1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
|
local configmanager = require "core.configmanager";
local show_usage = require "util.prosodyctl".show_usage;
local show_warning = require "util.prosodyctl".show_warning;
local is_prosody_running = require "util.prosodyctl".isrunning;
local dependencies = require "util.dependencies";
local socket = require "socket";
local socket_url = require "socket.url";
local jid_split = require "util.jid".prepped_split;
local modulemanager = require "core.modulemanager";
local async = require "util.async";
local httputil = require "util.http";
local function check_ojn(check_type, target_host)
local http = require "net.http"; -- .new({});
local json = require "util.json";
local response, err = async.wait_for(http.request(
("https://observe.jabber.network/api/v1/check/%s"):format(httputil.urlencode(check_type)),
{
method="POST",
headers={["Accept"] = "application/json"; ["Content-Type"] = "application/json"},
body=json.encode({target=target_host}),
}));
if not response then
return false, err;
end
if response.code ~= 200 then
return false, ("API replied with non-200 code: %d"):format(response.code);
end
local decoded_body, err = json.decode(response.body);
if decoded_body == nil then
return false, ("Failed to parse API JSON: %s"):format(err)
end
local success = decoded_body["success"];
return success == true, nil;
end
local function check_probe(base_url, probe_module, target)
local http = require "net.http"; -- .new({});
local params = httputil.formencode({ module = probe_module; target = target })
local response, err = async.wait_for(http.request(base_url .. "?" .. params));
if not response then return false, err; end
if response.code ~= 200 then return false, ("API replied with non-200 code: %d"):format(response.code); end
for line in response.body:gmatch("[^\r\n]+") do
local probe_success = line:match("^probe_success%s+(%d+)");
if probe_success == "1" then
return true;
elseif probe_success == "0" then
return false;
end
end
return false, "Probe endpoint did not return a success status";
end
local function skip_bare_jid_hosts(host)
if jid_split(host) then
-- See issue #779
return false;
end
return true;
end
local function check(arg)
if arg[1] == "--help" then
show_usage([[check]], [[Perform basic checks on your Prosody installation]]);
return 1;
end
local what = table.remove(arg, 1);
local array = require "util.array";
local set = require "util.set";
local it = require "util.iterators";
local ok = true;
local function disabled_hosts(host, conf) return host ~= "*" and conf.enabled ~= false; end
local function enabled_hosts() return it.filter(disabled_hosts, pairs(configmanager.getconfig())); end
if not (what == nil or what == "disabled" or what == "config" or what == "dns" or what == "certs" or what == "connectivity") then
show_warning("Don't know how to check '%s'. Try one of 'config', 'dns', 'certs', 'disabled' or 'connectivity'.", what);
show_warning("Note: The connectivity check will connect to a remote server.");
return 1;
end
if not what or what == "disabled" then
local disabled_hosts_set = set.new();
for host, host_options in it.filter("*", pairs(configmanager.getconfig())) do
if host_options.enabled == false then
disabled_hosts_set:add(host);
end
end
if not disabled_hosts_set:empty() then
local msg = "Checks will be skipped for these disabled hosts: %s";
if what then msg = "These hosts are disabled: %s"; end
show_warning(msg, tostring(disabled_hosts_set));
if what then return 0; end
print""
end
end
if not what or what == "config" then
print("Checking config...");
local obsolete = set.new({ --> remove
"archive_cleanup_interval",
"cross_domain_bosh",
"cross_domain_websocket",
"dns_timeout",
"muc_log_cleanup_interval",
"s2s_dns_resolvers",
"setgid",
"setuid",
});
local function instead_use(kind, name, value)
if kind == "option" then
if value then
return string.format("instead, use '%s = %q'", name, value);
else
return string.format("instead, use '%s'", name);
end
elseif kind == "module" then
return string.format("instead, add %q to '%s'", name, value or "modules_enabled");
elseif kind == "community" then
return string.format("instead, add %q from %s", name, value or "prosody-modules");
end
return kind
end
local deprecated_replacements = {
anonymous_login = instead_use("option", "authentication", "anonymous");
daemonize = "instead, use the --daemonize/-D or --foreground/-F command line flags";
disallow_s2s = instead_use("module", "s2s");
no_daemonize = "instead, use the --daemonize/-D or --foreground/-F command line flags";
require_encryption = "instead, use 'c2s_require_encryption' and 's2s_require_encryption'";
vcard_compatibility = instead_use("community", "mod_compat_vcard");
use_libevent = instead_use("option", "network_backend", "event");
whitelist_registration_only = instead_use("option", "allowlist_registration_only");
registration_whitelist = instead_use("option", "registration_allowlist");
registration_blacklist = instead_use("option", "registration_blocklist");
blacklist_on_registration_throttle_overload = instead_use("blocklist_on_registration_throttle_overload");
};
-- FIXME all the singular _port and _interface options are supposed to be deprecated too
local deprecated_ports = { bosh = "http", legacy_ssl = "c2s_direct_tls" };
local port_suffixes = set.new({ "port", "ports", "interface", "interfaces", "ssl" });
for port, replacement in pairs(deprecated_ports) do
for suffix in port_suffixes do
local rsuffix = (suffix == "port" or suffix == "interface") and suffix.."s" or suffix;
deprecated_replacements[port.."_"..suffix] = "instead, use '"..replacement.."_"..rsuffix.."'"
end
end
local deprecated = set.new(array.collect(it.keys(deprecated_replacements)));
local known_global_options = set.new({
"access_control_allow_credentials",
"access_control_allow_headers",
"access_control_allow_methods",
"access_control_max_age",
"admin_socket",
"body_size_limit",
"bosh_max_inactivity",
"bosh_max_polling",
"bosh_max_wait",
"buffer_size_limit",
"c2s_close_timeout",
"c2s_stanza_size_limit",
"c2s_tcp_keepalives",
"c2s_timeout",
"component_stanza_size_limit",
"component_tcp_keepalives",
"consider_bosh_secure",
"consider_websocket_secure",
"console_banner",
"console_prettyprint_settings",
"daemonize",
"gc",
"http_default_host",
"http_errors_always_show",
"http_errors_default_message",
"http_errors_detailed",
"http_errors_messages",
"http_max_buffer_size",
"http_max_content_size",
"installer_plugin_path",
"limits",
"limits_resolution",
"log",
"multiplex_buffer_size",
"network_backend",
"network_default_read_size",
"network_settings",
"openmetrics_allow_cidr",
"openmetrics_allow_ips",
"pidfile",
"plugin_paths",
"plugin_server",
"prosodyctl_timeout",
"prosody_group",
"prosody_user",
"run_as_root",
"s2s_close_timeout",
"s2s_insecure_domains",
"s2s_require_encryption",
"s2s_secure_auth",
"s2s_secure_domains",
"s2s_stanza_size_limit",
"s2s_tcp_keepalives",
"s2s_timeout",
"statistics",
"statistics_config",
"statistics_interval",
"tcp_keepalives",
"tls_profile",
"trusted_proxies",
"umask",
"use_dane",
"use_ipv4",
"use_ipv6",
"websocket_frame_buffer_limit",
"websocket_frame_fragment_limit",
"websocket_get_response_body",
"websocket_get_response_text",
});
local config = configmanager.getconfig();
-- Check that we have any global options (caused by putting a host at the top)
if it.count(it.filter("log", pairs(config["*"]))) == 0 then
ok = false;
print("");
print(" No global options defined. Perhaps you have put a host definition at the top")
print(" of the config file? They should be at the bottom, see https://prosody.im/doc/configure#overview");
end
if it.count(enabled_hosts()) == 0 then
ok = false;
print("");
if it.count(it.filter("*", pairs(config))) == 0 then
print(" No hosts are defined, please add at least one VirtualHost section")
elseif config["*"]["enabled"] == false then
print(" No hosts are enabled. Remove enabled = false from the global section or put enabled = true under at least one VirtualHost section")
else
print(" All hosts are disabled. Remove enabled = false from at least one VirtualHost section")
end
end
if not config["*"].modules_enabled then
print(" No global modules_enabled is set?");
local suggested_global_modules;
for host, options in enabled_hosts() do --luacheck: ignore 213/host
if not options.component_module and options.modules_enabled then
suggested_global_modules = set.intersection(suggested_global_modules or set.new(options.modules_enabled), set.new(options.modules_enabled));
end
end
if suggested_global_modules and not suggested_global_modules:empty() then
print(" Consider moving these modules into modules_enabled in the global section:")
print(" "..tostring(suggested_global_modules / function (x) return ("%q"):format(x) end));
end
print();
end
do -- Check for modules enabled both normally and as components
local modules = set.new(config["*"]["modules_enabled"]);
for host, options in enabled_hosts() do
local component_module = options.component_module;
if component_module and modules:contains(component_module) then
print((" mod_%s is enabled both in modules_enabled and as Component %q %q"):format(component_module, host, component_module));
print(" This means the service is enabled on all VirtualHosts as well as the Component.");
print(" Are you sure this what you want? It may cause unexpected behaviour.");
end
end
end
-- Check for global options under hosts
local global_options = set.new(it.to_array(it.keys(config["*"])));
local obsolete_global_options = set.intersection(global_options, obsolete);
if not obsolete_global_options:empty() then
print("");
print(" You have some obsolete options you can remove from the global section:");
print(" "..tostring(obsolete_global_options))
ok = false;
end
local deprecated_global_options = set.intersection(global_options, deprecated);
if not deprecated_global_options:empty() then
print("");
print(" You have some deprecated options in the global section:");
for option in deprecated_global_options do
print((" '%s' -- %s"):format(option, deprecated_replacements[option]));
end
ok = false;
end
for host, options in it.filter(function (h) return h ~= "*" end, pairs(configmanager.getconfig())) do
local host_options = set.new(it.to_array(it.keys(options)));
local misplaced_options = set.intersection(host_options, known_global_options);
for name in pairs(options) do
if name:match("^interfaces?")
or name:match("_ports?$") or name:match("_interfaces?$")
or (name:match("_ssl$") and not name:match("^[cs]2s_ssl$")) then
misplaced_options:add(name);
end
end
-- FIXME These _could_ be misplaced, but we would have to check where the corresponding module is loaded to be sure
misplaced_options:exclude(set.new({ "external_service_port", "turn_external_port" }));
if not misplaced_options:empty() then
ok = false;
print("");
local n = it.count(misplaced_options);
print(" You have "..n.." option"..(n>1 and "s " or " ").."set under "..host.." that should be");
print(" in the global section of the config file, above any VirtualHost or Component definitions,")
print(" see https://prosody.im/doc/configure#overview for more information.")
print("");
print(" You need to move the following option"..(n>1 and "s" or "")..": "..table.concat(it.to_array(misplaced_options), ", "));
end
end
for host, options in enabled_hosts() do
local host_options = set.new(it.to_array(it.keys(options)));
local subdomain = host:match("^[^.]+");
if not(host_options:contains("component_module")) and (subdomain == "jabber" or subdomain == "xmpp"
or subdomain == "chat" or subdomain == "im") then
print("");
print(" Suggestion: If "..host.. " is a new host with no real users yet, consider renaming it now to");
print(" "..host:gsub("^[^.]+%.", "")..". You can use SRV records to redirect XMPP clients and servers to "..host..".");
print(" For more information see: https://prosody.im/doc/dns");
end
end
local all_modules = set.new(config["*"].modules_enabled);
local all_options = set.new(it.to_array(it.keys(config["*"])));
for host in enabled_hosts() do
all_options:include(set.new(it.to_array(it.keys(config[host]))));
all_modules:include(set.new(config[host].modules_enabled));
end
for mod in all_modules do
if mod:match("^mod_") then
print("");
print(" Modules in modules_enabled should not have the 'mod_' prefix included.");
print(" Change '"..mod.."' to '"..mod:match("^mod_(.*)").."'.");
elseif mod:match("^auth_") then
print("");
print(" Authentication modules should not be added to modules_enabled,");
print(" but be specified in the 'authentication' option.");
print(" Remove '"..mod.."' from modules_enabled and instead add");
print(" authentication = '"..mod:match("^auth_(.*)").."'");
print(" For more information see https://prosody.im/doc/authentication");
elseif mod:match("^storage_") then
print("");
print(" storage modules should not be added to modules_enabled,");
print(" but be specified in the 'storage' option.");
print(" Remove '"..mod.."' from modules_enabled and instead add");
print(" storage = '"..mod:match("^storage_(.*)").."'");
print(" For more information see https://prosody.im/doc/storage");
end
end
if all_modules:contains("vcard") and all_modules:contains("vcard_legacy") then
print("");
print(" Both mod_vcard_legacy and mod_vcard are enabled but they conflict");
print(" with each other. Remove one.");
end
if all_modules:contains("pep") and all_modules:contains("pep_simple") then
print("");
print(" Both mod_pep_simple and mod_pep are enabled but they conflict");
print(" with each other. Remove one.");
end
for host, host_config in pairs(config) do --luacheck: ignore 213/host
if type(rawget(host_config, "storage")) == "string" and rawget(host_config, "default_storage") then
print("");
print(" The 'default_storage' option is not needed if 'storage' is set to a string.");
break;
end
end
local require_encryption = set.intersection(all_options, set.new({
"require_encryption", "c2s_require_encryption", "s2s_require_encryption"
})):empty();
local ssl = dependencies.softreq"ssl";
if not ssl then
if not require_encryption then
print("");
print(" You require encryption but LuaSec is not available.");
print(" Connections will fail.");
ok = false;
end
elseif not ssl.loadcertificate then
if all_options:contains("s2s_secure_auth") then
print("");
print(" You have set s2s_secure_auth but your version of LuaSec does ");
print(" not support certificate validation, so all s2s connections will");
print(" fail.");
ok = false;
elseif all_options:contains("s2s_secure_domains") then
local secure_domains = set.new();
for host in enabled_hosts() do
if config[host].s2s_secure_auth == true then
secure_domains:add("*");
else
secure_domains:include(set.new(config[host].s2s_secure_domains));
end
end
if not secure_domains:empty() then
print("");
print(" You have set s2s_secure_domains but your version of LuaSec does ");
print(" not support certificate validation, so s2s connections to/from ");
print(" these domains will fail.");
ok = false;
end
end
elseif require_encryption and not all_modules:contains("tls") then
print("");
print(" You require encryption but mod_tls is not enabled.");
print(" Connections will fail.");
ok = false;
end
do
local global_modules = set.new(config["*"].modules_enabled);
local registration_enabled_hosts = {};
for host in enabled_hosts() do
local host_modules = set.new(config[host].modules_enabled) + global_modules;
local allow_registration = config[host].allow_registration;
local mod_register = host_modules:contains("register");
local mod_register_ibr = host_modules:contains("register_ibr");
local mod_invites_register = host_modules:contains("invites_register");
local registration_invite_only = config[host].registration_invite_only;
local is_vhost = not config[host].component_module;
if is_vhost and (mod_register_ibr or (mod_register and allow_registration))
and not (mod_invites_register and registration_invite_only) then
table.insert(registration_enabled_hosts, host);
end
end
if #registration_enabled_hosts > 0 then
table.sort(registration_enabled_hosts);
print("");
print(" Public registration is enabled on:");
print(" "..table.concat(registration_enabled_hosts, ", "));
print("");
print(" If this is intentional, review our guidelines on running a public server");
print(" at https://prosody.im/doc/public_servers - otherwise, consider switching to");
print(" invite-based registration, which is more secure.");
end
end
do
local orphan_components = {};
local referenced_components = set.new();
local enabled_hosts_set = set.new();
for host, host_options in it.filter("*", pairs(configmanager.getconfig())) do
if host_options.enabled ~= false then
enabled_hosts_set:add(host);
for _, disco_item in ipairs(host_options.disco_items or {}) do
referenced_components:add(disco_item[1]);
end
end
end
for host, host_config in enabled_hosts() do
local is_component = not not host_config.component_module;
if is_component then
local parent_domain = host:match("^[^.]+%.(.+)$");
local is_orphan = not (enabled_hosts_set:contains(parent_domain) or referenced_components:contains(host));
if is_orphan then
table.insert(orphan_components, host);
end
end
end
if #orphan_components > 0 then
table.sort(orphan_components);
print("");
print(" Your configuration contains the following unreferenced components:\n");
print(" "..table.concat(orphan_components, "\n "));
print("");
print(" Clients may not be able to discover these services because they are not linked to");
print(" any VirtualHost. They are automatically linked if they are direct subdomains of a");
print(" VirtualHost. Alternatively, you can explicitly link them using the disco_items option.");
print(" For more information see https://prosody.im/doc/modules/mod_disco#items");
end
end
print("Done.\n");
end
if not what or what == "dns" then
local dns = require "net.dns";
pcall(function ()
local unbound = require"net.unbound";
local unbound_config = configmanager.get("*", "unbound") or {};
unbound_config.hoststxt = false; -- don't look at /etc/hosts
configmanager.set("*", "unbound", unbound_config);
unbound.dns.purge(); -- ensure the above config is used
dns = unbound.dns;
end)
local idna = require "util.encodings".idna;
local ip = require "util.ip";
local c2s_ports = set.new(configmanager.get("*", "c2s_ports") or {5222});
local s2s_ports = set.new(configmanager.get("*", "s2s_ports") or {5269});
local c2s_tls_ports = set.new(configmanager.get("*", "c2s_direct_tls_ports") or {});
local s2s_tls_ports = set.new(configmanager.get("*", "s2s_direct_tls_ports") or {});
if set.new(configmanager.get("*", "modules_enabled")):contains("net_multiplex") then
local multiplex_ports = set.new(configmanager.get("*", "ports") or {});
local multiplex_tls_ports = set.new(configmanager.get("*", "ssl_ports") or {});
if not multiplex_ports:empty() then
c2s_ports = c2s_ports + multiplex_ports;
s2s_ports = s2s_ports + multiplex_ports;
end
if not multiplex_tls_ports:empty() then
c2s_tls_ports = c2s_tls_ports + multiplex_tls_ports;
s2s_tls_ports = s2s_tls_ports + multiplex_tls_ports;
end
end
local c2s_srv_required, s2s_srv_required, c2s_tls_srv_required, s2s_tls_srv_required;
if not c2s_ports:contains(5222) then
c2s_srv_required = true;
end
if not s2s_ports:contains(5269) then
s2s_srv_required = true;
end
if not c2s_tls_ports:empty() then
c2s_tls_srv_required = true;
end
if not s2s_tls_ports:empty() then
s2s_tls_srv_required = true;
end
local problem_hosts = set.new();
local external_addresses, internal_addresses = set.new(), set.new();
local fqdn = socket.dns.tohostname(socket.dns.gethostname());
if fqdn then
do
local res = dns.lookup(idna.to_ascii(fqdn), "A");
if res then
for _, record in ipairs(res) do
external_addresses:add(record.a);
end
end
end
do
local res = dns.lookup(idna.to_ascii(fqdn), "AAAA");
if res then
for _, record in ipairs(res) do
external_addresses:add(record.aaaa);
end
end
end
end
local local_addresses = require"util.net".local_addresses() or {};
for addr in it.values(local_addresses) do
if not ip.new_ip(addr).private then
external_addresses:add(addr);
else
internal_addresses:add(addr);
end
end
-- Allow admin to specify additional (e.g. undiscoverable) IP addresses in the config
for _, address in ipairs(configmanager.get("*", "external_addresses") or {}) do
external_addresses:add(address);
end
if external_addresses:empty() then
print("");
print(" Failed to determine the external addresses of this server. Checks may be inaccurate.");
c2s_srv_required, s2s_srv_required = true, true;
end
local v6_supported = not not socket.tcp6;
local use_ipv4 = configmanager.get("*", "use_ipv4") ~= false;
local use_ipv6 = v6_supported and configmanager.get("*", "use_ipv6") ~= false;
local function trim_dns_name(n)
return (n:gsub("%.$", ""));
end
local unknown_addresses = set.new();
for jid, host_options in enabled_hosts() do
local all_targets_ok, some_targets_ok = true, false;
local node, host = jid_split(jid);
local modules, component_module = modulemanager.get_modules_for_host(host);
if component_module then
modules:add(component_module);
end
local is_component = not not host_options.component_module;
print("Checking DNS for "..(is_component and "component" or "host").." "..jid.."...");
if node then
print("Only the domain part ("..host..") is used in DNS.")
end
local target_hosts = set.new();
if modules:contains("c2s") then
local res = dns.lookup("_xmpp-client._tcp."..idna.to_ascii(host)..".", "SRV");
if res and #res > 0 then
for _, record in ipairs(res) do
if record.srv.target == "." then -- TODO is this an error if mod_c2s is enabled?
print(" 'xmpp-client' service disabled by pointing to '.'"); -- FIXME Explain better what this is
break;
end
local target = trim_dns_name(record.srv.target);
target_hosts:add(target);
if not c2s_ports:contains(record.srv.port) then
print(" SRV target "..target.." contains unknown client port: "..record.srv.port);
end
end
else
if c2s_srv_required then
print(" No _xmpp-client SRV record found for "..host..", but it looks like you need one.");
all_targets_ok = false;
else
target_hosts:add(host);
end
end
end
if modules:contains("c2s") and c2s_tls_srv_required then
local res = dns.lookup("_xmpps-client._tcp."..idna.to_ascii(host)..".", "SRV");
if res and #res > 0 then
for _, record in ipairs(res) do
if record.srv.target == "." then -- TODO is this an error if mod_c2s is enabled?
print(" 'xmpps-client' service disabled by pointing to '.'"); -- FIXME Explain better what this is
break;
end
local target = trim_dns_name(record.srv.target);
target_hosts:add(target);
if not c2s_tls_ports:contains(record.srv.port) then
print(" SRV target "..target.." contains unknown Direct TLS client port: "..record.srv.port);
end
end
else
print(" No _xmpps-client SRV record found for "..host..", but it looks like you need one.");
all_targets_ok = false;
end
end
if modules:contains("s2s") then
local res = dns.lookup("_xmpp-server._tcp."..idna.to_ascii(host)..".", "SRV");
if res and #res > 0 then
for _, record in ipairs(res) do
if record.srv.target == "." then -- TODO Is this an error if mod_s2s is enabled?
print(" 'xmpp-server' service disabled by pointing to '.'"); -- FIXME Explain better what this is
break;
end
local target = trim_dns_name(record.srv.target);
target_hosts:add(target);
if not s2s_ports:contains(record.srv.port) then
print(" SRV target "..target.." contains unknown server port: "..record.srv.port);
end
end
else
if s2s_srv_required then
print(" No _xmpp-server SRV record found for "..host..", but it looks like you need one.");
all_targets_ok = false;
else
target_hosts:add(host);
end
end
end
if modules:contains("s2s") and s2s_tls_srv_required then
local res = dns.lookup("_xmpps-server._tcp."..idna.to_ascii(host)..".", "SRV");
if res and #res > 0 then
for _, record in ipairs(res) do
if record.srv.target == "." then -- TODO is this an error if mod_s2s is enabled?
print(" 'xmpps-server' service disabled by pointing to '.'"); -- FIXME Explain better what this is
break;
end
local target = trim_dns_name(record.srv.target);
target_hosts:add(target);
if not s2s_tls_ports:contains(record.srv.port) then
print(" SRV target "..target.." contains unknown Direct TLS server port: "..record.srv.port);
end
end
else
print(" No _xmpps-server SRV record found for "..host..", but it looks like you need one.");
all_targets_ok = false;
end
end
if target_hosts:empty() then
target_hosts:add(host);
end
if target_hosts:contains("localhost") then
print(" Target 'localhost' cannot be accessed from other servers");
target_hosts:remove("localhost");
end
local function check_address(target)
local A, AAAA = dns.lookup(idna.to_ascii(target), "A"), dns.lookup(idna.to_ascii(target), "AAAA");
local prob = {};
if use_ipv4 and not (A and #A > 0) then table.insert(prob, "A"); end
if use_ipv6 and not (AAAA and #AAAA > 0) then table.insert(prob, "AAAA"); end
return prob;
end
if modules:contains("proxy65") then
local proxy65_target = configmanager.get(host, "proxy65_address") or host;
if type(proxy65_target) == "string" then
local prob = check_address(proxy65_target);
if #prob > 0 then
print(" File transfer proxy "..proxy65_target.." has no "..table.concat(prob, "/")
.." record. Create one or set 'proxy65_address' to the correct host/IP.");
end
else
print(" proxy65_address for "..host.." should be set to a string, unable to perform DNS check");
end
end
local known_http_modules = set.new { "bosh"; "http_files"; "http_file_share"; "http_openmetrics"; "websocket" };
local function contains_match(hayset, needle)
for member in hayset do if member:find(needle) then return true end end
end
if modules:contains("http") or not set.intersection(modules, known_http_modules):empty()
or contains_match(modules, "^http_") or contains_match(modules, "_web$") then
local http_host = configmanager.get(host, "http_host") or host;
local http_internal_host = http_host;
local http_url = configmanager.get(host, "http_external_url");
if http_url then
local url_parse = require "socket.url".parse;
local external_url_parts = url_parse(http_url);
if external_url_parts then
http_host = external_url_parts.host;
else
print(" The 'http_external_url' setting is not a valid URL");
end
end
local prob = check_address(http_host);
if #prob > 1 then
print(" HTTP service " .. http_host .. " has no " .. table.concat(prob, "/") .. " record. Create one or change "
.. (http_url and "'http_external_url'" or "'http_host'").." to the correct host.");
end
if http_host ~= http_internal_host then
print(" Ensure the reverse proxy sets the HTTP Host header to '" .. http_internal_host .. "'");
end
end
if not use_ipv4 and not use_ipv6 then
print(" Both IPv6 and IPv4 are disabled, Prosody will not listen on any ports");
print(" nor be able to connect to any remote servers.");
all_targets_ok = false;
end
for target_host in target_hosts do
local host_ok_v4, host_ok_v6;
do
local res = dns.lookup(idna.to_ascii(target_host), "A");
if res then
for _, record in ipairs(res) do
if external_addresses:contains(record.a) then
some_targets_ok = true;
host_ok_v4 = true;
elseif internal_addresses:contains(record.a) then
host_ok_v4 = true;
some_targets_ok = true;
print(" "..target_host.." A record points to internal address, external connections might fail");
else
print(" "..target_host.." A record points to unknown address "..record.a);
unknown_addresses:add(record.a);
all_targets_ok = false;
end
end
end
end
do
local res = dns.lookup(idna.to_ascii(target_host), "AAAA");
if res then
for _, record in ipairs(res) do
if external_addresses:contains(record.aaaa) then
some_targets_ok = true;
host_ok_v6 = true;
elseif internal_addresses:contains(record.aaaa) then
host_ok_v6 = true;
some_targets_ok = true;
print(" "..target_host.." AAAA record points to internal address, external connections might fail");
else
print(" "..target_host.." AAAA record points to unknown address "..record.aaaa);
unknown_addresses:add(record.aaaa);
all_targets_ok = false;
end
end
end
end
if host_ok_v4 and not use_ipv4 then
print(" Host "..target_host.." does seem to resolve to this server but IPv4 has been disabled");
all_targets_ok = false;
end
if host_ok_v6 and not use_ipv6 then
print(" Host "..target_host.." does seem to resolve to this server but IPv6 has been disabled");
all_targets_ok = false;
end
local bad_protos = {}
if use_ipv4 and not host_ok_v4 then
table.insert(bad_protos, "IPv4");
end
if use_ipv6 and not host_ok_v6 then
table.insert(bad_protos, "IPv6");
end
if #bad_protos > 0 then
print(" Host "..target_host.." does not seem to resolve to this server ("..table.concat(bad_protos, "/")..")");
end
if host_ok_v6 and not v6_supported then
print(" Host "..target_host.." has AAAA records, but your version of LuaSocket does not support IPv6.");
print(" Please see https://prosody.im/doc/ipv6 for more information.");
elseif host_ok_v6 and not use_ipv6 then
print(" Host "..target_host.." has AAAA records, but IPv6 is disabled.");
-- TODO Tell them to drop the AAAA records or enable IPv6?
print(" Please see https://prosody.im/doc/ipv6 for more information.");
end
end
if not all_targets_ok then
print(" "..(some_targets_ok and "Only some" or "No").." targets for "..host.." appear to resolve to this server.");
if is_component then
print(" DNS records are necessary if you want users on other servers to access this component.");
end
problem_hosts:add(host);
end
print("");
end
if not problem_hosts:empty() then
if not unknown_addresses:empty() then
print("");
print("Some of your DNS records point to unknown IP addresses. This may be expected if your server");
print("is behind a NAT or proxy. The unrecognized addresses were:");
print("");
print(" Unrecognized: "..tostring(unknown_addresses));
print("");
print("The addresses we found on this system are:");
print("");
print(" Internal: "..tostring(internal_addresses));
print(" External: "..tostring(external_addresses));
end
print("");
print("For more information about DNS configuration please see https://prosody.im/doc/dns");
print("");
ok = false;
end
end
if not what or what == "certs" then
local cert_ok;
print"Checking certificates..."
local x509_verify_identity = require"util.x509".verify_identity;
local create_context = require "core.certmanager".create_context;
local ssl = dependencies.softreq"ssl";
-- local datetime_parse = require"util.datetime".parse_x509;
local load_cert = ssl and ssl.loadcertificate;
-- or ssl.cert_from_pem
if not ssl then
print("LuaSec not available, can't perform certificate checks")
if what == "certs" then cert_ok = false end
elseif not load_cert then
print("This version of LuaSec (" .. ssl._VERSION .. ") does not support certificate checking");
cert_ok = false
else
for host in it.filter(skip_bare_jid_hosts, enabled_hosts()) do
print("Checking certificate for "..host);
-- First, let's find out what certificate this host uses.
local host_ssl_config = configmanager.rawget(host, "ssl")
or configmanager.rawget(host:match("%.(.*)"), "ssl");
local global_ssl_config = configmanager.rawget("*", "ssl");
local ok, err, ssl_config = create_context(host, "server", host_ssl_config, global_ssl_config);
if not ok then
print(" Error: "..err);
cert_ok = false
elseif not ssl_config.certificate then
print(" No 'certificate' found for "..host)
cert_ok = false
elseif not ssl_config.key then
print(" No 'key' found for "..host)
cert_ok = false
else
local key, err = io.open(ssl_config.key); -- Permissions check only
if not key then
print(" Could not open "..ssl_config.key..": "..err);
cert_ok = false
else
key:close();
end
local cert_fh, err = io.open(ssl_config.certificate); -- Load the file.
if not cert_fh then
print(" Could not open "..ssl_config.certificate..": "..err);
cert_ok = false
else
print(" Certificate: "..ssl_config.certificate)
local cert = load_cert(cert_fh:read"*a"); cert_fh:close();
if not cert:validat(os.time()) then
print(" Certificate has expired.")
cert_ok = false
elseif not cert:validat(os.time() + 86400) then
print(" Certificate expires within one day.")
cert_ok = false
elseif not cert:validat(os.time() + 86400*7) then
print(" Certificate expires within one week.")
elseif not cert:validat(os.time() + 86400*31) then
print(" Certificate expires within one month.")
end
if configmanager.get(host, "component_module") == nil
and not x509_verify_identity(host, "_xmpp-client", cert) then
print(" Not valid for client connections to "..host..".")
cert_ok = false
end
if (not (configmanager.get(host, "anonymous_login")
or configmanager.get(host, "authentication") == "anonymous"))
and not x509_verify_identity(host, "_xmpp-server", cert) then
print(" Not valid for server-to-server connections to "..host..".")
cert_ok = false
end
end
end
end
end
if cert_ok == false then
print("")
print("For more information about certificates please see https://prosody.im/doc/certificates");
ok = false
end
print("")
end
-- intentionally not doing this by default
if what == "connectivity" then
local _, prosody_is_running = is_prosody_running();
if configmanager.get("*", "pidfile") and not prosody_is_running then
print("Prosody does not appear to be running, which is required for this test.");
print("Start it and then try again.");
return 1;
end
local checker = "observe.jabber.network";
local probe_instance;
local probe_modules = {
["xmpp-client"] = "c2s_normal_auth";
["xmpp-server"] = "s2s_normal";
["xmpps-client"] = nil; -- TODO
["xmpps-server"] = nil; -- TODO
};
local probe_settings = configmanager.get("*", "connectivity_probe");
if type(probe_settings) == "string" then
probe_instance = probe_settings;
elseif type(probe_settings) == "table" and type(probe_settings.url) == "string" then
probe_instance = probe_settings.url;
if type(probe_settings.modules) == "table" then
probe_modules = probe_settings.modules;
end
elseif probe_settings ~= nil then
print("The 'connectivity_probe' setting not understood.");
print("Expected an URL or a table with 'url' and 'modules' fields");
print("See https://prosody.im/doc/prosodyctl#check for more information."); -- FIXME
return 1;
end
local check_api;
if probe_instance then
local parsed_url = socket_url.parse(probe_instance);
if not parsed_url then
print(("'connectivity_probe' is not a valid URL: %q"):format(probe_instance));
print("Set it to the URL of an XMPP Blackbox Exporter instance and try again");
return 1;
end
checker = parsed_url.host;
function check_api(protocol, host)
local target = socket_url.build({scheme="xmpp",path=host});
local probe_module = probe_modules[protocol];
if not probe_module then
return nil, "Checking protocol '"..protocol.."' is currently unsupported";
end
return check_probe(probe_instance, probe_module, target);
end
else
check_api = check_ojn;
end
for host in it.filter(skip_bare_jid_hosts, enabled_hosts()) do
local modules, component_module = modulemanager.get_modules_for_host(host);
if component_module then
modules:add(component_module)
end
print("Checking external connectivity for "..host.." via "..checker)
local function check_connectivity(protocol)
local success, err = check_api(protocol, host);
if not success and err ~= nil then
print((" %s: Failed to request check at API: %s"):format(protocol, err))
elseif success then
print((" %s: Works"):format(protocol))
else
print((" %s: Check service failed to establish (secure) connection"):format(protocol))
ok = false
end
end
if modules:contains("c2s") then
check_connectivity("xmpp-client")
if configmanager.get("*", "c2s_direct_tls_ports") then
check_connectivity("xmpps-client");
end
end
if modules:contains("s2s") then
check_connectivity("xmpp-server")
if configmanager.get("*", "s2s_direct_tls_ports") then
check_connectivity("xmpps-server");
end
end
print()
end
print("Note: The connectivity check only checks the reachability of the domain.")
print("Note: It does not ensure that the check actually reaches this specific prosody instance.")
end
if not ok then
print("Problems found, see above.");
else
print("All checks passed, congratulations!");
end
return ok and 0 or 2;
end
return {
check = check;
};
|