Mercurial > prosody-hg

comparison core/certmanager.lua @ 11200:bf8f2da84007

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Merge 0.11->trunk
author Kim Alvefur <zash@zash.se>
date Thu, 05 Nov 2020 22:31:25 +0100
parents 8cde06b38fdb
children 0bc3acf37428
comparison
equal deleted inserted replaced
11199:6c7c50a4de32 11200:bf8f2da84007
18 end 18 end
19 19
20 local configmanager = require "core.configmanager"; 20 local configmanager = require "core.configmanager";
21 local log = require "util.logger".init("certmanager"); 21 local log = require "util.logger".init("certmanager");
22 local ssl_context = ssl.context or softreq"ssl.context"; 22 local ssl_context = ssl.context or softreq"ssl.context";
23 local ssl_x509 = ssl.x509 or softreq"ssl.x509";
24 local ssl_newcontext = ssl.newcontext; 23 local ssl_newcontext = ssl.newcontext;
25 local new_config = require"util.sslconfig".new; 24 local new_config = require"util.sslconfig".new;
26 local stat = require "lfs".attributes; 25 local stat = require "lfs".attributes;
27 26
28 local tonumber, tostring = tonumber, tostring; 27 local tonumber, tostring = tonumber, tostring;
36 local resolve_path = require"util.paths".resolve_relative_path; 35 local resolve_path = require"util.paths".resolve_relative_path;
37 local config_path = prosody.paths.config or "."; 36 local config_path = prosody.paths.config or ".";
38 37
39 local luasec_major, luasec_minor = ssl._VERSION:match("^(%d+)%.(%d+)"); 38 local luasec_major, luasec_minor = ssl._VERSION:match("^(%d+)%.(%d+)");
40 local luasec_version = tonumber(luasec_major) * 100 + tonumber(luasec_minor); 39 local luasec_version = tonumber(luasec_major) * 100 + tonumber(luasec_minor);
40 -- TODO Use ssl.config instead of require here once we are sure that the fix
41 -- in LuaSec has been widely distributed
42 -- https://github.com/brunoos/luasec/issues/149
41 local luasec_has = softreq"ssl.config" or { 43 local luasec_has = softreq"ssl.config" or {
42 algorithms = { 44 algorithms = {
43 ec = luasec_version >= 5; 45 ec = luasec_version >= 5;
44 }; 46 };
45 capabilities = { 47 capabilities = {
106 -- Built-in defaults 108 -- Built-in defaults
107 local core_defaults = { 109 local core_defaults = {
108 capath = "/etc/ssl/certs"; 110 capath = "/etc/ssl/certs";
109 depth = 9; 111 depth = 9;
110 protocol = "tlsv1+"; 112 protocol = "tlsv1+";
111 verify = (ssl_x509 and { "peer", "client_once", }) or "none"; 113 verify = "none";
112 options = { 114 options = {
113 cipher_server_preference = luasec_has.options.cipher_server_preference; 115 cipher_server_preference = luasec_has.options.cipher_server_preference;
114 no_ticket = luasec_has.options.no_ticket; 116 no_ticket = luasec_has.options.no_ticket;
115 no_compression = luasec_has.options.no_compression and configmanager.get("*", "ssl_compression") ~= true; 117 no_compression = luasec_has.options.no_compression and configmanager.get("*", "ssl_compression") ~= true;
116 single_dh_use = luasec_has.options.single_dh_use; 118 single_dh_use = luasec_has.options.single_dh_use;
148 150
149 local path_options = { -- These we pass through resolve_path() 151 local path_options = { -- These we pass through resolve_path()
150 key = true, certificate = true, cafile = true, capath = true, dhparam = true 152 key = true, certificate = true, cafile = true, capath = true, dhparam = true
151 } 153 }
152 154
153 if luasec_version < 5 and ssl_x509 then
154 -- COMPAT mw/luasec-hg
155 for i=1,#core_defaults.verifyext do -- Remove lsec_ prefix
156 core_defaults.verify[#core_defaults.verify+1] = core_defaults.verifyext[i]:sub(6);
157 end
158 end
159
160 local function create_context(host, mode, ...) 155 local function create_context(host, mode, ...)
161 local cfg = new_config(); 156 local cfg = new_config();
162 cfg:apply(core_defaults); 157 cfg:apply(core_defaults);
163 local service_name, port = host:match("^(%S+) port (%d+)$"); 158 local service_name, port = host:match("^(%S+) port (%d+)$");
164 if service_name then 159 if service_name then
177 cfg:apply(select(i, ...)); 172 cfg:apply(select(i, ...));
178 end 173 end
179 local user_ssl_config = cfg:final(); 174 local user_ssl_config = cfg:final();
180 175
181 if mode == "server" then 176 if mode == "server" then
182 if not user_ssl_config.certificate then return nil, "No certificate present in SSL/TLS configuration for "..host; end 177 if not user_ssl_config.certificate then
183 if not user_ssl_config.key then return nil, "No key present in SSL/TLS configuration for "..host; end 178 log("info", "No certificate present in SSL/TLS configuration for %s. SNI will be required.", host);
179 end
180 if user_ssl_config.certificate and not user_ssl_config.key then return nil, "No key present in SSL/TLS configuration for "..host; end
184 end 181 end
185 182
186 for option in pairs(path_options) do 183 for option in pairs(path_options) do
187 if type(user_ssl_config[option]) == "string" then 184 if type(user_ssl_config[option]) == "string" then
188 user_ssl_config[option] = resolve_path(config_path, user_ssl_config[option]); 185 user_ssl_config[option] = resolve_path(config_path, user_ssl_config[option]);
258 255
259 return { 256 return {
260 create_context = create_context; 257 create_context = create_context;
261 reload_ssl_config = reload_ssl_config; 258 reload_ssl_config = reload_ssl_config;
262 find_cert = find_cert; 259 find_cert = find_cert;
260 find_host_cert = find_host_cert;
263 }; 261 };