Mercurial > prosody-hg

comparison core/certmanager.lua @ 10411:db2a06b9ff98

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Merge 0.11->trunk
author Kim Alvefur <zash@zash.se>
date Sat, 16 Nov 2019 16:52:31 +0100
parents a36af4570b39
children fbeb7a3fc4eb
comparison
equal deleted inserted replaced
10410:659b577f280c 10411:db2a06b9ff98
18 end 18 end
19 19
20 local configmanager = require "core.configmanager"; 20 local configmanager = require "core.configmanager";
21 local log = require "util.logger".init("certmanager"); 21 local log = require "util.logger".init("certmanager");
22 local ssl_context = ssl.context or softreq"ssl.context"; 22 local ssl_context = ssl.context or softreq"ssl.context";
23 local ssl_x509 = ssl.x509 or softreq"ssl.x509";
24 local ssl_newcontext = ssl.newcontext; 23 local ssl_newcontext = ssl.newcontext;
25 local new_config = require"util.sslconfig".new; 24 local new_config = require"util.sslconfig".new;
26 local stat = require "lfs".attributes; 25 local stat = require "lfs".attributes;
27 26
28 local tonumber, tostring = tonumber, tostring; 27 local tonumber, tostring = tonumber, tostring;
104 -- Built-in defaults 103 -- Built-in defaults
105 local core_defaults = { 104 local core_defaults = {
106 capath = "/etc/ssl/certs"; 105 capath = "/etc/ssl/certs";
107 depth = 9; 106 depth = 9;
108 protocol = "tlsv1+"; 107 protocol = "tlsv1+";
109 verify = (ssl_x509 and { "peer", "client_once", }) or "none"; 108 verify = "none";
110 options = { 109 options = {
111 cipher_server_preference = luasec_has.options.cipher_server_preference; 110 cipher_server_preference = luasec_has.options.cipher_server_preference;
112 no_ticket = luasec_has.options.no_ticket; 111 no_ticket = luasec_has.options.no_ticket;
113 no_compression = luasec_has.options.no_compression and configmanager.get("*", "ssl_compression") ~= true; 112 no_compression = luasec_has.options.no_compression and configmanager.get("*", "ssl_compression") ~= true;
114 single_dh_use = luasec_has.options.single_dh_use; 113 single_dh_use = luasec_has.options.single_dh_use;
121 "P-384", 120 "P-384",
122 "P-256", 121 "P-256",
123 "P-521", 122 "P-521",
124 }; 123 };
125 ciphers = { -- Enabled ciphers in order of preference: 124 ciphers = { -- Enabled ciphers in order of preference:
125 "HIGH+kEECDH", -- Ephemeral Elliptic curve Diffie-Hellman key exchange
126 "HIGH+kEDH", -- Ephemeral Diffie-Hellman key exchange, if a 'dhparam' file is set 126 "HIGH+kEDH", -- Ephemeral Diffie-Hellman key exchange, if a 'dhparam' file is set
127 "HIGH+kEECDH", -- Ephemeral Elliptic curve Diffie-Hellman key exchange
128 "HIGH", -- Other "High strength" ciphers 127 "HIGH", -- Other "High strength" ciphers
129 -- Disabled cipher suites: 128 -- Disabled cipher suites:
130 "!PSK", -- Pre-Shared Key - not used for XMPP 129 "!PSK", -- Pre-Shared Key - not used for XMPP
131 "!SRP", -- Secure Remote Password - not used for XMPP 130 "!SRP", -- Secure Remote Password - not used for XMPP
132 "!3DES", -- 3DES - slow and of questionable security 131 "!3DES", -- 3DES - slow and of questionable security
145 end 144 end
146 145
147 local path_options = { -- These we pass through resolve_path() 146 local path_options = { -- These we pass through resolve_path()
148 key = true, certificate = true, cafile = true, capath = true, dhparam = true 147 key = true, certificate = true, cafile = true, capath = true, dhparam = true
149 } 148 }
150
151 if luasec_version < 5 and ssl_x509 then
152 -- COMPAT mw/luasec-hg
153 for i=1,#core_defaults.verifyext do -- Remove lsec_ prefix
154 core_defaults.verify[#core_defaults.verify+1] = core_defaults.verifyext[i]:sub(6);
155 end
156 end
157 149
158 local function create_context(host, mode, ...) 150 local function create_context(host, mode, ...)
159 local cfg = new_config(); 151 local cfg = new_config();
160 cfg:apply(core_defaults); 152 cfg:apply(core_defaults);
161 local service_name, port = host:match("^(%S+) port (%d+)$"); 153 local service_name, port = host:match("^(%S+) port (%d+)$");
175 cfg:apply(select(i, ...)); 167 cfg:apply(select(i, ...));
176 end 168 end
177 local user_ssl_config = cfg:final(); 169 local user_ssl_config = cfg:final();
178 170
179 if mode == "server" then 171 if mode == "server" then
180 if not user_ssl_config.certificate then return nil, "No certificate present in SSL/TLS configuration for "..host; end 172 if not user_ssl_config.certificate then
181 if not user_ssl_config.key then return nil, "No key present in SSL/TLS configuration for "..host; end 173 log("info", "No certificate present in SSL/TLS configuration for %s. SNI will be required.", host);
174 end
175 if user_ssl_config.certificate and not user_ssl_config.key then return nil, "No key present in SSL/TLS configuration for "..host; end
182 end 176 end
183 177
184 for option in pairs(path_options) do 178 for option in pairs(path_options) do
185 if type(user_ssl_config[option]) == "string" then 179 if type(user_ssl_config[option]) == "string" then
186 user_ssl_config[option] = resolve_path(config_path, user_ssl_config[option]); 180 user_ssl_config[option] = resolve_path(config_path, user_ssl_config[option]);