prosody-hg: plugins/mod_saslauth.lua history

mod_saslauth: Use fully qualified import here too

Sun, 24 Nov 2024 14:53:49 +0100

mod_saslauth: Use fully qualified import here too

Looks like I forgot to update these when merging the channel binding
changes after the great renamening.

Ref #1223

mod_saslauth: Log when tls-exporter is NOT supported, as well as when it is

Wed, 17 Apr 2024 16:47:38 +0100

mod_saslauth: Log when tls-exporter is NOT supported, as well as when it is

mod_saslauth: Fire event per SASL step

Tue, 05 Dec 2023 11:39:11 +0000

mod_saslauth: Fire event per SASL step

This matches the behaviour of the newer mod_sasl2 implementation. It allows
plugins to observe (and potentially, with caution, modify) the SASL exchange.

mod_saslauth: Fire event at start of authentication attempt

Fri, 01 Dec 2023 23:43:18 +0100

mod_saslauth: Fire event at start of authentication attempt

As extension point for rate limiting and similar checks, so they can
hook a single event instead of <{sasl1}auth> or stream features, which
might not be fired in case of SASL2 or e.g. HTTP based login.

mod_saslauth: Allow plugins to override return SASL condition/text

Thu, 30 Nov 2023 11:22:40 +0000

mod_saslauth: Allow plugins to override return SASL condition/text

mod_saslauth: Clear 'auto' from endpoint hash var, it's not a real hash (thanks tmolitor)

Thu, 26 Oct 2023 18:30:47 +0100

mod_saslauth: Clear 'auto' from endpoint hash var, it's not a real hash (thanks tmolitor)

mod_saslauth, mod_c2s: Disable tls-server-end-point channel binding by default

Thu, 26 Oct 2023 15:14:39 +0100

mod_saslauth, mod_c2s: Disable tls-server-end-point channel binding by default

This channel binding method is now enabled when a hash is manually set in the
config, or it attempts to discover the hash automatically if the value is the
special string "auto".

A related change to mod_c2s prevents complicated certificate lookups in the
client connection hot path - this work now happens only when this channel
binding method is used. I'm not aware of anything else that uses ssl_cfg (vs
ssl_ctx).

Rationale for disabling by default:

- Minor performance impact in automatic cert detection
- This method is weak against a leaked/stolen private key (other methods such
as 'tls-exporter' would not be compromised in such a case)

Rationale for keeping the implementation:

- For some deployments, this may be the only method available (e.g. due to
TLS offloading in another process/server).

mod_saslauth: Fix traceback in tls-server-end-point channel binding

Thu, 26 Oct 2023 14:40:48 +0100

mod_saslauth: Fix traceback in tls-server-end-point channel binding

mod_saslauth: Actively close cert file after reading

Tue, 24 Oct 2023 09:24:01 +0100

mod_saslauth: Actively close cert file after reading

Explicit > implicit

mod_saslauth: Fix read format string (thanks tmolitor)

Tue, 24 Oct 2023 09:23:31 +0100

mod_saslauth: Fix read format string (thanks tmolitor)

mod_saslauth: Get correct 'tls-server-end-point' with new LuaSec API

Sun, 23 Oct 2022 02:49:05 +0200

mod_saslauth: Get correct 'tls-server-end-point' with new LuaSec API

MattJ contributed new APIs for retrieving the actually used certificate
and chain to LuaSec, which are not in a release at the time of this
commit.

mod_saslauth: Derive hash from certificate per tls-server-end-point

Tue, 29 Jun 2021 00:22:36 +0200

mod_saslauth: Derive hash from certificate per tls-server-end-point

This originally used a WIP implementation of cert:sigalg(), a method to
retrieve certificate signature algorithm, but it was never submitted
upstream. https://github.com/Zash/luasec/tree/zash/sigalg

cert:getsignaturename() was merged in
https://github.com/brunoos/luasec/commit/de393417b7c7566caf1e0a0ad54132942ac4f049

XEP-0440 v0.3.0 made implementing tls-server-end-point a MUST

mod_saslauth: Support tls-server-end-point via manually specified hash

Mon, 07 Dec 2020 19:53:26 +0100

mod_saslauth: Support tls-server-end-point via manually specified hash

Since this channel binding method is said to enable TLS offloading then
you need tell Prosody the hash (or the full cert), so this seems like a
good start.

Support is RECOMMENDED in XEP-0440 version 0.2

plugins: Prefix module imports with prosody namespace

Fri, 24 Mar 2023 13:15:28 +0100

plugins: Prefix module imports with prosody namespace

mod_saslauth: Support for SASL handlers forcing a specific resource

Wed, 01 Mar 2023 12:56:08 +0000

mod_saslauth: Support for SASL handlers forcing a specific resource

The token layer supports tokens that are tied to a given resource.

mod_saslauth: Put in stream:features per XEP-0440 0.4.0

Wed, 21 Sep 2022 15:00:06 +0100

mod_saslauth: Put in stream:features per XEP-0440 0.4.0

mod_saslauth: Fix incorrect variable name introduced in 27a4a7e64831

Sat, 03 Sep 2022 21:25:51 +0100

mod_saslauth: Fix incorrect variable name introduced in 27a4a7e64831

mod_saslauth: Only announce bind feature if no resource yet bound

Sat, 03 Sep 2022 21:19:00 +0100

mod_saslauth: Only announce bind feature if no resource yet bound

It's now possible to bind during SASL2 negotiation.

mod_saslauth: Rename field from 'scope'->'role'

Wed, 15 Jun 2022 11:47:39 +0100

mod_saslauth: Rename field from 'scope'->'role'

The 'scope' term derives from OAuth, and represents a bundle of permissions.
We're now setting on the term 'role' for a bundle of permissions.

This change does not affect any public modules I'm aware of.

mod_saslauth: Implement RFC 9266 'tls-exporter' channel binding (#1760)

Wed, 01 Jun 2022 15:06:59 +0200

mod_saslauth: Implement RFC 9266 'tls-exporter' channel binding (#1760)

Brings back SCRAM-SHA-*-PLUS from its hiatus brought on by the earlier
channel binding method being undefined for TLS 1.3, and the increasing
deployment of TLS 1.3.

See 1bfd238e05ad and #1542

Requires future version of LuaSec, once support for this key material
export method is merged.

See https://github.com/brunoos/luasec/pull/187

mod_saslauth: Advertise channel bindings via XEP-0440

Sun, 06 Dec 2020 22:04:43 +0100

mod_saslauth: Advertise channel bindings via XEP-0440

This is useful when there's more than one channel binding in
circulation, since perhaps there will be varying support for them.

net: isolate LuaSec-specifics

Wed, 27 Apr 2022 17:44:14 +0200

net: isolate LuaSec-specifics

For this, various accessor functions are now provided directly on the
sockets, which reach down into the LuaSec implementation to obtain the
information.

While this may seem of little gain at first, it hides the implementation
detail of the LuaSec+LuaSocket combination that the actual socket and
the TLS layer are separate objects.

The net gain here is that an alternative implementation does not have to
emulate that specific implementation detail and "only" has to expose
LuaSec-compatible data structures on the new functions.

usermanager, mod_saslauth: Default to internal_hashed if no auth module specified

Thu, 10 Feb 2022 19:54:14 +0000

usermanager, mod_saslauth: Default to internal_hashed if no auth module specified

The default config was updated in this way long ago, but if no option was
present in the config, Prosody would load internal_plain.

This change can result in changes (for the better) for people using very old
configuration files lacking an 'authentication' setting.

various: Require encryption by default for real

Sat, 25 Dec 2021 16:23:40 +0100

various: Require encryption by default for real

These options have been specified (and enabled) in the default config file for
a long time. However if unspecified in the config, they were not enabled. Now
they are.

This may result in a change of behaviour for people using very old config
files that lack the require_encryption options. But that's what we want.

s2s et al.: Add counters for connection state transitions

Wed, 21 Apr 2021 17:11:58 +0200

s2s et al.: Add counters for connection state transitions

Merge 0.11->trunk

Sat, 10 Apr 2021 16:45:44 +0200

Merge 0.11->trunk

mod_saslauth: Use a defined SASL error

Thu, 18 Mar 2021 16:16:54 +0100

mod_saslauth: Use a defined SASL error

mod_saslauth: Improve code style

Thu, 18 Mar 2021 16:17:45 +0100

mod_saslauth: Improve code style

This many returns deserve their own line.

`session["sasl_handler"]` style isn't used anywhere else.

mod_saslauth: Don't throw errors in async code when connections are gone

Thu, 18 Mar 2021 14:30:47 +0100

mod_saslauth: Don't throw errors in async code when connections are gone

Fixes #1515

Merge 0.11->trunk

Mon, 23 Nov 2020 21:56:26 +0100

Merge 0.11->trunk

mod_saslauth: Only advertise channel binding if a finished message is available

Mon, 23 Nov 2020 21:52:46 +0100

mod_saslauth: Only advertise channel binding if a finished message is available

In some cases this method returns nothing, unclear why.

mod_saslauth: Disable 'tls-unique' channel binding with TLS 1.3 (closes #1542)

Mon, 23 Nov 2020 21:42:52 +0100

mod_saslauth: Disable 'tls-unique' channel binding with TLS 1.3 (closes #1542)

The 'tls-unique' channel binding is undefined in TLS 1.3 according to a
single sentence in parenthesis in Apendix C of RFC 8446

This may trigger downgrade protection in clients that were expecting
channel binding to be available.

mod_saslauth: Pass through any auth scope from the SASL handler to sessionmanager.make_authenticated()

Wed, 05 Feb 2020 17:56:44 +0000

mod_saslauth: Pass through any auth scope from the SASL handler to sessionmanager.make_authenticated()

mod_saslauth: Set a nicer bounce error explaining SASL EXTERNAL failures

Sat, 07 Dec 2019 22:55:51 +0100

mod_saslauth: Set a nicer bounce error explaining SASL EXTERNAL failures

Better than the previous string concatenation of SASL failure condition
and optional text sent by the remote server.

Would be nice to have a text per condition, other than the probably most
common 'not-authorized'.

mod_saslauth: Collect SASL EXTERNAL failures into an util.error object

Sat, 07 Dec 2019 22:51:43 +0100

mod_saslauth: Collect SASL EXTERNAL failures into an util.error object

Will be easier than that concatenated string to extract info out of for
use elsewhere.

mod_saslauth: Advertise correct set of mechanisms

Mon, 02 Dec 2019 16:00:16 +0100

mod_saslauth: Advertise correct set of mechanisms

Mistakenly iterates over the set of all supported mechanisms instead of
the one without insecure mechanisms if the connection is insecure.

Not a problem if c2s_require_encryption is true

Introduced in 56a0f68b7797

mod_saslauth: Demote "no SASL mechanisms" error back to warning

Tue, 15 Oct 2019 23:38:29 +0200

mod_saslauth: Demote "no SASL mechanisms" error back to warning

This gets printed before TLS if c2s_require_encryption = false,
in which case it is just annoying.

mod_saslauth: Improve logging of why no SASL mechanisms were offered

Tue, 15 Oct 2019 22:05:51 +0200

mod_saslauth: Improve logging of why no SASL mechanisms were offered

mod_saslauth: Use the power of Set Theory to mange sets of SASL mechanisms

Tue, 15 Oct 2019 21:58:10 +0200

mod_saslauth: Use the power of Set Theory to mange sets of SASL mechanisms

This makes sets of excluded mechanisms easily available for use later.

mod_saslauth: Log (debug) messages about channel binding

Tue, 15 Oct 2019 21:37:19 +0200

mod_saslauth: Log (debug) messages about channel binding

mod_saslauth: Remove useless debug log line

Sun, 13 Oct 2019 00:33:35 +0200

mod_saslauth: Remove useless debug log line

Fairly useless to only log half of SASL messages.

Use mod_stanza_debug instead to get the full exchange.

mod_saslauth: Remove commented-out debug log line

Sun, 13 Oct 2019 00:32:58 +0200

mod_saslauth: Remove commented-out debug log line

plugins: Remove tostring call from logging

Tue, 30 Jul 2019 02:29:36 +0200

plugins: Remove tostring call from logging

Taken care of by loggingmanager now

Mass-rewrite using lua pattern like `tostring%b()`

Fix various spelling mistakes [codespell]

Fri, 03 May 2019 20:54:24 +0200

Fix various spelling mistakes [codespell]

mod_saslauth: Improve log message when no SASL mechanisms offered (thanks hexa)

Sat, 24 Nov 2018 02:24:48 +0100

mod_saslauth: Improve log message when no SASL mechanisms offered (thanks hexa)

mod_saslauth: Ignore unused argument [luacheck]

Sun, 04 Feb 2018 01:05:06 +0100

mod_saslauth: Ignore unused argument [luacheck]

mod_saslauth: Use renamed API for hooking non-stanzas

Sun, 04 Feb 2018 01:03:44 +0100

mod_saslauth: Use renamed API for hooking non-stanzas

mod_saslauth: Pass SASL EXTERNAL failure reason on to be used in error bounces

Sun, 04 Feb 2018 01:01:50 +0100

mod_saslauth: Pass SASL EXTERNAL failure reason on to be used in error bounces

mod_saslauth: Close connection if no fallback kicks in on SASL EXTERNAL failure

Sun, 04 Feb 2018 00:58:38 +0100

mod_saslauth: Close connection if no fallback kicks in on SASL EXTERNAL failure

Backed out changeset 89c42aff8510: The problem in ejabberd has reportedly been resolved and this change causes more problems than it solves (fixes #1006)

Sun, 04 Feb 2018 01:13:27 +0100

Backed out changeset 89c42aff8510: The problem in ejabberd has reportedly been resolved and this change causes more problems than it solves (fixes #1006)

mod_saslauth: Log which mechanisms are offered

Thu, 21 Dec 2017 10:15:47 +0100

mod_saslauth: Log which mechanisms are offered

Merge 0.9->0.10

Thu, 14 Sep 2017 02:47:40 +0200

Merge 0.9->0.10

mod_saslauth: Use correct varible name (thanks Roi)

Sat, 08 Jul 2017 18:21:45 +0200

mod_saslauth: Use correct varible name (thanks Roi)

mod_saslauth: Remove unused argument [luacheck]

Sat, 01 Apr 2017 22:34:15 +0200

mod_saslauth: Remove unused argument [luacheck]

mod_saslauth: Fix typoed variable name [luacheck]

Mon, 06 Mar 2017 16:05:24 +0100

mod_saslauth: Fix typoed variable name [luacheck]

mod_saslauth: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77

Mon, 06 Mar 2017 15:56:12 +0100

mod_saslauth: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77

Merge 0.9->0.10

Thu, 02 Mar 2017 15:21:07 +0100

Merge 0.9->0.10

mod_saslauth: Log SASL failure reason

Thu, 02 Mar 2017 15:17:32 +0100

mod_saslauth: Log SASL failure reason

mod_saslauth: Ignore shadowing of logger [luacheck]

Wed, 15 Feb 2017 23:04:44 +0100

mod_saslauth: Ignore shadowing of logger [luacheck]

mod_saslauth: Improve logging as to why when SASL is not offered

Wed, 15 Feb 2017 23:00:03 +0100

mod_saslauth: Improve logging as to why when SASL is not offered