prosody-hg: plugins/mod_tls.lua history

mod_tls: Collect full certificate chain validation information

Tue, 01 Apr 2025 20:49:58 +0200

mod_tls: Collect full certificate chain validation information

Enabling at least one of the ssl.verifyext modes enables a callback that
collects all the errors, which are used by mod_s2s to report better
problem descriptions.

mod_tls: Enable Prosody's certificate checking for incoming s2s connections (fixes #1916) (thanks Damian, Zash)

Tue, 01 Apr 2025 17:26:56 +0100

mod_tls: Enable Prosody's certificate checking for incoming s2s connections (fixes #1916) (thanks Damian, Zash)

Various options in Prosody allow control over the behaviour of the certificate
verification process For example, some deployments choose to allow falling
back to traditional "dialback" authentication (XEP-0220), while others verify
via DANE, hard-coded fingerprints, or other custom plugins.

Implementing this flexibility requires us to override OpenSSL's default
certificate verification, to allow Prosody to verify the certificate itself,
apply custom policies and make decisions based on the outcome.

To enable our custom logic, we have to suppress OpenSSL's default behaviour of
aborting the connection with a TLS alert message. With LuaSec, this can be
achieved by using the verifyext "lsec_continue" flag.

We also need to use the lsec_ignore_purpose flag, because XMPP s2s uses server
certificates as "client" certificates (for mutual TLS verification in outgoing
s2s connections).

Commit 99d2100d2918 moved these settings out of the defaults and into mod_s2s,
because we only really need these changes for s2s, and they should be opt-in,
rather than automatically applied to all TLS services we offer.

That commit was incomplete, because it only added the flags for incoming
direct TLS connections. StartTLS connections are handled by mod_tls, which was
not applying the lsec_* flags. It previously worked because they were already
in the defaults.

This resulted in incoming s2s connections with "invalid" certificates being
aborted early by OpenSSL, even if settings such as `s2s_secure_auth = false`
or DANE were present in the config.

Outgoing s2s connections inherit verify "none" from the defaults, which means
OpenSSL will receive the cert but will not terminate the connection when it is
deemed invalid. This means we don't need lsec_continue there, and we also
don't need lsec_ignore_purpose (because the remote peer is a "server").

Wondering why we can't just use verify "none" for incoming s2s? It's because
in that mode, OpenSSL won't request a certificate from the peer for incoming
connections. Setting verify "peer" is how you ask OpenSSL to request a
certificate from the client, but also what triggers its built-in verification.

plugins: Use boolean config method in some places

Tue, 18 Jul 2023 12:38:16 +0200

plugins: Use boolean config method in some places

Because it makes sense and improves feedback via logging

mod_tls: Drop request for client certificates on outgoing connections

Wed, 19 Apr 2023 11:14:11 +0200

mod_tls: Drop request for client certificates on outgoing connections

It is the other end who should request client certificates for these
connections, we only need to send ours. Hopefully this was treated as a
noop, so probably no harm in keeping it. But hey, spring cleaning? :)

plugins: Prefix module imports with prosody namespace

Fri, 24 Mar 2023 13:15:28 +0100

plugins: Prefix module imports with prosody namespace

mod_tls: Record STARTTLS state so it can be shown in Shell

Tue, 02 Aug 2022 19:26:26 +0200

mod_tls: Record STARTTLS state so it can be shown in Shell

This field can be viewed using s2s:show(nil, "... starttls") even
without any special support in mod_admin_shell, which can be added later
to make it nicer. One can then assume that a TLS connection with an
empty / nil starttls field means Direct TLS.

mod_tls: pass target hostname to starttls

Fri, 17 Sep 2021 21:43:54 +0200

mod_tls: pass target hostname to starttls

In case the network backend needs it for outgoing SNI or something.

mod_tls: tell network backend to stop reading while preparing TLS

Sat, 02 Apr 2022 11:18:57 +0200

mod_tls: tell network backend to stop reading while preparing TLS

mod_tls: Do not offer TLS if the connection is considered secure

Fri, 17 Sep 2021 21:18:30 +0200

mod_tls: Do not offer TLS if the connection is considered secure

This may be necessary if the session.conn object is not exchanged by the
network backend when establishing TLS. In that case, the starttls method
will always exist and thus that is not a good indicator for offering
TLS.

However, the secure bit already tells us that TLS has been established
or is not to be established on the connection, so we use that instead.

various: Require encryption by default for real

Sat, 25 Dec 2021 16:23:40 +0100

various: Require encryption by default for real

These options have been specified (and enabled) in the default config file for
a long time. However if unspecified in the config, they were not enabled. Now
they are.

This may result in a change of behaviour for people using very old config
files that lack the require_encryption options. But that's what we want.

mod_tls: Set ALPN on outgoing connections

Tue, 25 Jan 2022 13:20:26 +0100

mod_tls: Set ALPN on outgoing connections

Relevant and sometimes needed for Direct TLS which mod_s2s uses this
context for. Primarily when e.g. mod_net_multiplex or equivalent ALPN
based dispatch is used.

All these contexts should likely move away from mod_tls and into either
mod_s2s or portmanager. The later already duplicates some of this work.

mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls

Fri, 21 Jan 2022 18:42:38 +0100

mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls

So that the same TLS context is used for both Direct TLS and starttls,
since they are supposed to be functionally identical apart from the few
extra round trips.

A new event is added because the 's2s-created' event fires much later,
after a connection has already been established, where we need the TLS
context before that.

mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections

Wed, 01 Sep 2021 19:05:24 +0200

mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections

As suggested by RFC 7590

Fix various spelling errors (thanks codespell)

Tue, 27 Jul 2021 00:13:18 +0200

Fix various spelling errors (thanks codespell)

Also special thanks to timeless, for wordlessly reminding me to check
for typos.

mod_tls: Add "support" for by closing gracefully

Fri, 21 May 2021 19:04:01 +0200

mod_tls: Add "support" for by closing gracefully

Nicer than the "unsupported stanza type" error we get otherwise.

mod_tls: Fix order of debug messages and tls context creation

Wed, 05 May 2021 16:25:33 +0200

mod_tls: Fix order of debug messages and tls context creation

Originally added in 5b048ccd106f
Merged wrong in ca01c449357f

mod_tls: Bail out if session got destroyed while sending

Thu, 15 Apr 2021 15:57:24 +0200

mod_tls: Bail out if session got destroyed while sending

Can happen in case opportunistic_writes is enabled and the session got
destroyed while writing that tag.

Thanks Ge0rG

mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set

Fri, 29 Jan 2021 23:23:25 +0100

mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set

mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590

Fri, 29 Jan 2021 23:17:08 +0100

mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590

Merge 0.11->trunk

Sun, 26 Apr 2020 21:03:40 +0200

Merge 0.11->trunk

mod_tls: Log when certificates are (re)loaded

Sun, 26 Apr 2020 20:58:51 +0200

mod_tls: Log when certificates are (re)loaded

Meant to reduce user confusion over what's reloaded and not.

Merge 0.11->trunk

Wed, 24 Apr 2019 18:06:48 +0200

Merge 0.11->trunk

mod_tls: Log debug message for each kind of TLS context created

Tue, 23 Apr 2019 19:13:50 +0200

mod_tls: Log debug message for each kind of TLS context created

Creating TLS contexts triggers a lot of messages from certmanager that
don't really describe their purpose. This is meant to provide hints
about that.

mod_tls: Restore querying for certificates on s2s

Mon, 11 Mar 2019 13:07:59 +0100

mod_tls: Restore querying for certificates on s2s

The 'ssl_config' setting in the mod_s2s network service is not used.
Only direct TLS ports use this currently.

mod_tls: Keep TLS context errors and repeat them again for each session

Fri, 28 Dec 2018 00:04:26 +0100

mod_tls: Keep TLS context errors and repeat them again for each session

mod_tls: Rebuild SSL context objects on configuration reload - #701

Tue, 25 Apr 2017 21:50:36 +0200

mod_tls: Rebuild SSL context objects on configuration reload - #701

mod_tls: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77

Mon, 06 Mar 2017 15:55:37 +0100

mod_tls: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77

mod_tls: Suppress debug message if already using encryption

Sat, 25 Feb 2017 01:16:31 +0100

mod_tls: Suppress debug message if already using encryption

mod_tls: Log reasons for not being able to do TLS

Wed, 15 Feb 2017 23:03:22 +0100

mod_tls: Log reasons for not being able to do TLS

mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias)

Fri, 27 Jan 2017 12:21:09 +0100

mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias)

mod_tls: Return session.ssl_ctx if not nil, like when doing the full session type check

Wed, 25 Jan 2017 11:12:43 +0100

mod_tls: Return session.ssl_ctx if not nil, like when doing the full session type check

mod_tls: Add debug logging for when TLS should be doable but no ssl context was set

Wed, 25 Jan 2017 11:06:30 +0100

mod_tls: Add debug logging for when TLS should be doable but no ssl context was set

mod_tls: Verify that TLS is available before proceeding

Mon, 23 Jan 2017 10:46:42 +0100

mod_tls: Verify that TLS is available before proceeding

mod_tls: Only accept on outgoing s2s connections

Mon, 23 Jan 2017 10:45:20 +0100

mod_tls: Only accept on outgoing s2s connections

mod_tls: Ignore unused argument [luacheck]

Wed, 02 Nov 2016 23:19:41 +0100

mod_tls: Ignore unused argument [luacheck]

mod_tls: Fix ssl option fallback to a "parent" host if current host does not have ssl options set (thanks 70b1)

Mon, 09 Nov 2015 13:40:06 +0100

mod_tls: Fix ssl option fallback to a "parent" host if current host does not have ssl options set (thanks 70b1)

mod_tls: Remove unused reference to global ssl config option (certmanager adds that to the context)

Mon, 09 Nov 2015 13:39:23 +0100

mod_tls: Remove unused reference to global ssl config option (certmanager adds that to the context)

mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)

Tue, 15 Sep 2015 17:51:56 +0200

mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)

mod_tls: Treat session.ssl_ctx being false as a signal that TLS is disabled

Mon, 18 May 2015 21:48:58 +0200

mod_tls: Treat session.ssl_ctx being false as a signal that TLS is disabled

mod_tls: Build as a stanza instead of with string concatenation

Mon, 18 May 2015 21:43:24 +0200

mod_tls: Build as a stanza instead of with string concatenation

certmanager, mod_tls: Return final ssl config as third return value (fix for c6caaa440e74, portmanager assumes non-falsy second return value is an error) (thanks deoren)

Sat, 22 Nov 2014 11:51:54 +0100

certmanager, mod_tls: Return final ssl config as third return value (fix for c6caaa440e74, portmanager assumes non-falsy second return value is an error) (thanks deoren)

mod_tls: Keep ssl config around and attach them to sessions

Wed, 19 Nov 2014 14:47:49 +0100

mod_tls: Keep ssl config around and attach them to sessions

mod_legacyauth, mod_saslauth, mod_tls: Pass require_encryption as default option to s2s_require_encryption so the later overrides the former

Tue, 21 Oct 2014 12:49:03 +0200

mod_legacyauth, mod_saslauth, mod_tls: Pass require_encryption as default option to s2s_require_encryption so the later overrides the former

mod_lastactivity, mod_legacyauth, mod_presence, mod_saslauth, mod_tls: Use the newer stanza:get_child APIs and optimize away some table lookups

Fri, 04 Jul 2014 22:52:34 +0200

mod_lastactivity, mod_legacyauth, mod_presence, mod_saslauth, mod_tls: Use the newer stanza:get_child APIs and optimize away some table lookups

mod_tls: Simplify and use new ssl config merging in certmanager

Thu, 03 Jul 2014 15:35:45 +0200

mod_tls: Simplify and use new ssl config merging in certmanager

Merge 0.9->0.10

Sat, 18 Jan 2014 18:46:12 +0000

Merge 0.9->0.10

mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ

Wed, 15 Jan 2014 22:47:50 +0100

mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ

mod_tls: Rename variables to be less confusing

Wed, 15 Jan 2014 21:57:15 +0100

mod_tls: Rename variables to be less confusing

Merge 0.9->0.10

Sun, 12 Jan 2014 06:19:37 -0500

Merge 0.9->0.10

mod_tls: Log error when TLS initialization fails

Sun, 12 Jan 2014 06:16:49 -0500

mod_tls: Log error when TLS initialization fails

Remove all trailing whitespace

Fri, 09 Aug 2013 17:48:21 +0200

Remove all trailing whitespace

mod_tls: Remove debug statement

Sun, 16 Jun 2013 15:01:31 +0200

mod_tls: Remove debug statement

mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections

Thu, 13 Jun 2013 17:47:45 +0200

mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections

mod_tls: More use of config sections removed

Sat, 23 Mar 2013 02:35:50 +0100

mod_tls: More use of config sections removed

mod_announce, mod_auth_anonymous, mod_c2s, mod_c2s, mod_component, mod_iq, mod_message, mod_presence, mod_tls: Access prosody.{hosts,bare_sessions,full_sessions} instead of the old globals

Sat, 23 Mar 2013 01:27:16 +0100

mod_announce, mod_auth_anonymous, mod_c2s, mod_c2s, mod_component, mod_iq, mod_message, mod_presence, mod_tls: Access prosody.{hosts,bare_sessions,full_sessions} instead of the old globals

mod_tls: Fix log statement (thanks Zash)

Wed, 18 Jan 2012 15:07:26 +0000

mod_tls: Fix log statement (thanks Zash)

mod_tls: Fix for components to more reliably inherit SSL settings from their parenthost (thanks Link Mauve)

Wed, 06 Apr 2011 14:45:44 +0100

mod_tls: Fix for components to more reliably inherit SSL settings from their parenthost (thanks Link Mauve)

mod_tls: Drop 'TLS negotiation started for ...' to debug level from info

Tue, 22 Feb 2011 18:29:35 +0000

mod_tls: Drop 'TLS negotiation started for ...' to debug level from info

mod_tls: Let hosts without an 'ssl' option inherit it from their parent hosts.

Wed, 10 Nov 2010 02:26:18 +0500

mod_tls: Let hosts without an 'ssl' option inherit it from their parent hosts.

mod_tls: Pass the hostname rather than host session to certmanager.create_context() (thanks darkrain)

Mon, 08 Nov 2010 03:12:30 +0000

mod_tls: Pass the hostname rather than host session to certmanager.create_context() (thanks darkrain)