Mercurial > prosody-modules
annotate mod_auth_ccert/mod_auth_ccert.lua @ 6082:1a6cd0bbb7ab
mod_compliance_2023: Add 2023 Version of the compliance module, basis is the 2021 Version.
diff --git a/mod_compliance_2023/README.md b/mod_compliance_2023/README.md
new file mode 100644
--- /dev/null
+++ b/mod_compliance_2023/README.md
@@ -0,0 +1,22 @@
+---
+summary: XMPP Compliance Suites 2023 self-test
+labels:
+- Stage-Beta
+rockspec:
+ dependencies:
+ - mod_cloud_notify
+
+...
+
+Compare the list of enabled modules with
+[XEP-0479: XMPP Compliance Suites 2023] and produce basic report to the
+Prosody log file.
+
+If installed with the Prosody plugin installer then all modules needed for a green checkmark should be included. (With prosody 0.12 only [mod_cloud_notify] is not included with prosody and we need the community module)
+
+# Compatibility
+
+ Prosody-Version Status
+ --------------- ----------------------
+ trunk Works as of 2024-12-21
+ 0.12 Works
diff --git a/mod_compliance_2023/mod_compliance_2023.lua b/mod_compliance_2023/mod_compliance_2023.lua
new file mode 100644
--- /dev/null
+++ b/mod_compliance_2023/mod_compliance_2023.lua
@@ -0,0 +1,79 @@
+-- Copyright (c) 2021 Kim Alvefur
+--
+-- This module is MIT licensed.
+
+local hostmanager = require "core.hostmanager";
+
+local array = require "util.array";
+local set = require "util.set";
+
+local modules_enabled = module:get_option_inherited_set("modules_enabled");
+
+for host in pairs(hostmanager.get_children(module.host)) do
+ local component = module:context(host):get_option_string("component_module");
+ if component then
+ modules_enabled:add(component);
+ modules_enabled:include(module:context(host):get_option_set("modules_enabled", {}));
+ end
+end
+
+local function check(suggested, alternate, ...)
+ if set.intersection(modules_enabled, set.new({suggested; alternate; ...})):empty() then return suggested; end
+ return false;
+end
+
+local compliance = {
+ array {"Server"; check("tls"); check("disco")};
+
+ array {"Advanced Server"; check("pep", "pep_simple")};
+
+ array {"Web"; check("bosh"); check("websocket")};
+
+ -- No Server requirements for Advanced Web
+
+ array {"IM"; check("vcard_legacy", "vcard"); check("carbons"); check("http_file_share", "http_upload")};
+
+ array {
+ "Advanced IM";
+ check("vcard_legacy", "vcard");
+ check("blocklist");
+ check("muc");
+ check("private");
+ check("smacks");
+ check("mam");
+ check("bookmarks");
+ };
+
+ array {"Mobile"; check("smacks"); check("csi_simple", "csi_battery_saver")};
+
+ array {"Advanced Mobile"; check("cloud_notify")};
+
+ array {"A/V Calling"; check("turn_external", "external_services", "turncredentials", "extdisco")};
+
+};
+
+function check_compliance()
+ local compliant = true;
+ for _, suite in ipairs(compliance) do
+ local section = suite:pop(1);
+ if module:get_option_boolean("compliance_" .. section:lower():gsub("%A", "_"), true) then
+ local missing = set.new(suite:filter(function(m) return type(m) == "string" end):map(function(m) return "mod_" .. m end));
+ if suite[1] then
+ if compliant then
+ compliant = false;
+ module:log("warn", "Missing some modules for XMPP Compliance 2023");
+ end
+ module:log("info", "%s Compliance: %s", section, missing);
+ end
+ end
+ end
+
+ if compliant then module:log("info", "XMPP Compliance 2023: Compliant ✔️"); end
+end
+
+if prosody.start_time then
+ check_compliance()
+else
+ module:hook_global("server-started", check_compliance);
+end
+
| author | Menel <menel@snikket.de> |
|---|---|
| date | Sun, 22 Dec 2024 16:06:28 +0100 |
| parents | 86acfa44dc24 |
| children |
| rev | line source |
|---|---|
|
1062
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
1 -- Copyright (C) 2013 Kim Alvefur |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
2 -- |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
3 -- This file is MIT/X11 licensed. |
|
3041
86acfa44dc24
mod_auth_ccert: Silence warning about unused global [luacheck]
Kim Alvefur <zash@zash.se>
parents:
1325
diff
changeset
|
4 -- |
|
86acfa44dc24
mod_auth_ccert: Silence warning about unused global [luacheck]
Kim Alvefur <zash@zash.se>
parents:
1325
diff
changeset
|
5 -- luacheck: ignore 131/get_sasl_handler |
|
1062
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
6 |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
7 local jid_compare = require "util.jid".compare; |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
8 local jid_split = require "util.jid".prepped_split; |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
9 local new_sasl = require "util.sasl".new; |
|
1069
d7719bf1aed6
mod_auth_ccert: Add missing OID for email
Kim Alvefur <zash@zash.se>
parents:
1068
diff
changeset
|
10 local now = os.time; |
|
1062
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
11 local log = module._log; |
|
1069
d7719bf1aed6
mod_auth_ccert: Add missing OID for email
Kim Alvefur <zash@zash.se>
parents:
1068
diff
changeset
|
12 |
|
1062
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
13 local subject_alternative_name = "2.5.29.17"; |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
14 local id_on_xmppAddr = "1.3.6.1.5.5.7.8.5"; |
|
1069
d7719bf1aed6
mod_auth_ccert: Add missing OID for email
Kim Alvefur <zash@zash.se>
parents:
1068
diff
changeset
|
15 local oid_emailAddress = "1.2.840.113549.1.9.1"; |
|
1062
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
16 |
|
1065
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
17 local cert_match = module:get_option("certificate_match", "xmppaddr"); |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
18 |
|
1068
8ad0d234608c
mod_auth_ccert: Pass the session username-outfigurer function too
Kim Alvefur <zash@zash.se>
parents:
1067
diff
changeset
|
19 local username_extractor = {}; |
|
1065
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
20 |
|
1068
8ad0d234608c
mod_auth_ccert: Pass the session username-outfigurer function too
Kim Alvefur <zash@zash.se>
parents:
1067
diff
changeset
|
21 function username_extractor.xmppaddr(cert, authz, session) |
|
1065
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
22 local extensions = cert:extensions(); |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
23 local SANs = extensions[subject_alternative_name]; |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
24 local xmppAddrs = SANs and SANs[id_on_xmppAddr]; |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
25 |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
26 if not xmppAddrs then |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
27 (session.log or log)("warn", "Client certificate contains no xmppAddrs"); |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
28 return nil, false; |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
29 end |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
30 |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
31 for i=1,#xmppAddrs do |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
32 if authz == "" or jid_compare(authz, xmppAddrs[i]) then |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
33 (session.log or log)("debug", "xmppAddrs[%d] %q matches authz %q", i, xmppAddrs[i], authz) |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
34 local username, host = jid_split(xmppAddrs[i]); |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
35 if host == module.host then |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
36 return username, true |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
37 end |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
38 end |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
39 end |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
40 end |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
41 |
|
1066
83175a6af8c5
mod_auth_ccert: Add optional method for certificates which contain an email address
Kim Alvefur <zash@zash.se>
parents:
1065
diff
changeset
|
42 function username_extractor.email(cert) |
|
83175a6af8c5
mod_auth_ccert: Add optional method for certificates which contain an email address
Kim Alvefur <zash@zash.se>
parents:
1065
diff
changeset
|
43 local subject = cert:subject(); |
|
83175a6af8c5
mod_auth_ccert: Add optional method for certificates which contain an email address
Kim Alvefur <zash@zash.se>
parents:
1065
diff
changeset
|
44 for i=1,#subject do |
|
83175a6af8c5
mod_auth_ccert: Add optional method for certificates which contain an email address
Kim Alvefur <zash@zash.se>
parents:
1065
diff
changeset
|
45 local ava = subject[i]; |
|
83175a6af8c5
mod_auth_ccert: Add optional method for certificates which contain an email address
Kim Alvefur <zash@zash.se>
parents:
1065
diff
changeset
|
46 if ava.oid == oid_emailAddress then |
|
83175a6af8c5
mod_auth_ccert: Add optional method for certificates which contain an email address
Kim Alvefur <zash@zash.se>
parents:
1065
diff
changeset
|
47 local username, host = jid_split(ava.value); |
|
83175a6af8c5
mod_auth_ccert: Add optional method for certificates which contain an email address
Kim Alvefur <zash@zash.se>
parents:
1065
diff
changeset
|
48 if host == module.host then |
|
83175a6af8c5
mod_auth_ccert: Add optional method for certificates which contain an email address
Kim Alvefur <zash@zash.se>
parents:
1065
diff
changeset
|
49 return username, true |
|
83175a6af8c5
mod_auth_ccert: Add optional method for certificates which contain an email address
Kim Alvefur <zash@zash.se>
parents:
1065
diff
changeset
|
50 end |
|
83175a6af8c5
mod_auth_ccert: Add optional method for certificates which contain an email address
Kim Alvefur <zash@zash.se>
parents:
1065
diff
changeset
|
51 end |
|
83175a6af8c5
mod_auth_ccert: Add optional method for certificates which contain an email address
Kim Alvefur <zash@zash.se>
parents:
1065
diff
changeset
|
52 end |
|
83175a6af8c5
mod_auth_ccert: Add optional method for certificates which contain an email address
Kim Alvefur <zash@zash.se>
parents:
1065
diff
changeset
|
53 end |
|
83175a6af8c5
mod_auth_ccert: Add optional method for certificates which contain an email address
Kim Alvefur <zash@zash.se>
parents:
1065
diff
changeset
|
54 |
|
1065
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
55 local find_username = username_extractor[cert_match]; |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
56 if not find_username then |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
57 module:log("error", "certificate_match = %q is not supported"); |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
58 return |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
59 end |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
60 |
|
3d04d9377a67
mod_auth_ccert: Prepare for supporting more ways to figure out the username
Kim Alvefur <zash@zash.se>
parents:
1063
diff
changeset
|
61 |
|
1062
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
62 function get_sasl_handler(session) |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
63 return new_sasl(module.host, { |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
64 external = session.secure and function(authz) |
|
1325
b21236b6b8d8
Backed out changeset 853a382c9bd6
Kim Alvefur <zash@zash.se>
parents:
1324
diff
changeset
|
65 if not session.secure then |
|
1062
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
66 -- getpeercertificate() on a TCP connection would be bad, abort! |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
67 (session.log or log)("error", "How did you manage to select EXTERNAL without TLS?"); |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
68 return nil, false; |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
69 end |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
70 local sock = session.conn:socket(); |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
71 local cert = sock:getpeercertificate(); |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
72 if not cert then |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
73 (session.log or log)("warn", "No certificate provided"); |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
74 return nil, false; |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
75 end |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
76 |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
77 if not cert:validat(now()) then |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
78 (session.log or log)("warn", "Client certificate expired") |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
79 return nil, "expired"; |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
80 end |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
81 |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
82 local chain_valid, chain_errors = sock:getpeerverification(); |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
83 if not chain_valid then |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
84 (session.log or log)("warn", "Invalid client certificate chain"); |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
85 for i, error in ipairs(chain_errors) do |
|
1092
f46307e8e2f8
mod_auth_ccert: Use value from ipairs
Kim Alvefur <zash@zash.se>
parents:
1070
diff
changeset
|
86 (session.log or log)("warn", "%d: %s", i, table.concat(error, ", ")); |
|
1062
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
87 end |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
88 return nil, false; |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
89 end |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
90 |
|
1068
8ad0d234608c
mod_auth_ccert: Pass the session username-outfigurer function too
Kim Alvefur <zash@zash.se>
parents:
1067
diff
changeset
|
91 return find_username(cert, authz, session); |
|
1062
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
92 end |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
93 }); |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
94 end |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
95 |
|
f853a1a3aa15
mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
96 module:provides "auth"; |
