prosody-modules: mod_watchuntrusted/mod_watchuntrusted.lua annotate

annotate mod_watchuntrusted/mod_watchuntrusted.lua @ 6562:5da6fb562df9 default tip

mod_unified_push: Fix push error handling (fixes #2000) Use the error object that send_iq() passes as an argument to it's reject callback instead of attempting and failing to do the parsing in the callback itself.

author	kmq
date	Mon, 06 Jul 2026 14:23:57 +0200
parents	021eff79a1f5
children

rev	line source
1188 5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	1 local jid_prep = require "util.jid".prep;
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	2
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	3 local secure_auth = module:get_option_boolean("s2s_secure_auth", false);
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	4 local secure_domains, insecure_domains =
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	5 module:get_option_set("s2s_secure_domains", {})._items, module:get_option_set("s2s_insecure_domains", {})._items;
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	6
3220 0e78523f8c20 mod_watchuntrusted: Add option to ignore domains Michel Le Bihan <michel@lebihan.pl> parents: 3022 diff changeset	7 local ignore_domains = module:get_option_set("untrusted_ignore_domains", {})._items;
0e78523f8c20 mod_watchuntrusted: Add option to ignore domains Michel Le Bihan <michel@lebihan.pl> parents: 3022 diff changeset	8
1188 5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	9 local untrusted_fail_watchers = module:get_option_set("untrusted_fail_watchers", module:get_option("admins", {})) / jid_prep;
6462 021eff79a1f5 mod_watchuntrusted/mod_watchuntrusted.lua: making luacheck happy Menel <menel@snikket.de> parents: 3220 diff changeset	10 local untrusted_fail_notification = module:get_option(
021eff79a1f5 mod_watchuntrusted/mod_watchuntrusted.lua: making luacheck happy Menel <menel@snikket.de> parents: 3220 diff changeset	11 "untrusted_fail_notification",
021eff79a1f5 mod_watchuntrusted/mod_watchuntrusted.lua: making luacheck happy Menel <menel@snikket.de> parents: 3220 diff changeset	12 "Establishing a secure connection from $from_host to $to_host failed. Certificate hash: $sha256. $errors"
021eff79a1f5 mod_watchuntrusted/mod_watchuntrusted.lua: making luacheck happy Menel <menel@snikket.de> parents: 3220 diff changeset	13 );
1188 5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	14
3022 3996437ff64f mod_watchuntrusted: Actually add the untrusted_message_type option Kim Alvefur <zash@zash.se> parents: 3020 diff changeset	15 local msg_type = module:get_option_string("untrusted_message_type", "chat");
3996437ff64f mod_watchuntrusted: Actually add the untrusted_message_type option Kim Alvefur <zash@zash.se> parents: 3020 diff changeset	16
1188 5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	17 local st = require "util.stanza";
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	18
1675 116488cced16 mod_watchuntrusted: Only notify once per host per day Kim Alvefur <zash@zash.se> parents: 1188 diff changeset	19 local notified_about_already = { };
116488cced16 mod_watchuntrusted: Only notify once per host per day Kim Alvefur <zash@zash.se> parents: 1188 diff changeset	20
1188 5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	21 module:hook_global("s2s-check-certificate", function (event)
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	22 local session, host = event.session, event.host;
1693 2328cbc41045 mod_watchuntrusted: Skip connections to/from unknown hosts (fixes possible traceback) Kim Alvefur <zash@zash.se> parents: 1675 diff changeset	23 if not host then return end
1188 5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	24 local conn = session.conn:socket();
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	25 local local_host = session.direction == "outgoing" and session.from_host or session.to_host;
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	26
6462 021eff79a1f5 mod_watchuntrusted/mod_watchuntrusted.lua: making luacheck happy Menel <menel@snikket.de> parents: 3220 diff changeset	27 if (local_host ~= module:get_host()) then return end
1188 5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	28
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	29 module:log("debug", "Checking certificate...");
3220 0e78523f8c20 mod_watchuntrusted: Add option to ignore domains Michel Le Bihan <michel@lebihan.pl> parents: 3022 diff changeset	30 local certificate_is_valid = false;
0e78523f8c20 mod_watchuntrusted: Add option to ignore domains Michel Le Bihan <michel@lebihan.pl> parents: 3022 diff changeset	31
0e78523f8c20 mod_watchuntrusted: Add option to ignore domains Michel Le Bihan <michel@lebihan.pl> parents: 3022 diff changeset	32 if session.cert_chain_status == "valid" and session.cert_identity_status == "valid" then
0e78523f8c20 mod_watchuntrusted: Add option to ignore domains Michel Le Bihan <michel@lebihan.pl> parents: 3022 diff changeset	33 certificate_is_valid = true;
0e78523f8c20 mod_watchuntrusted: Add option to ignore domains Michel Le Bihan <michel@lebihan.pl> parents: 3022 diff changeset	34 end
0e78523f8c20 mod_watchuntrusted: Add option to ignore domains Michel Le Bihan <michel@lebihan.pl> parents: 3022 diff changeset	35
1188 5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	36 local must_secure = secure_auth;
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	37
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	38 if not must_secure and secure_domains[host] then
3220 0e78523f8c20 mod_watchuntrusted: Add option to ignore domains Michel Le Bihan <michel@lebihan.pl> parents: 3022 diff changeset	39 must_secure = true;
1188 5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	40 elseif must_secure and insecure_domains[host] then
3220 0e78523f8c20 mod_watchuntrusted: Add option to ignore domains Michel Le Bihan <michel@lebihan.pl> parents: 3022 diff changeset	41 must_secure = false;
1188 5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	42 end
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	43
3220 0e78523f8c20 mod_watchuntrusted: Add option to ignore domains Michel Le Bihan <michel@lebihan.pl> parents: 3022 diff changeset	44 if must_secure and not certificate_is_valid and not notified_about_already[host] and not ignore_domains[host] then
1675 116488cced16 mod_watchuntrusted: Only notify once per host per day Kim Alvefur <zash@zash.se> parents: 1188 diff changeset	45 notified_about_already[host] = os.time();
1188 5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	46 local _, errors = conn:getpeerverification();
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	47 local error_message = "";
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	48
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	49 for depth, t in pairs(errors or {}) do
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	50 if #t > 0 then
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	51 error_message = error_message .. "Error with certificate " .. (depth - 1) .. ": " .. table.concat(t, ", ") .. ". ";
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	52 end
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	53 end
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	54
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	55 if session.cert_identity_status then
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	56 error_message = error_message .. "This certificate is " .. session.cert_identity_status .. " for " .. host .. ".";
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	57 end
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	58
1878 7f96183a60ce mod_watchuntrusted: Add support for SHA-256 hash in message Kim Alvefur <zash@zash.se> parents: 1877 diff changeset	59 local replacements = {
1926 4c4a4191b825 mod_watchuntrusted: Add a fallback string as hash if no certificate was provided Kim Alvefur <zash@zash.se> parents: 1878 diff changeset	60 sha1 = event.cert and event.cert:digest("sha1") or "(No certificate)",
4c4a4191b825 mod_watchuntrusted: Add a fallback string as hash if no certificate was provided Kim Alvefur <zash@zash.se> parents: 1878 diff changeset	61 sha256 = event.cert and event.cert:digest("sha256") or "(No certificate)",
1878 7f96183a60ce mod_watchuntrusted: Add support for SHA-256 hash in message Kim Alvefur <zash@zash.se> parents: 1877 diff changeset	62 errors = error_message
7f96183a60ce mod_watchuntrusted: Add support for SHA-256 hash in message Kim Alvefur <zash@zash.se> parents: 1877 diff changeset	63 };
1188 5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	64
3020 ec671ad1a8a9 mod_watchuntrusted: Add option for which message 'type' to use on notifications Kim Alvefur <zash@zash.se> parents: 2887 diff changeset	65 local message = st.message({ type = msg_type, from = local_host },
2887 65082d91950e Many modules: Simplify st.message(…):tag("body"):text(…):up() into st.message(…, …) Emmanuel Gil Peyrot <linkmauve@linkmauve.fr> parents: 2810 diff changeset	66 untrusted_fail_notification:gsub("%$([%w_]+)", function (v)
65082d91950e Many modules: Simplify st.message(…):tag("body"):text(…):up() into st.message(…, …) Emmanuel Gil Peyrot <linkmauve@linkmauve.fr> parents: 2810 diff changeset	67 return event[v] or session and session[v] or replacements and replacements[v] or nil;
65082d91950e Many modules: Simplify st.message(…):tag("body"):text(…):up() into st.message(…, …) Emmanuel Gil Peyrot <linkmauve@linkmauve.fr> parents: 2810 diff changeset	68 end));
1188 5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	69 for jid in untrusted_fail_watchers do
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	70 module:log("debug", "Notifying %s", jid);
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	71 message.attr.to = jid;
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	72 module:send(message);
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	73 end
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	74 end
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	75 end, -0.5);
5eaecb7f680d mod_watchuntrusted: New module that will warn admins about s2s connections that fail due to lack of encryption or invalid certificates. Thijs Alkemade <me@thijsalkema.de> parents: diff changeset	76
1675 116488cced16 mod_watchuntrusted: Only notify once per host per day Kim Alvefur <zash@zash.se> parents: 1188 diff changeset	77 module:add_timer(14400, function (now)
116488cced16 mod_watchuntrusted: Only notify once per host per day Kim Alvefur <zash@zash.se> parents: 1188 diff changeset	78 for host, time in pairs(notified_about_already) do
2346 dd1f0173f538 mod_watchuntrusted: Fix backwards time comparison Kim Alvefur <zash@zash.se> parents: 1926 diff changeset	79 if time + 86400 < now then
1675 116488cced16 mod_watchuntrusted: Only notify once per host per day Kim Alvefur <zash@zash.se> parents: 1188 diff changeset	80 notified_about_already[host] = nil;
116488cced16 mod_watchuntrusted: Only notify once per host per day Kim Alvefur <zash@zash.se> parents: 1188 diff changeset	81 end
116488cced16 mod_watchuntrusted: Only notify once per host per day Kim Alvefur <zash@zash.se> parents: 1188 diff changeset	82 end
1877 055b39c08fd0 mod_watchuntrusted: Fix periodic cleanup to run more than once Kim Alvefur <zash@zash.se> parents: 1693 diff changeset	83 return 14400;
1675 116488cced16 mod_watchuntrusted: Only notify once per host per day Kim Alvefur <zash@zash.se> parents: 1188 diff changeset	84 end)

Mercurial > prosody-modules

annotate mod_watchuntrusted/mod_watchuntrusted.lua @ 6562:5da6fb562df9 default tip