Commit graph

13812 commits

Author SHA1 Message Date
Kim Alvefur
9327c4342a Merge 0.12->trunk 2024-08-16 17:06:41 +02:00
Kim Alvefur
ffbf4e39d2 mod_s2s_bidi: Collect some metrics 2024-08-11 17:25:47 +02:00
Kim Alvefur
04f45b1afa mod_auth_internal_{hashed,plain}: Respect flag for disabled accounts in test_password()
This API method is used e.g. in HTTP modules which also should respect
disabled accounts.
2024-08-09 20:23:46 +02:00
Kim Alvefur
4f7c829b1e net.http: Throw error if missing TLS context for HTTPS request
Prevents the mistake of creating a http context without any TLS context
and then trying to use HTTPS, which doesn't work right.

Thanks nils
2024-08-08 19:18:22 +02:00
Kim Alvefur
73aed09475 mod_c2s,mod_s2s: Advertise idle-seconds per XEP-0478
This is the time after liveness checks are performed via the respective
read-timeout event, which by default involves sending a space character
but could be overridden e.g. as is done by mod_smacks.

Only advertised, unsure what we would do with it.
2024-08-03 16:28:59 +02:00
Emmanuel Gil Peyrot
a719f5897c mod_invites: Fix traceback when token_info isn’t set 2024-07-31 22:06:18 +02:00
Kim Alvefur
f7d0caa5ac util.prosodyctl.cert: Ensure old cert is moved out of the way
This should make it visible if the move fails
2024-08-30 17:41:40 +02:00
Kim Alvefur
cf446f4188 core.certmanager: Include ffdhe2048 from RFC 7919 as default DH param
This removes one manual (yet undocumented) step that was supposed to be
done to get a complete 'intermediate' configuration.

This file can be found on the Internet by searching for "ffdhe2048" and
can be verified by comparing the hexadecimal representation of p from
the RFC with the output of `openssl asn1parse`.

Given the preference and prevalence of ECDHE, it seems likely that few
would have noticed this.
2024-07-12 15:06:42 +02:00
Kim Alvefur
dd657746b4 util.sslconfig: Support DH parameters as literal string
Simplifies shipping well-known DH parameters in the config
2024-07-12 15:21:08 +02:00
Kim Alvefur
b9cfebff24 Merge 0.12->trunk 2024-07-11 15:25:57 +02:00
Kim Alvefur
bb278430cf util.xtemplate: Fix error on applying each() to zero stanzas
Backport of 1f93e4f78c53
2024-07-11 15:24:19 +02:00
Kim Alvefur
8a96854733 util.xtemplate: Fix error on applying each() to zero stanzas 2024-07-11 15:04:29 +02:00
Kim Alvefur
b522fd0e05 Merge 0.12->trunk 2024-07-07 18:40:25 +02:00
Kim Alvefur
ca417ab776 net.server_event: Add 'wrapserver' API
This enables accepting admin stream socket (UNIX) connections trough the
same procedures as any other (TCP) socket, which avoids problems caused
by using the wrapclient API, which ends up discarding early data due to
only expecting early connection failure.

Fixes #1867
2024-07-07 18:28:17 +02:00
Matthew Wild
29148cfe9c MUC: Don't default component admins to being room owners
This change has various technical and social benefits. If ownership of a MUC
is really needed, it can be gained using the 'Set affiliation' ad-hoc command
or prosodyctl shell.

Example client incompatibility with the old behaviour:

  - https://github.com/monal-im/Monal/issues/1085
2024-06-18 15:08:30 +01:00
Kim Alvefur
11bc995c0b scansion: Enable blocklist compat during tests to fix CI 2024-06-12 23:00:24 +02:00
Matthew Wild
aa6b79c20c MUC: Add per-room PM restriction functionality (thanks Wirlaburla)
Based on mod_muc_restrict_pm in prosody-modules d82c0383106a
2024-05-23 17:39:20 +01:00
Kim Alvefur
5915d6fbcd Merge 0.12->trunk 2024-06-12 23:20:48 +02:00
Kim Alvefur
935de9b5e7 scansion: Add roster groups setting to pubsub form in tests 2024-06-12 23:14:55 +02:00
Kim Alvefur
4701e73a72 util.prosodyctl: Use notify socket to wait for Prosody to be ready
Previously, prosodyctl only waits for the pidfile to appear, which does
not necessarily mean that Prosody is fully ready to receive traffic.

By waiting until Prosody says it's ready via the systemd notify socket
we know for sure that Prosody is really ready.

Notably this should ensure that when running `make integration-test`
Prosody is really ready when Scansion starts running tests.

Not sure if this timeout handling is optimal.
2024-05-19 13:06:55 +02:00
Kim Alvefur
2647c56106 net.server_epoll: Add support for systemd socket activation
Allows creating listening sockets and accepting client connections
before Prosody starts.
This is unlike normal Prosody dynamic resource management, where ports
may added and removed at any time, and the ports defined by the config.

Weird things happen if these are closed (e.g. due to reload) so here we
prevent closing and ensure sockets are reused when opened again.
2024-05-14 17:07:47 +02:00
Kim Alvefur
58af0798b7 Merge 0.12->trunk 2024-04-27 15:59:46 +02:00
Kim Alvefur
b8e4d5e840 util.x509: Per RFC 9525, remove obsolete Common Name check 2024-02-11 13:34:13 +01:00
Kim Alvefur
83ee7e5739 mod_pep: Implement 'roster' (group) access_model
Allows e.g. restricting your vcard4 to only family or similar.

Notes: This does not include roster groups in the configuration form,
so the client will have to get them from the actual roster.
2023-12-03 23:19:27 +01:00
Matthew Wild
5ef6234248 mod_announce: Suppress luacheck warnings 2024-04-26 10:37:20 +01:00
Matthew Wild
a839446a32 mod_announce: Add shell commands and APIs for sending to all/online/roles 2024-04-24 11:50:13 +01:00
Matthew Wild
272e700f50 prosodyctl shell: Fix invocation with 3+ command arguments
The code correctly inserted the ',' when there was already a "%q" in the
format string, but then the next argument would fail to match because it
inserted ", %q" instead of "%q". The code now matches both, ensuring the
generated code will not produce a syntax error with multiple arguments.
2024-04-24 11:45:37 +01:00
Kim Alvefur
cbd3982308 mod_blocklist: Fix fix signal for letting stanzas pass
Returning nothing/nil lets stanzas pass, returning anything else blocks
2024-04-23 20:01:41 +02:00
Matthew Wild
f94d5d2f7f mod_blocklist: Check JID of mediated MUC invite sender against blocklist
This ensures that someone on your blocklist is unable to invite you to MUC
rooms.
2024-04-22 11:26:20 +01:00
Matthew Wild
d1022fe0c4 mod_saslauth: Log when tls-exporter is NOT supported, as well as when it is 2024-04-17 16:47:38 +01:00
Kim Alvefur
f29bc1c119 net.unbound: Show canonical name in textual format (e.g. in shell)
libunbound does not tell us the whole chain of CNAMEs, only the final
canonical name.

This is to aid in debugging since it will only be shown in the shell.
2024-04-14 14:06:57 +02:00
Kim Alvefur
04a918233e mod_http_file_share: Fix expiry disabled check for new config API
Similar to 26c30844cac6
2024-04-08 16:44:11 +02:00
Kim Alvefur
a4f4acaa55 util.startup: Fix notifying config-reload to systemd
Does this event name seem backwards to anyone else?
2024-04-08 09:29:58 +02:00
Kim Alvefur
269d40f1ea mod_version: Fix uname result style (thanks riau)
`result[, err]`, not `ok, err|result`, must have confused it with pcall
2024-04-07 18:36:00 +02:00
Kim Alvefur
b438a292e9 mod_server_contact_info: Sort form fields to please scansion
The unstable hash table order caused the tests to fail and I don't know
how to tell scansion to ignore the order.
2024-04-06 16:51:27 +02:00
Kim Alvefur
0987a0113d mod_version: Handle access denied from uname()
Discovered while experimenting with a stricter SystemCallFilter setting
See man:systemd.exec(5)
2024-04-06 14:31:28 +02:00
aidan
5550be6381 mod_admin_shell: Add connection created time
This adds an output format option to show the time that the connection was created.

Ref #1852
2024-04-03 21:56:03 -07:00
Kim Alvefur
0c03df98fe Merge 0.12->trunk 2024-04-04 19:44:17 +02:00
Kim Alvefur
ec3655ced6 mod_invites_adhoc: Fix result form type (thanks betarays) 2024-04-04 19:39:33 +02:00
Kim Alvefur
502b8d3998 util.startup: Support systemd Type=notify service type
This lets Prosody report its lifecycle status to systemd, so it knows
when Prosody has completed its startup, when it's reloading and shutting
down.

Both Type=notify and Type=notify-reload is supported

Example systemd .service configuration snippet:

[Service]
Type=notify
2024-04-04 19:00:27 +02:00
Kim Alvefur
221f86f77f MUC: Fix legacy hats (thanks nicoco)
Why do we not have tests for this?
2024-03-28 15:39:59 +01:00
Kim Alvefur
8cdc5fb3a2 MUC: Switch to official XEP-0317 namespace for Hats (including compat) (thanks nicoco) 2024-03-28 15:26:57 +01:00
Kim Alvefur
e311f13c43 util.startup: Fix exiting on pidfile trouble
prosody.shutdown() relies on prosody.main_thread, which has not been set
yet at this point.

Doing a clean shutdown might actually be harmful in case it tears down
things set up by the conflicting Prosody, such as the very pidfile we
were looking at.

Thanks again SigmaTel71 for noticing
2024-03-27 19:33:11 +01:00
Matthew Wild
a8556c1875 Merge 0.12->trunk 2024-03-27 15:39:03 +00:00
Matthew Wild
655c972a7d prosodyctl check: Warn about invalid domain names in the config file
This ensures that domain names of virtual hosts and components are valid in
XMPP, and that they are encoded correctly.
2024-03-27 15:35:15 +00:00
Kim Alvefur
b41253bb49 util.startup: Abort before initialization of logging when started as root
Prevents creation of log files owned by the root user which could be
inaccessible once started correctly.
2024-03-24 21:32:00 +01:00
Kim Alvefur
78be92ab70 util.startup: Don't use not yet existent shutdown procedure when started as root (thanks SigmaTel71) 2024-03-24 21:31:47 +01:00
Kim Alvefur
e76620ad10 util.startup: Check root after detecting platform and reading config (thanks SigmaTel71)
Ensures that startup.detect_platform() runs so know whether to use the
POSIX method of checking the current user or something else. Also after
reading the config so we know whether the root override setting is set.
2024-03-24 20:39:42 +01:00
Kim Alvefur
c2c82a10d3 mod_posix: Move everything to util.startup
This allows greater control over the order of events.

Notably, the internal ordering between daemonization, initialization of
libunbound and setup of signal handling is sensitive.

libunbound starts a separate thread for processing DNS requests.
If this thread is started before signal handling has been set up, it
will not inherit the signal handlers and instead behave as it would have
before signal handlers were set up, i.e. cause the whole process to
immediately exit.

libunbound is usually initialized on the first DNS request, usually
triggered by an outgoing s2s connection attempt.

If daemonization happens before signals have been set up, signals may
not be processed at all.
2024-03-23 20:48:19 +01:00
Matthew Wild
2bc341d8b1 mod_bosh: Set base_type on session
This fixes a traceback with mod_saslauth. Ideally we move this to util.session
at some point, though.
2024-03-17 10:10:24 +00:00