Kim Alvefur
91d95d4c33
plugins: Use boolean config method in some places
...
Because it makes sense and improves feedback via logging
2023-07-18 12:38:16 +02:00
Kim Alvefur
0d5af426ca
mod_tls: Drop request for client certificates on outgoing connections
...
It is the other end who should request client certificates for these
connections, we only need to send ours. Hopefully this was treated as a
noop, so probably no harm in keeping it. But hey, spring cleaning? :)
2023-04-19 11:14:11 +02:00
Kim Alvefur
98922d54b1
plugins: Prefix module imports with prosody namespace
2023-03-24 13:15:28 +01:00
Kim Alvefur
a2f8218a63
mod_tls: Record STARTTLS state so it can be shown in Shell
...
This field can be viewed using s2s:show(nil, "... starttls") even
without any special support in mod_admin_shell, which can be added later
to make it nicer. One can then assume that a TLS connection with an
empty / nil starttls field means Direct TLS.
2022-08-02 19:26:26 +02:00
Jonas Schäfer
84d748f94d
mod_tls: pass target hostname to starttls
...
In case the network backend needs it for outgoing SNI or something.
2021-09-17 21:43:54 +02:00
Jonas Schäfer
87d3cb2f33
mod_tls: tell network backend to stop reading while preparing TLS
2022-04-02 11:18:57 +02:00
Jonas Schäfer
85abab1dfd
mod_tls: Do not offer TLS if the connection is considered secure
...
This may be necessary if the session.conn object is not exchanged by the
network backend when establishing TLS. In that case, the starttls method
will always exist and thus that is not a good indicator for offering
TLS.
However, the secure bit already tells us that TLS has been established
or is not to be established on the connection, so we use that instead.
2021-09-17 21:18:30 +02:00
Kim Alvefur
73d1bb1218
various: Require encryption by default for real
...
These options have been specified (and enabled) in the default config file for
a long time. However if unspecified in the config, they were not enabled. Now
they are.
This may result in a change of behaviour for people using very old config
files that lack the require_encryption options. But that's what we want.
2021-12-25 16:23:40 +01:00
Kim Alvefur
c0be43a098
mod_tls: Set ALPN on outgoing connections
...
Relevant and sometimes needed for Direct TLS which mod_s2s uses this
context for. Primarily when e.g. mod_net_multiplex or equivalent ALPN
based dispatch is used.
All these contexts should likely move away from mod_tls and into either
mod_s2s or portmanager. The later already duplicates some of this work.
2022-01-25 13:20:26 +01:00
Kim Alvefur
90215f635b
mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls
...
So that the same TLS context is used for both Direct TLS and starttls,
since they are supposed to be functionally identical apart from the few
extra round trips.
A new event is added because the 's2s-created' event fires much later,
after a connection has already been established, where we need the TLS
context before that.
2022-01-21 18:42:38 +01:00
Kim Alvefur
e3c0a877bf
mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections
...
As suggested by RFC 7590
2021-09-01 19:05:24 +02:00
Kim Alvefur
c506269ff5
Fix various spelling errors (thanks codespell)
...
Also special thanks to timeless, for wordlessly reminding me to check
for typos.
2021-07-27 00:13:18 +02:00
Kim Alvefur
d7b7a25e73
mod_tls: Add "support" for <failure> by closing gracefully
...
Nicer than the "unsupported stanza type" error we get otherwise.
2021-05-21 19:04:01 +02:00
Kim Alvefur
02cead40db
mod_tls: Fix order of debug messages and tls context creation
...
Originally added in 5b048ccd106f
Merged wrong in ca01c449357f
2021-05-05 16:25:33 +02:00
Kim Alvefur
03a1ac4f69
mod_tls: Bail out if session got destroyed while sending <proceed/>
...
Can happen in case opportunistic_writes is enabled and the session got
destroyed while writing that tag.
Thanks Ge0rG
2021-04-15 15:57:24 +02:00
Kim Alvefur
da0482b226
mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set
2021-01-29 23:23:25 +01:00
Kim Alvefur
eb9e818e43
mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590
2021-01-29 23:17:08 +01:00
Kim Alvefur
47bd554448
Merge 0.11->trunk
2020-04-26 21:03:40 +02:00
Kim Alvefur
7c18043404
mod_tls: Log when certificates are (re)loaded
...
Meant to reduce user confusion over what's reloaded and not.
2020-04-26 20:58:51 +02:00
Kim Alvefur
86ed7cd44e
mod_tls: Log debug message for each kind of TLS context created
...
Creating TLS contexts triggers a lot of messages from certmanager that
don't really describe their purpose. This is meant to provide hints
about that.
2019-04-23 19:13:50 +02:00
Kim Alvefur
f0abacc215
mod_tls: Rebuild SSL context objects on configuration reload - #701
2017-04-25 21:50:36 +02:00
Kim Alvefur
b1b108de84
mod_tls: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77
2017-03-06 15:55:37 +01:00
Kim Alvefur
3405d89baa
mod_tls: Suppress debug message if already using encryption
2017-02-25 01:16:31 +01:00
Kim Alvefur
a193e1d9f4
mod_tls: Log reasons for not being able to do TLS
2017-02-15 23:03:22 +01:00
Kim Alvefur
c8b213ff4f
mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias)
2017-01-27 12:21:09 +01:00
Kim Alvefur
c7da30f634
mod_tls: Return session.ssl_ctx if not nil, like when doing the full session type check
2017-01-25 11:12:43 +01:00
Kim Alvefur
3258500edb
mod_tls: Add debug logging for when TLS should be doable but no ssl context was set
2017-01-25 11:06:30 +01:00
Kim Alvefur
272e5d06b4
mod_tls: Verify that TLS is available before proceeding
2017-01-23 10:46:42 +01:00
Kim Alvefur
a7a8fa91e3
mod_tls: Only accept <proceed> on outgoing s2s connections
2017-01-23 10:45:20 +01:00
Kim Alvefur
1a12e55904
mod_tls: Ignore unused argument [luacheck]
2016-11-02 23:19:41 +01:00
Kim Alvefur
57fe905a8c
mod_tls: Fix ssl option fallback to a "parent" host if current host does not have ssl options set (thanks 70b1)
2015-11-09 13:40:06 +01:00
Kim Alvefur
edc8079032
mod_tls: Remove unused reference to global ssl config option (certmanager adds that to the context)
2015-11-09 13:39:23 +01:00
Kim Alvefur
7b18c25101
mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain ( fixes #511 )
2015-09-15 17:51:56 +02:00
Kim Alvefur
72dde1c231
mod_tls: Treat session.ssl_ctx being false as a signal that TLS is disabled
2015-05-18 21:48:58 +02:00
Kim Alvefur
3f9b683457
mod_tls: Build <starttls/> as a stanza instead of with string concatenation
2015-05-18 21:43:24 +02:00
Kim Alvefur
49ba0ce08d
certmanager, mod_tls: Return final ssl config as third return value (fix for c6caaa440e74, portmanager assumes non-falsy second return value is an error) (thanks deoren)
2014-11-22 11:51:54 +01:00
Kim Alvefur
184d6ce60b
mod_tls: Keep ssl config around and attach them to sessions
2014-11-19 14:47:49 +01:00
Kim Alvefur
ac43c71ec2
mod_legacyauth, mod_saslauth, mod_tls: Pass require_encryption as default option to s2s_require_encryption so the later overrides the former
2014-10-21 12:49:03 +02:00
Kim Alvefur
8003a40b0a
mod_lastactivity, mod_legacyauth, mod_presence, mod_saslauth, mod_tls: Use the newer stanza:get_child APIs and optimize away some table lookups
2014-07-04 22:52:34 +02:00
Kim Alvefur
4e88341951
mod_tls: Simplify and use new ssl config merging in certmanager
2014-07-03 15:35:45 +02:00
Matthew Wild
996847e180
Merge 0.9->0.10
2014-01-18 18:46:12 +00:00
Florian Zeitz
1d833bb807
Remove all trailing whitespace
2013-08-09 17:48:21 +02:00
Kim Alvefur
7c51e9ec71
mod_tls: Remove debug statement
2013-06-16 15:01:31 +02:00
Kim Alvefur
410ab5d97b
mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ
2014-01-15 22:47:50 +01:00
Kim Alvefur
573c5bea61
mod_tls: Rename variables to be less confusing
2014-01-15 21:57:15 +01:00
Matthew Wild
342de92462
mod_tls: Log error when TLS initialization fails
2014-01-12 06:16:49 -05:00
Kim Alvefur
3786afa97f
mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
2013-06-13 17:47:45 +02:00
Kim Alvefur
16c7c4e78d
mod_tls: More use of config sections removed
2013-03-23 02:35:50 +01:00
Kim Alvefur
27dc3a5b9a
mod_announce, mod_auth_anonymous, mod_c2s, mod_c2s, mod_component, mod_iq, mod_message, mod_presence, mod_tls: Access prosody.{hosts,bare_sessions,full_sessions} instead of the old globals
2013-03-23 01:27:16 +01:00
Kim Alvefur
aac3fbdf9b
Merge 0.11->trunk
2019-04-24 18:06:48 +02:00
