220 Commits (02469e4e8eca3dd5cfd42f159175ec536300db33)

Author	SHA1	Message	Date
Matthew Wild	067a0ad4d8	usermanager, mod_saslauth: Default to internal_hashed if no auth module specified ... The default config was updated in this way long ago, but if no option was present in the config, Prosody would load internal_plain. This change can result in changes (for the better) for people using very old configuration files lacking an 'authentication' setting.	4 years ago
Kim Alvefur	73d1bb1218	various: Require encryption by default for real ... These options have been specified (and enabled) in the default config file for a long time. However if unspecified in the config, they were not enabled. Now they are. This may result in a change of behaviour for people using very old config files that lack the require_encryption options. But that's what we want.	4 years ago
Kim Alvefur	98922d54b1	plugins: Prefix module imports with prosody namespace	3 years ago
Matthew Wild	16137b3b14	mod_saslauth: Support for SASL handlers forcing a specific resource ... The token layer supports tokens that are tied to a given resource.	3 years ago
Matthew Wild	afa583dfcd	mod_saslauth: Put <sasl-channel-binding> in stream:features per XEP-0440 0.4.0	3 years ago
Matthew Wild	af0f1947cf	mod_saslauth: Fix incorrect variable name introduced in 27a4a7e64831	3 years ago
Matthew Wild	5eef82fdcf	mod_saslauth: Only announce bind feature if no resource yet bound ... It's now possible to bind during SASL2 negotiation.	3 years ago
Matthew Wild	8b384dc77f	mod_saslauth: Rename field from 'scope'->'role' ... The 'scope' term derives from OAuth, and represents a bundle of permissions. We're now setting on the term 'role' for a bundle of permissions. This change does not affect any public modules I'm aware of.	4 years ago
Kim Alvefur	8db7cdc713	mod_saslauth: Implement RFC 9266 'tls-exporter' channel binding (#1760) ... Brings back SCRAM-SHA-*-PLUS from its hiatus brought on by the earlier channel binding method being undefined for TLS 1.3, and the increasing deployment of TLS 1.3. See 1bfd238e05ad and #1542 Requires future version of LuaSec, once support for this key material export method is merged. See https://github.com/brunoos/luasec/pull/187	4 years ago
Kim Alvefur	2048a7a762	mod_saslauth: Advertise channel bindings via XEP-0440 ... This is useful when there's more than one channel binding in circulation, since perhaps there will be varying support for them.	5 years ago
Jonas Schäfer	38346dd6f1	net: isolate LuaSec-specifics ... For this, various accessor functions are now provided directly on the sockets, which reach down into the LuaSec implementation to obtain the information. While this may seem of little gain at first, it hides the implementation detail of the LuaSec+LuaSocket combination that the actual socket and the TLS layer are separate objects. The net gain here is that an alternative implementation does not have to emulate that specific implementation detail and "only" has to expose LuaSec-compatible data structures on the new functions.	4 years ago
Kim Alvefur	f1550b900d	mod_saslauth: Use a defined SASL error	5 years ago
Kim Alvefur	139cafdbaf	mod_saslauth: Improve code style ... This many returns deserve their own line. `session["sasl_handler"]` style isn't used anywhere else.	5 years ago
tmolitor	a7cc31c6bb	mod_saslauth: Don't throw errors in async code when connections are gone ... Fixes #1515	5 years ago
Kim Alvefur	15b64ea4ff	mod_saslauth: Only advertise channel binding if a finished message is available ... In some cases this method returns nothing, unclear why.	5 years ago
Kim Alvefur	b62216fab3	mod_saslauth: Disable 'tls-unique' channel binding with TLS 1.3 (closes #1542) ... The 'tls-unique' channel binding is undefined in TLS 1.3 according to a single sentence in parenthesis in Apendix C of RFC 8446 This may trigger downgrade protection in clients that were expecting channel binding to be available.	5 years ago
Jonas Schäfer	f18e33228d	s2s et al.: Add counters for connection state transitions	5 years ago
Matthew Wild	cfa4181982	mod_saslauth: Pass through any auth scope from the SASL handler to sessionmanager.make_authenticated()	6 years ago
Kim Alvefur	9589da30b6	mod_saslauth: Set a nicer bounce error explaining SASL EXTERNAL failures ... Better than the previous string concatenation of SASL failure condition and optional text sent by the remote server. Would be nice to have a text per condition, other than the probably most common 'not-authorized'.	6 years ago
Kim Alvefur	0de6ce740e	mod_saslauth: Collect SASL EXTERNAL failures into an util.error object ... Will be easier than that concatenated string to extract info out of for use elsewhere.	6 years ago
Kim Alvefur	4053cdb848	mod_saslauth: Advertise correct set of mechanisms ... Mistakenly iterates over the set of all supported mechanisms instead of the one without insecure mechanisms if the connection is insecure. Not a problem if c2s_require_encryption is true Introduced in 56a0f68b7797	6 years ago
Kim Alvefur	4d28443876	mod_saslauth: Demote "no SASL mechanisms" error back to warning ... This gets printed before TLS if c2s_require_encryption = false, in which case it is just annoying.	6 years ago
Kim Alvefur	57a86c0b0c	mod_saslauth: Improve logging of why no SASL mechanisms were offered	6 years ago
Kim Alvefur	668089d57c	mod_saslauth: Use the power of Set Theory to mange sets of SASL mechanisms ... This makes sets of excluded mechanisms easily available for use later.	6 years ago
Kim Alvefur	a375a34332	mod_saslauth: Log (debug) messages about channel binding	6 years ago
Kim Alvefur	8eb15f32e1	mod_saslauth: Remove useless debug log line ... Fairly useless to only log half of SASL messages. Use mod_stanza_debug instead to get the full exchange.	6 years ago
Kim Alvefur	bf566284b1	mod_saslauth: Remove commented-out debug log line	6 years ago
Kim Alvefur	f65c017ee1	Fix various spelling mistakes [codespell]	7 years ago
Kim Alvefur	40b1e3e0ed	plugins: Remove tostring call from logging ... Taken care of by loggingmanager now Mass-rewrite using lua pattern like `tostring%b()`	7 years ago
Kim Alvefur	e8872af8a0	mod_saslauth: Use correct varible name (thanks Roi)	9 years ago
Kim Alvefur	c1157eb0ae	mod_saslauth: Ignore unused argument [luacheck]	8 years ago
Kim Alvefur	e1542aa2ee	mod_saslauth: Use renamed API for hooking non-stanzas	8 years ago
Kim Alvefur	e925f5a34a	mod_saslauth: Pass SASL EXTERNAL failure reason on to be used in error bounces	8 years ago
Kim Alvefur	477f77e250	mod_saslauth: Close connection if no fallback kicks in on SASL EXTERNAL failure	8 years ago
Kim Alvefur	5a07b39c7f	Backed out changeset 89c42aff8510: The problem in ejabberd has reportedly been resolved and this change causes more problems than it solves (fixes #1006)	8 years ago
Kim Alvefur	2d4c94e612	mod_saslauth: Log which mechanisms are offered	8 years ago
Kim Alvefur	3e4952567c	mod_saslauth: Remove unused argument [luacheck]	9 years ago
Kim Alvefur	66618bf09c	mod_saslauth: Fix typoed variable name [luacheck]	9 years ago
Kim Alvefur	7e3a83a35b	mod_saslauth: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77	9 years ago
Kim Alvefur	d471c7b124	mod_saslauth: Log SASL failure reason	9 years ago
Kim Alvefur	7a2ed1a9ed	mod_saslauth: Ignore shadowing of logger [luacheck]	9 years ago
Kim Alvefur	bb3a3dfe97	mod_saslauth: Improve logging as to why when SASL is not offered	9 years ago
Kim Alvefur	39639a7c38	mod_saslauth: Cache logger in local for less typing	9 years ago
Kim Alvefur	e701756ba9	core.sessionmanager, mod_saslauth: Introduce intermediate session type for authenticated but unbound sessions so that resource binding is not treated as a normal stanza	9 years ago
Kim Alvefur	94c745e8e8	mod_saslauth: Disable DIGEST-MD5 by default (closes #515)	10 years ago
Kim Alvefur	8e786f387d	mod_saslauth: Make it easier to support multiple channel binding methonds	11 years ago
Kim Alvefur	2ab66e784a	mod_saslauth: Break out tls-unique channel binding callback so it is instantiated once	11 years ago
Kim Alvefur	b47d9adc40	mod_saslauth: Keep sasl_handler in a local variable	11 years ago
Kim Alvefur	9722fc8c01	mod_saslauth: Better name for config option	11 years ago
Kim Alvefur	1386a2c85d	mod_saslauth: Make it possible to disable certain mechanisms	11 years ago