util.startup: Check root after detecting platform and reading config (thanks SigmaTel71)
Ensures that startup.detect_platform() runs so know whether to use the
POSIX method of checking the current user or something else. Also after
reading the config so we know whether the root override setting is set.
local type, tostring, pairs, ipairs = type, tostring, pairs, ipairs;
local t_insert, t_concat = table.insert, table.concat;
local s_format = string.format;
local oid_xmppaddr = "1.3.6.1.5.5.7.8.5"; -- [XMPP-CORE]
local oid_dnssrv = "1.3.6.1.5.5.7.8.7"; -- [SRV-ID]
local idna_to_ascii = require "prosody.util.encodings".idna.to_ascii;
local _M = {};
local config = {};
_M.config = config;
local ssl_config = {};
local ssl_config_mt = { __index = ssl_config };
function config.new()
return setmetatable({
req = {
distinguished_name = "distinguished_name",
req_extensions = "certrequest",
x509_extensions = "selfsigned",
prompt = "no",
},
distinguished_name = {
countryName = "GB",
-- stateOrProvinceName = "",
localityName = "The Internet",
organizationName = "Your Organisation",
organizationalUnitName = "XMPP Department",
commonName = "example.com",
emailAddress = "xmpp@example.com",
},
certrequest = {
basicConstraints = "CA:FALSE",
keyUsage = "digitalSignature,keyEncipherment",
extendedKeyUsage = "serverAuth,clientAuth",
subjectAltName = "@subject_alternative_name",
},
selfsigned = {
basicConstraints = "CA:TRUE",
subjectAltName = "@subject_alternative_name",
},
subject_alternative_name = {
DNS = {},
otherName = {},
},
}, ssl_config_mt);
end
local DN_order = {
"countryName";
"stateOrProvinceName";
"localityName";
"streetAddress";
"organizationName";
"organizationalUnitName";
"commonName";
"emailAddress";
}
_M._DN_order = DN_order;
function ssl_config:serialize()
local s = "";
for section, t in pairs(self) do
s = s .. ("[%s]\n"):format(section);
if section == "subject_alternative_name" then
for san, n in pairs(t) do
for i = 1, #n do
s = s .. s_format("%s.%d = %s\n", san, i -1, n[i]);
end
end
elseif section == "distinguished_name" then
for _, k in ipairs(t[1] and t or DN_order) do
local v = t[k];
if v then
s = s .. ("%s = %s\n"):format(k, v);
end
end
else
for k, v in pairs(t) do
s = s .. ("%s = %s\n"):format(k, v);
end
end
s = s .. "\n";
end
return s;
end
local function utf8string(s)
-- This is how we tell openssl not to encode UTF-8 strings as fake Latin1
return s_format("FORMAT:UTF8,UTF8:%s", s);
end
local function ia5string(s)
return s_format("IA5STRING:%s", s);
end
_M.util = {
utf8string = utf8string,
ia5string = ia5string,
};
function ssl_config:add_dNSName(host)
t_insert(self.subject_alternative_name.DNS, idna_to_ascii(host));
end
function ssl_config:add_sRVName(host, service)
t_insert(self.subject_alternative_name.otherName,
s_format("%s;%s", oid_dnssrv, ia5string("_" .. service .. "." .. idna_to_ascii(host))));
end
function ssl_config:add_xmppAddr(host)
t_insert(self.subject_alternative_name.otherName,
s_format("%s;%s", oid_xmppaddr, utf8string(host)));
end
function ssl_config:from_prosody(hosts, config, certhosts) -- luacheck: ignore 431/config
-- TODO Decide if this should go elsewhere
local found_matching_hosts = false;
for i = 1, #certhosts do
local certhost = certhosts[i];
for name in pairs(hosts) do
if name == certhost or name:sub(-1-#certhost) == "." .. certhost then
found_matching_hosts = true;
self:add_dNSName(name);
--print(name .. "#component_module: " .. (config.get(name, "component_module") or "nil"));
if config.get(name, "component_module") == nil then
self:add_sRVName(name, "xmpp-client");
end
--print(name .. "#anonymous_login: " .. tostring(config.get(name, "anonymous_login")));
if not (config.get(name, "anonymous_login") or
config.get(name, "authentication") == "anonymous") then
self:add_sRVName(name, "xmpp-server");
end
self:add_xmppAddr(name);
end
end
end
if not found_matching_hosts then
return nil, "no-matching-hosts";
end
end
do -- Lua to shell calls.
local function shell_escape(s)
return "'" .. tostring(s):gsub("'",[['\'']]) .. "'";
end
local function serialize(command, args)
local commandline = { "openssl", command };
for k, v in pairs(args) do
if type(k) == "string" then
t_insert(commandline, ("-%s"):format(k));
if v ~= true then
t_insert(commandline, shell_escape(v));
end
end
end
for _, v in ipairs(args) do
t_insert(commandline, shell_escape(v));
end
return t_concat(commandline, " ");
end
local os_execute = os.execute;
setmetatable(_M, {
__index = function(_, command)
return function(opts)
return os_execute(serialize(command, type(opts) == "table" and opts or {}));
end;
end;
});
end
return _M;