util.startup: Fix exiting on pidfile trouble
prosody.shutdown() relies on prosody.main_thread, which has not been set
yet at this point.
Doing a clean shutdown might actually be harmful in case it tears down
things set up by the conflicting Prosody, such as the very pidfile we
were looking at.
Thanks again SigmaTel71 for noticing
local type, tostring, pairs, ipairs = type, tostring, pairs, ipairs;
local t_insert, t_concat = table.insert, table.concat;
local s_format = string.format;
local oid_xmppaddr = "1.3.6.1.5.5.7.8.5"; -- [XMPP-CORE]
local oid_dnssrv = "1.3.6.1.5.5.7.8.7"; -- [SRV-ID]
local idna_to_ascii = require "prosody.util.encodings".idna.to_ascii;
local _M = {};
local config = {};
_M.config = config;
local ssl_config = {};
local ssl_config_mt = { __index = ssl_config };
function config.new()
return setmetatable({
req = {
distinguished_name = "distinguished_name",
req_extensions = "certrequest",
x509_extensions = "selfsigned",
prompt = "no",
},
distinguished_name = {
countryName = "GB",
-- stateOrProvinceName = "",
localityName = "The Internet",
organizationName = "Your Organisation",
organizationalUnitName = "XMPP Department",
commonName = "example.com",
emailAddress = "xmpp@example.com",
},
certrequest = {
basicConstraints = "CA:FALSE",
keyUsage = "digitalSignature,keyEncipherment",
extendedKeyUsage = "serverAuth,clientAuth",
subjectAltName = "@subject_alternative_name",
},
selfsigned = {
basicConstraints = "CA:TRUE",
subjectAltName = "@subject_alternative_name",
},
subject_alternative_name = {
DNS = {},
otherName = {},
},
}, ssl_config_mt);
end
local DN_order = {
"countryName";
"stateOrProvinceName";
"localityName";
"streetAddress";
"organizationName";
"organizationalUnitName";
"commonName";
"emailAddress";
}
_M._DN_order = DN_order;
function ssl_config:serialize()
local s = "";
for section, t in pairs(self) do
s = s .. ("[%s]\n"):format(section);
if section == "subject_alternative_name" then
for san, n in pairs(t) do
for i = 1, #n do
s = s .. s_format("%s.%d = %s\n", san, i -1, n[i]);
end
end
elseif section == "distinguished_name" then
for _, k in ipairs(t[1] and t or DN_order) do
local v = t[k];
if v then
s = s .. ("%s = %s\n"):format(k, v);
end
end
else
for k, v in pairs(t) do
s = s .. ("%s = %s\n"):format(k, v);
end
end
s = s .. "\n";
end
return s;
end
local function utf8string(s)
-- This is how we tell openssl not to encode UTF-8 strings as fake Latin1
return s_format("FORMAT:UTF8,UTF8:%s", s);
end
local function ia5string(s)
return s_format("IA5STRING:%s", s);
end
_M.util = {
utf8string = utf8string,
ia5string = ia5string,
};
function ssl_config:add_dNSName(host)
t_insert(self.subject_alternative_name.DNS, idna_to_ascii(host));
end
function ssl_config:add_sRVName(host, service)
t_insert(self.subject_alternative_name.otherName,
s_format("%s;%s", oid_dnssrv, ia5string("_" .. service .. "." .. idna_to_ascii(host))));
end
function ssl_config:add_xmppAddr(host)
t_insert(self.subject_alternative_name.otherName,
s_format("%s;%s", oid_xmppaddr, utf8string(host)));
end
function ssl_config:from_prosody(hosts, config, certhosts) -- luacheck: ignore 431/config
-- TODO Decide if this should go elsewhere
local found_matching_hosts = false;
for i = 1, #certhosts do
local certhost = certhosts[i];
for name in pairs(hosts) do
if name == certhost or name:sub(-1-#certhost) == "." .. certhost then
found_matching_hosts = true;
self:add_dNSName(name);
--print(name .. "#component_module: " .. (config.get(name, "component_module") or "nil"));
if config.get(name, "component_module") == nil then
self:add_sRVName(name, "xmpp-client");
end
--print(name .. "#anonymous_login: " .. tostring(config.get(name, "anonymous_login")));
if not (config.get(name, "anonymous_login") or
config.get(name, "authentication") == "anonymous") then
self:add_sRVName(name, "xmpp-server");
end
self:add_xmppAddr(name);
end
end
end
if not found_matching_hosts then
return nil, "no-matching-hosts";
end
end
do -- Lua to shell calls.
local function shell_escape(s)
return "'" .. tostring(s):gsub("'",[['\'']]) .. "'";
end
local function serialize(command, args)
local commandline = { "openssl", command };
for k, v in pairs(args) do
if type(k) == "string" then
t_insert(commandline, ("-%s"):format(k));
if v ~= true then
t_insert(commandline, shell_escape(v));
end
end
end
for _, v in ipairs(args) do
t_insert(commandline, shell_escape(v));
end
return t_concat(commandline, " ");
end
local os_execute = os.execute;
setmetatable(_M, {
__index = function(_, command)
return function(opts)
return os_execute(serialize(command, type(opts) == "table" and opts or {}));
end;
end;
});
end
return _M;