net.server_epoll: Add support for systemd socket activation
Allows creating listening sockets and accepting client connections
before Prosody starts.
This is unlike normal Prosody dynamic resource management, where ports
may added and removed at any time, and the ports defined by the config.
Weird things happen if these are closed (e.g. due to reload) so here we
prevent closing and ensure sockets are reused when opened again.
local type, tostring, pairs, ipairs = type, tostring, pairs, ipairs;
local t_insert, t_concat = table.insert, table.concat;
local s_format = string.format;
local oid_xmppaddr = "1.3.6.1.5.5.7.8.5"; -- [XMPP-CORE]
local oid_dnssrv = "1.3.6.1.5.5.7.8.7"; -- [SRV-ID]
local idna_to_ascii = require "prosody.util.encodings".idna.to_ascii;
local _M = {};
local config = {};
_M.config = config;
local ssl_config = {};
local ssl_config_mt = { __index = ssl_config };
function config.new()
return setmetatable({
req = {
distinguished_name = "distinguished_name",
req_extensions = "certrequest",
x509_extensions = "selfsigned",
prompt = "no",
},
distinguished_name = {
countryName = "GB",
-- stateOrProvinceName = "",
localityName = "The Internet",
organizationName = "Your Organisation",
organizationalUnitName = "XMPP Department",
commonName = "example.com",
emailAddress = "xmpp@example.com",
},
certrequest = {
basicConstraints = "CA:FALSE",
keyUsage = "digitalSignature,keyEncipherment",
extendedKeyUsage = "serverAuth,clientAuth",
subjectAltName = "@subject_alternative_name",
},
selfsigned = {
basicConstraints = "CA:TRUE",
subjectAltName = "@subject_alternative_name",
},
subject_alternative_name = {
DNS = {},
otherName = {},
},
}, ssl_config_mt);
end
local DN_order = {
"countryName";
"stateOrProvinceName";
"localityName";
"streetAddress";
"organizationName";
"organizationalUnitName";
"commonName";
"emailAddress";
}
_M._DN_order = DN_order;
function ssl_config:serialize()
local s = "";
for section, t in pairs(self) do
s = s .. ("[%s]\n"):format(section);
if section == "subject_alternative_name" then
for san, n in pairs(t) do
for i = 1, #n do
s = s .. s_format("%s.%d = %s\n", san, i -1, n[i]);
end
end
elseif section == "distinguished_name" then
for _, k in ipairs(t[1] and t or DN_order) do
local v = t[k];
if v then
s = s .. ("%s = %s\n"):format(k, v);
end
end
else
for k, v in pairs(t) do
s = s .. ("%s = %s\n"):format(k, v);
end
end
s = s .. "\n";
end
return s;
end
local function utf8string(s)
-- This is how we tell openssl not to encode UTF-8 strings as fake Latin1
return s_format("FORMAT:UTF8,UTF8:%s", s);
end
local function ia5string(s)
return s_format("IA5STRING:%s", s);
end
_M.util = {
utf8string = utf8string,
ia5string = ia5string,
};
function ssl_config:add_dNSName(host)
t_insert(self.subject_alternative_name.DNS, idna_to_ascii(host));
end
function ssl_config:add_sRVName(host, service)
t_insert(self.subject_alternative_name.otherName,
s_format("%s;%s", oid_dnssrv, ia5string("_" .. service .. "." .. idna_to_ascii(host))));
end
function ssl_config:add_xmppAddr(host)
t_insert(self.subject_alternative_name.otherName,
s_format("%s;%s", oid_xmppaddr, utf8string(host)));
end
function ssl_config:from_prosody(hosts, config, certhosts) -- luacheck: ignore 431/config
-- TODO Decide if this should go elsewhere
local found_matching_hosts = false;
for i = 1, #certhosts do
local certhost = certhosts[i];
for name in pairs(hosts) do
if name == certhost or name:sub(-1-#certhost) == "." .. certhost then
found_matching_hosts = true;
self:add_dNSName(name);
--print(name .. "#component_module: " .. (config.get(name, "component_module") or "nil"));
if config.get(name, "component_module") == nil then
self:add_sRVName(name, "xmpp-client");
end
--print(name .. "#anonymous_login: " .. tostring(config.get(name, "anonymous_login")));
if not (config.get(name, "anonymous_login") or
config.get(name, "authentication") == "anonymous") then
self:add_sRVName(name, "xmpp-server");
end
self:add_xmppAddr(name);
end
end
end
if not found_matching_hosts then
return nil, "no-matching-hosts";
end
end
do -- Lua to shell calls.
local function shell_escape(s)
return "'" .. tostring(s):gsub("'",[['\'']]) .. "'";
end
local function serialize(command, args)
local commandline = { "openssl", command };
for k, v in pairs(args) do
if type(k) == "string" then
t_insert(commandline, ("-%s"):format(k));
if v ~= true then
t_insert(commandline, shell_escape(v));
end
end
end
for _, v in ipairs(args) do
t_insert(commandline, shell_escape(v));
end
return t_concat(commandline, " ");
end
local os_execute = os.execute;
setmetatable(_M, {
__index = function(_, command)
return function(opts)
return os_execute(serialize(command, type(opts) == "table" and opts or {}));
end;
end;
});
end
return _M;