X-Git-Url: https://git.enpas.org/?a=blobdiff_plain;f=prosodyctl;h=d9ae9b736ce0cbb1f8724845a536fb7112188e3f;hb=ea07e1d060aed7b8fe75c356d5f04c80f1951d67;hp=4d7f678fa2e767b05381657f719f09156e8e0904;hpb=f846760305fb4ba45f9e2a475fc1a3a4d3bc7f21;p=prosody.git

diff --git a/prosodyctl b/prosodyctl
index 4d7f678f..d9ae9b73 100755
--- a/prosodyctl
+++ b/prosodyctl
@@ -414,7 +414,11 @@ function commands.start(arg)
 	
 	local ok, ret = prosodyctl.start();
 	if ok then
-		if config.get("*", "daemonize") ~= false then
+		local daemonize = config.get("*", "daemonize");
+		if daemonize == nil then
+			daemonize = prosody.installed;
+		end
+		if daemonize then
 			local i=1;
 			while true do
 				local ok, running = prosodyctl.isrunning();
@@ -687,7 +691,12 @@ function cert_commands.config(arg)
 				conf.distinguished_name[k] = nv ~= "." and nv or nil;
 			end
 		end
-		local conf_file = io.open(conf_filename, "w");
+		local conf_file, err = io.open(conf_filename, "w");
+		if not conf_file then
+			show_warning("Could not open OpenSSL config file for writing");
+			show_warning(err);
+			os.exit(1);
+		end
 		conf_file:write(conf:serialize());
 		conf_file:close();
 		print("");
@@ -780,12 +789,36 @@ function commands.cert(arg)
 end
 
 function commands.check(arg)
+	if arg[1] == "--help" then
+		show_usage([[check]], [[Perform basic checks on your Prosody installation]]);
+		return 1;
+	end
 	local what = table.remove(arg, 1);
 	local array, set = require "util.array", require "util.set";
 	local it = require "util.iterators";
 	local ok = true;
+	local function disabled_hosts(host, conf) return host ~= "*" and conf.enabled ~= false; end
+	local function enabled_hosts() return it.filter(disabled_hosts, pairs(config.getconfig())); end
+	if not what or what == "disabled" then
+		local disabled_hosts = set.new();
+		for host, host_options in it.filter("*", pairs(config.getconfig())) do
+			if host_options.enabled == false then
+				disabled_hosts:add(host);
+			end
+		end
+		if not disabled_hosts:empty() then
+			local msg = "Checks will be skipped for these disabled hosts: %s";
+			if what then msg = "These hosts are disabled: %s"; end
+			show_warning(msg, tostring(disabled_hosts));
+			if what then return 0; end
+			print""
+		end
+	end
 	if not what or what == "config" then
 		print("Checking config...");
+		local deprecated = set.new({
+			"bosh_ports", "disallow_s2s", "no_daemonize", "anonymous_login",
+		});
 		local known_global_options = set.new({
 			"pidfile", "log", "plugin_paths", "prosody_user", "prosody_group", "daemonize",
 			"umask", "prosodyctl_timeout", "use_ipv6", "use_libevent", "network_settings"
@@ -798,9 +831,27 @@ function commands.check(arg)
 			print("    No global options defined. Perhaps you have put a host definition at the top")
 			print("    of the config file? They should be at the bottom, see http://prosody.im/doc/configure#overview");
 		end
+		if it.count(enabled_hosts()) == 0 then
+			ok = false;
+			print("");
+			if it.count(it.filter("*", pairs(config))) == 0 then
+				print("    No hosts are defined, please add at least one VirtualHost section")
+			elseif config["*"]["enabled"] == false then
+				print("    No hosts are enabled. Remove enabled = false from the global section or put enabled = true under at least one VirtualHost section")
+			else
+				print("    All hosts are disabled. Remove enabled = false from at least one VirtualHost section")
+			end
+		end
 		-- Check for global options under hosts
 		local global_options = set.new(it.to_array(it.keys(config["*"])));
-		for host, options in it.filter("*", pairs(config)) do
+		local deprecated_global_options = set.intersection(global_options, deprecated);
+		if not deprecated_global_options:empty() then
+			print("");
+			print("    You have some deprecated options in the global section:");
+			print("    "..tostring(deprecated_global_options))
+			ok = false;
+		end
+		for host, options in enabled_hosts() do
 			local host_options = set.new(it.to_array(it.keys(options)));
 			local misplaced_options = set.intersection(host_options, known_global_options);
 			for name in pairs(options) do
@@ -834,6 +885,7 @@ function commands.check(arg)
 	end
 	if not what or what == "dns" then
 		local dns = require "net.dns";
+		local idna = require "util.encodings".idna;
 		local ip = require "util.ip";
 		local c2s_ports = set.new(config.get("*", "c2s_ports") or {5222});
 		local s2s_ports = set.new(config.get("*", "s2s_ports") or {5269});
@@ -852,13 +904,13 @@ function commands.check(arg)
 		
 		local fqdn = socket.dns.tohostname(socket.dns.gethostname());
 		if fqdn then
-			local res = dns.lookup(fqdn, "A");
+			local res = dns.lookup(idna.to_ascii(fqdn), "A");
 			if res then
 				for _, record in ipairs(res) do
 					external_addresses:add(record.a);
 				end
 			end
-			local res = dns.lookup(fqdn, "AAAA");
+			local res = dns.lookup(idna.to_ascii(fqdn), "AAAA");
 			if res then
 				for _, record in ipairs(res) do
 					external_addresses:add(record.aaaa);
@@ -866,7 +918,7 @@ function commands.check(arg)
 			end
 		end
 		
-		local local_addresses = socket.local_addresses and socket.local_addresses() or {};
+		local local_addresses = require"util.net".local_addresses() or {};
 		
 		for addr in it.values(local_addresses) do
 			if not ip.new_ip(addr).private then
@@ -884,14 +936,14 @@ function commands.check(arg)
 		
 		local v6_supported = not not socket.tcp6;
 		
-		for host, host_options in it.filter("*", pairs(config.getconfig())) do
+		for host, host_options in enabled_hosts() do
 			local all_targets_ok, some_targets_ok = true, false;
 			
 			local is_component = not not host_options.component_module;
 			print("Checking DNS for "..(is_component and "component" or "host").." "..host.."...");
 			local target_hosts = set.new();
 			if not is_component then
-				local res = dns.lookup("_xmpp-client._tcp."..host..".", "SRV");
+				local res = dns.lookup("_xmpp-client._tcp."..idna.to_ascii(host)..".", "SRV");
 				if res then
 					for _, record in ipairs(res) do
 						target_hosts:add(record.srv.target);
@@ -908,7 +960,7 @@ function commands.check(arg)
 					end
 				end
 			end
-			local res = dns.lookup("_xmpp-server._tcp."..host..".", "SRV");
+			local res = dns.lookup("_xmpp-server._tcp."..idna.to_ascii(host)..".", "SRV");
 			if res then
 				for _, record in ipairs(res) do
 					target_hosts:add(record.srv.target);
@@ -939,7 +991,7 @@ function commands.check(arg)
 
 			if modules:contains("proxy65") then
 				local proxy65_target = config.get(host, "proxy65_address") or host;
-				local A, AAAA = dns.lookup(proxy65_target, "A"), dns.lookup(proxy65_target, "AAAA");
+				local A, AAAA = dns.lookup(idna.to_ascii(proxy65_target), "A"), dns.lookup(idna.to_ascii(proxy65_target), "AAAA");
 				local prob = {};
 				if not A then
 					table.insert(prob, "A");
@@ -954,7 +1006,7 @@ function commands.check(arg)
 			
 			for host in target_hosts do
 				local host_ok_v4, host_ok_v6;
-				local res = dns.lookup(host, "A");
+				local res = dns.lookup(idna.to_ascii(host), "A");
 				if res then
 					for _, record in ipairs(res) do
 						if external_addresses:contains(record.a) then
@@ -970,7 +1022,7 @@ function commands.check(arg)
 						end
 					end
 				end
-				local res = dns.lookup(host, "AAAA");
+				local res = dns.lookup(idna.to_ascii(host), "AAAA");
 				if res then
 					for _, record in ipairs(res) do
 						if external_addresses:contains(record.aaaa) then
@@ -1018,6 +1070,79 @@ function commands.check(arg)
 			ok = false;
 		end
 	end
+	if not what or what == "certs" then
+		local cert_ok;
+		print"Checking certificates..."
+		local x509_verify_identity = require"util.x509".verify_identity;
+		local ssl = dependencies.softreq"ssl";
+		-- local datetime_parse = require"util.datetime".parse_x509;
+		local load_cert = ssl and ssl.x509 and ssl.x509.load;
+		-- or ssl.cert_from_pem
+		if not ssl then
+			print("LuaSec not available, can't perform certificate checks")
+			if what == "certs" then cert_ok = false end
+		elseif not load_cert then
+			print("This version of LuaSec (" .. ssl._VERSION .. ") does not support certificate checking");
+			cert_ok = false
+		else
+			for host in enabled_hosts() do
+				print("Checking certificate for "..host);
+				-- First, let's find out what certificate this host uses.
+				local ssl_config = config.rawget(host, "ssl");
+				if not ssl_config then
+					local base_host = host:match("%.(.*)");
+					ssl_config = config.get(base_host, "ssl");
+				end
+				if not ssl_config then
+					print("  No 'ssl' option defined for "..host)
+					cert_ok = false
+				elseif not ssl_config.certificate then
+					print("  No 'certificate' set in ssl option for "..host)
+					cert_ok = false
+				elseif not ssl_config.key then
+					print("  No 'key' set in ssl option for "..host)
+					cert_ok = false
+				else
+					local key, err = io.open(ssl_config.key); -- Permissions check only
+					if not key then
+						print("    Could not open "..ssl_config.key..": "..err);
+						cert_ok = false
+					else
+						key:close();
+					end
+					local cert_fh, err = io.open(ssl_config.certificate); -- Load the file.
+					if not cert_fh then
+						print("    Could not open "..ssl_config.certificate..": "..err);
+						cert_ok = false
+					else
+						print("  Certificate: "..ssl_config.certificate)
+						local cert = load_cert(cert_fh:read"*a"); cert_fh = cert_fh:close();
+						if not cert:validat(os.time()) then
+							print("    Certificate has expired.")
+							cert_ok = false
+						end
+						if config.get(host, "component_module") == nil
+							and not x509_verify_identity(host, "_xmpp-client", cert) then
+							print("    Not vaild for client connections to "..host..".")
+							cert_ok = false
+						end
+						if (not (config.get(host, "anonymous_login")
+							or config.get(host, "authentication") == "anonymous"))
+							and not x509_verify_identity(host, "_xmpp-client", cert) then
+							print("    Not vaild for server-to-server connections to "..host..".")
+							cert_ok = false
+						end
+					end
+				end
+			end
+			if cert_ok == false then
+				print("")
+				print("For more information about certificates please see http://prosody.im/doc/certificates");
+				ok = false
+			end
+		end
+		print("")
+	end
 	if not ok then
 		print("Problems found, see above.");
 	else