Software /
code /
prosody-modules
Annotate
mod_host_guard/mod_host_guard.lua @ 684:27529031890b
mod_host_guard: now a proper error is returned when stanzas are routed to a filtered remote server (thanks Zash)
author | Marco Cirillo <maranda@lightwitch.org> |
---|---|
date | Sun, 27 May 2012 02:44:06 +0000 |
parent | 683:939f8fc84d49 |
child | 685:19698c5f3ab3 |
rev | line source |
---|---|
493
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
1 -- (C) 2011, Marco Cirillo (LW.Org) |
519
219ffe3541ff
mod_host_guard: updated banner.
Marco Cirillo <maranda@lightwitch.org>
parents:
515
diff
changeset
|
2 -- Block or restrict by blacklist remote access to local components or hosts. |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
3 |
460
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
4 module:set_global() |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
5 |
493
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
6 local guard_blockall = module:get_option_set("host_guard_blockall", {}) |
515
e98fe28c50b0
mod_host_guard: added exceptions/whitelisting to the blockall logic (makes little sense otherwise has s2s_disallow = true does the same)
Marco Cirillo <maranda@lightwitch.org>
parents:
494
diff
changeset
|
7 local guard_ball_wl = module:get_option_set("host_guard_blockall_exceptions", {}) |
493
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
8 local guard_protect = module:get_option_set("host_guard_selective", {}) |
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
9 local guard_block_bl = module:get_option_set("host_guard_blacklist", {}) |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
10 |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
11 local config = require "core.configmanager" |
682
3ab1cf30a848
mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading.
Marco Cirillo <maranda@lightwitch.org>
parents:
681
diff
changeset
|
12 local error_reply = require "util.stanza".error_reply |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
13 local nameprep = require "util.encodings".stringprep.nameprep |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
14 |
680
a2cea070f2c7
mod_host_guard: removed calls to s2smanager and made the module not dependant on it.
Marco Cirillo <maranda@lightwitch.org>
parents:
537
diff
changeset
|
15 local function s2s_hook (event) |
a2cea070f2c7
mod_host_guard: removed calls to s2smanager and made the module not dependant on it.
Marco Cirillo <maranda@lightwitch.org>
parents:
537
diff
changeset
|
16 local origin, stanza = event.session or event.origin, event.stanza or false |
a2cea070f2c7
mod_host_guard: removed calls to s2smanager and made the module not dependant on it.
Marco Cirillo <maranda@lightwitch.org>
parents:
537
diff
changeset
|
17 local to_host, from_host = (not stanza and origin.to_host) or stanza.attr.to, (not stanza and origin.from_host) or stanza.attr.from |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
18 |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
19 if origin.type == "s2sin" or origin.type == "s2sin_unauthed" then |
680
a2cea070f2c7
mod_host_guard: removed calls to s2smanager and made the module not dependant on it.
Marco Cirillo <maranda@lightwitch.org>
parents:
537
diff
changeset
|
20 if guard_blockall:contains(to_host) and not guard_ball_wl:contains(from_host) or |
a2cea070f2c7
mod_host_guard: removed calls to s2smanager and made the module not dependant on it.
Marco Cirillo <maranda@lightwitch.org>
parents:
537
diff
changeset
|
21 guard_block_bl:contains(from_host) and guard_protect:contains(to_host) then |
682
3ab1cf30a848
mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading.
Marco Cirillo <maranda@lightwitch.org>
parents:
681
diff
changeset
|
22 module:log("error", "remote service %s attempted to access restricted host %s", from_host, to_host) |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
23 origin:close({condition = "policy-violation", text = "You're not authorized, good bye."}) |
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
24 return false |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
25 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
26 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
27 |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
28 return nil |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
29 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
30 |
682
3ab1cf30a848
mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading.
Marco Cirillo <maranda@lightwitch.org>
parents:
681
diff
changeset
|
31 local function rr_hook (event) |
684
27529031890b
mod_host_guard: now a proper error is returned when stanzas are routed to a filtered remote server (thanks Zash)
Marco Cirillo <maranda@lightwitch.org>
parents:
683
diff
changeset
|
32 local from_host, to_host, send, stanza = event.from_host, event.to_host, event.origin.send, event.stanza |
682
3ab1cf30a848
mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading.
Marco Cirillo <maranda@lightwitch.org>
parents:
681
diff
changeset
|
33 |
3ab1cf30a848
mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading.
Marco Cirillo <maranda@lightwitch.org>
parents:
681
diff
changeset
|
34 if guard_blockall:contains(from_host) and not guard_ball_wl:contains(to_host) or |
3ab1cf30a848
mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading.
Marco Cirillo <maranda@lightwitch.org>
parents:
681
diff
changeset
|
35 guard_block_bl:contains(to_host) and guard_protect:contains(from_host) then |
3ab1cf30a848
mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading.
Marco Cirillo <maranda@lightwitch.org>
parents:
681
diff
changeset
|
36 module:log("info", "attempted to connect to a filtered remote host %s", to_host) |
684
27529031890b
mod_host_guard: now a proper error is returned when stanzas are routed to a filtered remote server (thanks Zash)
Marco Cirillo <maranda@lightwitch.org>
parents:
683
diff
changeset
|
37 if stanza.attr.type ~= "error" then send(error_reply(event.stanza, "cancel", "policy-violation", "Communicating with a filtered remote server is not allowed.")) end |
27529031890b
mod_host_guard: now a proper error is returned when stanzas are routed to a filtered remote server (thanks Zash)
Marco Cirillo <maranda@lightwitch.org>
parents:
683
diff
changeset
|
38 return true |
682
3ab1cf30a848
mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading.
Marco Cirillo <maranda@lightwitch.org>
parents:
681
diff
changeset
|
39 end |
3ab1cf30a848
mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading.
Marco Cirillo <maranda@lightwitch.org>
parents:
681
diff
changeset
|
40 |
3ab1cf30a848
mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading.
Marco Cirillo <maranda@lightwitch.org>
parents:
681
diff
changeset
|
41 return nil |
3ab1cf30a848
mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading.
Marco Cirillo <maranda@lightwitch.org>
parents:
681
diff
changeset
|
42 end |
3ab1cf30a848
mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading.
Marco Cirillo <maranda@lightwitch.org>
parents:
681
diff
changeset
|
43 |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
44 local function handle_activation (host) |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
45 if guard_blockall:contains(host) or guard_protect:contains(host) then |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
46 if hosts[host] and hosts[host].events then |
680
a2cea070f2c7
mod_host_guard: removed calls to s2smanager and made the module not dependant on it.
Marco Cirillo <maranda@lightwitch.org>
parents:
537
diff
changeset
|
47 hosts[host].events.add_handler("s2sin-established", s2s_hook, 500) |
682
3ab1cf30a848
mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading.
Marco Cirillo <maranda@lightwitch.org>
parents:
681
diff
changeset
|
48 hosts[host].events.add_handler("route/remote", rr_hook, 500) |
680
a2cea070f2c7
mod_host_guard: removed calls to s2smanager and made the module not dependant on it.
Marco Cirillo <maranda@lightwitch.org>
parents:
537
diff
changeset
|
49 hosts[host].events.add_handler("stanza/jabber:server:dialback:result", s2s_hook, 500) |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
50 module:log ("debug", "adding host protection for: "..host) |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
51 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
52 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
53 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
54 |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
55 local function handle_deactivation (host) |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
56 if guard_blockall:contains(host) or guard_protect:contains(host) then |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
57 if hosts[host] and hosts[host].events then |
680
a2cea070f2c7
mod_host_guard: removed calls to s2smanager and made the module not dependant on it.
Marco Cirillo <maranda@lightwitch.org>
parents:
537
diff
changeset
|
58 hosts[host].events.remove_handler("s2sin-established", s2s_hook) |
682
3ab1cf30a848
mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading.
Marco Cirillo <maranda@lightwitch.org>
parents:
681
diff
changeset
|
59 hosts[host].events.remove_handler("route/remote", rr_hook) |
680
a2cea070f2c7
mod_host_guard: removed calls to s2smanager and made the module not dependant on it.
Marco Cirillo <maranda@lightwitch.org>
parents:
537
diff
changeset
|
60 hosts[host].events.remove_handler("stanza/jabber:server:dialback:result", s2s_hook) |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
61 module:log ("debug", "removing host protection for: "..host) |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
62 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
63 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
64 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
65 |
537
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
66 local function init_hosts() |
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
67 for n,table in pairs(hosts) do |
680
a2cea070f2c7
mod_host_guard: removed calls to s2smanager and made the module not dependant on it.
Marco Cirillo <maranda@lightwitch.org>
parents:
537
diff
changeset
|
68 hosts[n].events.remove_handler("s2sin-established", s2s_hook) |
682
3ab1cf30a848
mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading.
Marco Cirillo <maranda@lightwitch.org>
parents:
681
diff
changeset
|
69 hosts[n].events.remove_handler("route/remote", rr_hook) |
680
a2cea070f2c7
mod_host_guard: removed calls to s2smanager and made the module not dependant on it.
Marco Cirillo <maranda@lightwitch.org>
parents:
537
diff
changeset
|
70 hosts[n].events.remove_handler("stanza/jabber:server:dialback:result", s2s_hook) |
537
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
71 if guard_blockall:contains(n) or guard_protect:contains(n) then handle_activation(n) end |
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
72 end |
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
73 end |
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
74 |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
75 local function reload() |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
76 module:log ("debug", "server configuration reloaded, rehashing plugin tables...") |
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
77 guard_blockall = module:get_option_set("host_guard_blockall", {}) |
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
78 guard_ball_wl = module:get_option_set("host_guard_blockall_exceptions", {}) |
537
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
79 guard_protect = module:get_option_set("host_guard_selective", {}) |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
80 guard_block_bl = module:get_option_set("host_guard_blacklist", {}) |
537
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
81 |
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
82 init_hosts() |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
83 end |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
84 |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
85 local function setup() |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
86 module:log ("debug", "initializing host guard module...") |
537
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
87 module:hook ("host-activated", handle_activation) |
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
88 module:hook ("host-deactivated", handle_deactivation) |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
89 module:hook ("config-reloaded", reload) |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
90 |
537
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
91 init_hosts() |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
92 end |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
93 |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
94 if prosody.start_time then |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
95 setup() |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
96 else |
533
47b9053dba38
mod_host_guard: replaced prosody.events.add_handler with module:hook.
Marco Cirillo <maranda@lightwitch.org>
parents:
528
diff
changeset
|
97 module:hook ("server-started", setup) |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
98 end |