prosody-modules
3b30635d215c
mod_secure_interfaces/mod_secure_interfaces.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody-modules

Annotate

mod_secure_interfaces/mod_secure_interfaces.lua @ 5425:3b30635d215c

mod_http_oauth2: Support granting zero role-scopes It seems Very Bad that if you uncheck all roles on the consent page, you get the default scopes, which seems the opposite of what you probably intended. Currently, mod_tokenauth will do the same thing, so work is needed there too to allow issuing tokens without roles. A token without a role could be used for OIDC login, and not much else. This seems like a valuable thing to support.
author Kim Alvefur <zash@zash.se>
date Sun, 07 May 2023 19:29:15 +0200
parent 3415:6c806a99f802
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
2730
cd828b1cb5b9 mod_secure_interfaces: Add ::1 to the default secure_interfaces.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 2726
diff changeset
1 local secure_interfaces = module:get_option_set("secure_interfaces", { "127.0.0.1", "::1" });
1177
a464261deba8 mod_secure_interfaces: New module to mark c2s sessions on given interfaces as 'secure' without encryption
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
2
a464261deba8 mod_secure_interfaces: New module to mark c2s sessions on given interfaces as 'secure' without encryption
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
3 module:hook("stream-features", function (event)
a464261deba8 mod_secure_interfaces: New module to mark c2s sessions on given interfaces as 'secure' without encryption
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
4 local session = event.origin;
a464261deba8 mod_secure_interfaces: New module to mark c2s sessions on given interfaces as 'secure' without encryption
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
5 if session.type ~= "c2s_unauthed" then return; end
a464261deba8 mod_secure_interfaces: New module to mark c2s sessions on given interfaces as 'secure' without encryption
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
6 local socket = session.conn:socket();
2726
55f3ab952d06 mod_secure_interfaces: Add debug log in non-secure case also
Matthew Wild <mwild1@gmail.com>
parents: 1177
diff changeset
7 if not socket.getsockname then
55f3ab952d06 mod_secure_interfaces: Add debug log in non-secure case also
Matthew Wild <mwild1@gmail.com>
parents: 1177
diff changeset
8 module:log("debug", "Unable to determine local address of incoming connection");
55f3ab952d06 mod_secure_interfaces: Add debug log in non-secure case also
Matthew Wild <mwild1@gmail.com>
parents: 1177
diff changeset
9 return;
55f3ab952d06 mod_secure_interfaces: Add debug log in non-secure case also
Matthew Wild <mwild1@gmail.com>
parents: 1177
diff changeset
10 end
1177
a464261deba8 mod_secure_interfaces: New module to mark c2s sessions on given interfaces as 'secure' without encryption
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
11 local localip = socket:getsockname();
a464261deba8 mod_secure_interfaces: New module to mark c2s sessions on given interfaces as 'secure' without encryption
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
12 if secure_interfaces:contains(localip) then
2726
55f3ab952d06 mod_secure_interfaces: Add debug log in non-secure case also
Matthew Wild <mwild1@gmail.com>
parents: 1177
diff changeset
13 module:log("debug", "Marking session from %s to %s as secure", session.ip or "[?]", localip);
1177
a464261deba8 mod_secure_interfaces: New module to mark c2s sessions on given interfaces as 'secure' without encryption
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
14 session.secure = true;
3415
6c806a99f802 mod_secure_interfaces: Prevent starttls on connections marked secure (fixes #1274)
Kim Alvefur <zash@zash.se>
parents: 2730
diff changeset
15 session.conn.starttls = false;
2726
55f3ab952d06 mod_secure_interfaces: Add debug log in non-secure case also
Matthew Wild <mwild1@gmail.com>
parents: 1177
diff changeset
16 else
55f3ab952d06 mod_secure_interfaces: Add debug log in non-secure case also
Matthew Wild <mwild1@gmail.com>
parents: 1177
diff changeset
17 module:log("debug", "Not marking session from %s to %s as secure", session.ip or "[?]", localip);
1177
a464261deba8 mod_secure_interfaces: New module to mark c2s sessions on given interfaces as 'secure' without encryption
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
18 end
a464261deba8 mod_secure_interfaces: New module to mark c2s sessions on given interfaces as 'secure' without encryption
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
19 end, 2500);