prosody-modules
9466efd10af9
mod_isolate_host/mod_isolate_host.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody-modules

Comparison

mod_isolate_host/mod_isolate_host.lua @ 1011:9466efd10af9

mod_isolate_host: Prevent communication between hosts, even internal ones
author Matthew Wild <mwild1@gmail.com>
date Tue, 14 May 2013 16:25:59 +0100
child 1792:8e19b943c2cd
comparison
equal deleted inserted replaced
1007:ba220790a59c 1011:9466efd10af9
1 local jid = require "util.jid";
2 local jid_bare, jid_split = jid.bare, jid.split;
3 local is_admin = require "core.usermanager".is_admin;
4 local set = require "util.set";
5 local st = require "util.stanza";
6
7 local stanza_types = set.new{"message", "presence", "iq"};
8 local jid_types = set.new{"bare", "full", "host"};
9
10 local except_domains = module:get_option_inherited_set("isolate_except_domains", {});
11 local except_users = module:get_option_inherited_set("isolate_except_users", {});
12
13 function check_stanza(event)
14 local origin, stanza = event.origin, event.stanza;
15 if origin.no_host_isolation then return; end
16 local to_user, to_host = jid_split(event.stanza.attr.to);
17 if to_host and to_host ~= origin.host and not except_domains:contains(to_host) then
18 if to_host:match("^[^.]+%.(.+)$") == origin.host then -- Permit subdomains
19 except_domains:add(to_host);
20 return;
21 end
22 module:log("warn", "Forbidding stanza from %s to %s", stanza.attr.from or origin.full_jid, stanza.attr.to);
23 origin.send(st.error_reply(stanza, "auth", "forbidden", "Communication with "..to_host.." is not available"));
24 return true;
25 end
26 end
27
28 for stanza_type in stanza_types do
29 for jid_type in jid_types do
30 module:hook("pre-"..stanza_type.."/"..jid_type, check_stanza);
31 end
32 end
33
34 function check_user_isolated(event)
35 local session = event.session;
36 local bare_jid = jid_bare(session.full_jid);
37 if is_admin(bare_jid, module.host) or except_users:contains(bare_jid) then
38 session.no_host_isolation = true;
39 end
40 module:log("debug", "%s is %sisolated", session.full_jid or "[?]", session.no_host_isolation and "" or "not ");
41 end
42
43 module:hook("resource-bind", check_user_isolated);