Software /
code /
prosody
Annotate
plugins/mod_legacyauth.lua @ 11523:5f15ab7c6ae5
Statistics: Rewrite statistics backends to use OpenMetrics
The metric subsystem of Prosody has had some shortcomings from
the perspective of the current state-of-the-art in metric
observability.
The OpenMetrics standard [0] is a formalization of the data
model (and serialization format) of the well-known and
widely-used Prometheus [1] software stack.
The previous stats subsystem of Prosody did not map well to that
format (see e.g. [2] and [3]); the key reason is that it was
trying to do too much math on its own ([2]) while lacking
first-class support for "families" of metrics ([3]) and
structured metric metadata (despite the `extra` argument to
metrics, there was no standard way of representing common things
like "tags" or "labels").
Even though OpenMetrics has grown from the Prometheus world of
monitoring, it maps well to other popular monitoring stacks
such as:
- InfluxDB (labels can be mapped to tags and fields as necessary)
- Carbon/Graphite (labels can be attached to the metric name with
dot-separation)
- StatsD (see graphite when assuming that graphite is used as
backend, which is the default)
The util.statsd module has been ported to use the OpenMetrics
model as a proof of concept. An implementation which exposes
the util.statistics backend data as Prometheus metrics is
ready for publishing in prosody-modules (most likely as
mod_openmetrics_prometheus to avoid breaking existing 0.11
deployments).
At the same time, the previous measure()-based API had one major
advantage: It is really simple and easy to use without requiring
lots of knowledge about OpenMetrics or similar concepts. For that
reason as well as compatibility with existing code, it is preserved
and may even be extended in the future.
However, code relying on the `stats-updated` event as well as
`get_stats` from `statsmanager` will break because the data
model has changed completely; in case of `stats-updated`, the
code will simply not run (as the event was renamed in order
to avoid conflicts); the `get_stats` function has been removed
completely (so it will cause a traceback when it is attempted
to be used).
Note that the measure_*_event methods have been removed from
the module API. I was unable to find any uses or documentation
and thus deemed they should not be ported. Re-implementation is
possible when necessary.
[0]: https://openmetrics.io/
[1]: https://prometheus.io/
[2]: #959
[3]: #960
author | Jonas Schäfer <jonas@wielicki.name> |
---|---|
date | Sun, 18 Apr 2021 11:47:41 +0200 |
parent | 10557:e1cb869e2f6c |
child | 12328:a80314101bc6 |
rev | line source |
---|---|
1523
841d61be198f
Remove version number from copyright headers
Matthew Wild <mwild1@gmail.com>
parents:
1218
diff
changeset
|
1 -- Prosody IM |
2923
b7049746bd29
Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents:
1912
diff
changeset
|
2 -- Copyright (C) 2008-2010 Matthew Wild |
b7049746bd29
Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents:
1912
diff
changeset
|
3 -- Copyright (C) 2008-2010 Waqas Hussain |
5776
bd0ff8ae98a8
Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents:
5126
diff
changeset
|
4 -- |
758 | 5 -- This project is MIT/X11 licensed. Please see the |
6 -- COPYING file in the source package for more information. | |
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
438
diff
changeset
|
7 -- |
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
438
diff
changeset
|
8 |
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
438
diff
changeset
|
9 |
30 | 10 |
11 local st = require "util.stanza"; | |
12 local t_concat = table.concat; | |
13 | |
6487
edc63dc72566
mod_legacyauth, mod_saslauth, mod_tls: Pass require_encryption as default option to s2s_require_encryption so the later overrides the former
Kim Alvefur <zash@zash.se>
parents:
6302
diff
changeset
|
14 local secure_auth_only = module:get_option("c2s_require_encryption", |
edc63dc72566
mod_legacyauth, mod_saslauth, mod_tls: Pass require_encryption as default option to s2s_require_encryption so the later overrides the former
Kim Alvefur <zash@zash.se>
parents:
6302
diff
changeset
|
15 module:get_option("require_encryption")) |
4258
ee445e658848
mod_legacyauth: Disallow on unencrypted connections by default, heed allow_unencrypted_plain_auth config option (thanks Maranda/Zash)
Matthew Wild <mwild1@gmail.com>
parents:
3528
diff
changeset
|
16 or not(module:get_option("allow_unencrypted_plain_auth")); |
1216
fd8ce71bc72b
mod_saslauth, mod_legacyauth: Deny logins to unsecure sessions when require_encryption config option is true
Matthew Wild <mwild1@gmail.com>
parents:
1042
diff
changeset
|
17 |
1042
a3d77353c18a
mod_*: Fix a load of global accesses
Matthew Wild <mwild1@gmail.com>
parents:
896
diff
changeset
|
18 local sessionmanager = require "core.sessionmanager"; |
a3d77353c18a
mod_*: Fix a load of global accesses
Matthew Wild <mwild1@gmail.com>
parents:
896
diff
changeset
|
19 local usermanager = require "core.usermanager"; |
1831
ced7a6b8bcd0
mod_legacyauth: Added node and resource prepping.
Waqas Hussain <waqas20@gmail.com>
parents:
1523
diff
changeset
|
20 local nodeprep = require "util.encodings".stringprep.nodeprep; |
ced7a6b8bcd0
mod_legacyauth: Added node and resource prepping.
Waqas Hussain <waqas20@gmail.com>
parents:
1523
diff
changeset
|
21 local resourceprep = require "util.encodings".stringprep.resourceprep; |
1042
a3d77353c18a
mod_*: Fix a load of global accesses
Matthew Wild <mwild1@gmail.com>
parents:
896
diff
changeset
|
22 |
541
3521e0851c9e
Change modules to use the new add_feature module API method.
Waqas Hussain <waqas20@gmail.com>
parents:
519
diff
changeset
|
23 module:add_feature("jabber:iq:auth"); |
2610
c9ed79940b2e
mod_legacyauth: Hook stream-features event using new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
1912
diff
changeset
|
24 module:hook("stream-features", function(event) |
c9ed79940b2e
mod_legacyauth: Hook stream-features event using new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
1912
diff
changeset
|
25 local origin, features = event.origin, event.features; |
c9ed79940b2e
mod_legacyauth: Hook stream-features event using new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
1912
diff
changeset
|
26 if secure_auth_only and not origin.secure then |
1218
8e02c10c9e60
mod_legacyauth: Hide stream feature when secure auth is enabled, and session isn't secure
Matthew Wild <mwild1@gmail.com>
parents:
1216
diff
changeset
|
27 -- Sorry, not offering to insecure streams! |
8e02c10c9e60
mod_legacyauth: Hide stream feature when secure auth is enabled, and session isn't secure
Matthew Wild <mwild1@gmail.com>
parents:
1216
diff
changeset
|
28 return; |
2610
c9ed79940b2e
mod_legacyauth: Hook stream-features event using new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
1912
diff
changeset
|
29 elseif not origin.username then |
1218
8e02c10c9e60
mod_legacyauth: Hide stream feature when secure auth is enabled, and session isn't secure
Matthew Wild <mwild1@gmail.com>
parents:
1216
diff
changeset
|
30 features:tag("auth", {xmlns='http://jabber.org/features/iq-auth'}):up(); |
8e02c10c9e60
mod_legacyauth: Hide stream feature when secure auth is enabled, and session isn't secure
Matthew Wild <mwild1@gmail.com>
parents:
1216
diff
changeset
|
31 end |
891
236d1ce9fa99
mod_legacyauth: Added stream feature: <auth xmlns='http://jabber.org/features/iq-auth'/>
Waqas Hussain <waqas20@gmail.com>
parents:
760
diff
changeset
|
32 end); |
421
63be85693710
Modules now sending disco replies
Waqas Hussain <waqas20@gmail.com>
parents:
308
diff
changeset
|
33 |
3527
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
34 module:hook("stanza/iq/jabber:iq:auth:query", function(event) |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
35 local session, stanza = event.origin, event.stanza; |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
36 |
3528
5cdcd7ee6ef5
mod_legacyauth: Limit authentication to unauthenticated client connections.
Waqas Hussain <waqas20@gmail.com>
parents:
3527
diff
changeset
|
37 if session.type ~= "c2s_unauthed" then |
8768
bd88ca43d77a
mod_legacyauth: Split a long line [luacheck]
Kim Alvefur <zash@zash.se>
parents:
6487
diff
changeset
|
38 (session.sends2s or session.send)(st.error_reply(stanza, "cancel", "service-unavailable", |
bd88ca43d77a
mod_legacyauth: Split a long line [luacheck]
Kim Alvefur <zash@zash.se>
parents:
6487
diff
changeset
|
39 "Legacy authentication is only allowed for unauthenticated client connections.")); |
3528
5cdcd7ee6ef5
mod_legacyauth: Limit authentication to unauthenticated client connections.
Waqas Hussain <waqas20@gmail.com>
parents:
3527
diff
changeset
|
40 return true; |
5cdcd7ee6ef5
mod_legacyauth: Limit authentication to unauthenticated client connections.
Waqas Hussain <waqas20@gmail.com>
parents:
3527
diff
changeset
|
41 end |
5cdcd7ee6ef5
mod_legacyauth: Limit authentication to unauthenticated client connections.
Waqas Hussain <waqas20@gmail.com>
parents:
3527
diff
changeset
|
42 |
3527
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
43 if secure_auth_only and not session.secure then |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
44 session.send(st.error_reply(stanza, "modify", "not-acceptable", "Encryption (SSL or TLS) is required to connect to this server")); |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
45 return true; |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
46 end |
5776
bd0ff8ae98a8
Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents:
5126
diff
changeset
|
47 |
6302
76699a0ae4c4
mod_lastactivity, mod_legacyauth, mod_presence, mod_saslauth, mod_tls: Use the newer stanza:get_child APIs and optimize away some table lookups
Kim Alvefur <zash@zash.se>
parents:
5776
diff
changeset
|
48 local query = stanza.tags[1]; |
76699a0ae4c4
mod_lastactivity, mod_legacyauth, mod_presence, mod_saslauth, mod_tls: Use the newer stanza:get_child APIs and optimize away some table lookups
Kim Alvefur <zash@zash.se>
parents:
5776
diff
changeset
|
49 local username = query:get_child("username"); |
76699a0ae4c4
mod_lastactivity, mod_legacyauth, mod_presence, mod_saslauth, mod_tls: Use the newer stanza:get_child APIs and optimize away some table lookups
Kim Alvefur <zash@zash.se>
parents:
5776
diff
changeset
|
50 local password = query:get_child("password"); |
76699a0ae4c4
mod_lastactivity, mod_legacyauth, mod_presence, mod_saslauth, mod_tls: Use the newer stanza:get_child APIs and optimize away some table lookups
Kim Alvefur <zash@zash.se>
parents:
5776
diff
changeset
|
51 local resource = query:get_child("resource"); |
3527
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
52 if not (username and password and resource) then |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
53 local reply = st.reply(stanza); |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
54 session.send(reply:query("jabber:iq:auth") |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
55 :tag("username"):up() |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
56 :tag("password"):up() |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
57 :tag("resource"):up()); |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
58 else |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
59 username, password, resource = t_concat(username), t_concat(password), t_concat(resource); |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
60 username = nodeprep(username); |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
61 resource = resourceprep(resource) |
5083
4629c60a303b
mod_legacyauth: Return an error if username or resource fails stringprep (thanks iron)
Kim Alvefur <zash@zash.se>
parents:
4258
diff
changeset
|
62 if not (username and resource) then |
4629c60a303b
mod_legacyauth: Return an error if username or resource fails stringprep (thanks iron)
Kim Alvefur <zash@zash.se>
parents:
4258
diff
changeset
|
63 session.send(st.error_reply(stanza, "modify", "bad-request")); |
4629c60a303b
mod_legacyauth: Return an error if username or resource fails stringprep (thanks iron)
Kim Alvefur <zash@zash.se>
parents:
4258
diff
changeset
|
64 return true; |
4629c60a303b
mod_legacyauth: Return an error if username or resource fails stringprep (thanks iron)
Kim Alvefur <zash@zash.se>
parents:
4258
diff
changeset
|
65 end |
3527
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
66 if usermanager.test_password(username, session.host, password) then |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
67 -- Authentication successful! |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
68 local success, err = sessionmanager.make_authenticated(session, username); |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
69 if success then |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
70 local err_type, err_msg; |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
71 success, err_type, err, err_msg = sessionmanager.bind_resource(session, resource); |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
72 if not success then |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
73 session.send(st.error_reply(stanza, err_type, err, err_msg)); |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
74 session.username, session.type = nil, "c2s_unauthed"; -- FIXME should this be placed in sessionmanager? |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
75 return true; |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
76 elseif resource ~= session.resource then -- server changed resource, not supported by legacy auth |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
77 session.send(st.error_reply(stanza, "cancel", "conflict", "The requested resource could not be assigned to this session.")); |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
78 session:close(); -- FIXME undo resource bind and auth instead of closing the session? |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
79 return true; |
30 | 80 end |
10557
e1cb869e2f6c
mod_legacyauth: Report failure from sessionmanager (mostly invalid username)
Kim Alvefur <zash@zash.se>
parents:
8768
diff
changeset
|
81 session.send(st.reply(stanza)); |
e1cb869e2f6c
mod_legacyauth: Report failure from sessionmanager (mostly invalid username)
Kim Alvefur <zash@zash.se>
parents:
8768
diff
changeset
|
82 else |
e1cb869e2f6c
mod_legacyauth: Report failure from sessionmanager (mostly invalid username)
Kim Alvefur <zash@zash.se>
parents:
8768
diff
changeset
|
83 session.send(st.error_reply(stanza, "auth", "not-authorized", err)); |
30 | 84 end |
3527
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
85 else |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
86 session.send(st.error_reply(stanza, "auth", "not-authorized")); |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
87 end |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
88 end |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
89 return true; |
59cdb9166bd0
mod_legacyauth: Updated to use the new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
3395
diff
changeset
|
90 end); |