prosody
79e410cd7f6e
plugins/mod_external_services.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Comparison

plugins/mod_external_services.lua @ 11036:79e410cd7f6e

mod_external_services: XEP-0215: External Service Discovery
author Kim Alvefur <zash@zash.se>
date Sat, 18 Jul 2020 15:36:25 +0200
child 11037:936ee55e1ae3
comparison
equal deleted inserted replaced
11035:ba1143ddae9b 11036:79e410cd7f6e
1
2 local dt = require "util.datetime";
3 local base64 = require "util.encodings".base64;
4 local hashes = require "util.hashes";
5 local st = require "util.stanza";
6 local jid = require "util.jid";
7
8 local default_host = module:get_option_string("external_service_host", module.host);
9 local default_port = module:get_option_number("external_service_port");
10 local default_secret = module:get_option_string("external_service_secret");
11 local default_ttl = module:get_option_number("external_service_ttl", 86400);
12
13 local configured_services = module:get_option_array("external_services", {});
14
15 local access = module:get_option_set("external_service_access", {});
16
17 -- filter config into well-defined service records
18 local function prepare(item)
19 if type(item) ~= "table" then
20 module:log("error", "Service definition is not a table: %q", item);
21 return nil;
22 end
23
24 local srv = {
25 type = nil;
26 transport = nil;
27 host = default_host;
28 port = default_port;
29 username = nil;
30 password = nil;
31 restricted = nil;
32 expires = nil;
33 };
34
35 if type(item.type) == "string" then
36 srv.type = item.type;
37 else
38 module:log("error", "Service missing mandatory 'type' field: %q", item);
39 return nil;
40 end
41 if type(item.transport) == "string" then
42 srv.transport = item.transport;
43 end
44 if type(item.host) == "string" then
45 srv.host = item.host;
46 end
47 if type(item.port) == "number" then
48 srv.port = item.port;
49 end
50 if type(item.username) == "string" then
51 srv.username = item.username;
52 end
53 if type(item.password) == "string" then
54 srv.password = item.password;
55 srv.restricted = true;
56 end
57 if item.restricted == true then
58 srv.restricted = true;
59 end
60 if type(item.expires) == "number" then
61 srv.expires = item.expires;
62 elseif type(item.ttl) == "number" then
63 srv.expires = os.time() + item.ttl;
64 end
65 if (item.secret == true and default_secret) or type(item.secret) == "string" then
66 local ttl = default_ttl;
67 if type(item.ttl) == "number" then
68 ttl = item.ttl;
69 end
70 local expires = os.time() + ttl;
71 local secret = item.secret;
72 if secret == true then
73 secret = default_secret;
74 end
75 local username;
76 if type(item.username) == "string" then
77 username = string.format("%d:%s", expires, item.username);
78 else
79 username = string.format("%d", expires);
80 end
81 srv.username = username;
82 srv.password = base64.encode(hashes.hmac_sha1(secret, srv.username));
83 srv.restricted = true;
84 end
85 return srv;
86 end
87
88 function module.load()
89 -- Trigger errors on startup
90 local services = configured_services / prepare;
91 if #services == 0 then
92 module:log("warn", "No services configured or all had errors");
93 end
94 end
95
96 local function handle_services(event)
97 local origin, stanza = event.origin, event.stanza;
98 local action = stanza.tags[1];
99
100 local user_bare = jid.bare(stanza.attr.from);
101 local user_host = jid.host(user_bare);
102 if not ((access:empty() and origin.type == "c2s") or access:contains(user_bare) or access:contains(user_host)) then
103 origin.send(st.error_reply(stanza, "auth", "forbidden"));
104 return true;
105 end
106
107 local reply = st.reply(stanza):tag("services", { xmlns = action.attr.xmlns });
108 local services = configured_services / prepare;
109
110 local requested_type = action.attr.type;
111 if requested_type then
112 services:filter(function(item)
113 return item.type == requested_type;
114 end);
115 end
116
117 module:fire_event("external_service/services", {
118 origin = origin;
119 stanza = stanza;
120 reply = reply;
121 requested_type = requested_type;
122 services = services;
123 });
124
125 for _, srv in ipairs(services) do
126 reply:tag("service", {
127 type = srv.type;
128 transport = srv.transport;
129 host = srv.host;
130 port = srv.port and string.format("%d", srv.port) or nil;
131 username = srv.username;
132 password = srv.password;
133 expires = srv.expires and dt.datetime(srv.expires) or nil;
134 restricted = srv.restricted and "1" or nil;
135 }):up();
136 end
137
138 origin.send(reply);
139 return true;
140 end
141
142 local function handle_credentials(event)
143 local origin, stanza = event.origin, event.stanza;
144 local action = stanza.tags[1];
145
146 if origin.type ~= "c2s" then
147 origin.send(st.error_reply(stanza, "auth", "forbidden"));
148 return true;
149 end
150
151 local reply = st.reply(stanza):tag("credentials", { xmlns = action.attr.xmlns });
152 local services = configured_services / prepare;
153 services:filter(function (item)
154 return item.restricted;
155 end)
156
157 local requested_credentials = {};
158 for service in action:childtags("service") do
159 table.insert(requested_credentials, {
160 type = service.attr.type;
161 host = service.attr.host;
162 port = tonumber(service.attr.port);
163 });
164 end
165
166 module:fire_event("external_service/credentials", {
167 origin = origin;
168 stanza = stanza;
169 reply = reply;
170 requested_credentials = requested_credentials;
171 services = services;
172 });
173
174 for req_srv in action:childtags("service") do
175 for _, srv in ipairs(services) do
176 if srv.type == req_srv.attr.type and srv.host == req_srv.attr.host
177 and not req_srv.attr.port or srv.port == tonumber(req_srv.attr.port) then
178 reply:tag("service", {
179 type = srv.type;
180 transport = srv.transport;
181 host = srv.host;
182 port = srv.port and string.format("%d", srv.port) or nil;
183 username = srv.username;
184 password = srv.password;
185 expires = srv.expires and dt.datetime(srv.expires) or nil;
186 restricted = srv.restricted and "1" or nil;
187 }):up();
188 end
189 end
190 end
191
192 origin.send(reply);
193 return true;
194 end
195
196 -- XEP-0215 v0.7
197 module:add_feature("urn:xmpp:extdisco:2");
198 module:hook("iq-get/host/urn:xmpp:extdisco:2:services", handle_services);
199 module:hook("iq-get/host/urn:xmpp:extdisco:2:credentials", handle_credentials);
200
201 -- COMPAT XEP-0215 v0.6
202 -- Those still on the old version gets to deal with undefined attributes until they upgrade.
203 module:add_feature("urn:xmpp:extdisco:1");
204 module:hook("iq-get/host/urn:xmpp:extdisco:1:services", handle_services);
205 module:hook("iq-get/host/urn:xmpp:extdisco:1:credentials", handle_credentials);