Software / code / prosody
Changeset
4589:8553d822f417
mod_s2s: streamopened(): Tighter validation around stream 'to' and 'from' attributes, and only set to_host and from_host if they aren't set already and if the session hasn't already been authenticated
| author | Matthew Wild <mwild1@gmail.com> |
|---|---|
| date | Mon, 05 Mar 2012 11:07:10 +0000 |
| parents | 4588:3e7702891649 |
| children | 4591:75b3d0c301d0 4592:0a9528b178fd |
| files | plugins/s2s/mod_s2s.lua |
| diffstat | 1 files changed, 27 insertions(+), 3 deletions(-) [+] |
line wrap: on
line diff
--- a/plugins/s2s/mod_s2s.lua Sat Mar 03 18:27:32 2012 +0000 +++ b/plugins/s2s/mod_s2s.lua Mon Mar 05 11:07:10 2012 +0000 @@ -168,9 +168,33 @@ if session.direction == "incoming" then -- Send a reply stream header - session.to_host = attr.to and nameprep(attr.to); - session.from_host = attr.from and nameprep(attr.from); - + + -- Validate to/from + local to, from = nameprep(attr.to), nameprep(attr.from); + if not to and attr.to then -- COMPAT: Some servers do not reliably set 'to' (especially on stream restarts) + session:close({ condition = "improper-addressing", text = "Invalid 'to' address" }); + return; + end + if not from and attr.from then -- COMPAT: Some servers do not reliably set 'from' (especially on stream restarts) + session:close({ condition = "improper-addressing", text = "Invalid 'from' address" }); + return; + end + + -- Set session.[from/to]_host if they have not been set already and if + -- this session isn't already authenticated + if session.type == "s2sin_unauthed" and from and not session.from_host then + session.from_host = from; + elseif from ~= session.from_host then + session:close({ condition = "improper-addressing", text = "New stream 'from' attribute does not match original" }); + return; + end + if session.type == "s2sin_unauthed" and to and not session.to_host then + session.to_host = to; + elseif to ~= session.to_host then + session:close({ condition = "improper-addressing", text = "New stream 'to' attribute does not match original" }); + return; + end + session.streamid = uuid_gen(); (session.log or log)("debug", "Incoming s2s received <stream:stream>"); if session.to_host then
