Mercurial > prosody-modules
annotate mod_s2s_blacklist/mod_s2s_blacklist.lua @ 5682:527c747711f3
mod_http_oauth2: Limit revocation to clients own tokens in strict mode
RFC 7009 section 2.1 states:
> The authorization server first validates the client credentials (in
> case of a confidential client) and then verifies whether the token was
> issued to the client making the revocation request. If this
> validation fails, the request is refused and the client is informed of
> the error by the authorization server as described below.
The first part was already covered (in strict mode). This adds the later
part using the hash of client_id recorded in 0860497152af
It still seems weird to me that revoking a leaked token should not be
allowed whoever might have discovered it, as that seems the responsible
thing to do.
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Sun, 29 Oct 2023 11:30:49 +0100 |
parents | d958558e0058 |
children |
rev | line source |
---|---|
1179
27b4e01ddbc4
mod_s2s_blacklist: A new _simple_ s2s blacklist module
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
1 local st = require "util.stanza"; |
27b4e01ddbc4
mod_s2s_blacklist: A new _simple_ s2s blacklist module
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
2 |
1325
b21236b6b8d8
Backed out changeset 853a382c9bd6
Kim Alvefur <zash@zash.se>
parents:
1324
diff
changeset
|
3 local blacklist = module:get_option_inherited_set("s2s_blacklist", {}); |
1179
27b4e01ddbc4
mod_s2s_blacklist: A new _simple_ s2s blacklist module
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
4 |
27b4e01ddbc4
mod_s2s_blacklist: A new _simple_ s2s blacklist module
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
5 module:hook("route/remote", function (event) |
1325
b21236b6b8d8
Backed out changeset 853a382c9bd6
Kim Alvefur <zash@zash.se>
parents:
1324
diff
changeset
|
6 if blacklist:contains(event.to_host) then |
2893
d958558e0058
mod_s2s_blacklist: Don't send error replies for error stanzas
Kim Alvefur <zash@zash.se>
parents:
1325
diff
changeset
|
7 if event.stanza.attr.type ~= "error" then |
d958558e0058
mod_s2s_blacklist: Don't send error replies for error stanzas
Kim Alvefur <zash@zash.se>
parents:
1325
diff
changeset
|
8 module:send(st.error_reply(event.stanza, "cancel", "not-allowed", "Communication with this domain is restricted")); |
d958558e0058
mod_s2s_blacklist: Don't send error replies for error stanzas
Kim Alvefur <zash@zash.se>
parents:
1325
diff
changeset
|
9 end |
1179
27b4e01ddbc4
mod_s2s_blacklist: A new _simple_ s2s blacklist module
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
10 return true; |
27b4e01ddbc4
mod_s2s_blacklist: A new _simple_ s2s blacklist module
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
11 end |
27b4e01ddbc4
mod_s2s_blacklist: A new _simple_ s2s blacklist module
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
12 end, 100); |
27b4e01ddbc4
mod_s2s_blacklist: A new _simple_ s2s blacklist module
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
13 |
27b4e01ddbc4
mod_s2s_blacklist: A new _simple_ s2s blacklist module
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
14 module:hook("s2s-stream-features", function (event) |
1325
b21236b6b8d8
Backed out changeset 853a382c9bd6
Kim Alvefur <zash@zash.se>
parents:
1324
diff
changeset
|
15 if blacklist:contains(event.origin.from_host) then |
1179
27b4e01ddbc4
mod_s2s_blacklist: A new _simple_ s2s blacklist module
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
16 event.origin:close({ |
27b4e01ddbc4
mod_s2s_blacklist: A new _simple_ s2s blacklist module
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
17 condition = "policy-violation"; |
27b4e01ddbc4
mod_s2s_blacklist: A new _simple_ s2s blacklist module
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
18 text = "Communication with this domain is restricted"; |
27b4e01ddbc4
mod_s2s_blacklist: A new _simple_ s2s blacklist module
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
19 }); |
27b4e01ddbc4
mod_s2s_blacklist: A new _simple_ s2s blacklist module
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
20 end |
27b4e01ddbc4
mod_s2s_blacklist: A new _simple_ s2s blacklist module
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
21 end, 1000); |