annotate mod_firewall/README.markdown @ 2545:9b46d24edf0d

mod_firewall: Add and document COUNT condition
author Matthew Wild <mwild1@gmail.com>
date Tue, 21 Feb 2017 22:41:58 +0000
parents d637bc0ac604
children 99b32f77f00d
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
1 ---
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
2 labels:
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
3 - 'Stage-Alpha'
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
4 summary: 'A rule-based stanza filtering module'
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
5 ...
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
6
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
7 ------------------------------------------------------------------------
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
8
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
9 **Note:** mod\_firewall is in its very early stages. This documentation
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
10 is liable to change, and some described functionality may be missing,
2375
7ad312b4cefe mod_firewall/README: Remove mention of comments section from google code
Kim Alvefur <zash@zash.se>
parents: 2370
diff changeset
11 incomplete or contain bugs.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
12
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
13 ------------------------------------------------------------------------
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
14
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
15 Introduction
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
16 ============
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
17
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
18 A firewall is an invaluable tool in the sysadmin's toolbox. However
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
19 while low-level firewalls such as iptables and pf are incredibly good at
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
20 what they do, they are generally not able to handle application-layer
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
21 rules.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
22
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
23 The goal of mod\_firewall is to provide similar services at the XMPP
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
24 layer. Based on rule scripts it can efficiently block, bounce, drop,
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
25 forward, copy, redirect stanzas and more! Furthermore all rules can be
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
26 applied and updated dynamically at runtime without restarting the
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
27 server.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
28
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
29 Details
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
30 =======
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
31
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
32 mod\_firewall loads one or more scripts, and compiles these to Lua code
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
33 that reacts to stanzas flowing through Prosody. The firewall script
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
34 syntax is unusual, but straightforward.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
35
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
36 A firewall script is dominated by rules. Each rule has two parts:
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
37 conditions, and actions. When a stanza matches all of the conditions,
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
38 all of the actions are executed in order.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
39
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
40 Here is a simple example to block stanzas from spammer@example.com:
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
41
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
42 FROM: spammer@example.com
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
43 DROP.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
44
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
45 FROM is a condition, and DROP is an action. This is about as simple as
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
46 it gets. How about heading to the other extreme? Let's demonstrate
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
47 something more complex that mod\_firewall can do for you:
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
48
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
49 %ZONE myorganisation: staff.myorg.example, support.myorg.example
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
50
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
51 ENTERING: myorganisation
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
52 KIND: message
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
53 TIME: 12am-9am, 5pm-12am, Saturday, Sunday
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
54 REPLY=Sorry, I am afraid our office is closed at the moment. If you need assistance, please call our 24-hour support line on 123-456-789.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
55
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
56 This rule will reply with a short message whenever someone tries to send
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
57 a message to someone at any of the hosts defined in the 'myorganisation'
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
58 outside of office hours.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
59
2387
5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files
Matthew Wild <mwild1@gmail.com>
parents: 2375
diff changeset
60 Specifying rule sets
5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files
Matthew Wild <mwild1@gmail.com>
parents: 2375
diff changeset
61 --------------------
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
62
2387
5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files
Matthew Wild <mwild1@gmail.com>
parents: 2375
diff changeset
63 Firewall rules should be written into text files, e.g. `ruleset.pfw` file.
5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files
Matthew Wild <mwild1@gmail.com>
parents: 2375
diff changeset
64 One or more rule files can be specified in the configuration using:
5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files
Matthew Wild <mwild1@gmail.com>
parents: 2375
diff changeset
65
5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files
Matthew Wild <mwild1@gmail.com>
parents: 2375
diff changeset
66 firewall_scripts = { "path/to/ruleset.pfw", "path/to/ruleset2.pfw" }
5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files
Matthew Wild <mwild1@gmail.com>
parents: 2375
diff changeset
67
5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files
Matthew Wild <mwild1@gmail.com>
parents: 2375
diff changeset
68 If multiple files are specified and they both add rules to the same chains,
5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files
Matthew Wild <mwild1@gmail.com>
parents: 2375
diff changeset
69 each file's rules will be processed in order, but the order of files is undefined.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
70
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
71 Conditions
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
72 ----------
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
73
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
74 All conditions must come before any action in a rule block. The
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
75 condition name is followed by a colon (':'), and the value to test for.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
76
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
77 A condition can be preceded or followed by `NOT` to negate its match.
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
78 For example:
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
79
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
80 NOT FROM: user@example.com
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
81 KIND NOT: message
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
82
2540
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
83 Some conditions do not take parameters, and these should end with just a
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
84 question mark, like:
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
85
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
86 IN ROSTER?
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
87
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
88 ### Zones
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
89
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
90 A 'zone' is one or more hosts or JIDs. It is possible to match when a
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
91 stanza is entering or leaving a zone, while at the same time not
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
92 matching traffic passing between JIDs in the same zone.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
93
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
94 Zones are defined at the top of a script with the following syntax (they
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
95 are not part of a rule block):
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
96
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
97 %ZONE myzone: host1, host2, user@host3, foo.bar.example
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
98
2388
b6d59998dba7 mod_firewall: README: Document dynamic '$local' zone
Matthew Wild <mwild1@gmail.com>
parents: 2387
diff changeset
99 There is an automatic zone named `$local`, which automatically includes
b6d59998dba7 mod_firewall: README: Document dynamic '$local' zone
Matthew Wild <mwild1@gmail.com>
parents: 2387
diff changeset
100 all of the current server's active hosts (including components). It can
b6d59998dba7 mod_firewall: README: Document dynamic '$local' zone
Matthew Wild <mwild1@gmail.com>
parents: 2387
diff changeset
101 be used to match stanzas entering or leaving the current server.
b6d59998dba7 mod_firewall: README: Document dynamic '$local' zone
Matthew Wild <mwild1@gmail.com>
parents: 2387
diff changeset
102
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
103 A host listed in a zone also matches all users on that host (but not
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
104 subdomains).
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
105
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
106 The following zone-matching conditions are supported:
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
107
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
108 Condition Matches
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
109 ------------ ------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
110 `ENTERING` When a stanza is entering the named zone
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
111 `LEAVING` When a stanza is leaving the named zone
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
112
2540
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
113 ### Lists
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
114
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
115 It is possible to create or load lists of strings for use in scripts. For example, you might load a JID blacklist,
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
116 a list of malware URLs or simple words that you want to filter messages on.
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
117
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
118 List type Example
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
119 ----------- -----------------------
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
120 memory %LIST spammers: memory
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
121 file %LIST spammers: file:/etc/spammers.txt
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
122 http %LIST spammers: http://example.com/spammers.txt
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
123
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
124 #### CHECK LIST
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
125
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
126 Checks whether a simple expression is found in a given list.
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
127
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
128 Example:
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
129
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
130 %LIST blacklist: file:/etc/prosody/blacklist.txt
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
131
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
132 # Rule to block presence subscription requests from blacklisted JIDs
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
133 KIND: presence
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
134 TYPE: subscribe
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
135 CHECK LIST: blacklist contains $<@from>
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
136 BOUNCE=policy-violation (Your JID is blacklisted)
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
137
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
138 #### SCAN
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
139
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
140 SCAN allows you to search inside a stanza for a given pattern, and check each result against a list. For example,
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
141 you could scan a message body for words and check if any of the words are found in a given list.
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
142
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
143 Before using SCAN, you need to define a search location and a pattern. The search location uses the same 'path'
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
144 format as documented under the 'INSPECT' condition. Patterns can be any valid Lua pattern.
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
145
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
146 To use the above example:
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
147
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
148 # Define a search location called 'body' which fetches the text of the 'body' element
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
149 %SEARCH body: body#
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
150 # Define a pattern called 'word' which matches any sequence of letters
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
151 %PATTERN word: [A-Za-z]+
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
152 # Finally, we also need our list of "bad" words:
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
153 %LIST badwords: file:/etc/prosody/bad_words.txt
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
154
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
155 # Now we can use these to SCAN incoming stanzas
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
156 # If it finds a match, bounce the stanza
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
157 SCAN: body for word in badwords
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
158 BOUNCE=policy-violation (This word is not allowed!)
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
159
2545
9b46d24edf0d mod_firewall: Add and document COUNT condition
Matthew Wild <mwild1@gmail.com>
parents: 2540
diff changeset
160 #### COUNT
9b46d24edf0d mod_firewall: Add and document COUNT condition
Matthew Wild <mwild1@gmail.com>
parents: 2540
diff changeset
161
9b46d24edf0d mod_firewall: Add and document COUNT condition
Matthew Wild <mwild1@gmail.com>
parents: 2540
diff changeset
162 COUNT is similar to SCAN, in that it uses a defined SEARCH and breaks it up according to a PATTERN. Then it
9b46d24edf0d mod_firewall: Add and document COUNT condition
Matthew Wild <mwild1@gmail.com>
parents: 2540
diff changeset
163 counts the number of results.
9b46d24edf0d mod_firewall: Add and document COUNT condition
Matthew Wild <mwild1@gmail.com>
parents: 2540
diff changeset
164
9b46d24edf0d mod_firewall: Add and document COUNT condition
Matthew Wild <mwild1@gmail.com>
parents: 2540
diff changeset
165 For example, to block every message with more than one URL:
9b46d24edf0d mod_firewall: Add and document COUNT condition
Matthew Wild <mwild1@gmail.com>
parents: 2540
diff changeset
166
9b46d24edf0d mod_firewall: Add and document COUNT condition
Matthew Wild <mwild1@gmail.com>
parents: 2540
diff changeset
167 # Define a search location called 'body' which fetches the text of the 'body' element
9b46d24edf0d mod_firewall: Add and document COUNT condition
Matthew Wild <mwild1@gmail.com>
parents: 2540
diff changeset
168 %SEARCH body: body#
9b46d24edf0d mod_firewall: Add and document COUNT condition
Matthew Wild <mwild1@gmail.com>
parents: 2540
diff changeset
169 # Define a pattern called 'url' which matches HTTP links
9b46d24edf0d mod_firewall: Add and document COUNT condition
Matthew Wild <mwild1@gmail.com>
parents: 2540
diff changeset
170 %PATTERN url: https?://%S+
9b46d24edf0d mod_firewall: Add and document COUNT condition
Matthew Wild <mwild1@gmail.com>
parents: 2540
diff changeset
171
9b46d24edf0d mod_firewall: Add and document COUNT condition
Matthew Wild <mwild1@gmail.com>
parents: 2540
diff changeset
172 COUNT: url in body > 1
9b46d24edf0d mod_firewall: Add and document COUNT condition
Matthew Wild <mwild1@gmail.com>
parents: 2540
diff changeset
173 BOUNCE=policy-violation (Up to one HTTP URL is allowed in messages)
9b46d24edf0d mod_firewall: Add and document COUNT condition
Matthew Wild <mwild1@gmail.com>
parents: 2540
diff changeset
174
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
175 ### Stanza matching
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
176
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
177 Condition Matches
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
178 ----------- ------------------------------------------------------------------------------------------------------------------------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
179 `KIND` The kind of stanza. May be 'message', 'presence' or 'iq'
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
180 `TYPE` The type of stanza. This varies depending on the kind of stanza. See 'Stanza types' below for more information.
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
181 `PAYLOAD` The stanza contains a child with the given namespace. Useful for determining the type of an iq request, or whether a message contains a certain extension.
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
182 `INSPECT` The node at the specified path exists or matches a given string. This allows you to look anywhere inside a stanza. See below for examples and more.
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
183
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
184 #### Stanza types
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
185
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
186 Stanza Valid types
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
187 ---------- ------------------------------------------------------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
188 iq get, set, result, error
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
189 presence *available*, unavailable, probe, subscribe, subscribed, unsubscribe, unsubscribed, error
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
190 message normal, chat, groupchat, headline, error
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
191
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
192 **Note:** The type 'available' for presence does not actually appear in
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
193 the protocol. Available presence is signalled by the omission of a type.
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
194 Similarly, a message stanza with no type is equivalent to one of type
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
195 'normal'. mod\_firewall handles these cases for you automatically.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
196
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
197 ### Sender/recipient matching
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
198
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
199 Condition Matches
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
200 ----------- -------------------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
201 `FROM` The JID in the 'from' attribute matches the given JID
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
202 `TO` The JID in the 'to' attribute matches the given JID
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
203
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
204 These conditions both accept wildcards in the JID when the wildcard
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
205 expression is enclosed in angle brackets ('\<...\>'). For example:
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
206
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
207 # All users at example.com
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
208 FROM: <*>@example.com
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
209
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
210 # The user 'admin' on any subdomain of example.com
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
211 FROM: admin@<*.example.com>
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
212
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
213 You can also use [Lua's pattern
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
214 matching](http://www.lua.org/manual/5.1/manual.html#5.4.1) for more
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
215 powerful matching abilities. Patterns are a lightweight
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
216 regular-expression alternative. Simply contain the pattern in double
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
217 angle brackets. The pattern is automatically anchored at the start and
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
218 end (so it must match the entire portion of the JID).
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
219
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
220 # Match admin@example.com, and admin1@example.com, etc.
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
221 FROM: <<admin%d*>>@example.com
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
222
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
223 **Note:** It is important to know that 'example.com' is a valid JID on
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
224 its own, and does **not** match 'user@example.com'. To perform domain
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
225 whitelists or blacklists, use Zones.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
226
2047
2ec7c0b8a371 mod_firewall/README: Fix table
Kim Alvefur <zash@zash.se>
parents: 2036
diff changeset
227 Condition Matches
2ec7c0b8a371 mod_firewall/README: Fix table
Kim Alvefur <zash@zash.se>
parents: 2036
diff changeset
228 ---------------- ---------------------------------------------------------------
2ec7c0b8a371 mod_firewall/README: Fix table
Kim Alvefur <zash@zash.se>
parents: 2036
diff changeset
229 `FROM_EXACTLY` The JID in the 'from' attribute exactly matches the given JID
2ec7c0b8a371 mod_firewall/README: Fix table
Kim Alvefur <zash@zash.se>
parents: 2036
diff changeset
230 `TO_EXACTLY` The JID in the 'to' attribute exactly matches the given JID
2036
7ba6ed553c93 mod_firewall/conditions: Add FROM_EXACTLY and TO_EXACTLY
Matthew Wild <mwild1@gmail.com>
parents: 2002
diff changeset
231
7ba6ed553c93 mod_firewall/conditions: Add FROM_EXACTLY and TO_EXACTLY
Matthew Wild <mwild1@gmail.com>
parents: 2002
diff changeset
232 These additional conditions do not support pattern matching, but are
7ba6ed553c93 mod_firewall/conditions: Add FROM_EXACTLY and TO_EXACTLY
Matthew Wild <mwild1@gmail.com>
parents: 2002
diff changeset
233 useful to match the exact to/from address on a stanza. For example, if
7ba6ed553c93 mod_firewall/conditions: Add FROM_EXACTLY and TO_EXACTLY
Matthew Wild <mwild1@gmail.com>
parents: 2002
diff changeset
234 no resource is specified then only bare JIDs will be matched. TO and FROM
7ba6ed553c93 mod_firewall/conditions: Add FROM_EXACTLY and TO_EXACTLY
Matthew Wild <mwild1@gmail.com>
parents: 2002
diff changeset
235 match all resources if no resource is specified to match.
7ba6ed553c93 mod_firewall/conditions: Add FROM_EXACTLY and TO_EXACTLY
Matthew Wild <mwild1@gmail.com>
parents: 2002
diff changeset
236
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
237 **Note:** Some chains execute before Prosody has performed any
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
238 normalisation or validity checks on the to/from JIDs on an incoming
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
239 stanza. It is not advisable to perform access control or similar rules
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
240 on JIDs in these chains (see the chain documentation for more info).
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
241
2540
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
242 #### INSPECT
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
243
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
244 INSPECT takes a 'path' through the stanza to get a string (an attribute
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
245 value or text content). An example is the best way to explain. Let's
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
246 check that a user is not trying to register an account with the username
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
247 'admin'. This stanza comes from [XEP-0077: In-band
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
248 Registration](http://xmpp.org/extensions/xep-0077.html#example-4):
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
249
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
250 ``` xml
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
251 <iq type='set' id='reg2'>
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
252 <query xmlns='jabber:iq:register'>
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
253 <username>bill</username>
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
254 <password>Calliope</password>
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
255 <email>bard@shakespeare.lit</email>
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
256 </query>
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
257 </iq>
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
258 ```
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
259
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
260 KIND: iq
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
261 TYPE: set
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
262 PAYLOAD: jabber:iq:register
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
263 INSPECT: {jabber:iq:register}query/username#=admin
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
264 BOUNCE=not-allowed (The username 'admin' is reserved.)
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
265
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
266 That weird string deserves some explanation. It is a path, divided into
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
267 segments by '/'. Each segment describes an element by its name,
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
268 optionally prefixed by its namespace in curly braces ('{...}'). If the
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
269 path ends with a '\#' then the text content of the last element will be
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
270 returned. If the path ends with '@name' then the value of the attribute
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
271 'name' will be returned.
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
272
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
273 You can use INSPECT to test for the existence of an element or attribute,
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
274 or you can see if it is equal to a string by appending `=STRING` (as in the
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
275 example above). Finally,you can also test whether it matches a given Lua
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
276 pattern by using `~=PATTERN`.
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
277
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
278 INSPECT is somewhat slower than the other stanza matching conditions. To
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
279 minimise performance impact, always place it below other faster
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
280 condition checks where possible (e.g. above we first checked KIND, TYPE
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
281 and PAYLOAD matched before INSPECT).
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
282
2342
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2114
diff changeset
283 ### Roster
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2114
diff changeset
284
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2114
diff changeset
285 These functions access the roster of the recipient (only). Therefore they cannot (currently)
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2114
diff changeset
286 be used in some chains, such as for outgoing messages (the recipient may be on another server).
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2114
diff changeset
287
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2114
diff changeset
288 Performance note: this check can potentially cause storage access (especially if the recipient
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2114
diff changeset
289 is currently offline), so you may want to limit its use in high-traffic situations, and place
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2114
diff changeset
290 it below other checks (such as a rate limiter).
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2114
diff changeset
291
2540
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
292 #### IN ROSTER
2342
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2114
diff changeset
293
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2114
diff changeset
294 Tests whether the sender is in the recipient's roster.
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2114
diff changeset
295
2540
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
296 IN ROSTER?
2342
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2114
diff changeset
297
2540
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
298 #### IN ROSTER GROUP
2342
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2114
diff changeset
299
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2114
diff changeset
300 Tests whether the sender is in the recipient's roster, and in the named group.
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2114
diff changeset
301
2540
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
302 IN ROSTER GROUP: Friends
2342
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2114
diff changeset
303
2410
898e70e85185 mod_firewall/README: Document SUBSCRIBED
Kim Alvefur <zash@zash.se>
parents: 2390
diff changeset
304 #### SUBSCRIBED
898e70e85185 mod_firewall/README: Document SUBSCRIBED
Kim Alvefur <zash@zash.se>
parents: 2390
diff changeset
305
898e70e85185 mod_firewall/README: Document SUBSCRIBED
Kim Alvefur <zash@zash.se>
parents: 2390
diff changeset
306 Tests whether the recipient is subscribed to the sender, ie will receive
898e70e85185 mod_firewall/README: Document SUBSCRIBED
Kim Alvefur <zash@zash.se>
parents: 2390
diff changeset
307 presence updates from them.
898e70e85185 mod_firewall/README: Document SUBSCRIBED
Kim Alvefur <zash@zash.se>
parents: 2390
diff changeset
308
898e70e85185 mod_firewall/README: Document SUBSCRIBED
Kim Alvefur <zash@zash.se>
parents: 2390
diff changeset
309 Note that this *does* work, regardless of direction and which chain is
898e70e85185 mod_firewall/README: Document SUBSCRIBED
Kim Alvefur <zash@zash.se>
parents: 2390
diff changeset
310 used, since both the sender and the recipient will have mirrored roster
898e70e85185 mod_firewall/README: Document SUBSCRIBED
Kim Alvefur <zash@zash.se>
parents: 2390
diff changeset
311 entries.
898e70e85185 mod_firewall/README: Document SUBSCRIBED
Kim Alvefur <zash@zash.se>
parents: 2390
diff changeset
312
2390
28fbe960adcf mod_firewall: README: Document conditions for groups and admins
Matthew Wild <mwild1@gmail.com>
parents: 2389
diff changeset
313 ### Groups
28fbe960adcf mod_firewall: README: Document conditions for groups and admins
Matthew Wild <mwild1@gmail.com>
parents: 2389
diff changeset
314
28fbe960adcf mod_firewall: README: Document conditions for groups and admins
Matthew Wild <mwild1@gmail.com>
parents: 2389
diff changeset
315 Using Prosody's mod\_groups it is possible to define groups of users on the server. You can
28fbe960adcf mod_firewall: README: Document conditions for groups and admins
Matthew Wild <mwild1@gmail.com>
parents: 2389
diff changeset
316 match based on these groups in firewall rules.
28fbe960adcf mod_firewall: README: Document conditions for groups and admins
Matthew Wild <mwild1@gmail.com>
parents: 2389
diff changeset
317
28fbe960adcf mod_firewall: README: Document conditions for groups and admins
Matthew Wild <mwild1@gmail.com>
parents: 2389
diff changeset
318 Condition Matches
28fbe960adcf mod_firewall: README: Document conditions for groups and admins
Matthew Wild <mwild1@gmail.com>
parents: 2389
diff changeset
319 ------------- ----------------------------
2540
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
320 `FROM GROUP` When the stanza is being sent from a member of the named group
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
321 `TO GROUP` When the stanza is being sent to a member of the named group
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
322
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
323 #### SENT DIRECTED PRESENCE TO SENDER
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
324
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
325 This condition matches if the recipient of a stanza has previously sent directed presence to the sender of the stanza. This
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
326 is often done in XMPP to exchange presence information with JIDs that are not on your roster, such as MUC rooms.
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
327
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
328 This condition does not take a parameter - end the condition name with a question mark:
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
329
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
330 # Rule to bounce messages from senders not in the roster who haven't been sent directed presence
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
331 NOT IN ROSTER?
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
332 NOT SENT DIRECTED PRESENCE TO SENDER?
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
333 BOUNCE=service-unavailable
2390
28fbe960adcf mod_firewall: README: Document conditions for groups and admins
Matthew Wild <mwild1@gmail.com>
parents: 2389
diff changeset
334
28fbe960adcf mod_firewall: README: Document conditions for groups and admins
Matthew Wild <mwild1@gmail.com>
parents: 2389
diff changeset
335 ### Admins
28fbe960adcf mod_firewall: README: Document conditions for groups and admins
Matthew Wild <mwild1@gmail.com>
parents: 2389
diff changeset
336
28fbe960adcf mod_firewall: README: Document conditions for groups and admins
Matthew Wild <mwild1@gmail.com>
parents: 2389
diff changeset
337 Prosody allows certain JIDs to be declared as administrators of a host, component or the whole server.
28fbe960adcf mod_firewall: README: Document conditions for groups and admins
Matthew Wild <mwild1@gmail.com>
parents: 2389
diff changeset
338
28fbe960adcf mod_firewall: README: Document conditions for groups and admins
Matthew Wild <mwild1@gmail.com>
parents: 2389
diff changeset
339 Condition Matches
28fbe960adcf mod_firewall: README: Document conditions for groups and admins
Matthew Wild <mwild1@gmail.com>
parents: 2389
diff changeset
340 -------------- ----------------------------------
2540
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
341 FROM ADMIN OF When the sender of the stanza is an admin of the named host on the current server
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
342 TO ADMIN OF When the recipient of the stanza is an admin of the named host on the current server
2390
28fbe960adcf mod_firewall: README: Document conditions for groups and admins
Matthew Wild <mwild1@gmail.com>
parents: 2389
diff changeset
343
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
344 ### Time and date
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
345
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
346 #### TIME
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
347
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
348 Matches stanzas sent during certain time periods.
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
349
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
350 Condition Matches
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
351 ----------- -------------------------------------------------------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
352 TIME When the current server local time is within one of the comma-separated time ranges given
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
353
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
354 TIME: 10pm-6am, 14:00-15:00
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
355 REPLY=Zzzz.
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
356
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
357 #### DAY
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
358
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
359 It is also possible to match only on certain days of the week.
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
360
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
361 Condition Matches
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
362 ----------- -----------------------------------------------------------------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
363 DAY When the current day matches one, or falls within a rage, in the given comma-separated list of days
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
364
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
365 Example:
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
366
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
367 DAY: Sat-Sun, Wednesday
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
368 REPLY=Sorry, I'm out enjoying life!
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
369
2102
2c225b4b93d2 mod_firewall: README: Add note about time functions using server's local time
Matthew Wild <mwild1@gmail.com>
parents: 2096
diff changeset
370 All times and dates are handled in the server's local time.
2c225b4b93d2 mod_firewall: README: Add note about time functions using server's local time
Matthew Wild <mwild1@gmail.com>
parents: 2096
diff changeset
371
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
372 ### Rate-limiting
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
373
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
374 It is possible to selectively rate-limit stanzas, and use rules to
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
375 decide what to do with stanzas when over the limit.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
376
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
377 First, you must define any rate limits that you are going to use in your
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
378 script. Here we create a limiter called 'normal' that will allow 2
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
379 stanzas per second, and then we define a rule to bounce messages when
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
380 over this limit. Note that the `RATE` definition is not part of a rule
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
381 (multiple rules can share the same limiter).
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
382
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
383 %RATE normal: 2 (burst 3)
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
384
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
385 KIND: message
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
386 LIMIT: normal
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
387 BOUNCE=policy-violation (Sending too fast!)
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
388
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
389 The 'burst' parameter on the rate limit allows you to spread the limit
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
390 check over a given time period. For example the definition shown above
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
391 will allow the limit to be temporarily surpassed, as long as it is
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
392 within the limit after 3 seconds. You will almost always want to specify
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
393 a burst factor.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
394
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
395 Both the rate and the burst can be fractional values. For example a rate
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
396 of 0.1 means only one event is allowed every 10 seconds.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
397
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
398 The LIMIT condition actually does two things; first it counts against
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
399 the given limiter, and then it checks to see if the limiter over its
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
400 limit yet. If it is, the condition matches, otherwise it will not.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
401
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
402 Condition Matches
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
403 ----------- --------------------------------------------------------------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
404 `LIMIT` When the named limit is 'used up'. Using this condition automatically counts against that limit.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
405
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
406 **Note:** Reloading mod\_firewall resets the current state of any
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
407 limiters.
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
408
2369
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
409 #### Dynamic limits
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
410
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
411 Sometimes you may want to have multiple throttles in a single condition, using some property of the session or stanza
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
412 to determine which throttle to use. For example, you might have a limit for incoming stanzas, but you want to limit by
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
413 sending JID, instead of all incoming stanzas sharing the same limit.
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
414
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
415 You can use the 'on' keyword for this, like so:
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
416
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
417 LIMIT: normal on EXPRESSION
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
418
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
419 For more information on expressions, see the section later in this document.
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
420
2370
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full
Matthew Wild <mwild1@gmail.com>
parents: 2369
diff changeset
421 Each value of 'EXPRESSION' has to be tracked individually in a table, which uses a small amount of memory. To prevent
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full
Matthew Wild <mwild1@gmail.com>
parents: 2369
diff changeset
422 memory exhaustion, the number of tracked values is limited to 1000 by default. You can override this by setting the
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full
Matthew Wild <mwild1@gmail.com>
parents: 2369
diff changeset
423 maximum number of table entries when you define the rate:
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full
Matthew Wild <mwild1@gmail.com>
parents: 2369
diff changeset
424
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full
Matthew Wild <mwild1@gmail.com>
parents: 2369
diff changeset
425 %RATE normal: 2 (burst 3) (entries 4096)
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full
Matthew Wild <mwild1@gmail.com>
parents: 2369
diff changeset
426
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full
Matthew Wild <mwild1@gmail.com>
parents: 2369
diff changeset
427 Old values are automatically removed from the tracking table. However if the tracking table becomes full, new entries
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full
Matthew Wild <mwild1@gmail.com>
parents: 2369
diff changeset
428 will be rejected - it will behave as if the rate limit was reached, even for values that have not been seen before. Since
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full
Matthew Wild <mwild1@gmail.com>
parents: 2369
diff changeset
429 this opens up a potential denial of service (innocent users may be affected if malicious users can fill up the tracking
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full
Matthew Wild <mwild1@gmail.com>
parents: 2369
diff changeset
430 table within the limit period). You can choose to instead "fail open", and allow the rate limit to be temporarily bypassed
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full
Matthew Wild <mwild1@gmail.com>
parents: 2369
diff changeset
431 when the table is full. To choose this behaviour, add `(allow overflow)` to the RATE definition.
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full
Matthew Wild <mwild1@gmail.com>
parents: 2369
diff changeset
432
2108
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
433 ### Session marking
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
434
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
435 It is possible to 'mark' sessions (see the MARK_ORIGIN action below). To match stanzas from marked sessions, use the
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
436 `ORIGIN_MARKED` condition.
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
437
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
438 Condition Description
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
439 ------------------------------- ---------------------------------------------------------------
2540
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
440 ORIGIN MARKED: markname Matches if the origin has been marked with 'markname'.
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
441 ORIGIN MARKED: markname (Xs) Matches if the origin has been marked with 'markname' within the past X seconds.
2108
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
442
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
443 Example usage:
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
444
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
445 # This rule drops messages from sessions that have been marked as spammers in the past hour
2540
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
446 ORIGIN MARKED: spammer (3600s)
2108
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
447 DROP.
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
448
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
449 # This rule marks the origin session as a spammer if they send a message to a honeypot JID
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
450 KIND: message
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
451 TO: honeypot@example.com
2540
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
452 MARK ORIGIN=spammer
2108
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
453
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
454 Actions
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
455 -------
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
456
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
457 Actions come after all conditions in a rule block. There must be at
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
458 least one action, though conditions are optional.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
459
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
460 An action without parameters ends with a full-stop/period ('.'), and one
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
461 with parameters uses an equals sign ('='):
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
462
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
463 # An action with no parameters:
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
464 DROP.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
465
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
466 # An action with a parameter:
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
467 REPLY=Hello, this is a reply.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
468
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
469 ### Route modification
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
470
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
471 The most common actions modify the stanza's route in some way. Currently
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
472 the first matching rule to do so will halt further processing of actions
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
473 and rules (this may change in the future).
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
474
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
475 Action Description
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
476 ----------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
477 `PASS.` Stop executing actions and rules on this stanza, and let it through this chain.
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
478 `DROP.` Stop executing actions and rules on this stanza, and discard it.
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
479 `REDIRECT=jid` Redirect the stanza to the given JID.
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
480 `REPLY=text` Reply to the stanza (assumed to be a message) with the given text.
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
481 `BOUNCE.` Bounce the stanza with the default error (usually service-unavailable)
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
482 `BOUNCE=error` Bounce the stanza with the given error (MUST be a defined XMPP stanza error, see [RFC6120](http://xmpp.org/rfcs/rfc6120.html#stanzas-error-conditions).
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
483 `BOUNCE=error (text)` As above, but include the supplied human-readable text with a description of the error
2092
f5d78bc016a6 mod_firewall: README: Add warning about COPY action's ability to cause loops (thanks Ge0rG)
Matthew Wild <mwild1@gmail.com>
parents: 2047
diff changeset
484 `COPY=jid` Make a copy of the stanza and send the copy to the specified JID. The copied stanza flows through Prosody's routing code, and as such is affected by firewall rules. Be careful to avoid loops.
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
485
2095
3b4a6d255d7a mod_firewall: README: Add note about BOUNCE and error stanzas/iq results
Matthew Wild <mwild1@gmail.com>
parents: 2093
diff changeset
486 **Note:** It is incorrect behaviour to reply to an 'error' stanza with another error, so BOUNCE will simply act the same as 'DROP' for stanzas that should not be bounced (error stanzas and iq results).
3b4a6d255d7a mod_firewall: README: Add note about BOUNCE and error stanzas/iq results
Matthew Wild <mwild1@gmail.com>
parents: 2093
diff changeset
487
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
488 ### Stanza modification
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
489
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
490 These actions make it possible to modify the content and structure of a
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
491 stanza.
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
492
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
493 Action Description
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
494 ------------------------ ------------------------------------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
495 `STRIP=name` Remove any child elements with the given name in the default namespace
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
496 `STRIP=name namespace` Remove any child elements with the given name and the given namespace
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
497 `INJECT=xml` Inject the given XML into the stanza as a child element
1782
29f3d6b7ad16 Import wiki pages
Kim Alvefur <zash@zash.se>
parents:
diff changeset
498
2108
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
499 ### Sessions
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
500
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
501 It is possible to mark sessions, and then use these marks to match rules later on.
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
502
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
503 Action Description
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
504 ------------------------ --------------------------------------------------------------------------
2540
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
505 `MARK ORIGIN=mark` Marks the originating session with the given flag.
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
506 `UNMARK ORIGIN=mark` Removes the given mark from the origin session (if it is set).
2108
573fe9825fba mod_firewall: README: Document session marking
Matthew Wild <mwild1@gmail.com>
parents: 2105
diff changeset
507
2114
ce3dd93f30d9 mod_firewall: README: Note about marks applying to sessions, not JIDs
Matthew Wild <mwild1@gmail.com>
parents: 2111
diff changeset
508 **Note:** Marks apply to sessions, not JIDs. E.g. if marking in a rule that matches a stanza received
ce3dd93f30d9 mod_firewall: README: Note about marks applying to sessions, not JIDs
Matthew Wild <mwild1@gmail.com>
parents: 2111
diff changeset
509 over s2s, it is the s2s session that is marked.
ce3dd93f30d9 mod_firewall: README: Note about marks applying to sessions, not JIDs
Matthew Wild <mwild1@gmail.com>
parents: 2111
diff changeset
510
ce3dd93f30d9 mod_firewall: README: Note about marks applying to sessions, not JIDs
Matthew Wild <mwild1@gmail.com>
parents: 2111
diff changeset
511 It is possible to have multiple marks on an origin at any given time.
ce3dd93f30d9 mod_firewall: README: Note about marks applying to sessions, not JIDs
Matthew Wild <mwild1@gmail.com>
parents: 2111
diff changeset
512
1803
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
513 ### Informational
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
514
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
515 Action Description
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
516 --------------- ------------------------------------------------------------------------------------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown
Kim Alvefur <zash@zash.se>
parents: 1782
diff changeset
517 `LOG=message` Logs the given message to Prosody's log file. Optionally prefix it with a log level in square brackets, e.g. `[debug]`
2093
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions
Matthew Wild <mwild1@gmail.com>
parents: 2092
diff changeset
518
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions
Matthew Wild <mwild1@gmail.com>
parents: 2092
diff changeset
519 You can include expressions in log messages, using `$(...)` syntax. For example, to log the stanza that matched the rule, you can use $(stanza),
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions
Matthew Wild <mwild1@gmail.com>
parents: 2092
diff changeset
520 or to log just the top tag of the stanza, use $(stanza:top_tag()).
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions
Matthew Wild <mwild1@gmail.com>
parents: 2092
diff changeset
521
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions
Matthew Wild <mwild1@gmail.com>
parents: 2092
diff changeset
522 Example:
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions
Matthew Wild <mwild1@gmail.com>
parents: 2092
diff changeset
523
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions
Matthew Wild <mwild1@gmail.com>
parents: 2092
diff changeset
524 # Log all stanzas to user@example.com:
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions
Matthew Wild <mwild1@gmail.com>
parents: 2092
diff changeset
525 TO: user@example.com
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions
Matthew Wild <mwild1@gmail.com>
parents: 2092
diff changeset
526 LOG=[debug] User received: $(stanza)
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions
Matthew Wild <mwild1@gmail.com>
parents: 2092
diff changeset
527
2369
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
528 More info about expressions can be found below.
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
529
2096
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
530 Chains
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
531 ------
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
532
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
533 Rules are grouped into "chains", which are injected at particular points in Prosody's routing code.
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
534
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
535 Available chains are:
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
536
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
537 Chain Description
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
538 -------------- -------------------------------------------------------------------------------------------
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
539 deliver Applies to stanzas delivered to local recipients (regardless of the stanza's origin)
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
540 deliver_remote Applies to stanzas delivered to remote recipients (just before they leave the local server)
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
541 preroute Applies to incoming stanzas from local users, before any routing rules are applied
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
542
2111
4e434abaf8fc mod_firewall: README: Improve chain documentation
Matthew Wild <mwild1@gmail.com>
parents: 2110
diff changeset
543 A chain is begun by a line `::name` where 'name' is the name of the chain you want the following rules to be
4e434abaf8fc mod_firewall: README: Improve chain documentation
Matthew Wild <mwild1@gmail.com>
parents: 2110
diff changeset
544 inserted into. If no chain is specified, rules are put into the 'deliver' chain.
4e434abaf8fc mod_firewall: README: Improve chain documentation
Matthew Wild <mwild1@gmail.com>
parents: 2110
diff changeset
545
4e434abaf8fc mod_firewall: README: Improve chain documentation
Matthew Wild <mwild1@gmail.com>
parents: 2110
diff changeset
546 It is possible to create custom chains (useful with the JUMP_CHAIN action described below). User-created
4e434abaf8fc mod_firewall: README: Improve chain documentation
Matthew Wild <mwild1@gmail.com>
parents: 2110
diff changeset
547 chains must begin with "user/", e.g. "user/spam_filtering".
2096
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
548
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
549 Example of chain use:
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
550
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
551 # example.com's firewall script
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
552
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
553 # This line is optional, because 'deliver' is the default chain anyway:
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
554 ::deliver
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
555
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
556 # This rule matches any stanzas delivered to our local user bob:
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
557 TO: bob@example.com
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
558 DROP.
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
559
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
560 # Oops! This rule will never match, because alice is not a local user,
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
561 # and only stanzas to local users go through the 'deliver' chain:
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
562 TO: alice@remote.example.com
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
563 DROP.
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
564
2104
384fb28452b9 mod_firewall: README: Improve chain usage example comments
Matthew Wild <mwild1@gmail.com>
parents: 2103
diff changeset
565 # Create a 'preroute' chain of rules (matched for incoming stanzas from local clients):
2096
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
566 ::preroute
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
567 # These rules are matched for outgoing stanzas from local clients
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
568
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
569 # This will match any stanzas sent to alice from a local user:
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
570 TO: alice@remote.example.com
b75d29a162cd mod_firewall: README: Document chains
Matthew Wild <mwild1@gmail.com>
parents: 2095
diff changeset
571 DROP.
2105
f2d5aa789646 mod_firewall: README: Document JUMP_CHAIN
Matthew Wild <mwild1@gmail.com>
parents: 2104
diff changeset
572
f2d5aa789646 mod_firewall: README: Document JUMP_CHAIN
Matthew Wild <mwild1@gmail.com>
parents: 2104
diff changeset
573 Action Description
f2d5aa789646 mod_firewall: README: Document JUMP_CHAIN
Matthew Wild <mwild1@gmail.com>
parents: 2104
diff changeset
574 ------------------------ ------------------------------------------------------------------------
2540
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
575 `JUMP CHAIN=name` Switches chains, and passes the stanza through the rules in chain 'name'. If the new chain causes the stanza to be dropped/redirected, the current chain halts further processing.
2369
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
576
2389
a753b21968c5 mod_firewall: README: Clarify that it's possible to jump to chains defined outside of the current file
Matthew Wild <mwild1@gmail.com>
parents: 2388
diff changeset
577 It is possible to jump to chains defined by other scripts and modules.
a753b21968c5 mod_firewall: README: Clarify that it's possible to jump to chains defined outside of the current file
Matthew Wild <mwild1@gmail.com>
parents: 2388
diff changeset
578
2369
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
579 Expressions
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
580 -----------
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
581
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
582 Some conditions and actions in rules support "expressions" in their parameters (their documentation will indicate if this is the case). Most parameters
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
583 are static once the firewall script is loaded and compiled internally, however parameters that allow expressions can be dynamically calculated when a
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
584 rule is being run.
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
585
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
586 There are two kinds of expression that you can use: stanza expressions, and code expressions.
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
587
2540
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
588 ### Stanza expressions
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
589
2369
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
590 Stanza expressions are of the form `$<...>`, where `...` is a stanza path. For syntax of stanza paths, see the documentation for the 'INSPECT' condition
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
591 above.
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
592
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
593 Example:
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
594
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
595 LOG=Matched a stanza from $<@from> to $<@to>
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
596
2540
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
597 There are built in functions which can be applied to the output of a stanza expression, by appending the pipe ('|') operator, followed by the function
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
598 name. These functions are:
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
599
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
600 Function Description
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
601 ------------ ---------------------------------------
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
602 bare Given a JID, strip any resource
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
603 node Return the node ('user part') of a JID
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
604 host Return the host ('domain') part of a JID
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
605 resource Return the resource part of a JID
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
606
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
607 For example, to apply a rate limit to stanzas per sender domain:
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
608
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
609 LIMIT normal on $<@from|domain>
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
610
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
611 If the path does not match (e.g. the element isn't found, or the attribute doesn't exist) or any of the functions fail to produce an output (e.g. an invalid
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
612 JID was passed to a function that only handles valid JIDs) the expression will return the text `<undefined>`. You can override this by ending the expression
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
613 with a double pipe ('||') followed by a quoted string to use as a default instead. E.g. to default to the string "normal" when there is no 'type' attribute:
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
614
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
615 LOG=Stanza type is $<@type||"normal">
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
616
d637bc0ac604 mod_firewall: Update README for latest changes
Matthew Wild <mwild1@gmail.com>
parents: 2410
diff changeset
617 ### Code expressions
2369
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
618
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
619 Code expressions use `$(...)` syntax. Code expressions are powerful, and allow unconstrained access to Prosody's internal environment. Therefore
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
620 code expressions are typically for advanced use-cases only. You may want to refer to Prosody's [developer documentation](https://prosody.im/doc/developers)
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
621 for more information. In particular, within code expressions you may access the 'session' object, which is the session object of the origin of the stanza,
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
622 and the 'stanza' object, which is the stanza being considered within the current rule. Whatever value the expression returns will be converted to a string.
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
623
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
624 Example to limit stanzas per session type:
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
625
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax
Matthew Wild <mwild1@gmail.com>
parents: 2360
diff changeset
626 LIMIT: normal on $(session.type)