Mercurial > prosody-modules
annotate mod_component_guard/mod_component_guard.lua @ 461:bbea8081c865
Revert various changes accidentally included in previous commit
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Sat, 29 Oct 2011 13:34:15 +0200 |
parents | 9bb9343f3c7a |
children |
rev | line source |
---|---|
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
1 -- Block or restrict by blacklist remote access to local components. |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
2 |
460
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
3 module:set_global() |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
4 |
459
3117d7e207c5
mod_component_guard: added default empty table entries for config options (is it even valid for true sets?)
Marco Cirillo <maranda@lightwitch.org>
parents:
458
diff
changeset
|
5 local guard_blockall = module:get_option_set("component_guard_blockall", {}) |
3117d7e207c5
mod_component_guard: added default empty table entries for config options (is it even valid for true sets?)
Marco Cirillo <maranda@lightwitch.org>
parents:
458
diff
changeset
|
6 local guard_protect = module:get_option_set("component_guard_components", {}) |
3117d7e207c5
mod_component_guard: added default empty table entries for config options (is it even valid for true sets?)
Marco Cirillo <maranda@lightwitch.org>
parents:
458
diff
changeset
|
7 local guard_block_bl = module:get_option_set("component_guard_blacklist", {}) |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
8 |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
9 local s2smanager = require "core.s2smanager"; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
10 local config = require "core.configmanager"; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
11 local nameprep = require "util.encodings".stringprep.nameprep; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
12 |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
13 local _make_connect = s2smanager.make_connect; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
14 function s2smanager.make_connect(session, connect_host, connect_port) |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
15 if not session.s2sValidation then |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
16 if guard_blockall:contains(session.from_host) or |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
17 guard_block_bl:contains(session.to_host) and guard_protect:contains(session.from_host) then |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
18 module:log("error", "remote service %s attempted to access restricted component %s", session.to_host, session.from_host); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
19 s2smanager.destroy_session(session, "You're not authorized, good bye."); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
20 return false; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
21 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
22 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
23 return _make_connect(session, connect_host, connect_port); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
24 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
25 |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
26 local _stream_opened = s2smanager.streamopened; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
27 function s2smanager.streamopened(session, attr) |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
28 local host = attr.to and nameprep(attr.to); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
29 local from = attr.from and nameprep(attr.from); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
30 if not from then |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
31 session.s2sValidation = false; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
32 else |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
33 session.s2sValidation = true; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
34 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
35 |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
36 if guard_blockall:contains(host) or |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
37 guard_block_bl:contains(from) and guard_protect:contains(host) then |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
38 module:log("error", "remote service %s attempted to access restricted component %s", from, host); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
39 session:close({condition = "policy-violation", text = "You're not authorized, good bye."}); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
40 return false; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
41 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
42 _stream_opened(session, attr); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
43 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
44 |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
45 local function sdr_hook (event) |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
46 local origin, stanza = event.origin, event.stanza; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
47 |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
48 if origin.type == "s2sin" or origin.type == "s2sin_unauthed" then |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
49 if guard_blockall:contains(stanza.attr.to) or |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
50 guard_block_bl:contains(stanza.attr.from) and guard_protect:contains(stanza.attr.to) then |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
51 module:log("error", "remote service %s attempted to access restricted component %s", stanza.attr.from, stanza.attr.to); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
52 origin:close({condition = "policy-violation", text = "You're not authorized, good bye."}); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
53 return false; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
54 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
55 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
56 |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
57 return nil; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
58 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
59 |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
60 local function handle_activation (host) |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
61 if guard_blockall:contains(host) or guard_protect:contains(host) then |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
62 if hosts[host] and hosts[host].events then |
457
79ba4f95d65c
mod_component_guard: missing hook priority.
Marco Cirillo <maranda@lightwitch.org>
parents:
456
diff
changeset
|
63 hosts[host].events.add_handler("stanza/jabber:server:dialback:result", sdr_hook, 100); |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
64 module:log ("debug", "adding component protection for: "..host); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
65 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
66 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
67 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
68 |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
69 local function handle_deactivation (host) |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
70 if guard_blockall:contains(host) or guard_protect:contains(host) then |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
71 if hosts[host] and hosts[host].events then |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
72 hosts[host].events.remove_handler("stanza/jabber:server:dialback:result", sdr_hook); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
73 module:log ("debug", "removing component protection for: "..host); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
74 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
75 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
76 end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
77 |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
78 local function reload() |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
79 module:log ("debug", "server configuration reloaded, rehashing plugin tables..."); |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
80 guard_blockall = module:get_option_set("component_guard_blockall"); |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
81 guard_protect = module:get_option_set("component_guard_components"); |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
82 guard_block_bl = module:get_option_set("component_guard_blacklist"); |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
83 end |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
84 |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
85 local function setup() |
460
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
86 module:log ("debug", "initializing component guard module..."); |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
87 |
460
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
88 module:hook ("component-activated", handle_activation); |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
89 module:hook ("component-deactivated", handle_deactivation); |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
90 module:hook ("config-reloaded", reload); |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
91 |
460
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
92 for n,table in pairs(hosts) do |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
93 if table.type == "component" then |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
94 if guard_blockall:contains(n) or guard_protect:contains(n) then |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
95 hosts[n].events.remove_handler("stanza/jabber:server:dialback:result", sdr_hook); |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
96 handle_activation(n); |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
97 end |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
98 end |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
99 end |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
100 end |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
101 |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
102 if prosody.start_time then |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
103 setup(); |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
104 else |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
105 prosody.events.add_handler("server-started", setup); |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
106 end |