prosody-modules: mod_host_guard/mod_host

annotate mod_host_guard/mod_host_guard.lua @ 735:c1b0f0c33c6a

mod_archive: Fix hour offset in stored message date os.date expect a timestamp in local time, that is subject to daylight saving. But since we pass an UTC timestamp to os.date one hour is (wrongly) added in the summer. The only sensible thing is to call the os.date only once with the ! parametter. And then parsing this sting to get the utc_timestamp. Calling os.date with an UTC timestamp is not possible, and calling os.date twice without timestamp could give different results.

author	Olivier Goffart <ogoffart@woboq.com>
date	Wed, 04 Jul 2012 13:49:57 +0200
parents	ce8e7b784be0
children	b16b291d68c3

rev	line source
493 b1b80319bbf6 mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module. Marco Cirillo <maranda@lightwitch.org> parents: 460 diff changeset	1 -- (C) 2011, Marco Cirillo (LW.Org)
519 219ffe3541ff mod_host_guard: updated banner. Marco Cirillo <maranda@lightwitch.org> parents: 515 diff changeset	2 -- Block or restrict by blacklist remote access to local components or hosts.
456 73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	3
460 9bb9343f3c7a mod_component_guard: made module global, refactored init. Marco Cirillo <maranda@lightwitch.org> parents: 459 diff changeset	4 module:set_global()
9bb9343f3c7a mod_component_guard: made module global, refactored init. Marco Cirillo <maranda@lightwitch.org> parents: 459 diff changeset	5
493 b1b80319bbf6 mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module. Marco Cirillo <maranda@lightwitch.org> parents: 460 diff changeset	6 local guard_blockall = module:get_option_set("host_guard_blockall", {})
515 e98fe28c50b0 mod_host_guard: added exceptions/whitelisting to the blockall logic (makes little sense otherwise has s2s_disallow = true does the same) Marco Cirillo <maranda@lightwitch.org> parents: 494 diff changeset	7 local guard_ball_wl = module:get_option_set("host_guard_blockall_exceptions", {})
493 b1b80319bbf6 mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module. Marco Cirillo <maranda@lightwitch.org> parents: 460 diff changeset	8 local guard_protect = module:get_option_set("host_guard_selective", {})
b1b80319bbf6 mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module. Marco Cirillo <maranda@lightwitch.org> parents: 460 diff changeset	9 local guard_block_bl = module:get_option_set("host_guard_blacklist", {})
456 73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	10
724 b94010de43f6 mod_host_guard: referenced configmanager from prosody's _G instead of requiring it. Marco Cirillo <maranda@lightwitch.org> parents: 686 diff changeset	11 local config = configmanager
682 3ab1cf30a848 mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading. Marco Cirillo <maranda@lightwitch.org> parents: 681 diff changeset	12 local error_reply = require "util.stanza".error_reply
456 73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	13
680 a2cea070f2c7 mod_host_guard: removed calls to s2smanager and made the module not dependant on it. Marco Cirillo <maranda@lightwitch.org> parents: 537 diff changeset	14 local function s2s_hook (event)
a2cea070f2c7 mod_host_guard: removed calls to s2smanager and made the module not dependant on it. Marco Cirillo <maranda@lightwitch.org> parents: 537 diff changeset	15 local origin, stanza = event.session or event.origin, event.stanza or false
a2cea070f2c7 mod_host_guard: removed calls to s2smanager and made the module not dependant on it. Marco Cirillo <maranda@lightwitch.org> parents: 537 diff changeset	16 local to_host, from_host = (not stanza and origin.to_host) or stanza.attr.to, (not stanza and origin.from_host) or stanza.attr.from
456 73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	17
73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	18 if origin.type == "s2sin" or origin.type == "s2sin_unauthed" then
680 a2cea070f2c7 mod_host_guard: removed calls to s2smanager and made the module not dependant on it. Marco Cirillo <maranda@lightwitch.org> parents: 537 diff changeset	19 if guard_blockall:contains(to_host) and not guard_ball_wl:contains(from_host) or
a2cea070f2c7 mod_host_guard: removed calls to s2smanager and made the module not dependant on it. Marco Cirillo <maranda@lightwitch.org> parents: 537 diff changeset	20 guard_block_bl:contains(from_host) and guard_protect:contains(to_host) then
682 3ab1cf30a848 mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading. Marco Cirillo <maranda@lightwitch.org> parents: 681 diff changeset	21 module:log("error", "remote service %s attempted to access restricted host %s", from_host, to_host)
528 1737c08fde30 mod_host_guard: stick to one code "punctuation" style. Marco Cirillo <maranda@lightwitch.org> parents: 519 diff changeset	22 origin:close({condition = "policy-violation", text = "You're not authorized, good bye."})
1737c08fde30 mod_host_guard: stick to one code "punctuation" style. Marco Cirillo <maranda@lightwitch.org> parents: 519 diff changeset	23 return false
456 73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	24 end
73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	25 end
73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	26
528 1737c08fde30 mod_host_guard: stick to one code "punctuation" style. Marco Cirillo <maranda@lightwitch.org> parents: 519 diff changeset	27 return nil
456 73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	28 end
73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	29
682 3ab1cf30a848 mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading. Marco Cirillo <maranda@lightwitch.org> parents: 681 diff changeset	30 local function rr_hook (event)
685 19698c5f3ab3 mod_host_guard: prevent possible traces in case there isn't a conn object on the session by adding a dummy replacement function. Marco Cirillo <maranda@lightwitch.org> parents: 684 diff changeset	31 local from_host, to_host, send, stanza = event.from_host, event.to_host, (event.origin and event.origin.send) or function() end, event.stanza
682 3ab1cf30a848 mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading. Marco Cirillo <maranda@lightwitch.org> parents: 681 diff changeset	32
3ab1cf30a848 mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading. Marco Cirillo <maranda@lightwitch.org> parents: 681 diff changeset	33 if guard_blockall:contains(from_host) and not guard_ball_wl:contains(to_host) or
3ab1cf30a848 mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading. Marco Cirillo <maranda@lightwitch.org> parents: 681 diff changeset	34 guard_block_bl:contains(to_host) and guard_protect:contains(from_host) then
3ab1cf30a848 mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading. Marco Cirillo <maranda@lightwitch.org> parents: 681 diff changeset	35 module:log("info", "attempted to connect to a filtered remote host %s", to_host)
684 27529031890b mod_host_guard: now a proper error is returned when stanzas are routed to a filtered remote server (thanks Zash) Marco Cirillo <maranda@lightwitch.org> parents: 683 diff changeset	36 if stanza.attr.type ~= "error" then send(error_reply(event.stanza, "cancel", "policy-violation", "Communicating with a filtered remote server is not allowed.")) end
27529031890b mod_host_guard: now a proper error is returned when stanzas are routed to a filtered remote server (thanks Zash) Marco Cirillo <maranda@lightwitch.org> parents: 683 diff changeset	37 return true
682 3ab1cf30a848 mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading. Marco Cirillo <maranda@lightwitch.org> parents: 681 diff changeset	38 end
3ab1cf30a848 mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading. Marco Cirillo <maranda@lightwitch.org> parents: 681 diff changeset	39
3ab1cf30a848 mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading. Marco Cirillo <maranda@lightwitch.org> parents: 681 diff changeset	40 return nil
3ab1cf30a848 mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading. Marco Cirillo <maranda@lightwitch.org> parents: 681 diff changeset	41 end
3ab1cf30a848 mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading. Marco Cirillo <maranda@lightwitch.org> parents: 681 diff changeset	42
728 8ad2e24f5efd mod_host_guard: reduced code duplication and added better logging. Marco Cirillo <maranda@lightwitch.org> parents: 727 diff changeset	43 local function handle_activation (host, u)
456 73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	44 if guard_blockall:contains(host) or guard_protect:contains(host) then
73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	45 if hosts[host] and hosts[host].events then
680 a2cea070f2c7 mod_host_guard: removed calls to s2smanager and made the module not dependant on it. Marco Cirillo <maranda@lightwitch.org> parents: 537 diff changeset	46 hosts[host].events.add_handler("s2sin-established", s2s_hook, 500)
682 3ab1cf30a848 mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading. Marco Cirillo <maranda@lightwitch.org> parents: 681 diff changeset	47 hosts[host].events.add_handler("route/remote", rr_hook, 500)
680 a2cea070f2c7 mod_host_guard: removed calls to s2smanager and made the module not dependant on it. Marco Cirillo <maranda@lightwitch.org> parents: 537 diff changeset	48 hosts[host].events.add_handler("stanza/jabber:server:dialback:result", s2s_hook, 500)
728 8ad2e24f5efd mod_host_guard: reduced code duplication and added better logging. Marco Cirillo <maranda@lightwitch.org> parents: 727 diff changeset	49 if not u then
8ad2e24f5efd mod_host_guard: reduced code duplication and added better logging. Marco Cirillo <maranda@lightwitch.org> parents: 727 diff changeset	50 module:log ("debug", "adding host protection for: "..host)
8ad2e24f5efd mod_host_guard: reduced code duplication and added better logging. Marco Cirillo <maranda@lightwitch.org> parents: 727 diff changeset	51 else
729 ce8e7b784be0 mod_host_guard: adjusted log message. Marco Cirillo <maranda@lightwitch.org> parents: 728 diff changeset	52 module:log ("debug", "updating or adding host protection for: "..host)
728 8ad2e24f5efd mod_host_guard: reduced code duplication and added better logging. Marco Cirillo <maranda@lightwitch.org> parents: 727 diff changeset	53 end
456 73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	54 end
73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	55 end
73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	56 end
73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	57
728 8ad2e24f5efd mod_host_guard: reduced code duplication and added better logging. Marco Cirillo <maranda@lightwitch.org> parents: 727 diff changeset	58 local function handle_deactivation (host, u, i)
456 73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	59 if guard_blockall:contains(host) or guard_protect:contains(host) then
73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	60 if hosts[host] and hosts[host].events then
680 a2cea070f2c7 mod_host_guard: removed calls to s2smanager and made the module not dependant on it. Marco Cirillo <maranda@lightwitch.org> parents: 537 diff changeset	61 hosts[host].events.remove_handler("s2sin-established", s2s_hook)
682 3ab1cf30a848 mod_host_guard: using route/remote event hook to stop outgoing connections to filtered entities, yet the returned error is highly misleading. Marco Cirillo <maranda@lightwitch.org> parents: 681 diff changeset	62 hosts[host].events.remove_handler("route/remote", rr_hook)
680 a2cea070f2c7 mod_host_guard: removed calls to s2smanager and made the module not dependant on it. Marco Cirillo <maranda@lightwitch.org> parents: 537 diff changeset	63 hosts[host].events.remove_handler("stanza/jabber:server:dialback:result", s2s_hook)
728 8ad2e24f5efd mod_host_guard: reduced code duplication and added better logging. Marco Cirillo <maranda@lightwitch.org> parents: 727 diff changeset	64 if not u and not i then module:log ("debug", "removing host protection for: "..host) end
456 73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	65 end
73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	66 end
73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	67 end
73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	68
728 8ad2e24f5efd mod_host_guard: reduced code duplication and added better logging. Marco Cirillo <maranda@lightwitch.org> parents: 727 diff changeset	69 local function init_hosts(u, i)
725 f79fda2d7e51 mod_host_guard: host handlers are now cleaned properly on module unload (and also still on re/load to be safe). Marco Cirillo <maranda@lightwitch.org> parents: 724 diff changeset	70 for n in pairs(hosts) do
727 99f5846bcd85 mod_host_guard: during configuration reload the host handlers should be reinitialized as well, so reverted changed and added back the "redundant code". Marco Cirillo <maranda@lightwitch.org> parents: 726 diff changeset	71 if guard_blockall:contains(n) or guard_protect:contains(n) then
728 8ad2e24f5efd mod_host_guard: reduced code duplication and added better logging. Marco Cirillo <maranda@lightwitch.org> parents: 727 diff changeset	72 handle_deactivation(n, u, i)
8ad2e24f5efd mod_host_guard: reduced code duplication and added better logging. Marco Cirillo <maranda@lightwitch.org> parents: 727 diff changeset	73 handle_activation(n, u)
727 99f5846bcd85 mod_host_guard: during configuration reload the host handlers should be reinitialized as well, so reverted changed and added back the "redundant code". Marco Cirillo <maranda@lightwitch.org> parents: 726 diff changeset	74 end
537 50be30f203f3 mod_host_guard: fixed plugin, minor code refactor. Marco Cirillo <maranda@lightwitch.org> parents: 533 diff changeset	75 end
50be30f203f3 mod_host_guard: fixed plugin, minor code refactor. Marco Cirillo <maranda@lightwitch.org> parents: 533 diff changeset	76 end
50be30f203f3 mod_host_guard: fixed plugin, minor code refactor. Marco Cirillo <maranda@lightwitch.org> parents: 533 diff changeset	77
458 4149fcacbbf1 mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes. Marco Cirillo <maranda@lightwitch.org> parents: 457 diff changeset	78 local function reload()
528 1737c08fde30 mod_host_guard: stick to one code "punctuation" style. Marco Cirillo <maranda@lightwitch.org> parents: 519 diff changeset	79 module:log ("debug", "server configuration reloaded, rehashing plugin tables...")
1737c08fde30 mod_host_guard: stick to one code "punctuation" style. Marco Cirillo <maranda@lightwitch.org> parents: 519 diff changeset	80 guard_blockall = module:get_option_set("host_guard_blockall", {})
1737c08fde30 mod_host_guard: stick to one code "punctuation" style. Marco Cirillo <maranda@lightwitch.org> parents: 519 diff changeset	81 guard_ball_wl = module:get_option_set("host_guard_blockall_exceptions", {})
537 50be30f203f3 mod_host_guard: fixed plugin, minor code refactor. Marco Cirillo <maranda@lightwitch.org> parents: 533 diff changeset	82 guard_protect = module:get_option_set("host_guard_selective", {})
528 1737c08fde30 mod_host_guard: stick to one code "punctuation" style. Marco Cirillo <maranda@lightwitch.org> parents: 519 diff changeset	83 guard_block_bl = module:get_option_set("host_guard_blacklist", {})
537 50be30f203f3 mod_host_guard: fixed plugin, minor code refactor. Marco Cirillo <maranda@lightwitch.org> parents: 533 diff changeset	84
728 8ad2e24f5efd mod_host_guard: reduced code duplication and added better logging. Marco Cirillo <maranda@lightwitch.org> parents: 727 diff changeset	85 init_hosts(true)
458 4149fcacbbf1 mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes. Marco Cirillo <maranda@lightwitch.org> parents: 457 diff changeset	86 end
4149fcacbbf1 mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes. Marco Cirillo <maranda@lightwitch.org> parents: 457 diff changeset	87
4149fcacbbf1 mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes. Marco Cirillo <maranda@lightwitch.org> parents: 457 diff changeset	88 local function setup()
528 1737c08fde30 mod_host_guard: stick to one code "punctuation" style. Marco Cirillo <maranda@lightwitch.org> parents: 519 diff changeset	89 module:log ("debug", "initializing host guard module...")
537 50be30f203f3 mod_host_guard: fixed plugin, minor code refactor. Marco Cirillo <maranda@lightwitch.org> parents: 533 diff changeset	90 module:hook ("host-activated", handle_activation)
50be30f203f3 mod_host_guard: fixed plugin, minor code refactor. Marco Cirillo <maranda@lightwitch.org> parents: 533 diff changeset	91 module:hook ("host-deactivated", handle_deactivation)
528 1737c08fde30 mod_host_guard: stick to one code "punctuation" style. Marco Cirillo <maranda@lightwitch.org> parents: 519 diff changeset	92 module:hook ("config-reloaded", reload)
458 4149fcacbbf1 mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes. Marco Cirillo <maranda@lightwitch.org> parents: 457 diff changeset	93
728 8ad2e24f5efd mod_host_guard: reduced code duplication and added better logging. Marco Cirillo <maranda@lightwitch.org> parents: 727 diff changeset	94 init_hosts(false, true)
456 73f06a14390a mod_component_guard: initial commit. Marco Cirillo <maranda@lightwitch.org> parents: diff changeset	95 end
458 4149fcacbbf1 mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes. Marco Cirillo <maranda@lightwitch.org> parents: 457 diff changeset	96
725 f79fda2d7e51 mod_host_guard: host handlers are now cleaned properly on module unload (and also still on re/load to be safe). Marco Cirillo <maranda@lightwitch.org> parents: 724 diff changeset	97 function module.unload()
f79fda2d7e51 mod_host_guard: host handlers are now cleaned properly on module unload (and also still on re/load to be safe). Marco Cirillo <maranda@lightwitch.org> parents: 724 diff changeset	98 module:log ("debug", "removing host handlers as module is being unloaded...")
f79fda2d7e51 mod_host_guard: host handlers are now cleaned properly on module unload (and also still on re/load to be safe). Marco Cirillo <maranda@lightwitch.org> parents: 724 diff changeset	99 for n in pairs(hosts) do
f79fda2d7e51 mod_host_guard: host handlers are now cleaned properly on module unload (and also still on re/load to be safe). Marco Cirillo <maranda@lightwitch.org> parents: 724 diff changeset	100 hosts[n].events.remove_handler("s2sin-established", s2s_hook)
f79fda2d7e51 mod_host_guard: host handlers are now cleaned properly on module unload (and also still on re/load to be safe). Marco Cirillo <maranda@lightwitch.org> parents: 724 diff changeset	101 hosts[n].events.remove_handler("route/remote", rr_hook)
f79fda2d7e51 mod_host_guard: host handlers are now cleaned properly on module unload (and also still on re/load to be safe). Marco Cirillo <maranda@lightwitch.org> parents: 724 diff changeset	102 hosts[n].events.remove_handler("stanza/jabber:server:dialback:result", s2s_hook)
f79fda2d7e51 mod_host_guard: host handlers are now cleaned properly on module unload (and also still on re/load to be safe). Marco Cirillo <maranda@lightwitch.org> parents: 724 diff changeset	103 end
f79fda2d7e51 mod_host_guard: host handlers are now cleaned properly on module unload (and also still on re/load to be safe). Marco Cirillo <maranda@lightwitch.org> parents: 724 diff changeset	104 end
f79fda2d7e51 mod_host_guard: host handlers are now cleaned properly on module unload (and also still on re/load to be safe). Marco Cirillo <maranda@lightwitch.org> parents: 724 diff changeset	105
458 4149fcacbbf1 mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes. Marco Cirillo <maranda@lightwitch.org> parents: 457 diff changeset	106 if prosody.start_time then
528 1737c08fde30 mod_host_guard: stick to one code "punctuation" style. Marco Cirillo <maranda@lightwitch.org> parents: 519 diff changeset	107 setup()
458 4149fcacbbf1 mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes. Marco Cirillo <maranda@lightwitch.org> parents: 457 diff changeset	108 else
533 47b9053dba38 mod_host_guard: replaced prosody.events.add_handler with module:hook. Marco Cirillo <maranda@lightwitch.org> parents: 528 diff changeset	109 module:hook ("server-started", setup)
458 4149fcacbbf1 mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes. Marco Cirillo <maranda@lightwitch.org> parents: 457 diff changeset	110 end

Mercurial > prosody-modules

annotate mod_host_guard/mod_host_guard.lua @ 735:c1b0f0c33c6a