prosody-modules: mod_firewall/README.markdown annotate

annotate mod_firewall/README.markdown @ 4127:e9e10ec1b91c

mod_firewall: Add checkcerts option for HTTP lists, cert verification disabled when SNI unsupported This provides a balance between security and usability. SNI is supported in Prosody trunk and in Prosody 0.11 from commit 30d3f6f85eb8 (scheduled for 0.11.7).

author	Matthew Wild <mwild1@gmail.com>
date	Tue, 15 Sep 2020 11:49:55 +0100
parents	68ceb7e0cfe6
children	87daef9ed4e7

rev	line source
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	1 ---
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	2 labels:
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	3 - 'Stage-Alpha'
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	4 summary: 'A rule-based stanza filtering module'
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	5 ...
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	6
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	7 ------------------------------------------------------------------------
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	8
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	9 Note: mod\_firewall is in its very early stages. This documentation
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	10 is liable to change, and some described functionality may be missing,
2375 7ad312b4cefe mod_firewall/README: Remove mention of comments section from google code Kim Alvefur <zash@zash.se> parents: 2370 diff changeset	11 incomplete or contain bugs.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	12
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	13 ------------------------------------------------------------------------
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	14
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	15 Introduction
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	16 ============
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	17
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	18 A firewall is an invaluable tool in the sysadmin's toolbox. However
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	19 while low-level firewalls such as iptables and pf are incredibly good at
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	20 what they do, they are generally not able to handle application-layer
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	21 rules.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	22
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	23 The goal of mod\_firewall is to provide similar services at the XMPP
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	24 layer. Based on rule scripts it can efficiently block, bounce, drop,
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	25 forward, copy, redirect stanzas and more! Furthermore all rules can be
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	26 applied and updated dynamically at runtime without restarting the
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	27 server.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	28
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	29 Details
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	30 =======
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	31
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	32 mod\_firewall loads one or more scripts, and compiles these to Lua code
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	33 that reacts to stanzas flowing through Prosody. The firewall script
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	34 syntax is unusual, but straightforward.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	35
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	36 A firewall script is dominated by rules. Each rule has two parts:
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	37 conditions, and actions. When a stanza matches all of the conditions,
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	38 all of the actions are executed in order.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	39
29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	40 Here is a simple example to block stanzas from spammer@example.com:
29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	41
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	42 FROM: spammer@example.com
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	43 DROP.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	44
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	45 FROM is a condition, and DROP is an action. This is about as simple as
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	46 it gets. How about heading to the other extreme? Let's demonstrate
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	47 something more complex that mod\_firewall can do for you:
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	48
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	49 %ZONE myorganisation: staff.myorg.example, support.myorg.example
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	50
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	51 ENTERING: myorganisation
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	52 KIND: message
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	53 TIME: 12am-9am, 5pm-12am, Saturday, Sunday
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	54 REPLY=Sorry, I am afraid our office is closed at the moment. If you need assistance, please call our 24-hour support line on 123-456-789.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	55
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	56 This rule will reply with a short message whenever someone tries to send
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	57 a message to someone at any of the hosts defined in the 'myorganisation'
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	58 outside of office hours.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	59
2387 5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files Matthew Wild <mwild1@gmail.com> parents: 2375 diff changeset	60 Specifying rule sets
5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files Matthew Wild <mwild1@gmail.com> parents: 2375 diff changeset	61 --------------------
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	62
2387 5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files Matthew Wild <mwild1@gmail.com> parents: 2375 diff changeset	63 Firewall rules should be written into text files, e.g. `ruleset.pfw` file.
5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files Matthew Wild <mwild1@gmail.com> parents: 2375 diff changeset	64 One or more rule files can be specified in the configuration using:
5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files Matthew Wild <mwild1@gmail.com> parents: 2375 diff changeset	65
5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files Matthew Wild <mwild1@gmail.com> parents: 2375 diff changeset	66 firewall_scripts = { "path/to/ruleset.pfw", "path/to/ruleset2.pfw" }
5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files Matthew Wild <mwild1@gmail.com> parents: 2375 diff changeset	67
5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files Matthew Wild <mwild1@gmail.com> parents: 2375 diff changeset	68 If multiple files are specified and they both add rules to the same chains,
5bfb2ccab2ab mod_firewall: README: Add more info about specifying rule set files Matthew Wild <mwild1@gmail.com> parents: 2375 diff changeset	69 each file's rules will be processed in order, but the order of files is undefined.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	70
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	71 Conditions
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	72 ----------
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	73
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	74 All conditions must come before any action in a rule block. The
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	75 condition name is followed by a colon (':'), and the value to test for.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	76
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	77 A condition can be preceded or followed by `NOT` to negate its match.
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	78 For example:
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	79
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	80 NOT FROM: user@example.com
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	81 KIND NOT: message
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	82
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	83 Some conditions do not take parameters, and these should end with just a
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	84 question mark, like:
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	85
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	86 IN ROSTER?
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	87
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	88 ### Zones
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	89
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	90 A 'zone' is one or more hosts or JIDs. It is possible to match when a
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	91 stanza is entering or leaving a zone, while at the same time not
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	92 matching traffic passing between JIDs in the same zone.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	93
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	94 Zones are defined at the top of a script with the following syntax (they
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	95 are not part of a rule block):
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	96
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	97 %ZONE myzone: host1, host2, user@host3, foo.bar.example
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	98
2388 b6d59998dba7 mod_firewall: README: Document dynamic '$local' zone Matthew Wild <mwild1@gmail.com> parents: 2387 diff changeset	99 There is an automatic zone named `$local`, which automatically includes
b6d59998dba7 mod_firewall: README: Document dynamic '$local' zone Matthew Wild <mwild1@gmail.com> parents: 2387 diff changeset	100 all of the current server's active hosts (including components). It can
b6d59998dba7 mod_firewall: README: Document dynamic '$local' zone Matthew Wild <mwild1@gmail.com> parents: 2387 diff changeset	101 be used to match stanzas entering or leaving the current server.
b6d59998dba7 mod_firewall: README: Document dynamic '$local' zone Matthew Wild <mwild1@gmail.com> parents: 2387 diff changeset	102
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	103 A host listed in a zone also matches all users on that host (but not
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	104 subdomains).
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	105
29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	106 The following zone-matching conditions are supported:
29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	107
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	108 Condition Matches
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	109 ------------ ------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	110 `ENTERING` When a stanza is entering the named zone
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	111 `LEAVING` When a stanza is leaving the named zone
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	112
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	113 ### Lists
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	114
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	115 It is possible to create or load lists of strings for use in scripts. For example, you might load a JID blacklist,
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	116 a list of malware URLs or simple words that you want to filter messages on.
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	117
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	118 List type Example
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	119 ----------- -----------------------
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	120 memory %LIST spammers: memory
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	121 file %LIST spammers: file:/etc/spammers.txt
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	122 http %LIST spammers: http://example.com/spammers.txt
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	123
4126 68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	124 #### List types
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	125 ##### memory
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	126
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	127 ```
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	128 %LIST name: memory (limit: number)
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	129 ```
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	130
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	131 A memory-only list, with an optional limit. Supports addition and removal of items by scripts.
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	132
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	133 If a limit is provided, the oldest item will be discarded to make room for a new item if the
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	134 list is full. The limit is useful to prevent infinite memory growth on busy servers.
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	135
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	136 ##### file
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	137
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	138 ```
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	139 %LIST name: file:/path/to/file (missing: string)
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	140 ```
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	141
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	142 Reads a list from a file. The list can be added to and removed from by scripts, but
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	143 these changes do not persist between restarts.
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	144
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	145 If the file is missing, an error will be raised. The optional 'missing' parameter can be set
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	146 to 'ignore' (e.g. `(missing: ignore)`) to ignore a missing file.
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	147
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	148 ##### http
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	149
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	150 ```
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	151 %LIST name: http://example.com/ (ttl: number, pattern: pat, hash: sha1, checkcerts: when-sni)
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	152 ```
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	153
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	154 Fetches a list from a HTTP or HTTPS URL. The following options are accepted:
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	155
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	156 Option Description
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	157 ------- -----------
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	158 ttl Seconds to cache the list for. After expiry, it will be refetched. Default 3600 (1 hour).
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	159 pattern Optional pattern used to extract list entries from the response. Default is to treat each line as a single item.
68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	160 hash Optional hash to be applied to items before looking them up in the list, e.g. sha1 or sha256.
4127 e9e10ec1b91c mod_firewall: Add checkcerts option for HTTP lists, cert verification disabled when SNI unsupported Matthew Wild <mwild1@gmail.com> parents: 4126 diff changeset	161 checkcert Whether to verify HTTPS certificates. May be "always", "never" or "when-sni". Default "when-sni".
e9e10ec1b91c mod_firewall: Add checkcerts option for HTTP lists, cert verification disabled when SNI unsupported Matthew Wild <mwild1@gmail.com> parents: 4126 diff changeset	162
e9e10ec1b91c mod_firewall: Add checkcerts option for HTTP lists, cert verification disabled when SNI unsupported Matthew Wild <mwild1@gmail.com> parents: 4126 diff changeset	163 The "when-sni" default disables certificate verification when Prosody's HTTP client API doesn't support SNI,
e9e10ec1b91c mod_firewall: Add checkcerts option for HTTP lists, cert verification disabled when SNI unsupported Matthew Wild <mwild1@gmail.com> parents: 4126 diff changeset	164 as in Prosody 0.11.6 and earlier.
4126 68ceb7e0cfe6 mod_firewall: Add docs for list types and parameters Matthew Wild <mwild1@gmail.com> parents: 4072 diff changeset	165
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	166 #### CHECK LIST
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	167
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	168 Checks whether a simple expression is found in a given list.
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	169
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	170 Example:
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	171
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	172 %LIST blacklist: file:/etc/prosody/blacklist.txt
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	173
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	174 # Rule to block presence subscription requests from blacklisted JIDs
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	175 KIND: presence
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	176 TYPE: subscribe
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	177 CHECK LIST: blacklist contains $<@from>
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	178 BOUNCE=policy-violation (Your JID is blacklisted)
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	179
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	180 #### SCAN
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	181
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	182 SCAN allows you to search inside a stanza for a given pattern, and check each result against a list. For example,
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	183 you could scan a message body for words and check if any of the words are found in a given list.
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	184
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	185 Before using SCAN, you need to define a search location and a pattern. The search location uses the same 'path'
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	186 format as documented under the 'INSPECT' condition. Patterns can be any valid Lua pattern.
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	187
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	188 To use the above example:
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	189
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	190 # Define a search location called 'body' which fetches the text of the 'body' element
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	191 %SEARCH body: body#
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	192 # Define a pattern called 'word' which matches any sequence of letters
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	193 %PATTERN word: [A-Za-z]+
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	194 # Finally, we also need our list of "bad" words:
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	195 %LIST badwords: file:/etc/prosody/bad_words.txt
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	196
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	197 # Now we can use these to SCAN incoming stanzas
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	198 # If it finds a match, bounce the stanza
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	199 SCAN: body for word in badwords
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	200 BOUNCE=policy-violation (This word is not allowed!)
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	201
2545 9b46d24edf0d mod_firewall: Add and document COUNT condition Matthew Wild <mwild1@gmail.com> parents: 2540 diff changeset	202 #### COUNT
9b46d24edf0d mod_firewall: Add and document COUNT condition Matthew Wild <mwild1@gmail.com> parents: 2540 diff changeset	203
9b46d24edf0d mod_firewall: Add and document COUNT condition Matthew Wild <mwild1@gmail.com> parents: 2540 diff changeset	204 COUNT is similar to SCAN, in that it uses a defined SEARCH and breaks it up according to a PATTERN. Then it
9b46d24edf0d mod_firewall: Add and document COUNT condition Matthew Wild <mwild1@gmail.com> parents: 2540 diff changeset	205 counts the number of results.
9b46d24edf0d mod_firewall: Add and document COUNT condition Matthew Wild <mwild1@gmail.com> parents: 2540 diff changeset	206
9b46d24edf0d mod_firewall: Add and document COUNT condition Matthew Wild <mwild1@gmail.com> parents: 2540 diff changeset	207 For example, to block every message with more than one URL:
9b46d24edf0d mod_firewall: Add and document COUNT condition Matthew Wild <mwild1@gmail.com> parents: 2540 diff changeset	208
9b46d24edf0d mod_firewall: Add and document COUNT condition Matthew Wild <mwild1@gmail.com> parents: 2540 diff changeset	209 # Define a search location called 'body' which fetches the text of the 'body' element
9b46d24edf0d mod_firewall: Add and document COUNT condition Matthew Wild <mwild1@gmail.com> parents: 2540 diff changeset	210 %SEARCH body: body#
9b46d24edf0d mod_firewall: Add and document COUNT condition Matthew Wild <mwild1@gmail.com> parents: 2540 diff changeset	211 # Define a pattern called 'url' which matches HTTP links
9b46d24edf0d mod_firewall: Add and document COUNT condition Matthew Wild <mwild1@gmail.com> parents: 2540 diff changeset	212 %PATTERN url: https?://%S+
9b46d24edf0d mod_firewall: Add and document COUNT condition Matthew Wild <mwild1@gmail.com> parents: 2540 diff changeset	213
9b46d24edf0d mod_firewall: Add and document COUNT condition Matthew Wild <mwild1@gmail.com> parents: 2540 diff changeset	214 COUNT: url in body > 1
9b46d24edf0d mod_firewall: Add and document COUNT condition Matthew Wild <mwild1@gmail.com> parents: 2540 diff changeset	215 BOUNCE=policy-violation (Up to one HTTP URL is allowed in messages)
9b46d24edf0d mod_firewall: Add and document COUNT condition Matthew Wild <mwild1@gmail.com> parents: 2540 diff changeset	216
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	217 ### Stanza matching
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	218
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	219 Condition Matches
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	220 ----------- ------------------------------------------------------------------------------------------------------------------------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	221 `KIND` The kind of stanza. May be 'message', 'presence' or 'iq'
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	222 `TYPE` The type of stanza. This varies depending on the kind of stanza. See 'Stanza types' below for more information.
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	223 `PAYLOAD` The stanza contains a child with the given namespace. Useful for determining the type of an iq request, or whether a message contains a certain extension.
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	224 `INSPECT` The node at the specified path exists or matches a given string. This allows you to look anywhere inside a stanza. See below for examples and more.
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	225
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	226 #### Stanza types
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	227
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	228 Stanza Valid types
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	229 ---------- ------------------------------------------------------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	230 iq get, set, result, error
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	231 presence available, unavailable, probe, subscribe, subscribed, unsubscribe, unsubscribed, error
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	232 message normal, chat, groupchat, headline, error
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	233
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	234 Note: The type 'available' for presence does not actually appear in
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	235 the protocol. Available presence is signalled by the omission of a type.
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	236 Similarly, a message stanza with no type is equivalent to one of type
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	237 'normal'. mod\_firewall handles these cases for you automatically.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	238
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	239 ### Sender/recipient matching
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	240
2576 95b79d515a65 mod_firewall: README: Document TO/FROM ADMIN, FORWARD, TO SELF and TO FULL JID Matthew Wild <mwild1@gmail.com> parents: 2559 diff changeset	241 Condition Matches
95b79d515a65 mod_firewall: README: Document TO/FROM ADMIN, FORWARD, TO SELF and TO FULL JID Matthew Wild <mwild1@gmail.com> parents: 2559 diff changeset	242 ------------- -------------------------------------------------------
95b79d515a65 mod_firewall: README: Document TO/FROM ADMIN, FORWARD, TO SELF and TO FULL JID Matthew Wild <mwild1@gmail.com> parents: 2559 diff changeset	243 `FROM` The JID in the 'from' attribute matches the given JID.
95b79d515a65 mod_firewall: README: Document TO/FROM ADMIN, FORWARD, TO SELF and TO FULL JID Matthew Wild <mwild1@gmail.com> parents: 2559 diff changeset	244 `TO` The JID in the 'to' attribute matches the given JID.
95b79d515a65 mod_firewall: README: Document TO/FROM ADMIN, FORWARD, TO SELF and TO FULL JID Matthew Wild <mwild1@gmail.com> parents: 2559 diff changeset	245 `TO SELF` The stanza is sent by any of a user's resources to their own bare JID.
95b79d515a65 mod_firewall: README: Document TO/FROM ADMIN, FORWARD, TO SELF and TO FULL JID Matthew Wild <mwild1@gmail.com> parents: 2559 diff changeset	246 `TO FULL JID` The stanza is addressed to a valid full JID on the local server (full JIDs include a resource at the end, and only exist for the lifetime of a single session, therefore the recipient must be online, or this check will not match).
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	247
2576 95b79d515a65 mod_firewall: README: Document TO/FROM ADMIN, FORWARD, TO SELF and TO FULL JID Matthew Wild <mwild1@gmail.com> parents: 2559 diff changeset	248 The TO and FROM conditions both accept wildcards in the JID when the wildcard
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	249 expression is enclosed in angle brackets ('\<...\>'). For example:
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	250
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	251 # All users at example.com
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	252 FROM: <*>@example.com
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	253
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	254 # The user 'admin' on any subdomain of example.com
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	255 FROM: admin@<*.example.com>
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	256
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	257 You can also use [Lua's pattern
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	258 matching](http://www.lua.org/manual/5.1/manual.html#5.4.1) for more
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	259 powerful matching abilities. Patterns are a lightweight
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	260 regular-expression alternative. Simply contain the pattern in double
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	261 angle brackets. The pattern is automatically anchored at the start and
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	262 end (so it must match the entire portion of the JID).
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	263
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	264 # Match admin@example.com, and admin1@example.com, etc.
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	265 FROM: <<admin%d*>>@example.com
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	266
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	267 Note: It is important to know that 'example.com' is a valid JID on
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	268 its own, and does not match 'user@example.com'. To perform domain
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	269 whitelists or blacklists, use Zones.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	270
2047 2ec7c0b8a371 mod_firewall/README: Fix table Kim Alvefur <zash@zash.se> parents: 2036 diff changeset	271 Condition Matches
2ec7c0b8a371 mod_firewall/README: Fix table Kim Alvefur <zash@zash.se> parents: 2036 diff changeset	272 ---------------- ---------------------------------------------------------------
2ec7c0b8a371 mod_firewall/README: Fix table Kim Alvefur <zash@zash.se> parents: 2036 diff changeset	273 `FROM_EXACTLY` The JID in the 'from' attribute exactly matches the given JID
2ec7c0b8a371 mod_firewall/README: Fix table Kim Alvefur <zash@zash.se> parents: 2036 diff changeset	274 `TO_EXACTLY` The JID in the 'to' attribute exactly matches the given JID
2036 7ba6ed553c93 mod_firewall/conditions: Add FROM_EXACTLY and TO_EXACTLY Matthew Wild <mwild1@gmail.com> parents: 2002 diff changeset	275
7ba6ed553c93 mod_firewall/conditions: Add FROM_EXACTLY and TO_EXACTLY Matthew Wild <mwild1@gmail.com> parents: 2002 diff changeset	276 These additional conditions do not support pattern matching, but are
7ba6ed553c93 mod_firewall/conditions: Add FROM_EXACTLY and TO_EXACTLY Matthew Wild <mwild1@gmail.com> parents: 2002 diff changeset	277 useful to match the exact to/from address on a stanza. For example, if
7ba6ed553c93 mod_firewall/conditions: Add FROM_EXACTLY and TO_EXACTLY Matthew Wild <mwild1@gmail.com> parents: 2002 diff changeset	278 no resource is specified then only bare JIDs will be matched. TO and FROM
7ba6ed553c93 mod_firewall/conditions: Add FROM_EXACTLY and TO_EXACTLY Matthew Wild <mwild1@gmail.com> parents: 2002 diff changeset	279 match all resources if no resource is specified to match.
7ba6ed553c93 mod_firewall/conditions: Add FROM_EXACTLY and TO_EXACTLY Matthew Wild <mwild1@gmail.com> parents: 2002 diff changeset	280
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	281 Note: Some chains execute before Prosody has performed any
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	282 normalisation or validity checks on the to/from JIDs on an incoming
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	283 stanza. It is not advisable to perform access control or similar rules
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	284 on JIDs in these chains (see the chain documentation for more info).
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	285
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	286 #### INSPECT
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	287
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	288 INSPECT takes a 'path' through the stanza to get a string (an attribute
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	289 value or text content). An example is the best way to explain. Let's
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	290 check that a user is not trying to register an account with the username
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	291 'admin'. This stanza comes from [XEP-0077: In-band
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	292 Registration](http://xmpp.org/extensions/xep-0077.html#example-4):
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	293
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	294 ``` xml
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	295 <iq type='set' id='reg2'>
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	296 <query xmlns='jabber:iq:register'>
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	297 <username>bill</username>
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	298 <password>Calliope</password>
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	299 <email>bard@shakespeare.lit</email>
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	300 </query>
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	301 </iq>
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	302 ```
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	303
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	304 KIND: iq
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	305 TYPE: set
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	306 PAYLOAD: jabber:iq:register
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	307 INSPECT: {jabber:iq:register}query/username#=admin
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	308 BOUNCE=not-allowed (The username 'admin' is reserved.)
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	309
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	310 That weird string deserves some explanation. It is a path, divided into
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	311 segments by '/'. Each segment describes an element by its name,
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	312 optionally prefixed by its namespace in curly braces ('{...}'). If the
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	313 path ends with a '\#' then the text content of the last element will be
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	314 returned. If the path ends with '@name' then the value of the attribute
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	315 'name' will be returned.
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	316
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	317 You can use INSPECT to test for the existence of an element or attribute,
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	318 or you can see if it is equal to a string by appending `=STRING` (as in the
3197 f6a14cdc531b mod_firewall: Add a missing space after a comma in the README. Emmanuel Gil Peyrot <linkmauve@linkmauve.fr> parents: 2594 diff changeset	319 example above). Finally, you can also test whether it matches a given Lua
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	320 pattern by using `~=PATTERN`.
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	321
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	322 INSPECT is somewhat slower than the other stanza matching conditions. To
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	323 minimise performance impact, always place it below other faster
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	324 condition checks where possible (e.g. above we first checked KIND, TYPE
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	325 and PAYLOAD matched before INSPECT).
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	326
2342 6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2114 diff changeset	327 ### Roster
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2114 diff changeset	328
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2114 diff changeset	329 These functions access the roster of the recipient (only). Therefore they cannot (currently)
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2114 diff changeset	330 be used in some chains, such as for outgoing messages (the recipient may be on another server).
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2114 diff changeset	331
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2114 diff changeset	332 Performance note: this check can potentially cause storage access (especially if the recipient
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2114 diff changeset	333 is currently offline), so you may want to limit its use in high-traffic situations, and place
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2114 diff changeset	334 it below other checks (such as a rate limiter).
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2114 diff changeset	335
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	336 #### IN ROSTER
2342 6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2114 diff changeset	337
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2114 diff changeset	338 Tests whether the sender is in the recipient's roster.
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2114 diff changeset	339
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	340 IN ROSTER?
2342 6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2114 diff changeset	341
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	342 #### IN ROSTER GROUP
2342 6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2114 diff changeset	343
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2114 diff changeset	344 Tests whether the sender is in the recipient's roster, and in the named group.
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2114 diff changeset	345
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	346 IN ROSTER GROUP: Friends
2342 6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2114 diff changeset	347
2410 898e70e85185 mod_firewall/README: Document SUBSCRIBED Kim Alvefur <zash@zash.se> parents: 2390 diff changeset	348 #### SUBSCRIBED
898e70e85185 mod_firewall/README: Document SUBSCRIBED Kim Alvefur <zash@zash.se> parents: 2390 diff changeset	349
898e70e85185 mod_firewall/README: Document SUBSCRIBED Kim Alvefur <zash@zash.se> parents: 2390 diff changeset	350 Tests whether the recipient is subscribed to the sender, ie will receive
898e70e85185 mod_firewall/README: Document SUBSCRIBED Kim Alvefur <zash@zash.se> parents: 2390 diff changeset	351 presence updates from them.
898e70e85185 mod_firewall/README: Document SUBSCRIBED Kim Alvefur <zash@zash.se> parents: 2390 diff changeset	352
898e70e85185 mod_firewall/README: Document SUBSCRIBED Kim Alvefur <zash@zash.se> parents: 2390 diff changeset	353 Note that this does work, regardless of direction and which chain is
898e70e85185 mod_firewall/README: Document SUBSCRIBED Kim Alvefur <zash@zash.se> parents: 2390 diff changeset	354 used, since both the sender and the recipient will have mirrored roster
898e70e85185 mod_firewall/README: Document SUBSCRIBED Kim Alvefur <zash@zash.se> parents: 2390 diff changeset	355 entries.
898e70e85185 mod_firewall/README: Document SUBSCRIBED Kim Alvefur <zash@zash.se> parents: 2390 diff changeset	356
2390 28fbe960adcf mod_firewall: README: Document conditions for groups and admins Matthew Wild <mwild1@gmail.com> parents: 2389 diff changeset	357 ### Groups
28fbe960adcf mod_firewall: README: Document conditions for groups and admins Matthew Wild <mwild1@gmail.com> parents: 2389 diff changeset	358
28fbe960adcf mod_firewall: README: Document conditions for groups and admins Matthew Wild <mwild1@gmail.com> parents: 2389 diff changeset	359 Using Prosody's mod\_groups it is possible to define groups of users on the server. You can
28fbe960adcf mod_firewall: README: Document conditions for groups and admins Matthew Wild <mwild1@gmail.com> parents: 2389 diff changeset	360 match based on these groups in firewall rules.
28fbe960adcf mod_firewall: README: Document conditions for groups and admins Matthew Wild <mwild1@gmail.com> parents: 2389 diff changeset	361
2594 1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	362 Condition Matches
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	363 ----------------- ----------------------------
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	364 `FROM GROUP` When the stanza is being sent from a member of the named group
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	365 `TO GROUP` When the stanza is being sent to a member of the named group
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	366 `CROSSING GROUPS` When the stanza is being sent between users of different named groups
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	367
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	368 #### CROSSING GROUPS
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	369
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	370 The `CROSSING GROUPS` condition takes a comma-separated list of groups to check. If the
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	371 sender and recipient are not in the same group (only the listed groups are checked), then the
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	372 this condition matches and the stanza is deemed to be crossing between groups.
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	373
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	374 For example, if you had three groups: Engineering, Marketing and Employees. All users are
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	375 members of the 'Employees' group, and the others are for employees of the named department only.
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	376
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	377 To prevent employees in the marketing department from communicating with engineers, you could use
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	378 the following rule:
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	379
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	380 ```
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	381 CROSSING GROUPS: Marketing, Engineering
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	382 BOUNCE=policy-violation (no communication between these groups is allowed!)
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	383 ```
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	384
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	385 This works, even though both the users are in the 'Employees' group, because that group is not listed
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	386 in the condition.
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	387
1e1c929c1aa5 mod_firewall: Add and document CROSSING GROUPS condition Matthew Wild <mwild1@gmail.com> parents: 2576 diff changeset	388 In the above example, a user who is member of both groups is not restricted.
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	389
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	390 #### SENT DIRECTED PRESENCE TO SENDER
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	391
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	392 This condition matches if the recipient of a stanza has previously sent directed presence to the sender of the stanza. This
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	393 is often done in XMPP to exchange presence information with JIDs that are not on your roster, such as MUC rooms.
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	394
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	395 This condition does not take a parameter - end the condition name with a question mark:
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	396
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	397 # Rule to bounce messages from senders not in the roster who haven't been sent directed presence
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	398 NOT IN ROSTER?
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	399 NOT SENT DIRECTED PRESENCE TO SENDER?
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	400 BOUNCE=service-unavailable
2390 28fbe960adcf mod_firewall: README: Document conditions for groups and admins Matthew Wild <mwild1@gmail.com> parents: 2389 diff changeset	401
28fbe960adcf mod_firewall: README: Document conditions for groups and admins Matthew Wild <mwild1@gmail.com> parents: 2389 diff changeset	402 ### Admins
28fbe960adcf mod_firewall: README: Document conditions for groups and admins Matthew Wild <mwild1@gmail.com> parents: 2389 diff changeset	403
28fbe960adcf mod_firewall: README: Document conditions for groups and admins Matthew Wild <mwild1@gmail.com> parents: 2389 diff changeset	404 Prosody allows certain JIDs to be declared as administrators of a host, component or the whole server.
28fbe960adcf mod_firewall: README: Document conditions for groups and admins Matthew Wild <mwild1@gmail.com> parents: 2389 diff changeset	405
2576 95b79d515a65 mod_firewall: README: Document TO/FROM ADMIN, FORWARD, TO SELF and TO FULL JID Matthew Wild <mwild1@gmail.com> parents: 2559 diff changeset	406 Condition Matches
95b79d515a65 mod_firewall: README: Document TO/FROM ADMIN, FORWARD, TO SELF and TO FULL JID Matthew Wild <mwild1@gmail.com> parents: 2559 diff changeset	407 ---------------- -------------------------------------------------------------------------------------
95b79d515a65 mod_firewall: README: Document TO/FROM ADMIN, FORWARD, TO SELF and TO FULL JID Matthew Wild <mwild1@gmail.com> parents: 2559 diff changeset	408 `TO ADMIN` When the recipient of the stanza is admin of the current host
95b79d515a65 mod_firewall: README: Document TO/FROM ADMIN, FORWARD, TO SELF and TO FULL JID Matthew Wild <mwild1@gmail.com> parents: 2559 diff changeset	409 `FROM ADMIN` When the sender of the stanza is admin of the current host
95b79d515a65 mod_firewall: README: Document TO/FROM ADMIN, FORWARD, TO SELF and TO FULL JID Matthew Wild <mwild1@gmail.com> parents: 2559 diff changeset	410 `FROM ADMIN OF` When the sender of the stanza is an admin of the named host on the current server
95b79d515a65 mod_firewall: README: Document TO/FROM ADMIN, FORWARD, TO SELF and TO FULL JID Matthew Wild <mwild1@gmail.com> parents: 2559 diff changeset	411 `TO ADMIN OF` When the recipient of the stanza is an admin of the named host on the current server
2390 28fbe960adcf mod_firewall: README: Document conditions for groups and admins Matthew Wild <mwild1@gmail.com> parents: 2389 diff changeset	412
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	413 ### Time and date
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	414
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	415 #### TIME
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	416
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	417 Matches stanzas sent during certain time periods.
29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	418
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	419 Condition Matches
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	420 ----------- -------------------------------------------------------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	421 TIME When the current server local time is within one of the comma-separated time ranges given
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	422
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	423 TIME: 10pm-6am, 14:00-15:00
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	424 REPLY=Zzzz.
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	425
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	426 #### DAY
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	427
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	428 It is also possible to match only on certain days of the week.
29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	429
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	430 Condition Matches
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	431 ----------- -----------------------------------------------------------------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	432 DAY When the current day matches one, or falls within a rage, in the given comma-separated list of days
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	433
29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	434 Example:
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	435
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	436 DAY: Sat-Sun, Wednesday
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	437 REPLY=Sorry, I'm out enjoying life!
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	438
2102 2c225b4b93d2 mod_firewall: README: Add note about time functions using server's local time Matthew Wild <mwild1@gmail.com> parents: 2096 diff changeset	439 All times and dates are handled in the server's local time.
2c225b4b93d2 mod_firewall: README: Add note about time functions using server's local time Matthew Wild <mwild1@gmail.com> parents: 2096 diff changeset	440
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	441 ### Rate-limiting
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	442
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	443 It is possible to selectively rate-limit stanzas, and use rules to
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	444 decide what to do with stanzas when over the limit.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	445
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	446 First, you must define any rate limits that you are going to use in your
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	447 script. Here we create a limiter called 'normal' that will allow 2
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	448 stanzas per second, and then we define a rule to bounce messages when
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	449 over this limit. Note that the `RATE` definition is not part of a rule
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	450 (multiple rules can share the same limiter).
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	451
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	452 %RATE normal: 2 (burst 3)
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	453
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	454 KIND: message
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	455 LIMIT: normal
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	456 BOUNCE=policy-violation (Sending too fast!)
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	457
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	458 The 'burst' parameter on the rate limit allows you to spread the limit
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	459 check over a given time period. For example the definition shown above
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	460 will allow the limit to be temporarily surpassed, as long as it is
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	461 within the limit after 3 seconds. You will almost always want to specify
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	462 a burst factor.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	463
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	464 Both the rate and the burst can be fractional values. For example a rate
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	465 of 0.1 means only one event is allowed every 10 seconds.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	466
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	467 The LIMIT condition actually does two things; first it counts against
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	468 the given limiter, and then it checks to see if the limiter over its
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	469 limit yet. If it is, the condition matches, otherwise it will not.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	470
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	471 Condition Matches
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	472 ----------- --------------------------------------------------------------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	473 `LIMIT` When the named limit is 'used up'. Using this condition automatically counts against that limit.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	474
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	475 Note: Reloading mod\_firewall resets the current state of any
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	476 limiters.
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	477
2369 2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	478 #### Dynamic limits
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	479
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	480 Sometimes you may want to have multiple throttles in a single condition, using some property of the session or stanza
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	481 to determine which throttle to use. For example, you might have a limit for incoming stanzas, but you want to limit by
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	482 sending JID, instead of all incoming stanzas sharing the same limit.
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	483
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	484 You can use the 'on' keyword for this, like so:
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	485
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	486 LIMIT: normal on EXPRESSION
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	487
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	488 For more information on expressions, see the section later in this document.
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	489
2370 5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full Matthew Wild <mwild1@gmail.com> parents: 2369 diff changeset	490 Each value of 'EXPRESSION' has to be tracked individually in a table, which uses a small amount of memory. To prevent
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full Matthew Wild <mwild1@gmail.com> parents: 2369 diff changeset	491 memory exhaustion, the number of tracked values is limited to 1000 by default. You can override this by setting the
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full Matthew Wild <mwild1@gmail.com> parents: 2369 diff changeset	492 maximum number of table entries when you define the rate:
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full Matthew Wild <mwild1@gmail.com> parents: 2369 diff changeset	493
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full Matthew Wild <mwild1@gmail.com> parents: 2369 diff changeset	494 %RATE normal: 2 (burst 3) (entries 4096)
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full Matthew Wild <mwild1@gmail.com> parents: 2369 diff changeset	495
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full Matthew Wild <mwild1@gmail.com> parents: 2369 diff changeset	496 Old values are automatically removed from the tracking table. However if the tracking table becomes full, new entries
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full Matthew Wild <mwild1@gmail.com> parents: 2369 diff changeset	497 will be rejected - it will behave as if the rate limit was reached, even for values that have not been seen before. Since
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full Matthew Wild <mwild1@gmail.com> parents: 2369 diff changeset	498 this opens up a potential denial of service (innocent users may be affected if malicious users can fill up the tracking
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full Matthew Wild <mwild1@gmail.com> parents: 2369 diff changeset	499 table within the limit period). You can choose to instead "fail open", and allow the rate limit to be temporarily bypassed
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full Matthew Wild <mwild1@gmail.com> parents: 2369 diff changeset	500 when the table is full. To choose this behaviour, add `(allow overflow)` to the RATE definition.
5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full Matthew Wild <mwild1@gmail.com> parents: 2369 diff changeset	501
2108 573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	502 ### Session marking
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	503
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	504 It is possible to 'mark' sessions (see the MARK_ORIGIN action below). To match stanzas from marked sessions, use the
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	505 `ORIGIN_MARKED` condition.
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	506
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	507 Condition Description
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	508 ------------------------------- ---------------------------------------------------------------
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	509 ORIGIN MARKED: markname Matches if the origin has been marked with 'markname'.
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	510 ORIGIN MARKED: markname (Xs) Matches if the origin has been marked with 'markname' within the past X seconds.
2108 573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	511
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	512 Example usage:
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	513
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	514 # This rule drops messages from sessions that have been marked as spammers in the past hour
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	515 ORIGIN MARKED: spammer (3600s)
2108 573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	516 DROP.
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	517
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	518 # This rule marks the origin session as a spammer if they send a message to a honeypot JID
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	519 KIND: message
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	520 TO: honeypot@example.com
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	521 MARK ORIGIN=spammer
2108 573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	522
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	523 Actions
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	524 -------
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	525
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	526 Actions come after all conditions in a rule block. There must be at
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	527 least one action, though conditions are optional.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	528
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	529 An action without parameters ends with a full-stop/period ('.'), and one
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	530 with parameters uses an equals sign ('='):
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	531
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	532 # An action with no parameters:
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	533 DROP.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	534
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	535 # An action with a parameter:
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	536 REPLY=Hello, this is a reply.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	537
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	538 ### Route modification
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	539
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	540 The most common actions modify the stanza's route in some way. Currently
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	541 the first matching rule to do so will halt further processing of actions
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	542 and rules (this may change in the future).
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	543
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	544 Action Description
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	545 ----------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------
2559 99b32f77f00d mod_firewall: Document PASS, RETURN and DEFAULT Matthew Wild <mwild1@gmail.com> parents: 2545 diff changeset	546 `PASS.` Stop executing actions and rules on this stanza, and let it through this chain and any calling chains.
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	547 `DROP.` Stop executing actions and rules on this stanza, and discard it.
2559 99b32f77f00d mod_firewall: Document PASS, RETURN and DEFAULT Matthew Wild <mwild1@gmail.com> parents: 2545 diff changeset	548 `DEFAULT.` Stop executing actions and rules on this stanza, prevent any other scripts/modules from handling it, to trigger the appropriate default "unhandled stanza" behaviour. Do not use in custom chains (it is treated as PASS).
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	549 `REDIRECT=jid` Redirect the stanza to the given JID.
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	550 `REPLY=text` Reply to the stanza (assumed to be a message) with the given text.
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	551 `BOUNCE.` Bounce the stanza with the default error (usually service-unavailable)
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	552 `BOUNCE=error` Bounce the stanza with the given error (MUST be a defined XMPP stanza error, see [RFC6120](http://xmpp.org/rfcs/rfc6120.html#stanzas-error-conditions).
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	553 `BOUNCE=error (text)` As above, but include the supplied human-readable text with a description of the error
2092 f5d78bc016a6 mod_firewall: README: Add warning about COPY action's ability to cause loops (thanks Ge0rG) Matthew Wild <mwild1@gmail.com> parents: 2047 diff changeset	554 `COPY=jid` Make a copy of the stanza and send the copy to the specified JID. The copied stanza flows through Prosody's routing code, and as such is affected by firewall rules. Be careful to avoid loops.
2576 95b79d515a65 mod_firewall: README: Document TO/FROM ADMIN, FORWARD, TO SELF and TO FULL JID Matthew Wild <mwild1@gmail.com> parents: 2559 diff changeset	555 `FORWARD=jid` Forward a copy of the stanza to the given JID (using XEP-0297). The stanza will be sent from the current host's JID.
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	556
2095 3b4a6d255d7a mod_firewall: README: Add note about BOUNCE and error stanzas/iq results Matthew Wild <mwild1@gmail.com> parents: 2093 diff changeset	557 Note: It is incorrect behaviour to reply to an 'error' stanza with another error, so BOUNCE will simply act the same as 'DROP' for stanzas that should not be bounced (error stanzas and iq results).
3b4a6d255d7a mod_firewall: README: Add note about BOUNCE and error stanzas/iq results Matthew Wild <mwild1@gmail.com> parents: 2093 diff changeset	558
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	559 ### Stanza modification
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	560
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	561 These actions make it possible to modify the content and structure of a
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	562 stanza.
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	563
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	564 Action Description
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	565 ------------------------ ------------------------------------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	566 `STRIP=name` Remove any child elements with the given name in the default namespace
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	567 `STRIP=name namespace` Remove any child elements with the given name and the given namespace
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	568 `INJECT=xml` Inject the given XML into the stanza as a child element
1782 29f3d6b7ad16 Import wiki pages Kim Alvefur <zash@zash.se> parents: diff changeset	569
2108 573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	570 ### Sessions
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	571
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	572 It is possible to mark sessions, and then use these marks to match rules later on.
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	573
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	574 Action Description
573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	575 ------------------------ --------------------------------------------------------------------------
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	576 `MARK ORIGIN=mark` Marks the originating session with the given flag.
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	577 `UNMARK ORIGIN=mark` Removes the given mark from the origin session (if it is set).
2108 573fe9825fba mod_firewall: README: Document session marking Matthew Wild <mwild1@gmail.com> parents: 2105 diff changeset	578
2114 ce3dd93f30d9 mod_firewall: README: Note about marks applying to sessions, not JIDs Matthew Wild <mwild1@gmail.com> parents: 2111 diff changeset	579 Note: Marks apply to sessions, not JIDs. E.g. if marking in a rule that matches a stanza received
ce3dd93f30d9 mod_firewall: README: Note about marks applying to sessions, not JIDs Matthew Wild <mwild1@gmail.com> parents: 2111 diff changeset	580 over s2s, it is the s2s session that is marked.
ce3dd93f30d9 mod_firewall: README: Note about marks applying to sessions, not JIDs Matthew Wild <mwild1@gmail.com> parents: 2111 diff changeset	581
ce3dd93f30d9 mod_firewall: README: Note about marks applying to sessions, not JIDs Matthew Wild <mwild1@gmail.com> parents: 2111 diff changeset	582 It is possible to have multiple marks on an origin at any given time.
ce3dd93f30d9 mod_firewall: README: Note about marks applying to sessions, not JIDs Matthew Wild <mwild1@gmail.com> parents: 2111 diff changeset	583
1803 4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	584 ### Informational
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	585
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	586 Action Description
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	587 --------------- ------------------------------------------------------------------------------------------------------------------------
4d73a1a6ba68 Convert all wiki pages to Markdown Kim Alvefur <zash@zash.se> parents: 1782 diff changeset	588 `LOG=message` Logs the given message to Prosody's log file. Optionally prefix it with a log level in square brackets, e.g. `[debug]`
2093 7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions Matthew Wild <mwild1@gmail.com> parents: 2092 diff changeset	589
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions Matthew Wild <mwild1@gmail.com> parents: 2092 diff changeset	590 You can include expressions in log messages, using `$(...)` syntax. For example, to log the stanza that matched the rule, you can use $(stanza),
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions Matthew Wild <mwild1@gmail.com> parents: 2092 diff changeset	591 or to log just the top tag of the stanza, use $(stanza:top_tag()).
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions Matthew Wild <mwild1@gmail.com> parents: 2092 diff changeset	592
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions Matthew Wild <mwild1@gmail.com> parents: 2092 diff changeset	593 Example:
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions Matthew Wild <mwild1@gmail.com> parents: 2092 diff changeset	594
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions Matthew Wild <mwild1@gmail.com> parents: 2092 diff changeset	595 # Log all stanzas to user@example.com:
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions Matthew Wild <mwild1@gmail.com> parents: 2092 diff changeset	596 TO: user@example.com
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions Matthew Wild <mwild1@gmail.com> parents: 2092 diff changeset	597 LOG=[debug] User received: $(stanza)
7b9520479e99 mod_firewall: README: Document LOG's ability to take meta expressions Matthew Wild <mwild1@gmail.com> parents: 2092 diff changeset	598
2369 2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	599 More info about expressions can be found below.
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	600
2096 b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	601 Chains
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	602 ------
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	603
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	604 Rules are grouped into "chains", which are injected at particular points in Prosody's routing code.
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	605
2559 99b32f77f00d mod_firewall: Document PASS, RETURN and DEFAULT Matthew Wild <mwild1@gmail.com> parents: 2545 diff changeset	606 Available built-in chains are:
2096 b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	607
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	608 Chain Description
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	609 -------------- -------------------------------------------------------------------------------------------
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	610 deliver Applies to stanzas delivered to local recipients (regardless of the stanza's origin)
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	611 deliver_remote Applies to stanzas delivered to remote recipients (just before they leave the local server)
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	612 preroute Applies to incoming stanzas from local users, before any routing rules are applied
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	613
2111 4e434abaf8fc mod_firewall: README: Improve chain documentation Matthew Wild <mwild1@gmail.com> parents: 2110 diff changeset	614 A chain is begun by a line `::name` where 'name' is the name of the chain you want the following rules to be
4e434abaf8fc mod_firewall: README: Improve chain documentation Matthew Wild <mwild1@gmail.com> parents: 2110 diff changeset	615 inserted into. If no chain is specified, rules are put into the 'deliver' chain.
4e434abaf8fc mod_firewall: README: Improve chain documentation Matthew Wild <mwild1@gmail.com> parents: 2110 diff changeset	616
4e434abaf8fc mod_firewall: README: Improve chain documentation Matthew Wild <mwild1@gmail.com> parents: 2110 diff changeset	617 It is possible to create custom chains (useful with the JUMP_CHAIN action described below). User-created
4e434abaf8fc mod_firewall: README: Improve chain documentation Matthew Wild <mwild1@gmail.com> parents: 2110 diff changeset	618 chains must begin with "user/", e.g. "user/spam_filtering".
2096 b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	619
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	620 Example of chain use:
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	621
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	622 # example.com's firewall script
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	623
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	624 # This line is optional, because 'deliver' is the default chain anyway:
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	625 ::deliver
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	626
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	627 # This rule matches any stanzas delivered to our local user bob:
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	628 TO: bob@example.com
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	629 DROP.
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	630
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	631 # Oops! This rule will never match, because alice is not a local user,
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	632 # and only stanzas to local users go through the 'deliver' chain:
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	633 TO: alice@remote.example.com
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	634 DROP.
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	635
2104 384fb28452b9 mod_firewall: README: Improve chain usage example comments Matthew Wild <mwild1@gmail.com> parents: 2103 diff changeset	636 # Create a 'preroute' chain of rules (matched for incoming stanzas from local clients):
2096 b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	637 ::preroute
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	638 # These rules are matched for outgoing stanzas from local clients
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	639
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	640 # This will match any stanzas sent to alice from a local user:
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	641 TO: alice@remote.example.com
b75d29a162cd mod_firewall: README: Document chains Matthew Wild <mwild1@gmail.com> parents: 2095 diff changeset	642 DROP.
2105 f2d5aa789646 mod_firewall: README: Document JUMP_CHAIN Matthew Wild <mwild1@gmail.com> parents: 2104 diff changeset	643
f2d5aa789646 mod_firewall: README: Document JUMP_CHAIN Matthew Wild <mwild1@gmail.com> parents: 2104 diff changeset	644 Action Description
f2d5aa789646 mod_firewall: README: Document JUMP_CHAIN Matthew Wild <mwild1@gmail.com> parents: 2104 diff changeset	645 ------------------------ ------------------------------------------------------------------------
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	646 `JUMP CHAIN=name` Switches chains, and passes the stanza through the rules in chain 'name'. If the new chain causes the stanza to be dropped/redirected, the current chain halts further processing.
2559 99b32f77f00d mod_firewall: Document PASS, RETURN and DEFAULT Matthew Wild <mwild1@gmail.com> parents: 2545 diff changeset	647 `RETURN.` Stops executing the current chain and returns to the parent chain. For built-in chains, equivalent to PASS. RETURN is implicit at the end of every chain.
2369 2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	648
2389 a753b21968c5 mod_firewall: README: Clarify that it's possible to jump to chains defined outside of the current file Matthew Wild <mwild1@gmail.com> parents: 2388 diff changeset	649 It is possible to jump to chains defined by other scripts and modules.
a753b21968c5 mod_firewall: README: Clarify that it's possible to jump to chains defined outside of the current file Matthew Wild <mwild1@gmail.com> parents: 2388 diff changeset	650
2369 2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	651 Expressions
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	652 -----------
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	653
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	654 Some conditions and actions in rules support "expressions" in their parameters (their documentation will indicate if this is the case). Most parameters
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	655 are static once the firewall script is loaded and compiled internally, however parameters that allow expressions can be dynamically calculated when a
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	656 rule is being run.
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	657
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	658 There are two kinds of expression that you can use: stanza expressions, and code expressions.
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	659
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	660 ### Stanza expressions
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	661
2369 2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	662 Stanza expressions are of the form `$<...>`, where `...` is a stanza path. For syntax of stanza paths, see the documentation for the 'INSPECT' condition
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	663 above.
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	664
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	665 Example:
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	666
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	667 LOG=Matched a stanza from $<@from> to $<@to>
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	668
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	669 There are built in functions which can be applied to the output of a stanza expression, by appending the pipe ('\|') operator, followed by the function
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	670 name. These functions are:
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	671
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	672 Function Description
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	673 ------------ ---------------------------------------
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	674 bare Given a JID, strip any resource
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	675 node Return the node ('user part') of a JID
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	676 host Return the host ('domain') part of a JID
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	677 resource Return the resource part of a JID
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	678
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	679 For example, to apply a rate limit to stanzas per sender domain:
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	680
4072 2dcbc01c9931 mod_firewall: Fix example in README to use \|host (thanks DebXWoody) Matthew Wild <mwild1@gmail.com> parents: 3197 diff changeset	681 LIMIT normal on $<@from\|host>
2540 d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	682
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	683 If the path does not match (e.g. the element isn't found, or the attribute doesn't exist) or any of the functions fail to produce an output (e.g. an invalid
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	684 JID was passed to a function that only handles valid JIDs) the expression will return the text `<undefined>`. You can override this by ending the expression
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	685 with a double pipe ('\|\|') followed by a quoted string to use as a default instead. E.g. to default to the string "normal" when there is no 'type' attribute:
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	686
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	687 LOG=Stanza type is $<@type\|\|"normal">
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	688
d637bc0ac604 mod_firewall: Update README for latest changes Matthew Wild <mwild1@gmail.com> parents: 2410 diff changeset	689 ### Code expressions
2369 2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	690
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	691 Code expressions use `$(...)` syntax. Code expressions are powerful, and allow unconstrained access to Prosody's internal environment. Therefore
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	692 code expressions are typically for advanced use-cases only. You may want to refer to Prosody's [developer documentation](https://prosody.im/doc/developers)
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	693 for more information. In particular, within code expressions you may access the 'session' object, which is the session object of the origin of the stanza,
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	694 and the 'stanza' object, which is the stanza being considered within the current rule. Whatever value the expression returns will be converted to a string.
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	695
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	696 Example to limit stanzas per session type:
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	697
2fb11d34087e mod_firewall: README: Update for LIMIT 'on' and document expression syntax Matthew Wild <mwild1@gmail.com> parents: 2360 diff changeset	698 LIMIT: normal on $(session.type)

Mercurial > prosody-modules

annotate mod_firewall/README.markdown @ 4127:e9e10ec1b91c