Mercurial > prosody-modules

comparison mod_audit/mod_audit.lua @ 5298:12f7d8b901e0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_audit: Support for adding location (GeoIP) to audit events This can be more privacy-friendly than logging full IP addresses, and also more informative to a user - IP addresses don't mean much to the average person, however if they see activity from outside their expected country, they can immediately identify suspicious activity. As with IPs, this field is configurable for deployments that would like to disable it. Location is also not logged when the geoip library is not available.
author Matthew Wild <mwild1@gmail.com>
date Sat, 01 Apr 2023 13:11:53 +0100
parents f3123cbbd894
children e3a3a6c86a9f
comparison
equal deleted inserted replaced
5297:4bba2d27ffaf 5298:12f7d8b901e0
4 local cleanup_after = module:get_option_string("audit_log_expires_after", "2w"); 4 local cleanup_after = module:get_option_string("audit_log_expires_after", "2w");
5 5
6 local attach_ips = module:get_option_boolean("audit_log_ips", true); 6 local attach_ips = module:get_option_boolean("audit_log_ips", true);
7 local attach_ipv4_prefix = module:get_option_number("audit_log_ipv4_prefix", nil); 7 local attach_ipv4_prefix = module:get_option_number("audit_log_ipv4_prefix", nil);
8 local attach_ipv6_prefix = module:get_option_number("audit_log_ipv6_prefix", nil); 8 local attach_ipv6_prefix = module:get_option_number("audit_log_ipv6_prefix", nil);
9
10 local have_geoip, geoip = pcall(require, "geoip.country");
11 local attach_location = have_geoip and module:get_option_boolean("audit_log_location", true);
12
13 local geoip4_country, geoip6_country;
14 if have_geoip and attach_location then
15 geoip4_country = geoip.open(module:get_option_string("geoip_ipv4_country", "/usr/share/GeoIP/GeoIP.dat"));
16 geoip6_country = geoip.open(module:get_option_string("geoip_ipv6_country", "/usr/share/GeoIP/GeoIPv6.dat"));
17 end
9 18
10 local time_now = os.time; 19 local time_now = os.time;
11 local ip = require "util.ip"; 20 local ip = require "util.ip";
12 local st = require "util.stanza"; 21 local st = require "util.stanza";
13 local moduleapi = require "core.moduleapi"; 22 local moduleapi = require "core.moduleapi";
56 if attach_ipv4_prefix or attach_ipv6_prefix then 65 if attach_ipv4_prefix or attach_ipv6_prefix then
57 network = get_ip_network(remote_ip); 66 network = get_ip_network(remote_ip);
58 end 67 end
59 stanza:text_tag("remote-ip", network or remote_ip); 68 stanza:text_tag("remote-ip", network or remote_ip);
60 end 69 end
70 if attach_location and session.ip then
71 local remote_ip = ip.new(session.ip);
72 local geoip_country = ip.proto == "IPv6" and geoip6_country or geoip4_country;
73 stanza:tag("location", {
74 country = geoip_country:query_by_addr(remote_ip.normal);
75 }):up();
76 end
61 if session.client_id then 77 if session.client_id then
62 stanza:text_tag("client", session.client_id); 78 stanza:text_tag("client", session.client_id);
63 end 79 end
64 return stanza 80 return stanza
65 end 81 end