prosody-modules: mod_firewall/mod_firewall.lua comparison

comparison mod_firewall/mod_firewall.lua @ 5920:254a21a104aa

mod_server_contact_info: Backport from prosody trunk

author	Matthew Wild <mwild1@gmail.com>
date	Fri, 07 Jun 2024 16:14:58 +0100
parents	1d1eadff331d
children

comparison

equal deleted inserted replaced

-:99ecfe44910b
+:254a21a104aa
 		global_code = [[local new_medium_id = require "util.id".medium;]];
 	};
 	new_long_id = {
 		global_code = [[local new_long_id = require "util.id".long;]];
 	};
+	trace = {
+		global_code = [[local trace_init = module:require("trace").init;]];
+	};
 };
 local function include_dep(dependency, code)
 	local dep, dep_param = dependency:match("^([^:]+):?(.*)$");
 	local dep_info = available_deps[dep];
 if module:get_option_boolean("firewall_experimental_user_marks", true) then
 	module:require"marks";
 end
-local function new_rule(ruleset, chain)
+local function new_rule(ruleset, chain, line_no)
 	assert(chain, "no chain specified");
-	local rule = { conditions = {}, actions = {}, deps = {} };
+	local rule = { conditions = {}, actions = {}, deps = {}, line_no = line_no };
 	table.insert(ruleset[chain], rule);
 	return rule;
 end
 local function parse_firewall_rules(filename)
 	local function errmsg(err)
 		return "Error compiling "..filename.." on line "..line_no..": "..err;
 	end
+	local metadata = { debug = {} };
 	local ruleset = {
 		deliver = {};
 	};
 	local chain = "deliver"; -- Default chain
 				end
 			elseif chain_info.type ~= "event" then
 				return nil, errmsg("Only event chains supported at the moment");
 			end
 			ruleset[chain] = ruleset[chain] or {};
+		elseif not(state) and line:sub(1, 2) == "@@" then
+			local k, v = line:match("^@@%s*([^%s=]+)%s*=%s*(.+)$");
+			if not k then
+				return nil, errmsg("Unable to parse metadata assignment (expected '@@ key = value')");
+			end
+			metadata[k] = v;
 		elseif not(state) and line:sub(1,1) == "%" then -- Definition (zone, limit, etc.)
 			local what, name = line:match("^%%%s*([%w_]+) +([^ :]+)");
 			if not definition_handlers[what] then
 				return nil, errmsg("Definition of unknown object: "..what);
 			elseif not name or not idsafe(name) then
 			for _, dep in ipairs(action_deps or {}) do
 				table.insert(rule.deps, dep);
 			end
 		elseif state == "actions" then -- state is actions but action pattern did not match
 			state = nil; -- Awaiting next rule, etc.
-			table.insert(ruleset[chain], rule);
+			table.insert(ruleset[chain], rule); -- FIXME: Is this a bug? Rule should have already been inserted by new_rule()?
 			rule = nil;
 		else
-			if not state then
+			-- Condition
+			if not state then -- Starting a new rule block?
 				state = "rules";
-				rule = new_rule(ruleset, chain);
+				rule = new_rule(ruleset, chain, line_no);
 			end
 			-- Check standard modifiers for the condition (e.g. NOT)
 			local negated;
 			local condition = line:match("^[^:=%.?]*");
 			if condition:find("%f[%w]NOT%f[^%w]") then
 			for _, dep in ipairs(condition_deps or {}) do
 				table.insert(rule.deps, dep);
 			end
 		end
 	end
-	return ruleset;
+	return ruleset, metadata;
 end
-local function process_firewall_rules(ruleset)
+local function process_firewall_rules(ruleset, metadata)
 	-- Compile ruleset and return complete code
 	local chain_handlers = {};
 	-- Loop through the chains in the parsed ruleset (e.g. incoming, outgoing)
 				end
 				condition_uses[condition] = (condition_uses[condition] or 0) + 1;
 			end
 		end
+		if metadata.trace then
+			include_dep("trace", code);
+			table.insert(code, ("local trace = trace_init(%q, %q);"):format(metadata.filename, chain_name))
+		end
 		local condition_cache, n_conditions = {}, 0;
-		for _, rule in ipairs(rules) do
+		for rule_n, rule in ipairs(rules) do
 			for _, dep in ipairs(rule.deps) do
 				include_dep(dep, code);
 			end
 			table.insert(code, "\n\t\t");
 			local rule_code;
 						end
 						rule.conditions[i] = (negated and "not(" or "")..name..(negated and ")" or "");
 					else
 						rule.conditions[i] = (negated and "not(" or "(")..condition..")";
 					end
+					if metadata.trace then
+						-- Wrap each condition in a tracer
+						rule.conditions[i] = ("trace(%d, %d, %s)"):format(rule_n, i, rule.conditions[i]);
+					end
+				end
+				if metadata.trace then
+					-- Trace overall action
+					table.insert(rule.actions, 1, ("trace(%d, nil, true)"):format(rule_n));
+					table.insert(rule.actions, ("else trace(%d, nil, false)"):format(rule_n));
 				end
 				rule_code = "if "..table.concat(rule.conditions, " and ").." then\n\t\t\t"
 					..table.concat(rule.actions, "\n\t\t\t")
 					.."\n\t\tend\n";
 	return chain_handlers;
 end
 local function compile_firewall_rules(filename)
-	local ruleset, err = parse_firewall_rules(filename);
+	local ruleset, metadata = parse_firewall_rules(filename);
-	if not ruleset then return nil, err; end
+	if not ruleset then return nil, metadata; end
-	local chain_handlers = process_firewall_rules(ruleset);
+	local chain_handlers = process_firewall_rules(ruleset, metadata);
 	return chain_handlers;
 end
 -- Compile handler code into a factory that produces a valid event handler. Factory accepts
 -- a value to be returned on PASS

Mercurial > prosody-modules

comparison mod_firewall/mod_firewall.lua @ 5920:254a21a104aa