diff mod_isolate_host/mod_isolate_host.lua @ 5296:0f5657db1cfc

mod_isolate_host: handle server-generated stanzas The hook for setting the no_host_isolation is only called for c2s sessions. This does not work for stanzas generated by the server, such as PEP notifications or presence probe answers. To handle that, we do per-stanza checks for the case that the origin is local.
author Jonas Schäfer <jonas@wielicki.name>
date Sat, 01 Apr 2023 12:03:08 +0200
parents 16db0a6e868c
children 4bba2d27ffaf
line wrap: on
line diff
--- a/mod_isolate_host/mod_isolate_host.lua	Fri Mar 31 16:56:42 2023 +0200
+++ b/mod_isolate_host/mod_isolate_host.lua	Sat Apr 01 12:03:08 2023 +0200
@@ -22,6 +22,14 @@
 			except_domains:add(to_host);
 			return;
 		end
+		if origin.type == "local" then
+			-- this is code-generated, which means that set_session_isolation_flag has never triggered.
+			-- we need to check explicitly.
+			if not is_jid_isolated(jid_bare(event.stanza.attr.from)) then
+				module:log("debug", "server-generated stanza from %s is allowed, as the jid is not isolated", event.stanza.attr.from);
+				return;
+			end
+		end
 		module:log("warn", "Forbidding stanza from %s to %s", stanza.attr.from or origin.full_jid, stanza.attr.to);
 		origin.send(st.error_reply(stanza, "auth", "forbidden", "Communication with "..to_host.." is not available"));
 		return true;
@@ -36,13 +44,21 @@
 
 module:default_permission("prosody:admin", "xmpp:federate");
 
-function check_user_isolated(event)
+function is_jid_isolated(bare_jid)
+	if module:may("xmpp:federate", bare_jid) or except_users:contains(bare_jid) then
+		return false;
+	else
+		return true;
+	end
+end
+
+function set_session_isolation_flag(event)
 	local session = event.session;
 	local bare_jid = jid_bare(session.full_jid);
-	if module:may("xmpp:federate", event) or except_users:contains(bare_jid) then
+	if not is_jid_isolated(bare_jid) then
 		session.no_host_isolation = true;
 	end
 	module:log("debug", "%s is %sisolated", session.full_jid or "[?]", session.no_host_isolation and "" or "not ");
 end
 
-module:hook("resource-bind", check_user_isolated);
+module:hook("resource-bind", set_session_isolation_flag);