author | Marco Cirillo <maranda@lightwitch.org> |
Thu, 05 Jan 2012 01:37:53 +0000 | |
changeset 519 | 219ffe3541ff |
parent 515 | e98fe28c50b0 |
child 528 | 1737c08fde30 |
permissions | -rw-r--r-- |
493
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
1 |
-- (C) 2011, Marco Cirillo (LW.Org) |
519
219ffe3541ff
mod_host_guard: updated banner.
Marco Cirillo <maranda@lightwitch.org>
parents:
515
diff
changeset
|
2 |
-- Block or restrict by blacklist remote access to local components or hosts. |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
3 |
|
460
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
4 |
module:set_global() |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
5 |
|
493
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
6 |
local guard_blockall = module:get_option_set("host_guard_blockall", {}) |
515
e98fe28c50b0
mod_host_guard: added exceptions/whitelisting to the blockall logic (makes little sense otherwise has s2s_disallow = true does the same)
Marco Cirillo <maranda@lightwitch.org>
parents:
494
diff
changeset
|
7 |
local guard_ball_wl = module:get_option_set("host_guard_blockall_exceptions", {}) |
493
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
8 |
local guard_protect = module:get_option_set("host_guard_selective", {}) |
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
9 |
local guard_block_bl = module:get_option_set("host_guard_blacklist", {}) |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
10 |
|
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
11 |
local s2smanager = require "core.s2smanager"; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
12 |
local config = require "core.configmanager"; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
13 |
local nameprep = require "util.encodings".stringprep.nameprep; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
14 |
|
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
15 |
local _make_connect = s2smanager.make_connect; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
16 |
function s2smanager.make_connect(session, connect_host, connect_port) |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
17 |
if not session.s2sValidation then |
515
e98fe28c50b0
mod_host_guard: added exceptions/whitelisting to the blockall logic (makes little sense otherwise has s2s_disallow = true does the same)
Marco Cirillo <maranda@lightwitch.org>
parents:
494
diff
changeset
|
18 |
if guard_blockall:contains(session.from_host) and not guard_ball_wl:contains(session.to_host) or |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
19 |
guard_block_bl:contains(session.to_host) and guard_protect:contains(session.from_host) then |
493
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
20 |
module:log("error", "remote service %s attempted to access restricted host %s", session.to_host, session.from_host); |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
21 |
s2smanager.destroy_session(session, "You're not authorized, good bye."); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
22 |
return false; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
23 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
24 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
25 |
return _make_connect(session, connect_host, connect_port); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
26 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
27 |
|
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
28 |
local _stream_opened = s2smanager.streamopened; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
29 |
function s2smanager.streamopened(session, attr) |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
30 |
local host = attr.to and nameprep(attr.to); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
31 |
local from = attr.from and nameprep(attr.from); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
32 |
if not from then |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
33 |
session.s2sValidation = false; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
34 |
else |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
35 |
session.s2sValidation = true; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
36 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
37 |
|
515
e98fe28c50b0
mod_host_guard: added exceptions/whitelisting to the blockall logic (makes little sense otherwise has s2s_disallow = true does the same)
Marco Cirillo <maranda@lightwitch.org>
parents:
494
diff
changeset
|
38 |
if guard_blockall:contains(host) and not guard_ball_wl:contains(from) or |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
39 |
guard_block_bl:contains(from) and guard_protect:contains(host) then |
493
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
40 |
module:log("error", "remote service %s attempted to access restricted host %s", from, host); |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
41 |
session:close({condition = "policy-violation", text = "You're not authorized, good bye."}); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
42 |
return false; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
43 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
44 |
_stream_opened(session, attr); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
45 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
46 |
|
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
47 |
local function sdr_hook (event) |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
48 |
local origin, stanza = event.origin, event.stanza; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
49 |
|
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
50 |
if origin.type == "s2sin" or origin.type == "s2sin_unauthed" then |
515
e98fe28c50b0
mod_host_guard: added exceptions/whitelisting to the blockall logic (makes little sense otherwise has s2s_disallow = true does the same)
Marco Cirillo <maranda@lightwitch.org>
parents:
494
diff
changeset
|
51 |
if guard_blockall:contains(stanza.attr.to) and not guard_ball_wl:contains(stanza.attr.from) or |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
52 |
guard_block_bl:contains(stanza.attr.from) and guard_protect:contains(stanza.attr.to) then |
493
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
53 |
module:log("error", "remote service %s attempted to access restricted host %s", stanza.attr.from, stanza.attr.to); |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
54 |
origin:close({condition = "policy-violation", text = "You're not authorized, good bye."}); |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
55 |
return false; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
56 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
57 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
58 |
|
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
59 |
return nil; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
60 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
61 |
|
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
62 |
local function handle_activation (host) |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
63 |
if guard_blockall:contains(host) or guard_protect:contains(host) then |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
64 |
if hosts[host] and hosts[host].events then |
457
79ba4f95d65c
mod_component_guard: missing hook priority.
Marco Cirillo <maranda@lightwitch.org>
parents:
456
diff
changeset
|
65 |
hosts[host].events.add_handler("stanza/jabber:server:dialback:result", sdr_hook, 100); |
493
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
66 |
module:log ("debug", "adding host protection for: "..host); |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
67 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
68 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
69 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
70 |
|
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
71 |
local function handle_deactivation (host) |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
72 |
if guard_blockall:contains(host) or guard_protect:contains(host) then |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
73 |
if hosts[host] and hosts[host].events then |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
74 |
hosts[host].events.remove_handler("stanza/jabber:server:dialback:result", sdr_hook); |
493
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
75 |
module:log ("debug", "removing host protection for: "..host); |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
76 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
77 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
78 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
79 |
|
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
80 |
local function reload() |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
81 |
module:log ("debug", "server configuration reloaded, rehashing plugin tables..."); |
494
376c4a90249c
mod_host_guard: minor fix.
Marco Cirillo <maranda@lightwitch.org>
parents:
493
diff
changeset
|
82 |
guard_blockall = module:get_option_set("host_guard_blockall", {}); |
515
e98fe28c50b0
mod_host_guard: added exceptions/whitelisting to the blockall logic (makes little sense otherwise has s2s_disallow = true does the same)
Marco Cirillo <maranda@lightwitch.org>
parents:
494
diff
changeset
|
83 |
guard_ball_wl = module:get_option_set("host_guard_blockall_exceptions", {}); |
494
376c4a90249c
mod_host_guard: minor fix.
Marco Cirillo <maranda@lightwitch.org>
parents:
493
diff
changeset
|
84 |
guard_protect = module:get_option_set("host_guard_components", {}); |
376c4a90249c
mod_host_guard: minor fix.
Marco Cirillo <maranda@lightwitch.org>
parents:
493
diff
changeset
|
85 |
guard_block_bl = module:get_option_set("host_guard_blacklist", {}); |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
86 |
end |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
87 |
|
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
88 |
local function setup() |
493
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
89 |
module:log ("debug", "initializing host guard module..."); |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
90 |
|
460
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
91 |
module:hook ("component-activated", handle_activation); |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
92 |
module:hook ("component-deactivated", handle_deactivation); |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
93 |
module:hook ("config-reloaded", reload); |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
94 |
|
460
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
95 |
for n,table in pairs(hosts) do |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
96 |
if table.type == "component" then |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
97 |
if guard_blockall:contains(n) or guard_protect:contains(n) then |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
98 |
hosts[n].events.remove_handler("stanza/jabber:server:dialback:result", sdr_hook); |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
99 |
handle_activation(n); |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
100 |
end |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
101 |
end |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
102 |
end |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
103 |
end |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
104 |
|
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
105 |
if prosody.start_time then |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
106 |
setup(); |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
107 |
else |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
108 |
prosody.events.add_handler("server-started", setup); |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
109 |
end |