author | Marco Cirillo <maranda@lightwitch.org> |
Sun, 08 Jan 2012 05:25:49 +0000 | |
changeset 537 | 50be30f203f3 |
parent 533 | 47b9053dba38 |
child 680 | a2cea070f2c7 |
permissions | -rw-r--r-- |
493
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
1 |
-- (C) 2011, Marco Cirillo (LW.Org) |
519
219ffe3541ff
mod_host_guard: updated banner.
Marco Cirillo <maranda@lightwitch.org>
parents:
515
diff
changeset
|
2 |
-- Block or restrict by blacklist remote access to local components or hosts. |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
3 |
|
460
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
4 |
module:set_global() |
9bb9343f3c7a
mod_component_guard: made module global, refactored init.
Marco Cirillo <maranda@lightwitch.org>
parents:
459
diff
changeset
|
5 |
|
493
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
6 |
local guard_blockall = module:get_option_set("host_guard_blockall", {}) |
515
e98fe28c50b0
mod_host_guard: added exceptions/whitelisting to the blockall logic (makes little sense otherwise has s2s_disallow = true does the same)
Marco Cirillo <maranda@lightwitch.org>
parents:
494
diff
changeset
|
7 |
local guard_ball_wl = module:get_option_set("host_guard_blockall_exceptions", {}) |
493
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
8 |
local guard_protect = module:get_option_set("host_guard_selective", {}) |
b1b80319bbf6
mod_host_guard: renamed mod_component_guard to mod_host_guard, as it really works with all hosts, finally decided to wiki it out and not merge it with the s2s_blackwhitelisting module.
Marco Cirillo <maranda@lightwitch.org>
parents:
460
diff
changeset
|
9 |
local guard_block_bl = module:get_option_set("host_guard_blacklist", {}) |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
10 |
|
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
11 |
local s2smanager = require "core.s2smanager" |
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
12 |
local config = require "core.configmanager" |
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
13 |
local nameprep = require "util.encodings".stringprep.nameprep |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
14 |
|
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
15 |
local _make_connect = s2smanager.make_connect |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
16 |
function s2smanager.make_connect(session, connect_host, connect_port) |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
17 |
if not session.s2sValidation then |
515
e98fe28c50b0
mod_host_guard: added exceptions/whitelisting to the blockall logic (makes little sense otherwise has s2s_disallow = true does the same)
Marco Cirillo <maranda@lightwitch.org>
parents:
494
diff
changeset
|
18 |
if guard_blockall:contains(session.from_host) and not guard_ball_wl:contains(session.to_host) or |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
19 |
guard_block_bl:contains(session.to_host) and guard_protect:contains(session.from_host) then |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
20 |
module:log("error", "remote service %s attempted to access restricted host %s", session.to_host, session.from_host) |
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
21 |
s2smanager.destroy_session(session, "You're not authorized, good bye.") |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
22 |
return false; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
23 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
24 |
end |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
25 |
return _make_connect(session, connect_host, connect_port) |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
26 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
27 |
|
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
28 |
local _stream_opened = s2smanager.streamopened |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
29 |
function s2smanager.streamopened(session, attr) |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
30 |
local host = attr.to and nameprep(attr.to) |
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
31 |
local from = attr.from and nameprep(attr.from) |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
32 |
if not from then |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
33 |
session.s2sValidation = false |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
34 |
else |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
35 |
session.s2sValidation = true |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
36 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
37 |
|
515
e98fe28c50b0
mod_host_guard: added exceptions/whitelisting to the blockall logic (makes little sense otherwise has s2s_disallow = true does the same)
Marco Cirillo <maranda@lightwitch.org>
parents:
494
diff
changeset
|
38 |
if guard_blockall:contains(host) and not guard_ball_wl:contains(from) or |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
39 |
guard_block_bl:contains(from) and guard_protect:contains(host) then |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
40 |
module:log("error", "remote service %s attempted to access restricted host %s", from, host) |
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
41 |
session:close({condition = "policy-violation", text = "You're not authorized, good bye."}) |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
42 |
return false; |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
43 |
end |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
44 |
_stream_opened(session, attr) |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
45 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
46 |
|
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
47 |
local function sdr_hook (event) |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
48 |
local origin, stanza = event.origin, event.stanza |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
49 |
|
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
50 |
if origin.type == "s2sin" or origin.type == "s2sin_unauthed" then |
515
e98fe28c50b0
mod_host_guard: added exceptions/whitelisting to the blockall logic (makes little sense otherwise has s2s_disallow = true does the same)
Marco Cirillo <maranda@lightwitch.org>
parents:
494
diff
changeset
|
51 |
if guard_blockall:contains(stanza.attr.to) and not guard_ball_wl:contains(stanza.attr.from) or |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
52 |
guard_block_bl:contains(stanza.attr.from) and guard_protect:contains(stanza.attr.to) then |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
53 |
module:log("error", "remote service %s attempted to access restricted host %s", stanza.attr.from, stanza.attr.to) |
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
54 |
origin:close({condition = "policy-violation", text = "You're not authorized, good bye."}) |
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
55 |
return false |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
56 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
57 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
58 |
|
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
59 |
return nil |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
60 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
61 |
|
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
62 |
local function handle_activation (host) |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
63 |
if guard_blockall:contains(host) or guard_protect:contains(host) then |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
64 |
if hosts[host] and hosts[host].events then |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
65 |
hosts[host].events.add_handler("stanza/jabber:server:dialback:result", sdr_hook, 100) |
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
66 |
module:log ("debug", "adding host protection for: "..host) |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
67 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
68 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
69 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
70 |
|
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
71 |
local function handle_deactivation (host) |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
72 |
if guard_blockall:contains(host) or guard_protect:contains(host) then |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
73 |
if hosts[host] and hosts[host].events then |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
74 |
hosts[host].events.remove_handler("stanza/jabber:server:dialback:result", sdr_hook) |
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
75 |
module:log ("debug", "removing host protection for: "..host) |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
76 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
77 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
78 |
end |
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
79 |
|
537
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
80 |
local function init_hosts() |
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
81 |
for n,table in pairs(hosts) do |
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
82 |
hosts[n].events.remove_handler("stanza/jabber:server:dialback:result", sdr_hook) |
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
83 |
if guard_blockall:contains(n) or guard_protect:contains(n) then handle_activation(n) end |
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
84 |
end |
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
85 |
end |
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
86 |
|
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
87 |
local function reload() |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
88 |
module:log ("debug", "server configuration reloaded, rehashing plugin tables...") |
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
89 |
guard_blockall = module:get_option_set("host_guard_blockall", {}) |
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
90 |
guard_ball_wl = module:get_option_set("host_guard_blockall_exceptions", {}) |
537
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
91 |
guard_protect = module:get_option_set("host_guard_selective", {}) |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
92 |
guard_block_bl = module:get_option_set("host_guard_blacklist", {}) |
537
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
93 |
|
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
94 |
init_hosts() |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
95 |
end |
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
96 |
|
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
97 |
local function setup() |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
98 |
module:log ("debug", "initializing host guard module...") |
537
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
99 |
module:hook ("host-activated", handle_activation) |
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
100 |
module:hook ("host-deactivated", handle_deactivation) |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
101 |
module:hook ("config-reloaded", reload) |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
102 |
|
537
50be30f203f3
mod_host_guard: fixed plugin, minor code refactor.
Marco Cirillo <maranda@lightwitch.org>
parents:
533
diff
changeset
|
103 |
init_hosts() |
456
73f06a14390a
mod_component_guard: initial commit.
Marco Cirillo <maranda@lightwitch.org>
parents:
diff
changeset
|
104 |
end |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
105 |
|
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
106 |
if prosody.start_time then |
528
1737c08fde30
mod_host_guard: stick to one code "punctuation" style.
Marco Cirillo <maranda@lightwitch.org>
parents:
519
diff
changeset
|
107 |
setup() |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
108 |
else |
533
47b9053dba38
mod_host_guard: replaced prosody.events.add_handler with module:hook.
Marco Cirillo <maranda@lightwitch.org>
parents:
528
diff
changeset
|
109 |
module:hook ("server-started", setup) |
458
4149fcacbbf1
mod_component_guard: refactored init code, added reloading logic to prevent events pollution with stale dupes.
Marco Cirillo <maranda@lightwitch.org>
parents:
457
diff
changeset
|
110 |
end |