-- Prosody IM

-- Copyright (C) 2008-2010 Matthew Wild

-- Copyright (C) 2008-2010 Waqas Hussain

--

-- This project is MIT/X11 licensed. Please see the

-- COPYING file in the source package for more information.

--

module:set_global();

local prosody = prosody;

local hosts = prosody.hosts;

local core_process_stanza = prosody.core_process_stanza;

local tostring, type = tostring, type;

local t_insert = table.insert;

local traceback = debug.traceback;

local add_task = require "util.timer".add_task;

local stop_timer = require "util.timer".stop;

local st = require "util.stanza";

local initialize_filters = require "util.filters".initialize;

local nameprep = require "util.encodings".stringprep.nameprep;

local new_xmpp_stream = require "util.xmppstream".new;

local s2s_new_incoming = require "core.s2smanager".new_incoming;

local s2s_new_outgoing = require "core.s2smanager".new_outgoing;

local s2s_destroy_session = require "core.s2smanager".destroy_session;

local uuid_gen = require "util.uuid".generate;

local runner = require "util.async".runner;

local connect = require "net.connect".connect;

local service = require "net.resolvers.service";

local errors = require "util.error";

local set = require "util.set";

local connect_timeout = module:get_option_number("s2s_timeout", 90);

local stream_close_timeout = module:get_option_number("s2s_close_timeout", 5);

local opt_keepalives = module:get_option_boolean("s2s_tcp_keepalives", module:get_option_boolean("tcp_keepalives", true));

local secure_auth = module:get_option_boolean("s2s_secure_auth", false); -- One day...

local secure_domains, insecure_domains =

	module:get_option_set("s2s_secure_domains", {})._items, module:get_option_set("s2s_insecure_domains", {})._items;

local require_encryption = module:get_option_boolean("s2s_require_encryption", false);

local stanza_size_limit = module:get_option_number("s2s_stanza_size_limit", 1024*512);

local measure_connections_inbound = module:metric(

	"gauge", "connections_inbound", "",

	"Established incoming s2s connections",

	{"host", "type", "ip_family"}

);

local measure_connections_outbound = module:metric(

	"gauge", "connections_outbound", "",

	"Established outgoing s2s connections",

	{"host", "type", "ip_family"}

);

local m_accepted_tcp_connections = module:metric(

	"counter", "accepted_tcp", "",

	"Accepted incoming connections on the TCP layer"

);

local m_authn_connections = module:metric(

	"counter", "authenticated", "",

	"Authenticated incoming connections",

	{"host", "direction", "mechanism"}

);

local m_initiated_connections = module:metric(

	"counter", "initiated", "",

	"Initiated outbound connections",

	{"host"}

);

local m_closed_connections = module:metric(

	"counter", "closed", "",

	"Closed connections",

	{"host", "direction", "error"}

);

local m_tls_params = module:metric(

	"counter", "encrypted", "",

	"Encrypted connections",

	{"protocol"; "cipher"}

);

local sessions = module:shared("sessions");

local runner_callbacks = {};

local listener = {};

local log = module._log;

local s2s_service_options = {

	default_port = 5269;

	use_ipv4 = module:get_option_boolean("use_ipv4", true);

	use_ipv6 = module:get_option_boolean("use_ipv6", true);

	use_dane = module:get_option_boolean("use_dane", false);

};

module:hook("stats-update", function ()

	measure_connections_inbound:clear()

	measure_connections_outbound:clear()

	-- TODO: init all expected metrics once?

	-- or maybe create/delete them in host-activate/host-deactivate? requires

	-- extra API in openmetrics.lua tho

	for _, session in pairs(sessions) do

		local is_inbound = string.sub(session.type, 4, 5) == "in"

		local metric_family = is_inbound and measure_connections_inbound or measure_connections_outbound

		local host = is_inbound and session.to_host or session.from_host or ""

		local type_ = session.type or "other"

		-- we want to expose both v4 and v6 counters in all cases to make

		-- queries smoother

		local is_ipv6 = session.ip and session.ip:match(":") and 1 or 0

		local is_ipv4 = 1 - is_ipv6

		metric_family:with_labels(host, type_, "ipv4"):add(is_ipv4)

		metric_family:with_labels(host, type_, "ipv6"):add(is_ipv6)

	end

end);

--- Handle stanzas to remote domains

local bouncy_stanzas = { message = true, presence = true, iq = true };

local function bounce_sendq(session, reason)

	local sendq = session.sendq;

	if not sendq then return; end

	session.log("info", "Sending error replies for %d queued stanzas because of failed outgoing connection to %s", #sendq, session.to_host);

	local dummy = {

		type = "s2sin";

		send = function ()

			(session.log or log)("error", "Replying to to an s2s error reply, please report this! Traceback: %s", traceback());

		end;

		dummy = true;

		close = function ()

			(session.log or log)("error", "Attempting to close the dummy origin of s2s error replies, please report this! Traceback: %s", traceback());

		end;

	};

	-- FIXME Allow for more specific error conditions

	-- TODO use util.error ?

	local error_type = "cancel";

	local condition = "remote-server-not-found";

	local reason_text;

	if session.had_stream then -- set when a stream is opened by the remote

		error_type, condition = "wait", "remote-server-timeout";

	end

	if errors.is_err(reason) then

		error_type, condition, reason_text = reason.type, reason.condition, reason.text;

	elseif type(reason) == "string" then

		reason_text = reason;

	end

	for i, data in ipairs(sendq) do

		local reply = data[2];

		if reply and not(reply.attr.xmlns) and bouncy_stanzas[reply.name] then

			reply.attr.type = "error";

			reply:tag("error", {type = error_type, by = session.from_host})

				:tag(condition, {xmlns = "urn:ietf:params:xml:ns:xmpp-stanzas"}):up();

			if reason_text then

				reply:tag("text", {xmlns = "urn:ietf:params:xml:ns:xmpp-stanzas"})

					:text("Server-to-server connection failed: "..reason_text):up();

			end

			core_process_stanza(dummy, reply);

		end

		sendq[i] = nil;

	end

	session.sendq = nil;

end

-- Handles stanzas to existing s2s sessions

function route_to_existing_session(event)

	local from_host, to_host, stanza = event.from_host, event.to_host, event.stanza;

	if not hosts[from_host] then

		log("warn", "Attempt to send stanza from %s - a host we don't serve", from_host);

		return false;

	end

	if hosts[to_host] then

		log("warn", "Attempt to route stanza to a remote %s - a host we do serve?!", from_host);

		return false;

	end

	local host = hosts[from_host].s2sout[to_host];

	if not host then return end

	-- We have a connection to this host already

	if host.type == "s2sout_unauthed" and (stanza.name ~= "db:verify" or not host.dialback_key) then

		(host.log or log)("debug", "trying to send over unauthed s2sout to "..to_host);

		-- Queue stanza until we are able to send it

		local queued_item = {

			tostring(stanza),

			stanza.attr.type ~= "error" and stanza.attr.type ~= "result" and st.reply(stanza);

		};

		if host.sendq then

			t_insert(host.sendq, queued_item);

		else

			-- luacheck: ignore 122

			host.sendq = { queued_item };

		end

		host.log("debug", "stanza [%s] queued ", stanza.name);

		return true;

	elseif host.type == "local" or host.type == "component" then

		log("error", "Trying to send a stanza to ourselves??")

		log("error", "Traceback: %s", traceback());

		log("error", "Stanza: %s", stanza);

		return false;

	else

		if host.sends2s(stanza) then

			return true;

		end

	end

end

-- Create a new outgoing session for a stanza

function route_to_new_session(event)

	local from_host, to_host, stanza = event.from_host, event.to_host, event.stanza;

	log("debug", "opening a new outgoing connection for this stanza");

	local host_session = s2s_new_outgoing(from_host, to_host);

	host_session.version = 1;

	-- Store in buffer

	host_session.bounce_sendq = bounce_sendq;

	host_session.sendq = { {tostring(stanza), stanza.attr.type ~= "error" and stanza.attr.type ~= "result" and st.reply(stanza)} };

	log("debug", "stanza [%s] queued until connection complete", stanza.name);

	connect(service.new(to_host, "xmpp-server", "tcp", s2s_service_options), listener, nil, { session = host_session });

	m_initiated_connections:with_labels(from_host):add(1)

	return true;

end

local function keepalive(event)

	local session = event.session;

	if not session.notopen then

		return event.session.sends2s(' ');

	end

end

module:hook("s2s-read-timeout", keepalive, -1);

function module.add_host(module)

	if module:get_option_boolean("disallow_s2s", false) then

		module:log("warn", "The 'disallow_s2s' config option is deprecated, please see https://prosody.im/doc/s2s#disabling");

		return nil, "This host has disallow_s2s set";

	end

	module:hook("route/remote", route_to_existing_session, -1);

	module:hook("route/remote", route_to_new_session, -10);

	module:hook("s2s-authenticated", make_authenticated, -1);

	module:hook("s2s-read-timeout", keepalive, -1);

	module:hook_stanza("http://etherx.jabber.org/streams", "features", function (session, stanza) -- luacheck: ignore 212/stanza

		if session.type == "s2sout" then

			-- Stream is authenticated and we are seem to be done with feature negotiation,

			-- so the stream is ready for stanzas.  RFC 6120 Section 4.3

			mark_connected(session);

			return true;

		elseif require_encryption and not session.secure then

			session.log("warn", "Encrypted server-to-server communication is required but was not offered by %s", session.to_host);

			session:close({

					condition = "policy-violation",

					text = "Encrypted server-to-server communication is required but was not offered",

				}, nil, "Could not establish encrypted connection to remote server");

			return true;

		elseif not session.dialback_verifying then

			session.log("warn", "No SASL EXTERNAL offer and Dialback doesn't seem to be enabled, giving up");

			session:close({

					condition = "unsupported-feature",

					text = "No viable authentication method offered",

				}, nil, "No viable authentication method offered by remote server");

			return true;

		end

	end, -1);

end

-- Stream is authorised, and ready for normal stanzas

function mark_connected(session)

	local sendq = session.sendq;

	local from, to = session.from_host, session.to_host;

	session.log("info", "%s s2s connection %s->%s complete", session.direction:gsub("^.", string.upper), from, to);

	local event_data = { session = session };

	if session.type == "s2sout" then

		module:fire_event("s2sout-established", event_data);

		module:context(from):fire_event("s2sout-established", event_data);

		if session.incoming then

			session.send = function(stanza)

				return module:context(from):fire_event("route/remote", { from_host = from, to_host = to, stanza = stanza });

			end;

		end

	else

		if session.outgoing and not hosts[to].s2sout[from] then

			session.log("debug", "Setting up to handle route from %s to %s", to, from);

			hosts[to].s2sout[from] = session; -- luacheck: ignore 122

		end

		local host_session = hosts[to];

		session.send = function(stanza)

			return host_session.events.fire_event("route/remote", { from_host = to, to_host = from, stanza = stanza });

		end;

		module:fire_event("s2sin-established", event_data);

		module:context(to):fire_event("s2sin-established", event_data);

	end

	if session.direction == "outgoing" then

		if sendq then

			session.log("debug", "sending %d queued stanzas across new outgoing connection to %s", #sendq, session.to_host);

			local send = session.sends2s;

			for i, data in ipairs(sendq) do

				send(data[1]);

				sendq[i] = nil;

			end

			session.sendq = nil;

		end

	end

	if session.connect_timeout then

		stop_timer(session.connect_timeout);

		session.connect_timeout = nil;

	end

end

function make_authenticated(event)

	local session, host = event.session, event.host;

	if not session.secure then

		if require_encryption or (secure_auth and not(insecure_domains[host])) or secure_domains[host] then

			session:close({

				condition = "policy-violation",

				text = "Encrypted server-to-server communication is required but was not "

				       ..((session.direction == "outgoing" and "offered") or "used")

			}, nil, "Could not establish encrypted connection to remote server");

		end

	end

	if hosts[host] then

		session:close({ condition = "undefined-condition", text = "Attempt to authenticate as a host we serve" });

	end

	if session.type == "s2sout_unauthed" then

		session.type = "s2sout";

	elseif session.type == "s2sin_unauthed" then

		session.type = "s2sin";

	elseif session.type ~= "s2sin" and session.type ~= "s2sout" then

		return false;

	end

	if session.incoming and host then

		if not session.hosts[host] then session.hosts[host] = {}; end

		session.hosts[host].authed = true;

	end

	session.log("debug", "connection %s->%s is now authenticated for %s", session.from_host, session.to_host, host);

	local local_host = session.direction == "incoming" and session.to_host or session.from_host

	m_authn_connections:with_labels(local_host, session.direction, event.mechanism or "other"):add(1)

	if (session.type == "s2sout" and session.external_auth ~= "succeeded") or session.type == "s2sin" then

		-- Stream either used dialback for authentication or is an incoming stream.

		mark_connected(session);

	end

	return true;

end

--- Helper to check that a session peer's certificate is valid

local function check_cert_status(session)

	local host = session.direction == "outgoing" and session.to_host or session.from_host

	local conn = session.conn:socket()

	local cert