--- a/plugins/mod_admin_shell.lua Sat Nov 06 18:45:44 2021 +0100
+++ b/plugins/mod_admin_shell.lua Wed Nov 10 17:59:35 2021 +0100
@@ -42,6 +42,10 @@
local format_number = require "util.human.units".format;
local format_table = require "util.human.io".table;
+local function capitalize(s)
+ return (s:gsub("^%a", string.upper):gsub("_", " "));
+end
+
local commands = module:shared("commands")
local def_env = module:shared("env");
local default_env_mt = { __index = def_env };
@@ -205,15 +209,13 @@
print [[config - Reloading the configuration, etc.]]
print [[console - Help regarding the console itself]]
elseif section == "c2s" then
- print [[c2s:show(jid) - Show all client sessions with the specified JID (or all if no JID given)]]
- print [[c2s:show_insecure() - Show all unencrypted client connections]]
- print [[c2s:show_secure() - Show all encrypted client connections]]
- print [[c2s:show_tls() - Show TLS cipher info for encrypted sessions]]
+ print [[c2s:show(jid, columns) - Show all client sessions with the specified JID (or all if no JID given)]]
+ print [[c2s:show_tls(jid) - Show TLS cipher info for encrypted sessions]]
print [[c2s:count() - Count sessions without listing them]]
print [[c2s:close(jid) - Close all sessions for the specified JID]]
print [[c2s:closeall() - Close all active c2s connections ]]
elseif section == "s2s" then
- print [[s2s:show(domain) - Show all s2s connections for the given domain (or all if no domain given)]]
+ print [[s2s:show(domain, columns) - Show all s2s connections for the given domain (or all if no domain given)]]
print [[s2s:show_tls(domain) - Show TLS cipher info for encrypted sessions]]
print [[s2s:close(from, to) - Close a connection from one domain to another]]
print [[s2s:closeall(host) - Close all the incoming/outgoing s2s sessions to specified host]]
@@ -582,101 +584,6 @@
return ok, (ok and "Config reloaded (you may need to reload modules to take effect)") or tostring(err);
end
-local function common_info(session, line)
- if session.id then
- line[#line+1] = "["..session.id.."]"
- else
- line[#line+1] = "["..session.type..(tostring(session):match("%x*$")).."]"
- end
-end
-
-local function session_flags(session, line)
- line = line or {};
- common_info(session, line);
- if session.type == "c2s" then
- local status, priority = "unavailable", tostring(session.priority or "-");
- if session.presence then
- status = session.presence:get_child_text("show") or "available";
- end
- line[#line+1] = status.."("..priority..")";
- end
- if session.cert_identity_status == "valid" then
- line[#line+1] = "(authenticated)";
- end
- if session.dialback_key then
- line[#line+1] = "(dialback)";
- end
- if session.external_auth then
- line[#line+1] = "(SASL)";
- end
- if session.secure then
- line[#line+1] = "(encrypted)";
- end
- if session.compressed then
- line[#line+1] = "(compressed)";
- end
- if session.smacks then
- line[#line+1] = "(sm)";
- end
- if session.state then
- if type(session.csi_counter) == "number" then
- line[#line+1] = string.format("(csi:%s queue #%d)", session.state, session.csi_counter);
- else
- line[#line+1] = string.format("(csi:%s)", session.state);
- end
- end
- if session.ip and session.ip:match(":") then
- line[#line+1] = "(IPv6)";
- end
- if session.remote then
- line[#line+1] = "(remote)";
- end
- if session.incoming and session.outgoing then
- line[#line+1] = "(bidi)";
- elseif session.is_bidi or session.bidi_session then
- line[#line+1] = "(bidi)";
- end
- if session.bosh_version then
- line[#line+1] = "(bosh)";
- end
- if session.websocket_request then
- line[#line+1] = "(websocket)";
- end
- return table.concat(line, " ");
-end
-
-local function tls_info(session, line)
- line = line or {};
- common_info(session, line);
- if session.secure then
- local sock = session.conn and session.conn.socket and session.conn:socket();
- if sock then
- local info = sock.info and sock:info();
- if info then
- line[#line+1] = ("(%s with %s)"):format(info.protocol, info.cipher);
- else
- -- TLS session might not be ready yet
- line[#line+1] = "(cipher info unavailable)";
- end
- if sock.getsniname then
- local name = sock:getsniname();
- if name then
- line[#line+1] = ("(SNI:%q)"):format(name);
- end
- end
- if sock.getalpn then
- local proto = sock:getalpn();
- if proto then
- line[#line+1] = ("(ALPN:%q)"):format(proto);
- end
- end
- end
- else
- line[#line+1] = "(insecure)";
- end
- return table.concat(line, " ");
-end
-
def_env.c2s = {};
local function get_jid(session)
@@ -700,16 +607,16 @@
return c2s;
end
+local function _sort_by_jid(a, b)
+ if a.host == b.host then
+ if a.username == b.username then return (a.resource or "") > (b.resource or ""); end
+ return (a.username or "") > (b.username or "");
+ end
+ return _sort_hosts(a.host or "", b.host or "");
+end
+
local function show_c2s(callback)
- get_c2s():sort(function(a, b)
- if a.host == b.host then
- if a.username == b.username then
- return (a.resource or "") > (b.resource or "");
- end
- return (a.username or "") > (b.username or "");
- end
- return _sort_hosts(a.host or "", b.host or "");
- end):map(function (session)
+ get_c2s():sort(_sort_by_jid):map(function (session)
callback(get_jid(session), session)
end);
end
@@ -719,47 +626,223 @@
return true, "Total: ".. #c2s .." clients";
end
-function def_env.c2s:show(match_jid, annotate)
- local print, count = self.session.print, 0;
- annotate = annotate or session_flags;
- local curr_host = false;
- show_c2s(function (jid, session)
- if curr_host ~= session.host then
- curr_host = session.host;
- print(curr_host or "(not connected to any host yet)");
- end
- if (not match_jid) or jid:match(match_jid) then
- count = count + 1;
- print(annotate(session, { " ", jid }));
- end
- end);
- return true, "Total: "..count.." clients";
+local function get_s2s_hosts(session) --> local,remote
+ if session.direction == "outgoing" then
+ return session.host or session.from_host, session.to_host;
+ elseif session.direction == "incoming" then
+ return session.host or session.to_host, session.from_host;
+ end
end
-function def_env.c2s:show_insecure(match_jid)
- local print, count = self.session.print, 0;
- show_c2s(function (jid, session)
- if ((not match_jid) or jid:match(match_jid)) and not session.secure then
- count = count + 1;
- print(jid);
+local available_columns = {
+ jid = {
+ title = "JID";
+ width = 32;
+ key = "full_jid";
+ mapper = function(full_jid, session) return full_jid or get_jid(session) end;
+ };
+ host = {
+ title = "Host";
+ key = "host";
+ width = 22;
+ mapper = function(host, session)
+ if host ~= "" then return host; end
+ return get_s2s_hosts(session) or "?";
+ end;
+ };
+ remote = {
+ title = "Remote";
+ width = 22;
+ mapper = function(_, session)
+ return select(2, get_s2s_hosts(session));
+ end;
+ };
+ dir = {
+ title = "Dir";
+ width = 3;
+ key = "direction";
+ mapper = function (dir)
+ if dir == "outgoing" then return "-->"; end
+ if dir == "incoming" then return "<--"; end
+ return ""
+ end;
+ };
+ id = { title = "Session ID"; width = 20; key = "id" };
+ type = { title = "Type"; width = #"c2s_unauthed"; key = "type" };
+ method = {
+ title = "Method";
+ width = 10;
+ mapper = function(_, session)
+ if session.bosh_version then
+ return "BOSH";
+ elseif session.websocket_request then
+ return "WebSocket";
+ else
+ return "TCP";
+ end
+ end;
+ };
+ ipv = {
+ title = "IPv";
+ width = 4;
+ key = "ip";
+ mapper = function(ip) return ip:find(":") and "IPv6" or "IPv4"; end;
+ };
+ ip = { title = "IP address"; width = 40; key = "ip" };
+ status = {
+ title = "Status";
+ width = 11;
+ key = "presence";
+ mapper = function(p)
+ if not p or p == "" then return "unavailable"; end
+ return p:get_child_text("show") or "available";
+ end;
+ };
+ secure = {
+ title = "Security";
+ key = "conn";
+ width = 11;
+ mapper = function(conn, session)
+ if not session.secure then return "insecure"; end
+ if conn == "" or not conn:ssl() then return "secure" end
+ local sock = conn ~= "" and conn:socket();
+ if not sock then return "unknown TLS"; end
+ local tls_info = sock.info and sock:info();
+ return tls_info and tls_info.protocol or "unknown TLS";
+ end;
+ };
+ encryption = {
+ title = "Encryption";
+ width = 30;
+ key = "conn";
+ mapper = function(conn)
+ local sock = conn ~= "" and conn:socket();
+ local info = sock and sock.info and sock:info();
+ if info then return info.cipher end
+ return ""
+ end;
+ };
+ cert = {
+ title = "Certificate";
+ key = "cert_identity_status";
+ mapper = function(cert_status, session)
+ if cert_status ~= "" then return capitalize(cert_status); end
+ if session.cert_chain_status == "Invalid" then
+ local cert_errors = set.new(session.cert_chain_errors[1]);
+ if cert_errors:contains("certificate has expired") then
+ return "Expired";
+ elseif cert_errors:contains("self signed certificate") then
+ return "Self-signed";
+ end
+ return "Untrusted";
+ elseif session.cert_identity_status == "invalid" then
+ return "Mismatched";
+ end
+ return "Not validated";
+ end;
+ };
+ sni = {
+ title = "SNI";
+ width = 22;
+ mapper = function(_, session)
+ if not session.conn then return "" end
+ local sock = session.conn:socket();
+ return sock and sock.getsniname and sock:getsniname() or "";
+ end;
+ };
+ alpn = {
+ title = "ALPN";
+ width = 11;
+ mapper = function(_, session)
+ if not session.conn then return "" end
+ local sock = session.conn:socket();
+ return sock and sock.getalpn and sock:getalpn() or "";
+ end;
+ };
+ smacks = {
+ title = "SM";
+ key = "smacks";
+ width = 11;
+ mapper = function(smacks_xmlns, session)
+ if smacks_xmlns == "" then return "no"; end
+ if session.hibernating then return "hibernating"; end
+ return "yes";
+ end;
+ };
+ smacks_queue = {
+ title = "SM Queue";
+ key = "outgoing_stanza_queue";
+ width = 8;
+ align = "right";
+ mapper = function (queue)
+ return tostring(#queue);
end
- end);
- return true, "Total: "..count.." insecure client connections";
+ };
+ csi = {
+ title = "CSI State";
+ key = "state";
+ -- TODO include counter
+ };
+ s2s_sasl = {
+ title = "SASL";
+ key = "external_auth";
+ width = 10;
+ mapper = capitalize
+ };
+ dialback = {
+ title = "Dialback";
+ key = "dialback_key";
+ width = 13;
+ mapper = function (dialback_key, session)
+ if dialback_key == "" then
+ if session.type == "s2sin" or session.type == "s2sout" then
+ return "Not used";
+ end
+ return "Not initiated";
+ elseif session.type == "s2sin_unauthed" or session.type == "s2sout_unauthed" then
+ return "Initiated";
+ else
+ return "Completed";
+ end
+ end
+ };
+};
+
+local function get_colspec(colspec, default)
+ local columns = {};
+ for i, col in pairs(colspec or default) do
+ if type(col) == "string" then
+ columns[i] = available_columns[col] or { title = capitalize(col); width = 20; key = col };
+ elseif type(col) ~= "table" then
+ return false, ("argument %d: expected string|table but got %s"):format(i, type(col));
+ else
+ columns[i] = col;
+ end
+ end
+
+ return columns;
end
-function def_env.c2s:show_secure(match_jid)
- local print, count = self.session.print, 0;
- show_c2s(function (jid, session)
- if ((not match_jid) or jid:match(match_jid)) and session.secure then
- count = count + 1;
- print(jid);
- end
- end);
- return true, "Total: "..count.." secure client connections";
+function def_env.c2s:show(match_jid, colspec)
+ local print = self.session.print;
+ local columns = get_colspec(colspec, { "id"; "jid"; "ipv"; "status"; "secure"; "smacks"; "csi" });
+ local row = format_table(columns, 120);
+
+ local function match(session)
+ local jid = get_jid(session)
+ return (not match_jid) or jid:match(match_jid)
+ end
+
+ print(row());
+
+ for _, session in ipairs(get_c2s():filter(match):sort(_sort_by_jid)) do
+ print(row(session));
+ end
+ return true;
end
function def_env.c2s:show_tls(match_jid)
- return self:show(match_jid, tls_info);
+ return self:show(match_jid, { "jid"; "id"; "secure"; "encryption" });
end
local function build_reason(text, condition)
@@ -794,71 +877,35 @@
def_env.s2s = {};
-function def_env.s2s:show(match_jid, annotate)
- local print = self.session.print;
- annotate = annotate or session_flags;
-
- local count_in, count_out = 0,0;
- local s2s_list = { };
-
- local s2s_sessions = module:shared"/*/s2s/sessions";
- for _, session in pairs(s2s_sessions) do
- local remotehost, localhost, direction;
- if session.direction == "outgoing" then
- direction = "->";
- count_out = count_out + 1;
- remotehost, localhost = session.to_host or "?", session.from_host or "?";
- else
- direction = "<-";
- count_in = count_in + 1;
- remotehost, localhost = session.from_host or "?", session.to_host or "?";
- end
- local sess_lines = { l = localhost, r = remotehost,
- annotate(session, { "", direction, remotehost or "?" })};
+local function _sort_s2s(a, b)
+ local a_local, a_remote = get_s2s_hosts(a);
+ local b_local, b_remote = get_s2s_hosts(b);
+ if (a_local or "") == (b_local or "") then return _sort_hosts(a_remote or "", b_remote or ""); end
+ return _sort_hosts(a_local or "", b_local or "");
+end
- if (not match_jid) or remotehost:match(match_jid) or localhost:match(match_jid) then
- table.insert(s2s_list, sess_lines);
- -- luacheck: ignore 421/print
- local print = function (s) table.insert(sess_lines, " "..s); end
- if session.sendq then
- print("There are "..#session.sendq.." queued outgoing stanzas for this connection");
- end
- if session.type == "s2sout_unauthed" then
- if session.notopen then
- print("The <stream> has not yet been opened");
- elseif not session.dialback_key then
- print("Dialback has not been initiated yet");
- elseif session.dialback_key then
- print("Dialback has been requested, but no result received");
- end
- end
- if session.type == "s2sin_unauthed" then
- print("Connection not yet authenticated");
- elseif session.type == "s2sin" then
- for name in pairs(session.hosts) do
- if name ~= session.from_host then
- print("also hosts "..tostring(name));
- end
- end
- end
- end
+function def_env.s2s:show(match_jid, colspec)
+ local print = self.session.print;
+ local columns = get_colspec(colspec, { "id"; "host"; "dir"; "remote"; "ipv"; "secure"; "s2s_sasl"; "dialback" });
+ local row = format_table(columns, 132);
+
+ local function match(session)
+ local host, remote = get_s2s_hosts(session);
+ return not match_jid or (host or ""):match(match_jid) or (remote or ""):match(match_jid);
end
- -- Sort by local host, then remote host
- table.sort(s2s_list, function(a,b)
- if a.l == b.l then return _sort_hosts(a.r, b.r); end
- return _sort_hosts(a.l, b.l);
- end);
- local lasthost;
- for _, sess_lines in ipairs(s2s_list) do
- if sess_lines.l ~= lasthost then print(sess_lines.l); lasthost=sess_lines.l end
- for _, line in ipairs(sess_lines) do print(line); end
+ local s2s_sessions = array(iterators.values(module:shared"/*/s2s/sessions")):filter(match):sort(_sort_s2s);
+
+ print(row());
+
+ for _, session in ipairs(s2s_sessions) do
+ print(row(session));
end
- return true, "Total: "..count_out.." outgoing, "..count_in.." incoming connections";
+ return true; -- TODO counts
end
function def_env.s2s:show_tls(match_jid)
- return self:show(match_jid, tls_info);
+ return self:show(match_jid, { "id"; "host"; "dir"; "remote"; "secure"; "encryption"; "cert" });
end
local function print_subject(print, subject)