prosody-hg: plugins/mod_limits.lua annotate

annotate plugins/mod_limits.lua @ 14179:25beb66fab38 13.0

util.crypto: Use post-Lua 5.1 buffer API Tha Lua 5.1 buffer API was frustrating to work with. luaL_prepbuffer() only allocates LUAL_BUFFERSIZE - there is no way to request a specific size. LUAL_BUFFERSIZE is set to BUFSIZ by default, which is generally 8192 bytes on Linux, however it may vary between platforms. The variation means this buffer could potentially overflow (small BUFSIZ with large signature). The Lua 5.2+ buffer API enables requesting a specific buffer size, so that's what we do now.

author	Matthew Wild <mwild1@gmail.com>
date	Mon, 25 May 2026 15:11:47 +0100
parents	4b8cf9420cf1
children

rev	line source
8453 6b3e7fddd723 mod_limits: Fix typo in comment Kim Alvefur <zash@zash.se> parents: 8269 diff changeset	1 -- Because we deal with pre-authed sessions and streams we can't be host-specific
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	2 module:set_global();
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	3
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	4 local it = require "prosody.util.iterators";
12977 74b9e05af71e plugins: Prefix module imports with prosody namespace Kim Alvefur <zash@zash.se> parents: 11735 diff changeset	5 local filters = require "prosody.util.filters";
74b9e05af71e plugins: Prefix module imports with prosody namespace Kim Alvefur <zash@zash.se> parents: 11735 diff changeset	6 local throttle = require "prosody.util.throttle";
74b9e05af71e plugins: Prefix module imports with prosody namespace Kim Alvefur <zash@zash.se> parents: 11735 diff changeset	7 local timer = require "prosody.util.timer";
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	8
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	9 local pton = require "prosody.util.net".pton;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	10
8269 25237002aba4 mod_limits: Handle fractional outstanding balance values (caused by e3f7b6fa46ba) Matthew Wild <mwild1@gmail.com> parents: 8256 diff changeset	11 local ceil = math.ceil;
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	12
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	13 local limits_cfg = module:get_option("limits", {});
13209 c8d949cf6b09 plugins: Switch to :get_option_period() for time range options Kim Alvefur <zash@zash.se> parents: 12977 diff changeset	14 local limits_resolution = module:get_option_period("limits_resolution", 1);
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	15
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	16 local default_bytes_per_second = 3000;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	17 local default_burst = 2;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	18
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	19 local rate_units = { b = 1, k = 3, m = 6, g = 9, t = 12 } -- Plan for the future.
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	20 local function parse_rate(rate, sess_type)
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	21 local quantity, unit, exp;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	22 if rate then
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	23 quantity, unit = rate:match("^(%d+) ?([^/]+)/s$");
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	24 exp = quantity and rate_units[unit:sub(1,1):lower()];
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	25 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	26 if not exp then
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	27 module:log("error", "Error parsing rate for %s: %q, using default rate (%d bytes/s)", sess_type, rate, default_bytes_per_second);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	28 return default_bytes_per_second;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	29 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	30 return quantity*(10^exp);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	31 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	32
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	33 local function parse_burst(burst, sess_type)
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	34 if type(burst) == "string" then
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	35 burst = burst:match("^(%d+) ?s$");
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	36 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	37 local n_burst = tonumber(burst);
11550 929de6ade6b6 mod_limits: Don't emit error when no burst period is configured Matthew Wild <mwild1@gmail.com> parents: 8803 diff changeset	38 if burst and not n_burst then
10111 0f335815244f plugins: Remove tostring call from logging Kim Alvefur <zash@zash.se> parents: 10099 diff changeset	39 module:log("error", "Unable to parse burst for %s: %q, using default burst interval (%ds)", sess_type, burst, default_burst);
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	40 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	41 return n_burst or default_burst;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	42 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	43
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	44 -- Process config option into limits table:
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	45 -- limits = { c2s = { bytes_per_second = X, burst_seconds = Y } }
11554 db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	46 local limits = {
db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	47 c2s = {
db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	48 bytes_per_second = 10 * 1024;
db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	49 burst_seconds = 2;
db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	50 };
14024 f65302ea37b0 mod_limits: Allow configuration of general 's2s' limit, and have s2sout inherit from s2sin Matthew Wild <mwild1@gmail.com> parents: 13209 diff changeset	51 s2s = {
11554 db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	52 bytes_per_second = 30 * 1024;
db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	53 burst_seconds = 2;
db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	54 };
db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	55 };
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	56
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	57 local function get_truncated_ip(conn)
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	58 local session_ip = pton(conn:ip());
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	59 if #session_ip == 128 then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	60 -- Use /64 for IPv6
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	61 session_ip = session_ip:sub(1, 8);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	62 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	63 return session_ip;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	64 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	65
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	66 local function limit_ip_sessions(session_type, max_sessions)
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	67 -- [packed_truncated_ip] = count
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	68 local current_ips = module:shared("ips."..session_type);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	69 module:hook(session_type.."-connected", function (event)
14144 e38916e22f59 mod_limits: Only count connections with associated sessions Matthew Wild <mwild1@gmail.com> parents: 14133 diff changeset	70 if not event.session then return; end
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	71 local session_ip = get_truncated_ip(event.conn);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	72 local new_count = (current_ips[session_ip] or 0) + 1;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	73 current_ips[session_ip] = new_count;
14148 4b8cf9420cf1 mod_limits: Add debug logging for IP counting Matthew Wild <mwild1@gmail.com> parents: 14144 diff changeset	74 module:log("debug", "Connection from IP %s opened, total now %d", event.conn:ip(), new_count);
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	75 if new_count > max_sessions then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	76 module:log("warn", "Rejecting stream from %s (%d of %d current connections)", event.conn:ip(), new_count, max_sessions);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	77 event.session:close({ condition = "policy-violation", text = "too many connections" });
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	78 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	79 end);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	80
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	81 module:hook(session_type.."-closed", function (event)
14144 e38916e22f59 mod_limits: Only count connections with associated sessions Matthew Wild <mwild1@gmail.com> parents: 14133 diff changeset	82 if not event.session then return; end
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	83 local session_ip = get_truncated_ip(event.conn);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	84 local new_count = (current_ips[session_ip] or 0) - 1;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	85 if new_count < 0 then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	86 module:log("warn", "IP counting failure");
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	87 new_count = 0;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	88 end
14148 4b8cf9420cf1 mod_limits: Add debug logging for IP counting Matthew Wild <mwild1@gmail.com> parents: 14144 diff changeset	89 module:log("debug", "Connection from IP %s closed, total now %d", event.conn:ip(), new_count);
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	90 if new_count == 0 then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	91 current_ips[session_ip] = nil;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	92 else
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	93 current_ips[session_ip] = new_count;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	94 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	95 end);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	96 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	97
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	98 for sess_type, sess_limits in pairs(limits_cfg) do
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	99 limits[sess_type] = {
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	100 bytes_per_second = parse_rate(sess_limits.rate, sess_type);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	101 burst_seconds = parse_burst(sess_limits.burst, sess_type);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	102 };
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	103 if sess_limits.max_connections_per_ip then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	104 limit_ip_sessions(sess_type, sess_limits.max_connections_per_ip);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	105 end
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	106 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	107
14024 f65302ea37b0 mod_limits: Allow configuration of general 's2s' limit, and have s2sout inherit from s2sin Matthew Wild <mwild1@gmail.com> parents: 13209 diff changeset	108 if not limits.s2sin and limits.s2s then
f65302ea37b0 mod_limits: Allow configuration of general 's2s' limit, and have s2sout inherit from s2sin Matthew Wild <mwild1@gmail.com> parents: 13209 diff changeset	109 limits.s2sin = limits.s2s;
f65302ea37b0 mod_limits: Allow configuration of general 's2s' limit, and have s2sout inherit from s2sin Matthew Wild <mwild1@gmail.com> parents: 13209 diff changeset	110 end
f65302ea37b0 mod_limits: Allow configuration of general 's2s' limit, and have s2sout inherit from s2sin Matthew Wild <mwild1@gmail.com> parents: 13209 diff changeset	111 if not limits.s2sout then
f65302ea37b0 mod_limits: Allow configuration of general 's2s' limit, and have s2sout inherit from s2sin Matthew Wild <mwild1@gmail.com> parents: 13209 diff changeset	112 limits.s2sout = limits.s2s or limits.s2sin;
f65302ea37b0 mod_limits: Allow configuration of general 's2s' limit, and have s2sout inherit from s2sin Matthew Wild <mwild1@gmail.com> parents: 13209 diff changeset	113 end
f65302ea37b0 mod_limits: Allow configuration of general 's2s' limit, and have s2sout inherit from s2sin Matthew Wild <mwild1@gmail.com> parents: 13209 diff changeset	114
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	115 local default_filter_set = {};
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	116
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	117 function default_filter_set.bytes_in(bytes, session)
9941 a2f8d54dd445 mod_limits: Fix indentation Kim Alvefur <zash@zash.se> parents: 8803 diff changeset	118 local sess_throttle = session.throttle;
a2f8d54dd445 mod_limits: Fix indentation Kim Alvefur <zash@zash.se> parents: 8803 diff changeset	119 if sess_throttle then
10551 27b275633156 mod_limits: Remove an unused variable Kim Alvefur <zash@zash.se> parents: 10111 diff changeset	120 local ok, _, outstanding = sess_throttle:poll(#bytes, true);
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	121 if not ok then
9941 a2f8d54dd445 mod_limits: Fix indentation Kim Alvefur <zash@zash.se> parents: 8803 diff changeset	122 session.log("debug", "Session over rate limit (%d) with %d (by %d), pausing", sess_throttle.max, #bytes, outstanding);
8269 25237002aba4 mod_limits: Handle fractional outstanding balance values (caused by e3f7b6fa46ba) Matthew Wild <mwild1@gmail.com> parents: 8256 diff changeset	123 outstanding = ceil(outstanding);
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	124 session.conn:pause(); -- Read no more data from the connection until there is no outstanding data
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	125 local outstanding_data = bytes:sub(-outstanding);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	126 bytes = bytes:sub(1, #bytes-outstanding);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	127 timer.add_task(limits_resolution, function ()
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	128 if not session.conn then return; end
9941 a2f8d54dd445 mod_limits: Fix indentation Kim Alvefur <zash@zash.se> parents: 8803 diff changeset	129 if sess_throttle:peek(#outstanding_data) then
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	130 session.log("debug", "Resuming paused session");
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	131 session.conn:resume();
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	132 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	133 -- Handle what we can of the outstanding data
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	134 session.data(outstanding_data);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	135 end);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	136 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	137 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	138 return bytes;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	139 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	140
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	141 local type_filters = {
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	142 c2s = default_filter_set;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	143 s2sin = default_filter_set;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	144 s2sout = default_filter_set;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	145 };
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	146
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	147 local function filter_hook(session)
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	148 local session_type = session.type:match("^[^_]+");
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	149 local filter_set, opts = type_filters[session_type], limits[session_type];
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	150 if opts then
10099 7e3196e0263e mod_limits: Use rate limiting in net.server if provided Kim Alvefur <zash@zash.se> parents: 9943 diff changeset	151 if session.conn and session.conn.setlimit then
7e3196e0263e mod_limits: Use rate limiting in net.server if provided Kim Alvefur <zash@zash.se> parents: 9943 diff changeset	152 session.conn:setlimit(opts.bytes_per_second);
7e3196e0263e mod_limits: Use rate limiting in net.server if provided Kim Alvefur <zash@zash.se> parents: 9943 diff changeset	153 -- Currently no burst support
7e3196e0263e mod_limits: Use rate limiting in net.server if provided Kim Alvefur <zash@zash.se> parents: 9943 diff changeset	154 else
7e3196e0263e mod_limits: Use rate limiting in net.server if provided Kim Alvefur <zash@zash.se> parents: 9943 diff changeset	155 session.throttle = throttle.create(opts.bytes_per_second * opts.burst_seconds, opts.burst_seconds);
7e3196e0263e mod_limits: Use rate limiting in net.server if provided Kim Alvefur <zash@zash.se> parents: 9943 diff changeset	156 filters.add_filter(session, "bytes/in", filter_set.bytes_in, 1000);
7e3196e0263e mod_limits: Use rate limiting in net.server if provided Kim Alvefur <zash@zash.se> parents: 9943 diff changeset	157 end
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	158 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	159 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	160
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	161 function module.load()
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	162 filters.add_filter_hook(filter_hook);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	163 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	164
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	165 function module.unload()
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	166 filters.remove_filter_hook(filter_hook);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	167 end
9942 b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	168
11734 c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	169 function unlimited(session)
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	170 local session_type = session.type:match("^[^_]+");
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	171 if session.conn and session.conn.setlimit then
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	172 session.conn:setlimit(0);
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	173 -- Currently no burst support
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	174 else
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	175 local filter_set = type_filters[session_type];
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	176 filters.remove_filter(session, "bytes/in", filter_set.bytes_in);
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	177 session.throttle = nil;
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	178 end
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	179 end
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	180
9942 b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	181 function module.add_host(module)
b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	182 local unlimited_jids = module:get_option_inherited_set("unlimited_jids", {});
b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	183
9943 46773fe2be45 mod_limits: Fix typo Kim Alvefur <zash@zash.se> parents: 9942 diff changeset	184 if not unlimited_jids:empty() then
9942 b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	185 module:hook("authentication-success", function (event)
b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	186 local session = event.session;
b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	187 local jid = session.username .. "@" .. session.host;
b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	188 if unlimited_jids:contains(jid) then
11734 c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	189 unlimited(session);
9942 b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	190 end
b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	191 end);
11735 7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	192
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	193 module:hook("s2sout-established", function (event)
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	194 local session = event.session;
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	195 if unlimited_jids:contains(session.to_host) then
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	196 unlimited(session);
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	197 end
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	198 end);
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	199
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	200 module:hook("s2sin-established", function (event)
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	201 local session = event.session;
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	202 if session.from_host and unlimited_jids:contains(session.from_host) then
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	203 unlimited(session);
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	204 end
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	205 end);
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	206
9942 b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	207 end
b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	208 end
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	209
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	210 module:add_item("shell-command", {
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	211 section = "limits";
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	212 section_desc = "Commands to inspect rate-limiting state";
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	213 name = "connections";
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	214 desc = "View per-IP connection limit status";
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	215 args = {
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	216 { name = "ip", type = "string" };
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	217 };
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	218 handler = function(self, ip_str) -- luacheck: ignore 212/self
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	219 local check_ip = pton(ip_str);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	220 if not check_ip then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	221 return false, "Unable to parse IP address: "..ip_str;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	222 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	223 if #check_ip == 128 then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	224 check_ip = check_ip:sub(1, 8);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	225 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	226
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	227 local found, any_limits = 0;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	228
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	229 for sess_type, sess_limits in it.sorted_pairs(limits_cfg) do
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	230 if sess_limits.max_connections_per_ip then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	231 any_limits = true;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	232 local current_ips = module:shared("ips."..sess_type);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	233 local count = current_ips[check_ip] or 0;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	234 self.session.print(("%s: %d (limit %d)"):format(sess_type, count or 0, sess_limits.max_connections_per_ip));
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	235 found = found + count;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	236 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	237 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	238
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	239 if not any_limits then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	240 return false, "No per-IP limits are configured";
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	241 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	242
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	243 return true, ("Total of %d tracked connections with this IP"):format(found);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	244 end;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	245 });
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	246
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	247

Mercurial > prosody-hg

annotate plugins/mod_limits.lua @ 14179:25beb66fab38 13.0