prosody-hg: plugins/mod_limits.lua annotate

annotate plugins/mod_limits.lua @ 14229:ce31fdde0ad1 default tip

net.unbound: Simplify conditional

author	Kim Alvefur <zash@zash.se>
date	Sat, 13 Jun 2026 11:35:18 +0200
parents	4b8cf9420cf1
children

rev	line source
8453 6b3e7fddd723 mod_limits: Fix typo in comment Kim Alvefur <zash@zash.se> parents: 8269 diff changeset	1 -- Because we deal with pre-authed sessions and streams we can't be host-specific
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	2 module:set_global();
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	3
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	4 local it = require "prosody.util.iterators";
12977 74b9e05af71e plugins: Prefix module imports with prosody namespace Kim Alvefur <zash@zash.se> parents: 11735 diff changeset	5 local filters = require "prosody.util.filters";
74b9e05af71e plugins: Prefix module imports with prosody namespace Kim Alvefur <zash@zash.se> parents: 11735 diff changeset	6 local throttle = require "prosody.util.throttle";
74b9e05af71e plugins: Prefix module imports with prosody namespace Kim Alvefur <zash@zash.se> parents: 11735 diff changeset	7 local timer = require "prosody.util.timer";
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	8
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	9 local pton = require "prosody.util.net".pton;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	10
8269 25237002aba4 mod_limits: Handle fractional outstanding balance values (caused by e3f7b6fa46ba) Matthew Wild <mwild1@gmail.com> parents: 8256 diff changeset	11 local ceil = math.ceil;
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	12
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	13 local limits_cfg = module:get_option("limits", {});
13209 c8d949cf6b09 plugins: Switch to :get_option_period() for time range options Kim Alvefur <zash@zash.se> parents: 12977 diff changeset	14 local limits_resolution = module:get_option_period("limits_resolution", 1);
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	15
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	16 local default_bytes_per_second = 3000;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	17 local default_burst = 2;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	18
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	19 local rate_units = { b = 1, k = 3, m = 6, g = 9, t = 12 } -- Plan for the future.
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	20 local function parse_rate(rate, sess_type)
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	21 local quantity, unit, exp;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	22 if rate then
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	23 quantity, unit = rate:match("^(%d+) ?([^/]+)/s$");
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	24 exp = quantity and rate_units[unit:sub(1,1):lower()];
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	25 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	26 if not exp then
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	27 module:log("error", "Error parsing rate for %s: %q, using default rate (%d bytes/s)", sess_type, rate, default_bytes_per_second);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	28 return default_bytes_per_second;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	29 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	30 return quantity*(10^exp);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	31 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	32
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	33 local function parse_burst(burst, sess_type)
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	34 if type(burst) == "string" then
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	35 burst = burst:match("^(%d+) ?s$");
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	36 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	37 local n_burst = tonumber(burst);
11550 929de6ade6b6 mod_limits: Don't emit error when no burst period is configured Matthew Wild <mwild1@gmail.com> parents: 8803 diff changeset	38 if burst and not n_burst then
10111 0f335815244f plugins: Remove tostring call from logging Kim Alvefur <zash@zash.se> parents: 10099 diff changeset	39 module:log("error", "Unable to parse burst for %s: %q, using default burst interval (%ds)", sess_type, burst, default_burst);
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	40 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	41 return n_burst or default_burst;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	42 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	43
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	44 -- Process config option into limits table:
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	45 -- limits = { c2s = { bytes_per_second = X, burst_seconds = Y } }
11554 db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	46 local limits = {
db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	47 c2s = {
db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	48 bytes_per_second = 10 * 1024;
db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	49 burst_seconds = 2;
db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	50 };
14024 f65302ea37b0 mod_limits: Allow configuration of general 's2s' limit, and have s2sout inherit from s2sin Matthew Wild <mwild1@gmail.com> parents: 13209 diff changeset	51 s2s = {
11554 db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	52 bytes_per_second = 30 * 1024;
db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	53 burst_seconds = 2;
db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	54 };
db8e41eb6eff mod_limits: Use default limits if none configured Matthew Wild <mwild1@gmail.com> parents: 11550 diff changeset	55 };
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	56
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	57 local function get_truncated_ip(conn)
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	58 local session_ip = pton(conn:ip());
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	59 if #session_ip == 128 then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	60 -- Use /64 for IPv6
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	61 session_ip = session_ip:sub(1, 8);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	62 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	63 return session_ip;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	64 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	65
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	66 local function limit_ip_sessions(session_type, max_sessions)
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	67 -- [packed_truncated_ip] = count
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	68 local current_ips = module:shared("ips."..session_type);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	69 module:hook(session_type.."-connected", function (event)
14144 e38916e22f59 mod_limits: Only count connections with associated sessions Matthew Wild <mwild1@gmail.com> parents: 14133 diff changeset	70 if not event.session then return; end
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	71 local session_ip = get_truncated_ip(event.conn);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	72 local new_count = (current_ips[session_ip] or 0) + 1;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	73 current_ips[session_ip] = new_count;
14148 4b8cf9420cf1 mod_limits: Add debug logging for IP counting Matthew Wild <mwild1@gmail.com> parents: 14144 diff changeset	74 module:log("debug", "Connection from IP %s opened, total now %d", event.conn:ip(), new_count);
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	75 if new_count > max_sessions then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	76 module:log("warn", "Rejecting stream from %s (%d of %d current connections)", event.conn:ip(), new_count, max_sessions);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	77 event.session:close({ condition = "policy-violation", text = "too many connections" });
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	78 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	79 end);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	80
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	81 module:hook(session_type.."-closed", function (event)
14144 e38916e22f59 mod_limits: Only count connections with associated sessions Matthew Wild <mwild1@gmail.com> parents: 14133 diff changeset	82 if not event.session then return; end
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	83 local session_ip = get_truncated_ip(event.conn);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	84 local new_count = (current_ips[session_ip] or 0) - 1;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	85 if new_count < 0 then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	86 module:log("warn", "IP counting failure");
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	87 new_count = 0;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	88 end
14148 4b8cf9420cf1 mod_limits: Add debug logging for IP counting Matthew Wild <mwild1@gmail.com> parents: 14144 diff changeset	89 module:log("debug", "Connection from IP %s closed, total now %d", event.conn:ip(), new_count);
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	90 if new_count == 0 then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	91 current_ips[session_ip] = nil;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	92 else
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	93 current_ips[session_ip] = new_count;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	94 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	95 end);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	96 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	97
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	98 for sess_type, sess_limits in pairs(limits_cfg) do
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	99 limits[sess_type] = {
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	100 bytes_per_second = parse_rate(sess_limits.rate, sess_type);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	101 burst_seconds = parse_burst(sess_limits.burst, sess_type);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	102 };
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	103 if sess_limits.max_connections_per_ip then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	104 limit_ip_sessions(sess_type, sess_limits.max_connections_per_ip);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	105 end
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	106 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	107
14024 f65302ea37b0 mod_limits: Allow configuration of general 's2s' limit, and have s2sout inherit from s2sin Matthew Wild <mwild1@gmail.com> parents: 13209 diff changeset	108 if not limits.s2sin and limits.s2s then
f65302ea37b0 mod_limits: Allow configuration of general 's2s' limit, and have s2sout inherit from s2sin Matthew Wild <mwild1@gmail.com> parents: 13209 diff changeset	109 limits.s2sin = limits.s2s;
f65302ea37b0 mod_limits: Allow configuration of general 's2s' limit, and have s2sout inherit from s2sin Matthew Wild <mwild1@gmail.com> parents: 13209 diff changeset	110 end
f65302ea37b0 mod_limits: Allow configuration of general 's2s' limit, and have s2sout inherit from s2sin Matthew Wild <mwild1@gmail.com> parents: 13209 diff changeset	111 if not limits.s2sout then
f65302ea37b0 mod_limits: Allow configuration of general 's2s' limit, and have s2sout inherit from s2sin Matthew Wild <mwild1@gmail.com> parents: 13209 diff changeset	112 limits.s2sout = limits.s2s or limits.s2sin;
f65302ea37b0 mod_limits: Allow configuration of general 's2s' limit, and have s2sout inherit from s2sin Matthew Wild <mwild1@gmail.com> parents: 13209 diff changeset	113 end
f65302ea37b0 mod_limits: Allow configuration of general 's2s' limit, and have s2sout inherit from s2sin Matthew Wild <mwild1@gmail.com> parents: 13209 diff changeset	114
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	115 local default_filter_set = {};
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	116
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	117 function default_filter_set.bytes_in(bytes, session)
9941 a2f8d54dd445 mod_limits: Fix indentation Kim Alvefur <zash@zash.se> parents: 8803 diff changeset	118 local sess_throttle = session.throttle;
a2f8d54dd445 mod_limits: Fix indentation Kim Alvefur <zash@zash.se> parents: 8803 diff changeset	119 if sess_throttle then
10551 27b275633156 mod_limits: Remove an unused variable Kim Alvefur <zash@zash.se> parents: 10111 diff changeset	120 local ok, _, outstanding = sess_throttle:poll(#bytes, true);
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	121 if not ok then
9941 a2f8d54dd445 mod_limits: Fix indentation Kim Alvefur <zash@zash.se> parents: 8803 diff changeset	122 session.log("debug", "Session over rate limit (%d) with %d (by %d), pausing", sess_throttle.max, #bytes, outstanding);
8269 25237002aba4 mod_limits: Handle fractional outstanding balance values (caused by e3f7b6fa46ba) Matthew Wild <mwild1@gmail.com> parents: 8256 diff changeset	123 outstanding = ceil(outstanding);
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	124 session.conn:pause(); -- Read no more data from the connection until there is no outstanding data
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	125 local outstanding_data = bytes:sub(-outstanding);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	126 bytes = bytes:sub(1, #bytes-outstanding);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	127 timer.add_task(limits_resolution, function ()
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	128 if not session.conn then return; end
9941 a2f8d54dd445 mod_limits: Fix indentation Kim Alvefur <zash@zash.se> parents: 8803 diff changeset	129 if sess_throttle:peek(#outstanding_data) then
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	130 session.log("debug", "Resuming paused session");
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	131 session.conn:resume();
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	132 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	133 -- Handle what we can of the outstanding data
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	134 session.data(outstanding_data);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	135 end);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	136 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	137 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	138 return bytes;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	139 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	140
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	141 local type_filters = {
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	142 c2s = default_filter_set;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	143 s2sin = default_filter_set;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	144 s2sout = default_filter_set;
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	145 };
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	146
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	147 local function filter_hook(session)
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	148 local session_type = session.type:match("^[^_]+");
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	149 local filter_set, opts = type_filters[session_type], limits[session_type];
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	150 if opts then
10099 7e3196e0263e mod_limits: Use rate limiting in net.server if provided Kim Alvefur <zash@zash.se> parents: 9943 diff changeset	151 if session.conn and session.conn.setlimit then
7e3196e0263e mod_limits: Use rate limiting in net.server if provided Kim Alvefur <zash@zash.se> parents: 9943 diff changeset	152 session.conn:setlimit(opts.bytes_per_second);
7e3196e0263e mod_limits: Use rate limiting in net.server if provided Kim Alvefur <zash@zash.se> parents: 9943 diff changeset	153 -- Currently no burst support
7e3196e0263e mod_limits: Use rate limiting in net.server if provided Kim Alvefur <zash@zash.se> parents: 9943 diff changeset	154 else
7e3196e0263e mod_limits: Use rate limiting in net.server if provided Kim Alvefur <zash@zash.se> parents: 9943 diff changeset	155 session.throttle = throttle.create(opts.bytes_per_second * opts.burst_seconds, opts.burst_seconds);
7e3196e0263e mod_limits: Use rate limiting in net.server if provided Kim Alvefur <zash@zash.se> parents: 9943 diff changeset	156 filters.add_filter(session, "bytes/in", filter_set.bytes_in, 1000);
7e3196e0263e mod_limits: Use rate limiting in net.server if provided Kim Alvefur <zash@zash.se> parents: 9943 diff changeset	157 end
8256 cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	158 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	159 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	160
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	161 function module.load()
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	162 filters.add_filter_hook(filter_hook);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	163 end
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	164
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	165 function module.unload()
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	166 filters.remove_filter_hook(filter_hook);
cdffe33efae4 mod_limits: Import from prosody-modules 2c59f2f0c37d (fixes #129) Matthew Wild <mwild1@gmail.com> parents: diff changeset	167 end
9942 b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	168
11734 c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	169 function unlimited(session)
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	170 local session_type = session.type:match("^[^_]+");
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	171 if session.conn and session.conn.setlimit then
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	172 session.conn:setlimit(0);
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	173 -- Currently no burst support
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	174 else
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	175 local filter_set = type_filters[session_type];
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	176 filters.remove_filter(session, "bytes/in", filter_set.bytes_in);
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	177 session.throttle = nil;
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	178 end
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	179 end
c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	180
9942 b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	181 function module.add_host(module)
b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	182 local unlimited_jids = module:get_option_inherited_set("unlimited_jids", {});
b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	183
9943 46773fe2be45 mod_limits: Fix typo Kim Alvefur <zash@zash.se> parents: 9942 diff changeset	184 if not unlimited_jids:empty() then
9942 b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	185 module:hook("authentication-success", function (event)
b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	186 local session = event.session;
b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	187 local jid = session.username .. "@" .. session.host;
b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	188 if unlimited_jids:contains(jid) then
11734 c0fc4ca74046 mod_limits: Factor out function for disabling limits allowing use from shell Kim Alvefur <zash@zash.se> parents: 11560 diff changeset	189 unlimited(session);
9942 b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	190 end
b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	191 end);
11735 7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	192
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	193 module:hook("s2sout-established", function (event)
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	194 local session = event.session;
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	195 if unlimited_jids:contains(session.to_host) then
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	196 unlimited(session);
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	197 end
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	198 end);
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	199
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	200 module:hook("s2sin-established", function (event)
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	201 local session = event.session;
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	202 if session.from_host and unlimited_jids:contains(session.from_host) then
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	203 unlimited(session);
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	204 end
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	205 end);
7d29167bfcc3 mod_limits: Extend unlimited_jids to s2s sessions (for Ge0rG) Kim Alvefur <zash@zash.se> parents: 11734 diff changeset	206
9942 b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	207 end
b0d5f4ae92b7 mod_limits: Allow configuring a list of unrestricted JIDs (fixes #1323) Kim Alvefur <zash@zash.se> parents: 9941 diff changeset	208 end
14133 4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	209
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	210 module:add_item("shell-command", {
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	211 section = "limits";
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	212 section_desc = "Commands to inspect rate-limiting state";
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	213 name = "connections";
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	214 desc = "View per-IP connection limit status";
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	215 args = {
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	216 { name = "ip", type = "string" };
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	217 };
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	218 handler = function(self, ip_str) -- luacheck: ignore 212/self
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	219 local check_ip = pton(ip_str);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	220 if not check_ip then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	221 return false, "Unable to parse IP address: "..ip_str;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	222 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	223 if #check_ip == 128 then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	224 check_ip = check_ip:sub(1, 8);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	225 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	226
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	227 local found, any_limits = 0;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	228
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	229 for sess_type, sess_limits in it.sorted_pairs(limits_cfg) do
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	230 if sess_limits.max_connections_per_ip then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	231 any_limits = true;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	232 local current_ips = module:shared("ips."..sess_type);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	233 local count = current_ips[check_ip] or 0;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	234 self.session.print(("%s: %d (limit %d)"):format(sess_type, count or 0, sess_limits.max_connections_per_ip));
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	235 found = found + count;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	236 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	237 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	238
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	239 if not any_limits then
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	240 return false, "No per-IP limits are configured";
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	241 end
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	242
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	243 return true, ("Total of %d tracked connections with this IP"):format(found);
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	244 end;
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	245 });
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	246
4087c5b600b1 mod_limits: Support limiting total number of connections by IP address/block Matthew Wild <mwild1@gmail.com> parents: 14024 diff changeset	247

Mercurial > prosody-hg

annotate plugins/mod_limits.lua @ 14229:ce31fdde0ad1 default tip