Mercurial > prosody-hg

comparison plugins/mod_s2s.lua @ 14104:a1fb05cbd44e 13.0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_s2s: Fully validate stream addressing NAMEPREP is not enough to validate an XMPP hostpart, missing IDNA and the IP literal special cases.
author Kim Alvefur <zash@zash.se>
date Sat, 14 Mar 2026 01:19:27 +0100
parents 04d7f2038933
children b5eeb6730721 8a4417d32b0f
comparison
equal deleted inserted replaced
14103:27e97e5b2c16 14104:a1fb05cbd44e
17 17
18 local add_task = require "prosody.util.timer".add_task; 18 local add_task = require "prosody.util.timer".add_task;
19 local stop_timer = require "prosody.util.timer".stop; 19 local stop_timer = require "prosody.util.timer".stop;
20 local st = require "prosody.util.stanza"; 20 local st = require "prosody.util.stanza";
21 local initialize_filters = require "prosody.util.filters".initialize; 21 local initialize_filters = require "prosody.util.filters".initialize;
22 local nameprep = require "prosody.util.encodings".stringprep.nameprep; 22 local prepped_split = require "prosody.util.jid".prepped_split;
23 local new_xmpp_stream = require "prosody.util.xmppstream".new; 23 local new_xmpp_stream = require "prosody.util.xmppstream".new;
24 local s2s_new_incoming = require "prosody.core.s2smanager".new_incoming; 24 local s2s_new_incoming = require "prosody.core.s2smanager".new_incoming;
25 local s2s_new_outgoing = require "prosody.core.s2smanager".new_outgoing; 25 local s2s_new_outgoing = require "prosody.core.s2smanager".new_outgoing;
26 local s2s_destroy_session = require "prosody.core.s2smanager".destroy_session; 26 local s2s_destroy_session = require "prosody.core.s2smanager".destroy_session;
27 local uuid_gen = require "prosody.util.uuid".generate; 27 local uuid_gen = require "prosody.util.uuid".generate;
488 if session.direction == "incoming" then 488 if session.direction == "incoming" then
489 -- Send a reply stream header 489 -- Send a reply stream header
490 490
491 -- Validate to/from 491 -- Validate to/from
492 local to, from = attr.to, attr.from; 492 local to, from = attr.to, attr.from;
493 if to then to = nameprep(attr.to); end 493 local function hostprep(s)
494 if from then from = nameprep(attr.from); end 494 local node, host, res = prepped_split(s);
495 if not (node or res) then return host; end
496 end
497 if to then to = hostprep(attr.to); end
498 if from then from = hostprep(attr.from); end
495 if not to and attr.to then -- COMPAT: Some servers do not reliably set 'to' (especially on stream restarts) 499 if not to and attr.to then -- COMPAT: Some servers do not reliably set 'to' (especially on stream restarts)
496 session:close({ condition = "improper-addressing", text = "Invalid 'to' address" }); 500 session:close({ condition = "improper-addressing", text = "Invalid 'to' address" });
497 return; 501 return;
498 end 502 end
499 if not from and attr.from then -- COMPAT: Some servers do not reliably set 'from' (especially on stream restarts) 503 if not from and attr.from then -- COMPAT: Some servers do not reliably set 'from' (especially on stream restarts)