Mercurial > prosody-hg

changeset 14161:9728c3fabeef

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Merge 13.0->trunk
author Matthew Wild <mwild1@gmail.com>
date Wed, 29 Apr 2026 17:12:59 +0100
parents 320e1d49aa9e (current diff) e3ddbf7f2d3f (diff)
children 78c89ff001bf
files core/moduleapi.lua net/server_epoll.lua plugins/mod_c2s.lua plugins/mod_s2s.lua
diffstat 3 files changed, 20 insertions(+), 12 deletions(-) [+]
line wrap: on
line diff
--- a/.hgtags	Tue Apr 21 16:23:34 2026 +0100
+++ b/.hgtags	Wed Apr 29 17:12:59 2026 +0100
@@ -93,3 +93,4 @@
 0dd82a8f19131ed6615cd5287be422e6eb0742bb 13.0.2
 f65302ea37b071c3c4bf5fa31f3e4ffd4b4922d1 13.0.3
 f463e101fbd9eec8a547ac2aaf299b650694dbfa 13.0.4
+2a66728d9e298653f9ab30e5874b7ba15a53ace7 13.0.5
--- a/plugins/mod_limits.lua	Tue Apr 21 16:23:34 2026 +0100
+++ b/plugins/mod_limits.lua	Wed Apr 29 17:12:59 2026 +0100
@@ -71,6 +71,7 @@
 		local session_ip = get_truncated_ip(event.conn);
 		local new_count = (current_ips[session_ip] or 0) + 1;
 		current_ips[session_ip] = new_count;
+		module:log("debug", "Connection from IP %s opened, total now %d", event.conn:ip(), new_count);
 		if new_count > max_sessions then
 			module:log("warn", "Rejecting stream from %s (%d of %d current connections)", event.conn:ip(), new_count, max_sessions);
 			event.session:close({ condition = "policy-violation", text = "too many connections" });
@@ -85,6 +86,7 @@
 			module:log("warn", "IP counting failure");
 			new_count = 0;
 		end
+		module:log("debug", "Connection from IP %s closed, total now %d", event.conn:ip(), new_count);
 		if new_count == 0 then
 			current_ips[session_ip] = nil;
 		else
--- a/plugins/mod_proxy65.lua	Tue Apr 21 16:23:34 2026 +0100
+++ b/plugins/mod_proxy65.lua	Wed Apr 29 17:12:59 2026 +0100
@@ -60,8 +60,6 @@
 				transfers[sha].initiator = conn;
 				session.sha = sha;
 				module:log("debug", "SOCKS5 initiator connected for session %s", sha);
-				server.link(conn, transfers[sha].target, max_buffer_size);
-				server.link(transfers[sha].target, conn, max_buffer_size);
 			end
 		else -- error, unexpected input
 			conn:write("\5\1\0\3\0\0\0"); -- VER, REP, RSV, ATYP, BND.ADDR (sha), BND.PORT (2 Byte)
@@ -105,25 +103,24 @@
 	module:add_identity("proxy", "bytestreams", name);
 	module:add_feature("http://jabber.org/protocol/bytestreams");
 
-	module:hook("iq-get/host/http://jabber.org/protocol/bytestreams:query", function(event)
-		local origin, stanza = event.origin, event.stanza;
-
-		-- check ACL
-		-- using 'while' instead of 'if' so we can break out of it
-		local allow;
+	local function is_permitted(origin, stanza)
 		if proxy_acl and #proxy_acl > 0 then
 			local jid = stanza.attr.from;
 			for _, acl in ipairs(proxy_acl) do
 				if jid_compare(jid, acl) then
-					allow = true;
-					break;
+					return true;
 				end
 			end
 		elseif proxy_open_access or origin.type == "c2s" then
-			allow = true;
+			return true;
 		end
+		return false;
+	end
 
-		if not allow then
+	module:hook("iq-get/host/http://jabber.org/protocol/bytestreams:query", function(event)
+		local origin, stanza = event.origin, event.stanza;
+
+		if not is_permitted(origin, stanza) then
 			module:log("warn", "Denying use of proxy for %s", stanza.attr.from);
 			origin.send(st.error_reply(stanza, "auth", "forbidden"));
 			return true;
@@ -145,6 +142,12 @@
 	module:hook("iq-set/host/http://jabber.org/protocol/bytestreams:query", function(event)
 		local origin, stanza = event.origin, event.stanza;
 
+		if not is_permitted(origin, stanza) then
+			module:log("warn", "Denying use of proxy for %s", stanza.attr.from);
+			origin.send(st.error_reply(stanza, "auth", "forbidden"));
+			return true;
+		end
+
 		local query = stanza.tags[1];
 		local sid = query.attr.sid;
 		local from = stanza.attr.from;
@@ -166,6 +169,8 @@
 			else -- if transfers[sha].initiator ~= nil and transfers[sha].target ~= nil then
 				module:log("debug", "Transfer activated (%s)", info);
 				transfers[sha].activated = true;
+				server.link(transfers[sha].initiator, transfers[sha].target, max_buffer_size);
+				server.link(transfers[sha].target, transfers[sha].initiator, max_buffer_size);
 				transfers[sha].target:resume();
 				transfers[sha].initiator:resume();
 				origin.send(st.reply(stanza));