Mercurial > prosody-modules
annotate mod_restrict_federation/mod_restrict_federation.lua @ 6403:13c61a068c71
mod_pubsub_serverinfo: Include hostname in default pubsub node name
This change ensures that every host publishes to a unique node by default,
which is important when publishing info about multiple hosts.
The old default node name was "serverinfo"
The new default node name is in the format "serverinfo/example.com" where
example.com is automatically replaced by the publishing host's name.
This affects existing deployments in the following ways:
- If you already configured pubsub_serverinfo_node explicitly in your config,
then nothing will change, your current configuration will still be used.
- If you did not specify it in your config (i.e. used the default) then the
module will switch to publishing to the new node. If your configuration is
correct this shouldn't be noticed, because the new node will automatically
be created and configured by the module. If you want, you can clean up the
old 'serverinfo' node using:
prosodyctl shell pubsub delete_node pubsub.example.com serverinfo
| author | Matthew Wild <mwild1@gmail.com> |
|---|---|
| date | Wed, 11 Feb 2026 09:40:30 +0000 |
| parents | ba2c344e1bdd |
| children | 981c14bb8975 |
| rev | line source |
|---|---|
|
6325
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
1 local jid_node = require "prosody.util.jid".node; |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
2 local st = require "prosody.util.stanza"; |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
3 |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
4 local get_user_role = require "prosody.core.usermanager".get_user_role; |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
5 |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
6 function check_outgoing_stanza(event) |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
7 local origin, stanza = event.origin, event.stanza; |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
8 |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
9 if not origin or origin.type ~= "c2s" then |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
10 -- We only filter user-originated traffic, so |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
11 -- pass this through. |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
12 return; |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
13 end |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
14 |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
15 if module:may("xmpp:federate", event) then |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
16 -- Pass through |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
17 return; |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
18 end |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
19 |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
20 -- Block |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
21 module:log("debug", "Forbidding outgoing %s stanza from <%s> to <%s>", stanza.name, stanza.attr.from, stanza.attr.to); |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
22 local err_reply = st.error_reply(event.stanza, "auth", "policy-violation", "Communication with remote domains is not permitted"); |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
23 origin.send(err_reply); |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
24 return true; |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
25 end |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
26 |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
27 function check_incoming_stanza(event) |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
28 local origin, stanza = event.origin, event.stanza; |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
29 |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
30 if origin.type ~= "s2sin" then |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
31 -- We only filter incoming traffic from remote domains |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
32 -- Pass through |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
33 return; |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
34 end |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
35 |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
36 local recipient_username = jid_node(stanza.attr.to); |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
37 if not recipient_username then |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
38 return; |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
39 end |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
40 |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
41 local recipient_role, role_err = get_user_role(recipient_username, module.host); |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
42 if not recipient_role then |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
43 module:log("warn", "Unable to determine recipient role: %s", role_err); |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
44 -- No idea what the role is, we'll pass it through |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
45 return; |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
46 end |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
47 |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
48 if recipient_role:may("xmpp:federate") then |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
49 -- Allowed, pass through |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
50 return; |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
51 end |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
52 |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
53 -- Block |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
54 module:log("debug", "Forbidding incoming %s stanza from <%s> to <%s>", stanza.name, stanza.attr.from, stanza.attr.to); |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
55 local err_reply = st.error_reply(event.stanza, "cancel", "service-unavailable"); |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
56 origin.send(err_reply); |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
57 return true; |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
58 end |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
59 |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
60 module:hook("message/bare", check_incoming_stanza, 500); |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
61 module:hook("message/full", check_incoming_stanza, 500); |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
62 module:hook("presence/bare", check_incoming_stanza, 500); |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
63 module:hook("presence/full", check_incoming_stanza, 500); |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
64 module:hook("iq/bare", check_incoming_stanza, 500); |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
65 module:hook("iq/full", check_incoming_stanza, 500); |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
66 |
|
ba2c344e1bdd
mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
67 module:hook("route/remote", check_outgoing_stanza, 500); |
