Mercurial > prosody-modules

annotate mod_firewall/mod_firewall.lua @ 6513:5fb466693e85

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_storage_xmlarchive: Ensure list index files are removed using os.remove() on the list files leaves the new index files behind since util.datamanager does not know they are removed. Thanks Link Mauve
author Kim Alvefur <zash@zash.se>
date Tue, 07 Apr 2026 21:10:54 +0200
parents f61564e11d3b
children 0f61d13ebbde
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
1
2578
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
2 local lfs = require "lfs";
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
3 local resolve_relative_path = require "core.configmanager".resolve_relative_path;
3981
7e8f2e36419d mod_firewall: Use util.envload instead of deprecated loadstring (thanks Martin)
Kim Alvefur <zash@zash.se>
parents: 2928
diff changeset
4 local envload = require "util.envload".envload;
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
5 local logger = require "util.logger".init;
971
53e158e44a44 mod_firewall: Add rate limiting capabilities, and keep zones and throttle objects in shared tables
Matthew Wild <mwild1@gmail.com>
parents: 967
diff changeset
6 local it = require "util.iterators";
2578
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
7 local set = require "util.set";
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
8
5002
84997bc3f92e mod_firewall: Update for role-auth (backwards compatible)
Matthew Wild <mwild1@gmail.com>
parents: 4608
diff changeset
9 local have_features, features = pcall(require, "core.features");
84997bc3f92e mod_firewall: Update for role-auth (backwards compatible)
Matthew Wild <mwild1@gmail.com>
parents: 4608
diff changeset
10 features = have_features and features.available or set.new();
84997bc3f92e mod_firewall: Update for role-auth (backwards compatible)
Matthew Wild <mwild1@gmail.com>
parents: 4608
diff changeset
11
2579
5e948d1392a5 mod_firewall: Add some comments
Matthew Wild <mwild1@gmail.com>
parents: 2578
diff changeset
12 -- [definition_type] = definition_factory(param)
999
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
13 local definitions = module:shared("definitions");
2579
5e948d1392a5 mod_firewall: Add some comments
Matthew Wild <mwild1@gmail.com>
parents: 2578
diff changeset
14
5e948d1392a5 mod_firewall: Add some comments
Matthew Wild <mwild1@gmail.com>
parents: 2578
diff changeset
15 -- When a definition instance has been instantiated, it lives here
5e948d1392a5 mod_firewall: Add some comments
Matthew Wild <mwild1@gmail.com>
parents: 2578
diff changeset
16 -- [definition_type][definition_name] = definition_object
2374
d630fa0d4dba mod_firewall: Add default zone called '$local' containing all local hosts (dynamically)
Matthew Wild <mwild1@gmail.com>
parents: 2368
diff changeset
17 local active_definitions = {
d630fa0d4dba mod_firewall: Add default zone called '$local' containing all local hosts (dynamically)
Matthew Wild <mwild1@gmail.com>
parents: 2368
diff changeset
18 ZONE = {
d630fa0d4dba mod_firewall: Add default zone called '$local' containing all local hosts (dynamically)
Matthew Wild <mwild1@gmail.com>
parents: 2368
diff changeset
19 -- Default zone that includes all local hosts
d630fa0d4dba mod_firewall: Add default zone called '$local' containing all local hosts (dynamically)
Matthew Wild <mwild1@gmail.com>
parents: 2368
diff changeset
20 ["$local"] = setmetatable({}, { __index = prosody.hosts });
2527
5ff7eb601d60 mod_firewall: Code formatting
Matthew Wild <mwild1@gmail.com>
parents: 2526
diff changeset
21 };
2374
d630fa0d4dba mod_firewall: Add default zone called '$local' containing all local hosts (dynamically)
Matthew Wild <mwild1@gmail.com>
parents: 2368
diff changeset
22 };
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
23
2113
d75145297bf9 mod_firewall: Support for defining extra chains in the config file
Matthew Wild <mwild1@gmail.com>
parents: 2101
diff changeset
24 local default_chains = {
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
25 preroute = {
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
26 type = "event";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
27 priority = 0.1;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
28 "pre-message/bare", "pre-message/full", "pre-message/host";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
29 "pre-presence/bare", "pre-presence/full", "pre-presence/host";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
30 "pre-iq/bare", "pre-iq/full", "pre-iq/host";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
31 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
32 deliver = {
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
33 type = "event";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
34 priority = 0.1;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
35 "message/bare", "message/full", "message/host";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
36 "presence/bare", "presence/full", "presence/host";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
37 "iq/bare", "iq/full", "iq/host";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
38 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
39 deliver_remote = {
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
40 type = "event"; "route/remote";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
41 priority = 0.1;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
42 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
43 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
44
2113
d75145297bf9 mod_firewall: Support for defining extra chains in the config file
Matthew Wild <mwild1@gmail.com>
parents: 2101
diff changeset
45 local extra_chains = module:get_option("firewall_extra_chains", {});
d75145297bf9 mod_firewall: Support for defining extra chains in the config file
Matthew Wild <mwild1@gmail.com>
parents: 2101
diff changeset
46
d75145297bf9 mod_firewall: Support for defining extra chains in the config file
Matthew Wild <mwild1@gmail.com>
parents: 2101
diff changeset
47 local chains = {};
d75145297bf9 mod_firewall: Support for defining extra chains in the config file
Matthew Wild <mwild1@gmail.com>
parents: 2101
diff changeset
48 for k,v in pairs(default_chains) do
d75145297bf9 mod_firewall: Support for defining extra chains in the config file
Matthew Wild <mwild1@gmail.com>
parents: 2101
diff changeset
49 chains[k] = v;
d75145297bf9 mod_firewall: Support for defining extra chains in the config file
Matthew Wild <mwild1@gmail.com>
parents: 2101
diff changeset
50 end
d75145297bf9 mod_firewall: Support for defining extra chains in the config file
Matthew Wild <mwild1@gmail.com>
parents: 2101
diff changeset
51 for k,v in pairs(extra_chains) do
d75145297bf9 mod_firewall: Support for defining extra chains in the config file
Matthew Wild <mwild1@gmail.com>
parents: 2101
diff changeset
52 chains[k] = v;
d75145297bf9 mod_firewall: Support for defining extra chains in the config file
Matthew Wild <mwild1@gmail.com>
parents: 2101
diff changeset
53 end
d75145297bf9 mod_firewall: Support for defining extra chains in the config file
Matthew Wild <mwild1@gmail.com>
parents: 2101
diff changeset
54
2124
89363766202c mod_firewall: Add comment to document idsafe()
Matthew Wild <mwild1@gmail.com>
parents: 2118
diff changeset
55 -- Returns the input if it is safe to be used as a variable name, otherwise nil
2099
a8c701631d0b mod_firewall: Make idsafe() a global function so libraries can re-use it
Matthew Wild <mwild1@gmail.com>
parents: 2080
diff changeset
56 function idsafe(name)
2527
5ff7eb601d60 mod_firewall: Code formatting
Matthew Wild <mwild1@gmail.com>
parents: 2526
diff changeset
57 return name:match("^%a[%w_]*$");
971
53e158e44a44 mod_firewall: Add rate limiting capabilities, and keep zones and throttle objects in shared tables
Matthew Wild <mwild1@gmail.com>
parents: 967
diff changeset
58 end
53e158e44a44 mod_firewall: Add rate limiting capabilities, and keep zones and throttle objects in shared tables
Matthew Wild <mwild1@gmail.com>
parents: 967
diff changeset
59
2518
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
60 local meta_funcs = {
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
61 bare = function (code)
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
62 return "jid_bare("..code..")", {"jid_bare"};
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
63 end;
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
64 node = function (code)
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
65 return "(jid_split("..code.."))", {"jid_split"};
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
66 end;
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
67 host = function (code)
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
68 return "(select(2, jid_split("..code..")))", {"jid_split"};
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
69 end;
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
70 resource = function (code)
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
71 return "(select(3, jid_split("..code..")))", {"jid_split"};
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
72 end;
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
73 };
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
74
2125
edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it
Matthew Wild <mwild1@gmail.com>
parents: 2124
diff changeset
75 -- Run quoted (%q) strings through this to allow them to contain code. e.g.: LOG=Received: $(stanza:top_tag())
2518
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
76 function meta(s, deps, extra)
2385
c0c2f8665c3e mod_firewall: Fix for raw code expressions that contain escape-worthy characters
Matthew Wild <mwild1@gmail.com>
parents: 2374
diff changeset
77 return (s:gsub("$(%b())", function (expr)
c0c2f8665c3e mod_firewall: Fix for raw code expressions that contain escape-worthy characters
Matthew Wild <mwild1@gmail.com>
parents: 2374
diff changeset
78 expr = expr:gsub("\\(.)", "%1");
c0c2f8665c3e mod_firewall: Fix for raw code expressions that contain escape-worthy characters
Matthew Wild <mwild1@gmail.com>
parents: 2374
diff changeset
79 return [["..tostring(]]..expr..[[).."]];
c0c2f8665c3e mod_firewall: Fix for raw code expressions that contain escape-worthy characters
Matthew Wild <mwild1@gmail.com>
parents: 2374
diff changeset
80 end)
2125
edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it
Matthew Wild <mwild1@gmail.com>
parents: 2124
diff changeset
81 :gsub("$(%b<>)", function (expr)
edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it
Matthew Wild <mwild1@gmail.com>
parents: 2124
diff changeset
82 expr = expr:sub(2,-2);
2538
a1b6a6b0aabb mod_firewall: Reinstate the ability to set a default for stanza expressions
Matthew Wild <mwild1@gmail.com>
parents: 2533
diff changeset
83 local default = "<undefined>";
2561
3da0e3c917cc mod_firewall: Accept backslash escapes in definitions
Matthew Wild <mwild1@gmail.com>
parents: 2558
diff changeset
84 expr = expr:gsub("||(%b\"\")$", function (default_string)
3da0e3c917cc mod_firewall: Accept backslash escapes in definitions
Matthew Wild <mwild1@gmail.com>
parents: 2558
diff changeset
85 default = stripslashes(default_string:sub(2,-2));
2538
a1b6a6b0aabb mod_firewall: Reinstate the ability to set a default for stanza expressions
Matthew Wild <mwild1@gmail.com>
parents: 2533
diff changeset
86 return "";
a1b6a6b0aabb mod_firewall: Reinstate the ability to set a default for stanza expressions
Matthew Wild <mwild1@gmail.com>
parents: 2533
diff changeset
87 end);
2518
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
88 local func_chain = expr:match("|[%w|]+$");
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
89 if func_chain then
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
90 expr = expr:sub(1, -1-#func_chain);
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
91 end
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
92 local code;
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
93 if expr:match("^@") then
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
94 -- Skip stanza:find() for simple attribute lookup
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
95 local attr_name = expr:sub(2);
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
96 if deps and (attr_name == "to" or attr_name == "from" or attr_name == "type") then
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
97 -- These attributes may be cached in locals
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
98 code = attr_name;
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
99 table.insert(deps, attr_name);
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
100 else
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
101 code = "stanza.attr["..("%q"):format(attr_name).."]";
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
102 end
2524
0404476ecfe3 mod_firewall: More meta() enhancements
Matthew Wild <mwild1@gmail.com>
parents: 2520
diff changeset
103 elseif expr:match("^%w+#$") then
0404476ecfe3 mod_firewall: More meta() enhancements
Matthew Wild <mwild1@gmail.com>
parents: 2520
diff changeset
104 code = ("stanza:get_child_text(%q)"):format(expr:sub(1, -2));
2368
7e1d8c46d788 mod_firewall: Support for default values in stanza paths
Matthew Wild <mwild1@gmail.com>
parents: 2367
diff changeset
105 else
2524
0404476ecfe3 mod_firewall: More meta() enhancements
Matthew Wild <mwild1@gmail.com>
parents: 2520
diff changeset
106 code = ("stanza:find(%q)"):format(expr);
2368
7e1d8c46d788 mod_firewall: Support for default values in stanza paths
Matthew Wild <mwild1@gmail.com>
parents: 2367
diff changeset
107 end
2518
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
108 if func_chain then
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
109 for func_name in func_chain:gmatch("|(%w+)") do
2573
24dbad147aef mod_firewall: Fix meta functions with to/from that weren't JID-based
Matthew Wild <mwild1@gmail.com>
parents: 2562
diff changeset
110 -- to/from are already available in local variables, use those if possible
24dbad147aef mod_firewall: Fix meta functions with to/from that weren't JID-based
Matthew Wild <mwild1@gmail.com>
parents: 2562
diff changeset
111 if (code == "to" or code == "from") and func_name == "bare" then
24dbad147aef mod_firewall: Fix meta functions with to/from that weren't JID-based
Matthew Wild <mwild1@gmail.com>
parents: 2562
diff changeset
112 code = "bare_"..code;
24dbad147aef mod_firewall: Fix meta functions with to/from that weren't JID-based
Matthew Wild <mwild1@gmail.com>
parents: 2562
diff changeset
113 table.insert(deps, code);
24dbad147aef mod_firewall: Fix meta functions with to/from that weren't JID-based
Matthew Wild <mwild1@gmail.com>
parents: 2562
diff changeset
114 elseif (code == "to" or code == "from") and (func_name == "node" or func_name == "host" or func_name == "resource") then
24dbad147aef mod_firewall: Fix meta functions with to/from that weren't JID-based
Matthew Wild <mwild1@gmail.com>
parents: 2562
diff changeset
115 table.insert(deps, "split_"..code);
24dbad147aef mod_firewall: Fix meta functions with to/from that weren't JID-based
Matthew Wild <mwild1@gmail.com>
parents: 2562
diff changeset
116 code = code.."_"..func_name;
2518
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
117 else
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
118 assert(meta_funcs[func_name], "unknown function: "..func_name);
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
119 local new_code, new_deps = meta_funcs[func_name](code);
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
120 code = new_code;
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
121 if new_deps and #new_deps > 0 then
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
122 assert(deps, "function not supported here: "..func_name);
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
123 for _, dep in ipairs(new_deps) do
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
124 table.insert(deps, dep);
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
125 end
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
126 end
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
127 end
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions
Matthew Wild <mwild1@gmail.com>
parents: 2517
diff changeset
128 end
2125
edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it
Matthew Wild <mwild1@gmail.com>
parents: 2124
diff changeset
129 end
2538
a1b6a6b0aabb mod_firewall: Reinstate the ability to set a default for stanza expressions
Matthew Wild <mwild1@gmail.com>
parents: 2533
diff changeset
130 return "\"..tostring("..code.." or "..("%q"):format(default)..")..\"";
2125
edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it
Matthew Wild <mwild1@gmail.com>
parents: 2124
diff changeset
131 end)
edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it
Matthew Wild <mwild1@gmail.com>
parents: 2124
diff changeset
132 :gsub("$$(%a+)", extra or {})
edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it
Matthew Wild <mwild1@gmail.com>
parents: 2124
diff changeset
133 :gsub([[^""%.%.]], "")
edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it
Matthew Wild <mwild1@gmail.com>
parents: 2124
diff changeset
134 :gsub([[%.%.""$]], ""));
edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it
Matthew Wild <mwild1@gmail.com>
parents: 2124
diff changeset
135 end
edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it
Matthew Wild <mwild1@gmail.com>
parents: 2124
diff changeset
136
2547
eb4f45bd7fef mod_firewall: Add metaq(), like meta() but takes an unquoted string
Matthew Wild <mwild1@gmail.com>
parents: 2546
diff changeset
137 function metaq(s, ...)
eb4f45bd7fef mod_firewall: Add metaq(), like meta() but takes an unquoted string
Matthew Wild <mwild1@gmail.com>
parents: 2546
diff changeset
138 return meta(("%q"):format(s), ...);
eb4f45bd7fef mod_firewall: Add metaq(), like meta() but takes an unquoted string
Matthew Wild <mwild1@gmail.com>
parents: 2546
diff changeset
139 end
eb4f45bd7fef mod_firewall: Add metaq(), like meta() but takes an unquoted string
Matthew Wild <mwild1@gmail.com>
parents: 2546
diff changeset
140
2546
6e4494772328 mod_firewall: Add stripslashes() function
Matthew Wild <mwild1@gmail.com>
parents: 2544
diff changeset
141 local escape_chars = {
6e4494772328 mod_firewall: Add stripslashes() function
Matthew Wild <mwild1@gmail.com>
parents: 2544
diff changeset
142 a = "\a", b = "\b", f = "\f", n = "\n", r = "\r", t = "\t",
6e4494772328 mod_firewall: Add stripslashes() function
Matthew Wild <mwild1@gmail.com>
parents: 2544
diff changeset
143 v = "\v", ["\\"] = "\\", ["\""] = "\"", ["\'"] = "\'"
6e4494772328 mod_firewall: Add stripslashes() function
Matthew Wild <mwild1@gmail.com>
parents: 2544
diff changeset
144 };
6e4494772328 mod_firewall: Add stripslashes() function
Matthew Wild <mwild1@gmail.com>
parents: 2544
diff changeset
145 function stripslashes(s)
6e4494772328 mod_firewall: Add stripslashes() function
Matthew Wild <mwild1@gmail.com>
parents: 2544
diff changeset
146 return (s:gsub("\\(.)", escape_chars));
6e4494772328 mod_firewall: Add stripslashes() function
Matthew Wild <mwild1@gmail.com>
parents: 2544
diff changeset
147 end
6e4494772328 mod_firewall: Add stripslashes() function
Matthew Wild <mwild1@gmail.com>
parents: 2544
diff changeset
148
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
149 -- Dependency locations:
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
150 -- <type lib>
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
151 -- <type global>
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
152 -- function handler()
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
153 -- <local deps>
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
154 -- if <conditions> then
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
155 -- <actions>
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
156 -- end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
157 -- end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
158
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
159 local available_deps = {
1303
8a3f3f485675 mod_firewall: Produce code with nicer indentation
Florian Zeitz <florob@babelmonkeys.de>
parents: 1052
diff changeset
160 st = { global_code = [[local st = require "util.stanza";]]};
2544
223eea31588d mod_firewall: Add it(erators) and it_count dependencies
Matthew Wild <mwild1@gmail.com>
parents: 2543
diff changeset
161 it = { global_code = [[local it = require "util.iterators";]]};
223eea31588d mod_firewall: Add it(erators) and it_count dependencies
Matthew Wild <mwild1@gmail.com>
parents: 2543
diff changeset
162 it_count = { global_code = [[local it_count = it.count;]], depends = { "it" } };
2548
ce08a57e516b mod_firewall: Add 'current_host' variable/dependency
Matthew Wild <mwild1@gmail.com>
parents: 2547
diff changeset
163 current_host = { global_code = [[local current_host = module.host;]] };
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
164 jid_split = {
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
165 global_code = [[local jid_split = require "util.jid".split;]];
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
166 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
167 jid_bare = {
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
168 global_code = [[local jid_bare = require "util.jid".bare;]];
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
169 };
2412
9159f9166893 mod_firewall: Use the sender bare JID instead of 'to' for stanzas to self
Kim Alvefur <zash@zash.se>
parents: 2404
diff changeset
170 to = { local_code = [[local to = stanza.attr.to or jid_bare(session.full_jid);]]; depends = { "jid_bare" } };
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
171 from = { local_code = [[local from = stanza.attr.from;]] };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
172 type = { local_code = [[local type = stanza.attr.type;]] };
2415
07d7036040ee mod_firewall: Insert semicolons after some statements to prevent ambiguous syntax in output (fixes #797)
Kim Alvefur <zash@zash.se>
parents: 2412
diff changeset
173 name = { local_code = [[local name = stanza.name;]] };
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
174 split_to = { -- The stanza's split to address
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
175 depends = { "jid_split", "to" };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
176 local_code = [[local to_node, to_host, to_resource = jid_split(to);]];
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
177 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
178 split_from = { -- The stanza's split from address
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
179 depends = { "jid_split", "from" };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
180 local_code = [[local from_node, from_host, from_resource = jid_split(from);]];
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
181 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
182 bare_to = { depends = { "jid_bare", "to" }, local_code = "local bare_to = jid_bare(to)"};
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
183 bare_from = { depends = { "jid_bare", "from" }, local_code = "local bare_from = jid_bare(from)"};
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
184 group_contains = {
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
185 global_code = [[local group_contains = module:depends("groups").group_contains]];
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
186 };
5160
8474a3b80200 mod_firewall: Fix 'is_admin' internal dependency rule #1797 (thanks diane)
Kim Alvefur <zash@zash.se>
parents: 5002
diff changeset
187 is_admin = require"core.usermanager".is_admin and { global_code = [[local is_admin = require "core.usermanager".is_admin;]]} or nil;
5002
84997bc3f92e mod_firewall: Update for role-auth (backwards compatible)
Matthew Wild <mwild1@gmail.com>
parents: 4608
diff changeset
188 get_jid_role = require "core.usermanager".get_jid_role and { global_code = [[local get_jid_role = require "core.usermanager".get_jid_role;]] } or nil;
2418
ef95853cf900 mod_firewall: More semicolons
Kim Alvefur <zash@zash.se>
parents: 2416
diff changeset
189 core_post_stanza = { global_code = [[local core_post_stanza = prosody.core_post_stanza;]] };
965
d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone).
Matthew Wild <mwild1@gmail.com>
parents: 960
diff changeset
190 zone = { global_code = function (zone)
2928
b0d92332b87f mod_firewall: Add special case for $local zone (fixes #1090)
Kim Alvefur <zash@zash.se>
parents: 2894
diff changeset
191 local var = zone;
b0d92332b87f mod_firewall: Add special case for $local zone (fixes #1090)
Kim Alvefur <zash@zash.se>
parents: 2894
diff changeset
192 if var == "$local" then
b0d92332b87f mod_firewall: Add special case for $local zone (fixes #1090)
Kim Alvefur <zash@zash.se>
parents: 2894
diff changeset
193 var = "_local"; -- See #1090
b0d92332b87f mod_firewall: Add special case for $local zone (fixes #1090)
Kim Alvefur <zash@zash.se>
parents: 2894
diff changeset
194 else
b0d92332b87f mod_firewall: Add special case for $local zone (fixes #1090)
Kim Alvefur <zash@zash.se>
parents: 2894
diff changeset
195 assert(idsafe(var), "Invalid zone name: "..zone);
b0d92332b87f mod_firewall: Add special case for $local zone (fixes #1090)
Kim Alvefur <zash@zash.se>
parents: 2894
diff changeset
196 end
b0d92332b87f mod_firewall: Add special case for $local zone (fixes #1090)
Kim Alvefur <zash@zash.se>
parents: 2894
diff changeset
197 return ("local zone_%s = zones[%q] or {};"):format(var, zone);
965
d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone).
Matthew Wild <mwild1@gmail.com>
parents: 960
diff changeset
198 end };
966
a65df6e97d94 mod_firewall: Add time and date deps
Matthew Wild <mwild1@gmail.com>
parents: 965
diff changeset
199 date_time = { global_code = [[local os_date = os.date]]; local_code = [[local current_date_time = os_date("*t");]] };
a65df6e97d94 mod_firewall: Add time and date deps
Matthew Wild <mwild1@gmail.com>
parents: 965
diff changeset
200 time = { local_code = function (what)
a65df6e97d94 mod_firewall: Add time and date deps
Matthew Wild <mwild1@gmail.com>
parents: 965
diff changeset
201 local defs = {};
a65df6e97d94 mod_firewall: Add time and date deps
Matthew Wild <mwild1@gmail.com>
parents: 965
diff changeset
202 for field in what:gmatch("%a+") do
a65df6e97d94 mod_firewall: Add time and date deps
Matthew Wild <mwild1@gmail.com>
parents: 965
diff changeset
203 table.insert(defs, ("local current_%s = current_date_time.%s;"):format(field, field));
a65df6e97d94 mod_firewall: Add time and date deps
Matthew Wild <mwild1@gmail.com>
parents: 965
diff changeset
204 end
a65df6e97d94 mod_firewall: Add time and date deps
Matthew Wild <mwild1@gmail.com>
parents: 965
diff changeset
205 return table.concat(defs, " ");
a65df6e97d94 mod_firewall: Add time and date deps
Matthew Wild <mwild1@gmail.com>
parents: 965
diff changeset
206 end, depends = { "date_time" }; };
6386
547feb8181eb mod_firewall: Use util.time instead of prosody.util.time, for 0.12 compatibility
Link Mauve <linkmauve@linkmauve.fr>
parents: 6372
diff changeset
207 timestamp = { global_code = [[local get_time = require "util.time".now;]]; local_code = [[local current_timestamp = get_time();]]; };
2128
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental)
Matthew Wild <mwild1@gmail.com>
parents: 2126
diff changeset
208 globalthrottle = {
971
53e158e44a44 mod_firewall: Add rate limiting capabilities, and keep zones and throttle objects in shared tables
Matthew Wild <mwild1@gmail.com>
parents: 967
diff changeset
209 global_code = function (throttle)
53e158e44a44 mod_firewall: Add rate limiting capabilities, and keep zones and throttle objects in shared tables
Matthew Wild <mwild1@gmail.com>
parents: 967
diff changeset
210 assert(idsafe(throttle), "Invalid rate limit name: "..throttle);
999
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
211 assert(active_definitions.RATE[throttle], "Unknown rate limit: "..throttle);
2128
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental)
Matthew Wild <mwild1@gmail.com>
parents: 2126
diff changeset
212 return ("local global_throttle_%s = rates.%s:single();"):format(throttle, throttle);
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental)
Matthew Wild <mwild1@gmail.com>
parents: 2126
diff changeset
213 end;
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental)
Matthew Wild <mwild1@gmail.com>
parents: 2126
diff changeset
214 };
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental)
Matthew Wild <mwild1@gmail.com>
parents: 2126
diff changeset
215 multithrottle = {
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental)
Matthew Wild <mwild1@gmail.com>
parents: 2126
diff changeset
216 global_code = function (throttle)
2130
9239893a2400 mod_firewall: Don't use util.cache unless it's needed, and add explanatory error if it is not available
Matthew Wild <mwild1@gmail.com>
parents: 2128
diff changeset
217 assert(pcall(require, "util.cache"), "Using LIMIT with 'on' requires Prosody 0.10 or higher");
2128
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental)
Matthew Wild <mwild1@gmail.com>
parents: 2126
diff changeset
218 assert(idsafe(throttle), "Invalid rate limit name: "..throttle);
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental)
Matthew Wild <mwild1@gmail.com>
parents: 2126
diff changeset
219 assert(active_definitions.RATE[throttle], "Unknown rate limit: "..throttle);
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental)
Matthew Wild <mwild1@gmail.com>
parents: 2126
diff changeset
220 return ("local multi_throttle_%s = rates.%s:multi();"):format(throttle, throttle);
971
53e158e44a44 mod_firewall: Add rate limiting capabilities, and keep zones and throttle objects in shared tables
Matthew Wild <mwild1@gmail.com>
parents: 967
diff changeset
221 end;
53e158e44a44 mod_firewall: Add rate limiting capabilities, and keep zones and throttle objects in shared tables
Matthew Wild <mwild1@gmail.com>
parents: 967
diff changeset
222 };
4608
4e8fa75cc678 mod_firewall: Remove reliance on full_sessions being a global
Kim Alvefur <zash@zash.se>
parents: 4582
diff changeset
223 full_sessions = {
4e8fa75cc678 mod_firewall: Remove reliance on full_sessions being a global
Kim Alvefur <zash@zash.se>
parents: 4582
diff changeset
224 global_code = [[local full_sessions = prosody.full_sessions;]];
4e8fa75cc678 mod_firewall: Remove reliance on full_sessions being a global
Kim Alvefur <zash@zash.se>
parents: 4582
diff changeset
225 };
2402
2040330586e4 mod_firewall: Split import of rostermanager into its own dependency
Kim Alvefur <zash@zash.se>
parents: 2385
diff changeset
226 rostermanager = {
2040330586e4 mod_firewall: Split import of rostermanager into its own dependency
Kim Alvefur <zash@zash.se>
parents: 2385
diff changeset
227 global_code = [[local rostermanager = require "core.rostermanager";]];
2040330586e4 mod_firewall: Split import of rostermanager into its own dependency
Kim Alvefur <zash@zash.se>
parents: 2385
diff changeset
228 };
2342
6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group)
Matthew Wild <mwild1@gmail.com>
parents: 2130
diff changeset
229 roster_entry = {
2416
ade918cd9ca7 mod_firewall: Only call rostermanager if username is available (fixes #796)
Kim Alvefur <zash@zash.se>
parents: 2415
diff changeset
230 local_code = [[local roster_entry = (to_node and rostermanager.load_roster(to_node, to_host) or {})[bare_from];]];
2402
2040330586e4 mod_firewall: Split import of rostermanager into its own dependency
Kim Alvefur <zash@zash.se>
parents: 2385
diff changeset
231 depends = { "rostermanager", "split_to", "bare_from" };
2040330586e4 mod_firewall: Split import of rostermanager into its own dependency
Kim Alvefur <zash@zash.se>
parents: 2385
diff changeset
232 };
2520
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP
Matthew Wild <mwild1@gmail.com>
parents: 2518
diff changeset
233 list = { global_code = function (list)
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP
Matthew Wild <mwild1@gmail.com>
parents: 2518
diff changeset
234 assert(idsafe(list), "Invalid list name: "..list);
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP
Matthew Wild <mwild1@gmail.com>
parents: 2518
diff changeset
235 assert(active_definitions.LIST[list], "Unknown list: "..list);
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP
Matthew Wild <mwild1@gmail.com>
parents: 2518
diff changeset
236 return ("local list_%s = lists[%q];"):format(list, list);
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP
Matthew Wild <mwild1@gmail.com>
parents: 2518
diff changeset
237 end
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP
Matthew Wild <mwild1@gmail.com>
parents: 2518
diff changeset
238 };
2528
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list
Matthew Wild <mwild1@gmail.com>
parents: 2527
diff changeset
239 search = {
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list
Matthew Wild <mwild1@gmail.com>
parents: 2527
diff changeset
240 local_code = function (search_name)
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list
Matthew Wild <mwild1@gmail.com>
parents: 2527
diff changeset
241 local search_path = assert(active_definitions.SEARCH[search_name], "Undefined search path: "..search_name);
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list
Matthew Wild <mwild1@gmail.com>
parents: 2527
diff changeset
242 return ("local search_%s = tostring(stanza:find(%q) or \"\")"):format(search_name, search_path);
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list
Matthew Wild <mwild1@gmail.com>
parents: 2527
diff changeset
243 end;
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list
Matthew Wild <mwild1@gmail.com>
parents: 2527
diff changeset
244 };
2543
3c16f0a8d66c mod_firewall: Do patterns properly, instead of cheating
Matthew Wild <mwild1@gmail.com>
parents: 2539
diff changeset
245 pattern = {
3c16f0a8d66c mod_firewall: Do patterns properly, instead of cheating
Matthew Wild <mwild1@gmail.com>
parents: 2539
diff changeset
246 local_code = function (pattern_name)
3c16f0a8d66c mod_firewall: Do patterns properly, instead of cheating
Matthew Wild <mwild1@gmail.com>
parents: 2539
diff changeset
247 local pattern = assert(active_definitions.PATTERN[pattern_name], "Undefined pattern: "..pattern_name);
3c16f0a8d66c mod_firewall: Do patterns properly, instead of cheating
Matthew Wild <mwild1@gmail.com>
parents: 2539
diff changeset
248 return ("local pattern_%s = %q"):format(pattern_name, pattern);
3c16f0a8d66c mod_firewall: Do patterns properly, instead of cheating
Matthew Wild <mwild1@gmail.com>
parents: 2539
diff changeset
249 end;
3c16f0a8d66c mod_firewall: Do patterns properly, instead of cheating
Matthew Wild <mwild1@gmail.com>
parents: 2539
diff changeset
250 };
2528
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list
Matthew Wild <mwild1@gmail.com>
parents: 2527
diff changeset
251 tokens = {
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list
Matthew Wild <mwild1@gmail.com>
parents: 2527
diff changeset
252 local_code = function (search_and_pattern)
2584
d64fc9c3cffd mod_firewall: Remove ambiguity from tokens dep parameter
Matthew Wild <mwild1@gmail.com>
parents: 2583
diff changeset
253 local search_name, pattern_name = search_and_pattern:match("^([^%-]+)-(.+)$");
2528
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list
Matthew Wild <mwild1@gmail.com>
parents: 2527
diff changeset
254 local code = ([[local tokens_%s_%s = {};
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list
Matthew Wild <mwild1@gmail.com>
parents: 2527
diff changeset
255 if search_%s then
2543
3c16f0a8d66c mod_firewall: Do patterns properly, instead of cheating
Matthew Wild <mwild1@gmail.com>
parents: 2539
diff changeset
256 for s in search_%s:gmatch(pattern_%s) do
2528
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list
Matthew Wild <mwild1@gmail.com>
parents: 2527
diff changeset
257 tokens_%s_%s[s] = true;
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list
Matthew Wild <mwild1@gmail.com>
parents: 2527
diff changeset
258 end
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list
Matthew Wild <mwild1@gmail.com>
parents: 2527
diff changeset
259 end
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list
Matthew Wild <mwild1@gmail.com>
parents: 2527
diff changeset
260 ]]):format(search_name, pattern_name, search_name, search_name, pattern_name, search_name, pattern_name);
2543
3c16f0a8d66c mod_firewall: Do patterns properly, instead of cheating
Matthew Wild <mwild1@gmail.com>
parents: 2539
diff changeset
261 return code, { "search:"..search_name, "pattern:"..pattern_name };
2528
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list
Matthew Wild <mwild1@gmail.com>
parents: 2527
diff changeset
262 end;
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list
Matthew Wild <mwild1@gmail.com>
parents: 2527
diff changeset
263 };
5793
e304e19536f2 mod_firewall: TO/FROM ROLE: Handle JIDs with no role (thanks Zash)
Matthew Wild <mwild1@gmail.com>
parents: 5704
diff changeset
264 sender_role = {
e304e19536f2 mod_firewall: TO/FROM ROLE: Handle JIDs with no role (thanks Zash)
Matthew Wild <mwild1@gmail.com>
parents: 5704
diff changeset
265 local_code = [[local sender_role = get_jid_role(bare_from, current_host)]];
e304e19536f2 mod_firewall: TO/FROM ROLE: Handle JIDs with no role (thanks Zash)
Matthew Wild <mwild1@gmail.com>
parents: 5704
diff changeset
266 depends = { "bare_from", "current_host", "get_jid_role" };
e304e19536f2 mod_firewall: TO/FROM ROLE: Handle JIDs with no role (thanks Zash)
Matthew Wild <mwild1@gmail.com>
parents: 5704
diff changeset
267 };
e304e19536f2 mod_firewall: TO/FROM ROLE: Handle JIDs with no role (thanks Zash)
Matthew Wild <mwild1@gmail.com>
parents: 5704
diff changeset
268 recipient_role = {
e304e19536f2 mod_firewall: TO/FROM ROLE: Handle JIDs with no role (thanks Zash)
Matthew Wild <mwild1@gmail.com>
parents: 5704
diff changeset
269 local_code = [[local recipient_role = get_jid_role(bare_to, current_host)]];
e304e19536f2 mod_firewall: TO/FROM ROLE: Handle JIDs with no role (thanks Zash)
Matthew Wild <mwild1@gmail.com>
parents: 5704
diff changeset
270 depends = { "bare_to", "current_host", "get_jid_role" };
e304e19536f2 mod_firewall: TO/FROM ROLE: Handle JIDs with no role (thanks Zash)
Matthew Wild <mwild1@gmail.com>
parents: 5704
diff changeset
271 };
2528
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list
Matthew Wild <mwild1@gmail.com>
parents: 2527
diff changeset
272 scan_list = {
2533
9aed7f4e9f07 mod_firewall: Fix scan_list() syntax error in generated code
Matthew Wild <mwild1@gmail.com>
parents: 2528
diff changeset
273 global_code = [[local function scan_list(list, items) for item in pairs(items) do if list:contains(item) then return true; end end end]];
5704
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
274 };
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
275 iplib = {
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
276 global_code = [[local iplib = require "util.ip";]];
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
277 };
6502
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions
Matthew Wild <mwild1@gmail.com>
parents: 6386
diff changeset
278 session_parsed_ip = {
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions
Matthew Wild <mwild1@gmail.com>
parents: 6386
diff changeset
279 local_code = [[local session_parsed_ip = iplib.new_ip(session.ip)]];
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions
Matthew Wild <mwild1@gmail.com>
parents: 6386
diff changeset
280 depends = { "iplib" };
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions
Matthew Wild <mwild1@gmail.com>
parents: 6386
diff changeset
281 };
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions
Matthew Wild <mwild1@gmail.com>
parents: 6386
diff changeset
282 parsed_ip = {
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions
Matthew Wild <mwild1@gmail.com>
parents: 6386
diff changeset
283 local_code = function (parsed_ip_spec)
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions
Matthew Wild <mwild1@gmail.com>
parents: 6386
diff changeset
284 local ip_hash, ip_str = parsed_ip_spec:match("^(%x+):(.+)$");
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions
Matthew Wild <mwild1@gmail.com>
parents: 6386
diff changeset
285 local code = ([[local parsed_ip_%s = iplib.new_ip(%q)]]):format(ip_hash, ip_str)
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions
Matthew Wild <mwild1@gmail.com>
parents: 6386
diff changeset
286 return code, { "iplib" };
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions
Matthew Wild <mwild1@gmail.com>
parents: 6386
diff changeset
287 end;
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions
Matthew Wild <mwild1@gmail.com>
parents: 6386
diff changeset
288 };
5704
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
289 geoip_country = {
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
290 global_code = [[
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
291 local geoip_country = require "geoip.country";
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
292 local geov4 = geoip_country.open(module:get_option_string("geoip_ipv4_country", "/usr/share/GeoIP/GeoIP.dat"));
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
293 local geov6 = geoip_country.open(module:get_option_string("geoip_ipv6_country", "/usr/share/GeoIP/GeoIPv6.dat"));
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
294 local function get_geoip(ips, what)
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
295 if not ips then
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
296 return "--";
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
297 end
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
298 local ip = iplib.new_ip(ips);
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
299 if not ip then
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
300 return "--";
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
301 end
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
302 if ip.proto == "IPv6" and geov6 then
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
303 local geoinfo = geoinfo:query_by_addr6(ip.addr);
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
304 if geoinfo then
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
305 return geoinfo[what or "code"];
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
306 end
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
307 elseif ip.proto == "IPv4" and geov4 then
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
308 local geoinfo = geoinfo:query_by_addr(ip.addr);
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
309 if geoinfo then
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
310 return geoinfo[what or "code"];
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
311 end
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
312 end
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
313 return "--";
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
314 end
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
315 ]];
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
316 depends = {
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
317 "iplib"
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
318 }
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB
Kim Alvefur <zash@zash.se>
parents: 5542
diff changeset
319 };
5866
1d1eadff331d mod_firewall: Support util.id.* as dependencies
Matthew Wild <mwild1@gmail.com>
parents: 5834
diff changeset
320 new_short_id = {
1d1eadff331d mod_firewall: Support util.id.* as dependencies
Matthew Wild <mwild1@gmail.com>
parents: 5834
diff changeset
321 global_code = [[local new_short_id = require "util.id".short;]];
1d1eadff331d mod_firewall: Support util.id.* as dependencies
Matthew Wild <mwild1@gmail.com>
parents: 5834
diff changeset
322 };
1d1eadff331d mod_firewall: Support util.id.* as dependencies
Matthew Wild <mwild1@gmail.com>
parents: 5834
diff changeset
323 new_medium_id = {
1d1eadff331d mod_firewall: Support util.id.* as dependencies
Matthew Wild <mwild1@gmail.com>
parents: 5834
diff changeset
324 global_code = [[local new_medium_id = require "util.id".medium;]];
1d1eadff331d mod_firewall: Support util.id.* as dependencies
Matthew Wild <mwild1@gmail.com>
parents: 5834
diff changeset
325 };
1d1eadff331d mod_firewall: Support util.id.* as dependencies
Matthew Wild <mwild1@gmail.com>
parents: 5834
diff changeset
326 new_long_id = {
1d1eadff331d mod_firewall: Support util.id.* as dependencies
Matthew Wild <mwild1@gmail.com>
parents: 5834
diff changeset
327 global_code = [[local new_long_id = require "util.id".long;]];
1d1eadff331d mod_firewall: Support util.id.* as dependencies
Matthew Wild <mwild1@gmail.com>
parents: 5834
diff changeset
328 };
5920
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
329
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
330 trace = {
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
331 global_code = [[local trace_init = module:require("trace").init;]];
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
332 };
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
333 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
334
2077
368b091e723b mod_firewall: Rename argument to avoid name clash [luacheck]
Kim Alvefur <zash@zash.se>
parents: 2076
diff changeset
335 local function include_dep(dependency, code)
368b091e723b mod_firewall: Rename argument to avoid name clash [luacheck]
Kim Alvefur <zash@zash.se>
parents: 2076
diff changeset
336 local dep, dep_param = dependency:match("^([^:]+):?(.*)$");
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
337 local dep_info = available_deps[dep];
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
338 if not dep_info then
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
339 module:log("error", "Dependency not found: %s", dep);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
340 return;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
341 end
2583
b6b10f57aa56 mod_firewall: Fix for including the same dependency with different parameters
Matthew Wild <mwild1@gmail.com>
parents: 2580
diff changeset
342 if code.included_deps[dependency] ~= nil then
b6b10f57aa56 mod_firewall: Fix for including the same dependency with different parameters
Matthew Wild <mwild1@gmail.com>
parents: 2580
diff changeset
343 if code.included_deps[dependency] ~= true then
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
344 module:log("error", "Circular dependency on %s", dep);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
345 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
346 return;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
347 end
2583
b6b10f57aa56 mod_firewall: Fix for including the same dependency with different parameters
Matthew Wild <mwild1@gmail.com>
parents: 2580
diff changeset
348 code.included_deps[dependency] = false; -- Pending flag (used to detect circular references)
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
349 for _, dep_dep in ipairs(dep_info.depends or {}) do
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
350 include_dep(dep_dep, code);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
351 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
352 if dep_info.global_code then
965
d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone).
Matthew Wild <mwild1@gmail.com>
parents: 960
diff changeset
353 if dep_param ~= "" then
2525
a35d85cfda92 mod_firewall: Fix for deps dynamically including deps
Matthew Wild <mwild1@gmail.com>
parents: 2524
diff changeset
354 local global_code, deps = dep_info.global_code(dep_param);
a35d85cfda92 mod_firewall: Fix for deps dynamically including deps
Matthew Wild <mwild1@gmail.com>
parents: 2524
diff changeset
355 if deps then
2562
78efd064aef3 mod_firewall: Rename variables to avoid shadowing #luacheck
Matthew Wild <mwild1@gmail.com>
parents: 2561
diff changeset
356 for _, dep_dep in ipairs(deps) do
78efd064aef3 mod_firewall: Rename variables to avoid shadowing #luacheck
Matthew Wild <mwild1@gmail.com>
parents: 2561
diff changeset
357 include_dep(dep_dep, code);
2525
a35d85cfda92 mod_firewall: Fix for deps dynamically including deps
Matthew Wild <mwild1@gmail.com>
parents: 2524
diff changeset
358 end
a35d85cfda92 mod_firewall: Fix for deps dynamically including deps
Matthew Wild <mwild1@gmail.com>
parents: 2524
diff changeset
359 end
a35d85cfda92 mod_firewall: Fix for deps dynamically including deps
Matthew Wild <mwild1@gmail.com>
parents: 2524
diff changeset
360 table.insert(code.global_header, global_code);
965
d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone).
Matthew Wild <mwild1@gmail.com>
parents: 960
diff changeset
361 else
d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone).
Matthew Wild <mwild1@gmail.com>
parents: 960
diff changeset
362 table.insert(code.global_header, dep_info.global_code);
d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone).
Matthew Wild <mwild1@gmail.com>
parents: 960
diff changeset
363 end
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
364 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
365 if dep_info.local_code then
965
d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone).
Matthew Wild <mwild1@gmail.com>
parents: 960
diff changeset
366 if dep_param ~= "" then
2525
a35d85cfda92 mod_firewall: Fix for deps dynamically including deps
Matthew Wild <mwild1@gmail.com>
parents: 2524
diff changeset
367 local local_code, deps = dep_info.local_code(dep_param);
a35d85cfda92 mod_firewall: Fix for deps dynamically including deps
Matthew Wild <mwild1@gmail.com>
parents: 2524
diff changeset
368 if deps then
2562
78efd064aef3 mod_firewall: Rename variables to avoid shadowing #luacheck
Matthew Wild <mwild1@gmail.com>
parents: 2561
diff changeset
369 for _, dep_dep in ipairs(deps) do
78efd064aef3 mod_firewall: Rename variables to avoid shadowing #luacheck
Matthew Wild <mwild1@gmail.com>
parents: 2561
diff changeset
370 include_dep(dep_dep, code);
2525
a35d85cfda92 mod_firewall: Fix for deps dynamically including deps
Matthew Wild <mwild1@gmail.com>
parents: 2524
diff changeset
371 end
a35d85cfda92 mod_firewall: Fix for deps dynamically including deps
Matthew Wild <mwild1@gmail.com>
parents: 2524
diff changeset
372 end
a35d85cfda92 mod_firewall: Fix for deps dynamically including deps
Matthew Wild <mwild1@gmail.com>
parents: 2524
diff changeset
373 table.insert(code, "\n\t\t-- "..dep.."\n\t\t"..local_code.."\n");
965
d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone).
Matthew Wild <mwild1@gmail.com>
parents: 960
diff changeset
374 else
1303
8a3f3f485675 mod_firewall: Produce code with nicer indentation
Florian Zeitz <florob@babelmonkeys.de>
parents: 1052
diff changeset
375 table.insert(code, "\n\t\t-- "..dep.."\n\t\t"..dep_info.local_code.."\n");
965
d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone).
Matthew Wild <mwild1@gmail.com>
parents: 960
diff changeset
376 end
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
377 end
2583
b6b10f57aa56 mod_firewall: Fix for including the same dependency with different parameters
Matthew Wild <mwild1@gmail.com>
parents: 2580
diff changeset
378 code.included_deps[dependency] = true;
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
379 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
380
999
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
381 local definition_handlers = module:require("definitions");
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
382 local condition_handlers = module:require("conditions");
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
383 local action_handlers = module:require("actions");
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
384
5539
fa8435a27f7e mod_firewall: enable marks by default
Matthew Wild <mwild1@gmail.com>
parents: 5381
diff changeset
385 if module:get_option_boolean("firewall_experimental_user_marks", true) then
2894
165d2877eeac mod_firewall: Add experimental user-centric persistent marks behind a feature flag
Kim Alvefur <zash@zash.se>
parents: 2859
diff changeset
386 module:require"marks";
165d2877eeac mod_firewall: Add experimental user-centric persistent marks behind a feature flag
Kim Alvefur <zash@zash.se>
parents: 2859
diff changeset
387 end
165d2877eeac mod_firewall: Add experimental user-centric persistent marks behind a feature flag
Kim Alvefur <zash@zash.se>
parents: 2859
diff changeset
388
5920
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
389 local function new_rule(ruleset, chain, line_no)
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
390 assert(chain, "no chain specified");
5920
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
391 local rule = { conditions = {}, actions = {}, deps = {}, line_no = line_no };
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
392 table.insert(ruleset[chain], rule);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
393 return rule;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
394 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
395
2078
11539785cb92 mod_firewall: Split compile function into two parts in order to separate their scopes
Kim Alvefur <zash@zash.se>
parents: 2077
diff changeset
396 local function parse_firewall_rules(filename)
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
397 local line_no = 0;
1343
7dbde05b48a9 all the things: Remove trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 1325
diff changeset
398
956
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
399 local function errmsg(err)
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
400 return "Error compiling "..filename.." on line "..line_no..": "..err;
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
401 end
1343
7dbde05b48a9 all the things: Remove trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 1325
diff changeset
402
5920
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
403 local metadata = { debug = {} };
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
404 local ruleset = {
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
405 deliver = {};
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
406 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
407
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
408 local chain = "deliver"; -- Default chain
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
409 local rule;
1343
7dbde05b48a9 all the things: Remove trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 1325
diff changeset
410
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
411 local file, err = io.open(filename);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
412 if not file then return nil, err; end
1343
7dbde05b48a9 all the things: Remove trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 1325
diff changeset
413
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
414 local state; -- nil -> "rules" -> "actions" -> nil -> ...
1343
7dbde05b48a9 all the things: Remove trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 1325
diff changeset
415
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
416 local line_hold;
6509
f61564e11d3b various: Adjust for loop variables becoming constants in Lua 5.5
Kim Alvefur <zash@zash.se>
parents: 6504
diff changeset
417 for rawline in file:lines() do
f61564e11d3b various: Adjust for loop variables becoming constants in Lua 5.5
Kim Alvefur <zash@zash.se>
parents: 6504
diff changeset
418 local line = rawline:match("^%s*(.-)%s*$");
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
419 if line_hold and line:sub(-1,-1) ~= "\\" then
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
420 line = line_hold..line;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
421 line_hold = nil;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
422 elseif line:sub(-1,-1) == "\\" then
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
423 line_hold = (line_hold or "")..line:sub(1,-2);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
424 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
425 line_no = line_no + 1;
1343
7dbde05b48a9 all the things: Remove trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 1325
diff changeset
426
2080
a435db77a5e5 mod_firewall: Silence warning about empty if branch [luacheck]
Kim Alvefur <zash@zash.se>
parents: 2078
diff changeset
427 if line_hold or line:find("^[#;]") then -- luacheck: ignore 542
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
428 -- No action; comment or partial line
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
429 elseif line == "" then
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
430 if state == "rules" then
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
431 return nil, ("Expected an action on line %d for preceding criteria")
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
432 :format(line_no);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
433 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
434 state = nil;
2070
2356114ff505 mod_firewall: Optimize string match operations, string.find is faster than .match since no string is returned
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
435 elseif not(state) and line:sub(1, 2) == "::" then
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
436 chain = line:gsub("^::%s*", "");
980
aeb11522a44f mod_firewall: Fix variable name
Kim Alvefur <zash@zash.se>
parents: 971
diff changeset
437 local chain_info = chains[chain];
956
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
438 if not chain_info then
2364
17d236129118 mod_firewall: Allow implicit defitions of chains in scripts if they begin with 'user/'
Matthew Wild <mwild1@gmail.com>
parents: 2342
diff changeset
439 if chain:match("^user/") then
2558
2b533a7b5236 mod_firewall: Make PASS bubble up through all chains, and add DEFAULT and RETURN
Matthew Wild <mwild1@gmail.com>
parents: 2550
diff changeset
440 chains[chain] = { type = "event", priority = 1, pass_return = false };
2364
17d236129118 mod_firewall: Allow implicit defitions of chains in scripts if they begin with 'user/'
Matthew Wild <mwild1@gmail.com>
parents: 2342
diff changeset
441 else
17d236129118 mod_firewall: Allow implicit defitions of chains in scripts if they begin with 'user/'
Matthew Wild <mwild1@gmail.com>
parents: 2342
diff changeset
442 return nil, errmsg("Unknown chain: "..chain);
17d236129118 mod_firewall: Allow implicit defitions of chains in scripts if they begin with 'user/'
Matthew Wild <mwild1@gmail.com>
parents: 2342
diff changeset
443 end
956
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
444 elseif chain_info.type ~= "event" then
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
445 return nil, errmsg("Only event chains supported at the moment");
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
446 end
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
447 ruleset[chain] = ruleset[chain] or {};
5920
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
448 elseif not(state) and line:sub(1, 2) == "@@" then
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
449 local k, v = line:match("^@@%s*([^%s=]+)%s*=%s*(.+)$");
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
450 if not k then
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
451 return nil, errmsg("Unable to parse metadata assignment (expected '@@ key = value')");
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
452 end
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
453 metadata[k] = v;
2070
2356114ff505 mod_firewall: Optimize string match operations, string.find is faster than .match since no string is returned
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
454 elseif not(state) and line:sub(1,1) == "%" then -- Definition (zone, limit, etc.)
4582
cc20493018f6 mod_firewall: Allow underscores in definition names
Matthew Wild <mwild1@gmail.com>
parents: 3981
diff changeset
455 local what, name = line:match("^%%%s*([%w_]+) +([^ :]+)");
999
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
456 if not definition_handlers[what] then
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
457 return nil, errmsg("Definition of unknown object: "..what);
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
458 elseif not name or not idsafe(name) then
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
459 return nil, errmsg("Invalid "..what.." name");
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
460 end
999
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
461
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
462 local val = line:match(": ?(.*)$");
2070
2356114ff505 mod_firewall: Optimize string match operations, string.find is faster than .match since no string is returned
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
463 if not val and line:find(":<") then -- Read from file
999
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
464 local fn = line:match(":< ?(.-)%s*$");
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
465 if not fn then
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
466 return nil, errmsg("Unable to parse filename");
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
467 end
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
468 local f, err = io.open(fn);
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
469 if not f then return nil, errmsg(err); end
2526
b2fc41001c8e mod_firewall: Fix pattern
Matthew Wild <mwild1@gmail.com>
parents: 2525
diff changeset
470 val = f:read("*a"):gsub("\r?\n", " "):gsub("%s+$", "");
999
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
471 end
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
472 if not val then
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
473 return nil, errmsg("No value given for definition");
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
474 end
2550
19a182651a9b mod_firewall: Allow backslash escapes in definitions
Matthew Wild <mwild1@gmail.com>
parents: 2549
diff changeset
475 val = stripslashes(val);
999
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
476 local ok, ret = pcall(definition_handlers[what], name, val);
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
477 if not ok then
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
478 return nil, errmsg(ret);
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
479 end
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
480
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
481 if not active_definitions[what] then
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
482 active_definitions[what] = {};
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
483 end
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
484 active_definitions[what][name] = ret;
2539
1510b66a43fc mod_firewall: Allow using spaces instead of underscores in actions, as well as conditions
Matthew Wild <mwild1@gmail.com>
parents: 2538
diff changeset
485 elseif line:find("^[%w_ ]+[%.=]") then
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
486 -- Action
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
487 if state == nil then
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
488 -- This is a standalone action with no conditions
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
489 rule = new_rule(ruleset, chain);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
490 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
491 state = "actions";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
492 -- Action handlers?
2539
1510b66a43fc mod_firewall: Allow using spaces instead of underscores in actions, as well as conditions
Matthew Wild <mwild1@gmail.com>
parents: 2538
diff changeset
493 local action = line:match("^[%w_ ]+"):upper():gsub(" ", "_");
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
494 if not action_handlers[action] then
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
495 return nil, ("Unknown action on line %d: %s"):format(line_no, action or "<unknown>");
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
496 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
497 table.insert(rule.actions, "-- "..line)
956
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
498 local ok, action_string, action_deps = pcall(action_handlers[action], line:match("=(.+)$"));
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
499 if not ok then
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
500 return nil, errmsg(action_string);
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
501 end
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
502 table.insert(rule.actions, action_string);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
503 for _, dep in ipairs(action_deps or {}) do
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
504 table.insert(rule.deps, dep);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
505 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
506 elseif state == "actions" then -- state is actions but action pattern did not match
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
507 state = nil; -- Awaiting next rule, etc.
5920
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
508 table.insert(ruleset[chain], rule); -- FIXME: Is this a bug? Rule should have already been inserted by new_rule()?
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
509 rule = nil;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
510 else
5920
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
511 -- Condition
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
512 if not state then -- Starting a new rule block?
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
513 state = "rules";
5920
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
514 rule = new_rule(ruleset, chain, line_no);
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
515 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
516 -- Check standard modifiers for the condition (e.g. NOT)
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
517 local negated;
2404
9af2d36567a8 mod_firewall: Allow conditions to end with a question mark
Kim Alvefur <zash@zash.se>
parents: 2402
diff changeset
518 local condition = line:match("^[^:=%.?]*");
2070
2356114ff505 mod_firewall: Optimize string match operations, string.find is faster than .match since no string is returned
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
519 if condition:find("%f[%w]NOT%f[^%w]") then
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
520 local s, e = condition:match("%f[%w]()NOT()%f[^%w]");
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
521 condition = (condition:sub(1,s-1)..condition:sub(e+1, -1)):match("^%s*(.-)%s*$");
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
522 negated = true;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
523 end
998
6fdcebbd2284 mod_firewall: Fix conditions with spaces
Matthew Wild <mwild1@gmail.com>
parents: 996
diff changeset
524 condition = condition:gsub(" ", "_");
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
525 if not condition_handlers[condition] then
998
6fdcebbd2284 mod_firewall: Fix conditions with spaces
Matthew Wild <mwild1@gmail.com>
parents: 996
diff changeset
526 return nil, ("Unknown condition on line %d: %s"):format(line_no, (condition:gsub("_", " ")));
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
527 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
528 -- Get the code for this condition
956
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
529 local ok, condition_code, condition_deps = pcall(condition_handlers[condition], line:match(":%s?(.+)$"));
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
530 if not ok then
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
531 return nil, errmsg(condition_code);
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
532 end
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
533 if negated then condition_code = "not("..condition_code..")"; end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
534 table.insert(rule.conditions, condition_code);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
535 for _, dep in ipairs(condition_deps or {}) do
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
536 table.insert(rule.deps, dep);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
537 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
538 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
539 end
5920
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
540 return ruleset, metadata;
2078
11539785cb92 mod_firewall: Split compile function into two parts in order to separate their scopes
Kim Alvefur <zash@zash.se>
parents: 2077
diff changeset
541 end
1343
7dbde05b48a9 all the things: Remove trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 1325
diff changeset
542
5920
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
543 local function process_firewall_rules(ruleset, metadata)
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
544 -- Compile ruleset and return complete code
1343
7dbde05b48a9 all the things: Remove trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 1325
diff changeset
545
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
546 local chain_handlers = {};
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
547
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
548 -- Loop through the chains in the parsed ruleset (e.g. incoming, outgoing)
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
549 for chain_name, rules in pairs(ruleset) do
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
550 local code = { included_deps = {}, global_header = {} };
1304
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
551 local condition_uses = {};
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
552 -- This inner loop assumes chain is an event-based, not a filter-based
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
553 -- chain (filter-based will be added later)
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
554 for _, rule in ipairs(rules) do
1304
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
555 for _, condition in ipairs(rule.conditions) do
2070
2356114ff505 mod_firewall: Optimize string match operations, string.find is faster than .match since no string is returned
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
556 if condition:find("^not%(.+%)$") then
1304
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
557 condition = condition:match("^not%((.+)%)$");
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
558 end
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
559 condition_uses[condition] = (condition_uses[condition] or 0) + 1;
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
560 end
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
561 end
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
562
5920
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
563 if metadata.trace then
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
564 include_dep("trace", code);
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
565 table.insert(code, ("local trace = trace_init(%q, %q);"):format(metadata.filename, chain_name))
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
566 end
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
567
1304
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
568 local condition_cache, n_conditions = {}, 0;
5920
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
569 for rule_n, rule in ipairs(rules) do
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
570 for _, dep in ipairs(rule.deps) do
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
571 include_dep(dep, code);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
572 end
1303
8a3f3f485675 mod_firewall: Produce code with nicer indentation
Florian Zeitz <florob@babelmonkeys.de>
parents: 1052
diff changeset
573 table.insert(code, "\n\t\t");
8a3f3f485675 mod_firewall: Produce code with nicer indentation
Florian Zeitz <florob@babelmonkeys.de>
parents: 1052
diff changeset
574 local rule_code;
967
a88f33fe6970 mod_firewall: Don't add empty conditions check when no conditions are listed in a rule
Matthew Wild <mwild1@gmail.com>
parents: 966
diff changeset
575 if #rule.conditions > 0 then
996
37af655ca575 mod_firewall: Cache conditions, so that they are only calculated once per chain execution
Matthew Wild <mwild1@gmail.com>
parents: 980
diff changeset
576 for i, condition in ipairs(rule.conditions) do
1001
c0850793b716 mod_firewall: don't use %b() (not technically correct)
Matthew Wild <mwild1@gmail.com>
parents: 999
diff changeset
577 local negated = condition:match("^not%(.+%)$");
996
37af655ca575 mod_firewall: Cache conditions, so that they are only calculated once per chain execution
Matthew Wild <mwild1@gmail.com>
parents: 980
diff changeset
578 if negated then
37af655ca575 mod_firewall: Cache conditions, so that they are only calculated once per chain execution
Matthew Wild <mwild1@gmail.com>
parents: 980
diff changeset
579 condition = condition:match("^not%((.+)%)$");
37af655ca575 mod_firewall: Cache conditions, so that they are only calculated once per chain execution
Matthew Wild <mwild1@gmail.com>
parents: 980
diff changeset
580 end
1304
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
581 if condition_uses[condition] > 1 then
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
582 local name = condition_cache[condition];
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
583 if not name then
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
584 n_conditions = n_conditions + 1;
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
585 name = "condition"..n_conditions;
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
586 condition_cache[condition] = name;
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
587 table.insert(code, "local "..name.." = "..condition..";\n\t\t");
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
588 end
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
589 rule.conditions[i] = (negated and "not(" or "")..name..(negated and ")" or "");
996
37af655ca575 mod_firewall: Cache conditions, so that they are only calculated once per chain execution
Matthew Wild <mwild1@gmail.com>
parents: 980
diff changeset
590 else
1304
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
591 rule.conditions[i] = (negated and "not(" or "(")..condition..")";
996
37af655ca575 mod_firewall: Cache conditions, so that they are only calculated once per chain execution
Matthew Wild <mwild1@gmail.com>
parents: 980
diff changeset
592 end
5920
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
593
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
594 if metadata.trace then
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
595 -- Wrap each condition in a tracer
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
596 rule.conditions[i] = ("trace(%d, %d, %s)"):format(rule_n, i, rule.conditions[i]);
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
597 end
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
598 end
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
599
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
600 if metadata.trace then
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
601 -- Trace overall action
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
602 table.insert(rule.actions, 1, ("trace(%d, nil, true)"):format(rule_n));
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
603 table.insert(rule.actions, ("else trace(%d, nil, false)"):format(rule_n));
996
37af655ca575 mod_firewall: Cache conditions, so that they are only calculated once per chain execution
Matthew Wild <mwild1@gmail.com>
parents: 980
diff changeset
604 end
1304
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use
Florian Zeitz <florob@babelmonkeys.de>
parents: 1303
diff changeset
605
1303
8a3f3f485675 mod_firewall: Produce code with nicer indentation
Florian Zeitz <florob@babelmonkeys.de>
parents: 1052
diff changeset
606 rule_code = "if "..table.concat(rule.conditions, " and ").." then\n\t\t\t"
8a3f3f485675 mod_firewall: Produce code with nicer indentation
Florian Zeitz <florob@babelmonkeys.de>
parents: 1052
diff changeset
607 ..table.concat(rule.actions, "\n\t\t\t")
8a3f3f485675 mod_firewall: Produce code with nicer indentation
Florian Zeitz <florob@babelmonkeys.de>
parents: 1052
diff changeset
608 .."\n\t\tend\n";
8a3f3f485675 mod_firewall: Produce code with nicer indentation
Florian Zeitz <florob@babelmonkeys.de>
parents: 1052
diff changeset
609 else
8a3f3f485675 mod_firewall: Produce code with nicer indentation
Florian Zeitz <florob@babelmonkeys.de>
parents: 1052
diff changeset
610 rule_code = table.concat(rule.actions, "\n\t\t");
967
a88f33fe6970 mod_firewall: Don't add empty conditions check when no conditions are listed in a rule
Matthew Wild <mwild1@gmail.com>
parents: 966
diff changeset
611 end
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
612 table.insert(code, rule_code);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
613 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
614
999
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
615 for name in pairs(definition_handlers) do
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
616 table.insert(code.global_header, 1, "local "..name:lower().."s = definitions."..name..";");
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
617 end
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
618
2558
2b533a7b5236 mod_firewall: Make PASS bubble up through all chains, and add DEFAULT and RETURN
Matthew Wild <mwild1@gmail.com>
parents: 2550
diff changeset
619 local code_string = "return function (definitions, fire_event, log, module, pass_return)\n\t"
1303
8a3f3f485675 mod_firewall: Produce code with nicer indentation
Florian Zeitz <florob@babelmonkeys.de>
parents: 1052
diff changeset
620 ..table.concat(code.global_header, "\n\t")
8a3f3f485675 mod_firewall: Produce code with nicer indentation
Florian Zeitz <florob@babelmonkeys.de>
parents: 1052
diff changeset
621 .."\n\tlocal db = require 'util.debug';\n\n\t"
8a3f3f485675 mod_firewall: Produce code with nicer indentation
Florian Zeitz <florob@babelmonkeys.de>
parents: 1052
diff changeset
622 .."return function (event)\n\t\t"
8a3f3f485675 mod_firewall: Produce code with nicer indentation
Florian Zeitz <florob@babelmonkeys.de>
parents: 1052
diff changeset
623 .."local stanza, session = event.stanza, event.origin;\n"
8a3f3f485675 mod_firewall: Produce code with nicer indentation
Florian Zeitz <florob@babelmonkeys.de>
parents: 1052
diff changeset
624 ..table.concat(code, "")
8a3f3f485675 mod_firewall: Produce code with nicer indentation
Florian Zeitz <florob@babelmonkeys.de>
parents: 1052
diff changeset
625 .."\n\tend;\nend";
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
626
956
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
627 chain_handlers[chain_name] = code_string;
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
628 end
1343
7dbde05b48a9 all the things: Remove trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 1325
diff changeset
629
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
630 return chain_handlers;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
631 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
632
2078
11539785cb92 mod_firewall: Split compile function into two parts in order to separate their scopes
Kim Alvefur <zash@zash.se>
parents: 2077
diff changeset
633 local function compile_firewall_rules(filename)
5920
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
634 local ruleset, metadata = parse_firewall_rules(filename);
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
635 if not ruleset then return nil, metadata; end
254a21a104aa mod_server_contact_info: Backport from prosody trunk
Matthew Wild <mwild1@gmail.com>
parents: 5866
diff changeset
636 local chain_handlers = process_firewall_rules(ruleset, metadata);
2078
11539785cb92 mod_firewall: Split compile function into two parts in order to separate their scopes
Kim Alvefur <zash@zash.se>
parents: 2077
diff changeset
637 return chain_handlers;
11539785cb92 mod_firewall: Split compile function into two parts in order to separate their scopes
Kim Alvefur <zash@zash.se>
parents: 2077
diff changeset
638 end
11539785cb92 mod_firewall: Split compile function into two parts in order to separate their scopes
Kim Alvefur <zash@zash.se>
parents: 2077
diff changeset
639
2558
2b533a7b5236 mod_firewall: Make PASS bubble up through all chains, and add DEFAULT and RETURN
Matthew Wild <mwild1@gmail.com>
parents: 2550
diff changeset
640 -- Compile handler code into a factory that produces a valid event handler. Factory accepts
2b533a7b5236 mod_firewall: Make PASS bubble up through all chains, and add DEFAULT and RETURN
Matthew Wild <mwild1@gmail.com>
parents: 2550
diff changeset
641 -- a value to be returned on PASS
956
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
642 local function compile_handler(code_string, filename)
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
643 -- Prepare event handler function
3981
7e8f2e36419d mod_firewall: Use util.envload instead of deprecated loadstring (thanks Martin)
Kim Alvefur <zash@zash.se>
parents: 2928
diff changeset
644 local chunk, err = envload(code_string, "="..filename, _G);
956
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
645 if not chunk then
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
646 return nil, "Error compiling (probably a compiler bug, please report): "..err;
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
647 end
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
648 local function fire_event(name, data)
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
649 return module:fire_event(name, data);
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
650 end
5381
32a9817c7516 mod_firewall: Initialize compiled chunk just once for all handlers
Matthew Wild <mwild1@gmail.com>
parents: 5160
diff changeset
651 local init_ok, initialized_chunk = pcall(chunk);
32a9817c7516 mod_firewall: Initialize compiled chunk just once for all handlers
Matthew Wild <mwild1@gmail.com>
parents: 5160
diff changeset
652 if not init_ok then
32a9817c7516 mod_firewall: Initialize compiled chunk just once for all handlers
Matthew Wild <mwild1@gmail.com>
parents: 5160
diff changeset
653 return nil, "Error initializing compiled rules: "..initialized_chunk;
32a9817c7516 mod_firewall: Initialize compiled chunk just once for all handlers
Matthew Wild <mwild1@gmail.com>
parents: 5160
diff changeset
654 end
2558
2b533a7b5236 mod_firewall: Make PASS bubble up through all chains, and add DEFAULT and RETURN
Matthew Wild <mwild1@gmail.com>
parents: 2550
diff changeset
655 return function (pass_return)
5381
32a9817c7516 mod_firewall: Initialize compiled chunk just once for all handlers
Matthew Wild <mwild1@gmail.com>
parents: 5160
diff changeset
656 return initialized_chunk(active_definitions, fire_event, logger(filename), module, pass_return); -- Returns event handler with upvalues
2558
2b533a7b5236 mod_firewall: Make PASS bubble up through all chains, and add DEFAULT and RETURN
Matthew Wild <mwild1@gmail.com>
parents: 2550
diff changeset
657 end
956
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
658 end
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions
Matthew Wild <mwild1@gmail.com>
parents: 955
diff changeset
659
2366
14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file
Matthew Wild <mwild1@gmail.com>
parents: 2365
diff changeset
660 local function resolve_script_path(script_path)
14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file
Matthew Wild <mwild1@gmail.com>
parents: 2365
diff changeset
661 local relative_to = prosody.paths.config;
14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file
Matthew Wild <mwild1@gmail.com>
parents: 2365
diff changeset
662 if script_path:match("^module:") then
5834
866a49f5aa61 mod_firewall: Fix to find scripts when installed with plugin installer
Kim Alvefur <zash@zash.se>
parents: 5793
diff changeset
663 relative_to = module:get_directory();
2366
14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file
Matthew Wild <mwild1@gmail.com>
parents: 2365
diff changeset
664 script_path = script_path:match("^module:(.+)$");
14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file
Matthew Wild <mwild1@gmail.com>
parents: 2365
diff changeset
665 end
14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file
Matthew Wild <mwild1@gmail.com>
parents: 2365
diff changeset
666 return resolve_relative_path(relative_to, script_path);
14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file
Matthew Wild <mwild1@gmail.com>
parents: 2365
diff changeset
667 end
14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file
Matthew Wild <mwild1@gmail.com>
parents: 2365
diff changeset
668
2578
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
669 -- [filename] = { last_modified = ..., events_hooked = { [name] = handler } }
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
670 local loaded_scripts = {};
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
671
2574
f65c5927ee8e mod_firewall: Factor out script loading
Matthew Wild <mwild1@gmail.com>
parents: 2573
diff changeset
672 function load_script(script)
f65c5927ee8e mod_firewall: Factor out script loading
Matthew Wild <mwild1@gmail.com>
parents: 2573
diff changeset
673 script = resolve_script_path(script);
2578
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
674 local last_modified = (lfs.attributes(script) or {}).modification or os.time();
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
675 if loaded_scripts[script] then
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
676 if loaded_scripts[script].last_modified == last_modified then
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
677 return; -- Already loaded, and source file hasn't changed
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
678 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
679 module:log("debug", "Reloading %s", script);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
680 -- Already loaded, but the source file has changed
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
681 -- unload it now, and we'll load the new version below
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
682 unload_script(script, true);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
683 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
684 local chain_functions, err = compile_firewall_rules(script);
2859
22e11645a895 mod_firewall: Trim trailing whitespace [luacheck]
Kim Alvefur <zash@zash.se>
parents: 2585
diff changeset
685
2574
f65c5927ee8e mod_firewall: Factor out script loading
Matthew Wild <mwild1@gmail.com>
parents: 2573
diff changeset
686 if not chain_functions then
f65c5927ee8e mod_firewall: Factor out script loading
Matthew Wild <mwild1@gmail.com>
parents: 2573
diff changeset
687 module:log("error", "Error compiling %s: %s", script, err or "unknown error");
2578
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
688 return;
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
689 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
690
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
691 -- Loop through the chains in the script, and for each chain attach the compiled code to the
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
692 -- relevant events, keeping track in events_hooked so we can cleanly unload later
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
693 local events_hooked = {};
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
694 for chain, handler_code in pairs(chain_functions) do
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
695 local new_handler, err = compile_handler(handler_code, "mod_firewall::"..chain);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
696 if not new_handler then
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
697 module:log("error", "Compilation error for %s: %s", script, err);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
698 else
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
699 local chain_definition = chains[chain];
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
700 if chain_definition and chain_definition.type == "event" then
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
701 local handler = new_handler(chain_definition.pass_return);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
702 for _, event_name in ipairs(chain_definition) do
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
703 events_hooked[event_name] = handler;
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
704 module:hook(event_name, handler, chain_definition.priority);
2574
f65c5927ee8e mod_firewall: Factor out script loading
Matthew Wild <mwild1@gmail.com>
parents: 2573
diff changeset
705 end
6504
ce716e5e0fee mod_firewall: Fix chain name check - custom chains should begin with 'user/'
Matthew Wild <mwild1@gmail.com>
parents: 6502
diff changeset
706 elseif chain:sub(1, 5) ~= "user/" then
2578
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
707 module:log("warn", "Unknown chain %q", chain);
2574
f65c5927ee8e mod_firewall: Factor out script loading
Matthew Wild <mwild1@gmail.com>
parents: 2573
diff changeset
708 end
2578
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
709 local event_name, handler = "firewall/chains/"..chain, new_handler(false);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
710 events_hooked[event_name] = handler;
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
711 module:hook(event_name, handler);
2574
f65c5927ee8e mod_firewall: Factor out script loading
Matthew Wild <mwild1@gmail.com>
parents: 2573
diff changeset
712 end
f65c5927ee8e mod_firewall: Factor out script loading
Matthew Wild <mwild1@gmail.com>
parents: 2573
diff changeset
713 end
2578
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
714 loaded_scripts[script] = { last_modified = last_modified, events_hooked = events_hooked };
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
715 module:log("debug", "Loaded %s", script);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
716 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
717
2580
aaff2716f022 mod_firewall: Compatibility fix for 0.9 (no module:unhook())
Matthew Wild <mwild1@gmail.com>
parents: 2579
diff changeset
718 --COMPAT w/0.9 (no module:unhook()!)
aaff2716f022 mod_firewall: Compatibility fix for 0.9 (no module:unhook())
Matthew Wild <mwild1@gmail.com>
parents: 2579
diff changeset
719 local function module_unhook(event, handler)
aaff2716f022 mod_firewall: Compatibility fix for 0.9 (no module:unhook())
Matthew Wild <mwild1@gmail.com>
parents: 2579
diff changeset
720 return module:unhook_object_event((hosts[module.host] or prosody).events, event, handler);
aaff2716f022 mod_firewall: Compatibility fix for 0.9 (no module:unhook())
Matthew Wild <mwild1@gmail.com>
parents: 2579
diff changeset
721 end
aaff2716f022 mod_firewall: Compatibility fix for 0.9 (no module:unhook())
Matthew Wild <mwild1@gmail.com>
parents: 2579
diff changeset
722
2578
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
723 function unload_script(script, is_reload)
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
724 script = resolve_script_path(script);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
725 local script_info = loaded_scripts[script];
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
726 if not script_info then
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
727 return; -- Script not loaded
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
728 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
729 local events_hooked = script_info.events_hooked;
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
730 for event_name, event_handler in pairs(events_hooked) do
2580
aaff2716f022 mod_firewall: Compatibility fix for 0.9 (no module:unhook())
Matthew Wild <mwild1@gmail.com>
parents: 2579
diff changeset
731 module_unhook(event_name, event_handler);
2578
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
732 events_hooked[event_name] = nil;
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
733 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
734 loaded_scripts[script] = nil;
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
735 if not is_reload then
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
736 module:log("debug", "Unloaded %s", script);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
737 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
738 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
739
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
740 -- Given a set of scripts (e.g. from config) figure out which ones need to
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
741 -- be loaded, which are already loaded but need unloading, and which to reload
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
742 function load_unload_scripts(script_list)
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
743 local wanted_scripts = script_list / resolve_script_path;
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
744 local currently_loaded = set.new(it.to_array(it.keys(loaded_scripts)));
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
745 local scripts_to_unload = currently_loaded - wanted_scripts;
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
746 for script in wanted_scripts do
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
747 -- If the script is already loaded, this is fine - it will
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
748 -- reload the script for us if the file has changed
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
749 load_script(script);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
750 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
751 for script in scripts_to_unload do
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
752 unload_script(script);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
753 end
2574
f65c5927ee8e mod_firewall: Factor out script loading
Matthew Wild <mwild1@gmail.com>
parents: 2573
diff changeset
754 end
f65c5927ee8e mod_firewall: Factor out script loading
Matthew Wild <mwild1@gmail.com>
parents: 2573
diff changeset
755
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
756 function module.load()
1052
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command
Kim Alvefur <zash@zash.se>
parents: 1051
diff changeset
757 if not prosody.arg then return end -- Don't run in prosodyctl
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
758 local firewall_scripts = module:get_option_set("firewall_scripts", {});
2578
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
759 load_unload_scripts(firewall_scripts);
999
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
760 -- Replace contents of definitions table (shared) with active definitions
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
761 for k in it.keys(definitions) do definitions[k] = nil; end
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with %
Matthew Wild <mwild1@gmail.com>
parents: 998
diff changeset
762 for k,v in pairs(active_definitions) do definitions[k] = v; end
947
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
763 end
1052
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command
Kim Alvefur <zash@zash.se>
parents: 1051
diff changeset
764
2578
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
765 function module.save()
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
766 return { active_definitions = active_definitions, loaded_scripts = loaded_scripts };
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
767 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
768
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
769 function module.restore(state)
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
770 active_definitions = state.active_definitions;
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
771 loaded_scripts = state.loaded_scripts;
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
772 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
773
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
774 module:hook_global("config-reloaded", function ()
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
775 load_unload_scripts(module:get_option_set("firewall_scripts", {}));
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
776 end);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts
Matthew Wild <mwild1@gmail.com>
parents: 2574
diff changeset
777
1052
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command
Kim Alvefur <zash@zash.se>
parents: 1051
diff changeset
778 function module.command(arg)
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command
Kim Alvefur <zash@zash.se>
parents: 1051
diff changeset
779 if not arg[1] or arg[1] == "--help" then
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command
Kim Alvefur <zash@zash.se>
parents: 1051
diff changeset
780 require"util.prosodyctl".show_usage([[mod_firewall <firewall.pfw>]], [[Compile files with firewall rules to Lua code]]);
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command
Kim Alvefur <zash@zash.se>
parents: 1051
diff changeset
781 return 1;
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command
Kim Alvefur <zash@zash.se>
parents: 1051
diff changeset
782 end
2118
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
783 local verbose = arg[1] == "-v";
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
784 if verbose then table.remove(arg, 1); end
1052
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command
Kim Alvefur <zash@zash.se>
parents: 1051
diff changeset
785
2585
02c6ae745c4f mod_firewall: Add 'test' subcommand to read stanzas from stdin and test them against rules
Matthew Wild <mwild1@gmail.com>
parents: 2584
diff changeset
786 if arg[1] == "test" then
02c6ae745c4f mod_firewall: Add 'test' subcommand to read stanzas from stdin and test them against rules
Matthew Wild <mwild1@gmail.com>
parents: 2584
diff changeset
787 table.remove(arg, 1);
02c6ae745c4f mod_firewall: Add 'test' subcommand to read stanzas from stdin and test them against rules
Matthew Wild <mwild1@gmail.com>
parents: 2584
diff changeset
788 return module:require("test")(arg);
02c6ae745c4f mod_firewall: Add 'test' subcommand to read stanzas from stdin and test them against rules
Matthew Wild <mwild1@gmail.com>
parents: 2584
diff changeset
789 end
02c6ae745c4f mod_firewall: Add 'test' subcommand to read stanzas from stdin and test them against rules
Matthew Wild <mwild1@gmail.com>
parents: 2584
diff changeset
790
2117
5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work)
Kim Alvefur <zash@zash.se>
parents: 2113
diff changeset
791 local serialize = require "util.serialization".serialize;
2118
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
792 if verbose then
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
793 print("local logger = require \"util.logger\".init;");
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
794 print();
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
795 print("local function fire_event(name, data)\n\tmodule:fire_event(name, data)\nend");
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
796 print();
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
797 end
2117
5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work)
Kim Alvefur <zash@zash.se>
parents: 2113
diff changeset
798
1052
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command
Kim Alvefur <zash@zash.se>
parents: 1051
diff changeset
799 for _, filename in ipairs(arg) do
2366
14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file
Matthew Wild <mwild1@gmail.com>
parents: 2365
diff changeset
800 filename = resolve_script_path(filename);
2117
5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work)
Kim Alvefur <zash@zash.se>
parents: 2113
diff changeset
801 print("do -- File "..filename);
2365
05dae9adf778 mod_firewall: Fix for when compiling on the command line and specifying multiple files
Matthew Wild <mwild1@gmail.com>
parents: 2364
diff changeset
802 local chain_functions = assert(compile_firewall_rules(filename));
2118
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
803 if verbose then
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
804 print();
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
805 print("local active_definitions = "..serialize(active_definitions)..";");
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
806 print();
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
807 end
2367
3ebd3cb4d7d2 mod_firewall: When compiling on the command-line with -v, ensure chain function names are unique and valid ids
Matthew Wild <mwild1@gmail.com>
parents: 2366
diff changeset
808 local c = 0;
1052
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command
Kim Alvefur <zash@zash.se>
parents: 1051
diff changeset
809 for chain, handler_code in pairs(chain_functions) do
2367
3ebd3cb4d7d2 mod_firewall: When compiling on the command-line with -v, ensure chain function names are unique and valid ids
Matthew Wild <mwild1@gmail.com>
parents: 2366
diff changeset
810 c = c + 1;
2117
5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work)
Kim Alvefur <zash@zash.se>
parents: 2113
diff changeset
811 print("---- Chain "..chain:gsub("_", " "));
2367
3ebd3cb4d7d2 mod_firewall: When compiling on the command-line with -v, ensure chain function names are unique and valid ids
Matthew Wild <mwild1@gmail.com>
parents: 2366
diff changeset
812 local chain_func_name = "chain_"..tostring(c).."_"..chain:gsub("%p", "_");
2118
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
813 if not verbose then
2367
3ebd3cb4d7d2 mod_firewall: When compiling on the command-line with -v, ensure chain function names are unique and valid ids
Matthew Wild <mwild1@gmail.com>
parents: 2366
diff changeset
814 print(("%s = %s;"):format(chain_func_name, handler_code:sub(8)));
2118
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
815 else
2117
5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work)
Kim Alvefur <zash@zash.se>
parents: 2113
diff changeset
816
2367
3ebd3cb4d7d2 mod_firewall: When compiling on the command-line with -v, ensure chain function names are unique and valid ids
Matthew Wild <mwild1@gmail.com>
parents: 2366
diff changeset
817 print(("local %s = (%s)(active_definitions, fire_event, logger(%q));"):format(chain_func_name, handler_code:sub(8), filename));
2118
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
818 print();
2117
5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work)
Kim Alvefur <zash@zash.se>
parents: 2113
diff changeset
819
2118
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
820 local chain_definition = chains[chain];
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
821 if chain_definition and chain_definition.type == "event" then
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
822 for _, event_name in ipairs(chain_definition) do
2367
3ebd3cb4d7d2 mod_firewall: When compiling on the command-line with -v, ensure chain function names are unique and valid ids
Matthew Wild <mwild1@gmail.com>
parents: 2366
diff changeset
823 print(("module:hook(%q, %s, %d);"):format(event_name, chain_func_name, chain_definition.priority or 0));
2118
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag
Kim Alvefur <zash@zash.se>
parents: 2117
diff changeset
824 end
2117
5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work)
Kim Alvefur <zash@zash.se>
parents: 2113
diff changeset
825 end
2367
3ebd3cb4d7d2 mod_firewall: When compiling on the command-line with -v, ensure chain function names are unique and valid ids
Matthew Wild <mwild1@gmail.com>
parents: 2366
diff changeset
826 print(("module:hook(%q, %s, %d);"):format("firewall/chains/"..chain, chain_func_name, chain_definition.priority or 0));
2117
5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work)
Kim Alvefur <zash@zash.se>
parents: 2113
diff changeset
827 end
5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work)
Kim Alvefur <zash@zash.se>
parents: 2113
diff changeset
828
5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work)
Kim Alvefur <zash@zash.se>
parents: 2113
diff changeset
829 print("---- End of chain "..chain);
5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work)
Kim Alvefur <zash@zash.se>
parents: 2113
diff changeset
830 print();
1052
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command
Kim Alvefur <zash@zash.se>
parents: 1051
diff changeset
831 end
2117
5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work)
Kim Alvefur <zash@zash.se>
parents: 2113
diff changeset
832 print("end -- End of file "..filename);
1052
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command
Kim Alvefur <zash@zash.se>
parents: 1051
diff changeset
833 end
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command
Kim Alvefur <zash@zash.se>
parents: 1051
diff changeset
834 end
5542
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
835
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
836
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
837 -- Console
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
838
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
839 local console_env = module:shared("/*/admin_shell/env");
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
840
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
841 console_env.firewall = {};
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
842
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
843 function console_env.firewall:mark(user_jid, mark_name)
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
844 local username, host = jid.split(user_jid);
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
845 if not username or not hosts[host] then
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
846 return nil, "Invalid JID supplied";
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
847 elseif not idsafe(mark_name) then
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
848 return nil, "Invalid characters in mark name";
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
849 end
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
850 if not module:context(host):fire_event("firewall/marked/user", {
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
851 username = session.username;
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
852 mark = mark_name;
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
853 timestamp = os.time();
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
854 }) then
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
855 return nil, "Mark not set - is mod_firewall loaded on that host?";
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
856 end
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
857 return true, "User marked";
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
858 end
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
859
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
860 function console_env.firewall:unmark(jid, mark_name)
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
861 local username, host = jid.split(user_jid);
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
862 if not username or not hosts[host] then
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
863 return nil, "Invalid JID supplied";
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
864 elseif not idsafe(mark_name) then
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
865 return nil, "Invalid characters in mark name";
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
866 end
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
867 if not module:context(host):fire_event("firewall/unmarked/user", {
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
868 username = session.username;
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
869 mark = mark_name;
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
870 }) then
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
871 return nil, "Mark not removed - is mod_firewall loaded on that host?";
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
872 end
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
873 return true, "User unmarked";
048284447643 mod_firewall: Add console commands to mark/unmark users
Matthew Wild <mwild1@gmail.com>
parents: 5539
diff changeset
874 end