prosody-modules: mod_firewall/mod

annotate mod_firewall/mod_firewall.lua @ 6556:7477e97a9045

mod_firewall: Apply pre-reload state before re-reading config This change makes load/reload a bit more robust. module.load() runs before module.restore() and it reads from the config and updates the state (if needed). However, after this, module.restore() could run and apply the old state again.

author	Matthew Wild <mwild1@gmail.com>
date	Sun, 24 May 2026 20:03:20 +0100
parents	d81bb13c0e87
children	15a7749c7acb

rev	line source
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	1
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	2 local lfs = require "lfs";
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	3 local resolve_relative_path = require "core.configmanager".resolve_relative_path;
3981 7e8f2e36419d mod_firewall: Use util.envload instead of deprecated loadstring (thanks Martin) Kim Alvefur <zash@zash.se> parents: 2928 diff changeset	4 local envload = require "util.envload".envload;
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	5 local logger = require "util.logger".init;
971 53e158e44a44 mod_firewall: Add rate limiting capabilities, and keep zones and throttle objects in shared tables Matthew Wild <mwild1@gmail.com> parents: 967 diff changeset	6 local it = require "util.iterators";
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	7 local set = require "util.set";
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	8
5002 84997bc3f92e mod_firewall: Update for role-auth (backwards compatible) Matthew Wild <mwild1@gmail.com> parents: 4608 diff changeset	9 local have_features, features = pcall(require, "core.features");
84997bc3f92e mod_firewall: Update for role-auth (backwards compatible) Matthew Wild <mwild1@gmail.com> parents: 4608 diff changeset	10 features = have_features and features.available or set.new();
84997bc3f92e mod_firewall: Update for role-auth (backwards compatible) Matthew Wild <mwild1@gmail.com> parents: 4608 diff changeset	11
2579 5e948d1392a5 mod_firewall: Add some comments Matthew Wild <mwild1@gmail.com> parents: 2578 diff changeset	12 -- [definition_type] = definition_factory(param)
999 197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	13 local definitions = module:shared("definitions");
2579 5e948d1392a5 mod_firewall: Add some comments Matthew Wild <mwild1@gmail.com> parents: 2578 diff changeset	14
5e948d1392a5 mod_firewall: Add some comments Matthew Wild <mwild1@gmail.com> parents: 2578 diff changeset	15 -- When a definition instance has been instantiated, it lives here
5e948d1392a5 mod_firewall: Add some comments Matthew Wild <mwild1@gmail.com> parents: 2578 diff changeset	16 -- [definition_type][definition_name] = definition_object
2374 d630fa0d4dba mod_firewall: Add default zone called '$local' containing all local hosts (dynamically) Matthew Wild <mwild1@gmail.com> parents: 2368 diff changeset	17 local active_definitions = {
d630fa0d4dba mod_firewall: Add default zone called '$local' containing all local hosts (dynamically) Matthew Wild <mwild1@gmail.com> parents: 2368 diff changeset	18 ZONE = {
d630fa0d4dba mod_firewall: Add default zone called '$local' containing all local hosts (dynamically) Matthew Wild <mwild1@gmail.com> parents: 2368 diff changeset	19 -- Default zone that includes all local hosts
d630fa0d4dba mod_firewall: Add default zone called '$local' containing all local hosts (dynamically) Matthew Wild <mwild1@gmail.com> parents: 2368 diff changeset	20 ["$local"] = setmetatable({}, { __index = prosody.hosts });
2527 5ff7eb601d60 mod_firewall: Code formatting Matthew Wild <mwild1@gmail.com> parents: 2526 diff changeset	21 };
2374 d630fa0d4dba mod_firewall: Add default zone called '$local' containing all local hosts (dynamically) Matthew Wild <mwild1@gmail.com> parents: 2368 diff changeset	22 };
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	23
2113 d75145297bf9 mod_firewall: Support for defining extra chains in the config file Matthew Wild <mwild1@gmail.com> parents: 2101 diff changeset	24 local default_chains = {
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	25 preroute = {
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	26 type = "event";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	27 priority = 0.1;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	28 "pre-message/bare", "pre-message/full", "pre-message/host";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	29 "pre-presence/bare", "pre-presence/full", "pre-presence/host";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	30 "pre-iq/bare", "pre-iq/full", "pre-iq/host";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	31 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	32 deliver = {
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	33 type = "event";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	34 priority = 0.1;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	35 "message/bare", "message/full", "message/host";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	36 "presence/bare", "presence/full", "presence/host";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	37 "iq/bare", "iq/full", "iq/host";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	38 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	39 deliver_remote = {
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	40 type = "event"; "route/remote";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	41 priority = 0.1;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	42 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	43 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	44
2113 d75145297bf9 mod_firewall: Support for defining extra chains in the config file Matthew Wild <mwild1@gmail.com> parents: 2101 diff changeset	45 local extra_chains = module:get_option("firewall_extra_chains", {});
d75145297bf9 mod_firewall: Support for defining extra chains in the config file Matthew Wild <mwild1@gmail.com> parents: 2101 diff changeset	46
d75145297bf9 mod_firewall: Support for defining extra chains in the config file Matthew Wild <mwild1@gmail.com> parents: 2101 diff changeset	47 local chains = {};
d75145297bf9 mod_firewall: Support for defining extra chains in the config file Matthew Wild <mwild1@gmail.com> parents: 2101 diff changeset	48 for k,v in pairs(default_chains) do
d75145297bf9 mod_firewall: Support for defining extra chains in the config file Matthew Wild <mwild1@gmail.com> parents: 2101 diff changeset	49 chains[k] = v;
d75145297bf9 mod_firewall: Support for defining extra chains in the config file Matthew Wild <mwild1@gmail.com> parents: 2101 diff changeset	50 end
d75145297bf9 mod_firewall: Support for defining extra chains in the config file Matthew Wild <mwild1@gmail.com> parents: 2101 diff changeset	51 for k,v in pairs(extra_chains) do
d75145297bf9 mod_firewall: Support for defining extra chains in the config file Matthew Wild <mwild1@gmail.com> parents: 2101 diff changeset	52 chains[k] = v;
d75145297bf9 mod_firewall: Support for defining extra chains in the config file Matthew Wild <mwild1@gmail.com> parents: 2101 diff changeset	53 end
d75145297bf9 mod_firewall: Support for defining extra chains in the config file Matthew Wild <mwild1@gmail.com> parents: 2101 diff changeset	54
2124 89363766202c mod_firewall: Add comment to document idsafe() Matthew Wild <mwild1@gmail.com> parents: 2118 diff changeset	55 -- Returns the input if it is safe to be used as a variable name, otherwise nil
2099 a8c701631d0b mod_firewall: Make idsafe() a global function so libraries can re-use it Matthew Wild <mwild1@gmail.com> parents: 2080 diff changeset	56 function idsafe(name)
2527 5ff7eb601d60 mod_firewall: Code formatting Matthew Wild <mwild1@gmail.com> parents: 2526 diff changeset	57 return name:match("^%a[%w_]*$");
971 53e158e44a44 mod_firewall: Add rate limiting capabilities, and keep zones and throttle objects in shared tables Matthew Wild <mwild1@gmail.com> parents: 967 diff changeset	58 end
53e158e44a44 mod_firewall: Add rate limiting capabilities, and keep zones and throttle objects in shared tables Matthew Wild <mwild1@gmail.com> parents: 967 diff changeset	59
2518 0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	60 local meta_funcs = {
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	61 bare = function (code)
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	62 return "jid_bare("..code..")", {"jid_bare"};
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	63 end;
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	64 node = function (code)
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	65 return "(jid_split("..code.."))", {"jid_split"};
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	66 end;
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	67 host = function (code)
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	68 return "(select(2, jid_split("..code..")))", {"jid_split"};
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	69 end;
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	70 resource = function (code)
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	71 return "(select(3, jid_split("..code..")))", {"jid_split"};
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	72 end;
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	73 };
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	74
2125 edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it Matthew Wild <mwild1@gmail.com> parents: 2124 diff changeset	75 -- Run quoted (%q) strings through this to allow them to contain code. e.g.: LOG=Received: $(stanza:top_tag())
2518 0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	76 function meta(s, deps, extra)
2385 c0c2f8665c3e mod_firewall: Fix for raw code expressions that contain escape-worthy characters Matthew Wild <mwild1@gmail.com> parents: 2374 diff changeset	77 return (s:gsub("$(%b())", function (expr)
c0c2f8665c3e mod_firewall: Fix for raw code expressions that contain escape-worthy characters Matthew Wild <mwild1@gmail.com> parents: 2374 diff changeset	78 expr = expr:gsub("\\(.)", "%1");
c0c2f8665c3e mod_firewall: Fix for raw code expressions that contain escape-worthy characters Matthew Wild <mwild1@gmail.com> parents: 2374 diff changeset	79 return [["..tostring(]]..expr..[[).."]];
c0c2f8665c3e mod_firewall: Fix for raw code expressions that contain escape-worthy characters Matthew Wild <mwild1@gmail.com> parents: 2374 diff changeset	80 end)
2125 edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it Matthew Wild <mwild1@gmail.com> parents: 2124 diff changeset	81 :gsub("$(%b<>)", function (expr)
edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it Matthew Wild <mwild1@gmail.com> parents: 2124 diff changeset	82 expr = expr:sub(2,-2);
2538 a1b6a6b0aabb mod_firewall: Reinstate the ability to set a default for stanza expressions Matthew Wild <mwild1@gmail.com> parents: 2533 diff changeset	83 local default = "<undefined>";
2561 3da0e3c917cc mod_firewall: Accept backslash escapes in definitions Matthew Wild <mwild1@gmail.com> parents: 2558 diff changeset	84 expr = expr:gsub("\|\|(%b\"\")$", function (default_string)
3da0e3c917cc mod_firewall: Accept backslash escapes in definitions Matthew Wild <mwild1@gmail.com> parents: 2558 diff changeset	85 default = stripslashes(default_string:sub(2,-2));
2538 a1b6a6b0aabb mod_firewall: Reinstate the ability to set a default for stanza expressions Matthew Wild <mwild1@gmail.com> parents: 2533 diff changeset	86 return "";
a1b6a6b0aabb mod_firewall: Reinstate the ability to set a default for stanza expressions Matthew Wild <mwild1@gmail.com> parents: 2533 diff changeset	87 end);
2518 0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	88 local func_chain = expr:match("\|[%w\|]+$");
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	89 if func_chain then
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	90 expr = expr:sub(1, -1-#func_chain);
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	91 end
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	92 local code;
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	93 if expr:match("^@") then
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	94 -- Skip stanza:find() for simple attribute lookup
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	95 local attr_name = expr:sub(2);
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	96 if deps and (attr_name == "to" or attr_name == "from" or attr_name == "type") then
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	97 -- These attributes may be cached in locals
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	98 code = attr_name;
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	99 table.insert(deps, attr_name);
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	100 else
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	101 code = "stanza.attr["..("%q"):format(attr_name).."]";
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	102 end
2524 0404476ecfe3 mod_firewall: More meta() enhancements Matthew Wild <mwild1@gmail.com> parents: 2520 diff changeset	103 elseif expr:match("^%w+#$") then
0404476ecfe3 mod_firewall: More meta() enhancements Matthew Wild <mwild1@gmail.com> parents: 2520 diff changeset	104 code = ("stanza:get_child_text(%q)"):format(expr:sub(1, -2));
2368 7e1d8c46d788 mod_firewall: Support for default values in stanza paths Matthew Wild <mwild1@gmail.com> parents: 2367 diff changeset	105 else
2524 0404476ecfe3 mod_firewall: More meta() enhancements Matthew Wild <mwild1@gmail.com> parents: 2520 diff changeset	106 code = ("stanza:find(%q)"):format(expr);
2368 7e1d8c46d788 mod_firewall: Support for default values in stanza paths Matthew Wild <mwild1@gmail.com> parents: 2367 diff changeset	107 end
2518 0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	108 if func_chain then
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	109 for func_name in func_chain:gmatch("\|(%w+)") do
2573 24dbad147aef mod_firewall: Fix meta functions with to/from that weren't JID-based Matthew Wild <mwild1@gmail.com> parents: 2562 diff changeset	110 -- to/from are already available in local variables, use those if possible
24dbad147aef mod_firewall: Fix meta functions with to/from that weren't JID-based Matthew Wild <mwild1@gmail.com> parents: 2562 diff changeset	111 if (code == "to" or code == "from") and func_name == "bare" then
24dbad147aef mod_firewall: Fix meta functions with to/from that weren't JID-based Matthew Wild <mwild1@gmail.com> parents: 2562 diff changeset	112 code = "bare_"..code;
24dbad147aef mod_firewall: Fix meta functions with to/from that weren't JID-based Matthew Wild <mwild1@gmail.com> parents: 2562 diff changeset	113 table.insert(deps, code);
24dbad147aef mod_firewall: Fix meta functions with to/from that weren't JID-based Matthew Wild <mwild1@gmail.com> parents: 2562 diff changeset	114 elseif (code == "to" or code == "from") and (func_name == "node" or func_name == "host" or func_name == "resource") then
24dbad147aef mod_firewall: Fix meta functions with to/from that weren't JID-based Matthew Wild <mwild1@gmail.com> parents: 2562 diff changeset	115 table.insert(deps, "split_"..code);
24dbad147aef mod_firewall: Fix meta functions with to/from that weren't JID-based Matthew Wild <mwild1@gmail.com> parents: 2562 diff changeset	116 code = code.."_"..func_name;
2518 0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	117 else
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	118 assert(meta_funcs[func_name], "unknown function: "..func_name);
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	119 local new_code, new_deps = meta_funcs[func_name](code);
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	120 code = new_code;
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	121 if new_deps and #new_deps > 0 then
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	122 assert(deps, "function not supported here: "..func_name);
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	123 for _, dep in ipairs(new_deps) do
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	124 table.insert(deps, dep);
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	125 end
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	126 end
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	127 end
0e1054c19f9d mod_firewall: More meta! Allow simple functions to be applied to $<> expressions Matthew Wild <mwild1@gmail.com> parents: 2517 diff changeset	128 end
2125 edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it Matthew Wild <mwild1@gmail.com> parents: 2124 diff changeset	129 end
2538 a1b6a6b0aabb mod_firewall: Reinstate the ability to set a default for stanza expressions Matthew Wild <mwild1@gmail.com> parents: 2533 diff changeset	130 return "\"..tostring("..code.." or "..("%q"):format(default)..")..\"";
2125 edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it Matthew Wild <mwild1@gmail.com> parents: 2124 diff changeset	131 end)
edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it Matthew Wild <mwild1@gmail.com> parents: 2124 diff changeset	132 :gsub("$$(%a+)", extra or {})
edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it Matthew Wild <mwild1@gmail.com> parents: 2124 diff changeset	133 :gsub([[^""%.%.]], "")
edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it Matthew Wild <mwild1@gmail.com> parents: 2124 diff changeset	134 :gsub([[%.%.""$]], ""));
edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it Matthew Wild <mwild1@gmail.com> parents: 2124 diff changeset	135 end
edf5cf3c474b mod_firewall: Move meta() function to main module, and make it a global so libs can use it Matthew Wild <mwild1@gmail.com> parents: 2124 diff changeset	136
2547 eb4f45bd7fef mod_firewall: Add metaq(), like meta() but takes an unquoted string Matthew Wild <mwild1@gmail.com> parents: 2546 diff changeset	137 function metaq(s, ...)
eb4f45bd7fef mod_firewall: Add metaq(), like meta() but takes an unquoted string Matthew Wild <mwild1@gmail.com> parents: 2546 diff changeset	138 return meta(("%q"):format(s), ...);
eb4f45bd7fef mod_firewall: Add metaq(), like meta() but takes an unquoted string Matthew Wild <mwild1@gmail.com> parents: 2546 diff changeset	139 end
eb4f45bd7fef mod_firewall: Add metaq(), like meta() but takes an unquoted string Matthew Wild <mwild1@gmail.com> parents: 2546 diff changeset	140
2546 6e4494772328 mod_firewall: Add stripslashes() function Matthew Wild <mwild1@gmail.com> parents: 2544 diff changeset	141 local escape_chars = {
6e4494772328 mod_firewall: Add stripslashes() function Matthew Wild <mwild1@gmail.com> parents: 2544 diff changeset	142 a = "\a", b = "\b", f = "\f", n = "\n", r = "\r", t = "\t",
6e4494772328 mod_firewall: Add stripslashes() function Matthew Wild <mwild1@gmail.com> parents: 2544 diff changeset	143 v = "\v", ["\\"] = "\\", ["\""] = "\"", ["\'"] = "\'"
6e4494772328 mod_firewall: Add stripslashes() function Matthew Wild <mwild1@gmail.com> parents: 2544 diff changeset	144 };
6e4494772328 mod_firewall: Add stripslashes() function Matthew Wild <mwild1@gmail.com> parents: 2544 diff changeset	145 function stripslashes(s)
6e4494772328 mod_firewall: Add stripslashes() function Matthew Wild <mwild1@gmail.com> parents: 2544 diff changeset	146 return (s:gsub("\\(.)", escape_chars));
6e4494772328 mod_firewall: Add stripslashes() function Matthew Wild <mwild1@gmail.com> parents: 2544 diff changeset	147 end
6e4494772328 mod_firewall: Add stripslashes() function Matthew Wild <mwild1@gmail.com> parents: 2544 diff changeset	148
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	149 -- Dependency locations:
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	150 -- <type lib>
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	151 -- <type global>
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	152 -- function handler()
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	153 -- <local deps>
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	154 -- if <conditions> then
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	155 -- <actions>
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	156 -- end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	157 -- end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	158
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	159 local available_deps = {
1303 8a3f3f485675 mod_firewall: Produce code with nicer indentation Florian Zeitz <florob@babelmonkeys.de> parents: 1052 diff changeset	160 st = { global_code = [[local st = require "util.stanza";]]};
2544 223eea31588d mod_firewall: Add it(erators) and it_count dependencies Matthew Wild <mwild1@gmail.com> parents: 2543 diff changeset	161 it = { global_code = [[local it = require "util.iterators";]]};
223eea31588d mod_firewall: Add it(erators) and it_count dependencies Matthew Wild <mwild1@gmail.com> parents: 2543 diff changeset	162 it_count = { global_code = [[local it_count = it.count;]], depends = { "it" } };
2548 ce08a57e516b mod_firewall: Add 'current_host' variable/dependency Matthew Wild <mwild1@gmail.com> parents: 2547 diff changeset	163 current_host = { global_code = [[local current_host = module.host;]] };
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	164 jid_split = {
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	165 global_code = [[local jid_split = require "util.jid".split;]];
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	166 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	167 jid_bare = {
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	168 global_code = [[local jid_bare = require "util.jid".bare;]];
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	169 };
2412 9159f9166893 mod_firewall: Use the sender bare JID instead of 'to' for stanzas to self Kim Alvefur <zash@zash.se> parents: 2404 diff changeset	170 to = { local_code = [[local to = stanza.attr.to or jid_bare(session.full_jid);]]; depends = { "jid_bare" } };
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	171 from = { local_code = [[local from = stanza.attr.from;]] };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	172 type = { local_code = [[local type = stanza.attr.type;]] };
2415 07d7036040ee mod_firewall: Insert semicolons after some statements to prevent ambiguous syntax in output (fixes #797) Kim Alvefur <zash@zash.se> parents: 2412 diff changeset	173 name = { local_code = [[local name = stanza.name;]] };
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	174 split_to = { -- The stanza's split to address
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	175 depends = { "jid_split", "to" };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	176 local_code = [[local to_node, to_host, to_resource = jid_split(to);]];
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	177 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	178 split_from = { -- The stanza's split from address
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	179 depends = { "jid_split", "from" };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	180 local_code = [[local from_node, from_host, from_resource = jid_split(from);]];
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	181 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	182 bare_to = { depends = { "jid_bare", "to" }, local_code = "local bare_to = jid_bare(to)"};
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	183 bare_from = { depends = { "jid_bare", "from" }, local_code = "local bare_from = jid_bare(from)"};
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	184 group_contains = {
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	185 global_code = [[local group_contains = module:depends("groups").group_contains]];
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	186 };
5160 8474a3b80200 mod_firewall: Fix 'is_admin' internal dependency rule #1797 (thanks diane) Kim Alvefur <zash@zash.se> parents: 5002 diff changeset	187 is_admin = require"core.usermanager".is_admin and { global_code = [[local is_admin = require "core.usermanager".is_admin;]]} or nil;
5002 84997bc3f92e mod_firewall: Update for role-auth (backwards compatible) Matthew Wild <mwild1@gmail.com> parents: 4608 diff changeset	188 get_jid_role = require "core.usermanager".get_jid_role and { global_code = [[local get_jid_role = require "core.usermanager".get_jid_role;]] } or nil;
2418 ef95853cf900 mod_firewall: More semicolons Kim Alvefur <zash@zash.se> parents: 2416 diff changeset	189 core_post_stanza = { global_code = [[local core_post_stanza = prosody.core_post_stanza;]] };
965 d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone). Matthew Wild <mwild1@gmail.com> parents: 960 diff changeset	190 zone = { global_code = function (zone)
2928 b0d92332b87f mod_firewall: Add special case for $local zone (fixes #1090) Kim Alvefur <zash@zash.se> parents: 2894 diff changeset	191 local var = zone;
b0d92332b87f mod_firewall: Add special case for $local zone (fixes #1090) Kim Alvefur <zash@zash.se> parents: 2894 diff changeset	192 if var == "$local" then
b0d92332b87f mod_firewall: Add special case for $local zone (fixes #1090) Kim Alvefur <zash@zash.se> parents: 2894 diff changeset	193 var = "_local"; -- See #1090
b0d92332b87f mod_firewall: Add special case for $local zone (fixes #1090) Kim Alvefur <zash@zash.se> parents: 2894 diff changeset	194 else
b0d92332b87f mod_firewall: Add special case for $local zone (fixes #1090) Kim Alvefur <zash@zash.se> parents: 2894 diff changeset	195 assert(idsafe(var), "Invalid zone name: "..zone);
b0d92332b87f mod_firewall: Add special case for $local zone (fixes #1090) Kim Alvefur <zash@zash.se> parents: 2894 diff changeset	196 end
b0d92332b87f mod_firewall: Add special case for $local zone (fixes #1090) Kim Alvefur <zash@zash.se> parents: 2894 diff changeset	197 return ("local zone_%s = zones[%q] or {};"):format(var, zone);
965 d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone). Matthew Wild <mwild1@gmail.com> parents: 960 diff changeset	198 end };
966 a65df6e97d94 mod_firewall: Add time and date deps Matthew Wild <mwild1@gmail.com> parents: 965 diff changeset	199 date_time = { global_code = [[local os_date = os.date]]; local_code = [[local current_date_time = os_date("*t");]] };
a65df6e97d94 mod_firewall: Add time and date deps Matthew Wild <mwild1@gmail.com> parents: 965 diff changeset	200 time = { local_code = function (what)
a65df6e97d94 mod_firewall: Add time and date deps Matthew Wild <mwild1@gmail.com> parents: 965 diff changeset	201 local defs = {};
a65df6e97d94 mod_firewall: Add time and date deps Matthew Wild <mwild1@gmail.com> parents: 965 diff changeset	202 for field in what:gmatch("%a+") do
a65df6e97d94 mod_firewall: Add time and date deps Matthew Wild <mwild1@gmail.com> parents: 965 diff changeset	203 table.insert(defs, ("local current_%s = current_date_time.%s;"):format(field, field));
a65df6e97d94 mod_firewall: Add time and date deps Matthew Wild <mwild1@gmail.com> parents: 965 diff changeset	204 end
a65df6e97d94 mod_firewall: Add time and date deps Matthew Wild <mwild1@gmail.com> parents: 965 diff changeset	205 return table.concat(defs, " ");
a65df6e97d94 mod_firewall: Add time and date deps Matthew Wild <mwild1@gmail.com> parents: 965 diff changeset	206 end, depends = { "date_time" }; };
6386 547feb8181eb mod_firewall: Use util.time instead of prosody.util.time, for 0.12 compatibility Link Mauve <linkmauve@linkmauve.fr> parents: 6372 diff changeset	207 timestamp = { global_code = [[local get_time = require "util.time".now;]]; local_code = [[local current_timestamp = get_time();]]; };
2128 21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2126 diff changeset	208 globalthrottle = {
971 53e158e44a44 mod_firewall: Add rate limiting capabilities, and keep zones and throttle objects in shared tables Matthew Wild <mwild1@gmail.com> parents: 967 diff changeset	209 global_code = function (throttle)
53e158e44a44 mod_firewall: Add rate limiting capabilities, and keep zones and throttle objects in shared tables Matthew Wild <mwild1@gmail.com> parents: 967 diff changeset	210 assert(idsafe(throttle), "Invalid rate limit name: "..throttle);
999 197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	211 assert(active_definitions.RATE[throttle], "Unknown rate limit: "..throttle);
2128 21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2126 diff changeset	212 return ("local global_throttle_%s = rates.%s:single();"):format(throttle, throttle);
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2126 diff changeset	213 end;
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2126 diff changeset	214 };
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2126 diff changeset	215 multithrottle = {
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2126 diff changeset	216 global_code = function (throttle)
2130 9239893a2400 mod_firewall: Don't use util.cache unless it's needed, and add explanatory error if it is not available Matthew Wild <mwild1@gmail.com> parents: 2128 diff changeset	217 assert(pcall(require, "util.cache"), "Using LIMIT with 'on' requires Prosody 0.10 or higher");
2128 21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2126 diff changeset	218 assert(idsafe(throttle), "Invalid rate limit name: "..throttle);
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2126 diff changeset	219 assert(active_definitions.RATE[throttle], "Unknown rate limit: "..throttle);
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2126 diff changeset	220 return ("local multi_throttle_%s = rates.%s:multi();"):format(throttle, throttle);
971 53e158e44a44 mod_firewall: Add rate limiting capabilities, and keep zones and throttle objects in shared tables Matthew Wild <mwild1@gmail.com> parents: 967 diff changeset	221 end;
53e158e44a44 mod_firewall: Add rate limiting capabilities, and keep zones and throttle objects in shared tables Matthew Wild <mwild1@gmail.com> parents: 967 diff changeset	222 };
4608 4e8fa75cc678 mod_firewall: Remove reliance on full_sessions being a global Kim Alvefur <zash@zash.se> parents: 4582 diff changeset	223 full_sessions = {
4e8fa75cc678 mod_firewall: Remove reliance on full_sessions being a global Kim Alvefur <zash@zash.se> parents: 4582 diff changeset	224 global_code = [[local full_sessions = prosody.full_sessions;]];
4e8fa75cc678 mod_firewall: Remove reliance on full_sessions being a global Kim Alvefur <zash@zash.se> parents: 4582 diff changeset	225 };
2402 2040330586e4 mod_firewall: Split import of rostermanager into its own dependency Kim Alvefur <zash@zash.se> parents: 2385 diff changeset	226 rostermanager = {
2040330586e4 mod_firewall: Split import of rostermanager into its own dependency Kim Alvefur <zash@zash.se> parents: 2385 diff changeset	227 global_code = [[local rostermanager = require "core.rostermanager";]];
2040330586e4 mod_firewall: Split import of rostermanager into its own dependency Kim Alvefur <zash@zash.se> parents: 2385 diff changeset	228 };
2342 6848297cf40a mod_firewall: Add conditions for testing whether a sender of a stanza is in the recipient's roster (or in a certain roster group) Matthew Wild <mwild1@gmail.com> parents: 2130 diff changeset	229 roster_entry = {
2416 ade918cd9ca7 mod_firewall: Only call rostermanager if username is available (fixes #796) Kim Alvefur <zash@zash.se> parents: 2415 diff changeset	230 local_code = [[local roster_entry = (to_node and rostermanager.load_roster(to_node, to_host) or {})[bare_from];]];
2402 2040330586e4 mod_firewall: Split import of rostermanager into its own dependency Kim Alvefur <zash@zash.se> parents: 2385 diff changeset	231 depends = { "rostermanager", "split_to", "bare_from" };
2040330586e4 mod_firewall: Split import of rostermanager into its own dependency Kim Alvefur <zash@zash.se> parents: 2385 diff changeset	232 };
2520 c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2518 diff changeset	233 list = { global_code = function (list)
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2518 diff changeset	234 assert(idsafe(list), "Invalid list name: "..list);
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2518 diff changeset	235 assert(active_definitions.LIST[list], "Unknown list: "..list);
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2518 diff changeset	236 return ("local list_%s = lists[%q];"):format(list, list);
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2518 diff changeset	237 end
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2518 diff changeset	238 };
2528 44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2527 diff changeset	239 search = {
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2527 diff changeset	240 local_code = function (search_name)
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2527 diff changeset	241 local search_path = assert(active_definitions.SEARCH[search_name], "Undefined search path: "..search_name);
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2527 diff changeset	242 return ("local search_%s = tostring(stanza:find(%q) or \"\")"):format(search_name, search_path);
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2527 diff changeset	243 end;
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2527 diff changeset	244 };
2543 3c16f0a8d66c mod_firewall: Do patterns properly, instead of cheating Matthew Wild <mwild1@gmail.com> parents: 2539 diff changeset	245 pattern = {
3c16f0a8d66c mod_firewall: Do patterns properly, instead of cheating Matthew Wild <mwild1@gmail.com> parents: 2539 diff changeset	246 local_code = function (pattern_name)
3c16f0a8d66c mod_firewall: Do patterns properly, instead of cheating Matthew Wild <mwild1@gmail.com> parents: 2539 diff changeset	247 local pattern = assert(active_definitions.PATTERN[pattern_name], "Undefined pattern: "..pattern_name);
3c16f0a8d66c mod_firewall: Do patterns properly, instead of cheating Matthew Wild <mwild1@gmail.com> parents: 2539 diff changeset	248 return ("local pattern_%s = %q"):format(pattern_name, pattern);
3c16f0a8d66c mod_firewall: Do patterns properly, instead of cheating Matthew Wild <mwild1@gmail.com> parents: 2539 diff changeset	249 end;
3c16f0a8d66c mod_firewall: Do patterns properly, instead of cheating Matthew Wild <mwild1@gmail.com> parents: 2539 diff changeset	250 };
2528 44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2527 diff changeset	251 tokens = {
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2527 diff changeset	252 local_code = function (search_and_pattern)
2584 d64fc9c3cffd mod_firewall: Remove ambiguity from tokens dep parameter Matthew Wild <mwild1@gmail.com> parents: 2583 diff changeset	253 local search_name, pattern_name = search_and_pattern:match("^([^%-]+)-(.+)$");
2528 44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2527 diff changeset	254 local code = ([[local tokens_%s_%s = {};
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2527 diff changeset	255 if search_%s then
2543 3c16f0a8d66c mod_firewall: Do patterns properly, instead of cheating Matthew Wild <mwild1@gmail.com> parents: 2539 diff changeset	256 for s in search_%s:gmatch(pattern_%s) do
2528 44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2527 diff changeset	257 tokens_%s_%s[s] = true;
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2527 diff changeset	258 end
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2527 diff changeset	259 end
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2527 diff changeset	260 ]]):format(search_name, pattern_name, search_name, search_name, pattern_name, search_name, pattern_name);
2543 3c16f0a8d66c mod_firewall: Do patterns properly, instead of cheating Matthew Wild <mwild1@gmail.com> parents: 2539 diff changeset	261 return code, { "search:"..search_name, "pattern:"..pattern_name };
2528 44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2527 diff changeset	262 end;
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2527 diff changeset	263 };
5793 e304e19536f2 mod_firewall: TO/FROM ROLE: Handle JIDs with no role (thanks Zash) Matthew Wild <mwild1@gmail.com> parents: 5704 diff changeset	264 sender_role = {
e304e19536f2 mod_firewall: TO/FROM ROLE: Handle JIDs with no role (thanks Zash) Matthew Wild <mwild1@gmail.com> parents: 5704 diff changeset	265 local_code = [[local sender_role = get_jid_role(bare_from, current_host)]];
e304e19536f2 mod_firewall: TO/FROM ROLE: Handle JIDs with no role (thanks Zash) Matthew Wild <mwild1@gmail.com> parents: 5704 diff changeset	266 depends = { "bare_from", "current_host", "get_jid_role" };
e304e19536f2 mod_firewall: TO/FROM ROLE: Handle JIDs with no role (thanks Zash) Matthew Wild <mwild1@gmail.com> parents: 5704 diff changeset	267 };
e304e19536f2 mod_firewall: TO/FROM ROLE: Handle JIDs with no role (thanks Zash) Matthew Wild <mwild1@gmail.com> parents: 5704 diff changeset	268 recipient_role = {
e304e19536f2 mod_firewall: TO/FROM ROLE: Handle JIDs with no role (thanks Zash) Matthew Wild <mwild1@gmail.com> parents: 5704 diff changeset	269 local_code = [[local recipient_role = get_jid_role(bare_to, current_host)]];
e304e19536f2 mod_firewall: TO/FROM ROLE: Handle JIDs with no role (thanks Zash) Matthew Wild <mwild1@gmail.com> parents: 5704 diff changeset	270 depends = { "bare_to", "current_host", "get_jid_role" };
e304e19536f2 mod_firewall: TO/FROM ROLE: Handle JIDs with no role (thanks Zash) Matthew Wild <mwild1@gmail.com> parents: 5704 diff changeset	271 };
2528 44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2527 diff changeset	272 scan_list = {
2533 9aed7f4e9f07 mod_firewall: Fix scan_list() syntax error in generated code Matthew Wild <mwild1@gmail.com> parents: 2528 diff changeset	273 global_code = [[local function scan_list(list, items) for item in pairs(items) do if list:contains(item) then return true; end end end]];
5704 ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	274 };
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	275 iplib = {
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	276 global_code = [[local iplib = require "util.ip";]];
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	277 };
6502 b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions Matthew Wild <mwild1@gmail.com> parents: 6386 diff changeset	278 session_parsed_ip = {
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions Matthew Wild <mwild1@gmail.com> parents: 6386 diff changeset	279 local_code = [[local session_parsed_ip = iplib.new_ip(session.ip)]];
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions Matthew Wild <mwild1@gmail.com> parents: 6386 diff changeset	280 depends = { "iplib" };
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions Matthew Wild <mwild1@gmail.com> parents: 6386 diff changeset	281 };
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions Matthew Wild <mwild1@gmail.com> parents: 6386 diff changeset	282 parsed_ip = {
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions Matthew Wild <mwild1@gmail.com> parents: 6386 diff changeset	283 local_code = function (parsed_ip_spec)
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions Matthew Wild <mwild1@gmail.com> parents: 6386 diff changeset	284 local ip_hash, ip_str = parsed_ip_spec:match("^(%x+):(.+)$");
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions Matthew Wild <mwild1@gmail.com> parents: 6386 diff changeset	285 local code = ([[local parsed_ip_%s = iplib.new_ip(%q)]]):format(ip_hash, ip_str)
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions Matthew Wild <mwild1@gmail.com> parents: 6386 diff changeset	286 return code, { "iplib" };
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions Matthew Wild <mwild1@gmail.com> parents: 6386 diff changeset	287 end;
b15601203d0d mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions Matthew Wild <mwild1@gmail.com> parents: 6386 diff changeset	288 };
5704 ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	289 geoip_country = {
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	290 global_code = [[
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	291 local geoip_country = require "geoip.country";
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	292 local geov4 = geoip_country.open(module:get_option_string("geoip_ipv4_country", "/usr/share/GeoIP/GeoIP.dat"));
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	293 local geov6 = geoip_country.open(module:get_option_string("geoip_ipv6_country", "/usr/share/GeoIP/GeoIPv6.dat"));
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	294 local function get_geoip(ips, what)
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	295 if not ips then
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	296 return "--";
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	297 end
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	298 local ip = iplib.new_ip(ips);
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	299 if not ip then
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	300 return "--";
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	301 end
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	302 if ip.proto == "IPv6" and geov6 then
6553 7f3ad8a5b2ab mod_firewall: FROM COUNTRY: Fix incorrect variable use in generated code Matthew Wild <mwild1@gmail.com> parents: 6548 diff changeset	303 local geoinfo = geov6:query_by_addr6(ip.addr);
5704 ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	304 if geoinfo then
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	305 return geoinfo[what or "code"];
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	306 end
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	307 elseif ip.proto == "IPv4" and geov4 then
6553 7f3ad8a5b2ab mod_firewall: FROM COUNTRY: Fix incorrect variable use in generated code Matthew Wild <mwild1@gmail.com> parents: 6548 diff changeset	308 local geoinfo = geov4:query_by_addr(ip.addr);
5704 ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	309 if geoinfo then
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	310 return geoinfo[what or "code"];
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	311 end
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	312 end
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	313 return "--";
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	314 end
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	315 ]];
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	316 depends = {
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	317 "iplib"
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	318 }
ad5c77793750 mod_firewall: Add FROM COUNTRY condition based on GeoIP DB Kim Alvefur <zash@zash.se> parents: 5542 diff changeset	319 };
5866 1d1eadff331d mod_firewall: Support util.id.* as dependencies Matthew Wild <mwild1@gmail.com> parents: 5834 diff changeset	320 new_short_id = {
1d1eadff331d mod_firewall: Support util.id.* as dependencies Matthew Wild <mwild1@gmail.com> parents: 5834 diff changeset	321 global_code = [[local new_short_id = require "util.id".short;]];
1d1eadff331d mod_firewall: Support util.id.* as dependencies Matthew Wild <mwild1@gmail.com> parents: 5834 diff changeset	322 };
1d1eadff331d mod_firewall: Support util.id.* as dependencies Matthew Wild <mwild1@gmail.com> parents: 5834 diff changeset	323 new_medium_id = {
1d1eadff331d mod_firewall: Support util.id.* as dependencies Matthew Wild <mwild1@gmail.com> parents: 5834 diff changeset	324 global_code = [[local new_medium_id = require "util.id".medium;]];
1d1eadff331d mod_firewall: Support util.id.* as dependencies Matthew Wild <mwild1@gmail.com> parents: 5834 diff changeset	325 };
1d1eadff331d mod_firewall: Support util.id.* as dependencies Matthew Wild <mwild1@gmail.com> parents: 5834 diff changeset	326 new_long_id = {
1d1eadff331d mod_firewall: Support util.id.* as dependencies Matthew Wild <mwild1@gmail.com> parents: 5834 diff changeset	327 global_code = [[local new_long_id = require "util.id".long;]];
1d1eadff331d mod_firewall: Support util.id.* as dependencies Matthew Wild <mwild1@gmail.com> parents: 5834 diff changeset	328 };
5920 254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	329
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	330 trace = {
6538 de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	331 global_code = [[local trace_init = module.environment.trace.init;]];
5920 254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	332 };
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	333 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	334
2077 368b091e723b mod_firewall: Rename argument to avoid name clash [luacheck] Kim Alvefur <zash@zash.se> parents: 2076 diff changeset	335 local function include_dep(dependency, code)
368b091e723b mod_firewall: Rename argument to avoid name clash [luacheck] Kim Alvefur <zash@zash.se> parents: 2076 diff changeset	336 local dep, dep_param = dependency:match("^([^:]+):?(.*)$");
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	337 local dep_info = available_deps[dep];
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	338 if not dep_info then
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	339 module:log("error", "Dependency not found: %s", dep);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	340 return;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	341 end
2583 b6b10f57aa56 mod_firewall: Fix for including the same dependency with different parameters Matthew Wild <mwild1@gmail.com> parents: 2580 diff changeset	342 if code.included_deps[dependency] ~= nil then
b6b10f57aa56 mod_firewall: Fix for including the same dependency with different parameters Matthew Wild <mwild1@gmail.com> parents: 2580 diff changeset	343 if code.included_deps[dependency] ~= true then
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	344 module:log("error", "Circular dependency on %s", dep);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	345 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	346 return;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	347 end
2583 b6b10f57aa56 mod_firewall: Fix for including the same dependency with different parameters Matthew Wild <mwild1@gmail.com> parents: 2580 diff changeset	348 code.included_deps[dependency] = false; -- Pending flag (used to detect circular references)
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	349 for _, dep_dep in ipairs(dep_info.depends or {}) do
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	350 include_dep(dep_dep, code);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	351 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	352 if dep_info.global_code then
965 d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone). Matthew Wild <mwild1@gmail.com> parents: 960 diff changeset	353 if dep_param ~= "" then
2525 a35d85cfda92 mod_firewall: Fix for deps dynamically including deps Matthew Wild <mwild1@gmail.com> parents: 2524 diff changeset	354 local global_code, deps = dep_info.global_code(dep_param);
a35d85cfda92 mod_firewall: Fix for deps dynamically including deps Matthew Wild <mwild1@gmail.com> parents: 2524 diff changeset	355 if deps then
2562 78efd064aef3 mod_firewall: Rename variables to avoid shadowing #luacheck Matthew Wild <mwild1@gmail.com> parents: 2561 diff changeset	356 for _, dep_dep in ipairs(deps) do
78efd064aef3 mod_firewall: Rename variables to avoid shadowing #luacheck Matthew Wild <mwild1@gmail.com> parents: 2561 diff changeset	357 include_dep(dep_dep, code);
2525 a35d85cfda92 mod_firewall: Fix for deps dynamically including deps Matthew Wild <mwild1@gmail.com> parents: 2524 diff changeset	358 end
a35d85cfda92 mod_firewall: Fix for deps dynamically including deps Matthew Wild <mwild1@gmail.com> parents: 2524 diff changeset	359 end
a35d85cfda92 mod_firewall: Fix for deps dynamically including deps Matthew Wild <mwild1@gmail.com> parents: 2524 diff changeset	360 table.insert(code.global_header, global_code);
965 d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone). Matthew Wild <mwild1@gmail.com> parents: 960 diff changeset	361 else
d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone). Matthew Wild <mwild1@gmail.com> parents: 960 diff changeset	362 table.insert(code.global_header, dep_info.global_code);
d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone). Matthew Wild <mwild1@gmail.com> parents: 960 diff changeset	363 end
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	364 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	365 if dep_info.local_code then
965 d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone). Matthew Wild <mwild1@gmail.com> parents: 960 diff changeset	366 if dep_param ~= "" then
2525 a35d85cfda92 mod_firewall: Fix for deps dynamically including deps Matthew Wild <mwild1@gmail.com> parents: 2524 diff changeset	367 local local_code, deps = dep_info.local_code(dep_param);
a35d85cfda92 mod_firewall: Fix for deps dynamically including deps Matthew Wild <mwild1@gmail.com> parents: 2524 diff changeset	368 if deps then
2562 78efd064aef3 mod_firewall: Rename variables to avoid shadowing #luacheck Matthew Wild <mwild1@gmail.com> parents: 2561 diff changeset	369 for _, dep_dep in ipairs(deps) do
78efd064aef3 mod_firewall: Rename variables to avoid shadowing #luacheck Matthew Wild <mwild1@gmail.com> parents: 2561 diff changeset	370 include_dep(dep_dep, code);
2525 a35d85cfda92 mod_firewall: Fix for deps dynamically including deps Matthew Wild <mwild1@gmail.com> parents: 2524 diff changeset	371 end
a35d85cfda92 mod_firewall: Fix for deps dynamically including deps Matthew Wild <mwild1@gmail.com> parents: 2524 diff changeset	372 end
a35d85cfda92 mod_firewall: Fix for deps dynamically including deps Matthew Wild <mwild1@gmail.com> parents: 2524 diff changeset	373 table.insert(code, "\n\t\t-- "..dep.."\n\t\t"..local_code.."\n");
965 d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone). Matthew Wild <mwild1@gmail.com> parents: 960 diff changeset	374 else
1303 8a3f3f485675 mod_firewall: Produce code with nicer indentation Florian Zeitz <florob@babelmonkeys.de> parents: 1052 diff changeset	375 table.insert(code, "\n\t\t-- "..dep.."\n\t\t"..dep_info.local_code.."\n");
965 d4e24fb289c0 mod_firewall: Improve zone handling, make it more efficient, and support dynamic dependencies in the compiler. ENTERING and LEAVING conditions now work at expected (not matching stanzas flowing within a zone). Matthew Wild <mwild1@gmail.com> parents: 960 diff changeset	376 end
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	377 end
2583 b6b10f57aa56 mod_firewall: Fix for including the same dependency with different parameters Matthew Wild <mwild1@gmail.com> parents: 2580 diff changeset	378 code.included_deps[dependency] = true;
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	379 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	380
999 197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	381 local definition_handlers = module:require("definitions");
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	382 local condition_handlers = module:require("conditions");
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	383 local action_handlers = module:require("actions");
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	384
6538 de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	385 module.environment.trace = module:require("trace");
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	386
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	387 local metadata_field_handlers = {
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	388 trace = function (v)
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	389 v = v:lower();
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	390 return v == "on" or v == "true";
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	391 end;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	392 };
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	393
5539 fa8435a27f7e mod_firewall: enable marks by default Matthew Wild <mwild1@gmail.com> parents: 5381 diff changeset	394 if module:get_option_boolean("firewall_experimental_user_marks", true) then
2894 165d2877eeac mod_firewall: Add experimental user-centric persistent marks behind a feature flag Kim Alvefur <zash@zash.se> parents: 2859 diff changeset	395 module:require"marks";
165d2877eeac mod_firewall: Add experimental user-centric persistent marks behind a feature flag Kim Alvefur <zash@zash.se> parents: 2859 diff changeset	396 end
165d2877eeac mod_firewall: Add experimental user-centric persistent marks behind a feature flag Kim Alvefur <zash@zash.se> parents: 2859 diff changeset	397
5920 254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	398 local function new_rule(ruleset, chain, line_no)
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	399 assert(chain, "no chain specified");
6536 24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	400 local rule = { conditions = {}, actions = {}, deps = {}, line_no = line_no, source = { conditions = {}, actions = {} } };
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	401 table.insert(ruleset[chain], rule);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	402 return rule;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	403 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	404
2078 11539785cb92 mod_firewall: Split compile function into two parts in order to separate their scopes Kim Alvefur <zash@zash.se> parents: 2077 diff changeset	405 local function parse_firewall_rules(filename)
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	406 local line_no = 0;
1343 7dbde05b48a9 all the things: Remove trailing whitespace Florian Zeitz <florob@babelmonkeys.de> parents: 1325 diff changeset	407
956 33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	408 local function errmsg(err)
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	409 return "Error compiling "..filename.." on line "..line_no..": "..err;
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	410 end
1343 7dbde05b48a9 all the things: Remove trailing whitespace Florian Zeitz <florob@babelmonkeys.de> parents: 1325 diff changeset	411
6537 9bc83fba89ac mod_firewall: Include filename in metadata Matthew Wild <mwild1@gmail.com> parents: 6536 diff changeset	412 local metadata = { debug = {}, filename = filename };
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	413 local ruleset = {
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	414 deliver = {};
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	415 };
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	416
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	417 local chain = "deliver"; -- Default chain
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	418 local rule;
1343 7dbde05b48a9 all the things: Remove trailing whitespace Florian Zeitz <florob@babelmonkeys.de> parents: 1325 diff changeset	419
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	420 local file, err = io.open(filename);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	421 if not file then return nil, err; end
1343 7dbde05b48a9 all the things: Remove trailing whitespace Florian Zeitz <florob@babelmonkeys.de> parents: 1325 diff changeset	422
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	423 local state; -- nil -> "rules" -> "actions" -> nil -> ...
1343 7dbde05b48a9 all the things: Remove trailing whitespace Florian Zeitz <florob@babelmonkeys.de> parents: 1325 diff changeset	424
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	425 local line_hold;
6509 f61564e11d3b various: Adjust for loop variables becoming constants in Lua 5.5 Kim Alvefur <zash@zash.se> parents: 6504 diff changeset	426 for rawline in file:lines() do
f61564e11d3b various: Adjust for loop variables becoming constants in Lua 5.5 Kim Alvefur <zash@zash.se> parents: 6504 diff changeset	427 local line = rawline:match("^%s(.-)%s$");
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	428 if line_hold and line:sub(-1,-1) ~= "\\" then
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	429 line = line_hold..line;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	430 line_hold = nil;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	431 elseif line:sub(-1,-1) == "\\" then
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	432 line_hold = (line_hold or "")..line:sub(1,-2);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	433 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	434 line_no = line_no + 1;
1343 7dbde05b48a9 all the things: Remove trailing whitespace Florian Zeitz <florob@babelmonkeys.de> parents: 1325 diff changeset	435
2080 a435db77a5e5 mod_firewall: Silence warning about empty if branch [luacheck] Kim Alvefur <zash@zash.se> parents: 2078 diff changeset	436 if line_hold or line:find("^[#;]") then -- luacheck: ignore 542
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	437 -- No action; comment or partial line
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	438 elseif line == "" then
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	439 if state == "rules" then
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	440 return nil, ("Expected an action on line %d for preceding criteria")
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	441 :format(line_no);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	442 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	443 state = nil;
2070 2356114ff505 mod_firewall: Optimize string match operations, string.find is faster than .match since no string is returned Kim Alvefur <zash@zash.se> parents: 1343 diff changeset	444 elseif not(state) and line:sub(1, 2) == "::" then
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	445 chain = line:gsub("^::%s*", "");
980 aeb11522a44f mod_firewall: Fix variable name Kim Alvefur <zash@zash.se> parents: 971 diff changeset	446 local chain_info = chains[chain];
956 33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	447 if not chain_info then
2364 17d236129118 mod_firewall: Allow implicit defitions of chains in scripts if they begin with 'user/' Matthew Wild <mwild1@gmail.com> parents: 2342 diff changeset	448 if chain:match("^user/") then
2558 2b533a7b5236 mod_firewall: Make PASS bubble up through all chains, and add DEFAULT and RETURN Matthew Wild <mwild1@gmail.com> parents: 2550 diff changeset	449 chains[chain] = { type = "event", priority = 1, pass_return = false };
2364 17d236129118 mod_firewall: Allow implicit defitions of chains in scripts if they begin with 'user/' Matthew Wild <mwild1@gmail.com> parents: 2342 diff changeset	450 else
17d236129118 mod_firewall: Allow implicit defitions of chains in scripts if they begin with 'user/' Matthew Wild <mwild1@gmail.com> parents: 2342 diff changeset	451 return nil, errmsg("Unknown chain: "..chain);
17d236129118 mod_firewall: Allow implicit defitions of chains in scripts if they begin with 'user/' Matthew Wild <mwild1@gmail.com> parents: 2342 diff changeset	452 end
956 33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	453 elseif chain_info.type ~= "event" then
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	454 return nil, errmsg("Only event chains supported at the moment");
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	455 end
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	456 ruleset[chain] = ruleset[chain] or {};
5920 254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	457 elseif not(state) and line:sub(1, 2) == "@@" then
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	458 local k, v = line:match("^@@%s([^%s=]+)%s=%s*(.+)$");
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	459 if not k then
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	460 return nil, errmsg("Unable to parse metadata assignment (expected '@@ key = value')");
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	461 end
6538 de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	462 local handler = metadata_field_handlers[k];
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	463 if handler then
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	464 v = handler(v);
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	465 end
5920 254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	466 metadata[k] = v;
2070 2356114ff505 mod_firewall: Optimize string match operations, string.find is faster than .match since no string is returned Kim Alvefur <zash@zash.se> parents: 1343 diff changeset	467 elseif not(state) and line:sub(1,1) == "%" then -- Definition (zone, limit, etc.)
4582 cc20493018f6 mod_firewall: Allow underscores in definition names Matthew Wild <mwild1@gmail.com> parents: 3981 diff changeset	468 local what, name = line:match("^%%%s*([%w_]+) +([^ :]+)");
999 197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	469 if not definition_handlers[what] then
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	470 return nil, errmsg("Definition of unknown object: "..what);
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	471 elseif not name or not idsafe(name) then
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	472 return nil, errmsg("Invalid "..what.." name");
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	473 end
999 197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	474
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	475 local val = line:match(": ?(.*)$");
2070 2356114ff505 mod_firewall: Optimize string match operations, string.find is faster than .match since no string is returned Kim Alvefur <zash@zash.se> parents: 1343 diff changeset	476 if not val and line:find(":<") then -- Read from file
999 197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	477 local fn = line:match(":< ?(.-)%s*$");
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	478 if not fn then
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	479 return nil, errmsg("Unable to parse filename");
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	480 end
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	481 local f, err = io.open(fn);
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	482 if not f then return nil, errmsg(err); end
2526 b2fc41001c8e mod_firewall: Fix pattern Matthew Wild <mwild1@gmail.com> parents: 2525 diff changeset	483 val = f:read("*a"):gsub("\r?\n", " "):gsub("%s+$", "");
999 197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	484 end
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	485 if not val then
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	486 return nil, errmsg("No value given for definition");
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	487 end
2550 19a182651a9b mod_firewall: Allow backslash escapes in definitions Matthew Wild <mwild1@gmail.com> parents: 2549 diff changeset	488 val = stripslashes(val);
999 197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	489 local ok, ret = pcall(definition_handlers[what], name, val);
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	490 if not ok then
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	491 return nil, errmsg(ret);
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	492 end
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	493
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	494 if not active_definitions[what] then
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	495 active_definitions[what] = {};
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	496 end
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	497 active_definitions[what][name] = ret;
2539 1510b66a43fc mod_firewall: Allow using spaces instead of underscores in actions, as well as conditions Matthew Wild <mwild1@gmail.com> parents: 2538 diff changeset	498 elseif line:find("^[%w_ ]+[%.=]") then
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	499 -- Action
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	500 if state == nil then
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	501 -- This is a standalone action with no conditions
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	502 rule = new_rule(ruleset, chain);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	503 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	504 state = "actions";
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	505 -- Action handlers?
2539 1510b66a43fc mod_firewall: Allow using spaces instead of underscores in actions, as well as conditions Matthew Wild <mwild1@gmail.com> parents: 2538 diff changeset	506 local action = line:match("^[%w_ ]+"):upper():gsub(" ", "_");
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	507 if not action_handlers[action] then
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	508 return nil, ("Unknown action on line %d: %s"):format(line_no, action or "<unknown>");
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	509 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	510 table.insert(rule.actions, "-- "..line)
956 33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	511 local ok, action_string, action_deps = pcall(action_handlers[action], line:match("=(.+)$"));
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	512 if not ok then
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	513 return nil, errmsg(action_string);
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	514 end
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	515 table.insert(rule.actions, action_string);
6536 24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	516 table.insert(rule.source.actions, line);
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	517 for _, dep in ipairs(action_deps or {}) do
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	518 table.insert(rule.deps, dep);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	519 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	520 elseif state == "actions" then -- state is actions but action pattern did not match
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	521 state = nil; -- Awaiting next rule, etc.
5920 254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	522 table.insert(ruleset[chain], rule); -- FIXME: Is this a bug? Rule should have already been inserted by new_rule()?
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	523 rule = nil;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	524 else
5920 254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	525 -- Condition
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	526 if not state then -- Starting a new rule block?
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	527 state = "rules";
5920 254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	528 rule = new_rule(ruleset, chain, line_no);
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	529 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	530 -- Check standard modifiers for the condition (e.g. NOT)
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	531 local negated;
6536 24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	532 local raw_condition = line:match("^[^:=%.?]*");
24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	533 local condition = raw_condition;
24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	534
2070 2356114ff505 mod_firewall: Optimize string match operations, string.find is faster than .match since no string is returned Kim Alvefur <zash@zash.se> parents: 1343 diff changeset	535 if condition:find("%f[%w]NOT%f[^%w]") then
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	536 local s, e = condition:match("%f[%w]()NOT()%f[^%w]");
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	537 condition = (condition:sub(1,s-1)..condition:sub(e+1, -1)):match("^%s(.-)%s$");
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	538 negated = true;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	539 end
998 6fdcebbd2284 mod_firewall: Fix conditions with spaces Matthew Wild <mwild1@gmail.com> parents: 996 diff changeset	540 condition = condition:gsub(" ", "_");
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	541 if not condition_handlers[condition] then
998 6fdcebbd2284 mod_firewall: Fix conditions with spaces Matthew Wild <mwild1@gmail.com> parents: 996 diff changeset	542 return nil, ("Unknown condition on line %d: %s"):format(line_no, (condition:gsub("_", " ")));
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	543 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	544 -- Get the code for this condition
956 33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	545 local ok, condition_code, condition_deps = pcall(condition_handlers[condition], line:match(":%s?(.+)$"));
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	546 if not ok then
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	547 return nil, errmsg(condition_code);
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	548 end
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	549 if negated then condition_code = "not("..condition_code..")"; end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	550 table.insert(rule.conditions, condition_code);
6536 24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	551 table.insert(rule.source.conditions, line);
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	552 for _, dep in ipairs(condition_deps or {}) do
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	553 table.insert(rule.deps, dep);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	554 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	555 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	556 end
5920 254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	557 return ruleset, metadata;
2078 11539785cb92 mod_firewall: Split compile function into two parts in order to separate their scopes Kim Alvefur <zash@zash.se> parents: 2077 diff changeset	558 end
1343 7dbde05b48a9 all the things: Remove trailing whitespace Florian Zeitz <florob@babelmonkeys.de> parents: 1325 diff changeset	559
5920 254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	560 local function process_firewall_rules(ruleset, metadata)
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	561 -- Compile ruleset and return complete code
1343 7dbde05b48a9 all the things: Remove trailing whitespace Florian Zeitz <florob@babelmonkeys.de> parents: 1325 diff changeset	562
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	563 local chain_handlers = {};
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	564
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	565 -- Loop through the chains in the parsed ruleset (e.g. incoming, outgoing)
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	566 for chain_name, rules in pairs(ruleset) do
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	567 local code = { included_deps = {}, global_header = {} };
1304 9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	568 local condition_uses = {};
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	569 -- This inner loop assumes chain is an event-based, not a filter-based
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	570 -- chain (filter-based will be added later)
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	571 for _, rule in ipairs(rules) do
1304 9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	572 for _, condition in ipairs(rule.conditions) do
2070 2356114ff505 mod_firewall: Optimize string match operations, string.find is faster than .match since no string is returned Kim Alvefur <zash@zash.se> parents: 1343 diff changeset	573 if condition:find("^not%(.+%)$") then
1304 9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	574 condition = condition:match("^not%((.+)%)$");
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	575 end
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	576 condition_uses[condition] = (condition_uses[condition] or 0) + 1;
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	577 end
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	578 end
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	579
5920 254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	580 if metadata.trace then
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	581 include_dep("trace", code);
6538 de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	582 table.insert(code, ("local trace_record <close>, trace = trace_init(%q, %q, stanza, event.firewall_trace_tag, source_rules);"):format(metadata.filename, chain_name))
5920 254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	583 end
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	584
1304 9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	585 local condition_cache, n_conditions = {}, 0;
5920 254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	586 for rule_n, rule in ipairs(rules) do
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	587 for _, dep in ipairs(rule.deps) do
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	588 include_dep(dep, code);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	589 end
1303 8a3f3f485675 mod_firewall: Produce code with nicer indentation Florian Zeitz <florob@babelmonkeys.de> parents: 1052 diff changeset	590 table.insert(code, "\n\t\t");
8a3f3f485675 mod_firewall: Produce code with nicer indentation Florian Zeitz <florob@babelmonkeys.de> parents: 1052 diff changeset	591 local rule_code;
967 a88f33fe6970 mod_firewall: Don't add empty conditions check when no conditions are listed in a rule Matthew Wild <mwild1@gmail.com> parents: 966 diff changeset	592 if #rule.conditions > 0 then
996 37af655ca575 mod_firewall: Cache conditions, so that they are only calculated once per chain execution Matthew Wild <mwild1@gmail.com> parents: 980 diff changeset	593 for i, condition in ipairs(rule.conditions) do
1001 c0850793b716 mod_firewall: don't use %b() (not technically correct) Matthew Wild <mwild1@gmail.com> parents: 999 diff changeset	594 local negated = condition:match("^not%(.+%)$");
996 37af655ca575 mod_firewall: Cache conditions, so that they are only calculated once per chain execution Matthew Wild <mwild1@gmail.com> parents: 980 diff changeset	595 if negated then
37af655ca575 mod_firewall: Cache conditions, so that they are only calculated once per chain execution Matthew Wild <mwild1@gmail.com> parents: 980 diff changeset	596 condition = condition:match("^not%((.+)%)$");
37af655ca575 mod_firewall: Cache conditions, so that they are only calculated once per chain execution Matthew Wild <mwild1@gmail.com> parents: 980 diff changeset	597 end
1304 9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	598 if condition_uses[condition] > 1 then
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	599 local name = condition_cache[condition];
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	600 if not name then
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	601 n_conditions = n_conditions + 1;
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	602 name = "condition"..n_conditions;
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	603 condition_cache[condition] = name;
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	604 table.insert(code, "local "..name.." = "..condition..";\n\t\t");
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	605 end
9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	606 rule.conditions[i] = (negated and "not(" or "")..name..(negated and ")" or "");
996 37af655ca575 mod_firewall: Cache conditions, so that they are only calculated once per chain execution Matthew Wild <mwild1@gmail.com> parents: 980 diff changeset	607 else
1304 9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	608 rule.conditions[i] = (negated and "not(" or "(")..condition..")";
996 37af655ca575 mod_firewall: Cache conditions, so that they are only calculated once per chain execution Matthew Wild <mwild1@gmail.com> parents: 980 diff changeset	609 end
5920 254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	610
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	611 if metadata.trace then
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	612 -- Wrap each condition in a tracer
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	613 rule.conditions[i] = ("trace(%d, %d, %s)"):format(rule_n, i, rule.conditions[i]);
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	614 end
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	615 end
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	616
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	617 if metadata.trace then
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	618 -- Trace overall action
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	619 table.insert(rule.actions, 1, ("trace(%d, nil, true)"):format(rule_n));
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	620 table.insert(rule.actions, ("else trace(%d, nil, false)"):format(rule_n));
996 37af655ca575 mod_firewall: Cache conditions, so that they are only calculated once per chain execution Matthew Wild <mwild1@gmail.com> parents: 980 diff changeset	621 end
1304 9f24ccaa66a6 mod_firewall: Do not cache conditions with only a single use Florian Zeitz <florob@babelmonkeys.de> parents: 1303 diff changeset	622
1303 8a3f3f485675 mod_firewall: Produce code with nicer indentation Florian Zeitz <florob@babelmonkeys.de> parents: 1052 diff changeset	623 rule_code = "if "..table.concat(rule.conditions, " and ").." then\n\t\t\t"
8a3f3f485675 mod_firewall: Produce code with nicer indentation Florian Zeitz <florob@babelmonkeys.de> parents: 1052 diff changeset	624 ..table.concat(rule.actions, "\n\t\t\t")
8a3f3f485675 mod_firewall: Produce code with nicer indentation Florian Zeitz <florob@babelmonkeys.de> parents: 1052 diff changeset	625 .."\n\t\tend\n";
8a3f3f485675 mod_firewall: Produce code with nicer indentation Florian Zeitz <florob@babelmonkeys.de> parents: 1052 diff changeset	626 else
6538 de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	627 if metadata.trace then
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	628 table.insert(rule.actions, 2, ("trace(%d, nil, true)"):format(rule_n));
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	629 end
1303 8a3f3f485675 mod_firewall: Produce code with nicer indentation Florian Zeitz <florob@babelmonkeys.de> parents: 1052 diff changeset	630 rule_code = table.concat(rule.actions, "\n\t\t");
967 a88f33fe6970 mod_firewall: Don't add empty conditions check when no conditions are listed in a rule Matthew Wild <mwild1@gmail.com> parents: 966 diff changeset	631 end
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	632 table.insert(code, rule_code);
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	633 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	634
999 197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	635 for name in pairs(definition_handlers) do
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	636 table.insert(code.global_header, 1, "local "..name:lower().."s = definitions."..name..";");
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	637 end
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	638
6536 24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	639 -- The function signature here must match what gets passed in compile_handler()
24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	640 local code_string = "return function (definitions, fire_event, log, module, pass_return, source_rules)\n\t"
1303 8a3f3f485675 mod_firewall: Produce code with nicer indentation Florian Zeitz <florob@babelmonkeys.de> parents: 1052 diff changeset	641 ..table.concat(code.global_header, "\n\t")
8a3f3f485675 mod_firewall: Produce code with nicer indentation Florian Zeitz <florob@babelmonkeys.de> parents: 1052 diff changeset	642 .."\n\tlocal db = require 'util.debug';\n\n\t"
8a3f3f485675 mod_firewall: Produce code with nicer indentation Florian Zeitz <florob@babelmonkeys.de> parents: 1052 diff changeset	643 .."return function (event)\n\t\t"
8a3f3f485675 mod_firewall: Produce code with nicer indentation Florian Zeitz <florob@babelmonkeys.de> parents: 1052 diff changeset	644 .."local stanza, session = event.stanza, event.origin;\n"
8a3f3f485675 mod_firewall: Produce code with nicer indentation Florian Zeitz <florob@babelmonkeys.de> parents: 1052 diff changeset	645 ..table.concat(code, "")
8a3f3f485675 mod_firewall: Produce code with nicer indentation Florian Zeitz <florob@babelmonkeys.de> parents: 1052 diff changeset	646 .."\n\tend;\nend";
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	647
6536 24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	648 chain_handlers[chain_name] = { code = code_string, rules = rules };
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	649 end
1343 7dbde05b48a9 all the things: Remove trailing whitespace Florian Zeitz <florob@babelmonkeys.de> parents: 1325 diff changeset	650
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	651 return chain_handlers;
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	652 end
c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	653
2078 11539785cb92 mod_firewall: Split compile function into two parts in order to separate their scopes Kim Alvefur <zash@zash.se> parents: 2077 diff changeset	654 local function compile_firewall_rules(filename)
5920 254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	655 local ruleset, metadata = parse_firewall_rules(filename);
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	656 if not ruleset then return nil, metadata; end
254a21a104aa mod_server_contact_info: Backport from prosody trunk Matthew Wild <mwild1@gmail.com> parents: 5866 diff changeset	657 local chain_handlers = process_firewall_rules(ruleset, metadata);
2078 11539785cb92 mod_firewall: Split compile function into two parts in order to separate their scopes Kim Alvefur <zash@zash.se> parents: 2077 diff changeset	658 return chain_handlers;
11539785cb92 mod_firewall: Split compile function into two parts in order to separate their scopes Kim Alvefur <zash@zash.se> parents: 2077 diff changeset	659 end
11539785cb92 mod_firewall: Split compile function into two parts in order to separate their scopes Kim Alvefur <zash@zash.se> parents: 2077 diff changeset	660
2558 2b533a7b5236 mod_firewall: Make PASS bubble up through all chains, and add DEFAULT and RETURN Matthew Wild <mwild1@gmail.com> parents: 2550 diff changeset	661 -- Compile handler code into a factory that produces a valid event handler. Factory accepts
2b533a7b5236 mod_firewall: Make PASS bubble up through all chains, and add DEFAULT and RETURN Matthew Wild <mwild1@gmail.com> parents: 2550 diff changeset	662 -- a value to be returned on PASS
6536 24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	663 local function compile_handler(code_string, filename, source_rules)
956 33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	664 -- Prepare event handler function
3981 7e8f2e36419d mod_firewall: Use util.envload instead of deprecated loadstring (thanks Martin) Kim Alvefur <zash@zash.se> parents: 2928 diff changeset	665 local chunk, err = envload(code_string, "="..filename, _G);
956 33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	666 if not chunk then
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	667 return nil, "Error compiling (probably a compiler bug, please report): "..err;
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	668 end
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	669 local function fire_event(name, data)
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	670 return module:fire_event(name, data);
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	671 end
5381 32a9817c7516 mod_firewall: Initialize compiled chunk just once for all handlers Matthew Wild <mwild1@gmail.com> parents: 5160 diff changeset	672 local init_ok, initialized_chunk = pcall(chunk);
32a9817c7516 mod_firewall: Initialize compiled chunk just once for all handlers Matthew Wild <mwild1@gmail.com> parents: 5160 diff changeset	673 if not init_ok then
32a9817c7516 mod_firewall: Initialize compiled chunk just once for all handlers Matthew Wild <mwild1@gmail.com> parents: 5160 diff changeset	674 return nil, "Error initializing compiled rules: "..initialized_chunk;
32a9817c7516 mod_firewall: Initialize compiled chunk just once for all handlers Matthew Wild <mwild1@gmail.com> parents: 5160 diff changeset	675 end
2558 2b533a7b5236 mod_firewall: Make PASS bubble up through all chains, and add DEFAULT and RETURN Matthew Wild <mwild1@gmail.com> parents: 2550 diff changeset	676 return function (pass_return)
6536 24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	677 return initialized_chunk(active_definitions, fire_event, logger(filename), module, pass_return, source_rules); -- Returns event handler with upvalues
2558 2b533a7b5236 mod_firewall: Make PASS bubble up through all chains, and add DEFAULT and RETURN Matthew Wild <mwild1@gmail.com> parents: 2550 diff changeset	678 end
956 33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	679 end
33d6642f4db7 mod_firewall: Tighten up error handling, and split rules->Lua and Lua->bytecode compilation into separate functions Matthew Wild <mwild1@gmail.com> parents: 955 diff changeset	680
2366 14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file Matthew Wild <mwild1@gmail.com> parents: 2365 diff changeset	681 local function resolve_script_path(script_path)
14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file Matthew Wild <mwild1@gmail.com> parents: 2365 diff changeset	682 local relative_to = prosody.paths.config;
14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file Matthew Wild <mwild1@gmail.com> parents: 2365 diff changeset	683 if script_path:match("^module:") then
5834 866a49f5aa61 mod_firewall: Fix to find scripts when installed with plugin installer Kim Alvefur <zash@zash.se> parents: 5793 diff changeset	684 relative_to = module:get_directory();
2366 14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file Matthew Wild <mwild1@gmail.com> parents: 2365 diff changeset	685 script_path = script_path:match("^module:(.+)$");
14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file Matthew Wild <mwild1@gmail.com> parents: 2365 diff changeset	686 end
14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file Matthew Wild <mwild1@gmail.com> parents: 2365 diff changeset	687 return resolve_relative_path(relative_to, script_path);
14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file Matthew Wild <mwild1@gmail.com> parents: 2365 diff changeset	688 end
14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file Matthew Wild <mwild1@gmail.com> parents: 2365 diff changeset	689
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	690 -- [filename] = { last_modified = ..., events_hooked = { [name] = handler } }
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	691 local loaded_scripts = {};
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	692
2574 f65c5927ee8e mod_firewall: Factor out script loading Matthew Wild <mwild1@gmail.com> parents: 2573 diff changeset	693 function load_script(script)
f65c5927ee8e mod_firewall: Factor out script loading Matthew Wild <mwild1@gmail.com> parents: 2573 diff changeset	694 script = resolve_script_path(script);
6538 de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	695 local base_name = script:match("[^/]+$");
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time Matthew Wild <mwild1@gmail.com> parents: 6537 diff changeset	696
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	697 local last_modified = (lfs.attributes(script) or {}).modification or os.time();
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	698 if loaded_scripts[script] then
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	699 if loaded_scripts[script].last_modified == last_modified then
6555 d81bb13c0e87 mod_firewall: Report success if script is already loaded and hasn't changed Matthew Wild <mwild1@gmail.com> parents: 6553 diff changeset	700 return true; -- Already loaded, and source file hasn't changed
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	701 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	702 module:log("debug", "Reloading %s", script);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	703 -- Already loaded, but the source file has changed
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	704 -- unload it now, and we'll load the new version below
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	705 unload_script(script, true);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	706 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	707 local chain_functions, err = compile_firewall_rules(script);
2859 22e11645a895 mod_firewall: Trim trailing whitespace [luacheck] Kim Alvefur <zash@zash.se> parents: 2585 diff changeset	708
2574 f65c5927ee8e mod_firewall: Factor out script loading Matthew Wild <mwild1@gmail.com> parents: 2573 diff changeset	709 if not chain_functions then
f65c5927ee8e mod_firewall: Factor out script loading Matthew Wild <mwild1@gmail.com> parents: 2573 diff changeset	710 module:log("error", "Error compiling %s: %s", script, err or "unknown error");
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	711 return;
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	712 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	713
6534 5aeefc2251d4 mod_firewall: Load a script completely or not at all Matthew Wild <mwild1@gmail.com> parents: 6533 diff changeset	714 local errs;
5aeefc2251d4 mod_firewall: Load a script completely or not at all Matthew Wild <mwild1@gmail.com> parents: 6533 diff changeset	715
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	716 -- Loop through the chains in the script, and for each chain attach the compiled code to the
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	717 -- relevant events, keeping track in events_hooked so we can cleanly unload later
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	718 local events_hooked = {};
6536 24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	719 for chain, chain_info in pairs(chain_functions) do
24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	720 local handler_code = chain_info.code;
6548 430584888704 mod_firewall: marks: load marks from storage on login Matthew Wild <mwild1@gmail.com> parents: 6538 diff changeset	721 module:log("warn", "Hooking %s for %s", chain, base_name);
6536 24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	722 local new_handler, err = compile_handler(handler_code, "mod_firewall:"..base_name.."::"..chain, chain_info.rules);
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	723 if not new_handler then
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	724 module:log("error", "Compilation error for %s: %s", script, err);
6534 5aeefc2251d4 mod_firewall: Load a script completely or not at all Matthew Wild <mwild1@gmail.com> parents: 6533 diff changeset	725 errs = true;
5aeefc2251d4 mod_firewall: Load a script completely or not at all Matthew Wild <mwild1@gmail.com> parents: 6533 diff changeset	726 break;
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	727 else
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	728 local chain_definition = chains[chain];
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	729 if chain_definition and chain_definition.type == "event" then
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	730 local handler = new_handler(chain_definition.pass_return);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	731 for _, event_name in ipairs(chain_definition) do
6548 430584888704 mod_firewall: marks: load marks from storage on login Matthew Wild <mwild1@gmail.com> parents: 6538 diff changeset	732 module:log("warn", "Hooking %s...", event_name);
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	733 events_hooked[event_name] = handler;
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	734 module:hook(event_name, handler, chain_definition.priority);
2574 f65c5927ee8e mod_firewall: Factor out script loading Matthew Wild <mwild1@gmail.com> parents: 2573 diff changeset	735 end
6504 ce716e5e0fee mod_firewall: Fix chain name check - custom chains should begin with 'user/' Matthew Wild <mwild1@gmail.com> parents: 6502 diff changeset	736 elseif chain:sub(1, 5) ~= "user/" then
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	737 module:log("warn", "Unknown chain %q", chain);
6548 430584888704 mod_firewall: marks: load marks from storage on login Matthew Wild <mwild1@gmail.com> parents: 6538 diff changeset	738 else
430584888704 mod_firewall: marks: load marks from storage on login Matthew Wild <mwild1@gmail.com> parents: 6538 diff changeset	739 module:log("warn", "Sad");
2574 f65c5927ee8e mod_firewall: Factor out script loading Matthew Wild <mwild1@gmail.com> parents: 2573 diff changeset	740 end
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	741 local event_name, handler = "firewall/chains/"..chain, new_handler(false);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	742 events_hooked[event_name] = handler;
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	743 module:hook(event_name, handler);
2574 f65c5927ee8e mod_firewall: Factor out script loading Matthew Wild <mwild1@gmail.com> parents: 2573 diff changeset	744 end
f65c5927ee8e mod_firewall: Factor out script loading Matthew Wild <mwild1@gmail.com> parents: 2573 diff changeset	745 end
6534 5aeefc2251d4 mod_firewall: Load a script completely or not at all Matthew Wild <mwild1@gmail.com> parents: 6533 diff changeset	746 if errs then
5aeefc2251d4 mod_firewall: Load a script completely or not at all Matthew Wild <mwild1@gmail.com> parents: 6533 diff changeset	747 for event_name, event_handler in pairs(events_hooked) do
5aeefc2251d4 mod_firewall: Load a script completely or not at all Matthew Wild <mwild1@gmail.com> parents: 6533 diff changeset	748 module:unhook(event_name, event_handler);
5aeefc2251d4 mod_firewall: Load a script completely or not at all Matthew Wild <mwild1@gmail.com> parents: 6533 diff changeset	749 events_hooked[event_name] = nil;
5aeefc2251d4 mod_firewall: Load a script completely or not at all Matthew Wild <mwild1@gmail.com> parents: 6533 diff changeset	750 end
5aeefc2251d4 mod_firewall: Load a script completely or not at all Matthew Wild <mwild1@gmail.com> parents: 6533 diff changeset	751 return;
5aeefc2251d4 mod_firewall: Load a script completely or not at all Matthew Wild <mwild1@gmail.com> parents: 6533 diff changeset	752 end
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	753 loaded_scripts[script] = { last_modified = last_modified, events_hooked = events_hooked };
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	754 module:log("debug", "Loaded %s", script);
6533 0f61d13ebbde mod_firewall: Update module status when scripts succeed/fail to load Matthew Wild <mwild1@gmail.com> parents: 6509 diff changeset	755 return true;
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	756 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	757
2580 aaff2716f022 mod_firewall: Compatibility fix for 0.9 (no module:unhook()) Matthew Wild <mwild1@gmail.com> parents: 2579 diff changeset	758 --COMPAT w/0.9 (no module:unhook()!)
aaff2716f022 mod_firewall: Compatibility fix for 0.9 (no module:unhook()) Matthew Wild <mwild1@gmail.com> parents: 2579 diff changeset	759 local function module_unhook(event, handler)
aaff2716f022 mod_firewall: Compatibility fix for 0.9 (no module:unhook()) Matthew Wild <mwild1@gmail.com> parents: 2579 diff changeset	760 return module:unhook_object_event((hosts[module.host] or prosody).events, event, handler);
aaff2716f022 mod_firewall: Compatibility fix for 0.9 (no module:unhook()) Matthew Wild <mwild1@gmail.com> parents: 2579 diff changeset	761 end
aaff2716f022 mod_firewall: Compatibility fix for 0.9 (no module:unhook()) Matthew Wild <mwild1@gmail.com> parents: 2579 diff changeset	762
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	763 function unload_script(script, is_reload)
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	764 script = resolve_script_path(script);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	765 local script_info = loaded_scripts[script];
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	766 if not script_info then
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	767 return; -- Script not loaded
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	768 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	769 local events_hooked = script_info.events_hooked;
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	770 for event_name, event_handler in pairs(events_hooked) do
2580 aaff2716f022 mod_firewall: Compatibility fix for 0.9 (no module:unhook()) Matthew Wild <mwild1@gmail.com> parents: 2579 diff changeset	771 module_unhook(event_name, event_handler);
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	772 events_hooked[event_name] = nil;
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	773 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	774 loaded_scripts[script] = nil;
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	775 if not is_reload then
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	776 module:log("debug", "Unloaded %s", script);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	777 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	778 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	779
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	780 -- Given a set of scripts (e.g. from config) figure out which ones need to
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	781 -- be loaded, which are already loaded but need unloading, and which to reload
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	782 function load_unload_scripts(script_list)
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	783 local wanted_scripts = script_list / resolve_script_path;
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	784 local currently_loaded = set.new(it.to_array(it.keys(loaded_scripts)));
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	785 local scripts_to_unload = currently_loaded - wanted_scripts;
6533 0f61d13ebbde mod_firewall: Update module status when scripts succeed/fail to load Matthew Wild <mwild1@gmail.com> parents: 6509 diff changeset	786 local n_wanted, n_loaded = 0, 0;
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	787 for script in wanted_scripts do
6533 0f61d13ebbde mod_firewall: Update module status when scripts succeed/fail to load Matthew Wild <mwild1@gmail.com> parents: 6509 diff changeset	788 n_wanted = n_wanted + 1;
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	789 -- If the script is already loaded, this is fine - it will
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	790 -- reload the script for us if the file has changed
6533 0f61d13ebbde mod_firewall: Update module status when scripts succeed/fail to load Matthew Wild <mwild1@gmail.com> parents: 6509 diff changeset	791 if load_script(script) then
0f61d13ebbde mod_firewall: Update module status when scripts succeed/fail to load Matthew Wild <mwild1@gmail.com> parents: 6509 diff changeset	792 n_loaded = n_loaded + 1;
0f61d13ebbde mod_firewall: Update module status when scripts succeed/fail to load Matthew Wild <mwild1@gmail.com> parents: 6509 diff changeset	793 end
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	794 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	795 for script in scripts_to_unload do
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	796 unload_script(script);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	797 end
6533 0f61d13ebbde mod_firewall: Update module status when scripts succeed/fail to load Matthew Wild <mwild1@gmail.com> parents: 6509 diff changeset	798 module:log_status(n_wanted == n_loaded and "info" or "warn", "Loaded %d of %d scripts", n_loaded, n_wanted);
2574 f65c5927ee8e mod_firewall: Factor out script loading Matthew Wild <mwild1@gmail.com> parents: 2573 diff changeset	799 end
f65c5927ee8e mod_firewall: Factor out script loading Matthew Wild <mwild1@gmail.com> parents: 2573 diff changeset	800
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	801 function module.load()
1052 80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command Kim Alvefur <zash@zash.se> parents: 1051 diff changeset	802 if not prosody.arg then return end -- Don't run in prosodyctl
6556 7477e97a9045 mod_firewall: Apply pre-reload state before re-reading config Matthew Wild <mwild1@gmail.com> parents: 6555 diff changeset	803
7477e97a9045 mod_firewall: Apply pre-reload state before re-reading config Matthew Wild <mwild1@gmail.com> parents: 6555 diff changeset	804 local state = module.saved_state;
7477e97a9045 mod_firewall: Apply pre-reload state before re-reading config Matthew Wild <mwild1@gmail.com> parents: 6555 diff changeset	805 if state then
7477e97a9045 mod_firewall: Apply pre-reload state before re-reading config Matthew Wild <mwild1@gmail.com> parents: 6555 diff changeset	806 active_definitions = state.active_definitions;
7477e97a9045 mod_firewall: Apply pre-reload state before re-reading config Matthew Wild <mwild1@gmail.com> parents: 6555 diff changeset	807 loaded_scripts = state.loaded_scripts;
7477e97a9045 mod_firewall: Apply pre-reload state before re-reading config Matthew Wild <mwild1@gmail.com> parents: 6555 diff changeset	808 end
7477e97a9045 mod_firewall: Apply pre-reload state before re-reading config Matthew Wild <mwild1@gmail.com> parents: 6555 diff changeset	809
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	810 local firewall_scripts = module:get_option_set("firewall_scripts", {});
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	811 load_unload_scripts(firewall_scripts);
999 197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	812 -- Replace contents of definitions table (shared) with active definitions
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	813 for k in it.keys(definitions) do definitions[k] = nil; end
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: 998 diff changeset	814 for k,v in pairs(active_definitions) do definitions[k] = v; end
947 c91cac3b823f mod_firewall: General stanza filtering plugin with a declarative rule-based syntax Matthew Wild <mwild1@gmail.com> parents: diff changeset	815 end
1052 80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command Kim Alvefur <zash@zash.se> parents: 1051 diff changeset	816
2578 6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	817 function module.save()
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	818 return { active_definitions = active_definitions, loaded_scripts = loaded_scripts };
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	819 end
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	820
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	821 module:hook_global("config-reloaded", function ()
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	822 load_unload_scripts(module:get_option_set("firewall_scripts", {}));
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	823 end);
6dbd07f9a868 mod_firewall: Various improvements allowing dynamic load/reload/unload of scripts Matthew Wild <mwild1@gmail.com> parents: 2574 diff changeset	824
1052 80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command Kim Alvefur <zash@zash.se> parents: 1051 diff changeset	825 function module.command(arg)
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command Kim Alvefur <zash@zash.se> parents: 1051 diff changeset	826 if not arg[1] or arg[1] == "--help" then
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command Kim Alvefur <zash@zash.se> parents: 1051 diff changeset	827 require"util.prosodyctl".show_usage([[mod_firewall <firewall.pfw>]], [[Compile files with firewall rules to Lua code]]);
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command Kim Alvefur <zash@zash.se> parents: 1051 diff changeset	828 return 1;
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command Kim Alvefur <zash@zash.se> parents: 1051 diff changeset	829 end
2118 643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	830 local verbose = arg[1] == "-v";
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	831 if verbose then table.remove(arg, 1); end
1052 80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command Kim Alvefur <zash@zash.se> parents: 1051 diff changeset	832
2585 02c6ae745c4f mod_firewall: Add 'test' subcommand to read stanzas from stdin and test them against rules Matthew Wild <mwild1@gmail.com> parents: 2584 diff changeset	833 if arg[1] == "test" then
02c6ae745c4f mod_firewall: Add 'test' subcommand to read stanzas from stdin and test them against rules Matthew Wild <mwild1@gmail.com> parents: 2584 diff changeset	834 table.remove(arg, 1);
02c6ae745c4f mod_firewall: Add 'test' subcommand to read stanzas from stdin and test them against rules Matthew Wild <mwild1@gmail.com> parents: 2584 diff changeset	835 return module:require("test")(arg);
02c6ae745c4f mod_firewall: Add 'test' subcommand to read stanzas from stdin and test them against rules Matthew Wild <mwild1@gmail.com> parents: 2584 diff changeset	836 end
02c6ae745c4f mod_firewall: Add 'test' subcommand to read stanzas from stdin and test them against rules Matthew Wild <mwild1@gmail.com> parents: 2584 diff changeset	837
2117 5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work) Kim Alvefur <zash@zash.se> parents: 2113 diff changeset	838 local serialize = require "util.serialization".serialize;
2118 643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	839 if verbose then
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	840 print("local logger = require \"util.logger\".init;");
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	841 print();
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	842 print("local function fire_event(name, data)\n\tmodule:fire_event(name, data)\nend");
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	843 print();
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	844 end
2117 5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work) Kim Alvefur <zash@zash.se> parents: 2113 diff changeset	845
1052 80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command Kim Alvefur <zash@zash.se> parents: 1051 diff changeset	846 for _, filename in ipairs(arg) do
2366 14021c93a962 mod_firewall: Allow prefixing script paths with 'module:' to specify path relative to module file Matthew Wild <mwild1@gmail.com> parents: 2365 diff changeset	847 filename = resolve_script_path(filename);
2117 5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work) Kim Alvefur <zash@zash.se> parents: 2113 diff changeset	848 print("do -- File "..filename);
2365 05dae9adf778 mod_firewall: Fix for when compiling on the command line and specifying multiple files Matthew Wild <mwild1@gmail.com> parents: 2364 diff changeset	849 local chain_functions = assert(compile_firewall_rules(filename));
2118 643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	850 if verbose then
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	851 print();
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	852 print("local active_definitions = "..serialize(active_definitions)..";");
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	853 print();
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	854 end
2367 3ebd3cb4d7d2 mod_firewall: When compiling on the command-line with -v, ensure chain function names are unique and valid ids Matthew Wild <mwild1@gmail.com> parents: 2366 diff changeset	855 local c = 0;
6536 24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	856 for chain_name, chain_info in pairs(chain_functions) do
24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	857 local handler_code = chain_info.code;
2367 3ebd3cb4d7d2 mod_firewall: When compiling on the command-line with -v, ensure chain function names are unique and valid ids Matthew Wild <mwild1@gmail.com> parents: 2366 diff changeset	858 c = c + 1;
6536 24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	859 print("---- Chain "..chain_name:gsub("_", " "));
24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	860 local chain_func_name = "chain_"..tostring(c).."_"..chain_name:gsub("%p", "_");
2118 643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	861 if not verbose then
2367 3ebd3cb4d7d2 mod_firewall: When compiling on the command-line with -v, ensure chain function names are unique and valid ids Matthew Wild <mwild1@gmail.com> parents: 2366 diff changeset	862 print(("%s = %s;"):format(chain_func_name, handler_code:sub(8)));
2118 643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	863 else
2117 5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work) Kim Alvefur <zash@zash.se> parents: 2113 diff changeset	864
2367 3ebd3cb4d7d2 mod_firewall: When compiling on the command-line with -v, ensure chain function names are unique and valid ids Matthew Wild <mwild1@gmail.com> parents: 2366 diff changeset	865 print(("local %s = (%s)(active_definitions, fire_event, logger(%q));"):format(chain_func_name, handler_code:sub(8), filename));
2118 643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	866 print();
2117 5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work) Kim Alvefur <zash@zash.se> parents: 2113 diff changeset	867
6536 24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	868 local chain_definition = chains[chain_name];
2118 643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	869 if chain_definition and chain_definition.type == "event" then
643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	870 for _, event_name in ipairs(chain_definition) do
2367 3ebd3cb4d7d2 mod_firewall: When compiling on the command-line with -v, ensure chain function names are unique and valid ids Matthew Wild <mwild1@gmail.com> parents: 2366 diff changeset	871 print(("module:hook(%q, %s, %d);"):format(event_name, chain_func_name, chain_definition.priority or 0));
2118 643b254e75de mod_firewall: Disable more realistic output by default, activated by adding a -v flag Kim Alvefur <zash@zash.se> parents: 2117 diff changeset	872 end
2117 5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work) Kim Alvefur <zash@zash.se> parents: 2113 diff changeset	873 end
6536 24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	874 print(("module:hook(%q, %s, %d);"):format("firewall/chains/"..chain_name, chain_func_name, chain_definition.priority or 0));
2117 5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work) Kim Alvefur <zash@zash.se> parents: 2113 diff changeset	875 end
5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work) Kim Alvefur <zash@zash.se> parents: 2113 diff changeset	876
6536 24c34968dd45 mod_firewall: Preserve original source of actions/conditions for debug purposes Matthew Wild <mwild1@gmail.com> parents: 6535 diff changeset	877 print("---- End of chain "..chain_name);
2117 5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work) Kim Alvefur <zash@zash.se> parents: 2113 diff changeset	878 print();
1052 80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command Kim Alvefur <zash@zash.se> parents: 1051 diff changeset	879 end
2117 5aa3b93cd37a mod_firewall: Make prosodyctl command output more realistic source (not guaranteed to work) Kim Alvefur <zash@zash.se> parents: 2113 diff changeset	880 print("end -- End of file "..filename);
1052 80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command Kim Alvefur <zash@zash.se> parents: 1051 diff changeset	881 end
80f0a3231c59 mod_firewall: Add support for being called as a prosodyctl command Kim Alvefur <zash@zash.se> parents: 1051 diff changeset	882 end

Mercurial > prosody-modules

annotate mod_firewall/mod_firewall.lua @ 6556:7477e97a9045