Mercurial > prosody-modules

annotate mod_firewall/trace.lib.lua @ 6556:7477e97a9045

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_firewall: Apply pre-reload state before re-reading config This change makes load/reload a bit more robust. module.load() runs before module.restore() and it reads from the config and updates the state (if needed). However, after this, module.restore() could run and apply the old state again.
author Matthew Wild <mwild1@gmail.com>
date Sun, 24 May 2026 20:03:20 +0100
parents de1f17ed4dac
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
6538
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
1 local async = require "prosody.util.async";
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
2
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
3 local tracers = {};
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
4
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
5 local trace_mt = {
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
6 __close = function (t)
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
7 for session, options in pairs(tracers) do
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
8 if not options.tag or options.tag == (t.tag or "untagged") then
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
9 session.print(("\n## Evaluating [%s::%s] (%s)"):format(t.filename, t.chain, t.tag or "untagged"));
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
10 local stanza_log = options.stanzas;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
11 if stanza_log == "full" then
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
12 session.print(t.stanza);
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
13 elseif not stanza_log or stanza_log == "header" then
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
14 session.print(t.stanza:top_tag());
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
15 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
16
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
17 for rule_n, rule_trace in ipairs(t.rules) do
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
18 local source = t.source[rule_n].source;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
19 for cond_n, matched in ipairs(rule_trace) do
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
20 session.print(
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
21 ("%s %s"):format(
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
22 matched and "✔" or "✖",
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
23 source.conditions[cond_n] or ("Rule %d condition %d"):format(rule_n, cond_n)
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
24 )
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
25 );
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
26 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
27 if rule_trace.matched then
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
28 for _, action in ipairs(source.actions) do
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
29 session.print("➜ "..action);
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
30 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
31 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
32 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
33 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
34 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
35 end;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
36 };
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
37
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
38 local function init(filename, chain_name, stanza, tag, source_rules)
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
39 local rule_trace = {};
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
40 local trace = setmetatable({
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
41 filename = filename;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
42 chain = chain_name;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
43 rules = rule_trace;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
44 stanza = stanza;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
45 tag = tag;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
46 source = source_rules;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
47 }, trace_mt);
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
48 return trace, function (rule_n, cond_n, result)
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
49 local rule = rule_trace[rule_n];
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
50 if not rule then
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
51 rule = {};
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
52 rule_trace[rule_n] = rule;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
53 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
54
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
55 if cond_n then
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
56 rule[cond_n] = result;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
57 return result;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
58 else
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
59 -- Rule finished
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
60 rule.matched = result;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
61 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
62 end;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
63 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
64
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
65
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
66 module:add_item("shell-command", {
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
67 section = "firewall";
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
68 section_desc = "mod_firewall commands";
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
69 name = "trace";
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
70 desc = "Trace executions";
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
71 args = {
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
72 { name = "host", type = "string" };
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
73 };
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
74 host_selector = "host";
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
75 flags = {
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
76 short_params = { t = "tag" };
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
77 value_params = { tag = true, stanzas = true };
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
78 };
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
79 handler = function(self, host, opts) --luacheck: ignore 212/self 212/host
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
80 self.session.print("# Tracing mod_firewall on "..host);
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
81 tracers[self.session] = opts or {};
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
82
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
83 while self.session.is_connected() do
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
84 async.sleep(3);
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
85 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
86
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
87 tracers[self.session] = nil;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
88 return true;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
89 end;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
90 });
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
91
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
92
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
93 return { init = init };