Mercurial > prosody-modules

annotate mod_restrict_federation/mod_restrict_federation.lua @ 6556:7477e97a9045

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_firewall: Apply pre-reload state before re-reading config This change makes load/reload a bit more robust. module.load() runs before module.restore() and it reads from the config and updates the state (if needed). However, after this, module.restore() could run and apply the old state again.
author Matthew Wild <mwild1@gmail.com>
date Sun, 24 May 2026 20:03:20 +0100
parents cfcd2d2f7119
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
6325
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
1 local jid_node = require "prosody.util.jid".node;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
2 local st = require "prosody.util.stanza";
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
3
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
4 local get_user_role = require "prosody.core.usermanager".get_user_role;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
5
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
6 function check_outgoing_stanza(event)
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
7 local origin, stanza = event.origin, event.stanza;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
8
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
9 if not origin or origin.type ~= "c2s" then
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
10 -- We only filter user-originated traffic, so
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
11 -- pass this through.
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
12 return;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
13 end
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
14
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
15 if module:may("xmpp:federate", event) then
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
16 -- Pass through
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
17 return;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
18 end
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
19
6544
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
20 if stanza.name == "iq" then
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
21 if stanza.attr.type == "result" or stanza.attr.type == "error" then
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
22 -- Allow responses to iqs
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
23 return;
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
24 end
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
25 local payload = stanza.tags[1];
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
26 -- Allow push notification registration
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
27 if payload.name == "command" and payload.attr.xmlns == "http://jabber.org/protocol/commands" then
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
28 -- This should allow Tigase and p2 ad-hoc commands to pass through to push gateways
6547
cfcd2d2f7119 mod_restrict_federation: Fix attribute check
Matthew Wild <mwild1@gmail.com>
parents: 6544
diff changeset
29 local node = payload.attr.node;
6544
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
30 if node:match("^register%-") or node:match("^unregister%-") then
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
31 return;
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
32 end
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
33 end
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
34 end
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
35
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
36
6325
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
37 -- Block
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
38 module:log("debug", "Forbidding outgoing %s stanza from <%s> to <%s>", stanza.name, stanza.attr.from, stanza.attr.to);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
39 local err_reply = st.error_reply(event.stanza, "auth", "policy-violation", "Communication with remote domains is not permitted");
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
40 origin.send(err_reply);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
41 return true;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
42 end
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
43
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
44 function check_incoming_stanza(event)
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
45 local origin, stanza = event.origin, event.stanza;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
46
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
47 if origin.type ~= "s2sin" then
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
48 -- We only filter incoming traffic from remote domains
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
49 -- Pass through
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
50 return;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
51 end
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
52
6544
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
53 if stanza.name == "iq" then
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
54 if stanza.attr.type == "result" or stanza.attr.type == "error" then
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
55 -- Allow responses to iqs
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
56 return;
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
57 end
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
58 end
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
59
6325
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
60 local recipient_username = jid_node(stanza.attr.to);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
61 if not recipient_username then
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
62 return;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
63 end
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
64
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
65 local recipient_role, role_err = get_user_role(recipient_username, module.host);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
66 if not recipient_role then
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
67 module:log("warn", "Unable to determine recipient role: %s", role_err);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
68 -- No idea what the role is, we'll pass it through
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
69 return;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
70 end
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
71
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
72 if recipient_role:may("xmpp:federate") then
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
73 -- Allowed, pass through
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
74 return;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
75 end
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
76
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
77 -- Block
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
78 module:log("debug", "Forbidding incoming %s stanza from <%s> to <%s>", stanza.name, stanza.attr.from, stanza.attr.to);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
79 local err_reply = st.error_reply(event.stanza, "cancel", "service-unavailable");
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
80 origin.send(err_reply);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
81 return true;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
82 end
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
83
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
84 module:hook("message/bare", check_incoming_stanza, 500);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
85 module:hook("message/full", check_incoming_stanza, 500);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
86 module:hook("presence/bare", check_incoming_stanza, 500);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
87 module:hook("presence/full", check_incoming_stanza, 500);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
88 module:hook("iq/bare", check_incoming_stanza, 500);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
89 module:hook("iq/full", check_incoming_stanza, 500);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
90
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
91 module:hook("route/remote", check_outgoing_stanza, 500);