Mercurial > prosody-modules

annotate mod_s2s_v6mesh/mod_s2s_v6mesh.lua @ 6478:bd785f524fd2

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
author Matthew Wild <mwild1@gmail.com>
date Wed, 18 Mar 2026 18:54:30 +0000
parents 88852e4f81bf
children 771944f2a7c7
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
1 --% requires: s2sout-pre-connect-event
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
2
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
3 module:set_global();
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
4
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
5 local basic_resolver = require "net.resolvers.basic";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
6 local base32 = module:require("base32");
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
7 local net = require "prosody.util.net";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
8
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
9 local ip = require "prosody.util.ip";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
10 local parse_cidr = require "prosody.util.ip".parse_cidr;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
11
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
12 local secure_ranges = module:get_option_set("s2s_v6mesh_secure_ranges", {});
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
13
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
14 local function is_secure_range(remote_ip)
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
15 for range in secure_ranges do
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
16 if ip.match(remote_ip, parse_cidr(range)) then
6476
4a1c17a5745f mod_s2s_v6mesh: Fixes for peer authentication
Matthew Wild <mwild1@gmail.com>
parents: 6472
diff changeset
17 return true, range;
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
18 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
19 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
20 return false;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
21 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
22
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
23 function lookup(dom)
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
24 local lendiff = 26 - #dom;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
25
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
26 if lendiff < 0 then
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
27 return nil; -- domain invalid; too long
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
28 elseif lendiff > 0 then
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
29 dom = dom:gsub("%-", ("a"):rep(lendiff+1));
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
30 if #dom ~= 26 then
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
31 return nil; -- domain invalid
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
32 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
33 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
34
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
35 local raw = base32.decode(dom);
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
36 if not raw then return nil; end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
37
6476
4a1c17a5745f mod_s2s_v6mesh: Fixes for peer authentication
Matthew Wild <mwild1@gmail.com>
parents: 6472
diff changeset
38 return net.ntop(raw), raw;
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
39 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
40
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
41 function module.add_host(host_module)
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
42 host_module:hook("s2sout-pre-connect", function(event)
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
43 local session = event.session;
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
44 local host = session.to_host;
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
45 local dom = host:match("([%w-]+)%.v6%.alt$");
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
46 if not dom then return; end
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
47
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
48 local target_ip = lookup(dom);
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
49 if not target_ip then
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
50 return;
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
51 end
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
52
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
53 host_module:log("debug", "Resolved %s to [%s]:%d", host, target_ip, 5269);
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
54
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
55 event.resolver = basic_resolver.new(target_ip, 5269, "tcp", {});
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
56
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
57 if is_secure_range(ip.new_ip(target_ip, "IPv6")) then
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
58 host_module:log("debug", "Treating non-TLS connection to %s as secure because it's in a secure IP range", host);
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
59 session.secure = true;
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
60 session.authenticated_remote = true;
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
61 session.cert_chain_status = "valid";
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
62 session.cert_identity_status = "valid";
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
63 end
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
64 end);
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
65
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
66 host_module:hook("s2s-stream-features", function (event)
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
67 local session = event.origin;
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
68 local host = session.from_host;
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
69
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
70 local dom = host:match("([%w-]+)%.v6%.alt$");
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
71 if not dom then
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
72 return;
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
73 end
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
74
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
75 local remote_ip = ip.new_ip(session.ip);
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
76
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
77 if select(2, lookup(dom)) ~= remote_ip.packed then
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
78 host_module:log("warn", "Rejecting incoming connection from %s: unexpected IP %s", host, remote_ip);
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
79 session:close({ condition = "not-authorized", text = "Hostname does not match IP address" });
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
80 return;
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
81 end
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
82
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
83 if is_secure_range(remote_ip) then
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
84 host_module:log("debug", "Treating non-TLS connection from %s as secure because it's in a secure IP range", host);
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
85 session.secure = true;
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
86 session.authenticated_remote = true;
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
87 session.cert_chain_status = "valid";
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
88 session.cert_identity_status = "valid";
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
89 end
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
90 end, 200);
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
91 end
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
92
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
93 module:hook("s2s-check-certificate", function(event)
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
94 local session, host = event.session, event.host;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
95
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
96 local dom = host:match("([%w-]+)%.v6%.alt$");
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
97 if not dom then
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
98 return;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
99 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
100
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
101 local remote_ip = ip.new_ip(session.ip);
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
102
6476
4a1c17a5745f mod_s2s_v6mesh: Fixes for peer authentication
Matthew Wild <mwild1@gmail.com>
parents: 6472
diff changeset
103 if select(2, lookup(dom)) ~= remote_ip.packed then
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
104 module:log("warn", "Unable to authenticate incoming connection from %s: unexpected IP %s", host, remote_ip);
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
105 return;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
106 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
107
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
108 module:log("debug", "Trusting certificate for %s because of IP match", host);
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
109 session.cert_chain_status = "valid";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
110 session.cert_identity_status = "valid";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
111 return true;
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
112 end, 600);
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
113
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
114 module:add_item("shell-command", {
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
115 section = "v6alt";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
116 section_desc = module.name.." utility commands";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
117 name = "get_domain";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
118 desc = "Convert an IPv6 address to a .v6.alt domain";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
119 args = {
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
120 { name = "ip", type = "string" };
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
121 };
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
122 handler = function(self, ip_str) --luacheck: ignore 212/self 212/host
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
123 local user_ip = ip.new_ip(ip_str, "IPv6");
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
124 if not user_ip then
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
125 return nil, "Invalid IP address: "..tostring(ip_str);
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
126 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
127
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
128 local encoded = base32.encode(user_ip.packed):gsub("=+$", "");
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
129 local longest_a_start, longest_a_len;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
130 for pos, seq in encoded:gmatch("()(aa+).", 2) do
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
131 if not longest_a_len or #seq >= longest_a_len then
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
132 longest_a_start, longest_a_len = pos, #seq;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
133 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
134 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
135 if longest_a_len then
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
136 encoded = encoded:sub(1, longest_a_start - 1) .. "-" .. encoded:sub(longest_a_start + longest_a_len, -1);
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
137 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
138 return true, ("Encoded hostname: %s.v6.alt"):format(encoded);
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
139 end;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
140 });
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
141
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
142 module:add_item("shell-command", {
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
143 section = "v6alt";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
144 section_desc = module.name.." utility commands";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
145 name = "get_ip";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
146 desc = "Convert a .v6.alt domain to an IP address";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
147 args = {
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
148 { name = "domain", type = "string" };
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
149 };
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
150 handler = function(self, domain) --luacheck: ignore 212/self 212/host
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
151 local encoded = domain:match("([%w-]+)%.v6%.alt$");
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
152 if not encoded then
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
153 return nil, "Invalid domain: "..domain;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
154 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
155 local user_ip = lookup(encoded);
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
156 return true, ("IP address: %s"):format(user_ip);
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
157 end;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
158 });
6477
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
159
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
160 module:add_item("shell-command", {
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
161 section = "v6alt";
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
162 section_desc = module.name.." utility commands";
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
163 name = "is_secure_range";
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
164 desc = "Check whether an IP address is considered secure";
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
165 args = {
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
166 { name = "ip", type = "string" };
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
167 };
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6477
diff changeset
168 handler = function(self, ip_str) --luacheck: ignore 212/self 212/host
6477
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
169 local user_ip = ip.new_ip(ip_str, "IPv6");
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
170 if not user_ip then
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
171 return nil, "Invalid IP address: "..tostring(ip_str);
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
172 end
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
173
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
174 local secure, range = is_secure_range(user_ip);
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
175
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
176 if not secure then
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
177 return true, "Not secure";
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
178 end
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
179
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
180 return true, ("In secure range: %s"):format(range);
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
181 end;
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses
Matthew Wild <mwild1@gmail.com>
parents: 6476
diff changeset
182 });