Mercurial > prosody-modules

annotate mod_restrict_federation/mod_restrict_federation.lua @ 6549:d2e50b587721

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_firewall: marks: switch to keyval+ store API
author Matthew Wild <mwild1@gmail.com>
date Sun, 24 May 2026 10:49:09 +0100
parents cfcd2d2f7119
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
6325
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
1 local jid_node = require "prosody.util.jid".node;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
2 local st = require "prosody.util.stanza";
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
3
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
4 local get_user_role = require "prosody.core.usermanager".get_user_role;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
5
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
6 function check_outgoing_stanza(event)
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
7 local origin, stanza = event.origin, event.stanza;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
8
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
9 if not origin or origin.type ~= "c2s" then
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
10 -- We only filter user-originated traffic, so
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
11 -- pass this through.
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
12 return;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
13 end
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
14
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
15 if module:may("xmpp:federate", event) then
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
16 -- Pass through
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
17 return;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
18 end
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
19
6544
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
20 if stanza.name == "iq" then
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
21 if stanza.attr.type == "result" or stanza.attr.type == "error" then
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
22 -- Allow responses to iqs
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
23 return;
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
24 end
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
25 local payload = stanza.tags[1];
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
26 -- Allow push notification registration
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
27 if payload.name == "command" and payload.attr.xmlns == "http://jabber.org/protocol/commands" then
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
28 -- This should allow Tigase and p2 ad-hoc commands to pass through to push gateways
6547
cfcd2d2f7119 mod_restrict_federation: Fix attribute check
Matthew Wild <mwild1@gmail.com>
parents: 6544
diff changeset
29 local node = payload.attr.node;
6544
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
30 if node:match("^register%-") or node:match("^unregister%-") then
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
31 return;
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
32 end
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
33 end
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
34 end
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
35
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
36
6325
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
37 -- Block
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
38 module:log("debug", "Forbidding outgoing %s stanza from <%s> to <%s>", stanza.name, stanza.attr.from, stanza.attr.to);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
39 local err_reply = st.error_reply(event.stanza, "auth", "policy-violation", "Communication with remote domains is not permitted");
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
40 origin.send(err_reply);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
41 return true;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
42 end
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
43
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
44 function check_incoming_stanza(event)
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
45 local origin, stanza = event.origin, event.stanza;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
46
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
47 if origin.type ~= "s2sin" then
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
48 -- We only filter incoming traffic from remote domains
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
49 -- Pass through
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
50 return;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
51 end
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
52
6544
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
53 if stanza.name == "iq" then
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
54 if stanza.attr.type == "result" or stanza.attr.type == "error" then
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
55 -- Allow responses to iqs
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
56 return;
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
57 end
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
58 end
981c14bb8975 mod_restrict_federation: Allow some ad-hoc commands used by push services
Matthew Wild <mwild1@gmail.com>
parents: 6325
diff changeset
59
6325
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
60 local recipient_username = jid_node(stanza.attr.to);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
61 if not recipient_username then
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
62 return;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
63 end
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
64
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
65 local recipient_role, role_err = get_user_role(recipient_username, module.host);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
66 if not recipient_role then
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
67 module:log("warn", "Unable to determine recipient role: %s", role_err);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
68 -- No idea what the role is, we'll pass it through
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
69 return;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
70 end
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
71
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
72 if recipient_role:may("xmpp:federate") then
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
73 -- Allowed, pass through
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
74 return;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
75 end
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
76
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
77 -- Block
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
78 module:log("debug", "Forbidding incoming %s stanza from <%s> to <%s>", stanza.name, stanza.attr.from, stanza.attr.to);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
79 local err_reply = st.error_reply(event.stanza, "cancel", "service-unavailable");
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
80 origin.send(err_reply);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
81 return true;
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
82 end
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
83
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
84 module:hook("message/bare", check_incoming_stanza, 500);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
85 module:hook("message/full", check_incoming_stanza, 500);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
86 module:hook("presence/bare", check_incoming_stanza, 500);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
87 module:hook("presence/full", check_incoming_stanza, 500);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
88 module:hook("iq/bare", check_incoming_stanza, 500);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
89 module:hook("iq/full", check_incoming_stanza, 500);
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
90
ba2c344e1bdd mod_restrict_federation: Yet another module for restricting s2s for (some) users
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
91 module:hook("route/remote", check_outgoing_stanza, 500);