Mercurial > prosody-modules

annotate mod_firewall/trace.lib.lua @ 6538:de1f17ed4dac

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_firewall: Add support for tracing rule evaluation in real-time
author Matthew Wild <mwild1@gmail.com>
date Mon, 11 May 2026 13:37:19 +0100
parents
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
6538
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
1 local async = require "prosody.util.async";
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
2
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
3 local tracers = {};
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
4
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
5 local trace_mt = {
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
6 __close = function (t)
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
7 for session, options in pairs(tracers) do
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
8 if not options.tag or options.tag == (t.tag or "untagged") then
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
9 session.print(("\n## Evaluating [%s::%s] (%s)"):format(t.filename, t.chain, t.tag or "untagged"));
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
10 local stanza_log = options.stanzas;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
11 if stanza_log == "full" then
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
12 session.print(t.stanza);
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
13 elseif not stanza_log or stanza_log == "header" then
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
14 session.print(t.stanza:top_tag());
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
15 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
16
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
17 for rule_n, rule_trace in ipairs(t.rules) do
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
18 local source = t.source[rule_n].source;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
19 for cond_n, matched in ipairs(rule_trace) do
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
20 session.print(
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
21 ("%s %s"):format(
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
22 matched and "✔" or "✖",
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
23 source.conditions[cond_n] or ("Rule %d condition %d"):format(rule_n, cond_n)
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
24 )
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
25 );
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
26 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
27 if rule_trace.matched then
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
28 for _, action in ipairs(source.actions) do
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
29 session.print("➜ "..action);
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
30 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
31 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
32 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
33 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
34 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
35 end;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
36 };
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
37
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
38 local function init(filename, chain_name, stanza, tag, source_rules)
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
39 local rule_trace = {};
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
40 local trace = setmetatable({
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
41 filename = filename;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
42 chain = chain_name;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
43 rules = rule_trace;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
44 stanza = stanza;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
45 tag = tag;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
46 source = source_rules;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
47 }, trace_mt);
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
48 return trace, function (rule_n, cond_n, result)
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
49 local rule = rule_trace[rule_n];
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
50 if not rule then
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
51 rule = {};
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
52 rule_trace[rule_n] = rule;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
53 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
54
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
55 if cond_n then
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
56 rule[cond_n] = result;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
57 return result;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
58 else
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
59 -- Rule finished
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
60 rule.matched = result;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
61 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
62 end;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
63 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
64
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
65
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
66 module:add_item("shell-command", {
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
67 section = "firewall";
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
68 section_desc = "mod_firewall commands";
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
69 name = "trace";
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
70 desc = "Trace executions";
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
71 args = {
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
72 { name = "host", type = "string" };
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
73 };
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
74 host_selector = "host";
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
75 flags = {
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
76 short_params = { t = "tag" };
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
77 value_params = { tag = true, stanzas = true };
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
78 };
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
79 handler = function(self, host, opts) --luacheck: ignore 212/self 212/host
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
80 self.session.print("# Tracing mod_firewall on "..host);
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
81 tracers[self.session] = opts or {};
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
82
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
83 while self.session.is_connected() do
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
84 async.sleep(3);
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
85 end
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
86
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
87 tracers[self.session] = nil;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
88 return true;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
89 end;
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
90 });
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
91
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
92
de1f17ed4dac mod_firewall: Add support for tracing rule evaluation in real-time
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
93 return { init = init };