Mercurial > prosody-modules

annotate mod_host_blacklist/mod_host_blacklist.lua @ 5390:f2363e6d9a64

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_http_oauth2: Advertise the currently supported id_token signing algorithm This field is REQUIRED. The algorithm RS256 MUST be included, but isn't because we don't implement it, as that would require implementing a pile of additional cryptography and JWT stuff. Instead the id_token is signed using the client secret, which allows verification by the client, since it's a shared secret per OpenID Connect Core 1.0 ยง 10.1 under Symmetric Signatures. OpenID Connect Discovery 1.0 has a lot of REQUIRED and MUST clauses that are not supported here, but that's okay because this is served from the RFC 8414 OAuth 2.0 Authorization Server Metadata .well-known endpoint!
author Kim Alvefur <zash@zash.se>
date Sun, 30 Apr 2023 16:13:40 +0200
parents 547b3c05cc06
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1180
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
1 local jid_split = require "util.jid".split;
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
2 local st = require "util.stanza";
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
3 local set = require "util.set";
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
4 local select = select;
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
5
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
6 local blacklist = module:get_option_inherited_set("host_blacklist", {});
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
7
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
8 local function stanza_checker(attr)
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
9 return function (event)
1181
005b0429cf46 mod_host_blacklist: Small fix
Matthew Wild <mwild1@gmail.com>
parents: 1180
diff changeset
10 local host = select(2, jid_split(event.stanza.attr[attr]));
1180
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
11 if blacklist:contains(host) then
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
12 module:send(st.error_reply(event.stanza, "cancel", "not-allowed", "Communication with this domain is restricted"));
1182
547b3c05cc06 mod_host_blacklist: Bigger fix: return true to block original stanza (thanks Zash)
Matthew Wild <mwild1@gmail.com>
parents: 1181
diff changeset
13 return true;
1180
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
14 end
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
15 end
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
16 end
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
17
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
18 check_incoming_stanza = stanza_checker("from");
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
19 check_outgoing_stanza = stanza_checker("to");
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
20
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
21 for stanza_type in set.new{"presence","message","iq"}:items() do
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
22 for jid_type in set.new{"bare", "full", "host"}:items() do
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
23 module:hook("pre-"..stanza_type.."/"..jid_type, check_outgoing_stanza, 500);
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
24 module:hook(stanza_type.."/"..jid_type, check_incoming_stanza, 500);
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
25 end
513aa2e0c045 mod_host_blacklist: Similar to mod_s2s_blacklist, but stanza-based. Works between hosts on the same server, at a slight performance impact.
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
26 end