prosody-modules: mod_firewall/definitions.lib.lua annotate

annotate mod_firewall/definitions.lib.lua @ 6562:5da6fb562df9 default tip

mod_unified_push: Fix push error handling (fixes #2000) Use the error object that send_iq() passes as an argument to it's reject callback instead of attempting and failing to do the parsing in the callback itself.

author	kmq
date	Mon, 06 Jul 2026 14:23:57 +0200
parents	0002c727e918
children

rev	line source
2079 edec9de0220a mod_firewall: Silence warnings about unused arguments [luacheck] Kim Alvefur <zash@zash.se> parents: 1863 diff changeset	1
edec9de0220a mod_firewall: Silence warnings about unused arguments [luacheck] Kim Alvefur <zash@zash.se> parents: 1863 diff changeset	2 -- Name arguments are unused here
edec9de0220a mod_firewall: Silence warnings about unused arguments [luacheck] Kim Alvefur <zash@zash.se> parents: 1863 diff changeset	3 -- luacheck: ignore 212
999 197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	4
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	5 local definition_handlers = {};
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	6
2520 c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	7 local http = require "net.http";
1863 92602cfac751 mod_firewall: Fix missing import of util.set (used to be global) Kim Alvefur <zash@zash.se> parents: 999 diff changeset	8 local set = require"util.set";
999 197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	9 local new_throttle = require "util.throttle".create;
2586 d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	10 local hashes = require "util.hashes";
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	11 local jid = require "util.jid";
4016 b872f111b7af mod_firewall: Add option to ignore missing list files Matthew Wild <mwild1@gmail.com> parents: 3240 diff changeset	12 local lfs = require "lfs";
2128 21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	13
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	14 local multirate_cache_size = module:get_option_number("firewall_multirate_cache_limit", 1000);
999 197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	15
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	16 function definition_handlers.ZONE(zone_name, zone_members)
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	17 local zone_member_list = {};
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	18 for member in zone_members:gmatch("[^, ]+") do
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	19 zone_member_list[#zone_member_list+1] = member;
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	20 end
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	21 return set.new(zone_member_list)._items;
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	22 end
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	23
2128 21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	24 -- Helper function used by RATE handler
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	25 local function evict_only_unthrottled(name, throttle)
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	26 throttle:update();
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	27 -- Check whether the throttle is at max balance (i.e. totally safe to forget about it)
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	28 if throttle.balance < throttle.max then
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	29 -- Not safe to forget
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	30 return false;
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	31 end
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	32 end
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	33
999 197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	34 function definition_handlers.RATE(name, line)
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	35 local rate = assert(tonumber(line:match("([%d.]+)")), "Unable to parse rate");
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	36 local burst = tonumber(line:match("%(%sburst%s+([%d.]+)%s%)")) or 1;
2128 21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	37 local max_throttles = tonumber(line:match("%(%sentries%s+([%d]+)%s%)")) or multirate_cache_size;
2370 5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full Matthew Wild <mwild1@gmail.com> parents: 2131 diff changeset	38 local deny_when_full = not line:match("%(allow overflow%)");
2128 21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	39 return {
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	40 single = function ()
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	41 return new_throttle(rate*burst, burst);
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	42 end;
2859 22e11645a895 mod_firewall: Trim trailing whitespace [luacheck] Kim Alvefur <zash@zash.se> parents: 2587 diff changeset	43
2128 21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	44 multi = function ()
2370 5fe483b73fd2 mod_firewall: Rate limiting: Document 'entries' and add option to allow overflowing when full Matthew Wild <mwild1@gmail.com> parents: 2131 diff changeset	45 local cache = require "util.cache".new(max_throttles, deny_when_full and evict_only_unthrottled or nil);
2128 21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	46 return {
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	47 poll_on = function (_, key, amount)
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	48 assert(key, "no key");
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	49 local throttle = cache:get(key);
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	50 if not throttle then
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	51 throttle = new_throttle(rate*burst, burst);
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	52 if not cache:set(key, throttle) then
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	53 module:log("warn", "Multirate '%s' has hit its maximum number of active throttles (%d), denying new events", name, max_throttles);
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	54 return false;
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	55 end
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	56 end
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	57 return throttle:poll(amount);
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	58 end;
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	59 }
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	60 end;
21bc4d7cddae mod_firewall: Add support for throttling based on user-defined properties (experimental) Matthew Wild <mwild1@gmail.com> parents: 2079 diff changeset	61 };
999 197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	62 end
197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	63
2520 c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	64 local list_backends = {
2898 9fd61234b6f0 mod_firewall/definitions: Comments on LIST backends Kim Alvefur <zash@zash.se> parents: 2859 diff changeset	65 -- %LIST name: memory (limit: number)
2520 c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	66 memory = {
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	67 init = function (self, type, opts)
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	68 if opts.limit then
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	69 local have_cache_lib, cache_lib = pcall(require, "util.cache");
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	70 if not have_cache_lib then
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	71 error("In-memory lists with a size limit require Prosody 0.10");
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	72 end
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	73 self.cache = cache_lib.new((assert(tonumber(opts.limit), "Invalid list limit")));
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	74 if not self.cache.table then
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	75 error("In-memory lists with a size limit require a newer version of Prosody 0.10");
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	76 end
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	77 self.items = self.cache:table();
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	78 else
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	79 self.items = {};
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	80 end
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	81 end;
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	82 add = function (self, item)
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	83 self.items[item] = true;
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	84 end;
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	85 remove = function (self, item)
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	86 self.items[item] = nil;
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	87 end;
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	88 contains = function (self, item)
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	89 return self.items[item] == true;
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	90 end;
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	91 };
2898 9fd61234b6f0 mod_firewall/definitions: Comments on LIST backends Kim Alvefur <zash@zash.se> parents: 2859 diff changeset	92
9fd61234b6f0 mod_firewall/definitions: Comments on LIST backends Kim Alvefur <zash@zash.se> parents: 2859 diff changeset	93 -- %LIST name: http://example.com/ (ttl: number, pattern: pat, hash: sha1)
2520 c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	94 http = {
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	95 init = function (self, url, opts)
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	96 local poll_interval = assert(tonumber(opts.ttl or "3600"), "invalid ttl for <"..url.."> (expected number of seconds)");
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	97 local pattern = opts.pattern or "([^\r\n]+)\r?\n";
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	98 assert(pcall(string.match, "", pattern), "invalid pattern for <"..url..">");
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	99 if opts.hash then
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	100 assert(opts.hash:match("^%w+$") and type(hashes[opts.hash]) == "function", "invalid hash function: "..opts.hash);
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	101 self.hash_function = hashes[opts.hash];
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	102 end
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	103 local etag;
2522 72cbec103709 mod_firewall: Improve HTTP polling logic Matthew Wild <mwild1@gmail.com> parents: 2520 diff changeset	104 local failure_count = 0;
72cbec103709 mod_firewall: Improve HTTP polling logic Matthew Wild <mwild1@gmail.com> parents: 2520 diff changeset	105 local retry_intervals = { 60, 120, 300 };
4127 e9e10ec1b91c mod_firewall: Add checkcerts option for HTTP lists, cert verification disabled when SNI unsupported Matthew Wild <mwild1@gmail.com> parents: 4017 diff changeset	106 -- By default only check the certificate if net.http supports SNI
e9e10ec1b91c mod_firewall: Add checkcerts option for HTTP lists, cert verification disabled when SNI unsupported Matthew Wild <mwild1@gmail.com> parents: 4017 diff changeset	107 local sni_supported = http.feature and http.features.sni;
e9e10ec1b91c mod_firewall: Add checkcerts option for HTTP lists, cert verification disabled when SNI unsupported Matthew Wild <mwild1@gmail.com> parents: 4017 diff changeset	108 local insecure = false;
e9e10ec1b91c mod_firewall: Add checkcerts option for HTTP lists, cert verification disabled when SNI unsupported Matthew Wild <mwild1@gmail.com> parents: 4017 diff changeset	109 if opts.checkcert == "never" then
e9e10ec1b91c mod_firewall: Add checkcerts option for HTTP lists, cert verification disabled when SNI unsupported Matthew Wild <mwild1@gmail.com> parents: 4017 diff changeset	110 insecure = true;
e9e10ec1b91c mod_firewall: Add checkcerts option for HTTP lists, cert verification disabled when SNI unsupported Matthew Wild <mwild1@gmail.com> parents: 4017 diff changeset	111 elseif (opts.checkcert == nil or opts.checkcert == "when-sni") and not sni_supported then
e9e10ec1b91c mod_firewall: Add checkcerts option for HTTP lists, cert verification disabled when SNI unsupported Matthew Wild <mwild1@gmail.com> parents: 4017 diff changeset	112 insecure = false;
e9e10ec1b91c mod_firewall: Add checkcerts option for HTTP lists, cert verification disabled when SNI unsupported Matthew Wild <mwild1@gmail.com> parents: 4017 diff changeset	113 end
2520 c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	114 local function update_list()
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	115 http.request(url, {
4127 e9e10ec1b91c mod_firewall: Add checkcerts option for HTTP lists, cert verification disabled when SNI unsupported Matthew Wild <mwild1@gmail.com> parents: 4017 diff changeset	116 insecure = insecure;
2520 c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	117 headers = {
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	118 ["If-None-Match"] = etag;
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	119 };
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	120 }, function (body, code, response)
2522 72cbec103709 mod_firewall: Improve HTTP polling logic Matthew Wild <mwild1@gmail.com> parents: 2520 diff changeset	121 local next_poll = poll_interval;
2520 c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	122 if code == 200 and body then
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	123 etag = response.headers.etag;
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	124 local items = {};
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	125 for entry in body:gmatch(pattern) do
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	126 items[entry] = true;
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	127 end
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	128 self.items = items;
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	129 module:log("debug", "Fetched updated list from <%s>", url);
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	130 elseif code == 304 then
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	131 module:log("debug", "List at <%s> is unchanged", url);
2522 72cbec103709 mod_firewall: Improve HTTP polling logic Matthew Wild <mwild1@gmail.com> parents: 2520 diff changeset	132 elseif code == 0 or (code >= 400 and code <=599) then
2520 c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	133 module:log("warn", "Failed to fetch list from <%s>: %d %s", url, code, tostring(body));
2522 72cbec103709 mod_firewall: Improve HTTP polling logic Matthew Wild <mwild1@gmail.com> parents: 2520 diff changeset	134 failure_count = failure_count + 1;
72cbec103709 mod_firewall: Improve HTTP polling logic Matthew Wild <mwild1@gmail.com> parents: 2520 diff changeset	135 next_poll = retry_intervals[failure_count] or retry_intervals[#retry_intervals];
2520 c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	136 end
2522 72cbec103709 mod_firewall: Improve HTTP polling logic Matthew Wild <mwild1@gmail.com> parents: 2520 diff changeset	137 if next_poll > 0 then
6554 0002c727e918 mod_firewall: Use module:add_timer() for HTTP polling Matthew Wild <mwild1@gmail.com> parents: 5233 diff changeset	138 return next_poll + math.random(0, 60);
2520 c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	139 end
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	140 end);
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	141 end
6554 0002c727e918 mod_firewall: Use module:add_timer() for HTTP polling Matthew Wild <mwild1@gmail.com> parents: 5233 diff changeset	142 local delay = update_list();
0002c727e918 mod_firewall: Use module:add_timer() for HTTP polling Matthew Wild <mwild1@gmail.com> parents: 5233 diff changeset	143 if delay then
0002c727e918 mod_firewall: Use module:add_timer() for HTTP polling Matthew Wild <mwild1@gmail.com> parents: 5233 diff changeset	144 module:add_timer(delay, update_list);
0002c727e918 mod_firewall: Use module:add_timer() for HTTP polling Matthew Wild <mwild1@gmail.com> parents: 5233 diff changeset	145 end
2520 c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	146 end;
2530 84e103fd8039 mod_firewall: Add dummy add/remove methods for HTTP lists Matthew Wild <mwild1@gmail.com> parents: 2528 diff changeset	147 add = function ()
84e103fd8039 mod_firewall: Add dummy add/remove methods for HTTP lists Matthew Wild <mwild1@gmail.com> parents: 2528 diff changeset	148 end;
84e103fd8039 mod_firewall: Add dummy add/remove methods for HTTP lists Matthew Wild <mwild1@gmail.com> parents: 2528 diff changeset	149 remove = function ()
84e103fd8039 mod_firewall: Add dummy add/remove methods for HTTP lists Matthew Wild <mwild1@gmail.com> parents: 2528 diff changeset	150 end;
2520 c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	151 contains = function (self, item)
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	152 if self.hash_function then
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	153 item = self.hash_function(item);
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	154 end
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	155 return self.items and self.items[item] == true;
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	156 end;
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	157 };
2898 9fd61234b6f0 mod_firewall/definitions: Comments on LIST backends Kim Alvefur <zash@zash.se> parents: 2859 diff changeset	158
9fd61234b6f0 mod_firewall/definitions: Comments on LIST backends Kim Alvefur <zash@zash.se> parents: 2859 diff changeset	159 -- %LIST: file:/path/to/file
2532 2ddb74805f91 mod_firewall: Add 'file' backend for lists (read-only atm) Matthew Wild <mwild1@gmail.com> parents: 2530 diff changeset	160 file = {
2535 b85d88737a32 mod_firewall: Fix file backend init code Matthew Wild <mwild1@gmail.com> parents: 2532 diff changeset	161 init = function (self, file_spec, opts)
4017 015452258952 mod_firewall: Ensure file lists are always initialized empty Matthew Wild <mwild1@gmail.com> parents: 4016 diff changeset	162 local n, items = 0, {};
015452258952 mod_firewall: Ensure file lists are always initialized empty Matthew Wild <mwild1@gmail.com> parents: 4016 diff changeset	163 self.items = items;
2535 b85d88737a32 mod_firewall: Fix file backend init code Matthew Wild <mwild1@gmail.com> parents: 2532 diff changeset	164 local filename = file_spec:gsub("^file:", "");
4016 b872f111b7af mod_firewall: Add option to ignore missing list files Matthew Wild <mwild1@gmail.com> parents: 3240 diff changeset	165 if opts.missing == "ignore" and not lfs.attributes(filename, "mode") then
b872f111b7af mod_firewall: Add option to ignore missing list files Matthew Wild <mwild1@gmail.com> parents: 3240 diff changeset	166 module:log("debug", "Ignoring missing list file: %s", filename);
b872f111b7af mod_firewall: Add option to ignore missing list files Matthew Wild <mwild1@gmail.com> parents: 3240 diff changeset	167 return;
b872f111b7af mod_firewall: Add option to ignore missing list files Matthew Wild <mwild1@gmail.com> parents: 3240 diff changeset	168 end
2532 2ddb74805f91 mod_firewall: Add 'file' backend for lists (read-only atm) Matthew Wild <mwild1@gmail.com> parents: 2530 diff changeset	169 local file, err = io.open(filename);
2ddb74805f91 mod_firewall: Add 'file' backend for lists (read-only atm) Matthew Wild <mwild1@gmail.com> parents: 2530 diff changeset	170 if not file then
2ddb74805f91 mod_firewall: Add 'file' backend for lists (read-only atm) Matthew Wild <mwild1@gmail.com> parents: 2530 diff changeset	171 module:log("warn", "Failed to open list from %s: %s", filename, err);
2ddb74805f91 mod_firewall: Add 'file' backend for lists (read-only atm) Matthew Wild <mwild1@gmail.com> parents: 2530 diff changeset	172 return;
3240 c30f2cfe9f15 mod_firewall: Assume empty list if file could not be loaded Matthew Wild <mwild1@gmail.com> parents: 2898 diff changeset	173 else
c30f2cfe9f15 mod_firewall: Assume empty list if file could not be loaded Matthew Wild <mwild1@gmail.com> parents: 2898 diff changeset	174 for line in file:lines() do
c30f2cfe9f15 mod_firewall: Assume empty list if file could not be loaded Matthew Wild <mwild1@gmail.com> parents: 2898 diff changeset	175 if not items[line] then
c30f2cfe9f15 mod_firewall: Assume empty list if file could not be loaded Matthew Wild <mwild1@gmail.com> parents: 2898 diff changeset	176 n = n + 1;
c30f2cfe9f15 mod_firewall: Assume empty list if file could not be loaded Matthew Wild <mwild1@gmail.com> parents: 2898 diff changeset	177 items[line] = true;
c30f2cfe9f15 mod_firewall: Assume empty list if file could not be loaded Matthew Wild <mwild1@gmail.com> parents: 2898 diff changeset	178 end
2536 22a271641c29 mod_firewall: Improve debug logging for LIST file backend Matthew Wild <mwild1@gmail.com> parents: 2535 diff changeset	179 end
2532 2ddb74805f91 mod_firewall: Add 'file' backend for lists (read-only atm) Matthew Wild <mwild1@gmail.com> parents: 2530 diff changeset	180 end
2536 22a271641c29 mod_firewall: Improve debug logging for LIST file backend Matthew Wild <mwild1@gmail.com> parents: 2535 diff changeset	181 module:log("debug", "Loaded %d items from %s", n, filename);
2532 2ddb74805f91 mod_firewall: Add 'file' backend for lists (read-only atm) Matthew Wild <mwild1@gmail.com> parents: 2530 diff changeset	182 end;
2ddb74805f91 mod_firewall: Add 'file' backend for lists (read-only atm) Matthew Wild <mwild1@gmail.com> parents: 2530 diff changeset	183 add = function (self, item)
2ddb74805f91 mod_firewall: Add 'file' backend for lists (read-only atm) Matthew Wild <mwild1@gmail.com> parents: 2530 diff changeset	184 self.items[item] = true;
2ddb74805f91 mod_firewall: Add 'file' backend for lists (read-only atm) Matthew Wild <mwild1@gmail.com> parents: 2530 diff changeset	185 end;
2ddb74805f91 mod_firewall: Add 'file' backend for lists (read-only atm) Matthew Wild <mwild1@gmail.com> parents: 2530 diff changeset	186 remove = function (self, item)
2ddb74805f91 mod_firewall: Add 'file' backend for lists (read-only atm) Matthew Wild <mwild1@gmail.com> parents: 2530 diff changeset	187 self.items[item] = nil;
2ddb74805f91 mod_firewall: Add 'file' backend for lists (read-only atm) Matthew Wild <mwild1@gmail.com> parents: 2530 diff changeset	188 end;
2ddb74805f91 mod_firewall: Add 'file' backend for lists (read-only atm) Matthew Wild <mwild1@gmail.com> parents: 2530 diff changeset	189 contains = function (self, item)
2ddb74805f91 mod_firewall: Add 'file' backend for lists (read-only atm) Matthew Wild <mwild1@gmail.com> parents: 2530 diff changeset	190 return self.items and self.items[item] == true;
2ddb74805f91 mod_firewall: Add 'file' backend for lists (read-only atm) Matthew Wild <mwild1@gmail.com> parents: 2530 diff changeset	191 end;
2ddb74805f91 mod_firewall: Add 'file' backend for lists (read-only atm) Matthew Wild <mwild1@gmail.com> parents: 2530 diff changeset	192 };
4512 b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	193
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	194 -- %LIST: pubsub:pubsub.example.com/node
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	195 -- TODO or the actual URI scheme? Bit overkill maybe?
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	196 -- TODO Publish items back to the service?
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	197 -- Step 1: Receiving pubsub events and storing them in the list
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	198 -- We'll start by using only the item id.
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	199 -- TODO Invent some custom schema for this? Needed for just a set of strings?
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	200 pubsubitemid = {
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	201 init = function(self, pubsub_spec, opts)
5232 0f943619e01a mod_firewall: Fix parsing of pubsubitemid list specification Matthew Wild <mwild1@gmail.com> parents: 4512 diff changeset	202 local service_addr, node = pubsub_spec:match("^pubsubitemid:([^/])/(.)");
5233 7eec2bc67c26 mod_firewall: Warn about invalid pubsubitemid list specification Matthew Wild <mwild1@gmail.com> parents: 5232 diff changeset	203 if not service_addr then
7eec2bc67c26 mod_firewall: Warn about invalid pubsubitemid list specification Matthew Wild <mwild1@gmail.com> parents: 5232 diff changeset	204 module:log("warn", "Invalid list specification (expected 'pubsubitemid:<service>/<node>', got: '%s')", pubsub_spec);
7eec2bc67c26 mod_firewall: Warn about invalid pubsubitemid list specification Matthew Wild <mwild1@gmail.com> parents: 5232 diff changeset	205 return;
7eec2bc67c26 mod_firewall: Warn about invalid pubsubitemid list specification Matthew Wild <mwild1@gmail.com> parents: 5232 diff changeset	206 end
4512 b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	207 module:depends("pubsub_subscription");
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	208 module:add_item("pubsub-subscription", {
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	209 service = service_addr;
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	210 node = node;
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	211 on_subscribed = function ()
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	212 self.items = {};
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	213 end;
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	214 on_item = function (event)
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	215 self:add(event.item.attr.id);
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	216 end;
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	217 on_retract = function (event)
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	218 self:remove(event.item.attr.id);
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	219 end;
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	220 on_purge = function ()
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	221 self.items = {};
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	222 end;
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	223 on_unsubscribed = function ()
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	224 self.items = nil;
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	225 end;
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	226 on_delete= function ()
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	227 self.items = nil;
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	228 end;
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	229 });
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	230 -- TODO Initial fetch? Or should mod_pubsub_subscription do this?
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	231 end;
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	232 add = function (self, item)
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	233 if self.items then
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	234 self.items[item] = true;
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	235 end
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	236 end;
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	237 remove = function (self, item)
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	238 if self.items then
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	239 self.items[item] = nil;
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	240 end
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	241 end;
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	242 contains = function (self, item)
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	243 return self.items and self.items[item] == true;
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	244 end;
b88f05c878ac mod_firewall: Add basic LIST backend for receiving items from PubSub Kim Alvefur <zash@zash.se> parents: 4127 diff changeset	245 };
2520 c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	246 };
2523 a3a18d09ae8a mod_firewall: Also handle HTTPS for lists Matthew Wild <mwild1@gmail.com> parents: 2522 diff changeset	247 list_backends.https = list_backends.http;
2520 c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	248
2586 d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	249 local normalize_functions = {
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	250 upper = string.upper, lower = string.lower;
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	251 md5 = hashes.md5, sha1 = hashes.sha1, sha256 = hashes.sha256;
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	252 prep = jid.prep, bare = jid.bare;
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	253 };
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	254
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	255 local function wrap_list_method(list_method, filter)
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	256 return function (self, item)
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	257 return list_method(self, filter(item));
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	258 end
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	259 end
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	260
2520 c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	261 local function create_list(list_backend, list_def, opts)
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	262 if not list_backends[list_backend] then
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	263 error("Unknown list type '"..list_backend.."'", 0);
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	264 end
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	265 local list = setmetatable({}, { __index = list_backends[list_backend] });
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	266 if list.init then
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	267 list:init(list_def, opts);
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	268 end
2586 d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	269 if opts.filter then
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	270 local filters = {};
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	271 for func_name in opts.filter:gmatch("[%w_]+") do
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	272 if func_name == "log" then
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	273 table.insert(filters, function (s)
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	274 --print("&&&&&", s);
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	275 module:log("debug", "Checking list <%s> for: %s", list_def, s);
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	276 return s;
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	277 end);
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	278 else
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	279 assert(normalize_functions[func_name], "Unknown list filter: "..func_name);
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	280 table.insert(filters, normalize_functions[func_name]);
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	281 end
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	282 end
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	283
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	284 local filter;
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	285 local n = #filters;
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	286 if n == 1 then
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	287 filter = filters[1];
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	288 else
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	289 function filter(s)
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	290 for i = 1, n do
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	291 s = filters[i](s or "");
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	292 end
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	293 return s;
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	294 end
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	295 end
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	296
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	297 list.add = wrap_list_method(list.add, filter);
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	298 list.remove = wrap_list_method(list.remove, filter);
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	299 list.contains = wrap_list_method(list.contains, filter);
d28e434cb5fd mod_firewall: Support filters for normalizing items before checking for them in lists Matthew Wild <mwild1@gmail.com> parents: 2536 diff changeset	300 end
2520 c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	301 return list;
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	302 end
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	303
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	304 --[[
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	305 %LIST spammers: memory (source: /etc/spammers.txt)
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	306
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	307 %LIST spammers: memory (source: /etc/spammers.txt)
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	308
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	309
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	310 %LIST spammers: http://example.com/blacklist.txt
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	311 ]]
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	312
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	313 function definition_handlers.LIST(list_name, list_definition)
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	314 local list_backend = list_definition:match("^%w+");
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	315 local opts = {};
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	316 local opt_string = list_definition:match("^%S+%s+%((.+)%)");
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	317 if opt_string then
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	318 for opt_k, opt_v in opt_string:gmatch("(%w+): ?([^,]+)") do
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	319 opts[opt_k] = opt_v;
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	320 end
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	321 end
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	322 return create_list(list_backend, list_definition:match("^%S+"), opts);
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	323 end
c6fd8975704b mod_firewall: Initial support for lists, in-memory and HTTP Matthew Wild <mwild1@gmail.com> parents: 2370 diff changeset	324
2528 44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2523 diff changeset	325 function definition_handlers.PATTERN(name, pattern)
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2523 diff changeset	326 local ok, err = pcall(string.match, "", pattern);
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2523 diff changeset	327 if not ok then
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2523 diff changeset	328 error("Invalid pattern '"..name.."': "..err);
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2523 diff changeset	329 end
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2523 diff changeset	330 return pattern;
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2523 diff changeset	331 end
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2523 diff changeset	332
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2523 diff changeset	333 function definition_handlers.SEARCH(name, pattern)
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2523 diff changeset	334 return pattern;
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2523 diff changeset	335 end
44a71584521d mod_firewall: Add SEARCH, PATTERN definitions and SCAN condition to check tokenized stanza:find() against a list Matthew Wild <mwild1@gmail.com> parents: 2523 diff changeset	336
999 197af8440ffb mod_firewall: Make defining objects generic (currently zones and rate limits), so more can easily be added. Also a syntax change... definition lines must begin with % Matthew Wild <mwild1@gmail.com> parents: diff changeset	337 return definition_handlers;

Mercurial > prosody-modules

annotate mod_firewall/definitions.lib.lua @ 6562:5da6fb562df9 default tip