prosody-modules: mod_s2s_v6mesh/mod_s2s

annotate mod_s2s_v6mesh/mod_s2s_v6mesh.lua @ 6562:5da6fb562df9 default tip

mod_unified_push: Fix push error handling (fixes #2000) Use the error object that send_iq() passes as an argument to it's reject callback instead of attempting and failing to do the parsing in the callback itself.

author	kmq
date	Mon, 06 Jul 2026 14:23:57 +0200
parents	771944f2a7c7
children

rev	line source
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	1 --% requires: s2sout-pre-connect-event
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	2
6478 bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	3 module:set_global();
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	4
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	5 local basic_resolver = require "net.resolvers.basic";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	6 local base32 = module:require("base32");
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	7 local net = require "prosody.util.net";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	8
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	9 local ip = require "prosody.util.ip";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	10 local parse_cidr = require "prosody.util.ip".parse_cidr;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	11
6490 771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	12 local mesh_ranges = module:get_option("s2s_v6mesh_ranges", {});
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	13 local trust_all_certs = module:get_option_boolean("s2s_v6mesh_trust_all_certs", true);
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	14
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	15 local function is_secure_range(remote_ip)
6490 771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	16 for range, range_config in pairs(mesh_ranges) do
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	17 if ip.match(remote_ip, parse_cidr(range)) then
6490 771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	18 return range, range_config;
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	19 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	20 end
6490 771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	21 return nil;
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	22 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	23
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	24 function lookup(dom)
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	25 local lendiff = 26 - #dom;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	26
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	27 if lendiff < 0 then
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	28 return nil; -- domain invalid; too long
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	29 elseif lendiff > 0 then
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	30 dom = dom:gsub("%-", ("a"):rep(lendiff+1));
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	31 if #dom ~= 26 then
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	32 return nil; -- domain invalid
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	33 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	34 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	35
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	36 local raw = base32.decode(dom);
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	37 if not raw then return nil; end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	38
6476 4a1c17a5745f mod_s2s_v6mesh: Fixes for peer authentication Matthew Wild <mwild1@gmail.com> parents: 6472 diff changeset	39 return net.ntop(raw), raw;
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	40 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	41
6490 771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	42 local function apply_range_config(host_module, host, session, target_ip)
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	43 local range, range_config = is_secure_range(target_ip);
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	44
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	45 if range then
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	46 if range_config.use_tls == false then
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	47 host_module:log("debug", "Treating non-TLS connection to %s as secure because of range configuration", host);
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	48 session.secure = true;
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	49 end
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	50 if range_config.trust_all_certs ~= false then
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	51 module:log("debug", "Auto-trusting certificate for %s because of range configuration", host);
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	52 session.authenticated_remote = true;
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	53 session.cert_chain_status = "valid";
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	54 session.cert_identity_status = "valid";
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	55 else
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	56 module:log("debug", "Not auto-trusting certificate for $s (IP in unconfigured range): %s", host);
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	57 end
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	58 elseif trust_all_certs then
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	59 module:log("debug", "Auto-trusting certificate for %s because of default policy", host);
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	60 session.authenticated_remote = true;
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	61 session.cert_chain_status = "valid";
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	62 session.cert_identity_status = "valid";
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	63 end
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	64 end
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	65
6478 bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	66 function module.add_host(host_module)
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	67 host_module:hook("s2sout-pre-connect", function(event)
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	68 local session = event.session;
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	69 local host = session.to_host;
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	70 local dom = host:match("([%w-]+)%.v6%.alt$");
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	71 if not dom then return; end
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	72
6478 bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	73 local target_ip = lookup(dom);
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	74 if not target_ip then
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	75 return;
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	76 end
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	77
6478 bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	78 host_module:log("debug", "Resolved %s to [%s]:%d", host, target_ip, 5269);
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	79
6478 bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	80 event.resolver = basic_resolver.new(target_ip, 5269, "tcp", {});
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	81
6490 771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	82 local range_ip = ip.new_ip(target_ip, "IPv6");
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	83 apply_range_config(host_module, host, session, range_ip);
6478 bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	84 end);
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	85
6478 bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	86 host_module:hook("s2s-stream-features", function (event)
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	87 local session = event.origin;
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	88 local host = session.from_host;
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	89
6478 bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	90 local dom = host:match("([%w-]+)%.v6%.alt$");
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	91 if not dom then
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	92 return;
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	93 end
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	94
6478 bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	95 local remote_ip = ip.new_ip(session.ip);
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	96
6478 bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	97 if select(2, lookup(dom)) ~= remote_ip.packed then
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	98 host_module:log("warn", "Rejecting incoming connection from %s: unexpected IP %s", host, remote_ip);
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	99 session:close({ condition = "not-authorized", text = "Hostname does not match IP address" });
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	100 return;
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	101 end
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	102
6490 771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	103 apply_range_config(host_module, host, session, remote_ip);
6478 bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	104 end, 200);
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	105 end
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	106
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	107 module:hook("s2s-check-certificate", function(event)
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	108 local session, host = event.session, event.host;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	109
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	110 local dom = host:match("([%w-]+)%.v6%.alt$");
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	111 if not dom then
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	112 return;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	113 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	114
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	115 local remote_ip = ip.new_ip(session.ip);
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	116
6476 4a1c17a5745f mod_s2s_v6mesh: Fixes for peer authentication Matthew Wild <mwild1@gmail.com> parents: 6472 diff changeset	117 if select(2, lookup(dom)) ~= remote_ip.packed then
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	118 module:log("warn", "Unable to authenticate incoming connection from %s: unexpected IP %s", host, remote_ip);
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	119 return;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	120 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	121
6490 771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	122 local range, range_config = is_secure_range(remote_ip);
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	123 if range then
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	124 if range_config.trust_all_certs ~= false then
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	125 module:log("debug", "Auto-trusting certificate for %s because of IP match", host);
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	126 session.cert_chain_status = "valid";
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	127 session.cert_identity_status = "valid";
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	128 else
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	129 module:log("debug", "Not auto-trusting certificate for $s (IP in unconfigured range): %s", host);
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	130 end
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	131 elseif trust_all_certs then
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	132 module:log("debug", "Auto-trusting certificate for %s because of default policy", host);
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	133 session.authenticated_remote = true;
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	134 session.cert_chain_status = "valid";
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	135 session.cert_identity_status = "valid";
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	136 return true;
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	137 end
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	138
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	139 if not session.conn.extra then
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	140 session.conn.extra = {};
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	141 end
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	142 -- This can be used by mod_s2s_auth_certs to validate IP certificates,
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	143 -- if supported.
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	144 session.conn.extra.secure_hostname = tostring(remote_ip);
6478 bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	145 end, 600);
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	146
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	147 module:add_item("shell-command", {
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	148 section = "v6alt";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	149 section_desc = module.name.." utility commands";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	150 name = "get_domain";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	151 desc = "Convert an IPv6 address to a .v6.alt domain";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	152 args = {
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	153 { name = "ip", type = "string" };
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	154 };
6478 bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	155 handler = function(self, ip_str) --luacheck: ignore 212/self 212/host
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	156 local user_ip = ip.new_ip(ip_str, "IPv6");
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	157 if not user_ip then
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	158 return nil, "Invalid IP address: "..tostring(ip_str);
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	159 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	160
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	161 local encoded = base32.encode(user_ip.packed):gsub("=+$", "");
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	162 local longest_a_start, longest_a_len;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	163 for pos, seq in encoded:gmatch("()(aa+).", 2) do
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	164 if not longest_a_len or #seq >= longest_a_len then
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	165 longest_a_start, longest_a_len = pos, #seq;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	166 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	167 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	168 if longest_a_len then
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	169 encoded = encoded:sub(1, longest_a_start - 1) .. "-" .. encoded:sub(longest_a_start + longest_a_len, -1);
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	170 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	171 return true, ("Encoded hostname: %s.v6.alt"):format(encoded);
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	172 end;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	173 });
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	174
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	175 module:add_item("shell-command", {
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	176 section = "v6alt";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	177 section_desc = module.name.." utility commands";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	178 name = "get_ip";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	179 desc = "Convert a .v6.alt domain to an IP address";
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	180 args = {
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	181 { name = "domain", type = "string" };
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	182 };
6478 bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected Matthew Wild <mwild1@gmail.com> parents: 6477 diff changeset	183 handler = function(self, domain) --luacheck: ignore 212/self 212/host
6472 9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	184 local encoded = domain:match("([%w-]+)%.v6%.alt$");
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	185 if not encoded then
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	186 return nil, "Invalid domain: "..domain;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	187 end
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	188 local user_ip = lookup(encoded);
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	189 return true, ("IP address: %s"):format(user_ip);
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	190 end;
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks Matthew Wild <mwild1@gmail.com> parents: diff changeset	191 });
6477 88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses Matthew Wild <mwild1@gmail.com> parents: 6476 diff changeset	192
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses Matthew Wild <mwild1@gmail.com> parents: 6476 diff changeset	193 module:add_item("shell-command", {
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses Matthew Wild <mwild1@gmail.com> parents: 6476 diff changeset	194 section = "v6alt";
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses Matthew Wild <mwild1@gmail.com> parents: 6476 diff changeset	195 section_desc = module.name.." utility commands";
6490 771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	196 name = "range";
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	197 desc = "Check whether a host/IP address is within a configured range";
6477 88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses Matthew Wild <mwild1@gmail.com> parents: 6476 diff changeset	198 args = {
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses Matthew Wild <mwild1@gmail.com> parents: 6476 diff changeset	199 { name = "ip", type = "string" };
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses Matthew Wild <mwild1@gmail.com> parents: 6476 diff changeset	200 };
6490 771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	201 handler = function(self, str) --luacheck: ignore 212/self 212/host
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	202 local encoded = str:match("([%w-]+)%.v6%.alt$");
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	203
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	204 local ip_str = encoded and lookup(encoded) or str;
6477 88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses Matthew Wild <mwild1@gmail.com> parents: 6476 diff changeset	205 local user_ip = ip.new_ip(ip_str, "IPv6");
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses Matthew Wild <mwild1@gmail.com> parents: 6476 diff changeset	206 if not user_ip then
6490 771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	207 return nil, "Invalid domain or IP: "..tostring(str);
6477 88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses Matthew Wild <mwild1@gmail.com> parents: 6476 diff changeset	208 end
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses Matthew Wild <mwild1@gmail.com> parents: 6476 diff changeset	209
6490 771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	210 local range, range_config = is_secure_range(user_ip);
6477 88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses Matthew Wild <mwild1@gmail.com> parents: 6476 diff changeset	211
6490 771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	212 if not range then
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	213 return true, "Not configured";
6477 88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses Matthew Wild <mwild1@gmail.com> parents: 6476 diff changeset	214 end
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses Matthew Wild <mwild1@gmail.com> parents: 6476 diff changeset	215
6490 771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	216 self.session.print(("In range: %s"):format(range));
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	217 self.session.print(("Use TLS: %s"):format(range_config.use_tls == false and "no" or "yes"));
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	218 self.session.print(("Trust certs: %s"):format(range_config.trust_all_certs == false and "no" or "yes"));
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	219
771944f2a7c7 mod_s2s_v6mesh: Update configuration syntax and associated documentation Matthew Wild <mwild1@gmail.com> parents: 6478 diff changeset	220 return true, "IP is in configured range";
6477 88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses Matthew Wild <mwild1@gmail.com> parents: 6476 diff changeset	221 end;
88852e4f81bf mod_s2s_v6mesh: Add is_secure_range shell command to check IP addresses Matthew Wild <mwild1@gmail.com> parents: 6476 diff changeset	222 });

Mercurial > prosody-modules

annotate mod_s2s_v6mesh/mod_s2s_v6mesh.lua @ 6562:5da6fb562df9 default tip