prosody-modules: mod_firewall/conditions.lib.lua comparison

mod_firewall: Support 'FROM IP' and 'FROM SUBNET' conditions

comparison

equal deleted inserted replaced

-:f7158c0e2202
+:b15601203d0d
 --luacheck: globals meta idsafe
 local condition_handlers = {};
 local jid = require "util.jid";
+local iplib = require "util.ip";
+local sha256 = require "util.hashes".sha256;
 local unpack = table.unpack or unpack;
 -- Helper to convert user-input strings (yes/true//no/false) to a bool
 local function string_to_boolean(s)
 	s = s:lower();
 		"it_count",
 		"search:"..search_name, "pattern:"..pattern_name
 	};
 end
+function condition_handlers.FROM_IP(ip_spec)
+	local parsed_ip, err = iplib.new_ip(ip_spec);
+	if not parsed_ip then
+		error("Cannot parse IP address: "..(err or "unknown error"));
+	end
+	local normal_ip = tostring(parsed_ip);
+	return ("session.ip == %q"):format(normal_ip);
+end
+function condition_handlers.FROM_SUBNET(subnet_spec)
+	local subnet, bits = iplib.parse_cidr(subnet_spec);
+	if not subnet then
+		error("Cannot parse subnet CIDR");
+	end
+	local spec_hash = sha256(subnet_spec, true):sub(1, 8);
+	return ("iplib.match(session_parsed_ip, parsed_ip_%s, %d)"):format(
+		spec_hash, bits
+	), {
+		"iplib", "session_parsed_ip", "parsed_ip:"..spec_hash..":"..tostring(subnet)
+	};
+end
 -- FROM COUNTRY: SE
 -- FROM COUNTRY: code=SE
 -- FROM COUNTRY: SWE
 -- FROM COUNTRY: code3=SWE
 -- FROM COUNTRY: continent=EU

Mercurial > prosody-modules