aboutsummaryrefslogtreecommitdiffstats
path: root/plugins/mod_websocket.lua
diff options
context:
space:
mode:
authorKim Alvefur <zash@zash.se>2016-12-05 12:29:21 +0100
committerKim Alvefur <zash@zash.se>2016-12-05 12:29:21 +0100
commit08a58cfdb2f6fd438fe7a00430d14c03b7caa7cb (patch)
treed8491d1afbee7ca428e0a6129a47dcdd9661dca7 /plugins/mod_websocket.lua
parent2a9484a488a5878e27b5d749b5bbb0d54f497e86 (diff)
parentb151bd4d64f0e25c7c73acca597eadcbbc1c812e (diff)
downloadprosody-08a58cfdb2f6fd438fe7a00430d14c03b7caa7cb.tar.gz
prosody-08a58cfdb2f6fd438fe7a00430d14c03b7caa7cb.zip
Merge 0.10->trunk
Diffstat (limited to 'plugins/mod_websocket.lua')
-rw-r--r--plugins/mod_websocket.lua48
1 files changed, 35 insertions, 13 deletions
diff --git a/plugins/mod_websocket.lua b/plugins/mod_websocket.lua
index ea736800..c19ad566 100644
--- a/plugins/mod_websocket.lua
+++ b/plugins/mod_websocket.lua
@@ -14,6 +14,7 @@ local sha1 = require "util.hashes".sha1;
local base64 = require "util.encodings".base64.encode;
local st = require "util.stanza";
local parse_xml = require "util.xml".parse;
+local contains_token = require "util.http".contains_token;
local portmanager = require "core.portmanager";
local sm_destroy_session = require"core.sessionmanager".destroy_session;
local log = module._log;
@@ -28,16 +29,16 @@ local t_concat = table.concat;
local stream_close_timeout = module:get_option_number("c2s_close_timeout", 5);
local consider_websocket_secure = module:get_option_boolean("consider_websocket_secure");
-local cross_domain = module:get_option("cross_domain_websocket");
-if cross_domain then
+local cross_domain = module:get_option_set("cross_domain_websocket", {});
+if cross_domain:contains("*") or cross_domain:contains(true) then
+ cross_domain = true;
+end
+
+local function check_origin(origin)
if cross_domain == true then
- cross_domain = "*";
- elseif type(cross_domain) == "table" then
- cross_domain = t_concat(cross_domain, ", ");
- end
- if type(cross_domain) ~= "string" then
- cross_domain = nil;
+ return true;
end
+ return cross_domain:contains(origin);
end
local xmlns_framing = "urn:ietf:params:xml:ns:xmpp-framing";
@@ -142,15 +143,18 @@ function handle_request(event)
</body></html>]];
end
- local wants_xmpp = false;
- (request.headers.sec_websocket_protocol or ""):gsub("([^,]*),?", function (proto)
- if proto == "xmpp" then wants_xmpp = true; end
- end);
+ local wants_xmpp = contains_token(request.headers.sec_websocket_protocol or "", "xmpp");
if not wants_xmpp then
+ module:log("debug", "Client didn't want to talk XMPP, list of protocols was %s", request.headers.sec_websocket_protocol or "(empty)");
return 501;
end
+ if not check_origin(request.headers.origin or "") then
+ module:log("debug", "Origin %s is not allowed by 'cross_domain_websocket'", request.headers.origin or "(missing header)");
+ return 403;
+ end
+
local function websocket_close(code, message)
conn:write(build_close(code, message));
conn:close();
@@ -285,7 +289,8 @@ function handle_request(event)
response.headers.connection = "Upgrade";
response.headers.sec_webSocket_accept = base64(sha1(request.headers.sec_websocket_key .. "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"));
response.headers.sec_webSocket_protocol = "xmpp";
- response.headers.access_control_allow_origin = cross_domain;
+
+ session.log("debug", "Sending WebSocket handshake");
return "";
end
@@ -310,4 +315,21 @@ function module.add_host(module)
};
});
module:hook("c2s-read-timeout", keepalive, -0.9);
+
+ if cross_domain ~= true then
+ local url = require "socket.url";
+ local ws_url = module:http_url("websocket", "xmpp-websocket");
+ local url_components = url.parse(ws_url);
+ -- The 'Origin' consists of the base URL without path
+ url_components.path = nil;
+ local this_origin = url.build(url_components);
+ local local_cross_domain = module:get_option_set("cross_domain_websocket", { this_origin });
+ -- Don't add / remove something added by another host
+ -- This might be weird with random load order
+ local_cross_domain:exclude(cross_domain);
+ cross_domain:include(local_cross_domain);
+ function module.unload()
+ cross_domain:exclude(local_cross_domain);
+ end
+ end
end