diff options
| -rw-r--r-- | core/modulemanager.lua | 2 | ||||
| -rw-r--r-- | core/s2smanager.lua | 5 | ||||
| -rw-r--r-- | plugins/mod_admin_telnet.lua | 1 | ||||
| -rw-r--r-- | plugins/mod_dialback.lua | 30 | ||||
| -rw-r--r-- | plugins/s2s/mod_s2s.lua | 13 | ||||
| -rw-r--r-- | plugins/s2s/s2sout.lib.lua | 11 |
6 files changed, 37 insertions, 25 deletions
diff --git a/core/modulemanager.lua b/core/modulemanager.lua index a192e637..0ca37105 100644 --- a/core/modulemanager.lua +++ b/core/modulemanager.lua @@ -34,7 +34,7 @@ end local array, set = require "util.array", require "util.set"; -local autoload_modules = {"presence", "message", "iq", "offline"}; +local autoload_modules = {"presence", "message", "iq", "offline", "c2s", "s2s"}; local component_inheritable_modules = {"tls", "dialback", "iq"}; -- We need this to let modules access the real global namespace diff --git a/core/s2smanager.lua b/core/s2smanager.lua index e61aaccb..6877ee18 100644 --- a/core/s2smanager.lua +++ b/core/s2smanager.lua @@ -114,10 +114,7 @@ function mark_connected(session) local from, to = session.from_host, session.to_host; session.log("info", session.direction.." s2s connection "..from.."->"..to.." complete"); - - local send_to_host = send_to_host; - function session.send(data) return send_to_host(to, from, data); end - + local event_data = { session = session }; if session.type == "s2sout" then prosody.events.fire_event("s2sout-established", event_data); diff --git a/plugins/mod_admin_telnet.lua b/plugins/mod_admin_telnet.lua index 9e9065bb..d3f5543e 100644 --- a/plugins/mod_admin_telnet.lua +++ b/plugins/mod_admin_telnet.lua @@ -776,4 +776,5 @@ end require "core.portmanager".register_service("console", { listener = console_listener; default_port = 5582; + private = true; }); diff --git a/plugins/mod_dialback.lua b/plugins/mod_dialback.lua index e27f8657..977e58c3 100644 --- a/plugins/mod_dialback.lua +++ b/plugins/mod_dialback.lua @@ -6,22 +6,37 @@ -- COPYING file in the source package for more information. -- +local format = string.format; local hosts = _G.hosts; local send_s2s = require "core.s2smanager".send_to_host; local s2s_make_authenticated = require "core.s2smanager".make_authenticated; -local s2s_initiate_dialback = require "core.s2smanager".initiate_dialback; -local s2s_verify_dialback = require "core.s2smanager".verify_dialback; local log = module._log; local st = require "util.stanza"; +local sha256_hash = require "util.hashes".sha256; local xmlns_stream = "http://etherx.jabber.org/streams"; local xmlns_dialback = "jabber:server:dialback"; local dialback_requests = setmetatable({}, { __mode = 'v' }); +function generate_dialback(id, to, from) + return sha256_hash(id..to..from..hosts[from].dialback_secret, true); +end + +function initiate_dialback(session) + -- generate dialback key + session.dialback_key = generate_dialback(session.streamid, session.to_host, session.from_host); + session.sends2s(format("<db:result from='%s' to='%s'>%s</db:result>", session.from_host, session.to_host, session.dialback_key)); + session.log("info", "sent dialback key on outgoing s2s stream"); +end + +function verify_dialback(id, to, from, key) + return key == generate_dialback(id, to, from); +end + module:hook("stanza/jabber:server:dialback:verify", function(event) local origin, stanza = event.origin, event.stanza; @@ -32,7 +47,7 @@ module:hook("stanza/jabber:server:dialback:verify", function(event) -- COMPAT: Grr, ejabberd breaks this one too?? it is black and white in XEP-220 example 34 --if attr.from ~= origin.to_host then error("invalid-from"); end local type; - if s2s_verify_dialback(attr.id, attr.from, attr.to, stanza[1]) then + if verify_dialback(attr.id, attr.from, attr.to, stanza[1]) then type = "valid" else type = "invalid" @@ -72,8 +87,8 @@ module:hook("stanza/jabber:server:dialback:result", function(event) end origin.log("debug", "asking %s if key %s belongs to them", attr.from, stanza[1]); - send_s2s(attr.to, attr.from, - st.stanza("db:verify", { from = attr.to, to = attr.from, id = origin.streamid }):text(stanza[1])); + --send_s2s(attr.to, attr.from, + origin.send(st.stanza("db:verify", { from = attr.to, to = attr.from, id = origin.streamid }):text(stanza[1])); return true; end end); @@ -84,6 +99,7 @@ module:hook("stanza/jabber:server:dialback:verify", function(event) if origin.type == "s2sout_unauthed" or origin.type == "s2sout" then local attr = stanza.attr; local dialback_verifying = dialback_requests[attr.from.."/"..(attr.id or "")]; + module:log("debug", tostring(dialback_verifying).." "..attr.from.." "..origin.to_host); if dialback_verifying and attr.from == origin.to_host then local valid; if attr.type == "valid" then @@ -134,14 +150,14 @@ end); module:hook_stanza("urn:ietf:params:xml:ns:xmpp-sasl", "failure", function (origin, stanza) if origin.external_auth == "failed" then module:log("debug", "SASL EXTERNAL failed, falling back to dialback"); - s2s_initiate_dialback(origin); + initiate_dialback(origin); return true; end end, 100); module:hook_stanza(xmlns_stream, "features", function (origin, stanza) if not origin.external_auth or origin.external_auth == "failed" then - s2s_initiate_dialback(origin); + initiate_dialback(origin); return true; end end, 100); diff --git a/plugins/s2s/mod_s2s.lua b/plugins/s2s/mod_s2s.lua index 90bedce9..f601a8a2 100644 --- a/plugins/s2s/mod_s2s.lua +++ b/plugins/s2s/mod_s2s.lua @@ -14,11 +14,11 @@ local xpcall, traceback = xpcall, debug.traceback; local add_task = require "util.timer".add_task; local st = require "util.stanza"; local initialize_filters = require "util.filters".initialize; +local nameprep = require "util.encodings".stringprep.nameprep; local new_xmpp_stream = require "util.xmppstream".new; local s2s_new_incoming = require "core.s2smanager".new_incoming; local s2s_new_outgoing = require "core.s2smanager".new_outgoing; local s2s_destroy_session = require "core.s2smanager".destroy_session; -local nameprep = require "util.encodings".stringprep.nameprep; local uuid_gen = require "util.uuid".generate; local cert_verify_identity = require "util.x509".verify_identity; @@ -92,12 +92,12 @@ function send_to_host(from_host, to_host, stanza) else log("debug", "opening a new outgoing connection for this stanza"); local host_session = s2s_new_outgoing(from_host, to_host); - s2sout.initiate_connection(host_session); -- Store in buffer host_session.bounce_sendq = bounce_sendq; host_session.sendq = { {tostring(stanza), stanza.attr.type ~= "error" and stanza.attr.type ~= "result" and st.reply(stanza)} }; log("debug", "stanza [%s] queued until connection complete", tostring(stanza.name)); + s2sout.initiate_connection(host_session); if (not host_session.connecting) and (not host_session.conn) then log("warn", "Connection to %s failed already, destroying session...", to_host); if not s2s_destroy_session(host_session, "Connection failed") then @@ -106,7 +106,6 @@ function send_to_host(from_host, to_host, stanza) end return false; end - s2sout.initiate_connection(host_session); end return true; end @@ -192,9 +191,6 @@ function stream_callbacks.streamopened(session, attr) if session.secure and not session.cert_chain_status then check_cert_status(session); end - function session.send(data) - return send_to_host(session.to_host, session.from_host, data); - end send("<?xml version='1.0'?>"); send(st.stanza("stream:stream", { xmlns='jabber:server', ["xmlns:db"]='jabber:server:dialback', ["xmlns:stream"]='http://etherx.jabber.org/streams', id=session.streamid, from=session.to_host, to=session.from_host, version=(session.version > 0 and "1.0" or nil) }):top_tag()); @@ -242,6 +238,7 @@ function stream_callbacks.streamopened(session, attr) end end session.notopen = nil; + session.send = function(stanza) send_to_host(session.to_host, session.from_host, stanza); end; end function stream_callbacks.streamclosed(session) @@ -250,7 +247,7 @@ function stream_callbacks.streamclosed(session) end function stream_callbacks.streamdisconnected(session, err) - if err and err ~= "closed" then + if err and err ~= "stream closed" then (session.log or log)("debug", "s2s connection attempt failed: %s", err); if s2sout.attempt_connection(session, err) then (session.log or log)("debug", "...so we're going to try another target"); @@ -258,7 +255,7 @@ function stream_callbacks.streamdisconnected(session, err) end end (session.log or log)("info", "s2s disconnected: %s->%s (%s)", tostring(session.from_host), tostring(session.to_host), tostring(err or "closed")); - sessions[session.conn] = nil; + if session.con then sessions[session.conn] = nil; else (session.log or log)("debug", "stale session's connection already closed"); end s2s_destroy_session(session, err); end diff --git a/plugins/s2s/s2sout.lib.lua b/plugins/s2s/s2sout.lib.lua index 64786862..808c7e74 100644 --- a/plugins/s2s/s2sout.lib.lua +++ b/plugins/s2s/s2sout.lib.lua @@ -15,18 +15,18 @@ local add_task = require "util.timer".add_task; local new_ip = require "util.ip".new_ip; local rfc3484_dest = require "util.rfc3484".destination; local socket = require "socket"; -local t_insert, t_sort = table.insert, table.sort; +local t_insert, t_sort, ipairs = table.insert, table.sort, ipairs; local st = require "util.stanza"; -local s2s_destroy_session = require "core.s2smanager".destroy_session; local s2s_new_outgoing = require "core.s2smanager".new_outgoing; +local s2s_destroy_session = require "core.s2smanager".destroy_session; + +local cfg_sources = config.get("*", "core", "s2s_interfaces") or socket.local_addresses and socket.local_addresses() or { "*" }; local s2sout = {}; local s2s_listener; -local cfg_sources = config.get("*", "core", "s2s_interfaces") or {"*"}; -local sources function s2sout.set_listener(listener) s2s_listener = listener; @@ -156,6 +156,7 @@ function s2sout.try_next_ip(host_session) end function s2sout.try_connect(host_session, connect_host, connect_port, err) + local sources; host_session.connecting = true; if not err then @@ -165,7 +166,7 @@ function s2sout.try_connect(host_session, connect_host, connect_port, err) local has_other = false; if not sources then - sources = {}; + sources = {}; for i, source in ipairs(cfg_sources) do if source == "*" then sources[i] = new_ip("0.0.0.0", "IPv4"); |