Home

s2s (server-to-server) Filtering

Submitted by dev_null123 on Sun, 2005-09-18 21:54

I believe this is already being addressed as a feature request:
http://www.jabber.ru/bugzilla/show_bug.cgi?id=42

but I was hoping some of the ejabber experts could chime in with a possible workaround...

I have two domains: domainX.com and domainY.com. I'd like to impliment the following logic:

Users at domainX.com can chat to anyone.
Users at domainY.com can send/recieve IMs only to fellow users at domainY.com.

I have ejabberd setup with two virtual domains, and an admin user for each. I have the following per-domain ACLs in the GUI:

domainX.com:
None

domainY.com:
acl domainY user *@domainy.com
access globalrule [{allow,domainY},{deny, all}]

Am I correct in assuming that these ACLs are strictly used in the context of c2s communications? Seems like to matter what I try, I cannot get certain rules to prevent specific cross-realm traffic; it's sort of "all or nothing." Unfortunatly, we have specific policies as to which users can communicate outside of their domain, therefore this functionality must be operational before any real deployment.

Searching the forums lead to some API named filter_packet, but I was unable to find any further info on this interface. Hopefully there's a simple approach that can mitigate this issue. Any suggestions would be highly appreciated!

Thanks,
-Dave

I think you need filter_packet

Submitted by mfoss on Mon, 2005-09-19 08:15.
Am I correct in assuming that these ACLs are strictly used in the context of c2s communications?

Let's see what do you get when you do this: 

{hosts, ["domainx.com", "domainy.com"]}.

{acl, domainy, [{user, "*@domainy.com"}]}.

{host_config, "domainy", [
  {access, c2s, [{allow, domainy}, {deny, all}]}
]}.

{listen, [
  {5222, ejabberd_c2s, [{access, c2s}, {shaper, c2s_shaper}]},
  ...
]}.
With this config, ejabberd will only accept C2S connections on port 5222 to 'domainy.com' if the user is from 'domainy.com'. As you can see, this is normal behaviour, not a restriction at all.

I guess that you want:

  • packets sent to the server by domainy.com users are checked individually and...
  • if the packet is sent to a JID with server not equal to 'domainy.com' then...
  • then the packet is discarded,
  • else the packet is sent as usual.

Maybe filter_packet can be used to do this, but you must know it's a hook, not a configuration option. So, it's meant to be used to code filters into ejabberd, it's not a filter in itself.

One possible implementation: a new module that allows filtering packets by the sender's server and/or receiver's server. That module registers to that hook, and can be configured on ejabberd.cfg.

»

I think I'm going to need to

Submitted by dev_null123 on Wed, 2005-09-21 02:15.

I think I'm going to need to write my own filter. Something that can basically strip out the XML and perform routing verification. I sense this is going to be a duanting task....

»

I've tried to implement this

Submitted by legoscia on Thu, 2005-09-22 10:49.

I have made an attempt at implementing this, and attached it to the bugzilla entry. Comments and testing welcome...

»
Syndicate content

User login