# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1465465605 -7200
# Node ID affccf479f89c81ad63abde9f8f993c17e87939d
# Parent  2dcc3079572cf167a659983293de9d0c435929c9
mod_s2s_auth_samecert: Authenticate incoming s2s connection if certificate matches that of an established outgoing s2s connection

diff -r 2dcc3079572c -r affccf479f89 mod_s2s_auth_samecert/mod_s2s_auth_samecert.lua
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/mod_s2s_auth_samecert/mod_s2s_auth_samecert.lua	Thu Jun 09 11:46:45 2016 +0200
@@ -0,0 +1,15 @@
+module:set_global()
+
+local hosts = prosody.hosts;
+
+module:hook("s2s-check-certificate", function(event)
+	local session, cert = event.session, event.cert;
+	if session.direction ~= "incoming" then return end
+	
+	local outgoing = hosts[session.to_host].s2sout[session.from_host];
+	if outgoing and outgoing.type == "s2sout" and outgoing.secure and outgoing.conn:socket():getpeercertificate():pem() == cert:pem() then
+		session.cert_identity_status = outgoing.cert_identity_status;
+		session.cert_chain_status = outgoing.cert_chain_status;
+		return true;
+	end
+end, 1000);