prosody
2ab1cbb1c6b0
plugins/mod_s2s/mod_s2s.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Comparison

plugins/mod_s2s/mod_s2s.lua @ 10456:2ab1cbb1c6b0

mod_s2s: Send stream errors for cert problems on outgoing connections Rationale in comment.
author Kim Alvefur <zash@zash.se>
date Thu, 28 Nov 2019 17:32:15 +0100
parent 10455:698ff3610e57
child 10457:0c44090cb168
comparison
equal deleted inserted replaced
10455:698ff3610e57 10456:2ab1cbb1c6b0
756 end 756 end
757 757
758 if must_secure and (session.cert_chain_status ~= "valid" or session.cert_identity_status ~= "valid") then 758 if must_secure and (session.cert_chain_status ~= "valid" or session.cert_identity_status ~= "valid") then
759 module:log("warn", "Forbidding insecure connection to/from %s", host or session.ip or "(unknown host)"); 759 module:log("warn", "Forbidding insecure connection to/from %s", host or session.ip or "(unknown host)");
760 local reason = friendly_cert_error(session); 760 local reason = friendly_cert_error(session);
761 if session.direction == "incoming" then 761 -- XEP-0178 recommends closing outgoing connections without warning
762 session:close({ condition = "not-authorized", text = "Your server's certificate "..reason }, 762 -- but does not give a rationale for this.
763 nil, "Remote server's certificate "..reason); 763 -- In practice most cases are configuration mistakes or forgotten
764 else -- Close outgoing connections without warning 764 -- certificate renewals. We think it's better to let the other party
765 session:close(false, nil, "Remote server's certificate "..reason); 765 -- know about the problem so that they can fix it.
766 end 766 session:close({ condition = "not-authorized", text = "Your server's certificate "..reason },
767 nil, "Remote server's certificate "..reason);
767 return false; 768 return false;
768 end 769 end
769 end 770 end
770 771
771 module:hook("s2s-check-certificate", check_auth_policy, -1); 772 module:hook("s2s-check-certificate", check_auth_policy, -1);