# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1574958735 -3600
# Node ID 2ab1cbb1c6b0b9a156018590bf8b2e81768f481f
# Parent  698ff3610e57bdce24b3893251cb135f730f8696
mod_s2s: Send stream errors for cert problems on outgoing connections

Rationale in comment.

diff -r 698ff3610e57 -r 2ab1cbb1c6b0 plugins/mod_s2s/mod_s2s.lua
--- a/plugins/mod_s2s/mod_s2s.lua	Wed Nov 27 23:26:59 2019 +0100
+++ b/plugins/mod_s2s/mod_s2s.lua	Thu Nov 28 17:32:15 2019 +0100
@@ -758,12 +758,13 @@
 	if must_secure and (session.cert_chain_status ~= "valid" or session.cert_identity_status ~= "valid") then
 		module:log("warn", "Forbidding insecure connection to/from %s", host or session.ip or "(unknown host)");
 		local reason = friendly_cert_error(session);
-		if session.direction == "incoming" then
-			session:close({ condition = "not-authorized", text = "Your server's certificate "..reason },
-				nil, "Remote server's certificate "..reason);
-		else -- Close outgoing connections without warning
-			session:close(false, nil, "Remote server's certificate "..reason);
-		end
+		-- XEP-0178 recommends closing outgoing connections without warning
+		-- but does not give a rationale for this.
+		-- In practice most cases are configuration mistakes or forgotten
+		-- certificate renewals. We think it's better to let the other party
+		-- know about the problem so that they can fix it.
+		session:close({ condition = "not-authorized", text = "Your server's certificate "..reason },
+			nil, "Remote server's certificate "..reason);
 		return false;
 	end
 end