# HG changeset patch
# User Matthew Wild <mwild1@gmail.com>
# Date 1368874945 -3600
# Node ID ad66ee47b67445778088178a7375cf00bd7ea08c
# Parent  8b09b0d068d42bff1d88e373b7afea26b4c9d3dd
mod_s2s: Fix interaction between s2s_secure_auth and s2s_require_encryption, in particular ensure that when s2s_require_encryption is NOT set, do not require encryption on s2s_insecure_domains.

diff -r 8b09b0d068d4 -r ad66ee47b674 plugins/mod_s2s/mod_s2s.lua
--- a/plugins/mod_s2s/mod_s2s.lua	Tue May 14 09:38:54 2013 +0100
+++ b/plugins/mod_s2s/mod_s2s.lua	Sat May 18 12:02:25 2013 +0100
@@ -37,7 +37,7 @@
 local secure_auth = module:get_option_boolean("s2s_secure_auth", false); -- One day...
 local secure_domains, insecure_domains =
 	module:get_option_set("s2s_secure_domains", {})._items, module:get_option_set("s2s_insecure_domains", {})._items;
-local require_encryption = module:get_option_boolean("s2s_require_encryption", secure_auth);
+local require_encryption = module:get_option_boolean("s2s_require_encryption", false);
 
 local sessions = module:shared("sessions");
 
@@ -185,7 +185,7 @@
 function make_authenticated(event)
 	local session, host = event.session, event.host;
 	if not session.secure then
-		if require_encryption or secure_auth or secure_domains[host] then
+		if require_encryption or (secure_auth and not(insecure_domains[host])) or secure_domains[host] then
 			session:close({
 				condition = "policy-violation",
 				text = "Encrypted server-to-server communication is required but was not "