Software / code / prosody
Changeset
13803:3627980e7df6
Merge 13.0->trunk
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Tue, 01 Apr 2025 18:31:26 +0200 (3 months ago) |
| parents | 13799:a353db59f942 (current diff) 13802:7c76ca78ceef (diff) |
| children | 13806:a91440ddf9a2 |
| files | |
| diffstat | 3 files changed, 6 insertions(+), 2 deletions(-) [+] |
line wrap: on
line diff
--- a/plugins/mod_s2s.lua Mon Mar 31 21:23:35 2025 +0200 +++ b/plugins/mod_s2s.lua Tue Apr 01 18:31:26 2025 +0200 @@ -999,7 +999,7 @@ local cert_errors = set.new(session.cert_chain_errors[1]); if cert_errors:contains("certificate has expired") then return "has expired"; - elseif cert_errors:contains("self signed certificate") then + elseif cert_errors:contains("self signed certificate") or cert_errors:contains("self-signed certificate") then return "is self-signed"; elseif cert_errors:contains("no matching DANE TLSA records") then return "does not match any DANE TLSA records";
--- a/plugins/mod_tls.lua Mon Mar 31 21:23:35 2025 +0200 +++ b/plugins/mod_tls.lua Tue Apr 01 18:31:26 2025 +0200 @@ -55,6 +55,7 @@ module:log("debug", "Creating context for c2s"); local request_client_certs = { verify = { "peer", "client_once", }; }; + local custom_cert_verification = { verifyext = { "lsec_continue", "lsec_ignore_purpose" }; }; local xmpp_alpn = { alpn = "xmpp-server" }; ssl_ctx_c2s, err_c2s, ssl_cfg_c2s = create_context(host.host, "server", host_c2s, host_ssl, global_c2s); -- for incoming client connections @@ -67,7 +68,9 @@ module:log("debug", "Creating context for s2sin"); -- for incoming server connections - ssl_ctx_s2sin, err_s2sin, ssl_cfg_s2sin = create_context(host.host, "server", host_s2s, host_ssl, global_s2s, request_client_certs); + ssl_ctx_s2sin, err_s2sin, ssl_cfg_s2sin = create_context(host.host, "server", + host_s2s, host_ssl, global_s2s, request_client_certs, custom_cert_verification + ); if not ssl_ctx_s2sin then module:log("error", "Error creating contexts for s2sin: %s", err_s2sin); end if reload then
--- a/prosodyctl Mon Mar 31 21:23:35 2025 +0200 +++ b/prosodyctl Tue Apr 01 18:31:26 2025 +0200 @@ -195,6 +195,7 @@ elseif init == "rc.d" then show_warning(" /etc/init.d/prosody %s", service_command); end + show_warning(""); else show_warning(" it may conflict with your system's service manager."); show_warning("");
