Software / code / prosody
Changeset
5390:b3c8757ee4f4
mod_s2s: Prevent s2s to and from hosts we serve locally
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Wed, 27 Mar 2013 23:09:47 +0100 |
| parents | 5389:d147a4227a72 |
| children | 5391:0d49a4e9963b |
| files | plugins/mod_s2s/mod_s2s.lua |
| diffstat | 1 files changed, 12 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/plugins/mod_s2s/mod_s2s.lua Tue Mar 26 09:25:20 2013 +0100 +++ b/plugins/mod_s2s/mod_s2s.lua Wed Mar 27 23:09:47 2013 +0100 @@ -80,6 +80,10 @@ log("warn", "Attempt to send stanza from %s - a host we don't serve", from_host); return false; end + if hosts[to_host] then + log("warn", "Attempt to route stanza to a remote %s - a host we do serve?!", from_host); + return false; + end local host = hosts[from_host].s2sout[to_host]; if host then -- We have a connection to this host already @@ -188,6 +192,9 @@ }); end end + if hosts[host] then + session:close({ condition = "undefined-condition", text = "Attempt to authenticate as a host we serve" }); + end if session.type == "s2sout_unauthed" then session.type = "s2sout"; elseif session.type == "s2sin_unauthed" then @@ -321,6 +328,11 @@ end end + if hosts[from] then + session:close({ condition = "undefined-condition", text = "Attempt to connect from a host we serve" }); + return; + end + if session.secure and not session.cert_chain_status then if check_cert_status(session) == false then return;
