aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorKim Alvefur <zash@zash.se>2021-09-09 22:09:41 +0200
committerKim Alvefur <zash@zash.se>2021-09-09 22:09:41 +0200
commit6da2329559a147961d4574fa38e0ad2cb8fab9d1 (patch)
tree4ba9a32ae016a160edc29b0954b16a4be155e85a
parentfd2785d99d0f731e2d075e38271f8fa9412f94aa (diff)
downloadprosody-6da2329559a147961d4574fa38e0ad2cb8fab9d1.tar.gz
prosody-6da2329559a147961d4574fa38e0ad2cb8fab9d1.zip
util.prosodyctl.check: Check for server-to-server Direct TLS records
-rw-r--r--util/prosodyctl/check.lua25
1 files changed, 24 insertions, 1 deletions
diff --git a/util/prosodyctl/check.lua b/util/prosodyctl/check.lua
index 1795b01d..1c404a08 100644
--- a/util/prosodyctl/check.lua
+++ b/util/prosodyctl/check.lua
@@ -311,8 +311,9 @@ local function check(arg)
local c2s_ports = set.new(configmanager.get("*", "c2s_ports") or {5222});
local s2s_ports = set.new(configmanager.get("*", "s2s_ports") or {5269});
local c2s_tls_ports = set.new(configmanager.get("*", "direct_tls_ports") or {});
+ local s2s_tls_ports = set.new(configmanager.get("*", "s2s_direct_tls_ports") or {});
- local c2s_srv_required, s2s_srv_required, c2s_tls_srv_required;
+ local c2s_srv_required, s2s_srv_required, c2s_tls_srv_required, s2s_tls_srv_required;
if not c2s_ports:contains(5222) then
c2s_srv_required = true;
end
@@ -322,6 +323,9 @@ local function check(arg)
if not c2s_tls_ports:empty() then
c2s_tls_srv_required = true;
end
+ if not s2s_tls_ports:empty() then
+ s2s_tls_srv_required = true;
+ end
local problem_hosts = set.new();
@@ -449,6 +453,25 @@ local function check(arg)
end
end
end
+ if modules:contains("s2s") and s2s_tls_srv_required then
+ local res = dns.lookup("_xmpps-server._tcp."..idna.to_ascii(host)..".", "SRV");
+ if res and #res > 0 then
+ for _, record in ipairs(res) do
+ if record.srv.target == "." then -- TODO is this an error if mod_s2s is enabled?
+ print(" 'xmpps-server' service disabled by pointing to '.'"); -- FIXME Explain better what this is
+ break;
+ end
+ local target = trim_dns_name(record.srv.target);
+ target_hosts:add(target);
+ if not s2s_tls_ports:contains(record.srv.port) then
+ print(" SRV target "..target.." contains unknown Direct TLS server port: "..record.srv.port);
+ end
+ end
+ else
+ print(" No _xmpps-server SRV record found for "..host..", but it looks like you need one.");
+ all_targets_ok = false;
+ end
+ end
if target_hosts:empty() then
target_hosts:add(host);
end