aboutsummaryrefslogtreecommitdiffstats
path: root/plugins/mod_s2s
diff options
context:
space:
mode:
authorMatthew Wild <mwild1@gmail.com>2013-05-18 12:02:25 +0100
committerMatthew Wild <mwild1@gmail.com>2013-05-18 12:02:25 +0100
commitbca009fef49f97bab1bc8e885195aaa6af98001a (patch)
tree083cfea92cecdd125a5fa4f0fb4f8db60639fd7f /plugins/mod_s2s
parenta9407043cf075c684494be34a5622ad06666a043 (diff)
downloadprosody-bca009fef49f97bab1bc8e885195aaa6af98001a.tar.gz
prosody-bca009fef49f97bab1bc8e885195aaa6af98001a.zip
mod_s2s: Fix interaction between s2s_secure_auth and s2s_require_encryption, in particular ensure that when s2s_require_encryption is NOT set, do not require encryption on s2s_insecure_domains.
Diffstat (limited to 'plugins/mod_s2s')
-rw-r--r--plugins/mod_s2s/mod_s2s.lua4
1 files changed, 2 insertions, 2 deletions
diff --git a/plugins/mod_s2s/mod_s2s.lua b/plugins/mod_s2s/mod_s2s.lua
index 30ebb706..5a2af968 100644
--- a/plugins/mod_s2s/mod_s2s.lua
+++ b/plugins/mod_s2s/mod_s2s.lua
@@ -37,7 +37,7 @@ local opt_keepalives = module:get_option_boolean("s2s_tcp_keepalives", module:ge
local secure_auth = module:get_option_boolean("s2s_secure_auth", false); -- One day...
local secure_domains, insecure_domains =
module:get_option_set("s2s_secure_domains", {})._items, module:get_option_set("s2s_insecure_domains", {})._items;
-local require_encryption = module:get_option_boolean("s2s_require_encryption", secure_auth);
+local require_encryption = module:get_option_boolean("s2s_require_encryption", false);
local sessions = module:shared("sessions");
@@ -185,7 +185,7 @@ end
function make_authenticated(event)
local session, host = event.session, event.host;
if not session.secure then
- if require_encryption or secure_auth or secure_domains[host] then
+ if require_encryption or (secure_auth and not(insecure_domains[host])) or secure_domains[host] then
session:close({
condition = "policy-violation",
text = "Encrypted server-to-server communication is required but was not "