mod_tls: Respond with proper error when TLS cannot be negotiated.

1 files changed, 4 insertions, 2 deletions

diff --git a/plugins/mod_tls.lua b/plugins/mod_tls.lua
index 8a450803..fb1433da 100644
--- a/plugins/mod_tls.lua
+++ b/plugins/mod_tls.lua
@@ -26,8 +26,9 @@ module:add_handler("c2s_unauthed", "starttls", xmlns_starttls,
 				session.log("info", "TLS negotiation started...");
 				session.secure = false;
 			else
-				-- FIXME: What reply?
 				session.log("warn", "Attempt to start TLS, but TLS is not available on this connection");
+				(session.sends2s or session.send)(st.stanza("failure", { xmlns = xmlns_starttls }));
+				session:close();
 			end
 		end);
 		
@@ -43,8 +44,9 @@ module:add_handler("s2sin_unauthed", "starttls", xmlns_starttls,
 				session.log("info", "TLS negotiation started for incoming s2s...");
 				session.secure = false;
 			else
-				-- FIXME: What reply?
 				session.log("warn", "Attempt to start TLS, but TLS is not available on this s2s connection");
+				(session.sends2s or session.send)(st.stanza("failure", { xmlns = xmlns_starttls }));
+				session:close();
 			end
 		end);