-add_handler("c2s_unauthed", "starttls", xmlns_starttls,
+
+local starttls_attr = { xmlns = xmlns_starttls };
+module:add_event_hook("stream-features",
+ function (session, features)
+ if not session.username and session.conn.starttls then
+ features:tag("starttls", starttls_attr);
+ if secure_auth_only then
+ features:tag("required"):up():up();
+ else
+ features:up();
+ end
+ end
+ end);
+
+module:hook("s2s-stream-features",
+ function (data)
+ local session, features = data.session, data.features;
+ if session.to_host and session.type ~= "s2sin" and session.conn.starttls then
+ features:tag("starttls", starttls_attr):up();
+ if secure_s2s_only then
+ features:tag("required"):up():up();
+ else
+ features:up();
+ end
+ end
+ end);
+
+-- For s2sout connections, start TLS if we can
+module:hook_stanza(xmlns_stream, "features",