configure: Replaces tabs with spaces in --help

[prosody.git] / plugins / mod_s2s / mod_s2s.lua

diff --git a/plugins/mod_s2s/mod_s2s.lua b/plugins/mod_s2s/mod_s2s.lua
index 512c903772e55c523dce78bf6eedadd1f3f937da..639f464bcf52ed1ea3302c90feb4acde33e189ce 100644 (file)
--- a/plugins/mod_s2s/mod_s2s.lua
+++ b/plugins/mod_s2s/mod_s2s.lua
@@ -80,6 +80,10 @@ function route_to_existing_session(event)
                log("warn", "Attempt to send stanza from %s - a host we don't serve", from_host);
                return false;
        end
+       if hosts[to_host] then
+               log("warn", "Attempt to route stanza to a remote %s - a host we do serve?!", from_host);
+               return false;
+       end
        local host = hosts[from_host].s2sout[to_host];
        if host then
                -- We have a connection to this host already
@@ -188,6 +192,9 @@ function make_authenticated(event)
                        });
                end
        end
+       if hosts[host] then
+               session:close({ condition = "undefined-condition", text = "Attempt to authenticate as a host we serve" });
+       end
        if session.type == "s2sout_unauthed" then
                session.type = "s2sout";
        elseif session.type == "s2sin_unauthed" then
@@ -211,7 +218,7 @@ end
 
 --- Helper to check that a session peer's certificate is valid
 local function check_cert_status(session)
-       local host = session.direction == "incoming" and session.from_host or session.to_host
+       local host = session.direction == "outgoing" and session.to_host or session.from_host
        local conn = session.conn:socket()
        local cert
        if conn.getpeercertificate then
@@ -321,6 +328,11 @@ function stream_callbacks.streamopened(session, attr)
                        end
                end
 
+               if hosts[from] then
+                       session:close({ condition = "undefined-condition", text = "Attempt to connect from a host we serve" });
+                       return;
+               end
+
                if session.secure and not session.cert_chain_status then
                        if check_cert_status(session) == false then
                                return;
@@ -423,7 +435,6 @@ local listener = {};
 
 --- Session methods
 local stream_xmlns_attr = {xmlns='urn:ietf:params:xml:ns:xmpp-streams'};
-local default_stream_attr = { ["xmlns:stream"] = "http://etherx.jabber.org/streams", xmlns = stream_callbacks.default_ns, version = "1.0", id = "" };
 local function session_close(session, reason, remote_reason)
        local log = session.log or log;
        if session.conn then
@@ -487,7 +498,7 @@ function session_open_stream(session, from, to)
                from = from, to = to,
        }
        local local_host = session.direction == "outgoing" and from or to;
-       if not local_host or hosts[local_host].modules.dialback then
+       if not local_host or (hosts[local_host] and hosts[local_host].modules.dialback) then
                attr["xmlns:db"] = 'jabber:server:dialback';
        end
 
@@ -611,16 +622,21 @@ end
 
 function check_auth_policy(event)
        local host, session = event.host, event.session;
-       
-       if not secure_auth and secure_domains[host] then
-               secure_auth = true;
-       elseif secure_auth and insecure_domains[host] then
-               secure_auth = false;
+       local must_secure = secure_auth;
+
+       if not must_secure and secure_domains[host] then
+               must_secure = true;
+       elseif must_secure and insecure_domains[host] then
+               must_secure = false;
        end
        
-       if secure_auth and not session.cert_identity_status then
+       if must_secure and not session.cert_identity_status then
                module:log("warn", "Forbidding insecure connection to/from %s", host);
-               session:close(false);
+               if session.direction == "incoming" then
+                       session:close({ condition = "not-authorized", text = "Your server's certificate is invalid, expired, or not trusted by"..session.to_host });
+               else -- Close outgoing connections without warning
+                       session:close(false);
+               end
                return false;
        end
 end