Merge 0.7/waqas->0.7/MattJ

[prosody.git] / plugins / mod_tls.lua

diff --git a/plugins/mod_tls.lua b/plugins/mod_tls.lua
index 8f688d613154d1ed77afcdb65bbe1af432c77d28..8b96aa157922c7bf1f63613a0e000e3baf72851f 100644 (file)
--- a/plugins/mod_tls.lua
+++ b/plugins/mod_tls.lua
@@ -1,6 +1,6 @@
 -- Prosody IM
--- Copyright (C) 2008-2009 Matthew Wild
--- Copyright (C) 2008-2009 Waqas Hussain
+-- Copyright (C) 2008-2010 Matthew Wild
+-- Copyright (C) 2008-2010 Waqas Hussain
 -- 
 -- This project is MIT/X11 licensed. Please see the
 -- COPYING file in the source package for more information.
@@ -10,6 +10,7 @@ local st = require "util.stanza";
 
 local secure_auth_only = module:get_option("c2s_require_encryption") or module:get_option("require_encryption");
 local secure_s2s_only = module:get_option("s2s_require_encryption");
+local allow_s2s_tls = module:get_option("s2s_allow_encryption") ~= false;
 
 local xmlns_starttls = 'urn:ietf:params:xml:ns:xmpp-tls';
 local starttls_attr = { xmlns = xmlns_starttls };
@@ -26,9 +27,11 @@ local host = hosts[module.host];
 
 local function can_do_tls(session)
        if session.type == "c2s_unauthed" then
-               return session.username and session.conn.starttls and host.ssl_ctx_in;
-       elseif session.type == "s2sin_unauthed" then
-               return origin.to_host and origin.conn.starttls and host.ssl_ctx_in;
+               return session.conn.starttls and host.ssl_ctx_in;
+       elseif session.type == "s2sin_unauthed" and allow_s2s_tls then
+               return session.conn.starttls and host.ssl_ctx_in;
+       elseif session.direction == "outgoing" and allow_s2s_tls then
+               return session.conn.starttls and host.ssl_ctx;
        end
        return false;
 end
@@ -69,7 +72,7 @@ end);
 -- For s2sout connections, start TLS if we can
 module:hook_stanza("http://etherx.jabber.org/streams", "features", function (session, stanza)
        module:log("debug", "Received features element");
-       if session.conn.starttls and stanza:child_with_ns(xmlns_starttls) then
+       if can_do_tls(session) and stanza:child_with_ns(xmlns_starttls) then
                module:log("%s is offering TLS, taking up the offer...", session.to_host);
                session.sends2s("<starttls xmlns='"..xmlns_starttls.."'/>");
                return true;