mod_s2s: Prevent s2s to and from hosts we serve locally

diff --git a/plugins/mod_s2s/mod_s2s.lua b/plugins/mod_s2s/mod_s2s.lua
index 0d552ce8ad4aa6cfa83e9bb02ec02a83af4fdd3a..6893d1848d7454d20ae3a4155827ed113118c5d6 100644 (file)
--- a/plugins/mod_s2s/mod_s2s.lua
+++ b/plugins/mod_s2s/mod_s2s.lua
@@ -80,6 +80,10 @@ function route_to_existing_session(event)
                log("warn", "Attempt to send stanza from %s - a host we don't serve", from_host);
                return false;
        end
+       if hosts[to_host] then
+               log("warn", "Attempt to route stanza to a remote %s - a host we do serve?!", from_host);
+               return false;
+       end
        local host = hosts[from_host].s2sout[to_host];
        if host then
                -- We have a connection to this host already
@@ -188,6 +192,9 @@ function make_authenticated(event)
                        });
                end
        end
+       if hosts[host] then
+               session:close({ condition = "undefined-condition", text = "Attempt to authenticate as a host we serve" });
+       end
        if session.type == "s2sout_unauthed" then
                session.type = "s2sout";
        elseif session.type == "s2sin_unauthed" then
@@ -321,6 +328,11 @@ function stream_callbacks.streamopened(session, attr)
                        end
                end
 
+               if hosts[from] then
+                       session:close({ condition = "undefined-condition", text = "Attempt to connect from a host we serve" });
+                       return;
+               end
+
                if session.secure and not session.cert_chain_status then
                        if check_cert_status(session) == false then
                                return;