Mercurial > prosody-hg

comparison plugins/mod_tls.lua @ 9854:115b5e32d960

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_tls: Restore querying for certificates on s2s The 'ssl_config' setting in the mod_s2s network service is not used. Only direct TLS ports use this currently.
author Kim Alvefur <zash@zash.se>
date Mon, 11 Mar 2019 13:07:59 +0100
parents 4b34687ede3f
children ca01c449357f
comparison
equal deleted inserted replaced
9853:9aea8dbb105d 9854:115b5e32d960
51 51
52 local global_s2s = rawgetopt("*", "s2s_ssl") or NULL; 52 local global_s2s = rawgetopt("*", "s2s_ssl") or NULL;
53 local parent_s2s = rawgetopt(parent, "s2s_ssl") or NULL; 53 local parent_s2s = rawgetopt(parent, "s2s_ssl") or NULL;
54 local host_s2s = rawgetopt(modhost, "s2s_ssl") or parent_s2s; 54 local host_s2s = rawgetopt(modhost, "s2s_ssl") or parent_s2s;
55 55
56 local request_client_certs = { verify = { "peer", "client_once", }; };
57
56 ssl_ctx_c2s, err_c2s, ssl_cfg_c2s = create_context(host.host, "server", host_c2s, host_ssl, global_c2s); -- for incoming client connections 58 ssl_ctx_c2s, err_c2s, ssl_cfg_c2s = create_context(host.host, "server", host_c2s, host_ssl, global_c2s); -- for incoming client connections
57 if not ssl_ctx_c2s then module:log("error", "Error creating context for c2s: %s", err_c2s); end 59 if not ssl_ctx_c2s then module:log("error", "Error creating context for c2s: %s", err_c2s); end
58 60
59 ssl_ctx_s2sout, err_s2sout, ssl_cfg_s2sout = create_context(host.host, "client", host_s2s, host_ssl, global_s2s); -- for outgoing server connections 61 -- for outgoing server connections
62 ssl_ctx_s2sout, err_s2sout, ssl_cfg_s2sout = create_context(host.host, "client", host_s2s, host_ssl, global_s2s, request_client_certs);
60 if not ssl_ctx_s2sout then module:log("error", "Error creating contexts for s2sout: %s", err_s2sout); end 63 if not ssl_ctx_s2sout then module:log("error", "Error creating contexts for s2sout: %s", err_s2sout); end
61 64
62 ssl_ctx_s2sin, err_s2sin, ssl_cfg_s2sin = create_context(host.host, "server", host_s2s, host_ssl, global_s2s); -- for incoming server connections 65 -- for incoming server connections
66 ssl_ctx_s2sin, err_s2sin, ssl_cfg_s2sin = create_context(host.host, "server", host_s2s, host_ssl, global_s2s, request_client_certs);
63 if not ssl_ctx_s2sin then module:log("error", "Error creating contexts for s2sin: %s", err_s2sin); end 67 if not ssl_ctx_s2sin then module:log("error", "Error creating contexts for s2sin: %s", err_s2sin); end
64 end 68 end
65 69
66 module:hook_global("config-reloaded", module.load); 70 module:hook_global("config-reloaded", module.load);
67 71