Mercurial > prosody-hg

comparison plugins/mod_s2s.lua @ 13703:99d2100d2918 13.0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
core.certmanager: Move LuaSec verification tweaks to mod_s2s These two settings are only really needed for XMPP server-to-server connections.
author Kim Alvefur <zash@zash.se>
date Sat, 15 Feb 2025 00:19:01 +0100
parents 750ff9f579e2
children 7c76ca78ceef
comparison
equal deleted inserted replaced
13701:1aa7efabeacb 13703:99d2100d2918
1095 encryption = "starttls"; 1095 encryption = "starttls";
1096 ssl_config = { 1096 ssl_config = {
1097 -- FIXME This only applies to Direct TLS, which we don't use yet. 1097 -- FIXME This only applies to Direct TLS, which we don't use yet.
1098 -- This gets applied for real in mod_tls 1098 -- This gets applied for real in mod_tls
1099 verify = { "peer", "client_once", }; 1099 verify = { "peer", "client_once", };
1100 verifyext = {
1101 "lsec_continue", -- Continue past certificate verification errors
1102 "lsec_ignore_purpose", -- Validate client certificates as if they were server certificates
1103 };
1100 }; 1104 };
1101 multiplex = { 1105 multiplex = {
1102 protocol = "xmpp-server"; 1106 protocol = "xmpp-server";
1103 pattern = "^<.*:stream.*%sxmlns%s*=%s*(['\"])jabber:server%1.*>"; 1107 pattern = "^<.*:stream.*%sxmlns%s*=%s*(['\"])jabber:server%1.*>";
1104 }; 1108 };
1109 name = "s2s_direct_tls"; 1113 name = "s2s_direct_tls";
1110 listener = listener; 1114 listener = listener;
1111 encryption = "ssl"; 1115 encryption = "ssl";
1112 ssl_config = { 1116 ssl_config = {
1113 verify = { "peer", "client_once", }; 1117 verify = { "peer", "client_once", };
1118 verifyext = {
1119 "lsec_continue", -- Continue past certificate verification errors
1120 "lsec_ignore_purpose", -- Validate client certificates as if they were server certificates
1121 };
1114 }; 1122 };
1115 multiplex = { 1123 multiplex = {
1116 protocol = "xmpp-server"; 1124 protocol = "xmpp-server";
1117 pattern = "^<.*:stream.*%sxmlns%s*=%s*(['\"])jabber:server%1.*>"; 1125 pattern = "^<.*:stream.*%sxmlns%s*=%s*(['\"])jabber:server%1.*>";
1118 }; 1126 };