Mercurial > prosody-hg

comparison plugins/mod_s2s/mod_s2s.lua @ 5346:b8fbb9d07efc

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Merge 0.9->trunk
author Matthew Wild <mwild1@gmail.com>
date Tue, 12 Mar 2013 12:30:35 +0000
parents 9b85976c873f
children 901ed253bbf7
comparison
equal deleted inserted replaced
5342:4c8c8285bf88 5346:b8fbb9d07efc
134 module:hook("route/remote", route_to_new_session, 100); 134 module:hook("route/remote", route_to_new_session, 100);
135 end 135 end
136 136
137 --- Helper to check that a session peer's certificate is valid 137 --- Helper to check that a session peer's certificate is valid
138 local function check_cert_status(session) 138 local function check_cert_status(session)
139 local host = session.direction == "incoming" and session.from_host or session.to_host
139 local conn = session.conn:socket() 140 local conn = session.conn:socket()
140 local cert 141 local cert
141 if conn.getpeercertificate then 142 if conn.getpeercertificate then
142 cert = conn:getpeercertificate() 143 cert = conn:getpeercertificate()
143 end 144 end
152 end 153 end
153 session.cert_chain_status = "invalid"; 154 session.cert_chain_status = "invalid";
154 else 155 else
155 (session.log or log)("debug", "certificate chain validation result: valid"); 156 (session.log or log)("debug", "certificate chain validation result: valid");
156 session.cert_chain_status = "valid"; 157 session.cert_chain_status = "valid";
157
158 local host = session.direction == "incoming" and session.from_host or session.to_host
159 158
160 -- We'll go ahead and verify the asserted identity if the 159 -- We'll go ahead and verify the asserted identity if the
161 -- connecting server specified one. 160 -- connecting server specified one.
162 if host then 161 if host then
163 if cert_verify_identity(host, "xmpp-server", cert) then 162 if cert_verify_identity(host, "xmpp-server", cert) then
166 session.cert_identity_status = "invalid" 165 session.cert_identity_status = "invalid"
167 end 166 end
168 end 167 end
169 end 168 end
170 end 169 end
170 module:fire_event("s2s-check-certificate", { host = host, session = session, cert = cert });
171 end 171 end
172 172
173 --- XMPP stream event handlers 173 --- XMPP stream event handlers
174 174
175 local stream_callbacks = { default_ns = "jabber:server", handlestanza = core_process_stanza }; 175 local stream_callbacks = { default_ns = "jabber:server", handlestanza = core_process_stanza };
247 end 247 end
248 248
249 if session.secure and not session.cert_chain_status then check_cert_status(session); end 249 if session.secure and not session.cert_chain_status then check_cert_status(session); end
250 250
251 send("<?xml version='1.0'?>"); 251 send("<?xml version='1.0'?>");
252 send(st.stanza("stream:stream", { xmlns='jabber:server', ["xmlns:db"]='jabber:server:dialback', 252 send(st.stanza("stream:stream", { xmlns='jabber:server',
253 ["xmlns:db"]= hosts[to].modules.dialback and 'jabber:server:dialback' or nil,
253 ["xmlns:stream"]='http://etherx.jabber.org/streams', id=session.streamid, from=to, to=from, version=(session.version > 0 and "1.0" or nil) }):top_tag()); 254 ["xmlns:stream"]='http://etherx.jabber.org/streams', id=session.streamid, from=to, to=from, version=(session.version > 0 and "1.0" or nil) }):top_tag());
254 if session.version >= 1.0 then 255 if session.version >= 1.0 then
255 local features = st.stanza("stream:features"); 256 local features = st.stanza("stream:features");
256 257
257 if to then 258 if to then