Mercurial > prosody-hg

changeset 14105:4ed802e45af6 13.0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_s2s_auth_dane_in: Don't attempt DANCE with IP addresses (fixes #1988) DNS lookups based on IP addresses do not work. Backported from b0c31a5d8276
author Kim Alvefur <zash@zash.se>
date Sun, 22 Mar 2026 11:20:42 +0100
parents a1fb05cbd44e
children b5eeb6730721 f587496eb08f
files plugins/mod_s2s_auth_dane_in.lua
diffstat 1 files changed, 6 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/plugins/mod_s2s_auth_dane_in.lua	Sat Mar 14 01:19:27 2026 +0100
+++ b/plugins/mod_s2s_auth_dane_in.lua	Sun Mar 22 11:20:42 2026 +0100
@@ -4,6 +4,7 @@
 local async = require "prosody.util.async";
 local encodings = require "prosody.util.encodings";
 local hashes = require "prosody.util.hashes";
+local inet_pton = require "prosody.util.net".pton;
 local promise = require "prosody.util.promise";
 local x509 = require "prosody.util.x509";
 
@@ -68,6 +69,11 @@
 		return
 	end
 
+	if inet_pton(host) or host:sub(1,1) == '[' then
+		-- No DANCEing with IP literals
+		return
+	end
+
 	local by_select_match = {
 		[0] = lazy_hash {
 			-- cert