http://hg.omfa.de/prosody-hg/ en-us prosody-hg: plugins/mod_s2s_auth_dane_in.lua history plugins/mod_s2s_auth_dane_in.lua revision history Merge 13.0->trunk http://hg.omfa.de/prosody-hg/log/b5eeb6730721/plugins/mod_s2s_auth_dane_in.lua Kim Alvefur <zash@zash.se> Sun, 22 Mar 2026 11:28:52 +0100 mod_s2s_auth_dane_in: Don't attempt DANCE with IP addresses (fixes #1988) http://hg.omfa.de/prosody-hg/log/4ed802e45af6/plugins/mod_s2s_auth_dane_in.lua
DNS lookups based on IP addresses do not work.

Backported from b0c31a5d8276]]> Kim Alvefur <zash@zash.se> Sun, 22 Mar 2026 11:20:42 +0100 mod_s2s_auth_dane_in: Don't attempt DANCE with IP addresses http://hg.omfa.de/prosody-hg/log/b0c31a5d8276/plugins/mod_s2s_auth_dane_in.lua
DNS lookups based on IP addresses do not work.]]> Kim Alvefur <zash@zash.se> Fri, 30 Jan 2026 22:02:31 +0100 Merge 13.0->trunk http://hg.omfa.de/prosody-hg/log/7fdf7645b0da/plugins/mod_s2s_auth_dane_in.lua Kim Alvefur <zash@zash.se> Tue, 05 Aug 2025 22:35:01 +0200 mod_s2s_auth_dane_in: Fix caching SHA2-512 hash http://hg.omfa.de/prosody-hg/log/e6087c733899/plugins/mod_s2s_auth_dane_in.lua
This unintentionally stored the SHA2-512 hash in the slot for SHA2-256,
so that if something compares the same entry again against a SHA2-256
hash it would fail. However a matching SHA2-512 entry should still
match. RFC 7671 RECOMMENDS SHA2-256 so SHA2-512 entries are expected to
be less common. DANE support not being enabled by default. Expected
impact is low.]]> Kim Alvefur <zash@zash.se> Tue, 05 Aug 2025 21:49:58 +0200 mod_s2s_auth_dane_in: Skip further TLSA lookups if the first is insecure http://hg.omfa.de/prosody-hg/log/d7e907830260/plugins/mod_s2s_auth_dane_in.lua
Because the later ones wouldn't be secure either.

Code reduction and fewer DNS lookups that should result in a speedup.]]> Kim Alvefur <zash@zash.se> Fri, 20 Jun 2025 13:33:09 +0200 mod_s2s_auth_dane_in: Try single TLSA lookup per draft-ietf-dance-client-auth http://hg.omfa.de/prosody-hg/log/b1e2dd6e735b/plugins/mod_s2s_auth_dane_in.lua
Moves some complexity from the implementation into DNS operations.]]> Kim Alvefur <zash@zash.se> Thu, 11 Jan 2024 07:54:11 +0100 mod_s2s_auth_dane_in: Simplify result processing http://hg.omfa.de/prosody-hg/log/d8e885db9851/plugins/mod_s2s_auth_dane_in.lua
Fewer loops]]> Kim Alvefur <zash@zash.se> Thu, 11 Jan 2024 07:53:06 +0100 mod_s2s_auth_dane_in: Bail out on explicit service denial http://hg.omfa.de/prosody-hg/log/28211ed70b4c/plugins/mod_s2s_auth_dane_in.lua Kim Alvefur <zash@zash.se> Sun, 12 Nov 2023 00:35:22 +0100 mod_s2s_auth_dane_in: DANE support for s2sin http://hg.omfa.de/prosody-hg/log/7264c4d16072/plugins/mod_s2s_auth_dane_in.lua
Complements the DANE support for outgoing connections included in
net.connect]]> Kim Alvefur <zash@zash.se> Wed, 01 Nov 2023 22:49:56 +0100