# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1574962230 -3600
# Node ID 0c44090cb1688cab345b3b74627a8073df9dac2e
# Parent  2ab1cbb1c6b0b9a156018590bf8b2e81768f481f
mod_s2s: Abort outgoing connections earlier when TLS requirement isn't satisfied

This ensures the closure reason is accurate and not reported as an
authentication or other problem

diff -r 2ab1cbb1c6b0 -r 0c44090cb168 plugins/mod_s2s/mod_s2s.lua
--- a/plugins/mod_s2s/mod_s2s.lua	Thu Nov 28 17:32:15 2019 +0100
+++ b/plugins/mod_s2s/mod_s2s.lua	Thu Nov 28 18:30:30 2019 +0100
@@ -190,6 +190,13 @@
 			-- so the stream is ready for stanzas.  RFC 6120 Section 4.3
 			mark_connected(session);
 			return true;
+		elseif require_encryption and not session.secure then
+			session.log("warn", "Encrypted server-to-server communication is required but was not offered by %s", session.to_host);
+			session:close({
+					condition = "policy-violation",
+					text = "Encrypted server-to-server communication is required but was not offered",
+				}, nil, "Could not establish encrypted connection to remote server");
+			return false;
 		elseif not session.dialback_verifying then
 			session.log("warn", "No SASL EXTERNAL offer and Dialback doesn't seem to be enabled, giving up");
 			session:close({