# HG changeset patch
# User Matthew Wild <mwild1@gmail.com>
# Date 1364823959 -3600
# Node ID 767ecb0091a63d469a77ccc9166f67cf8bf886a4
# Parent  c9ff345a27e7cc76c1b19bb4717c740fdf1f8d5d
mod_s2s: Close incoming s2s with stream error when secure and we don't trust their certificate

diff -r c9ff345a27e7 -r 767ecb0091a6 plugins/mod_s2s/mod_s2s.lua
--- a/plugins/mod_s2s/mod_s2s.lua	Sun Mar 31 22:40:01 2013 +0100
+++ b/plugins/mod_s2s/mod_s2s.lua	Mon Apr 01 14:45:59 2013 +0100
@@ -632,7 +632,11 @@
 	
 	if must_secure and not session.cert_identity_status then
 		module:log("warn", "Forbidding insecure connection to/from %s", host);
-		session:close(false);
+		if session.direction == "incoming" then
+			session:close({ condition = "not-authorized", text = "Your server's certificate is invalid, expired, or not trusted by"..session.to_host });
+		else -- Close outgoing connections without warning
+			session:close(false);
+		end
 		return false;
 	end
 end