processone/ejabberd — pull request #174 by weiss (2014-04-23 10:45:17+00:00)
Title: Fix certificate authentication for incoming s2s connections

ejabberd 13.x refuses incoming s2s connections when TLS is used and the peer's certificate is verified successfully but doesn't contain an [XmppAddr identifier as a subjectAltName][1]. The problem can currently be reproduced, for example, by trying to join `ejabberd@conference.jabber.ru` using a [dukgo.com][2] account. This happens due to a combination of two issues:

1. In order to decide whether to offer `SASL EXTERNAL` authentication, ejabberd verifies the remote server's certificate _without_ checking the host name. If this verification succeeds, ejabberd offers (and the remote server usually chooses) `EXTERNAL` authentication.
2. Then, when the remote server requested `EXTERNAL` authentication, ejabberd re-verifies the peer certificate and this time also the host name. This fails due to type errors in the verification code that were introduced by the [switch to binary strings][3].

My commits fix these type errors and let ejabberd check the host name before offering `SASL EXTERNAL` authentication, as suggested by the current version of [XEP-0178][4].

Thanks go to the Prosody developers who noted the issue and were very helpful while tracking down the details.

[1]: http://tools.ietf.org/html/rfc6120#section-13.7.1.4
[2]: https://duck.co/blog/using-pidgin-with-xmpp-jabber
[3]: 9deb294328bb3f9eb6bd2c0e7cd500732e9b5830
[4]: http://xmpp.org/extensions/xep-0178.html