Chapril
/
xmpp.chapril.org-ejabberd
mirror of https://github.com/processone/ejabberd.git
24
1
Fork 0
Code Releases Activity

Merge pull request #316 from weiss/really-require-tls 

Make sure "starttls_required" can't be bypassed
This commit is contained in:
Evgeny Khramtsov 2014-10-12 11:05:49 +04:00
parent 4bbf16b21a 7bdc1151b1
commit 97fa57c360
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/ejabberd_c2s.erl
View File

@ -735,7 +735,7 @@ wait_for_feature_request({xmlstreamelement, El},
(StateData#state.sockmod):get_sockmod(StateData#state.socket), (StateData#state.sockmod):get_sockmod(StateData#state.socket),
case {xml:get_attr_s(<<"xmlns">>, Attrs), Name} of case {xml:get_attr_s(<<"xmlns">>, Attrs), Name} of
{?NS_SASL, <<"auth">>} {?NS_SASL, <<"auth">>}
when not ((SockMod == gen_tcp) and TLSRequired) -> when TLSEnabled or not TLSRequired ->
Mech = xml:get_attr_s(<<"mechanism">>, Attrs), Mech = xml:get_attr_s(<<"mechanism">>, Attrs),
ClientIn = jlib:decode_base64(xml:get_cdata(Els)), ClientIn = jlib:decode_base64(xml:get_cdata(Els)),
case cyrsasl:server_start(StateData#state.sasl_state, case cyrsasl:server_start(StateData#state.sasl_state,
@ -856,7 +856,7 @@ wait_for_feature_request({xmlstreamelement, El},
end end
end; end;
_ -> _ ->
if (SockMod == gen_tcp) and TLSRequired -> if TLSRequired and not TLSEnabled ->
Lang = StateData#state.lang, Lang = StateData#state.lang,
send_element(StateData, send_element(StateData,
?POLICY_VIOLATION_ERR(Lang, ?POLICY_VIOLATION_ERR(Lang,