mod_legacyauth, mod_saslauth, mod_tls: Pass require_encryption as default option...

[prosody.git] / plugins / mod_legacyauth.lua

diff --git a/plugins/mod_legacyauth.lua b/plugins/mod_legacyauth.lua
index 0134d736d831440479573d42e5a5b91d046af44a..5edc26bb2567604348e42d33b00854f4f24db921 100644 (file)
--- a/plugins/mod_legacyauth.lua
+++ b/plugins/mod_legacyauth.lua
@@ -1,7 +1,7 @@
 -- Prosody IM
 -- Copyright (C) 2008-2010 Matthew Wild
 -- Copyright (C) 2008-2010 Waqas Hussain
--- 
+--
 -- This project is MIT/X11 licensed. Please see the
 -- COPYING file in the source package for more information.
 --
@@ -11,7 +11,9 @@
 local st = require "util.stanza";
 local t_concat = table.concat;
 
-local secure_auth_only = module:get_option("c2s_require_encryption") or module:get_option("require_encryption");
+local secure_auth_only = module:get_option("c2s_require_encryption",
+       module:get_option("require_encryption"))
+       or not(module:get_option("allow_unencrypted_plain_auth"));
 
 local sessionmanager = require "core.sessionmanager";
 local usermanager = require "core.usermanager";
@@ -29,47 +31,57 @@ module:hook("stream-features", function(event)
        end
 end);
 
-module:add_iq_handler("c2s_unauthed", "jabber:iq:auth", 
-               function (session, stanza)
-                       if secure_auth_only and not session.secure then
-                               session.send(st.error_reply(stanza, "modify", "not-acceptable", "Encryption (SSL or TLS) is required to connect to this server"));
-                               return true;
-                       end
-                       
-                       local username = stanza.tags[1]:child_with_name("username");
-                       local password = stanza.tags[1]:child_with_name("password");
-                       local resource = stanza.tags[1]:child_with_name("resource");
-                       if not (username and password and resource) then
-                               local reply = st.reply(stanza);
-                               session.send(reply:query("jabber:iq:auth")
-                                       :tag("username"):up()
-                                       :tag("password"):up()
-                                       :tag("resource"):up());
-                       else
-                               username, password, resource = t_concat(username), t_concat(password), t_concat(resource);
-                               username = nodeprep(username);
-                               resource = resourceprep(resource)
-                               local reply = st.reply(stanza);
-                               if usermanager.validate_credentials(session.host, username, password) then
-                                       -- Authentication successful!
-                                       local success, err = sessionmanager.make_authenticated(session, username);
-                                       if success then
-                                               local err_type, err_msg;
-                                               success, err_type, err, err_msg = sessionmanager.bind_resource(session, resource);
-                                               if not success then
-                                                       session.send(st.error_reply(stanza, err_type, err, err_msg));
-                                                       session.username, session.type = nil, "c2s_unauthed"; -- FIXME should this be placed in sessionmanager?
-                                                       return true;
-                                               elseif resource ~= session.resource then -- server changed resource, not supported by legacy auth
-                                                       session.send(st.error_reply(stanza, "cancel", "conflict", "The requested resource could not be assigned to this session."));
-                                                       session:close(); -- FIXME undo resource bind and auth instead of closing the session?
-                                                       return true;
-                                               end
-                                       end
-                                       session.send(st.reply(stanza));
-                               else
-                                       session.send(st.error_reply(stanza, "auth", "not-authorized"));
+module:hook("stanza/iq/jabber:iq:auth:query", function(event)
+       local session, stanza = event.origin, event.stanza;
+
+       if session.type ~= "c2s_unauthed" then
+               (session.sends2s or session.send)(st.error_reply(stanza, "cancel", "service-unavailable", "Legacy authentication is only allowed for unauthenticated client connections."));
+               return true;
+       end
+
+       if secure_auth_only and not session.secure then
+               session.send(st.error_reply(stanza, "modify", "not-acceptable", "Encryption (SSL or TLS) is required to connect to this server"));
+               return true;
+       end
+
+       local query = stanza.tags[1];
+       local username = query:get_child("username");
+       local password = query:get_child("password");
+       local resource = query:get_child("resource");
+       if not (username and password and resource) then
+               local reply = st.reply(stanza);
+               session.send(reply:query("jabber:iq:auth")
+                       :tag("username"):up()
+                       :tag("password"):up()
+                       :tag("resource"):up());
+       else
+               username, password, resource = t_concat(username), t_concat(password), t_concat(resource);
+               username = nodeprep(username);
+               resource = resourceprep(resource)
+               if not (username and resource) then
+                       session.send(st.error_reply(stanza, "modify", "bad-request"));
+                       return true;
+               end
+               if usermanager.test_password(username, session.host, password) then
+                       -- Authentication successful!
+                       local success, err = sessionmanager.make_authenticated(session, username);
+                       if success then
+                               local err_type, err_msg;
+                               success, err_type, err, err_msg = sessionmanager.bind_resource(session, resource);
+                               if not success then
+                                       session.send(st.error_reply(stanza, err_type, err, err_msg));
+                                       session.username, session.type = nil, "c2s_unauthed"; -- FIXME should this be placed in sessionmanager?
+                                       return true;
+                               elseif resource ~= session.resource then -- server changed resource, not supported by legacy auth
+                                       session.send(st.error_reply(stanza, "cancel", "conflict", "The requested resource could not be assigned to this session."));
+                                       session:close(); -- FIXME undo resource bind and auth instead of closing the session?
+                                       return true;
                                end
                        end
-                       return true;
-               end);
+                       session.send(st.reply(stanza));
+               else
+                       session.send(st.error_reply(stanza, "auth", "not-authorized"));
+               end
+       end
+       return true;
+end);