mod_presence: Fix a comment

[prosody.git] / plugins / mod_saslauth.lua

diff --git a/plugins/mod_saslauth.lua b/plugins/mod_saslauth.lua
index f7b30aab5370ca6ace020e4735dd79ab4c2bf763..78417c0f4874a67a7dcf61b70eb6182bb1c49c66 100644 (file)
--- a/plugins/mod_saslauth.lua
+++ b/plugins/mod_saslauth.lua
@@ -21,7 +21,9 @@ local jid_split = require "util.jid".split
 local md5 = require "util.hashes".md5;
 local config = require "core.configmanager";
 
-local log = require "util.logger".init("mod_saslauth");
+local secure_auth_only = config.get(module:get_host(), "core", "require_encryption");
+
+local log = module._log;
 
 local xmlns_sasl ='urn:ietf:params:xml:ns:xmpp-sasl';
 local xmlns_bind ='urn:ietf:params:xml:ns:xmpp-bind';
@@ -32,16 +34,16 @@ local new_sasl = require "util.sasl".new;
 local function build_reply(status, ret, err_msg)
        local reply = st.stanza(status, {xmlns = xmlns_sasl});
        if status == "challenge" then
-               log("debug", ret or "");
+               log("debug", "%s", ret or "");
                reply:text(base64.encode(ret or ""));
        elseif status == "failure" then
                reply:tag(ret):up();
                if err_msg then reply:tag("text"):text(err_msg); end
        elseif status == "success" then
-               log("debug", ret or "");
+               log("debug", "%s", ret or "");
                reply:text(base64.encode(ret or ""));
        else
-               error("Unknown sasl status: "..status);
+               module:log("error", "Unknown sasl status: %s", status);
        end
        return reply;
 end
@@ -50,7 +52,12 @@ local function handle_status(session, status)
        if status == "failure" then
                session.sasl_handler = nil;
        elseif status == "success" then
-               if not session.sasl_handler.username then error("SASL succeeded but we didn't get a username!"); end -- TODO move this to sessionmanager
+               if not session.sasl_handler.username then -- TODO move this to sessionmanager
+                       module:log("warn", "SASL succeeded but we didn't get a username!");
+                       session.sasl_handler = nil;
+                       session:reset_stream();
+                       return;
+               end 
                sm_make_authenticated(session, session.sasl_handler.username);
                session.sasl_handler = nil;
                session:reset_stream();
@@ -74,8 +81,10 @@ end
 local function sasl_handler(session, stanza)
        if stanza.name == "auth" then
                -- FIXME ignoring duplicates because ejabberd does
-               if config.get(session.host or "*", "core", "anonymous_login") and stanza.attr.mechanism ~= "ANONYMOUS" then
-                       return session.send(build_reply("failure", "invalid-mechanism"));
+               if config.get(session.host or "*", "core", "anonymous_login") then
+                       if stanza.attr.mechanism ~= "ANONYMOUS" then
+                               return session.send(build_reply("failure", "invalid-mechanism"));
+                       end
                elseif stanza.attr.mechanism == "ANONYMOUS" then
                        return session.send(build_reply("failure", "mechanism-too-weak"));
                end
@@ -89,7 +98,7 @@ local function sasl_handler(session, stanza)
        local text = stanza[1];
        if text then
                text = base64.decode(text);
-               log("debug", text);
+               log("debug", "%s", text);
                if not text then
                        session.sasl_handler = nil;
                        session.send(build_reply("failure", "incorrect-encoding"));
@@ -99,7 +108,7 @@ local function sasl_handler(session, stanza)
        local status, ret, err_msg = session.sasl_handler:feed(text);
        handle_status(session, status);
        local s = build_reply(status, ret, err_msg); 
-       log("debug", "sasl reply: "..tostring(s));
+       log("debug", "sasl reply: %s", tostring(s));
        session.send(s);
 end
 
@@ -113,6 +122,9 @@ local xmpp_session_attr = { xmlns='urn:ietf:params:xml:ns:xmpp-session' };
 module:add_event_hook("stream-features", 
                function (session, features)                                                                                            
                        if not session.username then
+                               if secure_auth_only and not session.secure then
+                                       return;
+                               end
                                features:tag("mechanisms", mechanisms_attr);
                                -- TODO: Provide PLAIN only if TLS is active, this is a SHOULD from the introduction of RFC 4616. This behavior could be overridden via configuration but will issuing a warning or so.
                                        if config.get(session.host or "*", "core", "anonymous_login") then
@@ -130,7 +142,7 @@ module:add_event_hook("stream-features",
                                        
 module:add_iq_handler("c2s", "urn:ietf:params:xml:ns:xmpp-bind", 
                function (session, stanza)
-                       log("debug", "Client tried to bind to a resource");
+                       log("debug", "Client requesting a resource bind");
                        local resource;
                        if stanza.attr.type == "set" then
                                local bind = stanza.tags[1];
@@ -153,6 +165,6 @@ module:add_iq_handler("c2s", "urn:ietf:params:xml:ns:xmpp-bind",
                
 module:add_iq_handler("c2s", "urn:ietf:params:xml:ns:xmpp-session", 
                function (session, stanza)
-                       log("debug", "Client tried to bind to a resource");
+                       log("debug", "Client requesting a session");
                        session.send(st.reply(stanza));
                end);