Add support for requiring users to use SSL in order to use SASL.

diff --git a/docs/conf/modules.conf.example b/docs/conf/modules.conf.example
index 9f8c46d05bcd39778ec1d3fbc31984c0461b06f5..1b26182e4d9fe87bf32f714bfe172b813712bd85 100644 (file)
--- a/docs/conf/modules.conf.example
+++ b/docs/conf/modules.conf.example
@@ -1951,7 +1951,10 @@
 # You must define <sasl:target> to the name of your services server so
 # that InspIRCd knows where to send SASL authentication messages and
 # when it should enable the SASL capability.
-#<sasl target="services.mynetwork.com">
+# You can also define <sasl:requiressl> to require users to use SSL in
+# order to be able to use SASL.
+#<sasl target="services.mynetwork.com"
+#      requiressl="yes">
 
 #-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
 # Secure list module: Prevent /LIST in the first minute of connection,

diff --git a/src/modules/m_sasl.cpp b/src/modules/m_sasl.cpp
index 9fe270567878b3f72329bbf51a49c5a840af7e80..19b2c9f507a747aff1118ceae8d11d1c6c544a6d 100644 (file)
--- a/src/modules/m_sasl.cpp
+++ b/src/modules/m_sasl.cpp
@@ -109,11 +109,16 @@ class ServerTracker
 
 class SASLCap : public Cap::Capability
 {
+ private:
        std::string mechlist;
        const ServerTracker& servertracker;
+       UserCertificateAPI sslapi;
 
        bool OnRequest(LocalUser* user, bool adding) CXX11_OVERRIDE
        {
+               if (requiressl && sslapi && !sslapi->GetCertificate(user))
+                       return false;
+
                // Servers MUST NAK any sasl capability request if the authentication layer
                // is unavailable.
                return servertracker.IsOnline();
@@ -121,6 +126,9 @@ class SASLCap : public Cap::Capability
 
        bool OnList(LocalUser* user) CXX11_OVERRIDE
        {
+               if (requiressl && sslapi && !sslapi->GetCertificate(user))
+                       return false;
+
                // Servers MUST NOT advertise the sasl capability if the authentication layer
                // is unavailable.
                return servertracker.IsOnline();
@@ -132,9 +140,11 @@ class SASLCap : public Cap::Capability
        }
 
  public:
+       bool requiressl;
        SASLCap(Module* mod, const ServerTracker& tracker)
                : Cap::Capability(mod, "sasl")
                , servertracker(tracker)
+               , sslapi(mod)
        {
        }
 
@@ -426,10 +436,13 @@ class ModuleSASL : public Module
 
        void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
        {
-               std::string target = ServerInstance->Config->ConfValue("sasl")->getString("target");
+               ConfigTag* tag = ServerInstance->Config->ConfValue("sasl");
+
+               const std::string target = tag->getString("target");
                if (target.empty())
                        throw ModuleException("<sasl:target> must be set to the name of your services server!");
 
+               cap.requiressl = tag->getBool("requiressl");
                sasl_target = target;
                servertracker.Reset();
        }