Check TLS state before requesting SASL EXTERNAL

Make sure a remote server can't circumvent "s2s_use_starttls: required"
by offering SASL EXTERNAL authentication over a non-TLS connection.

diff --git a/src/ejabberd_s2s_out.erl b/src/ejabberd_s2s_out.erl
index a0a83631d1674bdf5531977cacddd73cfb562627..e404207cd6c483fadf0fdb8598c07f361af11361 100644 (file)
--- a/src/ejabberd_s2s_out.erl
+++ b/src/ejabberd_s2s_out.erl
@@ -578,7 +578,9 @@ wait_for_features({xmlstreamelement, El}, StateData) ->
                 {next_state, stream_established,
                  StateData#state{queue = queue:new()}};
             SASLEXT and StateData#state.try_auth and
-              (StateData#state.new /= false) ->
+              (StateData#state.new /= false) and
+                (StateData#state.tls_enabled or
+                  not StateData#state.tls_required) ->
                 send_element(StateData,
                              #xmlel{name = <<"auth">>,
                                     attrs =