diff options
| author | Clombrong <cromblong@egregore.fun> | 2025-06-29 08:40:17 +0200 |
|---|---|---|
| committer | Clombrong <cromblong@egregore.fun> | 2025-06-29 08:40:17 +0200 |
| commit | 4d45ffa8cb2bf3065b4811e69aa59e6952c465d5 (patch) | |
| tree | 263c344234c815f29abc5be86c24af8e2189afce | |
| parent | 13ab7a0170fb18738d8f0a491c95416c8f2c0c4d (diff) | |
feat(stream): raise an exception on insufficient encryption
| -rw-r--r-- | lib/stream.ml | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/lib/stream.ml b/lib/stream.ml index 80579f0..b501a78 100644 --- a/lib/stream.ml +++ b/lib/stream.ml @@ -2,6 +2,7 @@ open Lwt.Syntax open Lwt.Infix exception ClosedStream +exception InsufficientEncryption type feature = | Mechanisms of Sasl.auth_mechanism list @@ -72,7 +73,10 @@ let negotiate match starttls, prefer_starttls with | [`Optional], true | [`Required], _ -> Starttls.upgrade portal >>= start_stream - | [`Optional], false | [], _ -> Lwt.return other_features + | [`Optional], false | [], _ -> + if Portal._encrypted portal._socket || Option.is_some (Sys.getenv_opt "FLESH_ALLOW_STRIPTLS") + then Lwt.return other_features + else Lwt.fail InsufficientEncryption | _ -> Lwt.fail_with "Invalid number of STARTLS declarations in features." in let sasl_auth features = |