plugins/tls.lua

local verse = require "verse";

local xmlns_tls = "urn:ietf:params:xml:ns:xmpp-tls";

function verse.plugins.tls(stream)
	local function handle_features(features_stanza)
		if stream.authenticated then return; end
		if features_stanza:get_child("starttls", xmlns_tls) and stream.conn.starttls then
			stream:debug("Negotiating TLS...");
			stream:send(verse.stanza("starttls", { xmlns = xmlns_tls }));
			return true;
		elseif not stream.conn.starttls and not stream.secure then
			stream:warn("SSL library (LuaSec) not loaded, so TLS not available");
		elseif not stream.secure then
			stream:debug("Server doesn't offer TLS :(");
		end
	end
	local function handle_tls(tls_status)
		if tls_status.name == "proceed" then
			stream:debug("Server says proceed, handshake starting...");
			local sslctx = verse.tls_builder(".")
				:apply({mode="client", protocol="sslv23", options="no_sslv2",capath="/etc/ssl/certs"})
				:apply(stream.ssl or {});
			stream.conn:starttls(sslctx:build(), true);
		end
	end
	local function handle_status(new_status)
		if new_status == "ssl-handshake-complete" then
			stream.secure = true;
			stream:debug("Re-opening stream...");
			stream:reopen();
		end
	end
	stream:hook("stream-features", handle_features, 400);
	stream:hook("stream/"..xmlns_tls, handle_tls);
	stream:hook("status", handle_status, 400);

	return true;
end