Add ability to mark webirc users and forbid marked users #320
Conversation
Marked connections (via set_mark in the webirc auth block) will be checked against the forbid_mark flag in the final auth block after resolving the user's spoofed IP. This allows for additional levels of security from webirc operators so that they are unable to spoof their way into privileged auth blocks -- an auth block with forbid_mark will reject any connections from marked users. The mark is not automatic because some webirc servers may be fully trusted to allow privileged users to connect (such as a webchat hosted by the network itself).
| @@ -325,6 +325,14 @@ verify_access(struct Client *client_p, const char *username) | |||
| return (NOT_AUTHORISED); | |||
| } | |||
|
|
|||
| if(IsMarked(client_p)) | |||
There was a problem hiding this comment.
| if(IsMarked(client_p)) | |
| if (IsMarked(client_p)) |
There was a problem hiding this comment.
I just stuck with the same formatting as all of the other (existing) ifs in the file (which lacked spaces before the parenthesis). Should I change all of them?
There was a problem hiding this comment.
change as many as you can be bothered to without feeling excessive, I guess. I don't always change surrounding ones (though I do think it's good to); I just figure if we stop introducing new if( eventually it'll be gone.
|
I would prefer adding a new flag bit; reusing an existing one seems rather cryptic and there are plenty of bits left. The flags in the configuration could perhaps be named more clearly as well, for example "unprivileged_webirc" and "forbid_unprivileged_webirc" (or "untrusted" instead of "unprivileged"). |
Marked connections (via set_mark in the webirc auth block) will be
checked against the forbid_mark flag in the final auth block after
resolving the user's spoofed IP. This allows for additional levels of
security from webirc operators so that they are unable to spoof their
way into privileged auth blocks -- an auth block with forbid_mark will
reject any connections from marked users.
The mark is not automatic because some webirc servers may be fully
trusted to allow privileged users to connect (such as a webchat hosted
by the network itself).