Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add ability to mark webirc users and forbid marked users #320

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add ability to mark webirc users and forbid marked users #320

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions doc/reference.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -394,6 +394,9 @@ auth {
* extend_chans | allow this user to join more channels than normal
* kline_spoof_ip | if this block has a spoof host, klines match only
* | the spoof and not the underlying IP
* set_mark | no-op by default; used by webirc to mark this user
* | before resolving their actual auth block
* forbid_mark | reject connections from marked users
*/
flags = kline_exempt, exceed_limit;

Expand Down
11 changes: 11 additions & 0 deletions extensions/m_webirc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,8 @@
* Possible flags:
* encrypted - password is encrypted (recommended)
* kline_exempt - klines on the cgiirc ip are ignored
* set_mark - mark clients connecting via this block, interacts with
* forbid_mark when resolving the auth block for the spoofed ip
* dlines are checked on the cgiirc ip (of course).
* k/d/x lines, auth blocks, user limits, etc are checked using the
* real host/ip.
Expand Down Expand Up @@ -143,6 +145,15 @@ mr_webirc(struct MsgBuf *msgbuf_p, struct Client *client_p, struct Client *sourc
source_p->username[0] = '\0';
ClearGotId(source_p);

/* set_mark and forbid_mark in an auth block both set CONF_FLAG_FORBIDMARK;
* the distinction is purely visual for the sake of human readability,
* hence checking IsConfForbidMark here.
*/
if (IsConfForbidMark(aconf))
{
SetMark(source_p);
}

if (parc >= 6)
{
const char *s;
Expand Down
2 changes: 2 additions & 0 deletions include/s_conf.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,7 @@ struct ConfItem
#define CONF_FLAGS_EXEMPTJUPE 0x00020000 /* exempt from resv generating warnings */
#define CONF_FLAGS_NEED_SASL 0x00040000
#define CONF_FLAGS_EXTEND_CHANS 0x00080000
#define CONF_FLAGS_FORBIDMARK 0x00100000
#define CONF_FLAGS_ENCRYPTED 0x00200000
#define CONF_FLAGS_EXEMPTDNSBL 0x04000000
#define CONF_FLAGS_EXEMPTPROXY 0x08000000
Expand All @@ -132,6 +133,7 @@ struct ConfItem
#define IsConfExemptResv(x) ((x)->flags & CONF_FLAGS_EXEMPTRESV)
#define IsConfDoSpoofIp(x) ((x)->flags & CONF_FLAGS_SPOOF_IP)
#define IsConfSpoofNotice(x) ((x)->flags & CONF_FLAGS_SPOOF_NOTICE)
#define IsConfForbidMark(x) ((x)->flags & CONF_FLAGS_FORBIDMARK)
#define IsConfEncrypted(x) ((x)->flags & CONF_FLAGS_ENCRYPTED)
#define IsNeedSasl(x) ((x)->flags & CONF_FLAGS_NEED_SASL)
#define IsConfExemptDNSBL(x) ((x)->flags & CONF_FLAGS_EXEMPTDNSBL)
Expand Down
2 changes: 2 additions & 0 deletions ircd/newconf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -351,6 +351,8 @@ static struct mode_table auth_table[] = {
{"extend_chans", CONF_FLAGS_EXTEND_CHANS },
{"allow_sctp", CONF_FLAGS_ALLOW_SCTP },
{"kline_spoof_ip", CONF_FLAGS_KLINE_SPOOF },
{"set_mark", CONF_FLAGS_FORBIDMARK },
{"forbid_mark", CONF_FLAGS_FORBIDMARK },
{NULL, 0}
};

Expand Down
8 changes: 8 additions & 0 deletions ircd/s_conf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -325,6 +325,14 @@ verify_access(struct Client *client_p, const char *username)
return (NOT_AUTHORISED);
}

if(IsMarked(client_p))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
if(IsMarked(client_p))
if (IsMarked(client_p))

Copy link
Contributor Author

@skizzerz skizzerz Apr 1, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just stuck with the same formatting as all of the other (existing) ifs in the file (which lacked spaces before the parenthesis). Should I change all of them?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

change as many as you can be bothered to without feeling excessive, I guess. I don't always change surrounding ones (though I do think it's good to); I just figure if we stop introducing new if( eventually it'll be gone.

{
if(IsConfForbidMark(aconf))
return NOT_AUTHORISED;

ClearMark(client_p);
edk0 marked this conversation as resolved.
Show resolved Hide resolved
}

/* Thanks for spoof idea amm */
if(IsConfDoSpoofIp(aconf))
{
Expand Down