echo/echoIRCd
1
1
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

harden: connclass clone-cap at register, ws control-frame limits, uuid recycle-skip, json-escape extjwt/filehost claims, metadata value/key caps, cloak numeric-dotted leak, relaymsg remote-nick, rpc set_oper block validation, isupport 13-token split, multi-hop privmsg routing, connectdelay=0

Browse source
This commit is contained in:
Jean Chevronnet 2026-08-15 16:27:11 +00:00
parent e935ee7002
commit 35af95fd0f
11 changed files with 129 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/modules/connclass.rs
View file

@ -386,6 +386,18 @@ pub fn on_register(s: &mut Server, uid: Uid) -> AuthOutcome {
else {
return AuthOutcome::Proceed;
};
// enforce per-IP clone caps here too: a class matched only by a host mask isn't
// picked at connect, so `assign` never got to check them
if let Some(max) = class.localmax {
if local_clones(s, &ip, &class.name, uid) >= max {
return AuthOutcome::Reject("Too many connections from your address".into());
}
}
if let Some(max) = class.globalmax {
if global_clones(s, &ip, uid) >= max {
return AuthOutcome::Reject("Too many connections from your address".into());
}
}
// cheap cert check before the (possibly slow) password verify
if class.ssl_trusted && !has_cert {
return AuthOutcome::Reject("Your connection class requires a client certificate".into());