From b106b66de50075f0ce8b09070d8661576b75edfd Mon Sep 17 00:00:00 2001
From: reverse <mike.chevronnet@gmail.com>
Date: Wed, 19 Aug 2026 04:57:39 +0000
Subject: [PATCH] =?UTF-8?q?s2s:=20validate=20source=5Fbehind=20on=20ADDLIN?=
 =?UTF-8?q?E/DELLINE/INVITE=20too=20=E2=80=94=20these=20apply=20network=20?=
 =?UTF-8?q?state=20(x-lines,=20invite=20bypass)=20from=20msg.source=20with?=
 =?UTF-8?q?=20no=20check=20the=20source=20sits=20behind=20the=20arriving?=
 =?UTF-8?q?=20link;=20a=20legit=20source=20(incl.=20a=20services=20SID/uui?=
 =?UTF-8?q?d)=20always=20is,=20so=20echo's=20akills=20still=20propagate?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/link.rs | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/src/link.rs b/src/link.rs
index 774504b..eccef2a 100644
--- a/src/link.rs
+++ b/src/link.rs
@@ -1345,6 +1345,9 @@ impl Server {
         let Some(src) = msg.source.clone() else {
             return;
         };
+        if !self.source_behind(&src, via) {
+            return; // reject an invite-bypass forged from behind another link
+        }
         let (Some(target), Some(chan)) =
             (msg.params.first().cloned(), msg.params.get(1).cloned())
         else {
@@ -1372,6 +1375,12 @@ impl Server {
         if msg.params.len() < 6 {
             return;
         }
+        let Some(src) = msg.source.as_deref() else {
+            return;
+        };
+        if !self.source_behind(src, via) {
+            return; // reject a network x-line forged from behind another link
+        }
         let Some(kind) = crate::xline::XKind::from_tag(&msg.params[0]) else {
             return;
         };
@@ -1390,6 +1399,12 @@ impl Server {
         if msg.params.len() < 2 {
             return;
         }
+        let Some(src) = msg.source.as_deref() else {
+            return;
+        };
+        if !self.source_behind(src, via) {
+            return; // reject an x-line removal forged from behind another link
+        }
         let Some(kind) = crate::xline::XKind::from_tag(&msg.params[0]) else {
             return;
         };