fedserv/echoIRCd
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

s2s: validate source_behind on ADDLINE/DELLINE/INVITE too — these apply network state (x-lines, invite bypass) from msg.source with no check the source sits behind the arriving link; a legit source (incl. a services SID/uuid) always is, so echo's akills still propagate

Browse source
This commit is contained in:
Jean Chevronnet 2026-08-19 04:57:39 +00:00
parent 78a6574d64
commit b106b66de5
1 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/link.rs
View file

@ -1345,6 +1345,9 @@ impl Server {
let Some(src) = msg.source.clone() else {
return;
};
if !self.source_behind(&src, via) {
return; // reject an invite-bypass forged from behind another link
}
let (Some(target), Some(chan)) =
(msg.params.first().cloned(), msg.params.get(1).cloned())
else {
@ -1372,6 +1375,12 @@ impl Server {
if msg.params.len() < 6 {
return;
}
let Some(src) = msg.source.as_deref() else {
return;
};
if !self.source_behind(src, via) {
return; // reject a network x-line forged from behind another link
}
let Some(kind) = crate::xline::XKind::from_tag(&msg.params[0]) else {
return;
};
@ -1390,6 +1399,12 @@ impl Server {
if msg.params.len() < 2 {
return;
}
let Some(src) = msg.source.as_deref() else {
return;
};
if !self.source_behind(src, via) {
return; // reject an x-line removal forged from behind another link
}
let Some(kind) = crate::xline::XKind::from_tag(&msg.params[0]) else {
return;
};