From c99f16f3e0830c19330eb02e522629971c4fde64 Mon Sep 17 00:00:00 2001 From: reverse Date: Wed, 19 Aug 2026 00:34:25 +0000 Subject: [PATCH] =?UTF-8?q?webirc:=20require=20a=20non-empty=20source-IP?= =?UTF-8?q?=20mask=20on=20a=20webirc=20block=20=E2=80=94=20an=20empty=20ip?= =?UTF-8?q?mask=20meant=20"any=20IP",=20so=20a=20maskless=20webirc=3D=20block=20turned=20one=20shared=20secret=20into=20a=20ful?= =?UTF-8?q?l=20host/IP=20spoof=20(bypassing=20z-lines,=20DNSBL,=20GeoIP,?= =?UTF-8?q?=20cloak)=20for=20anyone=20who=20learned=20it;=20now=20the=20ga?= =?UTF-8?q?teway's=20connecting=20IP=20must=20match=20the=20block's=20ipma?= =?UTF-8?q?sk?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/coremods/core_user.rs | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/coremods/core_user.rs b/src/coremods/core_user.rs index f23eb4b..659471b 100644 --- a/src/coremods/core_user.rs +++ b/src/coremods/core_user.rs @@ -75,8 +75,10 @@ impl Command for Vhost { /// WEBIRC — a trusted web gateway declares the real client's host + IP, so users /// behind it don't all share the gateway's address. `WEBIRC /// [:flags]`; must precede registration and the password must -/// match a `webirc` config block. (Password-only trust for now — restricting it -/// to the gateway's own source IP is a TODO.) +/// match a `webirc` config block whose `ipmask` also matches the gateway's own +/// connecting IP. A block with no `ipmask` is rejected: a shared password alone +/// would let anyone who learns it spoof any host/IP (bypassing z-lines, DNSBL, +/// GeoIP and cloaking). struct WebIrc; impl Command for WebIrc { fn name(&self) -> &'static str { @@ -102,7 +104,7 @@ impl Command for WebIrc { let Some(gw) = s .webirc .iter() - .find(|g| g.password == *pass && (g.ipmask.is_empty() || glob_match(&g.ipmask, &from))) + .find(|g| g.password == *pass && !g.ipmask.is_empty() && glob_match(&g.ipmask, &from)) .map(|g| g.name.clone()) else { s.notice_star(uid, "WEBIRC: invalid credentials");