fedserv/echoIRCd
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

connclass: cidr/parent/port/limit/globalmax + hashed/trusted-cert passwords, per-class recvq/sendq + fakelag, and rfc1413 ident

Browse source
This commit is contained in:
Jean Chevronnet 2026-08-10 18:46:42 +00:00
parent f5f888dbaa
commit f371ed0a18
14 changed files with 842 additions and 126 deletions
Download patch file Download diff file Expand all files Collapse all files

441
src/modules/connclass.rs
View file

@ -1,123 +1,390 @@
//! connclass — connection classes. Each `connectclass` config line matches
//! connecting clients by IP glob (and optionally TLS), then applies per-class
//! policy: reject (deny), a per-IP connection cap, a password, usermodes on
//! connect, and overrides for max channels / ping frequency / registration
//! timeout. Config, one line per class (first token = name, rest key=value):
//! connecting clients by IP/host mask (CIDR or glob) and optional TLS/port, then
//! applies per-class policy: reject (deny), per-IP and per-class connection caps, a
//! password, on-connect usermodes, queue/flood limits, and overrides for max
//! channels / ping frequency / registration timeout. One line per class — the first
//! token is the name, the rest are `key=value`:
//!
//! ```text
//! connectclass = <name> allow=<ip glob> [deny=yes] [ssl=yes] [password=<pw>]
//! [localmax=<n>] [maxchans=<n>] [pingfreq=<secs>] [timeout=<secs>] [modes=<+modes>]
//! connectclass = <name> allow=<mask[,mask]> [parent=<name>] [deny=yes]
//! [requiressl=yes|trusted] [password=<pw>] [hash=<algo>] [port=<p[,p]>]
//! [localmax=<n>] [globalmax=<n>] [limit=<n>] [maxchans=<n>] [pingfreq=<secs>]
//! [timeout=<secs>] [modes=<+modes>] [recvq=<bytes>] [hardsendq=<bytes>]
//! [softsendq=<bytes>] [fakelag=yes|no] [penaltythreshold=<n>] [commandrate=<secs>]
//! [useident=yes] [requireident=yes] [resolvehostnames=no] [maxconnwarn=yes]
//! ```
//!
//! The first class whose `allow` glob (and `ssl` if given) matches a client is
//! assigned at connect. With no class, the global limits apply. Matching is against
//! the IP (the host isn't resolved yet at connect).
//! The first class whose masks (and TLS/port conditions) match a client is assigned.
//! Masks are tested against the IP at connect and re-tested against the resolved
//! host at registration, so host masks work once rDNS returns. With no class the
//! global limits apply; set `connectclass_required = yes` to refuse clients that
//! match no allow class.
use std::net::IpAddr;
use crate::channels::glob_match;
use crate::server::Server;
use crate::Uid;
#[derive(Default)]
#[derive(Default, Clone)]
pub struct ConnClass {
pub name: String,
pub allow: String,
pub deny: bool,
pub ssl: bool,
pub password: Option<String>,
pub localmax: Option<usize>,
pub allow: Vec<String>, // IP/host masks (glob or CIDR); any match = match
pub deny: bool, // deny class: matching clients are refused
pub ssl: bool, // require TLS
pub ssl_trusted: bool, // require a TLS client certificate (requiressl=trusted)
pub password: Option<String>, // PASS credential (plain or hashed; verify auto-detects)
pub ports: Vec<u16>, // restrict to these listener ports (empty = any)
pub localmax: Option<usize>, // max local connections per IP in this class
pub globalmax: Option<usize>, // max network-wide connections per IP
pub limit: Option<usize>, // max total local users in this class
pub maxchans: Option<usize>,
pub pingfreq: Option<u64>,
pub timeout: Option<u64>,
pub modes: Option<String>,
pub timeout: Option<u64>, // registration timeout
pub modes: Option<String>, // usermodes set on connect
pub recvq: Option<usize>, // per-conn receive-queue byte cap
pub hardsendq: Option<usize>, // send-queue byte cap → disconnect
pub softsendq: Option<usize>, // send-queue byte cap → pause reading (backpressure)
pub penaltythreshold: Option<usize>, // flood message cap override (see modules::flood)
pub commandrate: Option<u64>, // flood window override, seconds
pub fakelag: bool, // apply flood limiting (default); false = kill on flood
pub useident: bool, // do an ident (RFC1413) lookup for this class
pub requireident: bool, // refuse if the ident lookup fails
pub resolvehostnames: bool, // resolve rDNS for this class (default yes)
pub maxconnwarn: bool, // snotice opers when a limit refuses a client
}
fn parse(line: &str) -> Option<ConnClass> {
let mut it = line.split_whitespace();
/// Split a `key=value` value on commas into non-empty pieces.
fn list(v: &str) -> impl Iterator<Item = &str> {
v.split(',').map(str::trim).filter(|s| !s.is_empty())
}
/// Apply one `key=value` token to `c`.
fn apply(c: &mut ConnClass, k: &str, v: &str) {
match k {
"allow" => c.allow.extend(list(v).map(str::to_string)),
"deny" => c.deny = v.eq_ignore_ascii_case("yes"),
"ssl" | "requiressl" => {
c.ssl = !v.eq_ignore_ascii_case("no") && !v.is_empty();
c.ssl_trusted = v.eq_ignore_ascii_case("trusted");
}
"password" | "pass" => c.password = Some(v.to_string()),
"hash" => {
// name the algorithm of a hashed password: fold it into the stored
// credential (`<algo>:<digest>`) that verify() auto-detects, unless the
// password value already carries its own prefix.
if let Some(pw) = c.password.take() {
c.password = Some(if pw.contains(':') {
pw
} else {
format!("{v}:{pw}")
});
}
}
"port" => c.ports.extend(list(v).filter_map(|p| p.parse::<u16>().ok())),
"localmax" => c.localmax = v.parse().ok(),
"globalmax" => c.globalmax = v.parse().ok(),
"limit" => c.limit = v.parse().ok(),
"maxchans" => c.maxchans = v.parse().ok(),
"pingfreq" => c.pingfreq = v.parse().ok(),
"timeout" => c.timeout = v.parse().ok(),
"modes" => c.modes = Some(v.to_string()),
"recvq" => c.recvq = v.parse().ok(),
"hardsendq" => c.hardsendq = v.parse().ok(),
"softsendq" => c.softsendq = v.parse().ok(),
"penaltythreshold" => c.penaltythreshold = v.parse().ok(),
"commandrate" => c.commandrate = v.parse().ok(),
"fakelag" => c.fakelag = !v.eq_ignore_ascii_case("no"),
"useident" => c.useident = v.eq_ignore_ascii_case("yes"),
"requireident" => c.requireident = v.eq_ignore_ascii_case("yes"),
"resolvehostnames" => c.resolvehostnames = !v.eq_ignore_ascii_case("no"),
"maxconnwarn" => c.maxconnwarn = v.eq_ignore_ascii_case("yes"),
_ => {}
}
}
/// The raw `connectclass` line whose first token is `name`.
fn raw_line(s: &Server, name: &str) -> Option<String> {
s.conf_all("connectclass")
.iter()
.find(|l| l.split_whitespace().next() == Some(name))
.map(|l| l.to_string())
}
/// The effective token list for `name` with `parent=` inheritance applied: a
/// parent's tokens come first (so the child overrides), minus the block-defining
/// `allow`/`deny`/`parent` keys, which stay class-local. Bounded against cycles.
fn tokens_for(s: &Server, name: &str, depth: u8) -> Option<Vec<String>> {
let line = raw_line(s, name)?;
let own: Vec<String> = line.split_whitespace().skip(1).map(str::to_string).collect();
let parent = own
.iter()
.find_map(|t| t.strip_prefix("parent="))
.map(str::to_string);
let mut merged = Vec::new();
if let Some(p) = parent {
if depth < 8 {
if let Some(pt) = tokens_for(s, &p, depth + 1) {
merged.extend(pt.into_iter().filter(|t| {
!t.starts_with("allow=")
&& !t.starts_with("deny=")
&& !t.starts_with("parent=")
}));
}
}
}
merged.extend(own);
Some(merged)
}
/// Build a resolved class (parent inheritance applied) from its config line.
fn build(s: &Server, name: &str) -> Option<ConnClass> {
let toks = tokens_for(s, name, 0)?;
let mut c = ConnClass {
name: it.next()?.to_string(),
allow: "*".to_string(),
name: name.to_string(),
fakelag: true,
resolvehostnames: true,
..Default::default()
};
for tok in it {
let Some((k, v)) = tok.split_once('=') else {
continue;
};
match k {
"allow" => c.allow = v.to_string(),
"deny" => c.deny = v.eq_ignore_ascii_case("yes"),
"ssl" | "requiressl" => c.ssl = v.eq_ignore_ascii_case("yes"),
"password" | "pass" => c.password = Some(v.to_string()),
"localmax" => c.localmax = v.parse().ok(),
"maxchans" => c.maxchans = v.parse().ok(),
"pingfreq" => c.pingfreq = v.parse().ok(),
"timeout" => c.timeout = v.parse().ok(),
"modes" => c.modes = Some(v.to_string()),
_ => {}
for tok in toks {
if let Some((k, v)) = tok.split_once('=') {
apply(&mut c, k, v);
}
}
if c.allow.is_empty() {
c.allow.push("*".to_string()); // an unqualified class matches everyone
}
Some(c)
}
/// Every configured class, resolved.
pub fn all(s: &Server) -> Vec<ConnClass> {
s.conf_all("connectclass")
.iter()
.filter_map(|l| parse(l))
.filter_map(|l| l.split_whitespace().next())
.filter_map(|name| build(s, name))
.collect()
}
/// A single resolved class by name.
pub fn named(s: &Server, name: &str) -> Option<ConnClass> {
all(s).into_iter().find(|c| c.name == name)
build(s, name)
}
// --- mask matching -----------------------------------------------------------
/// Whether the first `bits` bits of `a` and `b` are equal.
fn prefix_eq(a: &[u8], b: &[u8], bits: u8) -> bool {
let full = (bits / 8) as usize;
if a[..full] != b[..full] {
return false;
}
let rem = bits % 8;
if rem == 0 {
return true;
}
let mask = 0xffu8 << (8 - rem);
(a[full] & mask) == (b[full] & mask)
}
/// Whether `target` falls inside the CIDR `base`/`bits` (same family required).
fn cidr_contains(base: IpAddr, bits: u8, target: IpAddr) -> bool {
match (base, target) {
(IpAddr::V4(b), IpAddr::V4(t)) => prefix_eq(&b.octets(), &t.octets(), bits.min(32)),
(IpAddr::V6(b), IpAddr::V6(t)) => prefix_eq(&b.octets(), &t.octets(), bits.min(128)),
_ => false,
}
}
/// Match one mask against a client's IP and (once known) resolved host. A mask with
/// a `/` is a CIDR range tested against the IP; otherwise it's a glob tested against
/// both the IP text and the host.
fn mask_match(mask: &str, ip: &str, host: &str) -> bool {
if let Some((net, bits)) = mask.split_once('/') {
if let (Ok(base), Ok(bits), Ok(target)) =
(net.parse::<IpAddr>(), bits.parse::<u8>(), ip.parse::<IpAddr>())
{
return cidr_contains(base, bits, target);
}
return false;
}
glob_match(mask, ip) || (!host.is_empty() && glob_match(mask, host))
}
// --- class selection ---------------------------------------------------------
enum Pick {
Class(ConnClass),
Deny(String),
None,
}
/// Choose the first suitable class for a client. Suitability = a matching mask plus
/// any TLS/port/limit conditions; an unsuitable class is skipped, a matching deny
/// class rejects. `host` is empty at connect (pre-rDNS) and the resolved name later.
fn pick(
s: &Server,
uid: Uid,
ip: &str,
host: &str,
secure: bool,
has_cert: bool,
port: u16,
) -> Pick {
for c in all(s) {
if !c.allow.iter().any(|m| mask_match(m, ip, host)) {
continue;
}
if c.ssl && !secure {
continue;
}
if c.ssl_trusted && !has_cert {
continue;
}
if !c.ports.is_empty() && !c.ports.contains(&port) {
continue;
}
if c.deny {
return Pick::Deny(c.name);
}
if let Some(max) = c.limit {
if class_count(s, &c.name, uid) >= max {
if c.maxconnwarn {
s.snotice(&format!("connect class {} is full ({max})", c.name));
}
continue; // full — try the next class
}
}
return Pick::Class(c);
}
Pick::None
}
/// Local users currently in class `name` (excluding `uid`).
fn class_count(s: &Server, name: &str, uid: Uid) -> usize {
s.users
.iter()
.filter(|(&k, u)| k != uid && u.class.as_deref() == Some(name))
.count()
}
/// Local connections from `ip` in class `name` (excluding `uid`).
fn local_clones(s: &Server, ip: &str, name: &str, uid: Uid) -> usize {
s.users
.iter()
.filter(|(&k, u)| {
k != uid && u.addr.ip().to_string() == ip && u.class.as_deref() == Some(name)
})
.count()
}
/// Connections from `ip` across the whole network (local + remote), excluding `uid`.
fn global_clones(s: &Server, ip: &str, uid: Uid) -> usize {
let local = s
.users
.iter()
.filter(|(&k, u)| k != uid && u.addr.ip().to_string() == ip)
.count();
let remote = s.remote_users.values().filter(|ru| ru.ip == ip).count();
local + remote
}
/// Assign the connecting client to the first matching class. Returns `Some(reason)`
/// if the connection must be rejected (a deny class or a per-IP cap); otherwise sets
/// the class name on the user and returns `None`. Called from `add_conn`.
/// if the connection must be rejected (a deny class or a per-IP/per-class cap);
/// otherwise sets the class on the user and returns `None`. Called from `add_conn`.
pub fn assign(s: &mut Server, uid: Uid) -> Option<String> {
let (ip, secure) = {
let (ip, secure, has_cert, port) = {
let u = s.users.get(&uid)?;
(u.addr.ip().to_string(), u.secure)
(
u.addr.ip().to_string(),
u.secure,
u.certfp.is_some(),
u.port,
)
};
let class = match pick(s, uid, &ip, "", secure, has_cert, port) {
Pick::Deny(name) => {
return Some(format!("Connection class {name} denies your address"));
}
Pick::None => {
if !all(s).iter().any(|c| !c.deny) || !s.conf_bool("connectclass_required", false) {
return None; // no allow classes, or strict mode off: allow, no class
}
return Some("You are not allowed to connect to this server".to_string());
}
Pick::Class(c) => c,
};
let warn = |s: &Server, why: &str| {
if class.maxconnwarn {
s.snotice(&format!("connect class {} refused {ip}: {why}", class.name));
}
};
let class = all(s)
.into_iter()
.find(|c| glob_match(&c.allow, &ip) && (!c.ssl || secure))?;
if class.deny {
return Some(format!("Connection class {} denies your address", class.name));
}
if let Some(max) = class.localmax {
let n = s
.users
.values()
.filter(|u| {
u.addr.ip().to_string() == ip && u.class.as_deref() == Some(class.name.as_str())
})
.count();
if n >= max {
if local_clones(s, &ip, &class.name, uid) >= max {
warn(s, "local clone limit");
return Some("Too many connections from your address".to_string());
}
}
if let Some(max) = class.globalmax {
if global_clones(s, &ip, uid) >= max {
warn(s, "global clone limit");
return Some("Too many global connections from your address".to_string());
}
}
if let Some(u) = s.users.get_mut(&uid) {
u.class = Some(class.name);
}
None
}
/// At registration: verify the class password (if any) and apply the class's
/// on-connect usermodes. Returns `Some(reason)` to reject.
/// At registration: re-pick the class now the host is resolved (host masks), verify
/// the class password, enforce a required client cert, and apply on-connect modes.
/// Returns `Some(reason)` to reject.
pub fn on_register(s: &mut Server, uid: Uid) -> Option<String> {
let (ip, host, secure, has_cert, port, sent) = {
let u = s.users.get(&uid)?;
(
u.addr.ip().to_string(),
u.host.clone(),
u.secure,
u.certfp.is_some(),
u.port,
u.pass.clone(),
)
};
match pick(s, uid, &ip, &host, secure, has_cert, port) {
Pick::Deny(name) => {
return Some(format!("Connection class {name} denies your address"));
}
Pick::Class(c) => {
if let Some(u) = s.users.get_mut(&uid) {
u.class = Some(c.name);
}
}
Pick::None => {} // keep whatever was assigned at connect
}
let name = s.users.get(&uid)?.class.clone()?;
let class = named(s, &name)?;
if let Some(pw) = &class.password {
let ok = s.users.get(&uid).and_then(|u| u.pass.clone());
if ok.as_deref() != Some(pw.as_str()) {
let ok = sent
.as_deref()
.map(|p| crate::modules::password_hash::verify(pw, p))
.unwrap_or(false);
if !ok {
return Some("Password mismatch for your connection class".to_string());
}
}
if class.ssl_trusted && !has_cert {
return Some("Your connection class requires a client certificate".to_string());
}
if let Some(m) = class.modes {
crate::coremods::core_mode::svs_set_user_modes(s, uid, &m);
}
None
}
// --- per-class getters consulted by the core / other modules -----------------
fn class_of(s: &Server, uid: Uid) -> Option<ConnClass> {
let name = s.users.get(&uid).and_then(|u| u.class.clone())?;
named(s, &name)
@ -132,3 +399,57 @@ pub fn reg_timeout(s: &Server, uid: Uid) -> Option<u64> {
pub fn max_chans(s: &Server, uid: Uid) -> Option<usize> {
class_of(s, uid)?.maxchans
}
pub fn recvq(s: &Server, uid: Uid) -> Option<usize> {
class_of(s, uid)?.recvq
}
pub fn hardsendq(s: &Server, uid: Uid) -> Option<usize> {
class_of(s, uid)?.hardsendq
}
pub fn softsendq(s: &Server, uid: Uid) -> Option<usize> {
class_of(s, uid)?.softsendq
}
/// Per-class flood override: `(message cap, window secs, fakelag)`. `fakelag=false`
/// means flooders are killed rather than rate-limited.
pub fn flood_over(s: &Server, uid: Uid) -> Option<(Option<usize>, Option<u64>, bool)> {
let c = class_of(s, uid)?;
Some((c.penaltythreshold, c.commandrate, c.fakelag))
}
/// Whether reverse-DNS should be resolved for this client's class (default yes).
pub fn resolve_hostnames(s: &Server, uid: Uid) -> bool {
class_of(s, uid).map(|c| c.resolvehostnames).unwrap_or(true)
}
/// `(useident, requireident)` for this client's class.
pub fn ident_policy(s: &Server, uid: Uid) -> (bool, bool) {
class_of(s, uid)
.map(|c| (c.useident, c.requireident))
.unwrap_or((false, false))
}
#[cfg(test)]
mod tests {
use super::*;
use std::net::Ipv4Addr;
#[test]
fn cidr_v4_ranges() {
let base = IpAddr::V4(Ipv4Addr::new(10, 0, 0, 0));
assert!(cidr_contains(base, 8, "10.9.9.9".parse().unwrap()));
assert!(!cidr_contains(base, 8, "11.0.0.1".parse().unwrap()));
let net = IpAddr::V4(Ipv4Addr::new(192, 168, 1, 0));
assert!(cidr_contains(net, 24, "192.168.1.200".parse().unwrap()));
assert!(!cidr_contains(net, 24, "192.168.2.1".parse().unwrap()));
// a /32 is an exact host
let host = IpAddr::V4(Ipv4Addr::new(203, 0, 113, 5));
assert!(cidr_contains(host, 32, "203.0.113.5".parse().unwrap()));
assert!(!cidr_contains(host, 32, "203.0.113.6".parse().unwrap()));
}
#[test]
fn mask_glob_and_cidr() {
assert!(mask_match("10.0.0.0/8", "10.1.2.3", ""));
assert!(!mask_match("10.0.0.0/8", "192.0.2.1", ""));
assert!(mask_match("*.example.com", "192.0.2.1", "host.example.com"));
assert!(mask_match("192.0.2.*", "192.0.2.7", ""));
assert!(!mask_match("nomatch/33", "1.2.3.4", "")); // unparseable → no match
}
}

18
src/modules/flood.rs
View file

@ -1,7 +1,10 @@
//! Per-user message-rate limit (`flood_messages` within `flood_seconds`); opers
//! exempt. Recent message times live in the user's typed
//! exempt. A connection class can override the limit (`penaltythreshold` /
//! `commandrate`) and, with `fakelag=no`, have flooders disconnected instead of
//! rate-limited. Recent message times live in the user's typed
//! [`crate::extensible::Extensible`] slot, so the state is freed when the user quits.
use crate::modules::connclass;
use crate::module::{ModResult, Module};
use crate::server::{now, Server};
use crate::Uid;
@ -32,8 +35,11 @@ impl Module for Flood {
_text: &str,
) -> ModResult {
let now = now();
let max = srv.conf_num("flood_messages", FLOOD_MAX);
let window = srv.conf_num("flood_seconds", FLOOD_WINDOW);
// a connection class may raise the limit and/or opt out of fake lag
let (cls_max, cls_window, fakelag) =
connclass::flood_over(srv, uid).unwrap_or((None, None, true));
let max = cls_max.unwrap_or_else(|| srv.conf_num("flood_messages", FLOOD_MAX));
let window = cls_window.unwrap_or_else(|| srv.conf_num("flood_seconds", FLOOD_WINDOW));
let (over, warn) = {
let Some(u) = srv.users.get_mut(&uid) else {
return ModResult::Passthru;
@ -50,6 +56,12 @@ impl Module for Flood {
(over, warn)
};
if over {
if !fakelag {
// fakelag disabled: disconnect the flooder instead of throttling
srv.send(uid, "ERROR :Closing link: (Excess flood)".to_string());
srv.mark_quit(uid, "Excess flood".to_string());
return ModResult::Deny;
}
if warn {
let nick = srv
.users

161
src/modules/ident.rs Normal file
View file

@ -0,0 +1,161 @@
//! ident — optional RFC 1413 (Ident) lookups. When a connection class (or the
//! global `useident = yes`) asks for one, we ask the client's host (port 113) who
//! owns the connection; a confirmed reply becomes the visible username without the
//! `~` that marks an unverified ident. `requireident` refuses clients whose ident
//! can't be confirmed. The lookup runs on a short-lived worker thread (like the
//! resolver) and reports back as `Event::Ident`, so the core never blocks.
use std::io::{Read, Write};
use std::net::{IpAddr, SocketAddr, TcpStream};
use std::sync::atomic::{AtomicUsize, Ordering};
use std::time::Duration;
use crate::ircd::Event;
use crate::modules::connclass;
use crate::server::Server;
use crate::users::ident_of;
use crate::Uid;
/// Default per-lookup timeout; overridable with `ident_timeout` (seconds).
const IDENT_TIMEOUT: u64 = 5;
/// Cap on concurrent lookups so a connection flood can't spawn unbounded threads.
const MAX_ACTIVE: usize = 256;
static ACTIVE: AtomicUsize = AtomicUsize::new(0);
/// Per-user lookup result stored on `User.ext`: `Some(name)` confirmed, `None` not.
struct IdentResult(Option<String>);
/// `(useident, requireident)` combining the client's class with the global default.
fn policy(s: &Server, uid: Uid) -> (bool, bool) {
let (cu, cr) = connclass::ident_policy(s, uid);
(
cu || s.conf_bool("useident", false),
cr || s.conf_bool("requireident", false),
)
}
/// Start an ident lookup for a freshly-connected client if its class (or the global
/// config) wants one. Sets `ident_pending` to hold registration until the reply
/// arrives. Returns whether a lookup was started.
pub fn dispatch(s: &mut Server, uid: Uid) -> bool {
let (useident, requireident) = policy(s, uid);
if !useident && !requireident {
return false;
}
let (ip, their_port, our_port) = match s.users.get(&uid) {
Some(u) => (u.addr.ip(), u.addr.port(), u.port),
None => return false,
};
if ACTIVE.fetch_add(1, Ordering::Relaxed) >= MAX_ACTIVE {
ACTIVE.fetch_sub(1, Ordering::Relaxed);
return false; // too many in flight: skip (treated as no ident)
}
let timeout = Duration::from_secs(s.conf_num("ident_timeout", IDENT_TIMEOUT));
if let Some(u) = s.users.get_mut(&uid) {
u.ident_pending = true;
}
s.notice_star(uid, "Checking Ident");
let tx = s.event_tx.clone();
std::thread::spawn(move || {
let ident = lookup(ip, their_port, our_port, timeout);
ACTIVE.fetch_sub(1, Ordering::Relaxed);
let _ = tx.send(Event::Ident { uid, ident });
});
true
}
/// The blocking RFC 1413 exchange: connect to `<ip>:113`, ask about the connection
/// pair, and return the confirmed username (unsanitised) or `None`.
fn lookup(ip: IpAddr, their_port: u16, our_port: u16, timeout: Duration) -> Option<String> {
let mut stream = TcpStream::connect_timeout(&SocketAddr::new(ip, 113), timeout).ok()?;
stream.set_read_timeout(Some(timeout)).ok()?;
stream.set_write_timeout(Some(timeout)).ok()?;
// the query is "<port on their side>, <port on our side>"
let query = format!("{their_port}, {our_port}\r\n");
stream.write_all(query.as_bytes()).ok()?;
let mut buf = Vec::new();
let mut chunk = [0u8; 256];
loop {
match stream.read(&mut chunk) {
Ok(0) => break,
Ok(n) => {
buf.extend_from_slice(&chunk[..n]);
if buf.len() > 512 || buf.contains(&b'\n') {
break;
}
}
Err(_) => break,
}
}
parse_reply(&String::from_utf8_lossy(&buf))
}
/// Parse an ident reply: `<port>,<port> : USERID : <opsys> : <username>`.
fn parse_reply(reply: &str) -> Option<String> {
let fields: Vec<&str> = reply.split(':').collect();
if fields.len() < 4 || !fields[1].trim().eq_ignore_ascii_case("USERID") {
return None;
}
let name = fields[3].trim();
(!name.is_empty()).then(|| name.to_string())
}
/// A lookup finished: stash the result and clear the registration hold. The result
/// is applied to the visible ident at registration (so a late USER can't clobber it).
pub fn on_result(s: &mut Server, uid: Uid, ident: Option<String>) {
match &ident {
Some(name) => s.notice_star(uid, &format!("Received Ident response: {name}")),
None => s.notice_star(uid, "No Ident response"),
}
if let Some(u) = s.users.get_mut(&uid) {
*u.ext.get_or_insert_with(|| IdentResult(None)) = IdentResult(ident);
u.ident_pending = false;
}
}
/// At registration, apply a confirmed ident (dropping the leading `~`) and enforce
/// `requireident`. Returns `Some(reason)` to reject.
pub fn finalize(s: &mut Server, uid: Uid) -> Option<String> {
let confirmed = s
.users
.get(&uid)
.and_then(|u| u.ext.get::<IdentResult>().map(|r| r.0.clone()));
if let Some(Some(name)) = confirmed {
let clean = ident_of(&name); // sanitised, no `~`
if let Some(u) = s.users.get_mut(&uid) {
u.ident = clean;
}
}
let (_, requireident) = policy(s, uid);
if requireident {
let unverified = s
.users
.get(&uid)
.map(|u| u.ident.is_empty() || u.ident.starts_with('~'))
.unwrap_or(true);
if unverified {
return Some("Your connection class requires a valid ident response".to_string());
}
}
None
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn parses_userid_and_error() {
assert_eq!(
parse_reply("6193, 6667 : USERID : UNIX : reverse\r\n").as_deref(),
Some("reverse")
);
assert_eq!(parse_reply("6193, 6667 : ERROR : NO-USER"), None);
assert_eq!(parse_reply("garbage"), None);
// case-insensitive reply type, trailing charset field tolerated
assert_eq!(
parse_reply("1,2 : userid : UNIX,US-ASCII : bob").as_deref(),
Some("bob")
);
}
}

1
src/modules/mod.rs
View file

@ -37,6 +37,7 @@ pub mod hashident;
pub mod hidelist;
pub mod hidemode;
pub mod hidewhois;
pub mod ident;
pub mod irccloudtags;
pub mod jsonlog;
pub mod jwt;

5
src/modules/rpc/server.rs
View file

@ -57,7 +57,10 @@ pub fn handle(s: &mut Server, action: &str, params: &str) -> Result<String, RpcE
}
let addr = format!("{}:{}", b.ip, b.port);
let (tx, counter) = (s.event_tx.clone(), s.conn_counter.clone());
std::thread::spawn(move || crate::socketengine::connect_link(&addr, tx, counter));
let max_line = s.conf_num("max_line", crate::socketengine::DEFAULT_MAX_LINE);
std::thread::spawn(move || {
crate::socketengine::connect_link(&addr, tx, counter, max_line)
});
s.snotice(&format!("RPC initiated a link to {}", b.name));
Ok(obj(&[("result", "true".into())]))
}