3
0
mirror of https://github.com/ergochat/ergo.git synced 2024-12-29 14:12:38 +01:00
ergo/irc/gateways.go

118 lines
3.4 KiB
Go
Raw Normal View History

2017-10-15 08:18:14 +02:00
// Copyright (c) 2012-2014 Jeremy Latt
// Copyright (c) 2014-2015 Edmund Huber
// Copyright (c) 2017 Daniel Oaks <daniel@danieloaks.net>
// released under the MIT license
package irc
import (
"errors"
2017-10-15 08:18:14 +02:00
"fmt"
"net"
"strings"
2017-10-15 08:18:14 +02:00
"github.com/oragono/oragono/irc/modes"
2017-10-15 08:18:14 +02:00
"github.com/oragono/oragono/irc/utils"
)
var (
errBadGatewayAddress = errors.New("PROXY/WEBIRC commands are not accepted from this IP address")
errBadProxyLine = errors.New("Invalid PROXY/WEBIRC command")
)
2017-10-15 08:18:14 +02:00
type webircConfig struct {
PasswordString string `yaml:"password"`
Password []byte `yaml:"password-bytes"`
Fingerprint string
Hosts []string
2019-02-05 06:19:03 +01:00
allowedNets []net.IPNet
2017-10-15 08:18:14 +02:00
}
// Populate fills out our password or fingerprint.
func (wc *webircConfig) Populate() (err error) {
if wc.Fingerprint == "" && wc.PasswordString == "" {
2018-02-03 13:03:36 +01:00
return ErrNoFingerprintOrPassword
}
if wc.PasswordString != "" {
wc.Password, err = decodeLegacyPasswordHash(wc.PasswordString)
}
2018-02-01 21:53:49 +01:00
2019-02-05 06:19:03 +01:00
if err == nil {
wc.allowedNets, err = utils.ParseNetList(wc.Hosts)
2018-02-01 21:53:49 +01:00
}
2019-02-05 06:19:03 +01:00
return err
2018-02-01 21:53:49 +01:00
}
2017-10-15 08:18:14 +02:00
// ApplyProxiedIP applies the given IP to the client.
func (client *Client) ApplyProxiedIP(session *Session, proxiedIP string, tls bool) (err error, quitMsg string) {
2019-02-26 03:50:43 +01:00
// PROXY and WEBIRC are never accepted from a Tor listener, even if the address itself
// is whitelisted:
if client.isTor {
return errBadProxyLine, ""
2019-02-26 03:50:43 +01:00
}
2017-10-15 08:18:14 +02:00
// ensure IP is sane
2019-02-05 06:19:03 +01:00
parsedProxiedIP := net.ParseIP(proxiedIP).To16()
2017-10-15 08:18:14 +02:00
if parsedProxiedIP == nil {
return errBadProxyLine, fmt.Sprintf(client.t("Proxied IP address is not valid: [%s]"), proxiedIP)
}
2017-10-15 08:18:14 +02:00
isBanned, banMsg := client.server.checkBans(parsedProxiedIP)
if isBanned {
return errBanned, banMsg
2017-10-15 08:18:14 +02:00
}
// given IP is sane! override the client's current IP
2019-02-05 19:44:33 +01:00
ipstring := parsedProxiedIP.String()
client.server.logger.Info("localconnect-ip", "Accepted proxy IP for client", ipstring)
rawHostname := utils.LookupHostname(ipstring)
2019-05-12 08:17:57 +02:00
cloakedHostname := client.server.Config().Server.Cloaks.ComputeCloak(parsedProxiedIP)
2019-02-05 19:44:33 +01:00
2018-04-23 08:38:35 +02:00
client.stateMutex.Lock()
2019-02-05 19:44:33 +01:00
defer client.stateMutex.Unlock()
session.proxiedIP = parsedProxiedIP
2018-02-01 21:53:49 +01:00
client.proxiedIP = parsedProxiedIP
session.rawHostname = rawHostname
2018-04-23 08:38:35 +02:00
client.rawHostname = rawHostname
2019-05-12 08:17:57 +02:00
client.cloakedHostname = cloakedHostname
2018-04-23 08:38:35 +02:00
// nickmask will be updated when the client completes registration
// set tls info
client.certfp = ""
2018-04-23 00:47:10 +02:00
client.SetMode(modes.TLS, tls)
return nil, ""
}
// handle the PROXY command: http://www.haproxy.org/download/1.8/doc/proxy-protocol.txt
// PROXY must be sent as the first message in the session and has the syntax:
// PROXY TCP[46] SOURCEIP DESTIP SOURCEPORT DESTPORT\r\n
// unfortunately, an ipv6 SOURCEIP can start with a double colon; in this case,
// the message is invalid IRC and can't be parsed normally, hence the special handling.
func handleProxyCommand(server *Server, client *Client, session *Session, line string) (err error) {
var quitMsg string
defer func() {
if err != nil {
if quitMsg == "" {
quitMsg = client.t("Bad or unauthorized PROXY command")
}
client.Quit(quitMsg, session)
}
}()
params := strings.Fields(line)
if len(params) != 6 {
return errBadProxyLine
}
2019-02-05 06:19:03 +01:00
if utils.IPInNets(client.realIP, server.Config().Server.proxyAllowedFromNets) {
// assume PROXY connections are always secure
err, quitMsg = client.ApplyProxiedIP(session, params[2], true)
return
} else {
// real source IP is not authorized to issue PROXY:
return errBadGatewayAddress
}
2017-10-15 08:18:14 +02:00
}