From 0a59f41cf9343c42308cec7c01d9adb401405973 Mon Sep 17 00:00:00 2001 From: Shivaram Lingamneni Date: Sun, 2 Jan 2022 01:51:31 -0500 Subject: [PATCH] add ip-check-script.exempt-sasl --- default.yaml | 3 +++ irc/authscript.go | 2 +- irc/config.go | 17 +++++++++++------ irc/server.go | 29 +++++++++++++++++++++++++---- traditional.yaml | 3 +++ 5 files changed, 43 insertions(+), 11 deletions(-) diff --git a/default.yaml b/default.yaml index 676f33b4..cb27c5a5 100644 --- a/default.yaml +++ b/default.yaml @@ -300,6 +300,9 @@ server: kill-timeout: 1s # how many scripts are allowed to run at once? 0 for no limit: max-concurrency: 64 + # if true, only check anonymous connections (not logged into an account) + # at the very end of the handshake: + exempt-sasl: false # IP cloaking hides users' IP addresses from other users and from channel admins # (but not from server admins), while still allowing channel admins to ban diff --git a/irc/authscript.go b/irc/authscript.go index bb5dea95..8299afe1 100644 --- a/irc/authscript.go +++ b/irc/authscript.go @@ -84,7 +84,7 @@ type IPScriptOutput struct { Error string `json:"error"` } -func CheckIPBan(sem utils.Semaphore, config ScriptConfig, addr net.IP) (output IPScriptOutput, err error) { +func CheckIPBan(sem utils.Semaphore, config IPCheckScriptConfig, addr net.IP) (output IPScriptOutput, err error) { if sem != nil { sem.Acquire() defer sem.Release() diff --git a/irc/config.go b/irc/config.go index 68019179..3c26577a 100644 --- a/irc/config.go +++ b/irc/config.go @@ -348,6 +348,11 @@ type AuthScriptConfig struct { Autocreate bool } +type IPCheckScriptConfig struct { + ScriptConfig `yaml:",inline"` + ExemptSASL bool `yaml:"exempt-sasl"` +} + // AccountRegistrationConfig controls account registration. type AccountRegistrationConfig struct { Enabled bool @@ -587,12 +592,12 @@ type Config struct { supportedCapsWithoutSTS *caps.Set capValues caps.Values Casemapping Casemapping - EnforceUtf8 bool `yaml:"enforce-utf8"` - OutputPath string `yaml:"output-path"` - IPCheckScript ScriptConfig `yaml:"ip-check-script"` - OverrideServicesHostname string `yaml:"override-services-hostname"` - MaxLineLen int `yaml:"max-line-len"` - SuppressLusers bool `yaml:"suppress-lusers"` + EnforceUtf8 bool `yaml:"enforce-utf8"` + OutputPath string `yaml:"output-path"` + IPCheckScript IPCheckScriptConfig `yaml:"ip-check-script"` + OverrideServicesHostname string `yaml:"override-services-hostname"` + MaxLineLen int `yaml:"max-line-len"` + SuppressLusers bool `yaml:"suppress-lusers"` } Roleplay struct { diff --git a/irc/server.go b/irc/server.go index 270a361c..58b8641c 100644 --- a/irc/server.go +++ b/irc/server.go @@ -200,7 +200,7 @@ func (server *Server) checkBans(config *Config, ipaddr net.IP, checkScripts bool server.logger.Warning("internal", "unexpected ban result", err.Error()) } - if checkScripts && config.Server.IPCheckScript.Enabled { + if checkScripts && config.Server.IPCheckScript.Enabled && !config.Server.IPCheckScript.ExemptSASL { output, err := CheckIPBan(server.semaphores.IPCheckScript, config.Server.IPCheckScript, ipaddr) if err != nil { server.logger.Error("internal", "couldn't check IP ban script", ipaddr.String(), err.Error()) @@ -267,9 +267,26 @@ func (server *Server) handleAlwaysOnExpirations() { } } -// -// server functionality -// +// handles server.ip-check-script.exempt-sasl: +// run the ip check script at the end of the handshake, only for anonymous connections +func (server *Server) checkBanScriptExemptSASL(config *Config, session *Session) (outcome AuthOutcome) { + // TODO add caching for this; see related code in (*server).checkBans; + // we should probably just put an LRU around this instead of using the DLINE system + ipaddr := session.IP() + output, err := CheckIPBan(server.semaphores.IPCheckScript, config.Server.IPCheckScript, ipaddr) + if err != nil { + server.logger.Error("internal", "couldn't check IP ban script", ipaddr.String(), err.Error()) + return authSuccess + } + if output.Result == IPBanned || output.Result == IPRequireSASL { + server.logger.Info("connect-ip", "Rejecting unauthenticated client due to ip-check-script", ipaddr.String()) + if output.BanMessage != "" { + session.client.requireSASLMessage = output.BanMessage + } + return authFailSaslRequired + } + return authSuccess +} func (server *Server) tryRegister(c *Client, session *Session) (exiting bool) { // XXX PROXY or WEBIRC MUST be sent as the first line of the session; @@ -294,6 +311,10 @@ func (server *Server) tryRegister(c *Client, session *Session) (exiting bool) { // before completing the other registration commands config := server.Config() authOutcome := c.isAuthorized(server, config, session, c.requireSASL) + if authOutcome == authSuccess && c.account == "" && + config.Server.IPCheckScript.Enabled && config.Server.IPCheckScript.ExemptSASL { + authOutcome = server.checkBanScriptExemptSASL(config, session) + } var quitMessage string switch authOutcome { case authFailPass: diff --git a/traditional.yaml b/traditional.yaml index ca3bbc88..d67da8ad 100644 --- a/traditional.yaml +++ b/traditional.yaml @@ -274,6 +274,9 @@ server: kill-timeout: 1s # how many scripts are allowed to run at once? 0 for no limit: max-concurrency: 64 + # if true, only check anonymous connections (not logged into an account) + # at the very end of the handshake: + exempt-sasl: false # IP cloaking hides users' IP addresses from other users and from channel admins # (but not from server admins), while still allowing channel admins to ban