From 4e3989f3048c2aa6b5ea683e5b2e4bd1fbf7bd0e Mon Sep 17 00:00:00 2001
From: Bram Matthys <syzop@vulnscan.org>
Date: Sat, 3 Jan 2026 19:58:25 +0100
Subject: [PATCH] Add ban user { ....; soft yes; } as an easy way to add a
 soft-ban from the config file, without having to resort to things like mask
 %~asn:XXX; Now you can just use: ban user { 	asn { 11111; 22222; 33333;
 44444; } 	soft yes; 	reason "This ASN is not allowed. If you have
 an account you can still bypass"; }

Requested by nobody but sounds like a good idea :)
---
 src/modules/tkl.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/src/modules/tkl.c b/src/modules/tkl.c
index 6e3004f69..6cd8d8478 100644
--- a/src/modules/tkl.c
+++ b/src/modules/tkl.c
@@ -826,10 +826,16 @@ int tkl_config_test_ban(ConfigFile *cf, ConfigEntry *ce, int type, int *errs)
 				has_match = 1;
 			}
 		} else
-		if (config_is_blankorempty(cep, "ban"))
+		if (!strcmp(cep->name, "soft"))
 		{
-			errors++;
-			continue;
+			if (config_is_blankorempty(cep, "ban::soft"))
+				errors++;
+			if (strcmp(ce->value, "user"))
+			{
+				config_error("%s:%d: ban %s::soft can only be used in a ban user { } block",
+					cep->file->filename, cep->line_number, ce->value);
+				errors++;
+			}
 		} else
 		if (!strcmp(cep->name, "reason"))
 		{
@@ -974,6 +980,7 @@ int tkl_config_run_ban_user(ConfigFile *cf, ConfigEntry *ce, int configtype)
 	SecurityGroup *match = NULL;
 	char *reason = NULL;
 	int tkltype;
+	int soft = 0;
 
 	for (cep = ce->items; cep; cep = cep->next)
 	{
@@ -984,11 +991,15 @@ int tkl_config_run_ban_user(ConfigFile *cf, ConfigEntry *ce, int configtype)
 		if (!strcmp(cep->name, "reason"))
 		{
 			safe_strdup(reason, cep->value);
+		} else
+		if (!strcmp(cep->name, "soft"))
+		{
+			soft = config_checkval(cep->value, CFG_YESNO);
 		}
 	}
 
 	tkltype = TKL_KILL;
-	tkl_add_serverban(tkltype, NULL, NULL, match, reason, "-config-", 0, TStime(), 0, TKL_FLAG_CONFIG);
+	tkl_add_serverban(tkltype, NULL, NULL, match, reason, "-config-", 0, TStime(), soft, TKL_FLAG_CONFIG);
 	safe_free(reason);
 
 	return 1;