mirror of
https://github.com/unrealircd/unrealircd.git
synced 2026-06-29 23:56:38 +02:00
Bram Matthys
4f3e524602
This to replace the scattered IP setting. It is very important to always use set_client_ip() from this point. Everywhere! Also, in addition to client->ip, this adds client->rawip that contains the IP in network byte order. In older UnrealIRCd versions we always had the raw IP but not the IP as a string, so we moved to IP as a string, but it can be useful to have both in terms of optimizations. Of course, then the client->ip and client->rawip always need to 100% match, hence the set_client_ip(). This also changes IsIPV6() to do A BUGFIX, it changes it from: * if local user is the user connected over IPv6? Otherwise, does it have ':' in the IP? To: * check if the IPv6 flag is set (which is set if IP contains ':') This may seem insignificant but it means that for spoofed IP addresses, such as WEBIRC or transparant proxy, we use the correct transport. Previously, if the proxy was IPv6 then even if the spoofed user was using IPv4, the ident check would still be tried over IPv6. That sort of fun. From now in, in such a situation client->local->socket_type will be SOCKET_TYPE_IPV6 but since client->ip (and rawip) will contain IPv4 the IsIPV6() will actually return false, as it should be. Also, in the HOOKTYPE_IP_CHANGE, enforce that if HOOK_DENY is returned, the the user is killed by dead_link(). The user must be killed because that is what we expect, and you cannot use exit_client() because from some code paths that would be too much freed structures / hassle, as a comment in src/modules/connect-flood.c correctly states: /* There are two reasons why we can't use exit_client() here: * 1) Because the HOOKTYPE_IP_CHANGE call may be too deep. * Eg: read_packet -> webserver_packet_in -> * webserver_handle_request_header -> webserver_handle_request -> * RunHook().... and then returning without touching anything * after an exit_client() would not be feasible. * 2) Because in HOOKTYPE_ACCEPT we always need to use dead_socket * if we want to print a friendly message to TLS users. */