X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=src%2Fmodules%2Fm_websocket.cpp;h=05a9ce2e82952e1ef2682db31a23406cb4ff2b72;hb=dcafba95960685120b1f6d902de623ca10ed6135;hp=79cabf4e58957bc01359087a8579207453c0ab87;hpb=bb1f892f68cb70537b224bca85cc40f1ed23017d;p=user%2Fhenk%2Fcode%2Finspircd.git

diff --git a/src/modules/m_websocket.cpp b/src/modules/m_websocket.cpp
index 79cabf4e5..05a9ce2e8 100644
--- a/src/modules/m_websocket.cpp
+++ b/src/modules/m_websocket.cpp
@@ -1,7 +1,9 @@
 /*
  * InspIRCd -- Internet Relay Chat Daemon
  *
- *   Copyright (C) 2016 Attila Molnar <attilamolnar@hush.com>
+ *   Copyright (C) 2019 iwalkalone <iwalkalone69@gmail.com>
+ *   Copyright (C) 2017-2020 Sadie Powell <sadie@witchery.services>
+ *   Copyright (C) 2016-2017 Attila Molnar <attilamolnar@hush.com>
  *
  * This file is part of InspIRCd.  InspIRCd is free software: you can
  * redistribute it and/or modify it under the terms of the GNU General Public
@@ -25,19 +27,20 @@
 
 #include <utf8.h>
 
-typedef std::vector<std::string> OriginList;
-
 static const char MagicGUID[] = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
 static const char whitespace[] = " \t\r\n";
 static dynamic_reference_nocheck<HashProvider>* sha1;
 
 struct WebSocketConfig
 {
+	typedef std::vector<std::string> OriginList;
+	typedef std::vector<std::string> ProxyRanges;
+
 	// The HTTP origins that can connect to the server.
 	OriginList allowedorigins;
 
-	// Whether to trust the X-Real-IP or X-Forwarded-For headers.
-	bool behindproxy;
+	// The IP ranges which send trustworthy X-Real-IP or X-Forwarded-For headers.
+	ProxyRanges proxyranges;
 
 	// Whether to send as UTF-8 text instead of binary data.
 	bool sendastext;
@@ -327,7 +330,7 @@ class WebSocketHook : public IOHookMiddle
 		if (originheader.Find(recvq, "Origin:", 7, reqend))
 		{
 			const std::string origin = originheader.ExtractValue(recvq);
-			for (OriginList::const_iterator iter = config.allowedorigins.begin(); iter != config.allowedorigins.end(); ++iter)
+			for (WebSocketConfig::OriginList::const_iterator iter = config.allowedorigins.begin(); iter != config.allowedorigins.end(); ++iter)
 			{
 				if (InspIRCd::Match(origin, *iter, ascii_case_insensitive_map))
 				{
@@ -343,7 +346,7 @@ class WebSocketHook : public IOHookMiddle
 			return -1;
 		}
 
-		if (config.behindproxy && sock->type == StreamSocket::SS_USER)
+		if (!config.proxyranges.empty() && sock->type == StreamSocket::SS_USER)
 		{
 			LocalUser* luser = static_cast<UserIOHandler*>(sock)->user;
 			irc::sockets::sockaddrs realsa(luser->client_sa);
@@ -360,9 +363,20 @@ class WebSocketHook : public IOHookMiddle
 				// Nothing to do here.
 			}
 
-			// Give the user their real IP address.
-			if (realsa != luser->client_sa)
-				luser->SetClientIP(realsa);
+			for (WebSocketConfig::ProxyRanges::const_iterator iter = config.proxyranges.begin(); iter != config.proxyranges.end(); ++iter)
+			{
+				if (InspIRCd::MatchCIDR(luser->GetIPString(), *iter, ascii_case_insensitive_map))
+				{
+					// Give the user their real IP address.
+					if (realsa != luser->client_sa)
+						luser->SetClientIP(realsa);
+
+					// Error if changing their IP gets them banned.
+					if (luser->quitting)
+						return -1;
+					break;
+				}
+			}
 		}
 
 
@@ -518,9 +532,12 @@ class ModuleWebSocket : public Module
 		}
 
 		ConfigTag* tag = ServerInstance->Config->ConfValue("websocket");
-		config.behindproxy = tag->getBool("behindproxy");
 		config.sendastext = tag->getBool("sendastext", true);
 
+		irc::spacesepstream proxyranges(tag->getString("proxyranges"));
+		for (std::string proxyrange; proxyranges.GetToken(proxyrange); )
+			config.proxyranges.push_back(proxyrange);
+
 		// Everything is okay; apply the new config.
 		hookprov->config = config;
 	}
@@ -537,7 +554,7 @@ class ModuleWebSocket : public Module
 
 	Version GetVersion() CXX11_OVERRIDE
 	{
-		return Version("Provides RFC 6455 WebSocket support", VF_VENDOR);
+		return Version("Allows WebSocket clients to connect to the IRC server.", VF_VENDOR);
 	}
 };