diff options
| author |  Sadie Powell | 2025-03-02 13:06:35 +0000 |
|---|---|---|
| committer | Sadie Powell | 2025-03-02 13:06:35 +0000 |
| commit | 9c151650212e2101002f04bca902ca18982697c0 (patch) | |
| tree | e4a1153b0f49b4bb24d8ce359be1bad030de86ee /src/modules/m_spanningtree/server.cpp | |
| parent | Add an opt-out to the SSL enforcement for running in a container. (diff) | |
Scope the container SSL enforcement a bit better.
Diffstat (limited to 'src/modules/m_spanningtree/server.cpp')
| -rw-r--r-- | src/modules/m_spanningtree/server.cpp | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/src/modules/m_spanningtree/server.cpp b/src/modules/m_spanningtree/server.cpp index a2c6163f9..212b2f7c3 100644 --- a/src/modules/m_spanningtree/server.cpp +++ b/src/modules/m_spanningtree/server.cpp @@ -37,10 +37,18 @@ namespace { - bool RunningInContainer() + bool IsContainerAddress(const irc::sockets::sockaddrs& sa) { std::error_code ec; - return std::filesystem::is_regular_file("/.dockerenv", ec); + if (std::filesystem::is_regular_file("/.dockerenv", ec)) + { + // We are running in docker, check for internal addresses. + if (irc::sockets::cidr_mask("172.17.0.0/16").match(sa)) + return true; // docker0 + if (irc::sockets::cidr_mask("172.18.0.0/16").match(sa)) + return true; // docker_gwbridge. + } + return false; } } @@ -150,7 +158,7 @@ std::shared_ptr<Link> TreeSocket::AuthRemote(const CommandBase::Params& params) ssliohook->GetCiphersuite(ciphersuite); ServerInstance->SNO.WriteToSnoMask('l', "Negotiated ciphersuite {} on link {}", ciphersuite, x->Name); } - else if (!capab->remotesa.is_local() && !RunningInContainer()) + else if (!capab->remotesa.is_local() && !IsContainerAddress(capab->remotesa)) { this->SendError("Non-local server connections MUST be linked with SSL!"); return nullptr; |