From 3b35acae687936a6101f2580201749d3255f5d45 Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Thu, 17 Apr 2025 16:18:10 +0100
Subject: Fix enforcing use of the PSL database in link data.

The link data not being enforced is unfortunately a bug but we
can't do anything about it in v4 because it would break link
compatibility.
---
 docs/conf/modules.example.conf | 3 ++-
 src/modules/m_cloak_sha256.cpp | 8 ++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/docs/conf/modules.example.conf b/docs/conf/modules.example.conf
index d3f4a03fe..6ddeac237 100644
--- a/docs/conf/modules.example.conf
+++ b/docs/conf/modules.example.conf
@@ -540,7 +540,8 @@
 #       case="lower"
 #       hostparts="3"
 #       pathparts="1"
-#       psl="system">
+#       psl="system"
+#       enforcepsl="yes">
 #
 #<cloak method="hmac-sha256-addr"
 #       key="changeme"
diff --git a/src/modules/m_cloak_sha256.cpp b/src/modules/m_cloak_sha256.cpp
index ecfff323f..eb278f59b 100644
--- a/src/modules/m_cloak_sha256.cpp
+++ b/src/modules/m_cloak_sha256.cpp
@@ -73,6 +73,9 @@ private:
 	const std::string prefix;
 
 #ifdef HAS_LIBPSL
+	// Whether to enforce the use of the Public Suffix List in link data.
+	bool enforcepsl;
+
 	// Handle to the Public Suffix List library.
 	psl_ctx_t* psl;
 #endif
@@ -201,6 +204,7 @@ public:
 		, prefix(tag->getString("prefix"))
 #ifdef HAS_LIBPSL
 		, psl(p)
+		, enforcepsl(p ? tag->getBool("enforcepsl") : false)
 #endif
 		, sha256(engine->creator, "hash/sha256")
 		, suffix(tag->getString("suffix", "ip"))
@@ -267,8 +271,8 @@ public:
 		data["cloak-host"] = sha256 ? Generate("extremely.long.inspircd.cloak.example") : broken;
 		data["host-parts"] = ConvToStr(hostparts);
 
-#ifdef HAS_PSL
-		data["using-psl"] = psl ? "yes" : "no";
+#ifdef HAS_LIBPSL
+		data["using-psl"] = enforcepsl ? "yes" : "no";
 #else
 		data["using-psl"] = "no";
 #endif
-- 
cgit v1.3.1-10-gc9f91