From 6a12f06cfeff8a99f22d05ea25fe37c603574922 Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Fri, 15 Aug 2025 11:53:19 +0100
Subject: Add an undocumented option for specifying the local ranges.

---
 src/modules/m_spanningtree/server.cpp | 16 ++++++++--------
 src/modules/m_spanningtree/utils.cpp  |  9 +++++++++
 src/modules/m_spanningtree/utils.h    |  3 +++
 3 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/src/modules/m_spanningtree/server.cpp b/src/modules/m_spanningtree/server.cpp
index 8a309eeb3..70f50b42e 100644
--- a/src/modules/m_spanningtree/server.cpp
+++ b/src/modules/m_spanningtree/server.cpp
@@ -37,15 +37,15 @@
 
 namespace
 {
-	bool RunningInContainer()
+	bool IsLocalRange(const irc::sockets::sockaddrs& sa)
 	{
-		std::error_code ec;
-		if (std::filesystem::is_regular_file("/.dockerenv", ec))
+		if (sa.is_local())
+			return true; // Always allowed.
+
+		for (const auto& cidr : Utils->LocalRanges)
 		{
-			// We are running inside of Docker so all IP addresses are
-			// non-local and as far as I can see there isn't a way to
-			// reliably detect the Docker network.
-			return true;
+			if (cidr.match(sa))
+				return true; // Explicitly allowed range.
 		}
 		return false;
 	}
@@ -157,7 +157,7 @@ std::shared_ptr<Link> TreeSocket::AuthRemote(const CommandBase::Params& params)
 			ssliohook->GetCiphersuite(ciphersuite);
 			ServerInstance->SNO.WriteToSnoMask('l', "Negotiated ciphersuite {} on link {}", ciphersuite, x->Name);
 		}
-		else if (!capab->remotesa.is_local() && !RunningInContainer())
+		else if (!IsLocalRange(capab->remotesa))
 		{
 			this->SendError("Non-local server connections MUST be linked with SSL!");
 			return nullptr;
diff --git a/src/modules/m_spanningtree/utils.cpp b/src/modules/m_spanningtree/utils.cpp
index 601c45095..57a797405 100644
--- a/src/modules/m_spanningtree/utils.cpp
+++ b/src/modules/m_spanningtree/utils.cpp
@@ -247,6 +247,15 @@ void SpanningTreeUtilities::ReadConfiguration()
 	HideServices = security->getBool("hideservices", security->getBool("hideulines"));
 	HideSplits = security->getBool("hidesplits");
 
+	LocalRanges.clear();
+	irc::spacesepstream localrangestream(security->getString("localranges"));
+	for (std::string localrange; localrangestream.GetToken(localrange); )
+	{
+		irc::sockets::cidr_mask cidr(localrange);
+		if (cidr.length)
+			LocalRanges.push_back(cidr);
+	}
+
 	const auto& performance = ServerInstance->Config->ConfValue("performance");
 	quiet_bursts = performance->getBool("quietbursts");
 
diff --git a/src/modules/m_spanningtree/utils.h b/src/modules/m_spanningtree/utils.h
index c5e0b5c9e..f6ded5bf7 100644
--- a/src/modules/m_spanningtree/utils.h
+++ b/src/modules/m_spanningtree/utils.h
@@ -107,6 +107,9 @@ public:
 	/** Holds the data from the <autoconnect> tags in the conf
 	 */
 	std::vector<std::shared_ptr<Autoconnect>> AutoconnectBlocks;
+	/** Holds the ranges which are considered local.
+	 */
+	std::vector<irc::sockets::cidr_mask> LocalRanges;
 
 	/** Ping frequency of server to server links
 	 */
-- 
cgit v1.3.1-10-gc9f91