From 56aabd8b6ce3ba8361cacec70ac498f3ee59d40f Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Mon, 24 Oct 2022 20:12:00 +0100
Subject: Allow using sts over a proxied hook like HAProxy.

Closes #1911.
---
 src/modules/m_ircv3_sts.cpp | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

(limited to 'src/modules/m_ircv3_sts.cpp')

diff --git a/src/modules/m_ircv3_sts.cpp b/src/modules/m_ircv3_sts.cpp
index 801d87082..f7f03d7fa 100644
--- a/src/modules/m_ircv3_sts.cpp
+++ b/src/modules/m_ircv3_sts.cpp
@@ -28,6 +28,7 @@ class STSCap : public Cap::Capability
 	std::string host;
 	std::string plaintextpolicy;
 	std::string securepolicy;
+	mutable UserCertificateAPI sslapi;
 
 	bool OnList(LocalUser* user) CXX11_OVERRIDE
 	{
@@ -64,12 +65,19 @@ class STSCap : public Cap::Capability
 
 	const std::string* GetValue(LocalUser* user) const CXX11_OVERRIDE
 	{
-		return SSLIOHook::IsSSL(&user->eh) ? &securepolicy : &plaintextpolicy;
+		if (SSLIOHook::IsSSL(&user->eh))
+			return &securepolicy; // Normal SSL connection.
+
+		if (sslapi && sslapi->GetCertificate(user))
+			return &securepolicy; // Proxied SSL connection.
+
+		return &plaintextpolicy; // Plain text connection.
 	}
 
  public:
 	STSCap(Module* mod)
 		: Cap::Capability(mod, "sts")
+		, sslapi(mod)
 	{
 		DisableAutoRegister();
 	}
@@ -136,6 +144,10 @@ class ModuleIRCv3STS : public Module
 		{
 			ListenSocket* ls = *iter;
 
+			// Is this listener marked as providing SSL over HAProxy?
+			if (!ls->bind_tag->getString("hook").empty() && ls->bind_tag->getBool("sslhook"))
+				return true;
+
 			// Is this listener on the right port?
 			unsigned int saport = ls->bind_sa.port();
 			if (saport != port)
-- 
cgit v1.3.1-10-gc9f91