From bcf484016b17354c21e664901394bfc8dc79ea53 Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Sun, 23 Oct 2022 15:01:35 +0100
Subject: Only store the topic in the permchannels database if one is set.

---
 src/modules/m_permchannels.cpp | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

(limited to 'src')

diff --git a/src/modules/m_permchannels.cpp b/src/modules/m_permchannels.cpp
index bec10de0b..fdfbfecc4 100644
--- a/src/modules/m_permchannels.cpp
+++ b/src/modules/m_permchannels.cpp
@@ -142,11 +142,15 @@ static bool WriteDatabase(PermChannel& permchanmode, Module* mod, bool save_list
 		}
 
 		stream << "<permchannels channel=\"" << ServerConfig::Escape(chan->name)
-			<< "\" ts=\"" << chan->age
-			<< "\" topic=\"" << ServerConfig::Escape(chan->topic)
-			<< "\" topicts=\"" << chan->topicset
-			<< "\" topicsetby=\"" << ServerConfig::Escape(chan->setby)
-			<< "\" modes=\"" << ServerConfig::Escape(chanmodes)
+			<< "\" ts=\"" << chan->age;
+		if (!chan->topic.empty())
+		{
+			// Only store the topic if one is set.
+			stream << "\" topic=\"" << ServerConfig::Escape(chan->topic)
+				<< "\" topicts=\"" << chan->topicset
+				<< "\" topicsetby=\"" << ServerConfig::Escape(chan->setby);
+		}
+		stream << "\" modes=\"" << ServerConfig::Escape(chanmodes)
 			<< "\">" << std::endl;
 	}
 
-- 
cgit v1.3.1-10-gc9f91


From 56aabd8b6ce3ba8361cacec70ac498f3ee59d40f Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Mon, 24 Oct 2022 20:12:00 +0100
Subject: Allow using sts over a proxied hook like HAProxy.

Closes #1911.
---
 src/modules/m_ircv3_sts.cpp | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/modules/m_ircv3_sts.cpp b/src/modules/m_ircv3_sts.cpp
index 801d87082..f7f03d7fa 100644
--- a/src/modules/m_ircv3_sts.cpp
+++ b/src/modules/m_ircv3_sts.cpp
@@ -28,6 +28,7 @@ class STSCap : public Cap::Capability
 	std::string host;
 	std::string plaintextpolicy;
 	std::string securepolicy;
+	mutable UserCertificateAPI sslapi;
 
 	bool OnList(LocalUser* user) CXX11_OVERRIDE
 	{
@@ -64,12 +65,19 @@ class STSCap : public Cap::Capability
 
 	const std::string* GetValue(LocalUser* user) const CXX11_OVERRIDE
 	{
-		return SSLIOHook::IsSSL(&user->eh) ? &securepolicy : &plaintextpolicy;
+		if (SSLIOHook::IsSSL(&user->eh))
+			return &securepolicy; // Normal SSL connection.
+
+		if (sslapi && sslapi->GetCertificate(user))
+			return &securepolicy; // Proxied SSL connection.
+
+		return &plaintextpolicy; // Plain text connection.
 	}
 
  public:
 	STSCap(Module* mod)
 		: Cap::Capability(mod, "sts")
+		, sslapi(mod)
 	{
 		DisableAutoRegister();
 	}
@@ -136,6 +144,10 @@ class ModuleIRCv3STS : public Module
 		{
 			ListenSocket* ls = *iter;
 
+			// Is this listener marked as providing SSL over HAProxy?
+			if (!ls->bind_tag->getString("hook").empty() && ls->bind_tag->getBool("sslhook"))
+				return true;
+
 			// Is this listener on the right port?
 			unsigned int saport = ls->bind_sa.port();
 			if (saport != port)
-- 
cgit v1.3.1-10-gc9f91