jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-11-05 09:33:25 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

[Servatrice] Match trusted_sources by address, not substring (#7582)

Browse source 
trusted_sources was checked with QString::contains. A dual-stack listener
reports a local proxy as ::ffff:127.0.0.1, which never matches the default
"127.0.0.1,::1". Behind nginx the forwarded client IP header was then
ignored, every websocket user shared the proxy's address, and logins
failed with "too many concurrent connections" once max_users_per_address
was reached.

Add isTrustedSource(), which parses each entry as a QHostAddress and
compares exact addresses with IPv4-mapped addresses normalized, and use it
at all four call sites. The ban command also read server/trusted_sources
instead of the documented security/trusted_sources; it now uses the same
getter. Entries that are not IP addresses are logged at startup since they
no longer match anything.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Zach H 2026-10-18 16:50:04 -04:00 • committed by GitHub
parent 4343544588
commit 46cdbac830
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
9 changed files with 136 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

10
servatrice/src/serversocketinterface.cpp
View file

@ -42,6 +42,7 @@
#include "server_logger.h"
#include "server_protocolhandler.h"
#include "settingscache.h"
#include "trusted_sources.h"
#include "version_string.h"
#include <QChar>
@ -220,8 +221,7 @@ bool AbstractServerSocketInterface::initSession()
delete identSe;
// allow unlimited number of connections from the trusted sources
QString trustedSources = settingsCache->value("security/trusted_sources", "127.0.0.1,::1").toString();
if (trustedSources.contains(getAddress(), Qt::CaseInsensitive)) {
if (isTrustedSource(servatrice->getTrustedSources(), getPeerAddress())) {
return true;
}
@ -1908,9 +1908,8 @@ Response::ResponseCode AbstractServerSocketInterface::cmdBanFromServer(const Com
if (amountRemove != 0) {
removeSaidMessages(userName, amountRemove);
}
QString trustedSources = settingsCache->value("server/trusted_sources", "127.0.0.1,::1").toString();
int minutes = cmd.minutes();
if (trustedSources.contains(address, Qt::CaseInsensitive)) {
if (isTrustedSource(servatrice->getTrustedSources(), address)) {
address = "";
}
@ -4560,8 +4559,7 @@ void WebsocketServerSocketInterface::initConnection(void *_socket)
if (websocketIPHeader.length() > 0 && socket->request().hasRawHeader(websocketIPHeader)) {
// Only trust the forwarded header if the connection itself comes from a trusted proxy,
// otherwise a client could spoof its address to bypass bans and rate limits.
QString trustedSources = settingsCache->value("security/trusted_sources", "127.0.0.1,::1").toString();
if (trustedSources.contains(socket->peerAddress().toString(), Qt::CaseInsensitive)) {
if (isTrustedSource(servatrice->getTrustedSources(), socket->peerAddress())) {
QString header(socket->request().rawHeader(websocketIPHeader));
QHostAddress parsed(header);
if (!parsed.isNull()) {