CEF/ergo
1
0
Fork 0
forked from External/ergo
Code Pull requests Activity

fix #774

Browse source 
Don't advertise sasl=EXTERNAL to clients who aren't connected over native TLS,
since even if they have TLS configured locally and they enable a client
certificate, that information will be discarded by the reverse proxy.
This commit is contained in:
Shivaram Lingamneni 2022-05-06 13:09:09 -04:00
parent a13235880c
commit 05eaf3a0d8
3 changed files with 19 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
irc/config.go
View file

@ -591,6 +591,7 @@ type Config struct {
supportedCaps *caps.Set
supportedCapsWithoutSTS *caps.Set
capValues caps.Values
capValuesNoExternal caps.Values
Casemapping Casemapping
EnforceUtf8 bool `yaml:"enforce-utf8"`
OutputPath string `yaml:"output-path"`
@ -1388,7 +1389,7 @@ func LoadConfig(filename string) (config *Config, err error) {
config.Accounts.VHosts.validRegexp = defaultValidVhostRegex
}
saslCapValue := "PLAIN,EXTERNAL,SCRAM-SHA-256"
saslCapValue := "PLAIN,SCRAM-SHA-256,EXTERNAL"
// TODO(#1782) clean this up:
if !config.Accounts.AdvertiseSCRAM {
saslCapValue = "PLAIN,EXTERNAL"
@ -1544,6 +1545,9 @@ func LoadConfig(filename string) (config *Config, err error) {
config.Server.supportedCapsWithoutSTS.Union(config.Server.supportedCaps)
config.Server.supportedCapsWithoutSTS.Disable(caps.STS)
config.Server.capValuesNoExternal = utils.CopyMap(config.Server.capValues)
config.Server.capValuesNoExternal[caps.SASL] = strings.TrimSuffix(saslCapValue, ",EXTERNAL")
return config, nil
}