From 09a17b32be7c7f01867b93b93f19a872eb5399f7 Mon Sep 17 00:00:00 2001
From: Shivaram Lingamneni <slingamn@cs.stanford.edu>
Date: Wed, 31 Jan 2018 20:04:05 -0500
Subject: [PATCH 1/3] disallow WEBIRC after PROXY

---
 irc/gateways.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/irc/gateways.go b/irc/gateways.go
index 8942ff55..5916c4ff 100644
--- a/irc/gateways.go
+++ b/irc/gateways.go
@@ -41,7 +41,7 @@ func (wc *webircConfig) Populate() (err error) {
 // WEBIRC <password> <gateway> <hostname> <ip> [:flag1 flag2=x flag3]
 func webircHandler(server *Server, client *Client, msg ircmsg.IrcMessage) bool {
 	// only allow unregistered clients to use this command
-	if client.registered {
+	if client.registered || client.proxiedIP != "" {
 		return false
 	}
 
@@ -93,7 +93,7 @@ func webircHandler(server *Server, client *Client, msg ircmsg.IrcMessage) bool {
 // http://www.haproxy.org/download/1.8/doc/proxy-protocol.txt
 func proxyHandler(server *Server, client *Client, msg ircmsg.IrcMessage) bool {
 	// only allow unregistered clients to use this command
-	if client.registered {
+	if client.registered || client.proxiedIP != "" {
 		return false
 	}
 

From b7f66fb1de4c9f90d756813e9d2b576226ee9c3f Mon Sep 17 00:00:00 2001
From: Shivaram Lingamneni <slingamn@cs.stanford.edu>
Date: Wed, 31 Jan 2018 21:07:57 -0500
Subject: [PATCH 2/3] allow WEBIRC to set the TLS flag over local plaintext
 connections

---
 irc/gateways.go  |  8 +++++---
 irc/utils/net.go | 11 +++++++++++
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/irc/gateways.go b/irc/gateways.go
index 5916c4ff..7bc1ea45 100644
--- a/irc/gateways.go
+++ b/irc/gateways.go
@@ -58,9 +58,11 @@ func webircHandler(server *Server, client *Client, msg ircmsg.IrcMessage) bool {
 				key = x
 			}
 
-			// only accept "tls" flag if the gateway's connection to us is secure as well
-			if strings.ToLower(key) == "tls" && client.flags[TLS] {
-				secure = true
+			if strings.ToLower(key) == "tls" {
+				// only accept "tls" flag if the gateway's connection to us is secure as well
+				if client.flags[TLS] || utils.AddrIsLocal(client.socket.conn.RemoteAddr()) {
+					secure = true
+				}
 			}
 		}
 	}
diff --git a/irc/utils/net.go b/irc/utils/net.go
index e56ab8de..bad537c2 100644
--- a/irc/utils/net.go
+++ b/irc/utils/net.go
@@ -25,6 +25,17 @@ func AddrLookupHostname(addr net.Addr) string {
 	return LookupHostname(IPString(addr))
 }
 
+// AddrIsLocal returns whether the address is from a trusted local connection (loopback or unix).
+func AddrIsLocal(addr net.Addr) bool {
+	if tcpaddr, ok := addr.(*net.TCPAddr); ok {
+		return tcpaddr.IP.IsLoopback()
+	}
+	if _, ok := addr.(*net.UnixAddr); ok {
+		return true
+	}
+	return false
+}
+
 // LookupHostname returns the hostname for `addr` if it has one. Otherwise, just returns `addr`.
 func LookupHostname(addr string) string {
 	names, err := net.LookupAddr(addr)

From 2d6ddf7eb9415450e6c27be482b047e17c946026 Mon Sep 17 00:00:00 2001
From: Shivaram Lingamneni <slingamn@cs.stanford.edu>
Date: Wed, 31 Jan 2018 22:01:13 -0500
Subject: [PATCH 3/3] kiwi's gateway uses the flag `secure` instead of `tls`

---
 irc/gateways.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/irc/gateways.go b/irc/gateways.go
index 7bc1ea45..7eb84161 100644
--- a/irc/gateways.go
+++ b/irc/gateways.go
@@ -58,7 +58,8 @@ func webircHandler(server *Server, client *Client, msg ircmsg.IrcMessage) bool {
 				key = x
 			}
 
-			if strings.ToLower(key) == "tls" {
+			lkey := strings.ToLower(key)
+			if lkey == "tls" || lkey == "secure" {
 				// only accept "tls" flag if the gateway's connection to us is secure as well
 				if client.flags[TLS] || utils.AddrIsLocal(client.socket.conn.RemoteAddr()) {
 					secure = true