put an upper limit on registration messages

Fixes #505

irc/client.go

@@ -111,6 +111,8 @@ type Session struct {
 	capState     caps.State
 	capVersion   caps.Version
 
+	registrationMessages int
+
 	resumeID         string
 	resumeDetails    *ResumeDetails
 	zncPlaybackTimes *zncPlaybackTimes
@@ -396,6 +398,15 @@ func (client *Client) run(session *Session) {
 			}
 		}
 
+		// DoS hardening, #505
+		if !client.registered {
+			session.registrationMessages++
+			if client.server.Config().Limits.RegistrationMessages < session.registrationMessages {
+				client.Send(nil, client.server.name, ERR_UNKNOWNERROR, "*", client.t("You have sent too many registration messages"))
+				break
+			}
+		}
+
 		msg, err := ircmsg.ParseLineStrict(line, true, maxlenRest)
 		if err == ircmsg.ErrorLineIsEmpty {
 			continue