The bounce listener binds to the IRC socket's local address. With the
inttest unix sockets that is "localhost" on Linux, which Csocket
resolves to ::1, so connecting to 127.0.0.1 never reached it.
The Allow list was only checked in CZNC::AuthUser() after the core
password check, so logins accepted by imapauth, cyrusauth or certauth
(including SASL EXTERNAL) ignored it. Check it in CAuthBase::AcceptLogin()
and CClient::AcceptSASLLogin() instead.
When the DCC request came from IRC, ZNC connects out to the remote peer
and the thing connecting to the bounce listener should be one of the
user's clients. In GetSockObj, compare the connecting address with the
remote IP of each currently connected client and refuse anyone else,
closing the accepted socket straight away while leaving the listener up
for the real client. The user-originated path is unchanged, since there
it is the remote IRC peer that is expected to connect.
The address in an incoming DCC CHAT/SEND is chosen by the remote IRC
user, and ZNC is the side that connects to it, relaying traffic to
whoever connects to the bounce listener. Refuse requests that point at
0/8, 127/8, 169.254/16, 224/3 or values above 32 bits (which
CUtils::GetIP would otherwise mask down to one of those).
Alhuda Khan