The bounce listener binds to the IRC socket's local address. With the
inttest unix sockets that is "localhost" on Linux, which Csocket
resolves to ::1, so connecting to 127.0.0.1 never reached it.
The Allow list was only checked in CZNC::AuthUser() after the core
password check, so logins accepted by imapauth, cyrusauth or certauth
(including SASL EXTERNAL) ignored it. Check it in CAuthBase::AcceptLogin()
and CClient::AcceptSASLLogin() instead.
When the DCC request came from IRC, ZNC connects out to the remote peer
and the thing connecting to the bounce listener should be one of the
user's clients. In GetSockObj, compare the connecting address with the
remote IP of each currently connected client and refuse anyone else,
closing the accepted socket straight away while leaving the listener up
for the real client. The user-originated path is unchanged, since there
it is the remote IRC peer that is expected to connect.
The address in an incoming DCC CHAT/SEND is chosen by the remote IRC
user, and ZNC is the side that connects to it, relaying traffic to
whoever connects to the bounce listener. Refuse requests that point at
0/8, 127/8, 169.254/16, 224/3 or values above 32 bits (which
CUtils::GetIP would otherwise mask down to one of those).
Fixed 'pass' command to save password in CBlowfish(MD5(...)) instead of plaintext.
Fixed 'away' command not updating with a new away message if already away.
Fixed default timer in SetArgsHelpText to match SetAwayTime().
Fixed broken 'Messages' command.
Fixed 'replay' command with IPv6
Fixes#815
By not using the same hardcoded number for every test, we can parallelize the test now.
There are several cases remaining where we can't easily use unix sockets (e.g. QSslSocket or imapauth module), for that ask kernel what port number is currently free to use. This is a bit racy though.
Some clients will reuse query windows as the client thinks its just a
nick change if you have a existing query window with a module and a different one messages you.
Fix that by using the modules name as the ident.
Update tests to match new modules ident.
Alhuda Khan