matrix-appservice-irc
matrix-appservice-irc copied to clipboard
matrix-org
Ipv6Generator is inefficent in a multi-network configuration
The IPv6 counter is global to the whole bridge, so multiple networks never re-use the same IP. While this could be inferred to as by design, there doesn't really seem to be a need to have unique addresses across different IRC networks.
Limnoria bots assume two people with the same NUH on two networks are the same person (often, even just the same username and hostname); so using the same IP address while nick and username are under a user's control would make it possible to impersonate someone and run commands with their privileges.
so using the same IP address while nick and username are under a user's control would make it possible to impersonate someone and run commands with their privileges.
That's a terrible design if you assume that a user's IP can only belong to one user. Pretty much every public space and office will reuse the same IP for multiple users, as well as mobile networks.
I'm aware, but this was designed two decades ago, when shared IP addresses were supposed to have an identd server.
Right, I don't think the bridge is going to support architecture designed two decades ago. Rather, I suspect the bot developers are going to have to update to support how the modern internet works. I would hope it wouldn't take a impersonation attack to cause the change.
Rather, I suspect the bot developers are going to have to update to support how the modern internet works.
I'm the bot's developer. I added better authentication schemes in 2012 (based on network services) and in 2015 (based on GPG) and been recommending it since then. Yet many people still use hostmasks. And I'm not going to remove a feature thousands of people rely on, locking them out of their account after they upgrade one day, after 13 years of not breaking existing installs as a policy.
there doesn't really seem to be a need to have unique addresses across different IRC networks.
also by the way, matrix.org's Gimpnet bridge is misconfigured, and connects its puppets to Libera (probably since four months ago). If the change you suggest in this issue was implemented and if the Gimpnet and Libera bridges were on the same range, it would have been possible for an attacker to use the same hostmask as someone else on the same network.