ircd.rs/leveva-iauth/ at b29760986a6517f3e88d9047ed1106c25d38ef9c · xeiaso.net/ircd.rs · Tangled

xeiaso.net / ircd.rs

0

Proof of concept mechanical port of ircnet/ircd to Rust as part of a bit about C being insecure for network services

0

ircd.rs / leveva-iauth

2 folders 1 file

at b29760986a6517f3e88d9047ed1106c25d38ef9c

Xe Iaso chore: cargo fmt 6w ago

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

feat(leveva): add pipe auth module (P11 slice 44) Port mod_pipe.c (oracle iauth-rs) into leveva-iauth as the last denying auth module, completing the dnsbl/socks/webproxy/pipe set. Spawns an operator-configured external program with the client IP + source port appended as separate argv entries (no shell), reads one stdout byte: 'N' denies via the 465 gate, 'Y' allows, anything else abstains. Security hardening over the C module: explicit argv (no injection), config-only command source, stdin(null) + kill_on_drop so a timed-out probe is reaped. Pure classify()/build_argv() isolate the verdict map and argv composition for deterministic unit + proptest fuzzing. Tests: 11 unit + 3 config + 4 proptest + golden_pipe boot. No leveva-integration differential (oracle has no pure verdict fn; Y/N map trivially identical).

1 month ago

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago