Personally, I don't think DALnet needs masking. I see plenty of room for abuse, and inability to properly ban things, especially if each server is independently hashing a hostmask.
BUT, if we WERE to mask, I'd go with a static hash of the address shared among servers. Connecting server hashes it, passes it as the hostmask to all other servers. Helps prevent abuse. Nick based masks hold plenty of room for abuse.
On Tue, Oct 13, 2009 at 7:50 PM, Kobi Shmueli <kobi@dal.net> wrote:
Hi all,
I think it's about time to discuss host-masking for users again.
There are (at least) two types of host-masking we could add:
1) hash based masks (statically mask part of the IP/host, i.e. dalnet-19309.example.com)
2) nick based masks (i.e. registered-nick.dalnet.user or whatever)
The second method will let users evade bans more easily so I'm going to focus on the first method.
My implementation suggestion:
Each server will store both the user's real host and a hashed version of it. The hash for each IP/host will always be static and even if a user disconnects and re-connects, they will get the same hashed IP/host.
By default, users will get a umode (i.e. +H) that will show the hashed version wherever their real host have been used until now (/whois, /who, joins, parts, etc).
At any time, a user will be able to umode -H themselves and use their real host instead of the masked one.
Bans will work both against the real host and the hashed host so if a user will get banned by his masked host, they won't be able to join a channel even if they umode -H themsleves.
IRC Operators will be able to see any users' real IP/host, ofcourse.
IMO, we shouldn't pass the masked host with the NICK command between servers and just let each server hash it on their own.
As for the actual encryption, I would let a module do the actual hashing of the masked host (we'll provide a sample module). The module will be able to support (at least) two encryption types so we will be able to be change the type we're using on the fly by services after all servers have upgraded their module (in the case we'll ever want to change it).
Let the discussion begin!
-Kobi.
_______________________________________________
DALnet-src mailing list
DALnet-src@lists.dal.net
https://lists.dal.net/mailman/listinfo/dalnet-src