search

lrstanley / girc

:bomb: girc is a flexible IRC library for Go :ok_hand:
https://pkg.go.dev/github.com/lrstanley/girc
MIT License
137 stars 13 forks source link

Strict Transport Security (sts) support? #38

Closed lol768 closed 4 years ago

lol768 commented 5 years ago

Any plans to implement this?

lol768 commented 5 years ago

https://ircv3.net/specs/extensions/sts.html

https://github.com/KittehOrg/KittehIRCClientLib/issues/139

lrstanley commented 5 years ago

Yes, I plan to support most if not all of IRCv3. This is just one I haven't gotten around to yet.

lrstanley commented 5 years ago

Just FYI, I started working on this on/off the past few days, should be done with it soon. Sorry it took so long!

lrstanley commented 5 years ago

I believe I've completed STS functionality (in https://github.com/lrstanley/girc/tree/feature/sts) with the exception of a persistent store for the policies. For now, it will only be in-memory based storage (but the goal is this persists connections, as clients should be re-used).

I will eventually get around to creating some kind of policy storage interface that allows users to store policies however they define, but for now I think this is a good enough replacement for STARTTLS, even without the additional STS functionality of persisted enforcement, even after restarts.

If anyone wants to test it out before I merge: @nmeum @42wim @puffrfish @bmeh @qaisjp and anyone else I can remember off the top of my head.

See: https://ircv3.net/specs/extensions/sts And: https://ircv3.net/support/networks (Oragono Testnet is a good test network)

lrstanley commented 5 years ago

Note the implications -- it WILL by default disconnect from irc and reconnect when the server provides an STS policy (this should mean little to handlers unless you have on-connect stuff, as it should happen before registration). It will fallback by default on the first attempt if it fails to the original non-secure connection. If it successfully makes a connection with a valid policy (and fails after), it will continue failing until the policy expires. Connections made over tls won't do anything different.

lrstanley commented 4 years ago

Merged in https://github.com/lrstanley/girc/commit/634e679a3de9242f19aa1e4233f50a7ecb2fbca8.