https://gitlab.synchro.net/main/sbbs/-/commit/8ed7eed5afd1b3503e45bb2e
Added Files:
exec/tests/ircd/webirc.js
Modified Files:
exec/ircd.js exec/load/ircd/core.js unregistered.js exec/tests/ircd/lib.sjs
Log Message:
ircd: apply bans and RBLs to the client IP passed by WEBIRC for 2.7

Z:Lines and RBLs were checked only when a connection was accepted, against
the gateway's IP, and K:Lines (including services AKILLs) were matched only against user@hostname. A client behind a WEBIRC gateway whose IP resolved
to a hostname therefore escaped IP bans and RBL listings entirely.

After an accepted WEBIRC, check the client's IP against Z:Lines and the configured RBLs, and match K:Lines against user@ip as well as
user@hostname, both at registration and when a new ban is scanned against connected users. The RBL loop moves into RBL_Blocked() for the shared use.

A WEBIRC that is malformed or not accepted (wrong password or untrusted gateway) now closes the connection with ERROR instead of letting the
client register under the gateway's IP.

Fix check_dnsbl() building a malformed query for IPv6 addresses, with the
RBL name repeated after every group, so no IPv6 client was ever found
listed.

Add exec/tests/ircd/webirc.js covering the accepted, rejected and
malformed WEBIRC cases, a K:Line and an RBL listing of the client IP, and
the gateway's own clients still registering. The RBL case uses nip.io as
a stand-in blocklist and is skipped if it does not resolve.

Bump the IRCd version to 2.7.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net