webirc

Web IRC Specification

About

When a user connects through an indirect method, such web clients, the indirect client sends its own IP address instead of sending the user's IP address unless WebIRC is implemented by both the client and the server.

Method

Before the client sends the PASS, USER or NICK commands it should send:

WEBIRC password user hostname ip

Where each of the tokens in the above is replaced with the following:

• password Password that authenticates the WEBIRC command from this client.
• user User or client requesting spoof (cgiirc defaults to cgiirc).
• hostname Hostname of user.
• ip IP address either in IPv4 dotted quad notation (e.g. 192.0.0.2) or IPv6 notation (e.g. 1234:5678:9abc::def). IPv4-in-IPv6 addresses (e.g. ::ffff:192.0.0.2) should not be sent.

The password should be agreed previously with the IRC server that the client is connecting to. Normally this will be defined in the configuration file.

Expectations

Client expectations

• Perform any proxy resolution (TrustedProxies in CGI:IRC)
• Check the reverse DNS and forward DNS match
• Check the IP against suitable access controls (ipaccess, dnsbl in CGI:IRC)

Server expectations

• Check the connecting host and password
• Set the host and IP address to the given address
• Enforce bans (server-wide and channel) against the addresses given in the WEBIRC command

Security considerations

The server should limit the hosts from which a WEBIRC command is accepted from. Anyone with a valid password and host to connect from can spoof any hostname they desire, this is mostly by design. (It would be possible for the IRCD to check that the IP matches the hostname to stop spoofing of any host.) It is therefore possible to use this to bypass most kinds of ban. It is recommended the IRCD provides a method to find the original host and shows that WEBIRC is in use (to IRC operators at least) in order to provide a way to deal with abuse.

Supported IRC daemons

• Bahamut
• Charybdis
• Hybrid
• InspIRCd
• Nefarious
• Ratbox
• UnrealIRCd