3 ms·

This seems like an inevitable progression of the de-portaling in July: https://matrix.org/blog/2023/07/deportalling-libera-chat/ https://matrix.org/blog/2023/0

This seems like an inevitable progression of the de-portaling in July: https://matrix.org/blog/2023/07/deportalling-libera-chat/ https://matrix.org/blog/2023/07/deportalling-libera-chat/ I wonder whether the July move prompted users to find other ways to connect to Libera.chat besides Matrix, killing usage of the bridge, leading us here. Thanks to those involved for the efforts while they could be sustained!

susam 3y ago
I wrote my own IRC + Matrix client to bridge the channels I operate. I've made the source code available under the terms of the MIT license here: https://github.com/susam/nimb https://github.com/susam/nimb If you find any issues, bugs, etc. in this tool, please let me know. Although this tool works well for my modest requirements, someone else may find issues while using this tool that I have not encountered yet. In such a case, bug reports, pull requests, patches, etc. are very welcome!
- progval 3y ago
  You need to split on (or sanitize) null bytes here: https://github.com/susam/nimb/blob/b40d87ddf2e1134fed4d7380b8ab697f6d1523d9/nimb.py#L152 https://github.com/susam/nimb/blob/b40d87ddf2e1134fed4d7380b... and sanitize NUL/CR/LF from the prefix (well, display_name) here: https://github.com/susam/nimb/blob/b40d87ddf2e1134fed4d7380b8ab697f6d1523d9/nimb.py#L155 https://github.com/susam/nimb/blob/b40d87ddf2e1134fed4d7380b... Otherwise you may have a command injection vulnerability similar to what matrix-appservice-irc used to have: https://pktz.fr/matrix/security/2022-appservice-irc-command-injection/ https://pktz.fr/matrix/security/2022-appservice-irc-command-... (though with carriage returns instead of null bytes)
  - susam 3y ago
    Thank you for taking a close look at the source code and highlighting this issue. > You need to split on (or sanitize) null bytes Do you mean splitting on (or sanitising of) carriage returns (CR or 0xD) and newlines (LF or 0xA)? I read your security advisory and as far as I understand, the issue occurs due to improper handling of CR and LF characters. I don't see anything about null bytes there.
    - progval 3y ago
      Null bytes are not allowed in IRC messages: https://modern.ircdocs.horse/#parameters https://modern.ircdocs.horse/#parameters Some IRC servers (especially those written in C) may interpret it as a line end, so you would have a similar issue
      - susam 3y ago
        Your security advisory has been quite helpful and I could reproduce the issue involving CR. It is particularly enlightening to know that the null byte could also cause the same issue because some IRC servers may interpret the null byte too as a line ending. It is late here but I have pushed a quick fix to plug this loophole: <https://github.com/susam/nimb/commit/1c02137 https://github.com/susam/nimb/commit/1c02137>. Review comments, feedback, pull requests, patches, etc. are very welcome! Thank you for this comment thread which has been constructive as well as productive.
jeltz 3y ago
I wager many like me just stopped using Libera.chat.
joshsimmons 3y ago
I suspect many people _did_ find other ways to connect (indeed I fired my IRC Cloud subscription back up...), but that's not what ultimately brought us* to this decision. Really it came down to not having the funds or staff time to maintain and operate it to the level that was needed. Echoing you, I am likewise really grateful for all the people who worked on it while it was doable! * Speaking on behalf of the Matrix.org Foundation here as its Managing Director.
- deleted 3y ago
  [deleted]
dngray 3y ago
> I wonder whether the July move prompted users to find other ways to connect to Libera.chat besides Matrix, killing usage of the bridge, leading us here. It certainly, did, I deployed Heisenbridge on my homeserver because I didn't want to go back to having two clients open.

susam 3y ago

I wrote my own IRC + Matrix client to bridge the channels I operate. I've made the source code available under the terms of the MIT license here: https://github.com/susam/nimb https://github.com/susam/nimb If you find any issues, bugs, etc. in this tool, please let me know. Although this tool works well for my modest requirements, someone else may find issues while using this tool that I have not encountered yet. In such a case, bug reports, pull requests, patches, etc. are very welcome!

progval 3y ago
You need to split on (or sanitize) null bytes here: https://github.com/susam/nimb/blob/b40d87ddf2e1134fed4d7380b8ab697f6d1523d9/nimb.py#L152 https://github.com/susam/nimb/blob/b40d87ddf2e1134fed4d7380b... and sanitize NUL/CR/LF from the prefix (well, display_name) here: https://github.com/susam/nimb/blob/b40d87ddf2e1134fed4d7380b8ab697f6d1523d9/nimb.py#L155 https://github.com/susam/nimb/blob/b40d87ddf2e1134fed4d7380b... Otherwise you may have a command injection vulnerability similar to what matrix-appservice-irc used to have: https://pktz.fr/matrix/security/2022-appservice-irc-command-injection/ https://pktz.fr/matrix/security/2022-appservice-irc-command-... (though with carriage returns instead of null bytes)
- susam 3y ago
  Thank you for taking a close look at the source code and highlighting this issue. > You need to split on (or sanitize) null bytes Do you mean splitting on (or sanitising of) carriage returns (CR or 0xD) and newlines (LF or 0xA)? I read your security advisory and as far as I understand, the issue occurs due to improper handling of CR and LF characters. I don't see anything about null bytes there.
  - progval 3y ago
    Null bytes are not allowed in IRC messages: https://modern.ircdocs.horse/#parameters https://modern.ircdocs.horse/#parameters Some IRC servers (especially those written in C) may interpret it as a line end, so you would have a similar issue
    - susam 3y ago
      Your security advisory has been quite helpful and I could reproduce the issue involving CR. It is particularly enlightening to know that the null byte could also cause the same issue because some IRC servers may interpret the null byte too as a line ending. It is late here but I have pushed a quick fix to plug this loophole: <https://github.com/susam/nimb/commit/1c02137 https://github.com/susam/nimb/commit/1c02137>. Review comments, feedback, pull requests, patches, etc. are very welcome! Thank you for this comment thread which has been constructive as well as productive.

jeltz 3y ago

I wager many like me just stopped using Libera.chat.

joshsimmons 3y ago

I suspect many people _did_ find other ways to connect (indeed I fired my IRC Cloud subscription back up...), but that's not what ultimately brought us* to this decision. Really it came down to not having the funds or staff time to maintain and operate it to the level that was needed. Echoing you, I am likewise really grateful for all the people who worked on it while it was doable! * Speaking on behalf of the Matrix.org Foundation here as its Managing Director.

deleted 3y ago
[deleted]

dngray 3y ago

> I wonder whether the July move prompted users to find other ways to connect to Libera.chat besides Matrix, killing usage of the bridge, leading us here. It certainly, did, I deployed Heisenbridge on my homeserver because I didn't want to go back to having two clients open.