TapTap/FastSync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix(daemon): close ACL fail-opens (v4-mapped peers, invalid patterns) and cap auth delay

Browse Source
This commit is contained in:
TapTap
2026-09-13 02:51:07 +02:00
parent dff6609976
commit fc560246c1
6 changed files with 66 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+3 -2
View File
@@ -506,8 +506,9 @@ A `[module]` may also set `max connections` (parsed and validated but not
enforced per module — the global cap applies to the whole listener) and its own
`hosts allow`/`hosts deny`.
Host patterns are `*` (match all), IPv4/IPv6 literals, IPv4/IPv6 CIDR
(`10.0.0.0/8`, `2001:db8::/32`), or hostname globs (`*.example.com`). A matching
Host patterns are `*` (match all), IPv4/IPv6 literals, or IPv4/IPv6 CIDR
(`10.0.0.0/8`, `2001:db8::/32`). Hostnames are not resolved, so hostname globs
are rejected at parse time rather than silently never matching. A matching
`hosts deny` rejects; if any `hosts allow` entries exist, a peer matching none of
them is rejected; deny takes precedence over allow. The global list is checked
before the module list, before authentication, and the connecting peer address