ban_matches: don't match sockhost or ip against ipspoofed users

diff --git a/src/channel.c b/src/channel.c
index c633e1d50b4a7380756e23fcb1dcec0dba3cb1e1..d66cc7e1969dc0207f952c6f9ac6b4b935f09365 100644 (file)
--- a/src/channel.c
+++ b/src/channel.c
@@ -780,29 +780,32 @@ ban_matches(struct Client *who, struct Ban *bp)
 
   if (!match(bp->name, who->name) && !match(bp->user, who->username))
   {
+    if (!match(bp->host, who->host) || !match(bp->host, who->realhost))
+      return 1;
+
+    if ((!IsIPSpoof(who) || !ConfigFileEntry.hide_spoof_ips) && !match(bp->host, who->sockhost))
+      return 1;
+
     switch (bp->type)
     {
       case HM_HOST:
-        if (!match(bp->host, who->host) || !match(bp->host, who->realhost) || !match(bp->host, who->sockhost))
-          return 1;
-
         if (!cloak_match(&who->localClient->cloaks, bp->host))
           return 1;
         break;
       case HM_IPV4:
+        if (IsIPSpoof(who) && ConfigFileEntry.hide_spoof_ips)
+          break;
         if (who->localClient->aftype == AF_INET)
           if (match_ipv4(&who->localClient->ip, &bp->addr, bp->bits))
             return 1;
-        if (!match(bp->host, who->host) || !match(bp->host, who->realhost) || !match(bp->host, who->sockhost))
-          return 1;
         break;
 #ifdef IPV6
       case HM_IPV6:
+        if (IsIPSpoof(who) && ConfigFileEntry.hide_spoof_ips)
+          break;
         if (who->localClient->aftype == AF_INET6)
           if (match_ipv6(&who->localClient->ip, &bp->addr, bp->bits))
             return 1;
-        if (!match(bp->host, who->host) || !match(bp->host, who->realhost) || !match(bp->host, who->sockhost))
-          return 1;
         break;
 #endif
       default: