55863e9cfe
opers: TokenList -deny exclusion for commands/privs + auspex-gate hidden chans
...
commands=/privs= now honour a -token removal (e.g. *,-DIE), threaded through
resolve as deny sets and applied in the command gate + has_priv. WHOIS of a
+I (hidechans) user's channel list now needs users/auspex, not any oper.
2026-08-29 02:36:56 +00:00
e2a64b7806
opers: enforce the per-type usermode/chanmode allowlist
...
The usermodes=/chanmodes= class/type keys were parsed then ignored. Add a
ModeAllow allowlist to the resolved oper type + can_use_mode(), checked in
the oper-only mode handlers (services under mode_sudo pass through).
Unspecified stays permissive so built-in types are unrestricted; a type
opts into restriction with an explicit letter list (or * = all).
2026-08-29 02:17:32 +00:00
ff380d601d
opertypes: enforced oper privilege system (users/auspex, channels/auspex)
...
Add has_priv/user_has_priv and wire the auspex privileges into their gates:
WHOIS real host+IP + geo, WHO secret-channel members + hidden +i users,
LIST secret/private channels, and the connect-notice IP/geo redaction.
Only netadmin holds every privilege by default; the reusable auspex class
grants the pair to any other oper type. Replaces the ad-hoc snoop type gate.
2026-08-29 01:24:42 +00:00
d73f68f278
snoop: redact connect-notice IP + geo/ASN to non-netadmin opers
...
Per-viewer rendering via new snotice_c_gated: only opers whose type is in
snoop_sensitive_opertype (default netadmin) see the raw IP and geo/ASN;
lower opers see a 🔒 restricted redaction. Logs keep the full line.
2026-08-29 00:32:11 +00:00
068924de86
asn: core ASN lookup module (native MMDB); match connect classes + security groups on origin AS
2026-08-28 11:53:55 +00:00
cc13ce02c7
geoip: read city + ASN from MaxMind dbs; add geo (country/city + ASN) to connect snote, WHOIS and GEOIP
2026-08-28 09:49:18 +00:00
6ecb6f3d84
modules: draft/webpush — RFC 8291 (aes128gcm) + RFC 8292 (VAPID ES256) Web Push; WEBPUSH REGISTER/UNREGISTER, VAPID ISUPPORT, off-core delivery, HKDF/round-trip tested
2026-08-25 22:31:11 +00:00
6bb8ccd8ee
modules: draft/event-playback — record JOIN/PART/QUIT/NICK/MODE/TOPIC/KICK into CHATHISTORY, replayed only for cap clients (event_playback config, default on)
2026-08-25 22:17:26 +00:00
560c860f1d
i18n: server-wide locale via lang/<code>.conf catalogs (fr, es); numeric prose auto-translated at the chokepoint, en = zero-cost passthrough
2026-08-25 12:14:35 +00:00
a587d25873
docs: document the brand block (per-SNI server/network identity) in the example config
2026-08-24 23:29:45 +00:00
b11382bc1e
config: block-format example documenting every option; cloak/uline block fields + example parse guard
2026-08-23 12:28:19 +00:00
e8d16a1f96
config: accept oper password=<hash> named token; keep positional password back-compat
2026-08-23 03:11:32 +00:00
3052e47212
docs: document the pidfile option in the example config
2026-08-23 02:35:32 +00:00
4357a59c7a
filter: pluggable pattern engine (glob|regex) selected by filter_engine config; regex/glob backends behind a Matcher trait
2026-08-22 17:36:46 +00:00
b8e24e2071
chanlog: filter each log channel by snomask category; repeatable so different snomasks route to different channels
2026-08-21 17:11:27 +00:00
b693c5e5df
dnsbl: per-zone name/action/duration/reason with %ip%; XLINE notice shows duration + absolute expiry
2026-08-21 14:14:17 +00:00
81e013f053
docs: document oper classes/types + the five built-in types (operators.md, example config)
2026-08-20 10:06:38 +00:00
ebd6e29589
docs: rework README + manual — refresh the feature set (services interface, rustls TLS backend, WebSocket, PROXY v1/v2, metrics + JSON-RPC endpoints), correct command/module/cap counts, and document the tls_backend/metrics_bind/rpc/sts config keys in configuration.md and the example
2026-08-19 14:37:22 +00:00
99eb9c74f3
relaymsg: gate RELAYMSG on oper (it spoofs an arbitrary source nick), matching InspIRCd
2026-08-17 19:06:17 +00:00
0f28083855
markread: persist account-keyed read markers to disk and restore them at startup
2026-08-17 02:12:17 +00:00
b451ccbfd8
permchannels: persist +P channels (modes, topic, ts, list modes) to disk and restore them at startup
2026-08-17 01:43:29 +00:00
2ce6a5619c
docs: note REHASH cert reload and the tls_sni per-hostname cert key
2026-08-16 23:37:34 +00:00
a6293d5bbc
docs: document cloak_method and the account/fingerprint/static cloak keys
2026-08-16 19:52:27 +00:00
7d57e4ed34
connectban: never flood-ban loopback (127.0.0.1/::1) and add a connectban_exempt glob/cidr list
2026-08-15 23:25:16 +00:00
f921c2eb9c
docs: document all 85 previously-missing config keys in the example — on-connect (connbanner/autojoin/umodes), account registration, captcha gates, antirandom/blockamsg/connectban/hashident, restrict* + securelist + denychans + channames + maphide, and customtitle/extjwt/filehost/randquote
2026-08-15 01:37:16 +00:00
0ace39c882
listeners: make bind/bind_tls/bind_server repeatable (multiple addresses/ports) and normalize IPv4-mapped IPv6 peers back to plain IPv4 — a single [::] bind now serves IPv4+IPv6 with clean v4 addresses
2026-08-15 01:12:37 +00:00
41826c8e1a
socketengine: per-IP accept-rate limiter (token bucket, accept_rate/accept_burst, off by default) — drops connection-churn floods at the accept edge before any state is allocated; exempts trusted proxies and server links
2026-08-12 17:05:24 +00:00
59e18b0205
socketengine: reap TLS conns that stall mid-handshake (tls_handshake_timeout, default 15s) — a connection that opens the TLS port but never negotiates no longer leaks a slot
2026-08-12 15:51:45 +00:00
e74763619b
docs: document the io_threads reactor-pool knob in the example config
2026-08-12 14:03:24 +00:00
6795243d5f
core: slow-command snotice (slow_command_ms) + a watchdog thread (watchdog_ms) so a blocked core thread is visible instead of a silent freeze
2026-08-12 12:43:41 +00:00
b40c523b87
customprefix: data-driven prefix engine — define arbitrary new prefix modes (letter/prefix/rank/ranktoset/ranktounset/depriv), ranks re-spaced x10; built-in tiers + defaults unchanged
2026-08-11 19:46:07 +00:00
d35a2071a6
docs: document abbreviation + customprefix in the config example
2026-08-11 19:21:17 +00:00
72ca89af26
log_json: append the server-notice/log stream to a file as JSONL (log_json = <path>)
2026-08-11 18:44:48 +00:00
6ffd6a57bc
proxy: forward v2 TLS TLVs (PP2_TYPE_SSL/CERTFP) so plaintext clients behind a TLS-terminating proxy show secure+certfp; restore ws_trust_proxy to the config example
2026-08-11 17:13:32 +00:00
4f6c0ded48
websocket: add ws_defaultmode (text/binary/reject), ws_proxyranges (glob/CIDR X-Real-IP/XFF trust), ws_allowmissingorigin, ws_nativeping
2026-08-11 16:10:09 +00:00
87a683dbd2
proxy: HAProxy PROXY protocol v1+v2 on the plaintext (reactor) and TLS listeners; trusted via proxy=<glob>, rewrites the client IP before connect checks
2026-08-11 11:43:08 +00:00
5ea543188d
syslog: tee the server-notice/log stream to syslog (native /dev/log unix datagram or udp host:port)
2026-08-11 11:21:09 +00:00
56d3774647
rline: native regex engine (thompson nfa, no backtracking) + RLINE regex bans (registration/enforce/stats R/matchonnickchange)
2026-08-10 21:48:52 +00:00
f371ed0a18
connclass: cidr/parent/port/limit/globalmax + hashed/trusted-cert passwords, per-class recvq/sendq + fakelag, and rfc1413 ident
2026-08-10 18:46:42 +00:00
f5f888dbaa
connectclass: per-class connection policy (allow/deny, localmax, password, maxchans, pingfreq, timeout, modes) + PASS
2026-08-10 17:49:12 +00:00
1dd7f77ca8
operprefix + ojoin: server oper prefix (!/mode y, above owner) auto-granted to opers + OJOIN command
2026-08-10 13:01:07 +00:00
8ebb106f97
hidemode: hide configured mode changes from members below a rank (per-recipient MODE)
2026-08-10 09:41:20 +00:00
06883ced9f
extbanbanlist: matching extban b:#chan (share another channel's ban list)
2026-08-10 09:37:51 +00:00
0d5717c585
relaymsg: RELAYMSG + draft/relaymsg cap for bridge-style spoofed-nick channel messages
2026-08-10 09:06:30 +00:00
71d6e7441b
helpmode: oper-settable user mode +h (helpop) shown in whois
2026-08-10 09:01:38 +00:00
512185d6df
globops + autodrop: /GLOBOPS oper broadcast and pre-registration scanner drop
2026-08-10 08:58:15 +00:00
ab4d87488b
hidelist: restrict list-mode viewing by rank; allow members to view lists by default (parity)
2026-08-10 08:24:37 +00:00
9d84a66437
autoop: +w <prefix>:<mask> channel list mode grants status on join
2026-08-10 08:18:07 +00:00
87e3d5436d
chanlog: mirror the oper server-notice stream into a configured channel
2026-08-09 23:19:29 +00:00
1a53c5ae5a
banredirect: +b mask$#chan bounces a banned user to another channel (loop-guarded)
2026-08-09 23:17:32 +00:00
