Commit graph

Select branches

Hide pull requests

main

v5.0.1

Mono Color

• 281d3a962c
  docker: container image (Dockerfile + .dockerignore + minimal default config) main reverse 2026-08-30 21:17:34 +00:00
• 0be6daa1c2
  release: bump version to 5.0.1 v5.0.1 reverse 2026-08-30 21:07:25 +00:00
• ed58813ea5
  sasl: advertise and relay ECDSA-NIST256P-CHALLENGE reverse 2026-08-30 04:52:40 +00:00
• dfbe8e8c4a
  sasl: offer and relay SCRAM-SHA-256 (advertised on plaintext too) reverse 2026-08-30 04:06:06 +00:00
• a922a30bf1
  opers: use the priv-name constants at the auspex checks; remove unused fns reverse 2026-08-30 03:28:15 +00:00
• 369e06ec2b
  io: bound the blocking TLS handshake write side + the wss TLS handshake reverse 2026-08-30 02:27:09 +00:00
• 2d42fbd2ca
  opers: add users/ignore-privdeaf — reach +D deaf users reverse 2026-08-29 13:46:25 +00:00
• 5dfedb5091
  opers: wire eight more privileges over their raw is_oper gates reverse 2026-08-29 13:11:08 +00:00
• bbe2682478
  docs: document the oper privilege model (types/classes, privileges, mode allowlist) reverse 2026-08-29 12:00:21 +00:00
• 57c4cb0c26
  opers: apply the usermode allowlist to +s (snomask) too reverse 2026-08-29 03:08:47 +00:00
• 4e72ef790c
  opers: gate NAMES secret-channel visibility on channels/auspex too reverse 2026-08-29 02:43:35 +00:00
• 55863e9cfe
  opers: TokenList -deny exclusion for commands/privs + auspex-gate hidden chans reverse 2026-08-29 02:36:56 +00:00
• e2a64b7806
  opers: enforce the per-type usermode/chanmode allowlist reverse 2026-08-29 02:17:32 +00:00
• bc412c218e
  opers: organize privileges and enforce them at flood/join/visibility gates reverse 2026-08-29 02:05:23 +00:00
• ff380d601d
  opertypes: enforced oper privilege system (users/auspex, channels/auspex) reverse 2026-08-29 01:24:42 +00:00
• d73f68f278
  snoop: redact connect-notice IP + geo/ASN to non-netadmin opers reverse 2026-08-29 00:32:11 +00:00
• 0af2ab7d21
  snoop: show the +x cloaked host in the connect notice, not the raw host reverse 2026-08-29 00:11:43 +00:00
• 6a8999a1bb
  snoop: show connecting IP in the connect snote, tagged ipv4/ipv6 reverse 2026-08-28 22:56:38 +00:00
• bf1446a51b
  asn: A:<asn> matching extban (ban/exempt by origin AS); advertise A in EXTBAN reverse 2026-08-28 18:53:04 +00:00
• 068924de86
  asn: core ASN lookup module (native MMDB); match connect classes + security groups on origin AS reverse 2026-08-28 11:53:55 +00:00
• cc13ce02c7
  geoip: read city + ASN from MaxMind dbs; add geo (country/city + ASN) to connect snote, WHOIS and GEOIP reverse 2026-08-28 09:49:18 +00:00
• f0c4a1cc87
  snoop: show transport (websocket) + TLS version/cipher in the client-connecting snote reverse 2026-08-28 00:40:54 +00:00
• 106bda2e8b
  watchdog: name the slow event/command in the slow-event snote and [watchdog] warning reverse 2026-08-27 16:32:48 +00:00
• 533666dba0
  link: announce a member's IJOIN status modes to local channel members so a rejoining services bot shows opped reverse 2026-08-26 17:46:37 +00:00
• 8df756b038
  docs/ircv3: document draft/event-playback, draft/webpush (WEBPUSH + VAPID ISUPPORT) reverse 2026-08-26 11:46:15 +00:00
• f7ff5c3f86
  readme: list draft/event-playback + draft/webpush under IRCv3 features reverse 2026-08-26 11:43:59 +00:00
• 6ecb6f3d84
  modules: draft/webpush — RFC 8291 (aes128gcm) + RFC 8292 (VAPID ES256) Web Push; WEBPUSH REGISTER/UNREGISTER, VAPID ISUPPORT, off-core delivery, HKDF/round-trip tested reverse 2026-08-25 22:31:11 +00:00
• 6bb8ccd8ee
  modules: draft/event-playback — record JOIN/PART/QUIT/NICK/MODE/TOPIC/KICK into CHATHISTORY, replayed only for cap clients (event_playback config, default on) reverse 2026-08-25 22:17:26 +00:00
• 9dcc269f45
  readme: document server-wide message localization (locale/lang catalogs, fr+es) reverse 2026-08-25 14:47:02 +00:00
• 04671733d2
  i18n: localize the client-facing Closing-link ERROR wrapper via trf (fr, es); QUIT-broadcast reasons stay canonical for S2S reverse 2026-08-25 14:35:13 +00:00
• 9b51db07f5
  i18n: sweep all remaining dynamic prose (oper commands, XLINE/FILTER/DNSBL notices, whois/vhost/knock/dcc/title/reputation/tline/rmode, hash, rename) through trf; +\xNN catalog escape; fr+es now 236 entries each reverse 2026-08-25 14:30:29 +00:00
• ef96bcbd06
  i18n: localize the snotice/announce path — translate at deliver_server_notice chokepoint; rehash, connect/exit, oper-up, login, channel & ojoin notices via trf (fr, es) reverse 2026-08-25 13:04:31 +00:00
• 6f8ff39f99
  i18n: localize the welcome burst (001-003/251) via trf() dynamic templates (fr, es) reverse 2026-08-25 12:18:17 +00:00
• 560c860f1d
  i18n: server-wide locale via lang/<code>.conf catalogs (fr, es); numeric prose auto-translated at the chokepoint, en = zero-cost passthrough reverse 2026-08-25 12:14:35 +00:00
• 5914a6d993
  websocket: collapse v4-mapped proxy peer so ws_proxyranges matches and X-Real-IP is honored reverse 2026-08-25 03:15:28 +00:00
• 935f22f2f2
  accounts: oper snotice on post-connect login ('Client X is now logged in as Y') reverse 2026-08-25 02:21:58 +00:00
• 37436d0306
  snoop: drop needless clones in the connect notice (hold the &User borrow) reverse 2026-08-25 00:12:23 +00:00
• 6e8d6c31fb
  snoop: connect notice includes port, sni and account (present fields only) reverse 2026-08-25 00:06:22 +00:00
• a587d25873
  docs: document the brand block (per-SNI server/network identity) in the example config reverse 2026-08-24 23:29:45 +00:00
• b6ada854cc
  brand: per-SNI server/network identity (welcome, ISUPPORT NETWORK, numeric source prefix) reverse 2026-08-24 23:29:15 +00:00
• f36f803d42
  whois: show client-cert fingerprint (276) to everyone, not just opers/self reverse 2026-08-24 22:25:08 +00:00
• 009bea734a
  whois: show negotiated TLS version/group/cipher in 671; sslgroup crate reads the KEX group reverse 2026-08-24 21:45:46 +00:00
• 85eb8218f0
  tls: openssl backend offers TLS 1.3 via mozilla_intermediate_v5 (was capped at 1.2) reverse 2026-08-24 20:38:58 +00:00
• 51602737e2
  tls: rustls backend offers TLS 1.3 (was TLS 1.2 only), preferred over 1.2 reverse 2026-08-24 20:30:54 +00:00
• d0fdb2e8be
  docs: add Community section (irc.devtronic.pro #echoiRCd support channel) to README reverse 2026-08-24 19:47:06 +00:00
• f066fa0b5a
  docs: document the block config format + mkpasswd/checkconfig/rehash CLIs in README and configuration.md reverse 2026-08-24 19:13:45 +00:00
• 8d48900ae3
  config: derive Eq on the block-parser token enum reverse 2026-08-23 13:01:05 +00:00
• 1166c49443
  config: checkconfig CLI + Config::dump; tls block carries sni/handshake_timeout reverse 2026-08-23 12:42:30 +00:00
• b11382bc1e
  config: block-format example documenting every option; cloak/uline block fields + example parse guard reverse 2026-08-23 12:28:19 +00:00
• 2f6ce36af0
  config: add brace/block format (translated to flat, both formats supported) reverse 2026-08-23 12:18:10 +00:00
• e8d16a1f96
  config: accept oper password=<hash> named token; keep positional password back-compat reverse 2026-08-23 03:11:32 +00:00
• c2e0a9eeb4
  mkpasswd: 'echoircd mkpasswd [cost]' CLI hashes a stdin password with bcrypt for oper blocks reverse 2026-08-23 02:55:14 +00:00
• 12a4ddb749
  rehash: fall back to a /proc scan for the running server when the pidfile is stale, and self-heal it reverse 2026-08-23 02:40:53 +00:00
• 3052e47212
  docs: document the pidfile option in the example config reverse 2026-08-23 02:35:32 +00:00
• 34342e110f
  rehash: write the pidfile only when configured + CLI verifies a live echoircd, so a stale/clobbered pid can't misfire reverse 2026-08-23 02:17:44 +00:00
• a7ae0d86a9
  rehash: 'echoircd rehash' CLI + SIGHUP reload the running config in place via a pidfile reverse 2026-08-23 02:10:41 +00:00
• 42fe82556b
  version: show echoircd-<major> (5) in 002/004/351 and enrich RPL_VERSION with build/toolchain provenance reverse 2026-08-23 01:24:45 +00:00
• 5c286a94cb
  conn_waitpong: exempt loopback (per ipv4/ipv6) and per-class from the registration ping cookie reverse 2026-08-22 23:49:46 +00:00
• 70a4ecb0a0
  core: add oper MODULES command (702/703) listing loaded modules; module.list RPC already existed reverse 2026-08-22 17:36:46 +00:00
• 4357a59c7a
  filter: pluggable pattern engine (glob|regex) selected by filter_engine config; regex/glob backends behind a Matcher trait reverse 2026-08-22 17:36:46 +00:00
• 73817eddde
  whois: show a remote user's actual server description in 312, not the literal "remote user" reverse 2026-08-21 23:43:51 +00:00
• ddb6214b47
  chanlog: post log lines as a channel PRIVMSG from the server, not a NOTICE reverse 2026-08-21 17:41:00 +00:00
• b8e24e2071
  chanlog: filter each log channel by snomask category; repeatable so different snomasks route to different channels reverse 2026-08-21 17:11:27 +00:00
• 7cb9256ff5
  xline: tell a banned user when the ban expires, not just why reverse 2026-08-21 15:18:23 +00:00
• 745ddd540e
  xline: show a timed ban's remaining time in the removal notice reverse 2026-08-21 15:10:27 +00:00
• 3ad67c6b52
  xline: broadcast the XLINE notice on remove and expire too, so it covers every x-line's whole lifecycle reverse 2026-08-21 15:03:36 +00:00
• 6301b64509
  server: extract civil() so iso_time and long_date share one date conversion instead of duplicating it reverse 2026-08-21 14:52:49 +00:00
• b693c5e5df
  dnsbl: per-zone name/action/duration/reason with %ip%; XLINE notice shows duration + absolute expiry reverse 2026-08-21 14:14:17 +00:00
• 1824af5d90
  signore: persist per-account via services metadata — push on edit, replay on login reverse 2026-08-20 15:40:19 +00:00
• 6c5f330746
  add SIGNORE: personal mutual server-side ignore across channels and PMs reverse 2026-08-20 14:48:17 +00:00
• 2c9ce18cd7
  whois: render the oper-type title line in bold + colour (per-type color=<name|0-15|none>, default red) so it stands out reverse 2026-08-20 14:26:17 +00:00
• bc520d59a5
  whois: a typed oper gets its own 320 special line with the type title (e.g. 'is a Network Administrator'), separate from the generic 313 operator line reverse 2026-08-20 14:17:15 +00:00
• 8f9e60c8e2
  whois: 313 shows the generic 'is an IRC Operator' again — the oper type gates capabilities, and a custom title comes from the SWHOIS line (320) reverse 2026-08-20 14:05:46 +00:00
• 5a9825ee61
  comments: strip stray reference-implementation names from a handful of module/inline comments reverse 2026-08-20 10:11:07 +00:00
• 81e013f053
  docs: document oper classes/types + the five built-in types (operators.md, example config) reverse 2026-08-20 10:06:38 +00:00
• 01516d5fdc
  opertypes: oper classes + types — reusable capability classes and named roles (WHOIS title, auto usermodes/snomasks/vhost + level on oper-up, per-type command enforcement via on_pre_command); ships 5 built-in (helpop/globop/admin/servadmin/netadmin); oper blocks gain type=<id>; a typeless oper keeps full access reverse 2026-08-20 10:05:11 +00:00
• f3ce0e61ef
  s2s: accept a swhois metadata key from services — set (or clear, when empty) the user's SWHOIS ext, shown in WHOIS 320 reverse 2026-08-20 00:02:02 +00:00
• f1ddb878af
  rustls: offer TLS 1.2 only, matching the openssl backend (mozilla_intermediate) — advertising 1.3 as well pushed every client onto a 1.3 handshake openssl never served, so a client fine on 1.2 could fail to connect; a drop-in backend must negotiate the same protocol reverse 2026-08-19 17:55:31 +00:00
• 598a019620
  rustls: keep WRITABLE and drain buffered ciphertext when the socket backs up, and bound the plaintext buffer at 256KiB — rustls accepts all plaintext and buffers ciphertext internally on WouldBlock (unlike openssl, which surfaces backpressure through write); expose wants_write()/flush() so the reactor drains it and the sendq caps govern a slow reader. no-op for the openssl and plaintext paths reverse 2026-08-19 17:19:15 +00:00
• ebd6e29589
  docs: rework README + manual — refresh the feature set (services interface, rustls TLS backend, WebSocket, PROXY v1/v2, metrics + JSON-RPC endpoints), correct command/module/cap counts, and document the tls_backend/metrics_bind/rpc/sts config keys in configuration.md and the example reverse 2026-08-19 14:37:22 +00:00
• b106b66de5 s2s: validate source_behind on ADDLINE/DELLINE/INVITE too — these apply network state (x-lines, invite bypass) from msg.source with no check the source sits behind the arriving link; a legit source (incl. a services SID/uuid) always is, so echo's akills still propagate reverse 2026-08-19 04:57:39 +00:00
• 78a6574d64 hardening: bracket a bare IPv6 nameserver literal (was unparseable -> rDNS/DNSBL silently degraded on v6-only hosts); saturating chunk-size advance in the RPC dechunker (a 16-hex-digit size could overflow-panic the worker); connclass hash= is now last-wins to match password= under parent= inheritance reverse 2026-08-19 04:45:07 +00:00
• 1a5c41871c password_hash: reject an empty PBKDF2 hash/salt — a stored 'pbkdf2:iters:salt:' (empty hash) made ct_eq(&[],&[]) return true, verifying ANY password; refuse empty want/salt before computing reverse 2026-08-19 04:45:07 +00:00
• 6bc299f286 socketengine: re-drain a read-capped socket via a pending_reads queue, not an epoll re-arm — the MAX_READ_PER_TURN re-arm relied on kernel readiness, but a TLS socket drains all ciphertext and buffers decrypted plaintext INSIDE the session, so complete lines past 64KB stranded until the next TCP segment; the reactor now re-reads queued sockets each turn (covers kernel- and TLS-buffered leftover) reverse 2026-08-19 04:45:07 +00:00
• 9eda8cbd4f server: carry accepted_nicks count across a nick change — set_nick rewrites ACCEPT entries old->new in place (bypassing accept_add/remove) so the reverse count desynced; the count-gated quit scrub could then skip a reused nick, letting it inherit +g acceptance. move the count old->new (also fixes a slow map leak) reverse 2026-08-19 04:45:07 +00:00
• 155e804779 s2s: extend source_behind to FTOPIC/RENAME/UID/OPERTYPE/REDACT — the guard was on plain TOPIC but not its S2S twin FTOPIC (a peer could forge a network-wide topic overwrite), nor channel RENAME, UID (SID announce unchecked), OPERTYPE, or REDACT; all now validate the source lives behind the arriving link reverse 2026-08-19 04:45:06 +00:00
• 9c5719fd7c socketengine: cap bytes drained from one socket per readable event (MAX_READ_PER_TURN=64KiB), then re-arm epoll and yield — bounds the per-turn line buffer and stops one flooding client from monopolising the reactor; the leftover waits in the kernel buffer and is re-delivered next turn (verified: a 133KB single-write burst gets every reply back) reverse 2026-08-19 03:28:51 +00:00
• fc9ae4faad message: parse the IRCv3 tag block in a single pass instead of four separate split(';') scans plus an intermediate Vec for ctags reverse 2026-08-19 02:54:24 +00:00
• 1aa02a08b9 channels: replace Member's six parallel prefix bools (oprefix/owner/admin/op/halfop/voice) with a single u8 bitfield (PFX_*) + inline bool accessors/mutators — same semantics, one byte instead of six, no more risk of the flags drifting out of sync; all call sites go through op()/set_op()-style methods reverse 2026-08-19 02:47:04 +00:00
• 16fae5b23c watch: notify WATCH/MONITOR via nick->watchers reverse indexes (watch_by/monitor_by) instead of scanning every user on each online/offline/nick-change flip — O(watchers) not O(users); maintained through centralized watch_index_*/monitor_index_* helpers + quit cleanup reverse 2026-08-19 02:34:22 +00:00
• 16ea4b5a23 core_message: compute the sender's channel rank once per message (mrank) instead of recomputing s.rank(uid,&key) up to 7x in the channel PRIVMSG/NOTICE gate and once more in TAGMSG — rank is fixed for a single message reverse 2026-08-19 02:29:59 +00:00
• fb1a9f3d70 server: skip the O(users) callerid ACCEPT scrub on quit unless the departing nick is actually accepted by someone — a reverse count (accepted_nicks) maintained through centralized accept_add/accept_remove helpers avoids scanning every user's accept list on each quit (O(users*quits) on a netsplit); the full scrub still runs when the count is nonzero, so the nick-reuse protection is unchanged reverse 2026-08-19 02:21:38 +00:00
• ab0ccae71f server: scrub a departed user's pending invites via a User.invited reverse index instead of scanning every channel on the network per quit — the old O(channels)-per-quit path was O(channels*quits) on a netsplit; the index is maintained at the 4 invite add/remove sites (INVITE cmd, S2S INVITE, join-consume, UNINVITE) reverse 2026-08-19 02:09:36 +00:00
• 5101b1361d whois: build the target snapshot as a named WhoisInfo struct instead of a 17-field positional tuple — field-named construction can't silently transpose two same-typed fields; destructured into the same locals so the reply code is unchanged reverse 2026-08-19 01:58:01 +00:00
• ea3e879068 connclass: cache resolved connect classes in a config_gen-tagged thread_local — all()/named() (and thus pick/assign and every per-ping/per-message getter) re-parsed the connectclass config and re-resolved parent inheritance on each call; now rebuilt only on rehash reverse 2026-08-19 01:56:22 +00:00
• d4d3886379 restrictcommands: cache the parsed restriction list (config_gen-tagged) instead of re-tokenizing every restrictcommand line on every command; clone only the one matched rule so the ext borrow drops before the server is used mutably reverse 2026-08-19 01:54:45 +00:00
• cd46cfc49f securitygroups: cache parsed groups in a config_gen-tagged thread_local instead of re-parsing all securitygroup lines on every g: extban match and WHOIS — safe on the single-threaded core, re-parses only on rehash reverse 2026-08-19 01:53:41 +00:00
• 1da913a249 autodrop: cache the autodrop-command set (config_gen-tagged) instead of re-splitting autodrop_commands on every packet from an unregistered socket — the path runs hottest under the scanner flood it defends against reverse 2026-08-19 01:51:57 +00:00
• 09b4adabbf disable: cache the disabled-command set (config_gen-tagged HashSet) instead of re-splitting disabled_commands on every non-oper command — the hottest hook in the server; re-parses only on rehash reverse 2026-08-19 01:51:31 +00:00
• 78be7279b0 server: add a config_gen counter bumped on every rehash — lets modules cache config parsed into a hot-path structure and invalidate it correctly (a REHASH can't leave a stale cache), unblocking the per-message/per-command config re-parse in disable/autodrop/securitygroups/restrictcommands/connclass reverse 2026-08-19 01:51:08 +00:00