echo/echoIRCd
1
1
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

Commit graph

  • 11852332dc message: parse on space (0x20) only per RFC — trim_start() also ate tabs, so a param containing a tab (e.g. a trailing ':\t') didn't round-trip through to_wire/parse; the parser fuzz proptest found it. trim_start_matches(' ') makes tabs ordinary param content; regression case pinned reverse 2026-08-19 01:41:22 +00:00
  • 98e5cf4d20 relaymsg/showfile: reject whitespace/control chars in a RELAYMSG spoofed nick (defence-in-depth on top of the denylist), and cap the showfile read at 256 KiB so a large /RULES-style file can't stall the core loop reverse 2026-08-19 01:35:25 +00:00
  • c47fb9a80a syslog: keep the UDP socket cached across send errors instead of dropping it (which re-bound + re-resolved a socket on every notice when the target was unreachable); the Unix datagram path still reopens on failure reverse 2026-08-19 01:34:24 +00:00
  • b3f66ec310 customtitle: return Fail (not Ok) when the crypto pool is at capacity and the TITLE auth is denied, matching the synchronous verify path reverse 2026-08-19 01:33:34 +00:00
  • 55174ec017 profilelink/hidelist: unify the WHOIS label to English "Profile:" (was "Profil:" for logged-in users) and make hidelist honour the last matching config line (conf last-wins semantics) instead of the first reverse 2026-08-19 01:33:05 +00:00
  • 303fc0c8dc filehost: use only the final path segment of the URL as the displayed filename tag — the trailing part was taken verbatim (path separators, ../), and while json_esc/escape_tag block injection, a client rendering filename could be misled by traversal; take the basename reverse 2026-08-19 01:32:17 +00:00
  • c532828aab jwt: match claim_num only against a top-level object key (depth-aware scan), not any substring — a claim whose string value contained "exp": could otherwise spoof the exp an external verifier reads; added nested + string-value regression tests reverse 2026-08-19 01:31:22 +00:00
  • c32fbee905 chanlog: fan the mirrored notice via to_channel (Arc-shared line, per-recipient server-time) instead of collecting a members Vec and cloning the String per member reverse 2026-08-19 01:29:48 +00:00
  • 2851c0a7ab rmode: send a usage NOTICE when the list-mode arg has no mode letter (e.g. RMODE #c 3) instead of failing silently reverse 2026-08-19 01:29:14 +00:00
  • b557c9887f log_json: cache an open failure so a misconfigured path doesn't re-issue an open() syscall (and silently drop) on every notice — the error is now surfaced once via stderr and not retried until the path changes; the write-failure reopen (for logrotate) is preserved reverse 2026-08-19 01:28:42 +00:00
  • 65bedaf417 hidemode: resolve each changed mode's hidden-rank once and each member's rank once, instead of re-scanning the hidemode config for every (member x change) pair on the MODE broadcast hot path reverse 2026-08-19 01:23:33 +00:00
  • b59fe70537 operlevels: use Extensible::set instead of get_or_insert_with(0)-then-overwrite reverse 2026-08-19 01:22:54 +00:00
  • d495fd0f30 channel: cap the per-channel invite set (maxinvites, default 100) — it only shrank when the invitee joined, so an op could grow it unboundedly; re-inviting an already-listed nick still works reverse 2026-08-19 01:22:32 +00:00
  • 8f5b37bf8d dnsbl: cap the number of blocklist zones checked per client at 16 — each zone is a serial blocking DNS lookup, so a long (mis)configured zone list could stall a connecting client's registration for zones.len()*timeout reverse 2026-08-19 01:21:40 +00:00
  • b63458816e metrics: set read/write timeouts on each scrape connection — the single-threaded accept loop did an untimed read, so one client that connected and never sent blocked every future scrape (slowloris) reverse 2026-08-19 01:21:21 +00:00
  • ac3e66e9e0 metadata: prune a channel's metadata once the channel no longer exists (tick GC) — #channel entries were never freed (unlike user entries on quit), so setting metadata on a channel that later empties leaked memory and kept re-persisting to disk forever; +P channels stay live so keep theirs reverse 2026-08-19 01:20:23 +00:00
  • a7f6c264d1 snoop: gate the per-connect/join/quit eprintln! behind snoop_stderr (default off) — it wrote to stderr (journald) on every client event in the reactor thread, unbounded under a connect flood; the +c/+q snotices already carry the operator-facing signal reverse 2026-08-19 01:18:58 +00:00
  • 924141683c extbanbanlist: identify extbans by the real rule (<letter>:...) instead of "2nd byte is a colon" — the old heuristic wrongly skipped a plain hostmask whose second char happened to be ':', mis-listing it reverse 2026-08-19 01:18:27 +00:00
  • 6f9d11f83e captcha: clamp recaptcha/cloudflare token TTL to [60s, 86400s] — an unclamped conf value could set exp in the past (every token instantly invalid, self-DoS) or absurdly far out reverse 2026-08-19 01:18:13 +00:00
  • ee3c5e761e geoip: bound recursion + require forward progress in the .mmdb value decoder — value_len/map_get recursed into nested maps/arrays with no depth limit (unlike resolve), so a crafted database could overflow the stack or spin on a zero-advance value; cap nesting at 32 and bail on a malformed (0-length) sub-value reverse 2026-08-19 01:17:32 +00:00
  • e200779d27 connclass: resolve hash= independently of token order — the fold only ran if password= had already been parsed, so "hash=sha256 password=<hex>" (hash first) stored the digest as a plaintext password and every login to that class failed; build() now combines <algo>:<digest> after the full token pass reverse 2026-08-19 01:15:26 +00:00
  • 928026c49e permchannels: isolate the load-time mode applier in catch_unwind so a panicking mode handler can't leave mode_sudo stuck true — which would silently disable rank/oper gating for every subsequent MODE; the flag is now always reset reverse 2026-08-19 01:14:34 +00:00
  • 14eb982db5 multiline: reject an over-limit batch with a FAIL instead of silently dropping the overflowing lines — accumulate() dropped a line that exceeded multiline_maxbytes/maxlines but still returned buffered=true, so the client believed a truncated message was sent whole; now overflow flags the batch and close() drops it with a standard FAIL reverse 2026-08-19 01:13:39 +00:00
  • 83cdce17c5 connflood: bound the per-IP connection-history map (prune stale buckets past 65536 tracked IPs) — it only shrank on the tick GC, so a wide source-IP spread could grow it unbounded between ticks (memory DoS) reverse 2026-08-19 01:12:39 +00:00
  • a218d65371 rpc: authenticate on the header block before buffering the request body — the httpd read up to MAX_REQUEST (256 KiB) and only then checked the Authorization header, so an unauthenticated peer reaching rpc_bind could make each connection consume memory + a worker thread; now POST+auth are validated as soon as headers are complete, before any body is read reverse 2026-08-19 01:05:29 +00:00
  • 5b33786a46 rpc: refuse an all-wildcard x-line via ban.add — the mask went unvalidated, so an authenticated RPC call with "mask":"" or "*@*" installed a K/G/Z-line matching the entire network; require at least one literal host/ip/nick char reverse 2026-08-19 01:03:27 +00:00
  • 54c2a733fe password_hash: reject a PBKDF2 credential with an absurd iteration count (>10M) instead of running it — the count is read straight from the stored string, so a corrupt/hostile credential (e.g. via a compromised accounts backend) could pin a worker thread for a very long time; legitimate work factors are far below the cap reverse 2026-08-19 01:02:36 +00:00
  • 4248cc0479 oper: gate the client-facing SVSLOGIN/SVSLOGOUT behind oper_svslogin (default off) — they were a pre-S2S stopgap that let any oper forge an arbitrary account login (set_login) and thus +r/account-gated access; the live path is S2S link_svslogin (source_is_service-gated), so services are unaffected — only the obsolete oper backdoor is closed reverse 2026-08-19 01:01:33 +00:00
  • a80b86b50d perf: S2S channel-message fanout shares the line by Arc across members (relay_channel_message) instead of cloning a String per recipient — mirrors the client PRIVMSG fanout; builds at most three variants (plain / server-time / echo-services-tagged) whatever the channel size, behaviour unchanged reverse 2026-08-19 00:47:32 +00:00
  • 910422199b perf: glob_match takes a zero-allocation byte-wise path for ASCII operands (the norm for hostmasks/IPs/cloaks) instead of collecting two Vec<char> per call — it runs per-message (filter), per-user (extbans/tline) and per-channel (channelban); non-ASCII still uses the Unicode-lowercased fallback, and a proptest pins the two paths equal on ASCII reverse 2026-08-19 00:45:14 +00:00
  • 35bb901455 whoisport: report the port the user actually connected to (User.port, set at accept) instead of conf("bind")/conf("bind_tls") — those are Vec-valued so conf() returned only the LAST configured listener, giving every user the same wrong port on a multi-listener server reverse 2026-08-19 00:43:03 +00:00
  • 25702c9541 syslog: strip control chars (CR/LF) from the message before framing — a snotice carrying user-influenced text (nick/realname/quit reason) with an embedded newline could inject a forged syslog record; matches the CR/LF care the JSON log path already takes reverse 2026-08-19 00:42:30 +00:00
  • d9d5bd069b filehost: refuse to sign upload tokens when filehost_jwt_secret is unset/empty/"changeme" — the default fell open, signing with a world-known key so anyone could forge a server-trusted upload authorization; now it fails closed and tells the user to fix the config reverse 2026-08-19 00:42:10 +00:00
  • a09dfc74df auth: constant-time compare for VHOST and WEBIRC secrets — both used plain == on the config password, unlike oper/RPC/JWT secrets which already route through ct_eq; expose password_hash::ct_eq as the shared comparator and use it (usernames stay plain == — not secret) reverse 2026-08-19 00:41:47 +00:00
  • c72b966e0a mode: cap mode changes per MODE command (modes=, default 20) and advertise it as the MODES= ISUPPORT token — an uncapped modestring like MODE #c +bbbb… dispatched a handler per letter, each fanning out to the whole channel and every S2S link (amplification DoS); matches InspIRCd's MODES limit reverse 2026-08-19 00:40:58 +00:00
  • 11cec9fc36 s2s/xline: reject a malformed ADDLINE duration instead of coercing it to 0 (= a silent permanent ban), and make add_xline expiry saturating (n.saturating_add) so a peer sending duration=u64::MAX can't overflow-panic the debug build or wrap in release reverse 2026-08-19 00:39:40 +00:00
  • bbe4ee4567 http: bound spawn_http concurrency (http_max_concurrent, default 32) like spawn_crypto — it spawned one unbounded OS thread per call, so a pre-auth VERIFY/REGISTER flood could exhaust threads and hammer the accounts backend; at capacity the command now fails with TEMPORARILY_UNAVAILABLE instead reverse 2026-08-19 00:39:01 +00:00
  • 801614605f http: verify TLS certs by default + cap the response body — set_verify(NONE) unconditionally let a MITM read/forge the account-registration & captcha traffic (usernames, emails, plaintext passwords) POSTed to operator-configured https URLs; now the connector's cert+hostname check stays on (opt out with http_tls_verify=no), and read_to_end is bounded to 4 MiB so a hostile endpoint can't OOM the worker reverse 2026-08-19 00:37:50 +00:00
  • 6682227f81 denychans: bound redirect recursion — a badchan redirect re-enters Server::join (which re-runs denychans), so a redirect loop (#a->#b->#a) or a redirect into a broad badchan glob recursed until the single-threaded daemon stack-overflowed from one JOIN; cap the chain at 8 hops via a RedirDepth guard in ext reverse 2026-08-19 00:36:29 +00:00
  • a4f4c29a8a connectban: clamp the IPv6 keep-hextets to >=1 — connectban_ipv6cidr between 1 and 15 made keep==0, so the z-line glob became "*" and banned every IPv6 address on the internet (and bucketed all v6 clients into one key); mirrors the v4 clamp(1,4) reverse 2026-08-19 00:34:53 +00:00
  • c99f16f3e0 webirc: require a non-empty source-IP mask on a webirc block — an empty ipmask meant "any IP", so a maskless webirc=<password> block turned one shared secret into a full host/IP spoof (bypassing z-lines, DNSBL, GeoIP, cloak) for anyone who learned it; now the gateway's connecting IP must match the block's ipmask reverse 2026-08-19 00:34:25 +00:00
  • f56b68d6f5 resolver: close an off-path DNS spoof — connect() the UDP socket so the kernel drops replies from any IP but the nameserver, and use a CSPRNG per-query transaction id instead of the hardcoded 0x4543/0x4544 (which were in the public source, so rDNS/DNSBL answers could be forged with no guessing) reverse 2026-08-19 00:33:18 +00:00
  • 1763a95985 s2s: validate a message source actually lives behind the link it arrived on (source_behind) before applying remote JOIN/IJOIN/KICK/TOPIC/MODE/KILL/PRIVMSG — else a peer could forge ops/kicks/bans/topics/service-badged messages for users behind another link; NICK/QUIT/PART already guarded this, now the channel-state handlers do too reverse 2026-08-19 00:32:09 +00:00
  • 235c747c03 refactor: WEBIRC gateways and +G censor rules are named structs (WebircGateway/CensorRule) instead of positional tuples — self-documenting field access, no (_, g, _) index guessing; extends the OperBlock pattern reverse 2026-08-18 23:31:21 +00:00
  • c4456cf002 oper: TLS client-cert fingerprint login — oper block gains an optional fp=<sha256>; password=* means cert-only. Named OperBlock struct replaces the (name,pass,level) tuple. (Password login was never broken — verified live.) reverse 2026-08-18 22:55:07 +00:00
  • 853be58d18 perf: channel PRIVMSG/NOTICE fanout builds at most one line per capability profile (server-time/account-tag/message-tags) and shares it by Arc, instead of formatting a String per member — a big channel now allocates <=8 lines, not N reverse 2026-08-18 22:37:50 +00:00
  • d4dadf33e6 metrics: optional OpenMetrics/Prometheus endpoint (metrics_bind, off by default) — commands/messages/connects counters bumped inline via shared atomics, users/channels/servers/links gauges republished each tick; no event round-trip on the hot path reverse 2026-08-18 22:34:36 +00:00
  • 30754f08b5 refactor: define caps from one token=>field list via a macro that generates SUPPORTED_CAPS + the Caps struct + has/set — an advertised-but-unwired cap (or an unwired field) no longer compiles reverse 2026-08-18 22:29:47 +00:00
  • a3dc7b521f test: deterministic two-node S2S convergence simulator — real handshake + join/part/rejoin/FJOIN-TS-arbitration driven through actual code paths, proptest-randomised churn asserts both sides always converge; extract Server::part so the sim and the PART command share one path reverse 2026-08-18 22:24:19 +00:00
  • 621f06448d test: property-based fuzzing (proptest) for every untrusted-input parser — message line, PROXY header, WebSocket frame, regex engine, ban-mask, duration; asserts no-panic + round-trip/idempotence/bounds invariants reverse 2026-08-18 22:17:17 +00:00
  • cf2b157842 perf: to_channel shares one Arc<str> across all broadcast recipients instead of cloning the line per member (server-time members share a single time-tagged variant); single-recipient sends unchanged reverse 2026-08-18 20:30:07 +00:00
  • fc58113db9 tls: add opt-in pure-Rust rustls backend behind the TlsBackend trait (tls_backend = rustls; default stays openssl) — TLS1.3, CertFP via handshake-sig verify, SNI, REHASH reload; bump integration timeouts for loaded-host robustness reverse 2026-08-18 20:20:21 +00:00
  • 2565089666 gitignore runtime *.db state (reputation.db/permchannels.db) — untrack; they must never be committed reverse 2026-08-18 19:55:11 +00:00
  • 20b49add0b perf: mimalloc global allocator + aHash maps + memchr line framer + LTO/codegen-units=1 — ~29% faster channel fanout; and drop the bogus openssl+mio dependency whitelist from the guard (any perf crate is welcome now) reverse 2026-08-18 19:45:33 +00:00
  • 687c91638b remove some stupid text. reverse 2026-08-18 19:26:22 +00:00
  • 33a18b81cc channelban: leave the a: (account) extban mask verbatim — normalize_ban_mask was appending !*@* and breaking account matching reverse 2026-08-18 15:59:00 +00:00
  • bcd958d2d3 ircv3: close server-support-table gaps — BOT=B ISUPPORT, account-extban (a: matcher + ACCOUNTEXTBAN=a), draft/read-marker cap (gates MARKREAD sync), and no-implicit-names (suppress the post-JOIN NAMES burst) reverse 2026-08-18 15:56:59 +00:00
  • c9bd8e7492 channel-rename: implement IRCv3 draft/channel-rename — RENAME command + cap, in-place rename (RENAME for cap clients, PART/JOIN fallback for the rest), and S2S propagation reverse 2026-08-17 23:45:02 +00:00
  • 755e835baf snoop: only announce a client's exit if it registered — an unregistered liveness/health probe was spamming the +q snomask (regression from firing on_user_quit for all users) reverse 2026-08-17 22:49:29 +00:00
  • 244feb9f45 reactor: bound the blocking TLS handshake (proxied-TLS path) with tls_handshake_timeout so a stalled handshake can't pin a thread/socket reverse 2026-08-17 22:13:37 +00:00
  • 7563daf3a3 account_registration: GC the per-IP rate-limit table on the tick (an entry per distinct registering IP was never dropped) reverse 2026-08-17 22:13:37 +00:00
  • e28efb03e6 callerid: cap the auto-accept list like the explicit ACCEPT command reverse 2026-08-17 21:37:19 +00:00
  • fad66eaac2 chathistory: GC conversation keys idle past chathistory_maxage (default 7d) — the key set never shrank reverse 2026-08-17 21:37:19 +00:00
  • 5522e36125 reactor: reap proxy-pending connections that never send their PROXY header (were never timed out) reverse 2026-08-17 21:37:18 +00:00
  • de4cf9866d channel: scrub a departed user from every +i invite list (invited-then-quit leaked a Uid on persistent channels) reverse 2026-08-17 21:37:18 +00:00
  • 0da0906dc9 core: fire on_user_quit for unregistered users too — pre-registration module state (captcha Challenged/Verified) leaked one Uid per held-then-dropped bot reverse 2026-08-17 21:37:18 +00:00
  • f2e23fffa9 captcha: issue the challenge once per held client, not on every command they send reverse 2026-08-17 20:37:51 +00:00
  • d6cc813aad channel: reclaim departed-member +f flood counters and expired +J entries on the tick (slow high-churn leak) reverse 2026-08-17 20:37:51 +00:00
  • 92a3f5ba86 s2s: propagate CHGHOST/CHGIDENT host/ident changes to links (were applied locally only); inbound path uses a non-propagating variant to avoid a loop reverse 2026-08-17 19:38:58 +00:00
  • 73f8ff58ed s2s: enforce servprotect on a remote KILL and rank-vs-victim on a remote KICK (matching the local paths) reverse 2026-08-17 19:38:58 +00:00
  • da36d5c32a s2s: FJOIN TS arbitration wipes list modes+topic on loss and merges on equal TS; arbitrate remote-remote nick collisions (rewrite forward); IJOIN/FTOPIC channel-TS handling reverse 2026-08-17 19:32:18 +00:00
  • 4b86de3b62 registration: add a Hold verdict so captcha/challenge modules pend the client for the challenge instead of tearing the link down reverse 2026-08-17 19:06:17 +00:00
  • 99eb9c74f3 relaymsg: gate RELAYMSG on oper (it spoofs an arbitrary source nick), matching InspIRCd reverse 2026-08-17 19:06:17 +00:00
  • d6f27ac56c securitygroups: honor tls=no/account=no/etc. instead of inverting them to require reverse 2026-08-17 15:05:13 +00:00
  • edb10a6607 connectban: never collapse the ban mask to * on a sub-/8 CIDR (would z-line the whole network) reverse 2026-08-17 15:05:13 +00:00
  • 58d5a0e5a5 message: keep +U opmoderated messages out of CHATHISTORY/+H replay, and subject TAGMSG to the same PM gates (+c/+R/+z/+g/SILENCE) reverse 2026-08-17 15:05:13 +00:00
  • 45f4ee552d xline: remove masks case-insensitively, matching how they're enforced reverse 2026-08-17 14:52:38 +00:00
  • 480b5faea0 sanick/svsnick: allow a case-only rename (in-use check matched the target itself) reverse 2026-08-17 14:52:38 +00:00
  • 8ed2003546 callerid: scrub a departed/renamed nick from ACCEPT lists so it can't be reused to bypass +g reverse 2026-08-17 14:52:38 +00:00
  • c1b7ed6dda channel: count remote members for +l, and propagate TBAN expiry (-b) over S2S reverse 2026-08-17 14:52:38 +00:00
  • 713406870b who: hide +u auditorium and +D delayjoin members on WHO #chan, matching NAMES reverse 2026-08-17 14:52:38 +00:00
  • 3d7ee6b586 reputation: count remote/services channel members toward the minchanmembers gate (score was frozen) reverse 2026-08-17 13:27:58 +00:00
  • 62c0141362 test: services standard reply (SWSTDRPL) reaches a standard-replies client reverse 2026-08-17 13:12:31 +00:00
  • 5722640957 s2s: handle echo's metadata profile keys, standard replies, OPERTYPE and REDACT; emit ssl_cert + OPERTYPE reverse 2026-08-17 13:08:14 +00:00
  • 8f765bfba7 s2s: deliver server-sourced NOTICE/PRIVMSG (services SET SNOTICE) instead of dropping it reverse 2026-08-17 11:40:46 +00:00
  • 0f28083855 markread: persist account-keyed read markers to disk and restore them at startup reverse 2026-08-17 02:12:17 +00:00
  • 3f9aa8c6eb channel: cull an empty channel when a mode change (-P/-r) removes its last reason to persist reverse 2026-08-17 01:50:11 +00:00
  • b451ccbfd8 permchannels: persist +P channels (modes, topic, ts, list modes) to disk and restore them at startup reverse 2026-08-17 01:43:29 +00:00
  • 978f8f8f82 reputation: persist the score table on each bump/expire so restarts don't revert to a stale snapshot reverse 2026-08-17 01:19:57 +00:00
  • e10ea609ed s2s: apply inbound CHGHOST/CHGIDENT (services vhost) instead of dropping it reverse 2026-08-17 00:36:03 +00:00
  • 2ce6a5619c docs: note REHASH cert reload and the tls_sni per-hostname cert key reverse 2026-08-16 23:37:34 +00:00
  • 471fc00dfc tls: reload certs on REHASH (renewed cert applies without restart) and add per-hostname SNI via tls_sni reverse 2026-08-16 23:35:36 +00:00
  • a6293d5bbc docs: document cloak_method and the account/fingerprint/static cloak keys reverse 2026-08-16 19:52:27 +00:00
  • 6efbcb6db0 cloak: config-selectable methods (account, fingerprint, static) alongside the default hmac-sha256 reverse 2026-08-16 19:49:26 +00:00
  • 262699bf30 kick: route KICK of a remote channel member to its server and drop the local view reverse 2026-08-16 19:31:49 +00:00
  • 68b80c3f82 s2s: announce remote members arriving via FJOIN to local channel members reverse 2026-08-16 19:26:10 +00:00
  • ef84846267 invite: route INVITE for a remote target to its server and deliver inbound INVITE reverse 2026-08-16 19:11:57 +00:00
  • 559a102e48 add oper SQUIT command to disconnect a linked server by name reverse 2026-08-16 19:10:29 +00:00
  • d4a7043d10 s2s: resolve nick collisions by timestamp (force-rename loser to its UUID, SAVE) instead of killing; services always keep their nick reverse 2026-08-16 19:03:07 +00:00
  • 767ecb3471 whois: fold the channel list across multiple 319 lines to stay under 512 bytes reverse 2026-08-16 18:46:07 +00:00