echo/echoIRCd
1
1
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

Commit graph

  • e57e4c3a6a names: fold the member list across multiple 353 replies to stay under 512 bytes reverse 2026-08-16 18:45:12 +00:00
  • 94f57608f7 mode: require half-op to view the autoop/exemptchanops/filter lists reverse 2026-08-16 18:44:08 +00:00
  • dadbff91d8 xline: accept the durationless KLINE/GLINE form (mask :reason) instead of eating the reason reverse 2026-08-16 18:21:32 +00:00
  • 5046083608 add HELP command with a built-in index and per-topic help (704/705/706) reverse 2026-08-16 18:20:57 +00:00
  • ba9d62b172 cap: advertise IRCv3 sts policy (sts_duration/sts_port/sts_preload) for TLS upgrade reverse 2026-08-16 18:19:04 +00:00
  • 4ce500e525 cap: fold CAP LS 302 into multiple continuation lines to stay under 512 bytes reverse 2026-08-16 18:17:29 +00:00
  • 1ab643c870 s2s: timestamp arbitration for fjoin (lower TS wins — strip or wipe losing status), fmode and ftopic (drop changes stamped newer than ours) reverse 2026-08-16 18:06:03 +00:00
  • 7908fe50b0 s2s: propagate x-lines (ADDLINE/DELLINE) — apply from peers, announce local ones, burst on link reverse 2026-08-16 18:01:52 +00:00
  • 98fb848b8c s2s: route and apply KILL across the link (inbound handler + remote-target routing) reverse 2026-08-16 17:57:50 +00:00
  • 579c321670 channels/whois: validate +k/+l, cap and case-fold ban lists, honour -n for externals, hide +s/+p/+i from whois/who/names, 301 in whois, conf-key the join/nickflood lockout reverse 2026-08-16 17:56:24 +00:00
  • 4028cd3c84 s2s: verify NICK/QUIT/PART source is reached via the link it arrived on reverse 2026-08-16 17:54:20 +00:00
  • e87c9fd9ca s2s: reject malformed or duplicate UIDs on introduction reverse 2026-08-16 17:50:25 +00:00
  • 9ff0d8c629 s2s: apply METADATA accountname only from a services source reverse 2026-08-16 17:48:21 +00:00
  • 04423388d5 services: reword uline/service code comments, drop external daemon references reverse 2026-08-16 14:12:18 +00:00
  • 36b8a31a9a services: name the service message tag @echo/services (the project), not a foreign/author vendor prefix reverse 2026-08-16 14:00:17 +00:00
  • d012623dff services: add server-level uline/is_service flag and gate the service WHOIS line, echo/services tag, MAP/LINKS hide and SVS* on it reverse 2026-08-16 13:43:17 +00:00
  • 64d3bfc003 test: cover IJOIN status-mode application (bot joins +ao) — regression guard for the S2S ijoin handler that previously had none reverse 2026-08-16 13:16:09 +00:00
  • 636da13a8a mode: register +r as a services-only channel mode so a user MODE +r gets a clean rejection instead of 472 unknown-mode (chanserv still sets it via mode_sudo) reverse 2026-08-16 03:10:15 +00:00
  • b7600ee5aa add +k servprotect umode (server-set-only, advertised in 004/umodes): blocks KILL, KICK and SA* on a network service; tracked for remote services too reverse 2026-08-16 03:00:25 +00:00
  • 91022cffe8 whois: track remote users' umodes from UID; show 335 (is a bot) for remote +B services/bots and 379 modes to opers reverse 2026-08-15 23:50:07 +00:00
  • 7d57e4ed34 connectban: never flood-ban loopback (127.0.0.1/::1) and add a connectban_exempt glob/cidr list reverse 2026-08-15 23:25:16 +00:00
  • 59b0439b79 whois: append the snomask to the 379 modes line for opers (is using modes <umodes> +<snomask>), matching the standard format reverse 2026-08-15 17:17:12 +00:00
  • 546f6279e7 snomasks: make +s a parametric snomask mode with the standard category letters (acdfgjklnoqrtuvwx), route each server notice by category, RPL_SNOMASKIS 008; opers default to all and narrow with +s -c etc. reverse 2026-08-15 17:06:14 +00:00
  • 309201d7fb whois: add 307 (is a registered nick) for identified users and 379 (is using modes) for opers/self reverse 2026-08-15 16:46:10 +00:00
  • 35af95fd0f harden: connclass clone-cap at register, ws control-frame limits, uuid recycle-skip, json-escape extjwt/filehost claims, metadata value/key caps, cloak numeric-dotted leak, relaymsg remote-nick, rpc set_oper block validation, isupport 13-token split, multi-hop privmsg routing, connectdelay=0 reverse 2026-08-15 16:27:11 +00:00
  • e935ee7002 harden: fix reachable panics (parse_duration/parse_iso/dechunk char-boundary+overflow), s2s netburst key/limit loss, rpc set_nick/set_vhost/notice injection, webirc rehash reload, panic-state reset, ws line cap, remote nick collision, per-conn state leaks reverse 2026-08-15 15:02:36 +00:00
  • 3fa9737ccb link: stop services re-locking +r on every join — track the registered channel mode, keep +r channels alive when empty, use ijoin not fjoin for incremental joins, and consume s2s channel-mode params through the registry reverse 2026-08-15 13:20:04 +00:00
  • 62f901bdc8 sasl: wrap the s2s sasl relay in encap (client/agent/mode/data) so services drive authenticate, account via metadata reverse 2026-08-15 12:04:09 +00:00
  • 1c8799d785 link: rework s2s wire format to the standard v4 server protocol (10-field uid, letters-comma fjoin, ijoin, timestamped fmode, ftopic, uuid kick) so external services link reverse 2026-08-15 11:51:18 +00:00
  • f921c2eb9c docs: document all 85 previously-missing config keys in the example — on-connect (connbanner/autojoin/umodes), account registration, captcha gates, antirandom/blockamsg/connectban/hashident, restrict* + securelist + denychans + channames + maphide, and customtitle/extjwt/filehost/randquote reverse 2026-08-15 01:37:16 +00:00
  • 0ace39c882 listeners: make bind/bind_tls/bind_server repeatable (multiple addresses/ports) and normalize IPv4-mapped IPv6 peers back to plain IPv4 — a single [::] bind now serves IPv4+IPv6 with clean v4 addresses reverse 2026-08-15 01:12:37 +00:00
  • 08ed18bb96 deploy: Let's Encrypt deploy-hook — installs the renewed cert into echoircd's tls/ (readable by the daemon user) and restarts only when it changed; symlink into certbot renewal-hooks reverse 2026-08-15 01:12:37 +00:00
  • dae0cb985b modes: render the full channel mode set in MODE queries — +P/Q/A/U/D and params +B/J/d/K were set but never shown reverse 2026-08-14 17:42:34 +00:00
  • 5bf2116786 modes: close channel-mode privilege gaps — +P (permanent) and +O (oper-only join) are now IRC-oper-only, and adding a +w autoop entry requires the rank the granted prefix needs (a half-op could otherwise auto-op itself) reverse 2026-08-14 17:42:34 +00:00
  • 370b7bc57a usermodes: gate the oper-only flags (+W showwhois, +H hideoper, +h helpop, +s snomask) behind is_oper — a non-oper who tries to set one now gets 481 instead of the mode silently sticking or failing without a reason reverse 2026-08-14 17:04:28 +00:00
  • 40d868f4cf liveness: probe with a pre-registration PING/PONG instead of a full NICK/USER register — proves acceptor+core liveness without creating a client session, so it no longer spams the snotice stream with livecheck connect/quit notices reverse 2026-08-14 14:07:59 +00:00
  • d795d1a59c docs: add a module-developer API reference (docs/api/) — Command/Module/ChanMode/UserMode traits, the Server API surface, per-entity Extensible state, and a first-module tutorial reverse 2026-08-13 02:55:56 +00:00
  • bd054f7721 docs: add a full docs/ manual (architecture, configuration, modes, operators, linking, ircv3, anti-abuse, deployment, building) and refresh the README for the reactor pool + TLS-in-reactor + resilience reverse 2026-08-13 01:00:39 +00:00
  • d8a963d0f9 deploy: add firewalld direct-rule flood-mitigation script (per-IP hashlimit on the IRC ports); gitignore the pinned bin/ artifact reverse 2026-08-12 18:03:07 +00:00
  • be97089dfa deploy: use firewalld direct-rule for the per-IP flood mitigation (this box runs firewalld — a raw iptables rule would be flushed on reload); replaces the plain-iptables draft reverse 2026-08-12 18:02:45 +00:00
  • df160801c8 deploy: iptables hashlimit flood-mitigation script (per-source-IP rate limit on the IRC client ports; policy-accept, loopback-exempt, idempotent add/del) — kernel-layer defense-in-depth, not applied automatically reverse 2026-08-12 17:55:46 +00:00
  • 41826c8e1a socketengine: per-IP accept-rate limiter (token bucket, accept_rate/accept_burst, off by default) — drops connection-churn floods at the accept edge before any state is allocated; exempts trusted proxies and server links reverse 2026-08-12 17:05:24 +00:00
  • 2aaa5ac091 deploy: persistent systemd unit running a pinned release binary with Restart=on-failure + boot enable, plus a liveness timer that restarts the daemon if a register round-trip stops answering reverse 2026-08-12 16:01:58 +00:00
  • b022189fa5 core: write persisted snapshots atomically (temp + rename) so a crash mid-write can't leave a truncated reputation/metadata/xline file reverse 2026-08-12 15:57:43 +00:00
  • 859450fb6c tests: add end-to-end integration suite (spawns the binary on ephemeral ports; kills by PID, never by name) covering reactor-pool cross-worker delivery, TLS-in-reactor handshake + cross-transport + secure marker, stalled-handshake reap, and nick collision reverse 2026-08-12 15:56:42 +00:00
  • d8d57511ab tls: send a close_notify on close for established TLS sessions instead of just dropping the socket, so clients see a clean shutdown not a truncation error reverse 2026-08-12 15:53:10 +00:00
  • 59e18b0205 socketengine: reap TLS conns that stall mid-handshake (tls_handshake_timeout, default 15s) — a connection that opens the TLS port but never negotiates no longer leaks a slot reverse 2026-08-12 15:51:45 +00:00
  • e74763619b docs: document the io_threads reactor-pool knob in the example config reverse 2026-08-12 14:03:24 +00:00
  • 02ae92e16d socketengine: run direct TLS in the reactor pool — non-blocking handshake + crypto in the worker threads (Sock::Tls, TlsSession), unifying the client I/O model and spreading TLS work across cores; proxied TLS + links keep the thread path reverse 2026-08-12 14:03:00 +00:00
  • 7c166e3aae socketengine: plaintext reactor pool — an acceptor round-robins connections across N worker reactors (io_threads, auto=cores) feeding the single lock-free core, so per-connection I/O scales across cores reverse 2026-08-12 13:42:08 +00:00
  • 4ba8d5bce6 xline: persist server bans via the off-core disk writer too, so a KLINE/GLINE burst can't stall the event loop on a slow disk reverse 2026-08-12 13:20:16 +00:00
  • e91b64a4db resilience: isolate per-connection panics in the plaintext reactor (catch_unwind read/write -> drop just that conn) and log worker-thread panics instead of vanishing silently reverse 2026-08-12 13:19:25 +00:00
  • 145a01b2c2 core: Server::disk_write — coalescing off-core snapshot writer; reputation/metadata saves no longer block the event loop on a slow disk reverse 2026-08-12 13:16:15 +00:00
  • c231c6b8ef connclass: verify a KDF class password off the core thread with a registration hold (auth_pending + Event::ConnclassAuth) — connect floods can't freeze the server reverse 2026-08-12 13:13:27 +00:00
  • 2b3495be65 customtitle: verify a KDF /TITLE password off the core thread (Event::TitleAuth) — /TITLE spam can't freeze the server reverse 2026-08-12 13:07:28 +00:00
  • 7cb58586b4 core: generic spawn_crypto helper; offload all slow KDF hashing (OPER pbkdf2 too, and MKPASSWD) off the core thread reverse 2026-08-12 13:05:29 +00:00
  • e246699fef oper: verify bcrypt passwords on a worker thread (Event::OperAuth), bounded — a bcrypt OPER no longer freezes the core, closing the OPER-spam DoS; fast hashes stay inline reverse 2026-08-12 12:46:52 +00:00
  • 6795243d5f core: slow-command snotice (slow_command_ms) + a watchdog thread (watchdog_ms) so a blocked core thread is visible instead of a silent freeze reverse 2026-08-12 12:43:41 +00:00
  • 8309b851f2 core: wrap each event handler in catch_unwind so one panicking command can't take the whole single-threaded server down reverse 2026-08-12 12:41:16 +00:00
  • b40c523b87 customprefix: data-driven prefix engine — define arbitrary new prefix modes (letter/prefix/rank/ranktoset/ranktounset/depriv), ranks re-spaced x10; built-in tiers + defaults unchanged reverse 2026-08-11 19:46:07 +00:00
  • d35a2071a6 docs: document abbreviation + customprefix in the config example reverse 2026-08-11 19:21:17 +00:00
  • 9f3081cb38 customprefix: add ranktoset/ranktounset/depriv per tier (InspIRCd change= parity for existing prefixes) reverse 2026-08-11 19:20:27 +00:00
  • 749a1c3b69 customprefix: config-override channel-prefix sigils per tier (customprefix = <tier> <sigil>); PREFIX/NAMES/FJOIN consistent reverse 2026-08-11 19:01:45 +00:00
  • b4186ae08d namedmodes: PROP command sets/queries channel modes by long name (op, moderated, limit, ...) reverse 2026-08-11 18:55:14 +00:00
  • 3b43abc88a operlevels: oper = <name> <pass> <level>; a lower-level oper can't KILL a higher-level one reverse 2026-08-11 18:50:12 +00:00
  • 3b2f30965a abbreviation: a unique command-prefix resolves to its full command (abbreviation = yes) reverse 2026-08-11 18:46:16 +00:00
  • 72ca89af26 log_json: append the server-notice/log stream to a file as JSONL (log_json = <path>) reverse 2026-08-11 18:44:48 +00:00
  • 6ffd6a57bc proxy: forward v2 TLS TLVs (PP2_TYPE_SSL/CERTFP) so plaintext clients behind a TLS-terminating proxy show secure+certfp; restore ws_trust_proxy to the config example reverse 2026-08-11 17:13:32 +00:00
  • 4f6c0ded48 websocket: add ws_defaultmode (text/binary/reject), ws_proxyranges (glob/CIDR X-Real-IP/XFF trust), ws_allowmissingorigin, ws_nativeping reverse 2026-08-11 16:10:09 +00:00
  • 87a683dbd2 proxy: HAProxy PROXY protocol v1+v2 on the plaintext (reactor) and TLS listeners; trusted via proxy=<glob>, rewrites the client IP before connect checks reverse 2026-08-11 11:43:08 +00:00
  • d68f3ce97e bcrypt: native $2b$ hashing (blowfish + eksblowfish; pi constants via exact fixed-point machin) wired into password_hash + MKPASSWD reverse 2026-08-11 11:32:35 +00:00
  • 5ea543188d syslog: tee the server-notice/log stream to syslog (native /dev/log unix datagram or udp host:port) reverse 2026-08-11 11:21:09 +00:00
  • 56d3774647 rline: native regex engine (thompson nfa, no backtracking) + RLINE regex bans (registration/enforce/stats R/matchonnickchange) reverse 2026-08-10 21:48:52 +00:00
  • b76fbfdb79 services: SVSHOLD nick reservation, SVSTOPIC, SVSOPER, SVSCMODE over s2s (+ stats S) reverse 2026-08-10 21:00:23 +00:00
  • f371ed0a18 connclass: cidr/parent/port/limit/globalmax + hashed/trusted-cert passwords, per-class recvq/sendq + fakelag, and rfc1413 ident reverse 2026-08-10 18:46:42 +00:00
  • f5f888dbaa connectclass: per-class connection policy (allow/deny, localmax, password, maxchans, pingfreq, timeout, modes) + PASS reverse 2026-08-10 17:49:12 +00:00
  • 02b2061561 readme: polished front-page layout — badges, about, grouped features, quick start, links reverse 2026-08-10 12:16:08 +00:00
  • 75de56f532 readme: cover the full feature set (modes, ircv3, services, s2s, geoip, rpc, transports) reverse 2026-08-10 11:36:38 +00:00
  • 1dd7f77ca8 operprefix + ojoin: server oper prefix (!/mode y, above owner) auto-granted to opers + OJOIN command reverse 2026-08-10 10:05:37 +00:00
  • 8ebb106f97 hidemode: hide configured mode changes from members below a rank (per-recipient MODE) reverse 2026-08-10 09:41:20 +00:00
  • 06883ced9f extbanbanlist: matching extban b:#chan (share another channel's ban list) reverse 2026-08-10 09:37:51 +00:00
  • 0d5717c585 relaymsg: RELAYMSG + draft/relaymsg cap for bridge-style spoofed-nick channel messages reverse 2026-08-10 09:06:30 +00:00
  • 71d6e7441b helpmode: oper-settable user mode +h (helpop) shown in whois reverse 2026-08-10 09:01:38 +00:00
  • 512185d6df globops + autodrop: /GLOBOPS oper broadcast and pre-registration scanner drop reverse 2026-08-10 08:58:15 +00:00
  • ab4d87488b hidelist: restrict list-mode viewing by rank; allow members to view lists by default (parity) reverse 2026-08-10 08:24:37 +00:00
  • 9d84a66437 autoop: +w <prefix>:<mask> channel list mode grants status on join reverse 2026-08-10 08:18:07 +00:00
  • 87e3d5436d chanlog: mirror the oper server-notice stream into a configured channel reverse 2026-08-09 23:19:29 +00:00
  • 1a53c5ae5a banredirect: +b mask$#chan bounces a banned user to another channel (loop-guarded) reverse 2026-08-09 23:17:32 +00:00
  • 349200d695 solvemsg: arithmetic challenge before an un-vouched user's PMs deliver (anti-spam) reverse 2026-08-09 23:11:57 +00:00
  • 0bf6992d8a dccallow: block unwanted DCC sends/chat + DCCALLOW +/-/LIST allow-list command reverse 2026-08-09 23:08:25 +00:00
  • 61954f6c5c conn_waitpong: optionally require a PONG cookie before registration (anti-bot) reverse 2026-08-09 23:04:14 +00:00
  • e0d849b4c9 showfile: serve a text file as its own command (e.g. /RULES), config-driven like aliases reverse 2026-08-09 23:00:07 +00:00
  • 61584a545b config: make flood/dnsbl/multiline/chathistory/extjwt limits + nick/chan/watch/monitor/silence/whowas/timeouts configurable (no hardcoded options) reverse 2026-08-09 22:52:28 +00:00
  • 1969218d3f geoip: show full country name (country.names.en) in whois and GEOIP, keep iso for geoban reverse 2026-08-09 22:05:23 +00:00
  • 7a99f49ca4 geoip: native maxmind .mmdb reader, G: geoban extban, GEOIP command, whois country reverse 2026-08-09 21:43:57 +00:00
  • aa384d56f2 modules: port customtitle (TITLE vanity-title command + WHOIS line + vhost) reverse 2026-08-09 20:13:07 +00:00
  • e7976a76d3 modules: port rmode (bulk-remove channel list-mode entries) reverse 2026-08-09 20:11:09 +00:00
  • 3186af07e8 modules: port maphide and tline reverse 2026-08-09 20:06:54 +00:00
  • 140554719b modules: port randquote, disable, restrictchans, channames reverse 2026-08-09 20:03:47 +00:00
  • bda7eecfc2 modules: port ircv3_extended_isupport (draft/extended-isupport cap + ISUPPORT command, draft/isupport batch) reverse 2026-08-09 19:52:52 +00:00