diff --git a/api/src/lib.rs b/api/src/lib.rs index be2ae8a..bd6718d 100644 --- a/api/src/lib.rs +++ b/api/src/lib.rs @@ -973,6 +973,10 @@ pub trait Store { // Network defence level (OperServ DEFCON) and its derived registration freezes. fn defcon(&self) -> u8; fn set_defcon(&mut self, level: u8); + // OperServ SET READONLY: operator lockdown that refuses locally-authored + // writes. Ephemeral (resets on restart). + fn readonly(&self) -> bool; + fn set_readonly(&mut self, on: bool); fn registrations_frozen(&self) -> bool; fn channel_regs_frozen(&self) -> bool; // Whether account identity is owned externally (website); when true, IRC diff --git a/modules/operserv/src/lib.rs b/modules/operserv/src/lib.rs index 337803b..5afdbdc 100644 --- a/modules/operserv/src/lib.rs +++ b/modules/operserv/src/lib.rs @@ -39,6 +39,8 @@ mod logsearch; mod defcon; #[path = "shutdown.rs"] mod shutdown; +#[path = "set.rs"] +mod set; pub struct OperServ { pub uid: String, @@ -90,6 +92,7 @@ impl Service for OperServ { Some(cmd) if cmd.eq_ignore_ascii_case("CHANKILL") => chankill::handle(me, from, args, ctx, net, db), Some(cmd) if cmd.eq_ignore_ascii_case("LOGSEARCH") => logsearch::handle(me, from, args, ctx, net), Some(cmd) if cmd.eq_ignore_ascii_case("DEFCON") => defcon::handle(me, from, args, ctx, db), + Some(cmd) if cmd.eq_ignore_ascii_case("SET") => set::handle(me, from, args, ctx, db), Some(cmd) if cmd.eq_ignore_ascii_case("SHUTDOWN") => shutdown::handle(me, from, false, args, ctx), Some(cmd) if cmd.eq_ignore_ascii_case("RESTART") => shutdown::handle(me, from, true, args, ctx), Some(cmd) if cmd.eq_ignore_ascii_case("HELP") => echo_api::help(me, from, ctx, BLURB, TOPICS, args.get(1).copied()), @@ -125,6 +128,7 @@ const TOPICS: &[HelpEntry] = &[ HelpEntry { cmd: "JUPE", summary: "jupe a server name", detail: "Syntax: \x02JUPE [reason] | JUPE DEL | JUPE LIST\x02\nBlocks a server name from linking." }, HelpEntry { cmd: "LOGSEARCH", summary: "search the action log", detail: "Syntax: \x02LOGSEARCH [pattern]\x02\nSearches the incident and action log." }, HelpEntry { cmd: "DEFCON", summary: "network defence level", detail: "Syntax: \x02DEFCON [1-5]\x02\nShows or sets the network defence level (5 = normal, 1 = lockdown)." }, + HelpEntry { cmd: "SET", summary: "services-wide settings", detail: "Syntax: \x02SET READONLY {ON|OFF}\x02\nToggles read-only lockdown: while on, no registrations or changes are accepted." }, HelpEntry { cmd: "SHUTDOWN", summary: "stop services", detail: "Syntax: \x02SHUTDOWN [reason]\x02\nStops the services process. It stays down until restarted." }, HelpEntry { cmd: "RESTART", summary: "restart services", detail: "Syntax: \x02RESTART [reason]\x02\nRestarts the services process (a supervisor respawns it)." }, ]; diff --git a/modules/operserv/src/set.rs b/modules/operserv/src/set.rs new file mode 100644 index 0000000..f37680c --- /dev/null +++ b/modules/operserv/src/set.rs @@ -0,0 +1,35 @@ +use echo_api::{Priv, Sender, ServiceCtx, Store}; + +// SET READONLY {ON|OFF}: put services into (or out of) read-only lockdown. +// While on, no new registrations or changes are accepted; existing data and +// gossip replication keep working. Admin-only. No argument reports the state. +pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) { + if !from.privs.has(Priv::Admin) { + ctx.notice(me, from.uid, "Access denied — SET is for services operators."); + return; + } + match args.get(1).map(|s| s.to_ascii_uppercase()).as_deref() { + Some("READONLY") => { + let Some(on) = args.get(2).and_then(|s| parse_toggle(s)) else { + let state = if db.readonly() { "ON" } else { "OFF" }; + ctx.notice(me, from.uid, format!("READONLY is currently \x02{state}\x02. Syntax: SET READONLY {{ON|OFF}}")); + return; + }; + db.set_readonly(on); + if on { + ctx.notice(me, from.uid, "Services are now \x02read-only\x02 — no changes will be accepted."); + } else { + ctx.notice(me, from.uid, "Services are no longer read-only."); + } + } + _ => ctx.notice(me, from.uid, "Syntax: SET READONLY {ON|OFF}"), + } +} + +fn parse_toggle(s: &str) -> Option { + match s.to_ascii_uppercase().as_str() { + "ON" | "TRUE" | "YES" => Some(true), + "OFF" | "FALSE" | "NO" => Some(false), + _ => None, + } +} diff --git a/src/engine/db/mod.rs b/src/engine/db/mod.rs index fe561b9..a25c1f2 100644 --- a/src/engine/db/mod.rs +++ b/src/engine/db/mod.rs @@ -680,11 +680,15 @@ pub struct EventLog { versions: HashMap, // per-origin highest seq applied (version vector) entries: Vec, // full log, kept so peers can pull what they lack outbound: Option>, // push newly committed entries to peers + // Operator lockdown (OperServ SET READONLY): while set, locally-authored + // writes are refused. Ephemeral — it resets on restart and never persists, + // and gossip ingestion is unaffected so a read-only node stays in sync. + readonly: bool, } impl EventLog { fn open(path: PathBuf, origin: String) -> (Self, Vec) { - let mut log = Self { path, origin, lamport: 0, versions: HashMap::new(), entries: Vec::new(), outbound: None }; + let mut log = Self { path, origin, lamport: 0, versions: HashMap::new(), entries: Vec::new(), outbound: None, readonly: false }; if let Ok(data) = std::fs::read_to_string(&log.path) { for line in data.lines().filter(|l| !l.trim().is_empty()) { match serde_json::from_str::(line) { @@ -719,6 +723,10 @@ impl EventLog { // Lamport clock and are pushed to peers; local (channel) events are written // for restart but never gossiped and carry no version-vector identity. fn append(&mut self, event: Event) -> std::io::Result<()> { + // Operator lockdown refuses every locally-authored write at this one seam. + if self.readonly { + return Err(std::io::Error::new(std::io::ErrorKind::PermissionDenied, "services are read-only")); + } let global = event.scope() == Scope::Global; let entry = if global { self.lamport += 1; diff --git a/src/engine/db/network.rs b/src/engine/db/network.rs index 01a676a..e6ac001 100644 --- a/src/engine/db/network.rs +++ b/src/engine/db/network.rs @@ -197,6 +197,17 @@ impl Db { self.defcon = level.clamp(1, 5); } + /// Whether the services are in operator read-only lockdown. + pub fn readonly(&self) -> bool { + self.log.readonly + } + + /// Enter or leave read-only lockdown: while on, locally-authored writes are + /// refused. Ephemeral (never persisted); gossip ingestion is unaffected. + pub fn set_readonly(&mut self, on: bool) { + self.log.readonly = on; + } + /// Whether new nick/account registrations are frozen (defcon 3 or lower). pub fn registrations_frozen(&self) -> bool { self.defcon <= 3 diff --git a/src/engine/db/store.rs b/src/engine/db/store.rs index ea610c8..afb3fdf 100644 --- a/src/engine/db/store.rs +++ b/src/engine/db/store.rs @@ -228,6 +228,12 @@ impl Store for Db { fn set_defcon(&mut self, level: u8) { Db::set_defcon(self, level) } + fn readonly(&self) -> bool { + Db::readonly(self) + } + fn set_readonly(&mut self, on: bool) { + Db::set_readonly(self, on) + } fn registrations_frozen(&self) -> bool { Db::registrations_frozen(self) } diff --git a/src/engine/register.rs b/src/engine/register.rs index c2fb2de..7f8a4bf 100644 --- a/src/engine/register.rs +++ b/src/engine/register.rs @@ -200,7 +200,7 @@ impl Engine { if self.db.external_accounts() { return Some(reg_reply(reply, RegOutcome::External, account)); } - if self.db.registrations_frozen() { + if self.db.registrations_frozen() || self.db.readonly() { return Some(reg_reply(reply, RegOutcome::Frozen, account)); } if self.db.exists(account) { diff --git a/src/engine/tests.rs b/src/engine/tests.rs index 801f2a1..a36bacf 100644 --- a/src/engine/tests.rs +++ b/src/engine/tests.rs @@ -1155,6 +1155,48 @@ assert!(notice(&e.handle(NetEvent::Privmsg { from: "000AAAAAD".into(), to: "42SAAAAAH".into(), text: "FORBID ADD NICK x y".into() }), "Access denied"), "non-oper refused"); } + // OperServ SET READONLY locks out writes: while on, a channel can't be + // registered; turning it off restores normal service. + #[test] + fn operserv_set_readonly_blocks_writes() { + use echo_chanserv::ChanServ; + use echo_nickserv::NickServ; + use echo_operserv::OperServ; + let path = std::env::temp_dir().join("echo-osreadonly.jsonl"); + let _ = std::fs::remove_file(&path); + let mut db = Db::open(&path, "42S"); + db.scram_iterations = 4096; + db.register("boss", "pw", None).unwrap(); + let mut e = Engine::new( + vec![ + Box::new(NickServ { uid: "42SAAAAAA".into(), guest_nick: "Guest".into(), guest_seq: 0 }), + Box::new(ChanServ { uid: "42SAAAAAB".into() }), + Box::new(OperServ { uid: "42SAAAAAH".into() }), + ], + db, + ); + let mut opers = std::collections::HashMap::new(); + opers.insert("boss".to_string(), Privs::default().with(echo_api::Priv::Admin)); + e.set_opers(opers); + e.handle(NetEvent::UserConnect { uid: "000AAAAAB".into(), nick: "boss".into(), host: "h".into(), ip: "0.0.0.0".into() }); + e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAA".into(), text: "IDENTIFY pw".into() }); + e.handle(NetEvent::Join { uid: "000AAAAAB".into(), channel: "#c".into(), op: true }); + let os = |e: &mut Engine, t: &str| e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAH".into(), text: t.into() }); + let cs = |e: &mut Engine, t: &str| e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAB".into(), text: t.into() }); + let notice = |out: &[NetAction], n: &str| out.iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains(n))); + + assert!(notice(&os(&mut e, "SET READONLY ON"), "read-only"), "readonly enabled"); + assert!(e.db.readonly(), "flag set"); + let out = cs(&mut e, "REGISTER #c"); + assert!(!notice(&out, "now registered"), "register blocked while read-only: {out:?}"); + assert!(e.db.channel("#c").is_none(), "no channel written"); + + assert!(notice(&os(&mut e, "SET READONLY OFF"), "no longer"), "readonly cleared"); + assert!(!e.db.readonly(), "flag cleared"); + assert!(notice(&cs(&mut e, "REGISTER #c"), "now registered"), "register works again"); + assert!(e.db.channel("#c").is_some(), "channel written"); + } + // OperServ SHUTDOWN/RESTART (admin) emit a Shutdown action (which the link // layer turns into a process exit) and are refused to non-operators. #[test]