fedserv/echoIRCd
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

connclass: cidr/parent/port/limit/globalmax + hashed/trusted-cert passwords, per-class recvq/sendq + fakelag, and rfc1413 ident

Browse source
This commit is contained in:
Jean Chevronnet 2026-08-10 18:46:42 +00:00
parent f5f888dbaa
commit f371ed0a18
14 changed files with 842 additions and 126 deletions
Download patch file Download diff file Expand all files Collapse all files

47
echoircd.conf.example
View file

@ -85,13 +85,46 @@ amu_target = both
# connflood = 5 10
# --- connectclass: per-class connection policy. Each line matches connecting
# clients by IP glob (+ optional TLS); first match wins, else global limits.
# Keys: allow=<ip glob>, deny=yes (reject), ssl=yes (TLS only), password=<pw>
# (client must PASS it), localmax=<n> (max connections per IP in this class),
# maxchans=<n>, pingfreq=<secs>, timeout=<secs> (registration), modes=<+modes>.
# connectclass = trusted allow=10.0.0.* maxchans=200 pingfreq=120
# connectclass = vpn allow=* localmax=2 maxchans=20 modes=+ix
# connectclass = banned allow=1.2.3.* deny=yes
# clients by IP/host mask (glob OR CIDR) and optional TLS/port; the first match
# wins, else the global limits apply. Masks are tested against the IP at connect
# and re-tested against the resolved host at registration. Keys:
# allow=<mask[,mask]> IP/host globs or CIDR (e.g. 10.0.0.0/8); any match hits
# deny=yes reject clients matching this class
# parent=<name> inherit this class's other settings (not allow/deny)
# requiressl=yes|trusted require TLS; "trusted" also requires a client cert
# password=<pw> client must send it via PASS; may be hashed
# hash=<algo> names the hash of a hashed password (md5/sha256/…)
# port=<p[,p]> only clients that connected to these listener ports
# localmax=<n> max connections per IP in this class (local server)
# globalmax=<n> max connections per IP across the whole network
# limit=<n> max total local users in this class
# maxchans=<n> max channels a member may join
# pingfreq=<secs> ping frequency; timeout=<secs> registration timeout
# modes=<+modes> usermodes set on connect
# recvq=<bytes> receive-queue cap; hardsendq=<bytes> send-queue cap
# softsendq=<bytes> send-queue level above which reads pause (backpressure)
# fakelag=no disconnect flooders instead of rate-limiting them
# penaltythreshold=<n> flood message cap; commandrate=<secs> flood window
# useident=yes do an ident (RFC1413) lookup for this class
# requireident=yes refuse clients whose ident can't be confirmed
# resolvehostnames=no skip reverse-DNS for this class
# maxconnwarn=yes snotice opers when a limit refuses a client
# (recvq/hardsendq/softsendq apply to plaintext clients; TLS clients and links
# use the global max_line/max_sendq below.)
# connectclass = trusted allow=10.0.0.0/8 maxchans=200 pingfreq=120 fakelag=no
# connectclass = secure allow=* requiressl=yes password=sha256:<hex> hash=sha256
# connectclass = vpn allow=* parent=trusted localmax=2 maxchans=20 modes=+ix
# connectclass = banned allow=1.2.3.0/24 deny=yes
# connectclass_required = yes # refuse clients that match no allow class (default no)
# --- global connection limits (per-class recvq/hardsendq/softsendq override these) ---
# max_line = 16384 # max bytes in one line / receive queue (default 16 KiB)
# max_sendq = 1048576 # max queued output before a slow client is dropped (1 MiB)
# --- ident (RFC1413): off by default; a connection class can also enable it ---
# useident = yes # look up every client's ident (adds connect latency)
# requireident = yes # refuse clients whose ident can't be confirmed
# ident_timeout = 5 # seconds to wait for the ident reply
# --- security groups: securitygroup = <name> [criteria...]
# criteria: public tls insecure account unregistered oper exclude-oper