|
|
a4f4c29a8a
|
connectban: clamp the IPv6 keep-hextets to >=1 — connectban_ipv6cidr between 1 and 15 made keep==0, so the z-line glob became "*" and banned every IPv6 address on the internet (and bucketed all v6 clients into one key); mirrors the v4 clamp(1,4)
|
2026-08-19 00:34:53 +00:00 |
|
|
|
c99f16f3e0
|
webirc: require a non-empty source-IP mask on a webirc block — an empty ipmask meant "any IP", so a maskless webirc=<password> block turned one shared secret into a full host/IP spoof (bypassing z-lines, DNSBL, GeoIP, cloak) for anyone who learned it; now the gateway's connecting IP must match the block's ipmask
|
2026-08-19 00:34:25 +00:00 |
|
|
|
f56b68d6f5
|
resolver: close an off-path DNS spoof — connect() the UDP socket so the kernel drops replies from any IP but the nameserver, and use a CSPRNG per-query transaction id instead of the hardcoded 0x4543/0x4544 (which were in the public source, so rDNS/DNSBL answers could be forged with no guessing)
|
2026-08-19 00:33:18 +00:00 |
|
|
|
1763a95985
|
s2s: validate a message source actually lives behind the link it arrived on (source_behind) before applying remote JOIN/IJOIN/KICK/TOPIC/MODE/KILL/PRIVMSG — else a peer could forge ops/kicks/bans/topics/service-badged messages for users behind another link; NICK/QUIT/PART already guarded this, now the channel-state handlers do too
|
2026-08-19 00:32:09 +00:00 |
|
|
|
235c747c03
|
refactor: WEBIRC gateways and +G censor rules are named structs (WebircGateway/CensorRule) instead of positional tuples — self-documenting field access, no (_, g, _) index guessing; extends the OperBlock pattern
|
2026-08-18 23:31:21 +00:00 |
|
|
|
c4456cf002
|
oper: TLS client-cert fingerprint login — oper block gains an optional fp=<sha256>; password=* means cert-only. Named OperBlock struct replaces the (name,pass,level) tuple. (Password login was never broken — verified live.)
|
2026-08-18 22:55:07 +00:00 |
|
|
|
853be58d18
|
perf: channel PRIVMSG/NOTICE fanout builds at most one line per capability profile (server-time/account-tag/message-tags) and shares it by Arc, instead of formatting a String per member — a big channel now allocates <=8 lines, not N
|
2026-08-18 22:37:50 +00:00 |
|
|
|
d4dadf33e6
|
metrics: optional OpenMetrics/Prometheus endpoint (metrics_bind, off by default) — commands/messages/connects counters bumped inline via shared atomics, users/channels/servers/links gauges republished each tick; no event round-trip on the hot path
|
2026-08-18 22:34:36 +00:00 |
|
|
|
30754f08b5
|
refactor: define caps from one token=>field list via a macro that generates SUPPORTED_CAPS + the Caps struct + has/set — an advertised-but-unwired cap (or an unwired field) no longer compiles
|
2026-08-18 22:29:47 +00:00 |
|
|
|
a3dc7b521f
|
test: deterministic two-node S2S convergence simulator — real handshake + join/part/rejoin/FJOIN-TS-arbitration driven through actual code paths, proptest-randomised churn asserts both sides always converge; extract Server::part so the sim and the PART command share one path
|
2026-08-18 22:24:19 +00:00 |
|
|
|
621f06448d
|
test: property-based fuzzing (proptest) for every untrusted-input parser — message line, PROXY header, WebSocket frame, regex engine, ban-mask, duration; asserts no-panic + round-trip/idempotence/bounds invariants
|
2026-08-18 22:17:17 +00:00 |
|
|
|
cf2b157842
|
perf: to_channel shares one Arc<str> across all broadcast recipients instead of cloning the line per member (server-time members share a single time-tagged variant); single-recipient sends unchanged
|
2026-08-18 20:30:07 +00:00 |
|
|
|
fc58113db9
|
tls: add opt-in pure-Rust rustls backend behind the TlsBackend trait (tls_backend = rustls; default stays openssl) — TLS1.3, CertFP via handshake-sig verify, SNI, REHASH reload; bump integration timeouts for loaded-host robustness
|
2026-08-18 20:20:21 +00:00 |
|
|
|
2565089666
|
gitignore runtime *.db state (reputation.db/permchannels.db) — untrack; they must never be committed
|
2026-08-18 19:55:11 +00:00 |
|
|
|
20b49add0b
|
perf: mimalloc global allocator + aHash maps + memchr line framer + LTO/codegen-units=1 — ~29% faster channel fanout; and drop the bogus openssl+mio dependency whitelist from the guard (any perf crate is welcome now)
|
2026-08-18 19:45:33 +00:00 |
|
|
|
687c91638b
|
remove some stupid text.
|
2026-08-18 19:26:22 +00:00 |
|
|
|
33a18b81cc
|
channelban: leave the a: (account) extban mask verbatim — normalize_ban_mask was appending !*@* and breaking account matching
|
2026-08-18 15:59:00 +00:00 |
|
|
|
bcd958d2d3
|
ircv3: close server-support-table gaps — BOT=B ISUPPORT, account-extban (a: matcher + ACCOUNTEXTBAN=a), draft/read-marker cap (gates MARKREAD sync), and no-implicit-names (suppress the post-JOIN NAMES burst)
|
2026-08-18 15:56:59 +00:00 |
|
|
|
c9bd8e7492
|
channel-rename: implement IRCv3 draft/channel-rename — RENAME command + cap, in-place rename (RENAME for cap clients, PART/JOIN fallback for the rest), and S2S propagation
|
2026-08-17 23:45:02 +00:00 |
|
|
|
755e835baf
|
snoop: only announce a client's exit if it registered — an unregistered liveness/health probe was spamming the +q snomask (regression from firing on_user_quit for all users)
|
2026-08-17 22:49:29 +00:00 |
|
|
|
244feb9f45
|
reactor: bound the blocking TLS handshake (proxied-TLS path) with tls_handshake_timeout so a stalled handshake can't pin a thread/socket
|
2026-08-17 22:13:37 +00:00 |
|
|
|
7563daf3a3
|
account_registration: GC the per-IP rate-limit table on the tick (an entry per distinct registering IP was never dropped)
|
2026-08-17 22:13:37 +00:00 |
|
|
|
e28efb03e6
|
callerid: cap the auto-accept list like the explicit ACCEPT command
|
2026-08-17 21:37:19 +00:00 |
|
|
|
fad66eaac2
|
chathistory: GC conversation keys idle past chathistory_maxage (default 7d) — the key set never shrank
|
2026-08-17 21:37:19 +00:00 |
|
|
|
5522e36125
|
reactor: reap proxy-pending connections that never send their PROXY header (were never timed out)
|
2026-08-17 21:37:18 +00:00 |
|
|
|
de4cf9866d
|
channel: scrub a departed user from every +i invite list (invited-then-quit leaked a Uid on persistent channels)
|
2026-08-17 21:37:18 +00:00 |
|
|
|
0da0906dc9
|
core: fire on_user_quit for unregistered users too — pre-registration module state (captcha Challenged/Verified) leaked one Uid per held-then-dropped bot
|
2026-08-17 21:37:18 +00:00 |
|
|
|
f2e23fffa9
|
captcha: issue the challenge once per held client, not on every command they send
|
2026-08-17 20:37:51 +00:00 |
|
|
|
d6cc813aad
|
channel: reclaim departed-member +f flood counters and expired +J entries on the tick (slow high-churn leak)
|
2026-08-17 20:37:51 +00:00 |
|
|
|
92a3f5ba86
|
s2s: propagate CHGHOST/CHGIDENT host/ident changes to links (were applied locally only); inbound path uses a non-propagating variant to avoid a loop
|
2026-08-17 19:38:58 +00:00 |
|
|
|
73f8ff58ed
|
s2s: enforce servprotect on a remote KILL and rank-vs-victim on a remote KICK (matching the local paths)
|
2026-08-17 19:38:58 +00:00 |
|
|
|
da36d5c32a
|
s2s: FJOIN TS arbitration wipes list modes+topic on loss and merges on equal TS; arbitrate remote-remote nick collisions (rewrite forward); IJOIN/FTOPIC channel-TS handling
|
2026-08-17 19:32:18 +00:00 |
|
|
|
4b86de3b62
|
registration: add a Hold verdict so captcha/challenge modules pend the client for the challenge instead of tearing the link down
|
2026-08-17 19:06:17 +00:00 |
|
|
|
99eb9c74f3
|
relaymsg: gate RELAYMSG on oper (it spoofs an arbitrary source nick), matching InspIRCd
|
2026-08-17 19:06:17 +00:00 |
|
|
|
d6f27ac56c
|
securitygroups: honor tls=no/account=no/etc. instead of inverting them to require
|
2026-08-17 15:05:13 +00:00 |
|
|
|
edb10a6607
|
connectban: never collapse the ban mask to * on a sub-/8 CIDR (would z-line the whole network)
|
2026-08-17 15:05:13 +00:00 |
|
|
|
58d5a0e5a5
|
message: keep +U opmoderated messages out of CHATHISTORY/+H replay, and subject TAGMSG to the same PM gates (+c/+R/+z/+g/SILENCE)
|
2026-08-17 15:05:13 +00:00 |
|
|
|
45f4ee552d
|
xline: remove masks case-insensitively, matching how they're enforced
|
2026-08-17 14:52:38 +00:00 |
|
|
|
480b5faea0
|
sanick/svsnick: allow a case-only rename (in-use check matched the target itself)
|
2026-08-17 14:52:38 +00:00 |
|
|
|
8ed2003546
|
callerid: scrub a departed/renamed nick from ACCEPT lists so it can't be reused to bypass +g
|
2026-08-17 14:52:38 +00:00 |
|
|
|
c1b7ed6dda
|
channel: count remote members for +l, and propagate TBAN expiry (-b) over S2S
|
2026-08-17 14:52:38 +00:00 |
|
|
|
713406870b
|
who: hide +u auditorium and +D delayjoin members on WHO #chan, matching NAMES
|
2026-08-17 14:52:38 +00:00 |
|
|
|
3d7ee6b586
|
reputation: count remote/services channel members toward the minchanmembers gate (score was frozen)
|
2026-08-17 13:27:58 +00:00 |
|
|
|
62c0141362
|
test: services standard reply (SWSTDRPL) reaches a standard-replies client
|
2026-08-17 13:12:31 +00:00 |
|
|
|
5722640957
|
s2s: handle echo's metadata profile keys, standard replies, OPERTYPE and REDACT; emit ssl_cert + OPERTYPE
|
2026-08-17 13:08:14 +00:00 |
|
|
|
8f765bfba7
|
s2s: deliver server-sourced NOTICE/PRIVMSG (services SET SNOTICE) instead of dropping it
|
2026-08-17 11:40:46 +00:00 |
|
|
|
0f28083855
|
markread: persist account-keyed read markers to disk and restore them at startup
|
2026-08-17 02:12:17 +00:00 |
|
|
|
3f9aa8c6eb
|
channel: cull an empty channel when a mode change (-P/-r) removes its last reason to persist
|
2026-08-17 01:50:11 +00:00 |
|
|
|
b451ccbfd8
|
permchannels: persist +P channels (modes, topic, ts, list modes) to disk and restore them at startup
|
2026-08-17 01:43:29 +00:00 |
|
|
|
978f8f8f82
|
reputation: persist the score table on each bump/expire so restarts don't revert to a stale snapshot
|
2026-08-17 01:19:57 +00:00 |
|
