|
|
155e804779
|
s2s: extend source_behind to FTOPIC/RENAME/UID/OPERTYPE/REDACT — the guard was on plain TOPIC but not its S2S twin FTOPIC (a peer could forge a network-wide topic overwrite), nor channel RENAME, UID (SID announce unchecked), OPERTYPE, or REDACT; all now validate the source lives behind the arriving link
|
2026-08-19 04:45:06 +00:00 |
|
|
|
9c5719fd7c
|
socketengine: cap bytes drained from one socket per readable event (MAX_READ_PER_TURN=64KiB), then re-arm epoll and yield — bounds the per-turn line buffer and stops one flooding client from monopolising the reactor; the leftover waits in the kernel buffer and is re-delivered next turn (verified: a 133KB single-write burst gets every reply back)
|
2026-08-19 03:28:51 +00:00 |
|
|
|
fc9ae4faad
|
message: parse the IRCv3 tag block in a single pass instead of four separate split(';') scans plus an intermediate Vec for ctags
|
2026-08-19 02:54:24 +00:00 |
|
|
|
1aa02a08b9
|
channels: replace Member's six parallel prefix bools (oprefix/owner/admin/op/halfop/voice) with a single u8 bitfield (PFX_*) + inline bool accessors/mutators — same semantics, one byte instead of six, no more risk of the flags drifting out of sync; all call sites go through op()/set_op()-style methods
|
2026-08-19 02:47:04 +00:00 |
|
|
|
16fae5b23c
|
watch: notify WATCH/MONITOR via nick->watchers reverse indexes (watch_by/monitor_by) instead of scanning every user on each online/offline/nick-change flip — O(watchers) not O(users); maintained through centralized watch_index_*/monitor_index_* helpers + quit cleanup
|
2026-08-19 02:34:22 +00:00 |
|
|
|
16ea4b5a23
|
core_message: compute the sender's channel rank once per message (mrank) instead of recomputing s.rank(uid,&key) up to 7x in the channel PRIVMSG/NOTICE gate and once more in TAGMSG — rank is fixed for a single message
|
2026-08-19 02:29:59 +00:00 |
|
|
|
fb1a9f3d70
|
server: skip the O(users) callerid ACCEPT scrub on quit unless the departing nick is actually accepted by someone — a reverse count (accepted_nicks) maintained through centralized accept_add/accept_remove helpers avoids scanning every user's accept list on each quit (O(users*quits) on a netsplit); the full scrub still runs when the count is nonzero, so the nick-reuse protection is unchanged
|
2026-08-19 02:21:38 +00:00 |
|
|
|
ab0ccae71f
|
server: scrub a departed user's pending invites via a User.invited reverse index instead of scanning every channel on the network per quit — the old O(channels)-per-quit path was O(channels*quits) on a netsplit; the index is maintained at the 4 invite add/remove sites (INVITE cmd, S2S INVITE, join-consume, UNINVITE)
|
2026-08-19 02:09:36 +00:00 |
|
|
|
5101b1361d
|
whois: build the target snapshot as a named WhoisInfo struct instead of a 17-field positional tuple — field-named construction can't silently transpose two same-typed fields; destructured into the same locals so the reply code is unchanged
|
2026-08-19 01:58:01 +00:00 |
|
|
|
ea3e879068
|
connclass: cache resolved connect classes in a config_gen-tagged thread_local — all()/named() (and thus pick/assign and every per-ping/per-message getter) re-parsed the connectclass config and re-resolved parent inheritance on each call; now rebuilt only on rehash
|
2026-08-19 01:56:22 +00:00 |
|
|
|
d4d3886379
|
restrictcommands: cache the parsed restriction list (config_gen-tagged) instead of re-tokenizing every restrictcommand line on every command; clone only the one matched rule so the ext borrow drops before the server is used mutably
|
2026-08-19 01:54:45 +00:00 |
|
|
|
cd46cfc49f
|
securitygroups: cache parsed groups in a config_gen-tagged thread_local instead of re-parsing all securitygroup lines on every g: extban match and WHOIS — safe on the single-threaded core, re-parses only on rehash
|
2026-08-19 01:53:41 +00:00 |
|
|
|
1da913a249
|
autodrop: cache the autodrop-command set (config_gen-tagged) instead of re-splitting autodrop_commands on every packet from an unregistered socket — the path runs hottest under the scanner flood it defends against
|
2026-08-19 01:51:57 +00:00 |
|
|
|
09b4adabbf
|
disable: cache the disabled-command set (config_gen-tagged HashSet) instead of re-splitting disabled_commands on every non-oper command — the hottest hook in the server; re-parses only on rehash
|
2026-08-19 01:51:31 +00:00 |
|
|
|
78be7279b0
|
server: add a config_gen counter bumped on every rehash — lets modules cache config parsed into a hot-path structure and invalidate it correctly (a REHASH can't leave a stale cache), unblocking the per-message/per-command config re-parse in disable/autodrop/securitygroups/restrictcommands/connclass
|
2026-08-19 01:51:08 +00:00 |
|
|
|
11852332dc
|
message: parse on space (0x20) only per RFC — trim_start() also ate tabs, so a param containing a tab (e.g. a trailing ':\t') didn't round-trip through to_wire/parse; the parser fuzz proptest found it. trim_start_matches(' ') makes tabs ordinary param content; regression case pinned
|
2026-08-19 01:41:22 +00:00 |
|
|
|
98e5cf4d20
|
relaymsg/showfile: reject whitespace/control chars in a RELAYMSG spoofed nick (defence-in-depth on top of the denylist), and cap the showfile read at 256 KiB so a large /RULES-style file can't stall the core loop
|
2026-08-19 01:35:25 +00:00 |
|
|
|
c47fb9a80a
|
syslog: keep the UDP socket cached across send errors instead of dropping it (which re-bound + re-resolved a socket on every notice when the target was unreachable); the Unix datagram path still reopens on failure
|
2026-08-19 01:34:24 +00:00 |
|
|
|
b3f66ec310
|
customtitle: return Fail (not Ok) when the crypto pool is at capacity and the TITLE auth is denied, matching the synchronous verify path
|
2026-08-19 01:33:34 +00:00 |
|
|
|
55174ec017
|
profilelink/hidelist: unify the WHOIS label to English "Profile:" (was "Profil:" for logged-in users) and make hidelist honour the last matching config line (conf last-wins semantics) instead of the first
|
2026-08-19 01:33:05 +00:00 |
|
|
|
303fc0c8dc
|
filehost: use only the final path segment of the URL as the displayed filename tag — the trailing part was taken verbatim (path separators, ../), and while json_esc/escape_tag block injection, a client rendering filename could be misled by traversal; take the basename
|
2026-08-19 01:32:17 +00:00 |
|
|
|
c532828aab
|
jwt: match claim_num only against a top-level object key (depth-aware scan), not any substring — a claim whose string value contained "exp": could otherwise spoof the exp an external verifier reads; added nested + string-value regression tests
|
2026-08-19 01:31:22 +00:00 |
|
|
|
c32fbee905
|
chanlog: fan the mirrored notice via to_channel (Arc-shared line, per-recipient server-time) instead of collecting a members Vec and cloning the String per member
|
2026-08-19 01:29:48 +00:00 |
|
|
|
2851c0a7ab
|
rmode: send a usage NOTICE when the list-mode arg has no mode letter (e.g. RMODE #c 3) instead of failing silently
|
2026-08-19 01:29:14 +00:00 |
|
|
|
b557c9887f
|
log_json: cache an open failure so a misconfigured path doesn't re-issue an open() syscall (and silently drop) on every notice — the error is now surfaced once via stderr and not retried until the path changes; the write-failure reopen (for logrotate) is preserved
|
2026-08-19 01:28:42 +00:00 |
|
|
|
65bedaf417
|
hidemode: resolve each changed mode's hidden-rank once and each member's rank once, instead of re-scanning the hidemode config for every (member x change) pair on the MODE broadcast hot path
|
2026-08-19 01:23:33 +00:00 |
|
|
|
b59fe70537
|
operlevels: use Extensible::set instead of get_or_insert_with(0)-then-overwrite
|
2026-08-19 01:22:54 +00:00 |
|
|
|
d495fd0f30
|
channel: cap the per-channel invite set (maxinvites, default 100) — it only shrank when the invitee joined, so an op could grow it unboundedly; re-inviting an already-listed nick still works
|
2026-08-19 01:22:32 +00:00 |
|
|
|
8f5b37bf8d
|
dnsbl: cap the number of blocklist zones checked per client at 16 — each zone is a serial blocking DNS lookup, so a long (mis)configured zone list could stall a connecting client's registration for zones.len()*timeout
|
2026-08-19 01:21:40 +00:00 |
|
|
|
b63458816e
|
metrics: set read/write timeouts on each scrape connection — the single-threaded accept loop did an untimed read, so one client that connected and never sent blocked every future scrape (slowloris)
|
2026-08-19 01:21:21 +00:00 |
|
|
|
ac3e66e9e0
|
metadata: prune a channel's metadata once the channel no longer exists (tick GC) — #channel entries were never freed (unlike user entries on quit), so setting metadata on a channel that later empties leaked memory and kept re-persisting to disk forever; +P channels stay live so keep theirs
|
2026-08-19 01:20:23 +00:00 |
|
|
|
a7f6c264d1
|
snoop: gate the per-connect/join/quit eprintln! behind snoop_stderr (default off) — it wrote to stderr (journald) on every client event in the reactor thread, unbounded under a connect flood; the +c/+q snotices already carry the operator-facing signal
|
2026-08-19 01:18:58 +00:00 |
|
|
|
924141683c
|
extbanbanlist: identify extbans by the real rule (<letter>:...) instead of "2nd byte is a colon" — the old heuristic wrongly skipped a plain hostmask whose second char happened to be ':', mis-listing it
|
2026-08-19 01:18:27 +00:00 |
|
|
|
6f9d11f83e
|
captcha: clamp recaptcha/cloudflare token TTL to [60s, 86400s] — an unclamped conf value could set exp in the past (every token instantly invalid, self-DoS) or absurdly far out
|
2026-08-19 01:18:13 +00:00 |
|
|
|
ee3c5e761e
|
geoip: bound recursion + require forward progress in the .mmdb value decoder — value_len/map_get recursed into nested maps/arrays with no depth limit (unlike resolve), so a crafted database could overflow the stack or spin on a zero-advance value; cap nesting at 32 and bail on a malformed (0-length) sub-value
|
2026-08-19 01:17:32 +00:00 |
|
|
|
e200779d27
|
connclass: resolve hash= independently of token order — the fold only ran if password= had already been parsed, so "hash=sha256 password=<hex>" (hash first) stored the digest as a plaintext password and every login to that class failed; build() now combines <algo>:<digest> after the full token pass
|
2026-08-19 01:15:26 +00:00 |
|
|
|
928026c49e
|
permchannels: isolate the load-time mode applier in catch_unwind so a panicking mode handler can't leave mode_sudo stuck true — which would silently disable rank/oper gating for every subsequent MODE; the flag is now always reset
|
2026-08-19 01:14:34 +00:00 |
|
|
|
14eb982db5
|
multiline: reject an over-limit batch with a FAIL instead of silently dropping the overflowing lines — accumulate() dropped a line that exceeded multiline_maxbytes/maxlines but still returned buffered=true, so the client believed a truncated message was sent whole; now overflow flags the batch and close() drops it with a standard FAIL
|
2026-08-19 01:13:39 +00:00 |
|
|
|
83cdce17c5
|
connflood: bound the per-IP connection-history map (prune stale buckets past 65536 tracked IPs) — it only shrank on the tick GC, so a wide source-IP spread could grow it unbounded between ticks (memory DoS)
|
2026-08-19 01:12:39 +00:00 |
|
|
|
a218d65371
|
rpc: authenticate on the header block before buffering the request body — the httpd read up to MAX_REQUEST (256 KiB) and only then checked the Authorization header, so an unauthenticated peer reaching rpc_bind could make each connection consume memory + a worker thread; now POST+auth are validated as soon as headers are complete, before any body is read
|
2026-08-19 01:05:29 +00:00 |
|
|
|
5b33786a46
|
rpc: refuse an all-wildcard x-line via ban.add — the mask went unvalidated, so an authenticated RPC call with "mask":"" or "*@*" installed a K/G/Z-line matching the entire network; require at least one literal host/ip/nick char
|
2026-08-19 01:03:27 +00:00 |
|
|
|
54c2a733fe
|
password_hash: reject a PBKDF2 credential with an absurd iteration count (>10M) instead of running it — the count is read straight from the stored string, so a corrupt/hostile credential (e.g. via a compromised accounts backend) could pin a worker thread for a very long time; legitimate work factors are far below the cap
|
2026-08-19 01:02:36 +00:00 |
|
|
|
4248cc0479
|
oper: gate the client-facing SVSLOGIN/SVSLOGOUT behind oper_svslogin (default off) — they were a pre-S2S stopgap that let any oper forge an arbitrary account login (set_login) and thus +r/account-gated access; the live path is S2S link_svslogin (source_is_service-gated), so services are unaffected — only the obsolete oper backdoor is closed
|
2026-08-19 01:01:33 +00:00 |
|
|
|
a80b86b50d
|
perf: S2S channel-message fanout shares the line by Arc across members (relay_channel_message) instead of cloning a String per recipient — mirrors the client PRIVMSG fanout; builds at most three variants (plain / server-time / echo-services-tagged) whatever the channel size, behaviour unchanged
|
2026-08-19 00:47:32 +00:00 |
|
|
|
910422199b
|
perf: glob_match takes a zero-allocation byte-wise path for ASCII operands (the norm for hostmasks/IPs/cloaks) instead of collecting two Vec<char> per call — it runs per-message (filter), per-user (extbans/tline) and per-channel (channelban); non-ASCII still uses the Unicode-lowercased fallback, and a proptest pins the two paths equal on ASCII
|
2026-08-19 00:45:14 +00:00 |
|
|
|
35bb901455
|
whoisport: report the port the user actually connected to (User.port, set at accept) instead of conf("bind")/conf("bind_tls") — those are Vec-valued so conf() returned only the LAST configured listener, giving every user the same wrong port on a multi-listener server
|
2026-08-19 00:43:03 +00:00 |
|
|
|
25702c9541
|
syslog: strip control chars (CR/LF) from the message before framing — a snotice carrying user-influenced text (nick/realname/quit reason) with an embedded newline could inject a forged syslog record; matches the CR/LF care the JSON log path already takes
|
2026-08-19 00:42:30 +00:00 |
|
|
|
d9d5bd069b
|
filehost: refuse to sign upload tokens when filehost_jwt_secret is unset/empty/"changeme" — the default fell open, signing with a world-known key so anyone could forge a server-trusted upload authorization; now it fails closed and tells the user to fix the config
|
2026-08-19 00:42:10 +00:00 |
|
|
|
a09dfc74df
|
auth: constant-time compare for VHOST and WEBIRC secrets — both used plain == on the config password, unlike oper/RPC/JWT secrets which already route through ct_eq; expose password_hash::ct_eq as the shared comparator and use it (usernames stay plain == — not secret)
|
2026-08-19 00:41:47 +00:00 |
|
|
|
c72b966e0a
|
mode: cap mode changes per MODE command (modes=, default 20) and advertise it as the MODES= ISUPPORT token — an uncapped modestring like MODE #c +bbbb… dispatched a handler per letter, each fanning out to the whole channel and every S2S link (amplification DoS); matches InspIRCd's MODES limit
|
2026-08-19 00:40:58 +00:00 |
|
