|
|
244feb9f45
|
reactor: bound the blocking TLS handshake (proxied-TLS path) with tls_handshake_timeout so a stalled handshake can't pin a thread/socket
|
2026-08-17 22:13:37 +00:00 |
|
|
|
5522e36125
|
reactor: reap proxy-pending connections that never send their PROXY header (were never timed out)
|
2026-08-17 21:37:18 +00:00 |
|
|
|
0ace39c882
|
listeners: make bind/bind_tls/bind_server repeatable (multiple addresses/ports) and normalize IPv4-mapped IPv6 peers back to plain IPv4 — a single [::] bind now serves IPv4+IPv6 with clean v4 addresses
|
2026-08-15 01:12:37 +00:00 |
|
|
|
41826c8e1a
|
socketengine: per-IP accept-rate limiter (token bucket, accept_rate/accept_burst, off by default) — drops connection-churn floods at the accept edge before any state is allocated; exempts trusted proxies and server links
|
2026-08-12 17:05:24 +00:00 |
|
|
|
d8d57511ab
|
tls: send a close_notify on close for established TLS sessions instead of just dropping the socket, so clients see a clean shutdown not a truncation error
|
2026-08-12 15:53:10 +00:00 |
|
|
|
59e18b0205
|
socketengine: reap TLS conns that stall mid-handshake (tls_handshake_timeout, default 15s) — a connection that opens the TLS port but never negotiates no longer leaks a slot
|
2026-08-12 15:51:45 +00:00 |
|
|
|
02ae92e16d
|
socketengine: run direct TLS in the reactor pool — non-blocking handshake + crypto in the worker threads (Sock::Tls, TlsSession), unifying the client I/O model and spreading TLS work across cores; proxied TLS + links keep the thread path
|
2026-08-12 14:03:00 +00:00 |
|
|
|
7c166e3aae
|
socketengine: plaintext reactor pool — an acceptor round-robins connections across N worker reactors (io_threads, auto=cores) feeding the single lock-free core, so per-connection I/O scales across cores
|
2026-08-12 13:42:08 +00:00 |
|
|
|
e91b64a4db
|
resilience: isolate per-connection panics in the plaintext reactor (catch_unwind read/write -> drop just that conn) and log worker-thread panics instead of vanishing silently
|
2026-08-12 13:19:25 +00:00 |
|
|
|
6ffd6a57bc
|
proxy: forward v2 TLS TLVs (PP2_TYPE_SSL/CERTFP) so plaintext clients behind a TLS-terminating proxy show secure+certfp; restore ws_trust_proxy to the config example
|
2026-08-11 17:13:32 +00:00 |
|
|
|
4f6c0ded48
|
websocket: add ws_defaultmode (text/binary/reject), ws_proxyranges (glob/CIDR X-Real-IP/XFF trust), ws_allowmissingorigin, ws_nativeping
|
2026-08-11 16:10:09 +00:00 |
|
|
|
87a683dbd2
|
proxy: HAProxy PROXY protocol v1+v2 on the plaintext (reactor) and TLS listeners; trusted via proxy=<glob>, rewrites the client IP before connect checks
|
2026-08-11 11:43:08 +00:00 |
|
|
|
f371ed0a18
|
connclass: cidr/parent/port/limit/globalmax + hashed/trusted-cert passwords, per-class recvq/sendq + fakelag, and rfc1413 ident
|
2026-08-10 18:46:42 +00:00 |
|
|
|
1dd7f77ca8
|
operprefix + ojoin: server oper prefix (!/mode y, above owner) auto-granted to opers + OJOIN command
|
2026-08-10 13:01:07 +00:00 |
|
|
|
19157e0722
|
websocket: native RFC 6455 transport (ws:// + wss://) — handshake, framing, ping/pong keepalive, idle timeout, origin/proxy flags, via_websocket
|
2026-08-09 18:45:12 +00:00 |
|
|
|
02528df5e9
|
sasl external: request tls client cert, plumb sha256 certfp through to user, relay to services; advertise sasl=PLAIN,EXTERNAL on tls
|
2026-08-08 19:36:48 +00:00 |
|
|
|
58596aea66
|
scale the socket engine: mio epoll reactor for client connections (tens of thousands on a few threads)
|
2026-08-05 16:46:13 +00:00 |
|
|
|
9b12791774
|
import echoircd — from-scratch irc daemon in native rust
|
2026-08-05 16:10:31 +00:00 |
|
