Commit graph

Select branches

Hide pull requests

main

Mono Color

• 5914a6d993
  websocket: collapse v4-mapped proxy peer so ws_proxyranges matches and X-Real-IP is honored main reverse 2026-08-25 03:15:28 +00:00
• 935f22f2f2
  accounts: oper snotice on post-connect login ('Client X is now logged in as Y') reverse 2026-08-25 02:21:58 +00:00
• 37436d0306
  snoop: drop needless clones in the connect notice (hold the &User borrow) reverse 2026-08-25 00:12:23 +00:00
• 6e8d6c31fb
  snoop: connect notice includes port, sni and account (present fields only) reverse 2026-08-25 00:06:22 +00:00
• a587d25873
  docs: document the brand block (per-SNI server/network identity) in the example config reverse 2026-08-24 23:29:45 +00:00
• b6ada854cc
  brand: per-SNI server/network identity (welcome, ISUPPORT NETWORK, numeric source prefix) reverse 2026-08-24 23:29:15 +00:00
• f36f803d42
  whois: show client-cert fingerprint (276) to everyone, not just opers/self reverse 2026-08-24 22:25:08 +00:00
• 009bea734a
  whois: show negotiated TLS version/group/cipher in 671; sslgroup crate reads the KEX group reverse 2026-08-24 21:45:46 +00:00
• 85eb8218f0
  tls: openssl backend offers TLS 1.3 via mozilla_intermediate_v5 (was capped at 1.2) reverse 2026-08-24 20:38:58 +00:00
• 51602737e2
  tls: rustls backend offers TLS 1.3 (was TLS 1.2 only), preferred over 1.2 reverse 2026-08-24 20:30:54 +00:00
• d0fdb2e8be
  docs: add Community section (irc.devtronic.pro #echoiRCd support channel) to README reverse 2026-08-24 19:47:06 +00:00
• f066fa0b5a
  docs: document the block config format + mkpasswd/checkconfig/rehash CLIs in README and configuration.md reverse 2026-08-24 19:13:45 +00:00
• 8d48900ae3
  config: derive Eq on the block-parser token enum reverse 2026-08-23 13:01:05 +00:00
• 1166c49443
  config: checkconfig CLI + Config::dump; tls block carries sni/handshake_timeout reverse 2026-08-23 12:42:30 +00:00
• b11382bc1e
  config: block-format example documenting every option; cloak/uline block fields + example parse guard reverse 2026-08-23 12:28:19 +00:00
• 2f6ce36af0
  config: add brace/block format (translated to flat, both formats supported) reverse 2026-08-23 12:18:10 +00:00
• e8d16a1f96
  config: accept oper password=<hash> named token; keep positional password back-compat reverse 2026-08-23 03:11:32 +00:00
• c2e0a9eeb4
  mkpasswd: 'echoircd mkpasswd [cost]' CLI hashes a stdin password with bcrypt for oper blocks reverse 2026-08-23 02:55:14 +00:00
• 12a4ddb749
  rehash: fall back to a /proc scan for the running server when the pidfile is stale, and self-heal it reverse 2026-08-23 02:40:53 +00:00
• 3052e47212
  docs: document the pidfile option in the example config reverse 2026-08-23 02:35:32 +00:00
• 34342e110f
  rehash: write the pidfile only when configured + CLI verifies a live echoircd, so a stale/clobbered pid can't misfire reverse 2026-08-23 02:17:44 +00:00
• a7ae0d86a9
  rehash: 'echoircd rehash' CLI + SIGHUP reload the running config in place via a pidfile reverse 2026-08-23 02:10:41 +00:00
• 42fe82556b
  version: show echoircd-<major> (5) in 002/004/351 and enrich RPL_VERSION with build/toolchain provenance reverse 2026-08-23 01:24:45 +00:00
• 5c286a94cb
  conn_waitpong: exempt loopback (per ipv4/ipv6) and per-class from the registration ping cookie reverse 2026-08-22 23:49:46 +00:00
• 70a4ecb0a0
  core: add oper MODULES command (702/703) listing loaded modules; module.list RPC already existed reverse 2026-08-22 17:36:46 +00:00
• 4357a59c7a
  filter: pluggable pattern engine (glob|regex) selected by filter_engine config; regex/glob backends behind a Matcher trait reverse 2026-08-22 17:36:46 +00:00
• 73817eddde
  whois: show a remote user's actual server description in 312, not the literal "remote user" reverse 2026-08-21 23:43:51 +00:00
• ddb6214b47
  chanlog: post log lines as a channel PRIVMSG from the server, not a NOTICE reverse 2026-08-21 17:41:00 +00:00
• b8e24e2071
  chanlog: filter each log channel by snomask category; repeatable so different snomasks route to different channels reverse 2026-08-21 17:11:27 +00:00
• 7cb9256ff5
  xline: tell a banned user when the ban expires, not just why reverse 2026-08-21 15:18:23 +00:00
• 745ddd540e
  xline: show a timed ban's remaining time in the removal notice reverse 2026-08-21 15:10:27 +00:00
• 3ad67c6b52
  xline: broadcast the XLINE notice on remove and expire too, so it covers every x-line's whole lifecycle reverse 2026-08-21 15:03:36 +00:00
• 6301b64509
  server: extract civil() so iso_time and long_date share one date conversion instead of duplicating it reverse 2026-08-21 14:52:49 +00:00
• b693c5e5df
  dnsbl: per-zone name/action/duration/reason with %ip%; XLINE notice shows duration + absolute expiry reverse 2026-08-21 14:14:17 +00:00
• 1824af5d90
  signore: persist per-account via services metadata — push on edit, replay on login reverse 2026-08-20 15:40:19 +00:00
• 6c5f330746
  add SIGNORE: personal mutual server-side ignore across channels and PMs reverse 2026-08-20 14:48:17 +00:00
• 2c9ce18cd7
  whois: render the oper-type title line in bold + colour (per-type color=<name|0-15|none>, default red) so it stands out reverse 2026-08-20 14:26:17 +00:00
• bc520d59a5
  whois: a typed oper gets its own 320 special line with the type title (e.g. 'is a Network Administrator'), separate from the generic 313 operator line reverse 2026-08-20 14:17:15 +00:00
• 8f9e60c8e2
  whois: 313 shows the generic 'is an IRC Operator' again — the oper type gates capabilities, and a custom title comes from the SWHOIS line (320) reverse 2026-08-20 14:05:46 +00:00
• 5a9825ee61
  comments: strip stray reference-implementation names from a handful of module/inline comments reverse 2026-08-20 10:11:07 +00:00
• 81e013f053
  docs: document oper classes/types + the five built-in types (operators.md, example config) reverse 2026-08-20 10:06:38 +00:00
• 01516d5fdc
  opertypes: oper classes + types — reusable capability classes and named roles (WHOIS title, auto usermodes/snomasks/vhost + level on oper-up, per-type command enforcement via on_pre_command); ships 5 built-in (helpop/globop/admin/servadmin/netadmin); oper blocks gain type=<id>; a typeless oper keeps full access reverse 2026-08-20 10:05:11 +00:00
• f3ce0e61ef
  s2s: accept a swhois metadata key from services — set (or clear, when empty) the user's SWHOIS ext, shown in WHOIS 320 reverse 2026-08-20 00:02:02 +00:00
• f1ddb878af
  rustls: offer TLS 1.2 only, matching the openssl backend (mozilla_intermediate) — advertising 1.3 as well pushed every client onto a 1.3 handshake openssl never served, so a client fine on 1.2 could fail to connect; a drop-in backend must negotiate the same protocol reverse 2026-08-19 17:55:31 +00:00
• 598a019620
  rustls: keep WRITABLE and drain buffered ciphertext when the socket backs up, and bound the plaintext buffer at 256KiB — rustls accepts all plaintext and buffers ciphertext internally on WouldBlock (unlike openssl, which surfaces backpressure through write); expose wants_write()/flush() so the reactor drains it and the sendq caps govern a slow reader. no-op for the openssl and plaintext paths reverse 2026-08-19 17:19:15 +00:00
• ebd6e29589
  docs: rework README + manual — refresh the feature set (services interface, rustls TLS backend, WebSocket, PROXY v1/v2, metrics + JSON-RPC endpoints), correct command/module/cap counts, and document the tls_backend/metrics_bind/rpc/sts config keys in configuration.md and the example reverse 2026-08-19 14:37:22 +00:00
• b106b66de5 s2s: validate source_behind on ADDLINE/DELLINE/INVITE too — these apply network state (x-lines, invite bypass) from msg.source with no check the source sits behind the arriving link; a legit source (incl. a services SID/uuid) always is, so echo's akills still propagate reverse 2026-08-19 04:57:39 +00:00
• 78a6574d64 hardening: bracket a bare IPv6 nameserver literal (was unparseable -> rDNS/DNSBL silently degraded on v6-only hosts); saturating chunk-size advance in the RPC dechunker (a 16-hex-digit size could overflow-panic the worker); connclass hash= is now last-wins to match password= under parent= inheritance reverse 2026-08-19 04:45:07 +00:00
• 1a5c41871c password_hash: reject an empty PBKDF2 hash/salt — a stored 'pbkdf2:iters:salt:' (empty hash) made ct_eq(&[],&[]) return true, verifying ANY password; refuse empty want/salt before computing reverse 2026-08-19 04:45:07 +00:00
• 6bc299f286 socketengine: re-drain a read-capped socket via a pending_reads queue, not an epoll re-arm — the MAX_READ_PER_TURN re-arm relied on kernel readiness, but a TLS socket drains all ciphertext and buffers decrypted plaintext INSIDE the session, so complete lines past 64KB stranded until the next TCP segment; the reactor now re-reads queued sockets each turn (covers kernel- and TLS-buffered leftover) reverse 2026-08-19 04:45:07 +00:00
• 9eda8cbd4f server: carry accepted_nicks count across a nick change — set_nick rewrites ACCEPT entries old->new in place (bypassing accept_add/remove) so the reverse count desynced; the count-gated quit scrub could then skip a reused nick, letting it inherit +g acceptance. move the count old->new (also fixes a slow map leak) reverse 2026-08-19 04:45:07 +00:00
• 155e804779 s2s: extend source_behind to FTOPIC/RENAME/UID/OPERTYPE/REDACT — the guard was on plain TOPIC but not its S2S twin FTOPIC (a peer could forge a network-wide topic overwrite), nor channel RENAME, UID (SID announce unchecked), OPERTYPE, or REDACT; all now validate the source lives behind the arriving link reverse 2026-08-19 04:45:06 +00:00
• 9c5719fd7c socketengine: cap bytes drained from one socket per readable event (MAX_READ_PER_TURN=64KiB), then re-arm epoll and yield — bounds the per-turn line buffer and stops one flooding client from monopolising the reactor; the leftover waits in the kernel buffer and is re-delivered next turn (verified: a 133KB single-write burst gets every reply back) reverse 2026-08-19 03:28:51 +00:00
• fc9ae4faad message: parse the IRCv3 tag block in a single pass instead of four separate split(';') scans plus an intermediate Vec for ctags reverse 2026-08-19 02:54:24 +00:00
• 1aa02a08b9 channels: replace Member's six parallel prefix bools (oprefix/owner/admin/op/halfop/voice) with a single u8 bitfield (PFX_*) + inline bool accessors/mutators — same semantics, one byte instead of six, no more risk of the flags drifting out of sync; all call sites go through op()/set_op()-style methods reverse 2026-08-19 02:47:04 +00:00
• 16fae5b23c watch: notify WATCH/MONITOR via nick->watchers reverse indexes (watch_by/monitor_by) instead of scanning every user on each online/offline/nick-change flip — O(watchers) not O(users); maintained through centralized watch_index_*/monitor_index_* helpers + quit cleanup reverse 2026-08-19 02:34:22 +00:00
• 16ea4b5a23 core_message: compute the sender's channel rank once per message (mrank) instead of recomputing s.rank(uid,&key) up to 7x in the channel PRIVMSG/NOTICE gate and once more in TAGMSG — rank is fixed for a single message reverse 2026-08-19 02:29:59 +00:00
• fb1a9f3d70 server: skip the O(users) callerid ACCEPT scrub on quit unless the departing nick is actually accepted by someone — a reverse count (accepted_nicks) maintained through centralized accept_add/accept_remove helpers avoids scanning every user's accept list on each quit (O(users*quits) on a netsplit); the full scrub still runs when the count is nonzero, so the nick-reuse protection is unchanged reverse 2026-08-19 02:21:38 +00:00
• ab0ccae71f server: scrub a departed user's pending invites via a User.invited reverse index instead of scanning every channel on the network per quit — the old O(channels)-per-quit path was O(channels*quits) on a netsplit; the index is maintained at the 4 invite add/remove sites (INVITE cmd, S2S INVITE, join-consume, UNINVITE) reverse 2026-08-19 02:09:36 +00:00
• 5101b1361d whois: build the target snapshot as a named WhoisInfo struct instead of a 17-field positional tuple — field-named construction can't silently transpose two same-typed fields; destructured into the same locals so the reply code is unchanged reverse 2026-08-19 01:58:01 +00:00
• ea3e879068 connclass: cache resolved connect classes in a config_gen-tagged thread_local — all()/named() (and thus pick/assign and every per-ping/per-message getter) re-parsed the connectclass config and re-resolved parent inheritance on each call; now rebuilt only on rehash reverse 2026-08-19 01:56:22 +00:00
• d4d3886379 restrictcommands: cache the parsed restriction list (config_gen-tagged) instead of re-tokenizing every restrictcommand line on every command; clone only the one matched rule so the ext borrow drops before the server is used mutably reverse 2026-08-19 01:54:45 +00:00
• cd46cfc49f securitygroups: cache parsed groups in a config_gen-tagged thread_local instead of re-parsing all securitygroup lines on every g: extban match and WHOIS — safe on the single-threaded core, re-parses only on rehash reverse 2026-08-19 01:53:41 +00:00
• 1da913a249 autodrop: cache the autodrop-command set (config_gen-tagged) instead of re-splitting autodrop_commands on every packet from an unregistered socket — the path runs hottest under the scanner flood it defends against reverse 2026-08-19 01:51:57 +00:00
• 09b4adabbf disable: cache the disabled-command set (config_gen-tagged HashSet) instead of re-splitting disabled_commands on every non-oper command — the hottest hook in the server; re-parses only on rehash reverse 2026-08-19 01:51:31 +00:00
• 78be7279b0 server: add a config_gen counter bumped on every rehash — lets modules cache config parsed into a hot-path structure and invalidate it correctly (a REHASH can't leave a stale cache), unblocking the per-message/per-command config re-parse in disable/autodrop/securitygroups/restrictcommands/connclass reverse 2026-08-19 01:51:08 +00:00
• 11852332dc message: parse on space (0x20) only per RFC — trim_start() also ate tabs, so a param containing a tab (e.g. a trailing ':\t') didn't round-trip through to_wire/parse; the parser fuzz proptest found it. trim_start_matches(' ') makes tabs ordinary param content; regression case pinned reverse 2026-08-19 01:41:22 +00:00
• 98e5cf4d20 relaymsg/showfile: reject whitespace/control chars in a RELAYMSG spoofed nick (defence-in-depth on top of the denylist), and cap the showfile read at 256 KiB so a large /RULES-style file can't stall the core loop reverse 2026-08-19 01:35:25 +00:00
• c47fb9a80a syslog: keep the UDP socket cached across send errors instead of dropping it (which re-bound + re-resolved a socket on every notice when the target was unreachable); the Unix datagram path still reopens on failure reverse 2026-08-19 01:34:24 +00:00
• b3f66ec310 customtitle: return Fail (not Ok) when the crypto pool is at capacity and the TITLE auth is denied, matching the synchronous verify path reverse 2026-08-19 01:33:34 +00:00
• 55174ec017 profilelink/hidelist: unify the WHOIS label to English "Profile:" (was "Profil:" for logged-in users) and make hidelist honour the last matching config line (conf last-wins semantics) instead of the first reverse 2026-08-19 01:33:05 +00:00
• 303fc0c8dc filehost: use only the final path segment of the URL as the displayed filename tag — the trailing part was taken verbatim (path separators, ../), and while json_esc/escape_tag block injection, a client rendering filename could be misled by traversal; take the basename reverse 2026-08-19 01:32:17 +00:00
• c532828aab jwt: match claim_num only against a top-level object key (depth-aware scan), not any substring — a claim whose string value contained "exp": could otherwise spoof the exp an external verifier reads; added nested + string-value regression tests reverse 2026-08-19 01:31:22 +00:00
• c32fbee905 chanlog: fan the mirrored notice via to_channel (Arc-shared line, per-recipient server-time) instead of collecting a members Vec and cloning the String per member reverse 2026-08-19 01:29:48 +00:00
• 2851c0a7ab rmode: send a usage NOTICE when the list-mode arg has no mode letter (e.g. RMODE #c 3) instead of failing silently reverse 2026-08-19 01:29:14 +00:00
• b557c9887f log_json: cache an open failure so a misconfigured path doesn't re-issue an open() syscall (and silently drop) on every notice — the error is now surfaced once via stderr and not retried until the path changes; the write-failure reopen (for logrotate) is preserved reverse 2026-08-19 01:28:42 +00:00
• 65bedaf417 hidemode: resolve each changed mode's hidden-rank once and each member's rank once, instead of re-scanning the hidemode config for every (member x change) pair on the MODE broadcast hot path reverse 2026-08-19 01:23:33 +00:00
• b59fe70537 operlevels: use Extensible::set instead of get_or_insert_with(0)-then-overwrite reverse 2026-08-19 01:22:54 +00:00
• d495fd0f30 channel: cap the per-channel invite set (maxinvites, default 100) — it only shrank when the invitee joined, so an op could grow it unboundedly; re-inviting an already-listed nick still works reverse 2026-08-19 01:22:32 +00:00
• 8f5b37bf8d dnsbl: cap the number of blocklist zones checked per client at 16 — each zone is a serial blocking DNS lookup, so a long (mis)configured zone list could stall a connecting client's registration for zones.len()*timeout reverse 2026-08-19 01:21:40 +00:00
• b63458816e metrics: set read/write timeouts on each scrape connection — the single-threaded accept loop did an untimed read, so one client that connected and never sent blocked every future scrape (slowloris) reverse 2026-08-19 01:21:21 +00:00
• ac3e66e9e0 metadata: prune a channel's metadata once the channel no longer exists (tick GC) — #channel entries were never freed (unlike user entries on quit), so setting metadata on a channel that later empties leaked memory and kept re-persisting to disk forever; +P channels stay live so keep theirs reverse 2026-08-19 01:20:23 +00:00
• a7f6c264d1 snoop: gate the per-connect/join/quit eprintln! behind snoop_stderr (default off) — it wrote to stderr (journald) on every client event in the reactor thread, unbounded under a connect flood; the +c/+q snotices already carry the operator-facing signal reverse 2026-08-19 01:18:58 +00:00
• 924141683c extbanbanlist: identify extbans by the real rule (<letter>:...) instead of "2nd byte is a colon" — the old heuristic wrongly skipped a plain hostmask whose second char happened to be ':', mis-listing it reverse 2026-08-19 01:18:27 +00:00
• 6f9d11f83e captcha: clamp recaptcha/cloudflare token TTL to [60s, 86400s] — an unclamped conf value could set exp in the past (every token instantly invalid, self-DoS) or absurdly far out reverse 2026-08-19 01:18:13 +00:00
• ee3c5e761e geoip: bound recursion + require forward progress in the .mmdb value decoder — value_len/map_get recursed into nested maps/arrays with no depth limit (unlike resolve), so a crafted database could overflow the stack or spin on a zero-advance value; cap nesting at 32 and bail on a malformed (0-length) sub-value reverse 2026-08-19 01:17:32 +00:00
• e200779d27 connclass: resolve hash= independently of token order — the fold only ran if password= had already been parsed, so "hash=sha256 password=<hex>" (hash first) stored the digest as a plaintext password and every login to that class failed; build() now combines <algo>:<digest> after the full token pass reverse 2026-08-19 01:15:26 +00:00
• 928026c49e permchannels: isolate the load-time mode applier in catch_unwind so a panicking mode handler can't leave mode_sudo stuck true — which would silently disable rank/oper gating for every subsequent MODE; the flag is now always reset reverse 2026-08-19 01:14:34 +00:00
• 14eb982db5 multiline: reject an over-limit batch with a FAIL instead of silently dropping the overflowing lines — accumulate() dropped a line that exceeded multiline_maxbytes/maxlines but still returned buffered=true, so the client believed a truncated message was sent whole; now overflow flags the batch and close() drops it with a standard FAIL reverse 2026-08-19 01:13:39 +00:00
• 83cdce17c5 connflood: bound the per-IP connection-history map (prune stale buckets past 65536 tracked IPs) — it only shrank on the tick GC, so a wide source-IP spread could grow it unbounded between ticks (memory DoS) reverse 2026-08-19 01:12:39 +00:00
• a218d65371 rpc: authenticate on the header block before buffering the request body — the httpd read up to MAX_REQUEST (256 KiB) and only then checked the Authorization header, so an unauthenticated peer reaching rpc_bind could make each connection consume memory + a worker thread; now POST+auth are validated as soon as headers are complete, before any body is read reverse 2026-08-19 01:05:29 +00:00
• 5b33786a46 rpc: refuse an all-wildcard x-line via ban.add — the mask went unvalidated, so an authenticated RPC call with "mask":"" or "*@*" installed a K/G/Z-line matching the entire network; require at least one literal host/ip/nick char reverse 2026-08-19 01:03:27 +00:00
• 54c2a733fe password_hash: reject a PBKDF2 credential with an absurd iteration count (>10M) instead of running it — the count is read straight from the stored string, so a corrupt/hostile credential (e.g. via a compromised accounts backend) could pin a worker thread for a very long time; legitimate work factors are far below the cap reverse 2026-08-19 01:02:36 +00:00
• 4248cc0479 oper: gate the client-facing SVSLOGIN/SVSLOGOUT behind oper_svslogin (default off) — they were a pre-S2S stopgap that let any oper forge an arbitrary account login (set_login) and thus +r/account-gated access; the live path is S2S link_svslogin (source_is_service-gated), so services are unaffected — only the obsolete oper backdoor is closed reverse 2026-08-19 01:01:33 +00:00
• a80b86b50d perf: S2S channel-message fanout shares the line by Arc across members (relay_channel_message) instead of cloning a String per recipient — mirrors the client PRIVMSG fanout; builds at most three variants (plain / server-time / echo-services-tagged) whatever the channel size, behaviour unchanged reverse 2026-08-19 00:47:32 +00:00
• 910422199b perf: glob_match takes a zero-allocation byte-wise path for ASCII operands (the norm for hostmasks/IPs/cloaks) instead of collecting two Vec<char> per call — it runs per-message (filter), per-user (extbans/tline) and per-channel (channelban); non-ASCII still uses the Unicode-lowercased fallback, and a proptest pins the two paths equal on ASCII reverse 2026-08-19 00:45:14 +00:00
• 35bb901455 whoisport: report the port the user actually connected to (User.port, set at accept) instead of conf("bind")/conf("bind_tls") — those are Vec-valued so conf() returned only the LAST configured listener, giving every user the same wrong port on a multi-listener server reverse 2026-08-19 00:43:03 +00:00
• 25702c9541 syslog: strip control chars (CR/LF) from the message before framing — a snotice carrying user-influenced text (nick/realname/quit reason) with an embedded newline could inject a forged syslog record; matches the CR/LF care the JSON log path already takes reverse 2026-08-19 00:42:30 +00:00
• d9d5bd069b filehost: refuse to sign upload tokens when filehost_jwt_secret is unset/empty/"changeme" — the default fell open, signing with a world-known key so anyone could forge a server-trusted upload authorization; now it fails closed and tells the user to fix the config reverse 2026-08-19 00:42:10 +00:00
• a09dfc74df auth: constant-time compare for VHOST and WEBIRC secrets — both used plain == on the config password, unlike oper/RPC/JWT secrets which already route through ct_eq; expose password_hash::ct_eq as the shared comparator and use it (usernames stay plain == — not secret) reverse 2026-08-19 00:41:47 +00:00