fedserv/echoIRCd
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Commit graph

  • c72b966e0a mode: cap mode changes per MODE command (modes=, default 20) and advertise it as the MODES= ISUPPORT token — an uncapped modestring like MODE #c +bbbb… dispatched a handler per letter, each fanning out to the whole channel and every S2S link (amplification DoS); matches InspIRCd's MODES limit reverse 2026-08-19 00:40:58 +00:00
  • 11cec9fc36 s2s/xline: reject a malformed ADDLINE duration instead of coercing it to 0 (= a silent permanent ban), and make add_xline expiry saturating (n.saturating_add) so a peer sending duration=u64::MAX can't overflow-panic the debug build or wrap in release reverse 2026-08-19 00:39:40 +00:00
  • bbe4ee4567 http: bound spawn_http concurrency (http_max_concurrent, default 32) like spawn_crypto — it spawned one unbounded OS thread per call, so a pre-auth VERIFY/REGISTER flood could exhaust threads and hammer the accounts backend; at capacity the command now fails with TEMPORARILY_UNAVAILABLE instead reverse 2026-08-19 00:39:01 +00:00
  • 801614605f http: verify TLS certs by default + cap the response body — set_verify(NONE) unconditionally let a MITM read/forge the account-registration & captcha traffic (usernames, emails, plaintext passwords) POSTed to operator-configured https URLs; now the connector's cert+hostname check stays on (opt out with http_tls_verify=no), and read_to_end is bounded to 4 MiB so a hostile endpoint can't OOM the worker reverse 2026-08-19 00:37:50 +00:00
  • 6682227f81 denychans: bound redirect recursion — a badchan redirect re-enters Server::join (which re-runs denychans), so a redirect loop (#a->#b->#a) or a redirect into a broad badchan glob recursed until the single-threaded daemon stack-overflowed from one JOIN; cap the chain at 8 hops via a RedirDepth guard in ext reverse 2026-08-19 00:36:29 +00:00
  • a4f4c29a8a connectban: clamp the IPv6 keep-hextets to >=1 — connectban_ipv6cidr between 1 and 15 made keep==0, so the z-line glob became "*" and banned every IPv6 address on the internet (and bucketed all v6 clients into one key); mirrors the v4 clamp(1,4) reverse 2026-08-19 00:34:53 +00:00
  • c99f16f3e0 webirc: require a non-empty source-IP mask on a webirc block — an empty ipmask meant "any IP", so a maskless webirc=<password> block turned one shared secret into a full host/IP spoof (bypassing z-lines, DNSBL, GeoIP, cloak) for anyone who learned it; now the gateway's connecting IP must match the block's ipmask reverse 2026-08-19 00:34:25 +00:00
  • f56b68d6f5 resolver: close an off-path DNS spoof — connect() the UDP socket so the kernel drops replies from any IP but the nameserver, and use a CSPRNG per-query transaction id instead of the hardcoded 0x4543/0x4544 (which were in the public source, so rDNS/DNSBL answers could be forged with no guessing) reverse 2026-08-19 00:33:18 +00:00
  • 1763a95985 s2s: validate a message source actually lives behind the link it arrived on (source_behind) before applying remote JOIN/IJOIN/KICK/TOPIC/MODE/KILL/PRIVMSG — else a peer could forge ops/kicks/bans/topics/service-badged messages for users behind another link; NICK/QUIT/PART already guarded this, now the channel-state handlers do too reverse 2026-08-19 00:32:09 +00:00
  • 235c747c03 refactor: WEBIRC gateways and +G censor rules are named structs (WebircGateway/CensorRule) instead of positional tuples — self-documenting field access, no (_, g, _) index guessing; extends the OperBlock pattern reverse 2026-08-18 23:31:21 +00:00
  • c4456cf002 oper: TLS client-cert fingerprint login — oper block gains an optional fp=<sha256>; password=* means cert-only. Named OperBlock struct replaces the (name,pass,level) tuple. (Password login was never broken — verified live.) reverse 2026-08-18 22:55:07 +00:00
  • 853be58d18 perf: channel PRIVMSG/NOTICE fanout builds at most one line per capability profile (server-time/account-tag/message-tags) and shares it by Arc, instead of formatting a String per member — a big channel now allocates <=8 lines, not N reverse 2026-08-18 22:37:50 +00:00
  • d4dadf33e6 metrics: optional OpenMetrics/Prometheus endpoint (metrics_bind, off by default) — commands/messages/connects counters bumped inline via shared atomics, users/channels/servers/links gauges republished each tick; no event round-trip on the hot path reverse 2026-08-18 22:34:36 +00:00
  • 30754f08b5 refactor: define caps from one token=>field list via a macro that generates SUPPORTED_CAPS + the Caps struct + has/set — an advertised-but-unwired cap (or an unwired field) no longer compiles reverse 2026-08-18 22:29:47 +00:00
  • a3dc7b521f test: deterministic two-node S2S convergence simulator — real handshake + join/part/rejoin/FJOIN-TS-arbitration driven through actual code paths, proptest-randomised churn asserts both sides always converge; extract Server::part so the sim and the PART command share one path reverse 2026-08-18 22:24:19 +00:00
  • 621f06448d test: property-based fuzzing (proptest) for every untrusted-input parser — message line, PROXY header, WebSocket frame, regex engine, ban-mask, duration; asserts no-panic + round-trip/idempotence/bounds invariants reverse 2026-08-18 22:17:17 +00:00
  • cf2b157842 perf: to_channel shares one Arc<str> across all broadcast recipients instead of cloning the line per member (server-time members share a single time-tagged variant); single-recipient sends unchanged reverse 2026-08-18 20:30:07 +00:00
  • fc58113db9 tls: add opt-in pure-Rust rustls backend behind the TlsBackend trait (tls_backend = rustls; default stays openssl) — TLS1.3, CertFP via handshake-sig verify, SNI, REHASH reload; bump integration timeouts for loaded-host robustness reverse 2026-08-18 20:20:21 +00:00
  • 2565089666 gitignore runtime *.db state (reputation.db/permchannels.db) — untrack; they must never be committed reverse 2026-08-18 19:55:11 +00:00
  • 20b49add0b perf: mimalloc global allocator + aHash maps + memchr line framer + LTO/codegen-units=1 — ~29% faster channel fanout; and drop the bogus openssl+mio dependency whitelist from the guard (any perf crate is welcome now) reverse 2026-08-18 19:45:33 +00:00
  • 687c91638b remove some stupid text. reverse 2026-08-18 19:26:22 +00:00
  • 33a18b81cc channelban: leave the a: (account) extban mask verbatim — normalize_ban_mask was appending !*@* and breaking account matching reverse 2026-08-18 15:59:00 +00:00
  • bcd958d2d3 ircv3: close server-support-table gaps — BOT=B ISUPPORT, account-extban (a: matcher + ACCOUNTEXTBAN=a), draft/read-marker cap (gates MARKREAD sync), and no-implicit-names (suppress the post-JOIN NAMES burst) reverse 2026-08-18 15:56:59 +00:00
  • c9bd8e7492 channel-rename: implement IRCv3 draft/channel-rename — RENAME command + cap, in-place rename (RENAME for cap clients, PART/JOIN fallback for the rest), and S2S propagation reverse 2026-08-17 23:45:02 +00:00
  • 755e835baf snoop: only announce a client's exit if it registered — an unregistered liveness/health probe was spamming the +q snomask (regression from firing on_user_quit for all users) reverse 2026-08-17 22:49:29 +00:00
  • 244feb9f45 reactor: bound the blocking TLS handshake (proxied-TLS path) with tls_handshake_timeout so a stalled handshake can't pin a thread/socket reverse 2026-08-17 22:13:37 +00:00
  • 7563daf3a3 account_registration: GC the per-IP rate-limit table on the tick (an entry per distinct registering IP was never dropped) reverse 2026-08-17 22:13:37 +00:00
  • e28efb03e6 callerid: cap the auto-accept list like the explicit ACCEPT command reverse 2026-08-17 21:37:19 +00:00
  • fad66eaac2 chathistory: GC conversation keys idle past chathistory_maxage (default 7d) — the key set never shrank reverse 2026-08-17 21:37:19 +00:00
  • 5522e36125 reactor: reap proxy-pending connections that never send their PROXY header (were never timed out) reverse 2026-08-17 21:37:18 +00:00
  • de4cf9866d channel: scrub a departed user from every +i invite list (invited-then-quit leaked a Uid on persistent channels) reverse 2026-08-17 21:37:18 +00:00
  • 0da0906dc9 core: fire on_user_quit for unregistered users too — pre-registration module state (captcha Challenged/Verified) leaked one Uid per held-then-dropped bot reverse 2026-08-17 21:37:18 +00:00
  • f2e23fffa9 captcha: issue the challenge once per held client, not on every command they send reverse 2026-08-17 20:37:51 +00:00
  • d6cc813aad channel: reclaim departed-member +f flood counters and expired +J entries on the tick (slow high-churn leak) reverse 2026-08-17 20:37:51 +00:00
  • 92a3f5ba86 s2s: propagate CHGHOST/CHGIDENT host/ident changes to links (were applied locally only); inbound path uses a non-propagating variant to avoid a loop reverse 2026-08-17 19:38:58 +00:00
  • 73f8ff58ed s2s: enforce servprotect on a remote KILL and rank-vs-victim on a remote KICK (matching the local paths) reverse 2026-08-17 19:38:58 +00:00
  • da36d5c32a s2s: FJOIN TS arbitration wipes list modes+topic on loss and merges on equal TS; arbitrate remote-remote nick collisions (rewrite forward); IJOIN/FTOPIC channel-TS handling reverse 2026-08-17 19:32:18 +00:00
  • 4b86de3b62 registration: add a Hold verdict so captcha/challenge modules pend the client for the challenge instead of tearing the link down reverse 2026-08-17 19:06:17 +00:00
  • 99eb9c74f3 relaymsg: gate RELAYMSG on oper (it spoofs an arbitrary source nick), matching InspIRCd reverse 2026-08-17 19:06:17 +00:00
  • d6f27ac56c securitygroups: honor tls=no/account=no/etc. instead of inverting them to require reverse 2026-08-17 15:05:13 +00:00
  • edb10a6607 connectban: never collapse the ban mask to * on a sub-/8 CIDR (would z-line the whole network) reverse 2026-08-17 15:05:13 +00:00
  • 58d5a0e5a5 message: keep +U opmoderated messages out of CHATHISTORY/+H replay, and subject TAGMSG to the same PM gates (+c/+R/+z/+g/SILENCE) reverse 2026-08-17 15:05:13 +00:00
  • 45f4ee552d xline: remove masks case-insensitively, matching how they're enforced reverse 2026-08-17 14:52:38 +00:00
  • 480b5faea0 sanick/svsnick: allow a case-only rename (in-use check matched the target itself) reverse 2026-08-17 14:52:38 +00:00
  • 8ed2003546 callerid: scrub a departed/renamed nick from ACCEPT lists so it can't be reused to bypass +g reverse 2026-08-17 14:52:38 +00:00
  • c1b7ed6dda channel: count remote members for +l, and propagate TBAN expiry (-b) over S2S reverse 2026-08-17 14:52:38 +00:00
  • 713406870b who: hide +u auditorium and +D delayjoin members on WHO #chan, matching NAMES reverse 2026-08-17 14:52:38 +00:00
  • 3d7ee6b586 reputation: count remote/services channel members toward the minchanmembers gate (score was frozen) reverse 2026-08-17 13:27:58 +00:00
  • 62c0141362 test: services standard reply (SWSTDRPL) reaches a standard-replies client reverse 2026-08-17 13:12:31 +00:00
  • 5722640957 s2s: handle echo's metadata profile keys, standard replies, OPERTYPE and REDACT; emit ssl_cert + OPERTYPE reverse 2026-08-17 13:08:14 +00:00
  • 8f765bfba7 s2s: deliver server-sourced NOTICE/PRIVMSG (services SET SNOTICE) instead of dropping it reverse 2026-08-17 11:40:46 +00:00
  • 0f28083855 markread: persist account-keyed read markers to disk and restore them at startup reverse 2026-08-17 02:12:17 +00:00
  • 3f9aa8c6eb channel: cull an empty channel when a mode change (-P/-r) removes its last reason to persist reverse 2026-08-17 01:50:11 +00:00
  • b451ccbfd8 permchannels: persist +P channels (modes, topic, ts, list modes) to disk and restore them at startup reverse 2026-08-17 01:43:29 +00:00
  • 978f8f8f82 reputation: persist the score table on each bump/expire so restarts don't revert to a stale snapshot reverse 2026-08-17 01:19:57 +00:00
  • e10ea609ed s2s: apply inbound CHGHOST/CHGIDENT (services vhost) instead of dropping it reverse 2026-08-17 00:36:03 +00:00
  • 2ce6a5619c docs: note REHASH cert reload and the tls_sni per-hostname cert key reverse 2026-08-16 23:37:34 +00:00
  • 471fc00dfc tls: reload certs on REHASH (renewed cert applies without restart) and add per-hostname SNI via tls_sni reverse 2026-08-16 23:35:36 +00:00
  • a6293d5bbc docs: document cloak_method and the account/fingerprint/static cloak keys reverse 2026-08-16 19:52:27 +00:00
  • 6efbcb6db0 cloak: config-selectable methods (account, fingerprint, static) alongside the default hmac-sha256 reverse 2026-08-16 19:49:26 +00:00
  • 262699bf30 kick: route KICK of a remote channel member to its server and drop the local view reverse 2026-08-16 19:31:49 +00:00
  • 68b80c3f82 s2s: announce remote members arriving via FJOIN to local channel members reverse 2026-08-16 19:26:10 +00:00
  • ef84846267 invite: route INVITE for a remote target to its server and deliver inbound INVITE reverse 2026-08-16 19:11:57 +00:00
  • 559a102e48 add oper SQUIT command to disconnect a linked server by name reverse 2026-08-16 19:10:29 +00:00
  • d4a7043d10 s2s: resolve nick collisions by timestamp (force-rename loser to its UUID, SAVE) instead of killing; services always keep their nick reverse 2026-08-16 19:03:07 +00:00
  • 767ecb3471 whois: fold the channel list across multiple 319 lines to stay under 512 bytes reverse 2026-08-16 18:46:07 +00:00
  • e57e4c3a6a names: fold the member list across multiple 353 replies to stay under 512 bytes reverse 2026-08-16 18:45:12 +00:00
  • 94f57608f7 mode: require half-op to view the autoop/exemptchanops/filter lists reverse 2026-08-16 18:44:08 +00:00
  • dadbff91d8 xline: accept the durationless KLINE/GLINE form (mask :reason) instead of eating the reason reverse 2026-08-16 18:21:32 +00:00
  • 5046083608 add HELP command with a built-in index and per-topic help (704/705/706) reverse 2026-08-16 18:20:57 +00:00
  • ba9d62b172 cap: advertise IRCv3 sts policy (sts_duration/sts_port/sts_preload) for TLS upgrade reverse 2026-08-16 18:19:04 +00:00
  • 4ce500e525 cap: fold CAP LS 302 into multiple continuation lines to stay under 512 bytes reverse 2026-08-16 18:17:29 +00:00
  • 1ab643c870 s2s: timestamp arbitration for fjoin (lower TS wins — strip or wipe losing status), fmode and ftopic (drop changes stamped newer than ours) reverse 2026-08-16 18:06:03 +00:00
  • 7908fe50b0 s2s: propagate x-lines (ADDLINE/DELLINE) — apply from peers, announce local ones, burst on link reverse 2026-08-16 18:01:52 +00:00
  • 98fb848b8c s2s: route and apply KILL across the link (inbound handler + remote-target routing) reverse 2026-08-16 17:57:50 +00:00
  • 579c321670 channels/whois: validate +k/+l, cap and case-fold ban lists, honour -n for externals, hide +s/+p/+i from whois/who/names, 301 in whois, conf-key the join/nickflood lockout reverse 2026-08-16 17:56:24 +00:00
  • 4028cd3c84 s2s: verify NICK/QUIT/PART source is reached via the link it arrived on reverse 2026-08-16 17:54:20 +00:00
  • e87c9fd9ca s2s: reject malformed or duplicate UIDs on introduction reverse 2026-08-16 17:50:25 +00:00
  • 9ff0d8c629 s2s: apply METADATA accountname only from a services source reverse 2026-08-16 17:48:21 +00:00
  • 04423388d5 services: reword uline/service code comments, drop external daemon references reverse 2026-08-16 14:12:18 +00:00
  • 36b8a31a9a services: name the service message tag @echo/services (the project), not a foreign/author vendor prefix reverse 2026-08-16 14:00:17 +00:00
  • d012623dff services: add server-level uline/is_service flag and gate the service WHOIS line, echo/services tag, MAP/LINKS hide and SVS* on it reverse 2026-08-16 13:43:17 +00:00
  • 64d3bfc003 test: cover IJOIN status-mode application (bot joins +ao) — regression guard for the S2S ijoin handler that previously had none reverse 2026-08-16 13:16:09 +00:00
  • 636da13a8a mode: register +r as a services-only channel mode so a user MODE +r gets a clean rejection instead of 472 unknown-mode (chanserv still sets it via mode_sudo) reverse 2026-08-16 03:10:15 +00:00
  • b7600ee5aa add +k servprotect umode (server-set-only, advertised in 004/umodes): blocks KILL, KICK and SA* on a network service; tracked for remote services too reverse 2026-08-16 03:00:25 +00:00
  • 91022cffe8 whois: track remote users' umodes from UID; show 335 (is a bot) for remote +B services/bots and 379 modes to opers reverse 2026-08-15 23:50:07 +00:00
  • 7d57e4ed34 connectban: never flood-ban loopback (127.0.0.1/::1) and add a connectban_exempt glob/cidr list reverse 2026-08-15 23:25:16 +00:00
  • 59b0439b79 whois: append the snomask to the 379 modes line for opers (is using modes <umodes> +<snomask>), matching the standard format reverse 2026-08-15 17:17:12 +00:00
  • 546f6279e7 snomasks: make +s a parametric snomask mode with the standard category letters (acdfgjklnoqrtuvwx), route each server notice by category, RPL_SNOMASKIS 008; opers default to all and narrow with +s -c etc. reverse 2026-08-15 17:06:14 +00:00
  • 309201d7fb whois: add 307 (is a registered nick) for identified users and 379 (is using modes) for opers/self reverse 2026-08-15 16:46:10 +00:00
  • 35af95fd0f harden: connclass clone-cap at register, ws control-frame limits, uuid recycle-skip, json-escape extjwt/filehost claims, metadata value/key caps, cloak numeric-dotted leak, relaymsg remote-nick, rpc set_oper block validation, isupport 13-token split, multi-hop privmsg routing, connectdelay=0 reverse 2026-08-15 16:27:11 +00:00
  • e935ee7002 harden: fix reachable panics (parse_duration/parse_iso/dechunk char-boundary+overflow), s2s netburst key/limit loss, rpc set_nick/set_vhost/notice injection, webirc rehash reload, panic-state reset, ws line cap, remote nick collision, per-conn state leaks reverse 2026-08-15 15:02:36 +00:00
  • 3fa9737ccb link: stop services re-locking +r on every join — track the registered channel mode, keep +r channels alive when empty, use ijoin not fjoin for incremental joins, and consume s2s channel-mode params through the registry reverse 2026-08-15 13:20:04 +00:00
  • 62f901bdc8 sasl: wrap the s2s sasl relay in encap (client/agent/mode/data) so services drive authenticate, account via metadata reverse 2026-08-15 12:04:09 +00:00
  • 1c8799d785 link: rework s2s wire format to the standard v4 server protocol (10-field uid, letters-comma fjoin, ijoin, timestamped fmode, ftopic, uuid kick) so external services link reverse 2026-08-15 11:51:18 +00:00
  • f921c2eb9c docs: document all 85 previously-missing config keys in the example — on-connect (connbanner/autojoin/umodes), account registration, captcha gates, antirandom/blockamsg/connectban/hashident, restrict* + securelist + denychans + channames + maphide, and customtitle/extjwt/filehost/randquote reverse 2026-08-15 01:37:16 +00:00
  • 0ace39c882 listeners: make bind/bind_tls/bind_server repeatable (multiple addresses/ports) and normalize IPv4-mapped IPv6 peers back to plain IPv4 — a single [::] bind now serves IPv4+IPv6 with clean v4 addresses reverse 2026-08-15 01:12:37 +00:00
  • 08ed18bb96 deploy: Let's Encrypt deploy-hook — installs the renewed cert into echoircd's tls/ (readable by the daemon user) and restarts only when it changed; symlink into certbot renewal-hooks reverse 2026-08-15 01:12:37 +00:00
  • dae0cb985b modes: render the full channel mode set in MODE queries — +P/Q/A/U/D and params +B/J/d/K were set but never shown reverse 2026-08-14 17:42:34 +00:00
  • 5bf2116786 modes: close channel-mode privilege gaps — +P (permanent) and +O (oper-only join) are now IRC-oper-only, and adding a +w autoop entry requires the rank the granted prefix needs (a half-op could otherwise auto-op itself) reverse 2026-08-14 17:42:34 +00:00