diff --git a/.hgignore b/.hgignore index 13a78ec2..2375ef17 100644 --- a/.hgignore +++ b/.hgignore @@ -1,9 +1,12 @@ syntax: glob Makefile +*~ *.o *.so *.lo *.la +*.orig +*.log .deps .libs autom4te.cache @@ -14,13 +17,17 @@ include/serno.h libratbox/include/libratbox_config.h libratbox/include/librb-config.h libratbox/include/stamp-h1 +libratbox/libratbox.pc libratbox/libtool +scripts/*.tbz2 +scripts/*.tgz servlink/servlink src/ircd src/lex.yy.c src/version.c.last src/y.tab.h src/y.tab.c +ssld/ssld tools/convertilines tools/convertklines tools/mkpasswd diff --git a/CREDITS b/CREDITS index 3dbaa9dd..97d1e95e 100644 --- a/CREDITS +++ b/CREDITS @@ -7,7 +7,7 @@ network configurations. The charybdis core team is listed in nick-alphabetical order: -dwr, Valery Yatsko +dwr, Valery Yatsko gxti, Michael Tharp jilles, Jilles Tjoelker nenolod, William Pitcock diff --git a/TODO b/TODO index 1ec8cf84..77198bfc 100644 --- a/TODO +++ b/TODO @@ -4,6 +4,7 @@ [x] remove 2.8 report_error() in ratbox imported stuff [F] client.c, channel.c is very 2.8 style still. it'd be nice to pack them into their own namespace and such. moreover, the other 2.8 code needs similar rewriting/reworking too... + [x] merge m_join.c and m_sjoin.c in one module (same functions, done in ratbox3) [ ] rewrite s_auth.c [ ] authentication state/lock manager [ ] move resolver/auth checker code into separated modules @@ -12,7 +13,7 @@ [x] clean up maxconnections kludges &c [x] in-process SSL [x] port and use ratbox ssld for server links - [ ] merge with libratbox SVN + [x] merge with libratbox SVN [/] ssl stuff [x] client-to-client ssl [x] server-to-server ssl @@ -21,29 +22,32 @@ [ ] acknowledgement message for SSL users like '* *** You are connected using SSL cipher "DHE RSA-AES 128 CBC-SHA"' [x] tool for generating ssl certificates and other stuff [x] gnutls backend for at least SSL connections (replacing libcrypto use in m_challenge would be nice too) -[x] merge some stuff from ircd-seven directly (to be determined what) +[/] merge some stuff from ircd-seven directly (to be determined what) [x] remote d:lines support + [x] PASS selector:password for auth{} (useful for dynamic IPs) + [ ] +C (noctcp) channel/usermode [F] kline/xline/resv sync [F] make an ability of using bandb instead of .conf files as bans storage [x] drop non-TS6 (legacy protocol) support [F] Doxygen code documentation [/] module engine rework - [x] more beautiful way of adding new channel modes by module + [/] more beautiful way of adding new channel modes by module + [x] basic functionality + [x] some example modules + [ ] think on how could we append privilege checking for simple chmode - like chm_staff, but additionaly limited (e. g. IsOperResv etc); + possibly move the same code for all functions into separated one and make it extern? [ ] make nick/user/host validation functions/match tables able to work in separated modules, this will help us making support for native characters sets/slashes in host etc [ ] auth checker module [ ] resolver module [x] Remove glines entirely -[ ] Bug fixes - [ ] Compilation without zlib headers fails +[/] Bug fixes + [x] Compilation without zlib headers fails - fixed [ ] Compilation date and time in server welcome message is in OS locale - looks ugly 'cause often it's not match user's codepage --- other stuff - [?] allow to set up configfiles path (etc/) instead of separated configfiles names (kline.conf, ircd.conf etc) like it is in ratbox3? - [?] PASS selector:password for auth{} from ircd-seven? (useful for dynamic IPs) - [?] +C (noctcp) channel/usermode from ircd-seven? + [ ] allow to set up configfiles path (etc/) instead of separated configfiles names (kline.conf, ircd.conf etc) like it is in ratbox3? [?] internally split out +o/+v "ranks" into a series of permissions. this could allow for configure-defined special access levels, halfops, etc. (would need to match globally, somehow. extra SVINFO param?) [?] somehow hide channel operators like ircnet can do? - [x] merge m_join.c and m_sjoin.c in one module (same functions, done in ratbox3) [x] create chmode.h and put there all declarations of chm_* - this will make some modules clean [?] Move oper override server WALLOPS to global server notices? diff --git a/doc/example.conf b/doc/example.conf index 5e02e0df..48df57c5 100755 --- a/doc/example.conf +++ b/doc/example.conf @@ -460,7 +460,8 @@ general { reject_ban_time = 1 minute; reject_after_count = 3; reject_duration = 5 minutes; - max_unknown_ip = 2; + throttle_duration = 60; + throttle_count = 4; }; modules { diff --git a/doc/reference.conf b/doc/reference.conf index 4d544805..0b64947b 100755 --- a/doc/reference.conf +++ b/doc/reference.conf @@ -1153,10 +1153,14 @@ general { /* reject duration: the amount of time to cache the rejection */ reject_duration = 5 minutes; - /* max_unknown_ip: maximum number of pending connections to the server - * that are allowed per IP address + /* throttle_duration: Amount of time that throttling will be applied to an IP + * address. */ - max_unknown_ip = 2; + throttle_duration = 60; + + /* throttle_count: Number of connections within throttle_duration that it takes + * for throttling to take effect */ + throttle_count = 4; }; modules { diff --git a/doc/sgml/oper-guide/config.sgml b/doc/sgml/oper-guide/config.sgml index a5ae1df0..fc44fb73 100644 --- a/doc/sgml/oper-guide/config.sgml +++ b/doc/sgml/oper-guide/config.sgml @@ -549,8 +549,6 @@ connect "name" { The hostname or IP to connect to. - Charybdis uses solely DNS for all hostname/address lookups - (no /etc/hosts or anything else). Furthermore, if a hostname is used, it must have an A or AAAA record (no CNAME) and it must be the primary hostname for inbound connections to work. @@ -1094,6 +1092,28 @@ service { + + Hostname resolution (DNS) + + Charybdis uses solely DNS for all hostname/address lookups + (no /etc/hosts or anything else). + The DNS servers are taken from /etc/resolv.conf. + If this file does not exist or no valid IP addresses are listed in it, + the local host (127.0.0.1) is used. (Note that the latter part + did not work in older versions of Charybdis.) + + + IPv4 as well as IPv6 DNS servers are supported, but it is not + possible to use both IPv4 and IPv6 in + /etc/resolv.conf. + + + For both security and performance reasons, it is recommended + that a caching nameserver such as BIND be run on the same machine + as Charybdis and that /etc/resolv.conf only + list 127.0.0.1. + +