ircd.rs/leveva/src/ at b24bdc012fcfe6dc1199039a06d341b854d88456 · xeiaso.net/ircd.rs · Tangled

xeiaso.net / ircd.rs

0

Proof of concept mechanical port of ircnet/ircd to Rust as part of a bit about C being insecure for network services

0

ircd.rs / leveva / src

5 folders 54 files

at b24bdc012fcfe6dc1199039a06d341b854d88456

Xe Iaso feat(leveva): OKICK — operator force-kick bypassing chanop status (P11 slice 294) 5w ago

feat(leveva): OKICK — operator force-kick bypassing chanop status (P11 slice 294) charybdis extensions/m_okick.c: an operator force-kicks a member without being a chanop (or even a member of the channel), sourced from the server so the channel sees a normal KICK. The oper-override sibling of KICK (chanop-gated) and REMOVE (chanop force-part), completing the operator channel-intervention family. - New atomic seam Channels::okick: no permission/rank check (the override); the one refusal is +Y official-join, whose immunity leveva keeps absolute. - command/okick.rs gate ladder 481/461/401/403/441/482; server-sourced KICK echoed to the oper + fanned to local members; relayed via new s2s::relay::server_kick; +s audit snomask. - Help page + COMMANDS allowlist + index.md operator line. - 4 channel units + 5 command units + okick_proptest (2 props) + golden_okick. leveva-native (no oracle); plain oper-bit gate; +Y respected (vs charybdis raw removal); oper always gets the echo even off-channel; local-only.

1 month ago

feat(leveva): XLINE/UNXLINE realname (gecos) operator ban (P11 slice 289) Charybdis-style XLINE/UNXLINE: an operator bans connections by a realname (gecos) glob — the realname sibling of the K-line (user@host) and D-line (ip/cidr) families, completing the runtime ban quartet K/D/X/RESV. Bolt-for-bolt the DLINE plane (slice 284) with a single-token gecos matcher (matching::matches) instead of CIDR: - leveva::xline::{Xline,XlineStore} — SQLite write-through + boot reload. - command/xline.rs — 461 param gate before OperPrivilege::Xline 481; reap local matching realnames (465 + ERROR close); s2s propagation. - s2s/xline.rs — ENCAP * XLINE/UNXLINE carrier (remaining seconds) + apply. - s2s/burst.rs::xline_burst re-assertion; forward.rs ENCAP arms. - Registration X-line gate in finalize_registration after the K-line/config-ban gates; STATS x -> 247 RPL_STATSXLINE. - Lights up the dead xline_exempt flag end-to-end (Admission/ClientRecord + set_xline_exempt), a dedicated exemption distinct from kline-exempt. leveva-native (no differential). Gate: cargo test -p leveva green (golden_xline + xline_proptest + the touched iline/stats/help goldens), clippy clean, workspace build 0 warnings.

1 month ago

chore: version bump Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

feat(leveva): OKICK — operator force-kick bypassing chanop status (P11 slice 294) charybdis extensions/m_okick.c: an operator force-kicks a member without being a chanop (or even a member of the channel), sourced from the server so the channel sees a normal KICK. The oper-override sibling of KICK (chanop-gated) and REMOVE (chanop force-part), completing the operator channel-intervention family. - New atomic seam Channels::okick: no permission/rank check (the override); the one refusal is +Y official-join, whose immunity leveva keeps absolute. - command/okick.rs gate ladder 481/461/401/403/441/482; server-sourced KICK echoed to the oper + fanned to local members; relayed via new s2s::relay::server_kick; +s audit snomask. - Help page + COMMANDS allowlist + index.md operator line. - 4 channel units + 5 command units + okick_proptest (2 props) + golden_okick. leveva-native (no oracle); plain oper-bit gate; +Y respected (vs charybdis raw removal); oper always gets the echo even off-channel; local-only.

1 month ago

chore: version bump Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

feat(leveva): outbound S2S server links over TLS (P11 slice 176) Closes the documented deferral in command::connect: leveva accepted TLS server-links on a server-only TLS listener but could only dial out in plaintext. A connect{} block flagged `tls` now dials over a rustls client connection (new tls::connect_outbound + accept-any-server-cert verifier, symmetric to the inbound accept-any-client-cert; links authenticate by PASS, not PKI). The flag rides OutboundLink so both operator CONNECT and the auto-connect ticker inherit it; main::dial_server wraps the socket then hands off to a stream-generic run_outbound. Config-parse fuzzed + in-process connector integration + a full two-node TLS link golden.

1 month ago

feat(leveva): +R registered-only-messages user mode (charybdis UMODE_REGONLYMSG) — P11 slice 248 A +R user receives a private PRIVMSG/NOTICE only from a sender identified to a services account, bypassed by an identified/operator/accepted sender; a blocked PRIVMSG bounces 486 ERR_NONONREG, a NOTICE is silently dropped. Channel messages are unaffected. Client-settable, purely local (gate runs on the target's home server) so not in SEND_UMODES — the caller-id/deaf precedent. This is the local-sender plane; the remote-sender S2S plane is the slice-249 follow-on (mirroring the caller-id 216->217 split). UserMode::RegOnlyMsg (bit 0x4000), mode::is_regonly_msg predicate, callerid::regonly_msg_blocks decision core, the command::message gate, and numeric 486. Unit + golden + proptest coverage; 004 usermode list -> oOiwraWBxsgGZDR.

1 month ago

test(leveva): chathistory golden + proptest, help page, docs; refresh stale help_users snapshot — P11 slice 274 (3/3)

1 month ago

feat(leveva): shared client registry (nick uniqueness table) The foundational shared-state primitive the next P11 slices stand on: a process-wide Registry<folded-nick → ClientRecord> behind a Mutex, carried in the Arc<ServerContext> so every per-connection tokio task sees one table. Keyed by casemap::fold (added here) so alice/ALICE/Alice[]/alice{} collide — the CASEMAPPING=rfc1459 divergence enforced at the table, not just advertised. try_claim/try_rename/release/contains/get/len, with unit tests pairing each positive with its inverse (claim→release→reclaim, rename-collision changes nothing). Not yet wired into registration; that is the next commit.

1 month ago

feat(leveva): client certificate fingerprints (CertFP), charybdis-style (P11 slice 78) A TLS client that presents a client certificate now gets a SHA-256 fingerprint that leveva surfaces in WHOIS (276 RPL_WHOISCERTFP), lets a certfp-gated `operator` block require, and propagates network-wide via `ENCAP * CERTFP` — modelled on charybdis (sslproc.c / m_certfp.c / m_whois.c / m_oper.c / s_user.c). - leveva::certfp: fingerprint(der) = lowercase-hex SHA-256 of the leaf cert DER; from_peer_certs() over rustls' presented chain. - tls.rs: AcceptAnyClientCert verifier — requests but does not require a client cert, accepts any issuer (the fingerprint is the identity) while still verifying the handshake signature. TlsEndpoint now requests client auth. - main.rs/session.rs: extract the peer cert after the handshake → Session certfp; finalize mirrors it into the registry record (Registry::set_certfp), the single source of truth read by WHOIS and the OPER gate (no Registered churn). - OPER: Operator.certfp (config `certfp "..."`); a block grants oper only if the password verifies AND the certfp matches case-insensitively — mismatch/absence is 491, distinct from the 464 password arm. - S2S: burst appends `:<uid> ENCAP * CERTFP :<fp>` per local certfp user; inbound ENCAP CERTFP records it on the source's record then relays verbatim. Divergence: sha256-only (charybdis defaults to deprecated sha1 + a method menu); single-server-local notify (the burst carries it; no live post-burst rebroadcast).

1 month ago

feat(leveva): OKICK — operator force-kick bypassing chanop status (P11 slice 294) charybdis extensions/m_okick.c: an operator force-kicks a member without being a chanop (or even a member of the channel), sourced from the server so the channel sees a normal KICK. The oper-override sibling of KICK (chanop-gated) and REMOVE (chanop force-part), completing the operator channel-intervention family. - New atomic seam Channels::okick: no permission/rank check (the override); the one refusal is +Y official-join, whose immunity leveva keeps absolute. - command/okick.rs gate ladder 481/461/401/403/441/482; server-sourced KICK echoed to the oper + fanned to local members; relayed via new s2s::relay::server_kick; +s audit snomask. - Help page + COMMANDS allowlist + index.md operator line. - 4 channel units + 5 command units + okick_proptest (2 props) + golden_okick. leveva-native (no oracle); plain oper-bit gate; +Y respected (vs charybdis raw removal); oper always gets the echo even off-channel; local-only.

1 month ago

feat(leveva): per-class connection-accounting core + admission decision (P11 slice 136) The connection-class limit fields (max-links / max-local-per-host / max-local-per-user-host / cidr) have been parsed and modelled since the config layer existed but never enforced (the deferral repeated across slices 49/82/89). This commit lands the foundation, unwired: - connlimit::check_admission — the pure admission decision (admit iff every enabled cap has headroom; first full cap in priority order is the denial). - connlimit::ConnLimits — the live per-ServerContext accounting store: atomic try_admit (check + increment under one lock) / release (decrement + prune). - cidr::network_base — the CIDR-block grouping key. A limit of 0 (and cidr None) means unlimited. leveva-native (no oracle differential). Wiring into registration + the golden/proptest gate follow.

1 month ago

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

feat(leveva): chat-history foundations — SQLite store, serde Message, config + caps + ISUPPORT — P11 slice 274 (1/2)

1 month ago

feat(leveva): enforce + REHASH-able options { connection-accept } (P13 slice 206) The previously parsed-but-dead `connection-accept` (with `split-min-servers`/ `split-min-users` as the Split-mode inputs) is now enforced at registration finalize and hot-reloaded by REHASH — closing the last boot-immutable `options` field on the phase-13 rehash backlog. - connaccept.rs: pure `is_split`/`admits` + REFUSED_REASON (no globals/clock). On accepts; Off refuses everyone; Split accepts only while the net is split (reachable servers/users below the configured thresholds; a 0 threshold disables that dimension). Refusal is a bare ERROR :Closing Link close. - session.rs finalize_registration: the gate is the first check (client path only — servers still link). Existing clients are never kicked (gate bites at registration finalize), so an operator can flip to off and still REHASH back. - control.rs/server.rs/main.rs: the canonical live_*().unwrap_or(ctx.…) ConfStore seam with a StatsConf ctx field (the slice-191 `bans` precedent → zero churn on the 62 hand-rolled ServerContext literals). Tests/fuzz: connaccept units + connaccept_proptest (On/Off invariant, Split≡split, is_split reference + monotone), session gate units (off/on/split + inverses), control units, rehash_conf_proptest lockstep, golden_rehash_conn_accept boot test (off refuses a fresh client / REHASH reopens). 1941 lib pass; clippy clean; workspace 0 warnings.

1 month ago

docs(leveva): correct stale deferral comments A doc-only sweep of "deferred"/"follow-on"/"future slice"/"out of scope" comments that claimed work was pending when the feature had actually landed in a later slice. Verified each against the implementation before editing; zero code touched. - command/rehash.rs: opers/classes/allows/admin/connect/bans/options all hot-reload via the ConfStore live seam — only the server{} identity is fixed per boot (by nature, not a deferral). - config/model.rs: STS sts-duration/sts-preload hot-reload via REHASH (slice 212). - command/kill.rs: inbound-S2S KILL +s notice exists (slice 185); kept the genuinely out-of-scope items (FLAGS_KILLED / WHOWAS-chasing / TOPICLEN). - connlimit.rs: max_global_* caps are enforced via check_global_admission (slice 150) — the "deferred" line contradicted the field docs below it. - cap.rs + labeled.rs: netsplit (157) and netjoin (160) batch types are produced; only chathistory genuinely remains. - main.rs: server-only ports speak S2S (serve_server) — the doc said they were dropped, contradicting the body. - command/metadata.rs: the draft/metadata-2 track is complete; reworded the "Divergences (each a follow-on slice)" heading as deliberate departures.

1 month ago

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

feat(leveva): RESV/UNRESV nick+channel reservation — config-seeded — P11 slice 272 charybdis RESV/UNRESV: an operator reserves a channel name (non-operator JOIN refused 437) or a nick mask (non-operator NICK refused 432); UNRESV lifts it. New OperPrivilege::Resv; operators are exempt from both gates. Masks are RFC-1459 globs (the channel '#' is escaped to a literal, dodging leveva's any-digit metacharacter). Default reservations are also declared in the config (resv {} blocks), seeded at boot and re-seeded on REHASH — replacing the config-sourced set while keeping operator-laid runtime RESVs (a Resv::conf flag). The shipped examples/ircd.kdl (+ verbatim dist copy) declares #services + NickServ. Tests (RED first): 28 resv units (store + command + JOIN/NICK gates, each with inverses), 3 config units, a 5-case resv_proptest (total/disjoint/exact lookup, add->remove identity, seed_config keeps runtime, command no-panic), and a golden_resv_config boot test proving config -> live store -> enforcement. cargo test -p leveva green; clippy --workspace --tests clean; build 0 warnings.

1 month ago

feat(leveva): D-lines (DLINE/UNDLINE) — IP-level operator bans (P11 slice 284) charybdis-style D-lines, the IP/CIDR sibling of the temporary K-line family (slices 281–283): `DLINE <duration> <ip/cidr> [:reason]` bans a raw IP or CIDR block, `UNDLINE <ip/cidr>` lifts it. Built as a near-clone of the K-line plane keyed on a single IP/CIDR `mask` (matched with the CIDR-aware `matching::host_component_matches`) instead of `user@host`. - `dline.rs`: `DlineStore` mirrors `KlineStore` (Vec+Mutex, NOCASE dedup, `find_active`, same `database {}` SQLite write-through + boot reload as slice 282); `Dline::covers` = `host_component_matches`. Reuses the kline duration grammar/clock/clamp. - `command/dline.rs`: `dline`/`undline` mirror `tkline`/`untkline` (461→481 gate, empty/`*` mask → Incorrect format, no success reply); `reap_matching_ip` ejects local matching clients by `orighost` (real connect IP), skipping remote + `kline-exempt`. New `OperPrivilege::Dline` (bit 0x400000). - `session.rs`: registration gate checked before the K-line gate, matching the pre-cloak connect IP → 465+ERROR+REJ snomask, never counted/claimed. - `s2s/dline.rs`+`forward.rs`+`burst.rs`: `ENCAP * DLINE`/`UNDLINE` propagation (server-prefixed, remaining-seconds, slice-281 KLINE shape) + burst re-assertion. - `stats.rs`: `STATS d` → `250 RPL_STATSDLINE` via `dline_report`. - `server.rs`: `ctx.dlines` opens against the same `database {}` file (persists across restart); boot test + inverse extended. - help `DLINE.md`/`UNDLINE.md` + COMMANDS allowlist. Tests (TDD, inverse invariants, mandated fuzzing): unit+proptest per module; `tests/golden_dline.rs` (real binary, `dline.kdl` fixture) and `tests/dline_proptest.rs` (6 properties incl. model-lockstep registration gate over `Session::feed`). leveva-native, no oracle differential. `cargo test -p leveva` green (2530 lib); clippy clean; workspace 0 warnings.

1 month ago

feat(leveva): ELIST C/T age search letters for LIST — P11 slice 225 Close the slice-224 deferral: the C (channel creation age) and T (topic age) ELIST search letters (C>n/C<n/T>n/T<n, whole minutes), advertised ELIST=CMNTU. The deferral was a plumbing gap, not a data gap — Channel::created_at and Topic::set_at are already stored (unix nanoseconds), and clock::unixnano() is read once in the command layer and passed into the pure elist matcher, which gains a Candidate view + a now argument so it stays deterministic under test. A no-topic channel takes its creation age for the T conditions (divergence from charybdis's epoch-based topic_time=0). Fuzzed via elist_proptest (age-bound totality + strict whole-minute bounds + no-topic T≡C fallback) and pinned end-to-end by golden_elist.

1 month ago

chore: version bump Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

feat(leveva): per-class keepalive ticker cadence — P11 slice 231 The session heartbeat already adopts the matched `allow -> class` block's `ping-freq` at registration finalize (the decision), but the serve-loop tokio check ticker was seeded once from the default (first) class and never updated, so a client in a non-default class was checked at the wrong rate — stretching its ping/timeout detection latency. Add a pure `heartbeat::class_ping_freq(class, classes)` seam (matched class -> its ping-freq; unknown/None -> default_ping_freq) that both the finalize re-arm and the loop key off, expose `Session::keepalive_freq()`, and re-arm the serve_client ticker whenever the session keepalive freq changes (top of loop, covering the feed + deferred resolve_auth finalize paths). Fix the stale 'leveva does not yet match clients against allow -> class' comments. Tests: class_ping_freq unit (matched-wins/unknown-default/empty-set) + keepalive_freq_proptest (2048 cases: total, matched-or-default, tick always >=1s) + session matched-vs-default-class re-arm. golden_keepalive green.

1 month ago

feat(leveva): message redaction deletes the chat-history line — P11 slice 275 Wire IRCv3 message-redaction (REDACT) to the slice-274 chat-history store: an accepted channel `REDACT <chan> <msgid>` now deletes the stored line so CHATHISTORY can never replay it. Closes the gap left by slice 274, where REDACT was a pure relay and command/redact.rs still claimed "leveva keeps no message history". - history.rs: new History::delete_by_msgid(target, msgid) -> usize (DELETE WHERE folded-target + msgid; no-op when disabled/unknown). Unit tests + a proptest fuzzing an arbitrary redacted subset. - command/redact.rs: delete in the channel CanSend::Ok arm only; refresh the stale "no history" docstring (still a stateless authorization relay, but the storage side now deletes). - s2s/redact.rs: delete in the plain-channel inbound branch of apply_encap_redact so each server drops its own recorded copy. Load-bearing boundary: deletion mirrors recording (full-delivery only). A +z op-moderated REDACT — local opmod broadcast and inbound @<chan> op-redirect — is "shown to ops", never recorded, so never deleted. Nick/DM targets aren't channel history. Gate: history/command::redact/s2s::redact units; golden_chathistory end-to-end (learn a msgid, REDACT it, re-query -> gone, sibling survives); two new redact_proptest command-path fuzzes (random subset via real Session + rejected-non-member-deletes-nothing). cargo clippy -p leveva --tests clean; full cargo test -p leveva green.

1 month ago

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

feat(leveva): chat-history foundations — SQLite store, serde Message, config + caps + ISUPPORT — P11 slice 274 (1/2)

1 month ago

join_throttle.rs

feat(leveva): +j join throttle channel mode — P11 slice 234 Charybdis-style `+j n:t` (MODE_JOINTHROTTLE): a channel admits at most n joins per t-second window; the next join bounces 480 ERR_THROTTLE and is not added. The first parameter-bearing flag mode since +l/+k and the first JOIN-rate gate; continues the channel-mode parity track (220 +C, 232 +c, 233 +S). leveva-native — gate is unit + golden + proptest. - Pure core join_throttle.rs: parse_param(n:t) + format_param + the charybdis fixed-window decide() (both fuzz seams); JoinThrottle counter store (reads no clock, self-draining) housed inside Channels (zero ServerContext-literal churn). - ChanMode::JoinThrottle ('j', bit 0x8000000, Param kind) threaded through both mode parsers + the three ModeChange matches + 324/CHANMODES-type-C/004 render. - JOIN gate in command::join::join_one: non-members, local path only (remote NJOIN gated at its home server); SAJOIN bypasses; refusal -> 480 ErrThrottle. - Tests: 12 core units + 2 channel + 1 mode units; jointhrottle_proptest (5, incl. no-window-over-admits) + golden_jointhrottle; 8 005/004 snapshots regenerated (CHANMODES ...,k,lj,... / 004 ...IRklj, token-only).

1 month ago

feat(leveva): persist K-lines + reservations to the database{} SQLite file — P11 slice 282

1 month ago

knock_throttle.rs

chore: version bump Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

docs(leveva): correct stale deferral comments A doc-only sweep of "deferred"/"follow-on"/"future slice"/"out of scope" comments that claimed work was pending when the feature had actually landed in a later slice. Verified each against the implementation before editing; zero code touched. - command/rehash.rs: opers/classes/allows/admin/connect/bans/options all hot-reload via the ConfStore live seam — only the server{} identity is fixed per boot (by nature, not a deferral). - config/model.rs: STS sts-duration/sts-preload hot-reload via REHASH (slice 212). - command/kill.rs: inbound-S2S KILL +s notice exists (slice 185); kept the genuinely out-of-scope items (FLAGS_KILLED / WHOWAS-chasing / TOPICLEN). - connlimit.rs: max_global_* caps are enforced via check_global_admission (slice 150) — the "deferred" line contradicted the field docs below it. - cap.rs + labeled.rs: netsplit (157) and netjoin (160) batch types are produced; only chathistory genuinely remains. - main.rs: server-only ports speak S2S (serve_server) — the doc said they were dropped, contradicting the body. - command/metadata.rs: the draft/metadata-2 track is complete; reworded the "Divergences (each a follow-on slice)" heading as deliberate departures.

1 month ago

feat(leveva): XLINE/UNXLINE realname (gecos) operator ban (P11 slice 289) Charybdis-style XLINE/UNXLINE: an operator bans connections by a realname (gecos) glob — the realname sibling of the K-line (user@host) and D-line (ip/cidr) families, completing the runtime ban quartet K/D/X/RESV. Bolt-for-bolt the DLINE plane (slice 284) with a single-token gecos matcher (matching::matches) instead of CIDR: - leveva::xline::{Xline,XlineStore} — SQLite write-through + boot reload. - command/xline.rs — 461 param gate before OperPrivilege::Xline 481; reap local matching realnames (465 + ERROR close); s2s propagation. - s2s/xline.rs — ENCAP * XLINE/UNXLINE carrier (remaining seconds) + apply. - s2s/burst.rs::xline_burst re-assertion; forward.rs ENCAP arms. - Registration X-line gate in finalize_registration after the K-line/config-ban gates; STATS x -> 247 RPL_STATSXLINE. - Lights up the dead xline_exempt flag end-to-end (Admission/ClientRecord + set_xline_exempt), a dedicated exemption distinct from kline-exempt. leveva-native (no differential). Gate: cargo test -p leveva green (golden_xline + xline_proptest + the touched iline/stats/help goldens), clippy clean, workspace build 0 warnings.

1 month ago

feat(leveva): outbound S2S server links over TLS (P11 slice 176) Closes the documented deferral in command::connect: leveva accepted TLS server-links on a server-only TLS listener but could only dial out in plaintext. A connect{} block flagged `tls` now dials over a rustls client connection (new tls::connect_outbound + accept-any-server-cert verifier, symmetric to the inbound accept-any-client-cert; links authenticate by PASS, not PKI). The flag rides OutboundLink so both operator CONNECT and the auto-connect ticker inherit it; main::dial_server wraps the socket then hands off to a stream-generic run_outbound. Config-parse fuzzed + in-process connector integration + a full two-node TLS link golden.

1 month ago

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

test: parallelize golden suite via ephemeral ports + nextest The boot-level golden tests each booted a real `leveva` on a fixed port, forcing a global lock that serialized the whole suite (~230s). Make them parallel-safe and run them under nextest: - Ephemeral ports: each daemon reserves `127.0.0.1:0`, templates its fixture to the assigned client/server ports, and threads them through the clients/peers. Per-port flock + a CPU-count slot semaphore (MAX_CONCURRENT_DAEMONS=128) bound concurrency. - `.config/nextest.toml`: a `golden` test-group caps in-flight daemons, with `retries = 2` and a 30s `slow-timeout terminate-after` backstop. - Streaming `read_until`: a per-connection `pending` buffer returns through the sentinel line and retains the rest, and a 30s overall deadline now PANICS (was a silent hang) so a never-arriving sentinel fails loudly. Sentinels that previously matched on a since-coalesced read were re-pointed at their transcript's true last line; a handful of snapshots reattributed accordingly (content preserved). - Fakelag off in tests: the daemon arms flood protection unless `LEVEVA_DISABLE_FAKELAG=1`, which the harness sets by default so barrier-paced clients don't eat the fakelag *delay*; the dedicated flood goldens opt back in via `want_fakelag()`. - Slow-test sentinels: `golden_rehash_conf` waited on a `376` its no-MOTD config never sends (124s -> 1s); `golden_s2s_monitor` keyed on a too-early `731`. Suite: ~230s -> ~25s. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

feat(leveva): chat-history foundations — SQLite store, serde Message, config + caps + ISUPPORT — P11 slice 274 (1/2)

1 month ago

feat(leveva): metadata-rate-cost/metadata-rate-burst REHASH knobs — P11 slice 230 Close the slice-228 follow-on: the METADATA SET/CLEAR rate-limit budget (was the hard-coded META_RATE_COST_SECS/META_RATE_BURST_SECS consts) is now the REHASH-able options { metadata-rate-cost / metadata-rate-burst } pair via the slice-204/210/212 ConfStore live seam. - rate_charge/charge_rate take cost_secs/burst_secs (consts become defaults; negatives clamped); command::metadata::rate_gate reads live_meta_rate_cost/live_meta_rate_burst. - Options/ConfBlocks/ConfStore carry the i64 pair, seeded at boot and re-seeded on REHASH. - 0 legal for both: cost 0 disables the limiter, burst 0 caps at one mutation/sec; negative rejected. Tests: metadata.rs units (custom budget + inverses, cost-0-disables, store threads knobs), config parse (default/override/0/negative), control re-seed lockstep, metadata_rate_proptest fuzzes cost/burst incl. 0 + negatives (the proptest caught and corrected an over-broad cost-0 property), and a config-driven golden_metadata_rate.rs. cargo build --workspace 0 warnings; clippy clean.

1 month ago

feat(leveva): S2S server-link traffic metrics (P11 slice 180)

1 month ago

metrics_server.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

feat(leveva): burst empty +P permanent channel over S2S — stale-S2S-flag-allowlist fix — P11 slice 269 Closes slice 244's documented "Bursting empty permanent channels on link" follow-on. A +P channel survives memberless so its topic/modes persist, but a freshly-linked peer's NJOIN carries only the empty-channel placeholder (.), so the receiver dropped the whole channel block (CHANTS on an unknown channel was a no-op, the . NJOIN added nobody, and the following MODE/TOPIC landed on a nonexistent channel). Receiver-only fix: s2s::chants::apply_encap_chants now materializes the empty channel from the burst CHANTS line via the new Channels::create_permanent_from_burst, gated on +P (pure channel::burst_creates_permanent, the inverse of destroy_when_empty) so a leaky non-permanent empty channel is never created and a known channel is never clobbered. Also fixes a root-cause sub-bug surfaced while scoping: the S2S burst/MODE parser s2s::mode::supported_flag carried a stale nmtipsO-only flag-letter allowlist that silently dropped every leveva-native channel flag (+C +c +S +z +T +g +r +Q +F +P +L) off a server burst/MODE, so they never replicated across a link. Both the client and S2S parsers now delegate to one canonical ChanMode::flag_from_char so they can never drift again. Tests (TDD + fuzz): golden_s2s_permanent (MODE->324 +Pkl, TOPIC->332, inverse non-+P->403); unit tests in channel/chants/mode; permanent_proptest extended (burst_creates_permanent totality+inverse, create_permanent_from_burst gated/never-clobbers).

1 month ago

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

chore: version bump Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

feat(leveva): SendQ follow-ons — bounded socket writes + server-link SendQ accounting (P11 slice 148) The two robustness items slice 147 deferred. Part A — bounded socket writes (new leveva::netio). Both serve loops wrote with a bare stream.write_all(&bytes).await; when the peer stops reading, TCP backpressure parks that write *inside* its tokio::select! branch body, so the whole task parks and the keepalive ticker.tick() branch can never fire — a fully-wedged socket was never reaped (the slice-147 SendQ eject rides the very mailbox the wedged write blocks). WRITE_TIMEOUT (60s) + write_bounded/flush_bounded wrap write_all/flush in a timeout; both steady-state serve loops route every write/flush through them, so a wedged socket is force-closed at the deadline like an I/O error. Part B — server-link SendQ accounting (mirrors slice 147's client path). serve_linked_peer's mailbox_rx was unbounded with no accounting — the write-side DoS slice 147 fixed for clients, still open for peers. PeerLink gains stats: Arc<ConnStats> (in PeerLink::new, sig unchanged); LinkEntry gains stats/sendq_max + a private enqueue running the slice-147 admit/overflow/drop policy (overflow → one ERROR :Closing Link: <sid> (Max SendQ exceeded) eject → squit_subtree); the four PeerLinks send methods route through it, accounting the egress (post tag-strip) length. PeerLinks::link → account-only wrapper; new link_with_stats is the live path (DEFAULT_SERVER_SENDQ = 8 MiB, drained per dequeued frame). Inline unit tests: 3 netio + 5 links. tokio test-util added as a dev-dep for start_paused (deterministic timeout tests under a paused clock).

1 month ago

feat(leveva): TESTMASK mask-population diagnostic (P11 slice 288) TESTMASK <[nick!]user@host> [<gecos>] counts how many connected clients match a hostmask (and optional realname glob), split into local vs remote — the read-only population sibling of TESTLINE (slice 285, which reports bans), together completing charybdis's test* diagnostic family. 461 param gate before the plain oper-bit gate (481); a malformed mask (no @, or empty user/host) yields a NOTICE :Invalid parameters (faithful to charybdis's sendto_one_notice, not a numeric); a registry sweep glob-matches nick/user/host(+orighost)/gecos (nick & gecos default *) and tallies is_local_uid into one 727 RPL_TESTMASKGECOS reply. New numeric 727 (charybdis's 724 is dead — no format string, no caller). Pure parse_mask fuzz seam. Confirmed against cloned charybdis m_testmask.c / messages.h / numeric.h. leveva-native, local-only (no S2S, mirroring charybdis). Tests: 13 units (inverse filters + quit-drops-count), golden_testmask (real binary), testmask_proptest (4 properties incl. l+g <= population, never panics).

1 month ago

chore: run cargo format Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

registration.rs

feat(leveva): XLINE/UNXLINE realname (gecos) operator ban (P11 slice 289) Charybdis-style XLINE/UNXLINE: an operator bans connections by a realname (gecos) glob — the realname sibling of the K-line (user@host) and D-line (ip/cidr) families, completing the runtime ban quartet K/D/X/RESV. Bolt-for-bolt the DLINE plane (slice 284) with a single-token gecos matcher (matching::matches) instead of CIDR: - leveva::xline::{Xline,XlineStore} — SQLite write-through + boot reload. - command/xline.rs — 461 param gate before OperPrivilege::Xline 481; reap local matching realnames (465 + ERROR close); s2s propagation. - s2s/xline.rs — ENCAP * XLINE/UNXLINE carrier (remaining seconds) + apply. - s2s/burst.rs::xline_burst re-assertion; forward.rs ENCAP arms. - Registration X-line gate in finalize_registration after the K-line/config-ban gates; STATS x -> 247 RPL_STATSXLINE. - Lights up the dead xline_exempt flag end-to-end (Admission/ClientRecord + set_xline_exempt), a dedicated exemption distinct from kline-exempt. leveva-native (no differential). Gate: cargo test -p leveva green (golden_xline + xline_proptest + the touched iline/stats/help goldens), clippy clean, workspace build 0 warnings.

1 month ago

feat(leveva): XLINE/UNXLINE realname (gecos) operator ban (P11 slice 289) Charybdis-style XLINE/UNXLINE: an operator bans connections by a realname (gecos) glob — the realname sibling of the K-line (user@host) and D-line (ip/cidr) families, completing the runtime ban quartet K/D/X/RESV. Bolt-for-bolt the DLINE plane (slice 284) with a single-token gecos matcher (matching::matches) instead of CIDR: - leveva::xline::{Xline,XlineStore} — SQLite write-through + boot reload. - command/xline.rs — 461 param gate before OperPrivilege::Xline 481; reap local matching realnames (465 + ERROR close); s2s propagation. - s2s/xline.rs — ENCAP * XLINE/UNXLINE carrier (remaining seconds) + apply. - s2s/burst.rs::xline_burst re-assertion; forward.rs ENCAP arms. - Registration X-line gate in finalize_registration after the K-line/config-ban gates; STATS x -> 247 RPL_STATSXLINE. - Lights up the dead xline_exempt flag end-to-end (Admission/ClientRecord + set_xline_exempt), a dedicated exemption distinct from kline-exempt. leveva-native (no differential). Gate: cargo test -p leveva green (golden_xline + xline_proptest + the touched iline/stats/help goldens), clippy clean, workspace build 0 warnings.

1 month ago

feat(leveva): persist K-lines + reservations to the database{} SQLite file — P11 slice 282

1 month ago

chore: version bump Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

feat(leveva): XLINE/UNXLINE realname (gecos) operator ban (P11 slice 289) Charybdis-style XLINE/UNXLINE: an operator bans connections by a realname (gecos) glob — the realname sibling of the K-line (user@host) and D-line (ip/cidr) families, completing the runtime ban quartet K/D/X/RESV. Bolt-for-bolt the DLINE plane (slice 284) with a single-token gecos matcher (matching::matches) instead of CIDR: - leveva::xline::{Xline,XlineStore} — SQLite write-through + boot reload. - command/xline.rs — 461 param gate before OperPrivilege::Xline 481; reap local matching realnames (465 + ERROR close); s2s propagation. - s2s/xline.rs — ENCAP * XLINE/UNXLINE carrier (remaining seconds) + apply. - s2s/burst.rs::xline_burst re-assertion; forward.rs ENCAP arms. - Registration X-line gate in finalize_registration after the K-line/config-ban gates; STATS x -> 247 RPL_STATSXLINE. - Lights up the dead xline_exempt flag end-to-end (Admission/ClientRecord + set_xline_exempt), a dedicated exemption distinct from kline-exempt. leveva-native (no differential). Gate: cargo test -p leveva green (golden_xline + xline_proptest + the touched iline/stats/help goldens), clippy clean, workspace build 0 warnings.

1 month ago

feat(leveva): XLINE/UNXLINE realname (gecos) operator ban (P11 slice 289) Charybdis-style XLINE/UNXLINE: an operator bans connections by a realname (gecos) glob — the realname sibling of the K-line (user@host) and D-line (ip/cidr) families, completing the runtime ban quartet K/D/X/RESV. Bolt-for-bolt the DLINE plane (slice 284) with a single-token gecos matcher (matching::matches) instead of CIDR: - leveva::xline::{Xline,XlineStore} — SQLite write-through + boot reload. - command/xline.rs — 461 param gate before OperPrivilege::Xline 481; reap local matching realnames (465 + ERROR close); s2s propagation. - s2s/xline.rs — ENCAP * XLINE/UNXLINE carrier (remaining seconds) + apply. - s2s/burst.rs::xline_burst re-assertion; forward.rs ENCAP arms. - Registration X-line gate in finalize_registration after the K-line/config-ban gates; STATS x -> 247 RPL_STATSXLINE. - Lights up the dead xline_exempt flag end-to-end (Admission/ClientRecord + set_xline_exempt), a dedicated exemption distinct from kline-exempt. leveva-native (no differential). Gate: cargo test -p leveva green (golden_xline + xline_proptest + the touched iline/stats/help goldens), clippy clean, workspace build 0 warnings.

1 month ago

feat(leveva): +s/+d DEBUG snomask producer — unknown-S2S-command spy — P11 slice 268 The ninth and final producer for a slice-257 snomask category. The `d` DEBUG category had been reserved-but-empty since slice 257 ("genuine future/feature work", since charybdis's SNO_DEBUG is compile-gated debug-build diagnostics with no faithful analogue). When a linked peer sends a server command leveva does not recognise (the s2s::dispatch catch-all, previously a bare `_ => Vec::new()`), it now fans an `Unknown command from <server>: <verb>` notice to local `+s +d` watchers (snotice::unknown_command_notice, leveva-native; the line is still dropped, the oracle's m_nop behaviour). The snomask producer matrix is complete — every category now has a producer. Tests (RED first): snotice render/embed units; s2s dispatch test with inverses (+s+k-only / -s clients get nothing; a known verb / numeric fires no DEBUG notice); proptest debug_snomask_proptest (never panics, scaffold + verbatim fields). Gate: cargo test -p leveva green; clippy clean; build 0 warnings.

1 month ago

feat(leveva): +s/+d DEBUG snomask producer — unknown-S2S-command spy — P11 slice 268 The ninth and final producer for a slice-257 snomask category. The `d` DEBUG category had been reserved-but-empty since slice 257 ("genuine future/feature work", since charybdis's SNO_DEBUG is compile-gated debug-build diagnostics with no faithful analogue). When a linked peer sends a server command leveva does not recognise (the s2s::dispatch catch-all, previously a bare `_ => Vec::new()`), it now fans an `Unknown command from <server>: <verb>` notice to local `+s +d` watchers (snotice::unknown_command_notice, leveva-native; the line is still dropped, the oracle's m_nop behaviour). The snomask producer matrix is complete — every category now has a producer. Tests (RED first): snotice render/embed units; s2s dispatch test with inverses (+s+k-only / -s clients get nothing; a known verb / numeric fires no DEBUG notice); proptest debug_snomask_proptest (never panics, scaffold + verbatim fields). Gate: cargo test -p leveva green; clippy clean; build 0 warnings.

1 month ago

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

feat(p10): bootstrap leveva crate with RFC 1459 string layer Stand up the greenfield idiomatic-Rust crate (named per blog 001 / the P10 plan) with its foundational string layer — pulled forward at the user's request now that P7 (faithful port) is complete. Std-only, no oracle/FFI seam. - casemap: textbook RFC 1459 case folding (A-Z<->a-z plus the Scandinavian [<->{ \<->| ]<->} ~<->^), as const fns + slice eq/cmp/hash helpers. This is the rule the RFC specifies, which deliberately differs from this daemon's ASCII-only tolowertab in common/match.c. - string: IrcStr/IrcString with RFC-1459 case-insensitive Eq/Ord/Hash (Display preserves original case), Borrow<IrcStr> for HashMap keying, NUL/CR/LF rejection, and IrcStringBuilder. - ident: validating newtypes via an ident_newtype! macro — Nick, ChanName, Sid/Uid/Cid (base-36), ServerName, UserName, HostName — each grounded in the C grammar (struct_def.h lengths, char_atribs NVALID, do_nick_name, s_id.c). - message: Message/MessageBuilder assembling 512-byte-safe CRLF wire lines; typed idents pass through via impl Display. 27 unit + 4 doc tests green; clippy clean; 0 warnings.

1 month ago

feat(leveva): advertise IRCv3 `sts` capability — P11 slice 211 Add Strict Transport Security advertisement: a plaintext `CAP LS 302` client is told the TLS upgrade port (`sts=port=<p>`) and a TLS client the policy duration (`sts=duration=<n>[,preload]`). Advisory-only — `sts` stays out of the `SUPPORTED` registry, so `CAP REQ sts` NAKs and it never appears in `CAP LIST`; injected straight into the `LS` token list (302+ only). - new pure `sts::StsPolicy::ls_value(secure)` (None when disabled: no TLS client listener, or `sts-duration 0`); `port=` over plaintext, `duration=` over TLS (preload only over TLS, per spec) - `options { sts-duration N; sts-preload }` (boot-read; default off) - `StatsConf.sts` (slice-206 churn-free bundling) built in `from_config` from the first `tls && !server_only && websocket.is_none()` listener - `Session.secure` set by `serve_client`; the CAP LS path threads the value into `cap.apply`'s new `sts` param REHASH-ability of the knobs + treating wss as secure are documented follow-ons. Tests: sts/cap/config units + sts_proptest (fuzz) + golden_sts (real binary, plaintext sees the upgrade port; inverse no-TLS-listener sees no token).

1 month ago

chore: version bump Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

chore: run cargo format Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

feat(leveva): WHOWAS command + nick-history ring (P11 slice 21) Records a vacated identity on every NICK-change and disconnect into a new bounded newest-first whowas ring; WHOWAS <nicklist> [count] [target] answers 314+312 per match, 406 on miss, one 369, 431 with no nick. Single-server divergences (no routing, 312 time as unix seconds) documented. Verified by unit + session integration + 3-property whowas_proptest + golden_whowas.

1 month ago

feat(leveva): XLINE/UNXLINE realname (gecos) operator ban (P11 slice 289) Charybdis-style XLINE/UNXLINE: an operator bans connections by a realname (gecos) glob — the realname sibling of the K-line (user@host) and D-line (ip/cidr) families, completing the runtime ban quartet K/D/X/RESV. Bolt-for-bolt the DLINE plane (slice 284) with a single-token gecos matcher (matching::matches) instead of CIDR: - leveva::xline::{Xline,XlineStore} — SQLite write-through + boot reload. - command/xline.rs — 461 param gate before OperPrivilege::Xline 481; reap local matching realnames (465 + ERROR close); s2s propagation. - s2s/xline.rs — ENCAP * XLINE/UNXLINE carrier (remaining seconds) + apply. - s2s/burst.rs::xline_burst re-assertion; forward.rs ENCAP arms. - Registration X-line gate in finalize_registration after the K-line/config-ban gates; STATS x -> 247 RPL_STATSXLINE. - Lights up the dead xline_exempt flag end-to-end (Admission/ClientRecord + set_xline_exempt), a dedicated exemption distinct from kline-exempt. leveva-native (no differential). Gate: cargo test -p leveva green (golden_xline + xline_proptest + the touched iline/stats/help goldens), clippy clean, workspace build 0 warnings.

1 month ago