serverless-ircd 0.10.0 → 0.11.0

package/.github/workflows/ci.yml

@@ -124,6 +124,34 @@ jobs:
         # config) before it reaches main.
         run: pnpm --filter @serverless-ircd/ci-hardening test
 
+      - name: Container non-root smoke (gated on docker availability)
+        # Live proof that the cf-tcp-container image drops root: the
+        # runtime UID must be 1000 and /data must be writable by it.
+        # The static Dockerfile assertions in
+        # apps/cf-tcp-container/tests/dockerfile.test.ts always run in
+        # the test step; this smoke additionally builds and runs the
+        # real image. Gated because the self-hosted runner image ships
+        # without a docker daemon (see the DynamoDB Local notes above).
+        run: |
+          if ! command -v docker >/dev/null 2>&1 || ! timeout 15 docker info >/dev/null 2>&1; then
+            echo "docker not available — skipping live container smoke (static Dockerfile test covers it)"
+            exit 0
+          fi
+          docker build -f apps/cf-tcp-container/Dockerfile -t sirc-tcp-origin-smoke .
+          uid="$(docker run --rm sirc-tcp-origin-smoke id -u)"
+          echo "runtime UID: ${uid}"
+          if [ "${uid}" != "1000" ]; then
+            echo "FAIL: expected runtime UID 1000, got ${uid}"
+            exit 1
+          fi
+          docker run --rm sirc-tcp-origin-smoke \
+            node -e "const fs=require('fs');fs.writeFileSync('/data/.smoke','ok');fs.unlinkSync('/data/.smoke')"
+          if [ "$?" -ne 0 ]; then
+            echo "FAIL: /data not writable as UID 1000"
+            exit 1
+          fi
+          echo "SMOKE PASS: image runs as UID 1000 and /data is writable"
+
       - name: Upload coverage
         if: always()
         uses: actions/upload-artifact@v3

package/.github/workflows/deploy-cf-tcp.yml

@@ -17,9 +17,22 @@ name: deploy-cf-tcp
 #   CLOUDFLARE_ACCOUNT_ID   Account ID for the target zone.
 #   CF_ZONE_ID              Zone ID for the Spectrum hostname.
 #   CF_TCP_ORIGIN_ADDRESS   Hostname/IP of the container origin.
+#
+# Inputs (prompted on workflow_dispatch):
+#   hostname                REQUIRED. Public IRC hostname this deploy
+#                          serves (e.g. irc.example.net). The pipeline
+#                          fails loudly when unset and refuses to ship
+#                          while it is still a repo placeholder
+#                          (irc.example.com / irc.your-domain.invalid)
+#                          — the guard step below enforces both.
 
 on:
   workflow_dispatch:
+    inputs:
+      hostname:
+        description: 'Public IRC hostname for this deploy (must not be a placeholder)'
+        required: true
+        type: string
 
 concurrency:
   group: cf-tcp-deploy
@@ -49,6 +62,16 @@ jobs:
       - name: Build workspace
         run: pnpm build
 
+      # Fail fast, before any deploy or terraform step, when the
+      # hostname input is unset or still a repo placeholder. Runs the
+      # same guard the deploy scripts use (tools/ci-hardening
+      # hostname-guard); the `::error::` message names the offending
+      # value and how to set a real hostname.
+      - name: 'Guard: reject placeholder hostnames'
+        env:
+          DEPLOY_HOSTNAME: ${{ inputs.hostname }}
+        run: node tools/ci-hardening/dist/hostname-guard.js "$DEPLOY_HOSTNAME"
+
       - name: Typecheck
         run: pnpm typecheck
 
@@ -60,14 +83,15 @@ jobs:
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-        run: wrangler deploy
+          SERVER_NAME: ${{ inputs.hostname }}
+        run: pnpm run deploy -- --var "SERVER_NAME:$SERVER_NAME"
 
       - name: Apply Spectrum TLS config
         working-directory: apps/cf-tcp-container/terraform
         env:
           TF_VAR_zone_id: ${{ secrets.CF_ZONE_ID }}
           TF_VAR_origin_address: ${{ secrets.CF_TCP_ORIGIN_ADDRESS }}
-          TF_VAR_hostname: irc.example.com
+          TF_VAR_hostname: ${{ inputs.hostname }}
         run: |
           terraform init
           terraform apply -auto-approve

package/.github/workflows/deploy-cf.yml

@@ -24,9 +24,23 @@ name: deploy-cf
 # plus the deployer's account subdomain. Override by setting
 # `CF_SMOKE_URL` in the repo Variables store when custom routes are
 # wired.
+#
+# Inputs (prompted on workflow_dispatch):
+#   hostname   REQUIRED. Public IRC hostname this deploy serves
+#              (e.g. irc.example.net). Fails loudly when unset and
+#              refuses to ship while it is still a repo placeholder
+#              (irc.example.com / irc.your-domain.invalid) — the
+#              guard step below enforces both, and the deploy step
+#              overrides the shipped wrangler.toml `SERVER_NAME`
+#              default with the input via `--var`.
 
 on:
   workflow_dispatch:
+    inputs:
+      hostname:
+        description: 'Public IRC hostname for this deploy (must not be a placeholder)'
+        required: true
+        type: string
 
 # Prevent two deploys racing the same DO namespace.
 concurrency:
@@ -57,6 +71,14 @@ jobs:
       - name: Build workspace
         run: pnpm build
 
+      # Fail fast, before the deploy step, when the hostname input is
+      # unset or still a repo placeholder (same guard the deploy
+      # scripts use; tools/ci-hardening hostname-guard).
+      - name: 'Guard: reject placeholder hostnames'
+        env:
+          DEPLOY_HOSTNAME: ${{ inputs.hostname }}
+        run: node tools/ci-hardening/dist/hostname-guard.js "$DEPLOY_HOSTNAME"
+
       - name: Typecheck
         run: pnpm typecheck
 
@@ -68,6 +90,10 @@ jobs:
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          SERVER_NAME: ${{ inputs.hostname }}
+        # The guarded cf-deploy wrapper resolves SERVER_NAME from the env
+        # (set above from the workflow input), runs the placeholder guard,
+        # and injects it into wrangler as --var SERVER_NAME:<hostname>.
         run: pnpm run deploy
 
       - name: Resolve smoke URL

package/CHANGELOG.md

@@ -10,6 +10,295 @@ For the release process itself — versioning policy, pre-release checklist,
 cutting a tag, rolling back — see [`docs/Release-Process.md`](docs/Release-Process.md).
 Cross-reference `progress.md` / `tickets.md` for per-ticket detail.
 
+## [0.11.0] - 2026-08-18
+
+This is the **security-audit remediation release**. The 2026-08-11
+static audit (`SECURITY-REPORT.md`, 43 findings) is now fully
+remediated: the Critical + first High findings (APIGW body logging,
+OIDC-only deploys) and the CSPRNG id fix shipped in v0.10.0; the
+remaining **40 findings (TICKET-182 … TICKET-222)** land here as a
+layered hardening pass over every edge: **admission control and
+rate limiting at every transport boundary** (global cap, per-IP
+caps, connect-rate windows, per-connection frame budgets, bounded
+line buffers), **credential hardening** (scrypt oper credentials,
+constant-time / timing-equalized comparisons, brute-force lockouts
+on every auth surface), **SASL `EXTERNAL` rebuilt behind an
+operator opt-in with DER-fingerprint account binding**, and a sweep
+of **protocol budget correctness fixes** (UTF-8 byte budgets, tag
+caps, bare-CR rejection).
+
+### Added — Admission control & rate limiting (`irc-core`, `cf-adapter`, `aws-adapter`, `aws-stack`)
+
+Layered throttling of connection establishment and frame intake,
+enforced at every transport edge (WS upgrade, NLB stream, TCP
+origin) with `429` rejections.
+
+- **Global `MAX_CLIENTS` cap with live-connection counter.**
+  Cloudflare reserves a slot in a `CounterDO` counter before
+  forwarding an upgrade and answers `429` (`ERROR :Closing link:
+  server full`) once the cap is reached; slots are released on
+  close and TTL-reaped if a DO dies without one. AWS keeps the
+  O(1) atomic counter from v0.8.0, now enforced against the
+  configured cap.
+- **Per-IP connection caps + sliding-window connect-rate limits.**
+  `MAX_CONNECTIONS_PER_IP` (default 10) caps simultaneous
+  connections per source IP; `PER_IP_CONNECTION_RATE_MAX` /
+  `PER_IP_CONNECTION_RATE_WINDOW_MS` (default 5 / 60 s) cap new
+  establishments per window. Cloudflare enforces both at the worker
+  edge via a new `RateLimitDO` (sliding-window admission timestamps
+  keyed on `CF-Connecting-IP`; rejections never consume budget, so
+  a blocked IP recovers after window decay). AWS `$connect` counts
+  live + in-window rows via a new `sourceIp+connectedSince` GSI on
+  `Connections`, the NLB path applies the same budget to new flows
+  (first chunk only, so active sessions are not starved), API
+  Gateway stage throttling (rate + burst parameters) backstops
+  globally, and an **opt-in WAFv2 per-IP rate rule**
+  (`-c wafConnectRateLimit=<n>`) sits at the edge.
+- **Per-connection inbound frame-rate window.**
+  `MAX_FRAMES_PER_WINDOW` / `FRAME_WINDOW_SECONDS` (default 50 /
+  5 s) enforced at the adapter boundary **before** the actor or any
+  storage write — a cheap early rejection for frame floods.
+- **Bounded line-buffer memory.** TCP input buffers are capped at
+  **8 KiB** at every transport edge (local CLI, container origin,
+  NLB handler, forwarder), and the NLB handler rejects oversized
+  payloads outright — an unauthenticated peer can no longer pin
+  memory with an unterminated byte stream.
+
+### Added — Cloudflare TCP origin hardening (`cf-tcp-container`)
+
+The Spectrum origin is rebuilt as a hardened TLS terminator.
+
+- **TLS terminates at the origin.** Spectrum switches to
+  `tls_mode = "full"` (encrypted all the way to the container, no
+  plaintext hop) and the container itself terminates TLS, pinned to
+  **TLS 1.2/1.3**.
+- **PROXY protocol v1 is required on every flow.** The container
+  parses the `PROXY TCP4/TCP6 …` header (incremental, 107-byte
+  budget) to recover the real client IP — and **rejects flows
+  without one** — so per-IP admission (above) cannot be spoofed by
+  connecting directly to the origin. Origin ingress is locked to
+  Spectrum's published IP ranges in the Terraform.
+- **Non-root runtime.** The container runs as the non-root `node`
+  user (UID 1000); the Dockerfile drops to an unprivileged user and
+  the cert files are owned by it.
+
+### Added — AWS stack hardening (`aws-stack`, `aws-adapter`)
+
+- **State tables protected.** Every DynamoDB state table
+  (`Connections`, `Nicks`, `Channels`, `Services`, …) now carries
+  `RETAIN` deletion policy, **deletion protection**, and
+  **point-in-time recovery (PITR)** — a stray `cdk destroy` or a
+  compromised console session can no longer silently destroy
+  persistent IRC state.
+- **NLB stream path integrity.** The streaming handler asserts the
+  flow is TLS-secured (surfacing user mode `S`), **rejects flows
+  with missing or malformed `x-forwarded-for` / `x-forwarded-port`
+  headers**, and its Lambda now holds the
+  `execute-api:ManageConnections` grant against the management API
+  stage (fixes silent fanout failure on the TCP path).
+- **APIGW logging role least-privilege.** The CloudWatch logging
+  role's policy is scoped to exact write-only grants on the
+  API-specific log groups.
+
+### Added — Credential hardening (`irc-core`)
+
+- **Scrypt-hashed oper credentials.** `OPER` verifies against a
+  scrypt hash + salt (`OPER_SALT` + `OPER_HASH`) with a timing-safe
+  compare; a new `tools/hash-oper-cred.ts` generates the pair
+  (`node --import tsx tools/hash-oper-cred.ts --user admin --stdin`).
+  The plaintext `OPER_PASSWORD` form still works but logs a
+  deprecation warning and will be removed.
+- **Constant-time server-password comparison.** The
+  `SERVER_PASSWORD` gate compares in constant time.
+- **Timing-equalized nick verification (no account enumeration).**
+  `verifyNick` runs a dummy scrypt verify for unknown accounts, so
+  response timing cannot distinguish "no such nick" from "wrong
+  password". NickServ `INFO` / `SET PASSWORD` replies are already
+  indistinguishable on the same axis.
+- **Brute-force lockouts on every auth surface.** A per-connection
+  **SASL failure lockout** (repeated `904`s disconnect with "too
+  many failed SASL attempts"), a **per-IP `OPER` failure lockout**
+  (with oper-broadcast on trip), and a **per-account NickServ
+  `IDENTIFY` freeze**. The `AUTHENTICATE` **flood-control exemption
+  is removed** — SASL frames now count against the connection's
+  message bucket, closing the timing-oracle bandwidth amplifier.
+- **Credential redaction from parse-error logs.** Parse-error log
+  records carry only a truncated leading token, the length, and a
+  stable reason code — never the raw line (a malformed line could
+  otherwise smuggle `PASS <secret>` past the parser into logs).
+  Workers log sampling is lowered to **10%** by default.
+
+### Changed — SASL `EXTERNAL` (mTLS) rebuilt behind an operator opt-in (`irc-core`, adapters)
+
+EXTERNAL is now advertised and accepted only when **all three**
+hold: a bound mTLS identity source (CF API Shield / APIGW client
+certs), the operator opt-in **`EXTERNAL_ENABLED`** (`true`/`1`,
+**default off** — surfaced via both adapters' config loaders), and
+a secure (TLS) connection. The `sasl` cap value and the
+`AUTHENTICATE` reducer share the same gate so advertisement and
+enforcement cannot drift; refusals answer `908 ERR_SASLMECHS`
+listing `PLAIN` only and do not count toward the SASL lockout.
+
+- **Accounts bind to the certificate's DER SHA-256 fingerprint**
+  (`fp:<hex>` entries in `RegisteredNick.certSubjects` — what
+  Cloudflare surfaces from `request.cf.tlsClientAuth`; the preferred
+  binding) **or a canonical subject DN** (the only identifier API
+  Gateway exposes). DNs are canonicalised before comparison —
+  attribute types lower-cased, whitespace collapsed, RDN/AVA
+  components sorted — so semantically equal DNs written differently
+  (including across cert re-issuance) still match. Legacy verbatim
+  bindings verify and are rewritten to the canonical spelling on
+  first use.
+- **Transports without a client-cert surface pin the mechanism off.**
+  The `cf-tcp-container` Spectrum origin (and the NLB stream handler
+  unless an mTLS provider is injected) reject
+  `AUTHENTICATE EXTERNAL` outright with a transport-specific
+  `904 ERR_SASLFAIL` instead of silently mis-binding.
+
+### Changed — Protocol budget correctness (`irc-core`, `irc-server`)
+
+- **All length budgets are enforced in UTF-8 bytes, not UTF-16 code
+  units** — the 512-byte line cap, `TOPICLEN` (truncated on
+  character boundaries, never mid-multibyte), `NICKLEN` /
+  `CHANNELLEN`, and the `draft/multiline` batch budget, which is
+  now also **enforced incrementally as lines arrive** (an
+  over-budget batch aborts mid-stream with `FAIL`, not just at
+  close).
+- **IRCv3 tag limits enforced in the parser**: at most **15 tags**
+  and an **8191-byte tag section** per message.
+- **Multi-target commands capped.** Comma-split
+  `PRIVMSG`/`NOTICE`/`TAGMSG`/`PART` targets beyond
+  `MAX_TARGETS_PER_COMMAND` are dropped with `407 ERR_TOOMANYTARGETS`.
+- **Long `353 NAMES` replies split** across multiple lines within
+  the 510-byte budget (previously one over-long line).
+- **`CHATHISTORY` limits capped** at a configurable ceiling
+  (default 100) — `CHATHISTORY LATEST #chan * 999999999` no longer
+  asks for an unbounded replay.
+- **Bare-CR smuggling rejected.** Any CR remaining after the
+  trailing CRLF strip is a parse error (`421`), and outbound
+  `RawLine.text` is sanitized of stray CR.
+- **Channel names validated in one shared module** — NUL and
+  control characters are forbidden outright.
+- **`USER` username/realname validated** (charset, byte length, no
+  control characters) before `001`.
+- **`OPER` requires a registered connection** (`451
+  ERR_NOTREGISTERED` pre-registration).
+- **`parseTags` builds a null-prototype map** — a `__proto__` tag
+  can no longer pollute the tags object (prototype pollution).
+
+### Changed — Services hardening (`irc-core`)
+
+- **ChanServ privilege guards.** `DEOP`/`KICK` cannot target the
+  founder from a non-founder, and roster-mutation commands check the
+  caller's access rank (`SOP`/`AOP`/`HOP`/`VOP`) before acting.
+- **HostServ auto-approve denylist/allowlist.** When vhost
+  auto-approve is enabled, requests are checked against a
+  configurable denylist (and optional allowlist) instead of
+  approving everything.
+
+### Added — CI / deploy guards (`ci-hardening`, deploy workflows)
+
+- **Env-var documentation drift guard.** The
+  `consumed-env-vars` block in `apps/cf-worker/wrangler.toml` is
+  contract-checked against the cf-adapter config loader source on
+  every CI run: every consumed var must be documented (classified
+  `[vars]` vs `[secret]`), no stale names, and no `[secret]`-class
+  var may ship as a plaintext `[vars]` entry.
+- **Placeholder-hostname deploy rejection.** The CF deploy workflow
+  refuses to ship while `SERVER_NAME` is still a repo placeholder
+  (`irc.example.com` / `irc.your-domain.invalid`).
+
+### Changed — Documentation
+
+- **`README.md` rewritten to current capabilities**: the abuse
+  controls & credential hardening surface (admission/rate table,
+  protocol budgets, lockouts, the SASL EXTERNAL triple gate), the
+  hardened TCP origins (PROXY v1 + origin TLS on CF, NLB assertions
+  on AWS), the new tools, accurate coverage state, and an updated
+  roadmap.
+
+### ⚠️ Migration required
+
+- **No persisted-DO-state schema change.** `PERSISTED_STATE_VERSION`
+  stays `1`; the D1/DynamoDB services tables are unchanged (the
+  canonical-DN rewrite happens lazily at compare time and is
+  backward-compatible). **Code rollback across this release is
+  safe.**
+- **SASL `EXTERNAL` is now OFF by default.** If you rely on mTLS
+  EXTERNAL, set `EXTERNAL_ENABLED=true` (Workers `[vars]` / Lambda
+  env) **and** ensure edge mTLS (API Shield / APIGW client certs)
+  is configured — the flag alone advertises nothing. Accounts
+  should re-bind to the certificate's DER fingerprint
+  (`fp:<hex>`) where the platform surfaces it.
+- **CF TCP origin: reconfigure Spectrum before deploying.** The
+  container now terminates TLS and **requires PROXY protocol v1**
+  on every flow. Update the Spectrum app to
+  `proxy_protocol = "v1"` + `tls_mode = "full"`, mount the origin
+  certificate readable by UID 1000, and keep origin ingress locked
+  to Spectrum's IP ranges. See `docs/Cloudflare-TCP-Deployment.md`.
+- **AWS: NLB target must preserve flow headers.** The stream
+  handler now rejects flows missing `x-forwarded-for` /
+  `x-forwarded-port` (an NLB target-group attribute) — a
+  misconfigured LB now fails loudly instead of mis-attributing IPs.
+- **Admission defaults are now ON.** `MAX_CONNECTIONS_PER_IP=10`,
+  per-user 5, connect-rate 5/60 s, and 50 frames / 5 s apply even
+  when unset. Deployments behind a shared NAT / proxy (offices,
+  bridges, health probes) should raise `MAX_CONNECTIONS_PER_IP` /
+  the rate budget to taste.
+- **Oper credentials: migrate off plaintext.** `OPER_PASSWORD`
+  still works but is deprecated. Generate
+  `OPER_SALT`/`OPER_HASH` with `tools/hash-oper-cred.ts` and set
+  them as Workers secrets / Lambda env.
+- **Client-visible behaviour changes.** (1) `AUTHENTICATE` frames
+  now count against flood control (a client that sent SASL at line
+  rate will be disconnected as an excess flood). (2) An inbound
+  frame with an embedded bare CR is now a parse error answered with
+  `421` (previously in legacy mode it could smuggle content).
+  (3) Multi-target commands beyond the cap get `407` for the
+  dropped targets. No compliant client is known to trip any of
+  these.
+
+### Known limitations
+
+- **Client compatibility sweep** (WeeChat / HexChat / IRCCloud /
+  TheLounge / matrix-IRC bridge) remains pending.
+- **Web client e2e** (Playwright headless-browser vs a deployed
+  stack) remains pending; the AWS staging frontend e2e
+  (TICKET-169) is still open.
+- Same transport limits as v0.10.0: the **CF TCP path requires
+  Cloudflare Spectrum (Enterprise tier)**; the **AWS TCP path** is
+  subject to Lambda stream-duration limits. WebSocket remains the
+  zero-extra-deps default.
+- **Coverage hardening is near-complete.** `irc-core`,
+  `irc-server`, `in-memory-runtime`, `irc-test-support`,
+  `cf-worker`, `local-cli`, `aws-stack`, `load-test`,
+  `cf-tcp-container`, `tcp-ws-forwarder`, `ci-hardening`, and
+  `deploy-scripts` sit at 100% lines; `cf-adapter` (~99.7%) and
+  `aws-adapter` (~98%) clear the 90% gate with follow-ups open;
+  `web` is at 100% lines / ~98% branches.
+
+### Security
+
+This release is itself a security remediation; the headline items:
+
+- **Admission + rate limiting at every edge** (above) — the audit's
+  "no throttling anywhere" theme: connection floods, per-IP
+  takeovers of the connection budget, and frame floods are now
+  bounded by default.
+- **Plaintext oper credentials replaced** with scrypt hashes +
+  timing-safe verify (above).
+- **Account-enumeration oracles closed**: timing-equalized
+  `verifyNick`, constant-time server-password compare (above).
+- **Brute-force lockouts** on SASL / OPER / NickServ `IDENTIFY`
+  (above).
+- **SASL `EXTERNAL` safe by default** (off unless the operator
+  opts in; fingerprint-based binding) and **bare-CR / prototype-
+  pollution / oversized-payload parser hardening** (above).
+- **Credential redaction from logs** + 10% default sampling
+  (above), complementing v0.10.0's `DataTraceEnabled` hard-lock.
+
+---
+
 ## [0.10.0] - 2026-08-13
 
 The main change in this release is **AWS web client parity** — the