serverless-ircd 0.10.0 → 0.11.0

package/packages/irc-core/src/commands/hostserv.ts

@@ -15,10 +15,14 @@
  *     peers see the revert. Requires identification.
  *   - `REQUEST <vhost>` — proposes a vhost for the account. Behaviour
  *     depends on {@link ServerConfig.hostservAutoApproveVhosts}: when the
- *     knob is on (the default) the vhost is recorded against the account
- *     immediately (legacy auto-approve); when the knob is off the request
- *     is queued for oper review via {@link ServicesStore.requestVhost}
- *     and the requester is told it is pending. Requires identification.
+ *     knob is off (the default) the request is queued for oper review via
+ *     {@link ServicesStore.requestVhost} and the requester is told it is
+ *     pending. When the knob is on (deprecated legacy auto-approve) the
+ *     vhost is recorded against the account immediately, but only after
+ *     clearing a built-in denylist (reserved labels such as `admin` /
+ *     `staff` at any position, plus this server's own hostname) and
+ *     matching the mandatory {@link ServerConfig.hostservAutoApproveAllowlist}
+ *     (exact or `*.suffix` wildcard entries). Requires identification.
  *   - `SET <account> <vhost>` — oper-only. Records (or, with the literal
  *     `*` argument, clears) the vhost for `account` directly without
  *     going through REQUEST. The target account must be a registered nick.
@@ -67,6 +71,59 @@ function isValidVhost(vhost: string): boolean {
   return VHOST_RE.test(vhost);
 }
 
+/**
+ * Labels a user may never self-assign via auto-approved REQUEST, at any
+ * dot-separated position of the vhost (case-insensitive — DNS labels are).
+ * These names impersonate staff, operators, or off-network services, so the
+ * denylist is enforced even when the operator explicitly allowlists them.
+ */
+const RESERVED_VHOST_LABELS = new Set(['admin', 'oper', 'staff', 'irc', 'www', 'root', 'security']);
+
+/**
+ * Built-in denylist for auto-approved vhosts. Rejects any vhost containing
+ * a {@link RESERVED_VHOST_LABELS} label, plus the deployment's own hostname
+ * (exactly or as a suffix) so a user cannot cloak as
+ * `<anything>.<this-server>` and phish off its identity. Oper-vetted paths
+ * (SET, queue-mode APPROVE) intentionally bypass this — opers are trusted.
+ */
+function isDeniedVhost(vhost: string, serverName: string): boolean {
+  const lower = vhost.toLowerCase();
+  for (const label of lower.split('.')) {
+    if (RESERVED_VHOST_LABELS.has(label)) {
+      return true;
+    }
+  }
+  const server = serverName.toLowerCase();
+  return lower === server || lower.endsWith(`.${server}`);
+}
+
+/**
+ * Allowlist check for auto-approved vhosts. An entry matches when it is
+ * exactly the vhost (`users.example.net`) or a wildcard suffix
+ * (`*.users.example.com` matches `a.users.example.com` and any depth
+ * beneath it, but NOT the bare suffix). Matching is case-insensitive
+ * (DNS semantics). A missing allowlist matches nothing — the reducer
+ * fails closed; the config layer separately refuses to boot auto-approve
+ * mode without a non-empty allowlist.
+ */
+function isAllowlistedVhost(vhost: string, allowlist: ReadonlyArray<string> | undefined): boolean {
+  if (allowlist === undefined) {
+    return false;
+  }
+  const lower = vhost.toLowerCase();
+  for (const entry of allowlist) {
+    const normalized = entry.toLowerCase();
+    if (normalized.startsWith('*.')) {
+      if (lower.endsWith(normalized.slice(1))) {
+        return true;
+      }
+    } else if (lower === normalized) {
+      return true;
+    }
+  }
+  return false;
+}
+
 /**
  * Reducer for `PRIVMSG HostServ :<subcommand> <args…>`.
  * Authority: the invoking connection's {@link ConnectionState}.
@@ -185,13 +242,20 @@ function handleOff(
 /**
  * Handles `REQUEST <vhost>`. Behaviour is selected by
  * {@link ServerConfig.hostservAutoApproveVhosts}:
- *   - `true` (auto-approve) — the vhost is recorded against the account
- *     immediately (the path that shipped before the oper queue landed). The
- *     user is notified that the vhost has been requested and approved.
  *   - `false` or omitted (the default — queue mode) — the request is
  *     queued for oper review via {@link ServicesStore.requestVhost}; the
  *     vhost is NOT activated and no `CHGHOST` is emitted. The user is
- *     notified that the request is pending oper approval.
+ *     notified that the request is pending oper approval. Oper-vetted
+ *     vhosts are exempt from the denylist/allowlist below.
+ *   - `true` (auto-approve, deprecated) — the vhost is recorded against
+ *     the account immediately, but only if it survives hardening: the
+ *     built-in denylist ({@link isDeniedVhost}: reserved labels at any
+ *     position + this deployment's own hostname) rejects impersonation
+ *     vectors even when the operator allowlisted them, and the mandatory
+ *     allowlist ({@link isAllowlistedVhost}) must match the vhost exactly
+ *     or via a `*.suffix` wildcard entry. Config parsing refuses to boot
+ *     auto-approve mode without a non-empty allowlist; the reducer fails
+ *     closed regardless.
  *
  * Identified-only — otherwise a guest could plant a vhost (or a pending
  * request) against a registered account they do not own.
@@ -225,6 +289,18 @@ function handleRequest(
     return { state, effects };
   }
 
+  if (isDeniedVhost(vhost, ctx.serverName)) {
+    effects.push(
+      notice(state, `Vhost ${vhost} is not permitted (reserved label or this server's hostname).`),
+    );
+    return { state, effects };
+  }
+
+  if (!isAllowlistedVhost(vhost, ctx.serverConfig.hostservAutoApproveAllowlist)) {
+    effects.push(notice(state, `Vhost ${vhost} is not in the auto-approve allowlist.`));
+    return { state, effects };
+  }
+
   services.setVhost(state.account, vhost);
   effects.push(notice(state, `Vhost ${vhost} has been requested and approved.`));
   return { state, effects };

package/packages/irc-core/src/commands/index.ts

@@ -15,7 +15,7 @@ export {
   userReducer,
 } from './registration.js';
 export { quitReducer } from './quit.js';
-export { handleJoinZero, isValidChannelName, joinReducer } from './join.js';
+export { handleJoinZero, joinReducer } from './join.js';
 export { partReducer } from './part.js';
 export { motdReducer } from './motd.js';
 export { operReducer, matchOperCred } from './oper.js';
@@ -61,6 +61,7 @@ export { tagmsgChannelReducer, tagmsgUserReducer } from './tagmsg.js';
 export { markreadChannelReducer } from './markread.js';
 export {
   DEFAULT_MULTILINE_MAX_BYTES,
+  DEFAULT_MULTILINE_MAX_ENTRIES,
   MULTILINE_CAP,
   type FinalizeMultilineResult,
   type MultilineEntry,

package/packages/irc-core/src/commands/invite.ts

@@ -23,19 +23,13 @@
 import { caseFold } from '../case-fold.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
+import { isValidChannelName } from '../protocol/channel-name.js';
 import { Numerics } from '../protocol/numerics.js';
 import type { ChannelState } from '../state/channel.js';
 import { hostmaskOf } from '../state/connection.js';
 import type { ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
 
-const CHANNEL_NAME_RE = /^[#&][^\s,:]+$/u;
-
-function isValidChannelName(name: string, maxLen: number): boolean {
-  if (name.length === 0 || name.length > maxLen) return false;
-  return CHANNEL_NAME_RE.test(name);
-}
-
 /** Returns the caller's hostmask, falling back to nick then `?`. */
 function callerHostmask(conn: ConnectionState): string {
   return hostmaskOf(conn) ?? conn.nick ?? '?';

package/packages/irc-core/src/commands/join.ts

@@ -20,6 +20,7 @@ import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
 import type { PersistedTopic, StoredMessage } from '../ports.js';
 import { wrapBatch } from '../protocol/batch.js';
+import { isValidChannelName } from '../protocol/channel-name.js';
 import { Numerics } from '../protocol/numerics.js';
 import { type ChanName, type ChannelState, type ChannelTopic, prefixOf } from '../state/channel.js';
 import { hostmaskOf } from '../state/connection.js';
@@ -29,22 +30,6 @@ import { CHANSERV_HOSTMASK, DEFAULT_CHANNEL_LEVELS } from './chanserv.js';
 import { CHATHISTORY_CAP, buildChathistoryBatch } from './chathistory.js';
 import { topicNumerics } from './topic.js';
 
-/**
- * RFC 1459/2812 channel-name grammar. The first character must be a channel
- * prefix (`#` or `&`); the rest may be any printable char except space, comma,
- * or colon (which all carry protocol meaning).
- */
-const CHANNEL_NAME_RE = /^[#&][^\s,:]+$/u;
-
-/**
- * Returns true iff `name` matches the IRC channel-name grammar and is within
- * the configured length cap.
- */
-export function isValidChannelName(name: string, maxLen: number): boolean {
-  if (name.length === 0 || name.length > maxLen) return false;
-  return CHANNEL_NAME_RE.test(name);
-}
-
 /**
  * Returns the 353 NAMES sigil for a channel given its modes:
  * `@` for `+p` (private), `*` for `+s` (secret), `=` otherwise (public).

package/packages/irc-core/src/commands/kick.ts

@@ -16,20 +16,13 @@
 import { caseFold } from '../case-fold.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
+import { isValidChannelName } from '../protocol/channel-name.js';
 import { Numerics } from '../protocol/numerics.js';
 import type { ChannelState } from '../state/channel.js';
 import { hostmaskOf } from '../state/connection.js';
 import type { ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
 
-/** Channel-name validation mirrors JOIN: same grammar, same length cap. */
-const CHANNEL_NAME_RE = /^[#&][^\s,:]+$/u;
-
-function isValidChannelName(name: string, maxLen: number): boolean {
-  if (name.length === 0 || name.length > maxLen) return false;
-  return CHANNEL_NAME_RE.test(name);
-}
-
 /**
  * Formats a single numeric error line addressed to the connection's current
  * nick (or `*` when unregistered). Optional `middle` is emitted before the

package/packages/irc-core/src/commands/list.ts

@@ -29,18 +29,11 @@
 import { caseFold } from '../case-fold.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
+import { isValidChannelName } from '../protocol/channel-name.js';
 import { Numerics } from '../protocol/numerics.js';
 import type { ChanSnapshot } from '../state/channel.js';
 import type { Ctx, Reducer } from '../types.js';
 
-/** Channel-name grammar; mirrors {@link isValidChannelName} in `join.ts`. */
-const CHANNEL_NAME_RE = /^[#&][^\s,:]+$/u;
-
-function isValidChannelName(name: string, maxLen: number): boolean {
-  if (name.length === 0 || name.length > maxLen) return false;
-  return CHANNEL_NAME_RE.test(name);
-}
-
 /**
  * Returns true iff the requester is permitted to see `chan` in LIST output.
  * Secret channels require membership; everything else is public.

package/packages/irc-core/src/commands/mode.ts

@@ -31,6 +31,7 @@
 import { caseFold } from '../case-fold.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
+import { isValidChannelName } from '../protocol/channel-name.js';
 import { Numerics } from '../protocol/numerics.js';
 import type { BooleanChannelMode, ChannelState } from '../state/channel.js';
 import type {
@@ -45,14 +46,6 @@ import type { ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
 import { positiveMlockLetters } from './chanserv.js';
 
-/** Channel-name grammar; mirrors {@link isValidChannelName} in `join.ts`. */
-const CHANNEL_NAME_RE = /^[#&][^\s,:]+$/u;
-
-function isValidChannelName(name: string, maxLen: number): boolean {
-  if (name.length === 0 || name.length > maxLen) return false;
-  return CHANNEL_NAME_RE.test(name);
-}
-
 /** Returns the caller's hostmask, falling back to nick then `?`. */
 function callerHostmask(conn: ConnectionState): string {
   return hostmaskOf(conn) ?? conn.nick ?? '?';

package/packages/irc-core/src/commands/multiline.ts

@@ -26,11 +26,13 @@
 
 import {
   DEFAULT_MULTILINE_MAX_BYTES,
+  DEFAULT_MULTILINE_MAX_ENTRIES,
   MULTILINE_CAP_NAME,
   multilineCapValue,
 } from '../caps/capabilities.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
+import { byteLength } from '../protocol/bytes.js';
 import { hostmaskOf } from '../state/connection.js';
 import type { Ctx } from '../types.js';
 
@@ -41,7 +43,7 @@ import type { Ctx } from '../types.js';
  */
 export const MULTILINE_CAP = MULTILINE_CAP_NAME;
 
-export { DEFAULT_MULTILINE_MAX_BYTES, multilineCapValue };
+export { DEFAULT_MULTILINE_MAX_BYTES, DEFAULT_MULTILINE_MAX_ENTRIES, multilineCapValue };
 
 /**
  * One accumulated inner line of a multi-line batch. The actor collects these
@@ -79,21 +81,13 @@ export function multilineByteLength(entries: readonly MultilineEntry[]): number
   if (entries.length === 0) return 0;
   let total = 0;
   for (const entry of entries) {
-    total += utf8ByteLength(entry.text);
+    total += byteLength(entry.text);
   }
   // `(n - 1)` separators join `n` entries.
   total += entries.length - 1;
   return total;
 }
 
-/** Shared `TextEncoder` for UTF-8 byte-length accounting (Web standard). */
-const TEXT_ENCODER = new TextEncoder();
-
-/** Returns the UTF-8 byte length of `s` (the wire encoding for IRC content). */
-function utf8ByteLength(s: string): number {
-  return TEXT_ENCODER.encode(s).length;
-}
-
 /** Resolves the sender's hostmask, falling back to nick then `?`. */
 function senderHostmask(conn: Ctx['connection']): string {
   return hostmaskOf(conn) ?? conn.nick ?? '?';

package/packages/irc-core/src/commands/names.ts

@@ -31,17 +31,22 @@
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
 import { wrapBatch } from '../protocol/batch.js';
+import { byteLength } from '../protocol/bytes.js';
+import { isValidChannelName } from '../protocol/channel-name.js';
 import { Numerics } from '../protocol/numerics.js';
 import type { ChannelState, RosterEntry } from '../state/channel.js';
 import type { Ctx, Reducer } from '../types.js';
 
-/** Channel-name grammar; mirrors {@link isValidChannelName} in `join.ts`. */
-const CHANNEL_NAME_RE = /^[#&][^\s,:]+$/u;
+/**
+ * RFC 1459 §2.3: maximum IRC line length in bytes, including the trailing
+ * CR-LF. Transports append `\r\n` after the text produced here, so the
+ * budget for the line text itself is 512 − 2 = 510 bytes. Declared locally
+ * (mirroring `cap.ts` / `motd-lines.ts`) to keep this module self-contained.
+ */
+const MAX_LINE_BYTES = 512;
 
-function isValidChannelName(name: string, maxLen: number): boolean {
-  if (name.length === 0 || name.length > maxLen) return false;
-  return CHANNEL_NAME_RE.test(name);
-}
+/** Length of the trailing CR-LF the wire layer appends to each line. */
+const TRAILING_CRLF_LEN = 2;
 
 /** Formats a numeric error/reply line addressed to the connection's nick. */
 function numericErr(ctx: Ctx, code: number, trailing: string, middle: string): RawLine {
@@ -90,14 +95,50 @@ function prefixFormatter(ctx: Ctx): (entry: RosterEntry) => string {
   return ctx.connection.caps.has('multi-prefix') ? allPrefixes : highestPrefix;
 }
 
-/** Builds the space-separated NAMES list with mode prefixes for a channel. */
-function buildNamesList(state: ChannelState, ctx: Ctx): string {
+/**
+ * Greedy-packs the formatted member list into one or more `353 RPL_NAMREPLY`
+ * lines so every emitted line fits the 510-byte text budget (RFC 2812 §3.2.5:
+ * long NAMES lists are split across multiple `353` replies rather than
+ * truncated mid-nick by the outbound line limiter).
+ *
+ * The full line is measured: the fixed `:{server} 353 {nick} {sigil} {chan} :`
+ * header, each member's mode-prefix bytes (`@`/`+`), the nicks themselves
+ * (UTF-8 bytes, not UTF-16 code units), and the separating spaces. A member
+ * that alone overflows the budget (only possible with pathological config —
+ * nicks are capped at `nickLen`) still gets its own line rather than being
+ * dropped, leaving any last-resort truncation to the outbound limiter.
+ *
+ * A channel with no members still yields exactly one `353` with an empty
+ * trailing parameter, so the reply shape (`353`…`366`) is stable for clients.
+ */
+function packNamesLines(state: ChannelState, ctx: Ctx, nick: string, sigil: string): RawLine[] {
   const format = prefixFormatter(ctx);
-  const names: string[] = [];
+  const header = `:${ctx.serverName} 353 ${nick} ${sigil} ${state.name} :`;
+  const budget = MAX_LINE_BYTES - TRAILING_CRLF_LEN;
+  const headerBytes = byteLength(header);
+
+  const lines: RawLine[] = [];
+  let current = '';
+  let usedBytes = 0;
+  let empty = true;
+
   for (const entry of state.members.values()) {
-    names.push(format(entry) + entry.nick);
+    const token = format(entry) + entry.nick;
+    const tokenBytes = byteLength(token);
+    // One extra byte for the space separator when appending to a non-empty list.
+    const costBytes = empty ? tokenBytes : tokenBytes + 1;
+    if (!empty && headerBytes + usedBytes + costBytes > budget) {
+      lines.push({ text: `${header}${current}` });
+      current = token;
+      usedBytes = tokenBytes;
+    } else {
+      current = empty ? token : `${current} ${token}`;
+      usedBytes += costBytes;
+    }
+    empty = false;
   }
-  return names.join(' ');
+  lines.push({ text: `${header}${current}` });
+  return lines;
 }
 
 /**
@@ -143,9 +184,8 @@ export const namesReducer: Reducer<ChannelState> = (state, msg, ctx) => {
 
   const nick = ctx.connection.nick ?? '*';
   const sigil = namesSigil(state);
-  const names = buildNamesList(state, ctx);
   const replyLines: RawLine[] = [
-    { text: `:${ctx.serverName} 353 ${nick} ${sigil} ${state.name} :${names}` },
+    ...packNamesLines(state, ctx, nick, sigil),
     { text: `:${ctx.serverName} 366 ${nick} ${state.name} :End of /NAMES list.` },
   ];
 

package/packages/irc-core/src/commands/nickserv.ts

@@ -29,7 +29,12 @@
  * the {@link MessageStore} pattern).
  */
 
-import { DEFAULT_MIN_PASSWORD_LENGTH, DEFAULT_NICK_ENFORCE_GRACE_MS } from '../config.js';
+import {
+  DEFAULT_IDENTIFY_FREEZE_SECONDS,
+  DEFAULT_MAX_IDENTIFY_FAILURES,
+  DEFAULT_MIN_PASSWORD_LENGTH,
+  DEFAULT_NICK_ENFORCE_GRACE_MS,
+} from '../config.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
 import type { NickEnforcePolicy, ServicesStore } from '../ports.js';
@@ -72,6 +77,17 @@ const ENFORCE_GATE_NOTICE = 'You must identify before changing enforcement.';
  */
 const PASSWORD_GATE_NOTICE = 'You must identify before changing your password.';
 
+/**
+ * Formats the owner NOTICE delivered on the first successful identify
+ * after failed identifies were recorded against the account. Delivered
+ * once (the queued count is cleared with the delivery), so the owner
+ * learns their account was targeted even though every attempt failed.
+ */
+function identifyFailureNoticeText(count: number): string {
+  const plural = count === 1 ? 'attempt' : 'attempts';
+  return `Warning: ${count} failed identify ${plural} recorded against your account since your last successful login.`;
+}
+
 /**
  * Reducer for `PRIVMSG NickServ :<subcommand> <args…>`.
  * Authority: the invoking connection's {@link ConnectionState}.
@@ -181,13 +197,36 @@ function handleIdentify(
     return { state, effects };
   }
 
+  // Per-account freeze: once maxIdentifyFailures failed attempts were
+  // recorded within the sliding freeze window, reject BEFORE running
+  // scrypt (the freeze is the cheap rejection path; verifyNick is the
+  // expensive one an attacker would otherwise keep hitting).
+  const maxFailures =
+    ctx.serverConfig.nickServ?.maxIdentifyFailures ?? DEFAULT_MAX_IDENTIFY_FAILURES;
+  const freezeWindowMs =
+    (ctx.serverConfig.nickServ?.identifyFreezeSeconds ?? DEFAULT_IDENTIFY_FREEZE_SECONDS) * 1000;
+  if (services.isNickIdentifyFrozen(nick, { maxFailures, windowMs: freezeWindowMs })) {
+    effects.push(
+      notice(state, `Nick ${nick} is temporarily frozen due to too many failed identify attempts.`),
+    );
+    return { state, effects };
+  }
+
   const result = services.verifyNick(nick, password);
   if (!result.ok) {
+    services.recordIdentifyFailure(nick);
     effects.push(notice(state, 'Invalid password.'));
     return { state, effects };
   }
 
+  // A successful login delivers the queued owner notice (if any failed
+  // identifies were recorded since the last successful login) and resets
+  // the per-account failure accounting.
+  const failedSinceLogin = services.clearIdentifyFailures(nick);
   applyIdentify(state, result.account, services, effects);
+  if (failedSinceLogin > 0) {
+    effects.push(notice(state, identifyFailureNoticeText(failedSinceLogin)));
+  }
   return { state, effects };
 }