https://gitlab.synchro.net/main/sbbs/-/commit/da772bb475bf40030ca230f2
Added Files:
exec/load/ircd/client-security.js
Modified Files:
exec/ircd.js exec/load/ircd/config.js core.js link-security.js server.js services-common.js services-core.js services.js services.md tls.js tls.md unregistered.js exec/tests/ircd/link-security.js services-notices.js services.js state.js tls-network.py tls.js
Log Message:
ircd: enforce optional services TLS policy across the full route
Add independent RequireTLS settings for BBS services and the embedded authority, both disabled by default. Protect authentication, private
account and memo commands, and account/channel changes while keeping
HELP, public INFO, and LOGOUT available without TLS. Check client and
server transports before dispatch and recheck pending private replies.
Negotiate CLIENTTLS to report each owning server's client connections.
Keep reports on the user object, reject foreign ownership and conflicting security claims, and preserve legacy links without sending new commands
to incapable peers. Unknown paths cannot satisfy an enabled TLS policy.
Report complete client-to-client WHOIS security using numeric 671 only
for an entirely encrypted path. Explain plaintext or unknown paths with
320, and reassess forwarded WHOIS replies at the requesting server.
Also accept both native CryptLib error spellings for missing optional certificate attributes and certificate-chain exhaustion, without masking
other validation failures. Bump SynchronetIRCd to 2.8 and document the
settings and protocol behavior.
Validation: 220 regression tests; native certificate validation and
three-hub TLS/plaintext/reconnect integration; services interoperability through a legacy 2.0 relay; git diff --check.
---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net