Skip to content

feat: Add native DNSBL and GitSync implementations #83

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
MrLenin wants to merge 10 commits into
base: master
Choose a base branch
from
Draft

feat: Add native DNSBL and GitSync implementations #83

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
95eeb68
fix: Add missing +1 to ircd_strncpy size parameters
MrLenin Jan 1, 2026
831f73e
feat: Implement native DNSBL and Linesync support
MrLenin Dec 30, 2025
cc2f533
refactor: Replace linesync (curl) with gitsync (libgit2)
MrLenin Dec 30, 2025
ad2b183
feat: Complete gitsync implementation with TLS cert tag support
MrLenin Dec 30, 2025
865e85a
feat: Add gitsync security hardening and remote command support
MrLenin Dec 30, 2025
06cab9c
feat: Add native GitSync with libgit2 and SSH key auto-generation
MrLenin Dec 31, 2025
9e71797
fix: DNSBL security vulnerabilities and whitelist exemption
MrLenin Dec 31, 2025
818b7ff
security: Fix command injection and TOCTOU vulnerabilities in GitSync
MrLenin Dec 31, 2025
d3cd71a
fix: Clear DNSBL server list on rehash to prevent duplicates
MrLenin Dec 31, 2025
bae731b
Merge upstream/master: security hardening fixes
MrLenin Jan 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ ENV GID 1234
ENV UID 1234

RUN DEBIAN_FRONTEND=noninteractive RUNLEVEL=1 apt-get update
RUN DEBIAN_FRONTEND=noninteractive RUNLEVEL=1 apt-get -y install build-essential libssl-dev autoconf automake flex libpcre3-dev byacc gawk git vim procps net-tools iputils-ping bind9-host
RUN DEBIAN_FRONTEND=noninteractive RUNLEVEL=1 apt-get -y install build-essential libssl-dev autoconf automake flex libpcre3-dev byacc gawk git vim procps net-tools iputils-ping bind9-host libgit2-dev openssh-client
#libgeoip-dev libmaxminddb-dev

# Perl dependencies for iauthd.pl (commented out - using TypeScript version)
Expand All @@ -31,8 +31,9 @@ WORKDIR /home/nefarious/nefarious2

# I cant get the maxminddb library to compile in at all in debian 12, give up on geoip for now
# --with-geoip=/usr --with-mmdb=/usr \
RUN ./configure --libdir=/home/nefarious/ircd --enable-debug --with-maxcon=4096
RUN ./configure --libdir=/home/nefarious/ircd --enable-debug --with-maxcon=4096 --with-libgit2=/usr
RUN make
# make install runs an interactive SSL generator - pre-create pem to skip, then remove so entrypoint generates fresh one
RUN touch /home/nefarious/ircd/ircd.pem && make install && rm /home/nefarious/ircd/ircd.pem

# Build iauthd-ts
Expand All @@ -53,8 +54,7 @@ RUN ln -sf /dev/stdout /home/nefarious/ircd/ircd.log
USER root
#Clean up build
RUN rm -rf /home/nefarious/nefarious2
RUN apt-get remove -y build-essential && apt-get autoremove -y
RUN apt-get clean
RUN apt-get remove -y build-essential && apt-get autoremove -y && apt-get clean

USER nefarious

Expand All @@ -71,6 +71,7 @@ COPY tools/docker/base.conf-dist /home/nefarious/ircd/base.conf-dist
COPY tools/docker/ircd.conf /home/nefarious/ircd/ircd.conf
COPY tools/docker/linesync.conf /home/nefarious/ircd/linesync.conf

# Run entrypoint (volume permissions fixed by init container in docker-compose)
ENTRYPOINT ["/home/nefarious/dockerentrypoint.sh"]

CMD ["/home/nefarious/bin/ircd", "-n", "-x", "5", "-f", "ircd-docker.conf"]
Expand Down
78 changes: 48 additions & 30 deletions config.h.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,40 +33,43 @@
/* Define to 1 if you have the <crypt.h> header file. */
#undef HAVE_CRYPT_H

/* Define to 1 if you have the `getrusage' function. */
/* Define to 1 if you have the 'getrusage' function. */
#undef HAVE_GETRUSAGE

/* Define to 1 if you have the <git2.h> header file. */
#undef HAVE_GIT2_H

/* Define to 1 if you have the <inttypes.h> header file. */
#undef HAVE_INTTYPES_H

/* Define to 1 if you have the `kqueue' function. */
/* Define to 1 if you have the 'kqueue' function. */
#undef HAVE_KQUEUE

/* Define to 1 if you have the `nsl' library (-lnsl). */
/* Define to 1 if you have the 'nsl' library (-lnsl). */
#undef HAVE_LIBNSL

/* Define to 1 if you have the `resolv' library (-lresolv). */
/* Define to 1 if you have the 'resolv' library (-lresolv). */
#undef HAVE_LIBRESOLV

/* Define to 1 if you have the `socket' library (-lsocket). */
/* Define to 1 if you have the 'socket' library (-lsocket). */
#undef HAVE_LIBSOCKET

/* Define to 1 if you have the <memory.h> header file. */
#undef HAVE_MEMORY_H

/* Define to 1 if you have the <poll.h> header file. */
#undef HAVE_POLL_H

/* Define to 1 if system calls automatically restart after interruption by a
signal. */
#undef HAVE_RESTARTABLE_SYSCALLS

/* Define to 1 if you have the `setrlimit' function. */
/* Define to 1 if you have the 'setrlimit' function. */
#undef HAVE_SETRLIMIT

/* Define to 1 if you have the <stdint.h> header file. */
#undef HAVE_STDINT_H

/* Define to 1 if you have the <stdio.h> header file. */
#undef HAVE_STDIO_H

/* Define to 1 if you have the <stdlib.h> header file. */
#undef HAVE_STDLIB_H

Expand Down Expand Up @@ -97,13 +100,16 @@
/* Define to 1 if you have the <sys/stat.h> header file. */
#undef HAVE_SYS_STAT_H

/* Define to 1 if you have the <sys/time.h> header file. */
#undef HAVE_SYS_TIME_H

/* Define to 1 if you have the <sys/types.h> header file. */
#undef HAVE_SYS_TYPES_H

/* Define to 1 if you have <sys/wait.h> that is POSIX.1 compatible. */
#undef HAVE_SYS_WAIT_H

/* Define to 1 if you have the `times' function. */
/* Define to 1 if you have the 'times' function. */
#undef HAVE_TIMES

/* Define to 1 if you have the <unistd.h> header file. */
Expand Down Expand Up @@ -169,22 +175,22 @@
/* Define if you have POSIX signals. */
#undef POSIX_SIGNALS

/* The size of `int', as computed by sizeof. */
/* The size of 'int', as computed by sizeof. */
#undef SIZEOF_INT

/* The size of `int64_t', as computed by sizeof. */
/* The size of 'int64_t', as computed by sizeof. */
#undef SIZEOF_INT64_T

/* The size of `long', as computed by sizeof. */
/* The size of 'long', as computed by sizeof. */
#undef SIZEOF_LONG

/* The size of `long long', as computed by sizeof. */
/* The size of 'long long', as computed by sizeof. */
#undef SIZEOF_LONG_LONG

/* The size of `short', as computed by sizeof. */
/* The size of 'short', as computed by sizeof. */
#undef SIZEOF_SHORT

/* The size of `void *', as computed by sizeof. */
/* The size of 'void *', as computed by sizeof. */
#undef SIZEOF_VOID_P

/* Path to executable for restarts */
Expand All @@ -196,16 +202,19 @@
/* Path name used as a base for the ssl lib files. */
#undef SSL_LIBS_PATH

/* Define to 1 if you have the ANSI C header files. */
/* Define to 1 if all of the C89 standard headers exist (not just the ones
required in a freestanding environment). This macro is provided for
backward compatibility; new code need not use it. */
#undef STDC_HEADERS

/* Define if you have (unreliable) SysV signals. */
#undef SYSV_UNRELIABLE_SIGNALS

/* Define to 1 if you can safely include both <sys/time.h> and <time.h>. */
/* Define to 1 if you can safely include both <sys/time.h> and <time.h>. This
macro is obsolete. */
#undef TIME_WITH_SYS_TIME

/* Define to 1 if your <sys/time.h> declares `struct tm'. */
/* Define to 1 if your <sys/time.h> declares 'struct tm'. */
#undef TM_IN_SYS_TIME

/* Define to enable the /dev/poll engine */
Expand All @@ -223,6 +232,12 @@
/* Define to enable the kqueue engine */
#undef USE_KQUEUE

/* Define if you are using libgit2 for gitsync */
#undef USE_LIBGIT2

/* Define if you are using LMDB for chathistory */
#undef USE_LMDB

/* Define if you are using MaxMindDB */
#undef USE_MMDB

Expand All @@ -232,6 +247,9 @@
/* Define if you are using OpenSSL */
#undef USE_SSL

/* Define if you are using zstd compression */
#undef USE_ZSTD

/* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
significant byte first (like Motorola and SPARC, unlike Intel). */
#if defined AC_APPLE_UNIVERSAL_BUILD
Expand All @@ -244,36 +262,36 @@
# endif
#endif

/* Define to 1 if `lex' declares `yytext' as a `char *' by default, not a
`char[]'. */
/* Define to 1 if 'lex' declares 'yytext' as a 'char *' by default, not a
'char[]'. */
#undef YYTEXT_POINTER

/* Define to `int' if <sys/types.h> doesn't define. */
/* Define as 'int' if <sys/types.h> doesn't define. */
#undef gid_t

/* Define to `short' if <sys/types.h> does not define. */
/* Define to 'short' if <sys/types.h> does not define. */
#undef int16_t

/* Define to `long' if <sys/types.h> does not define. */
/* Define to 'long' if <sys/types.h> does not define. */
#undef int32_t

/* Define to `long long' if <sys/types.h> does not define. */
/* Define to 'long long' if <sys/types.h> does not define. */
#undef int64_t

/* Define to `unsigned int' if <sys/types.h> does not define. */
/* Define as 'unsigned int' if <stddef.h> doesn't define. */
#undef size_t

/* type to use in place of socklen_t if not defined */
#undef socklen_t

/* Define to `int' if <sys/types.h> doesn't define. */
/* Define as 'int' if <sys/types.h> doesn't define. */
#undef uid_t

/* Define to `unsigned short' if <sys/types.h> does not define. */
/* Define to 'unsigned short' if <sys/types.h> does not define. */
#undef uint16_t

/* Define to `unsigned long' if <sys/types.h> does not define. */
/* Define to 'unsigned long' if <sys/types.h> does not define. */
#undef uint32_t

/* Define to `unsigned long long' if <sys/types.h> does not define. */
/* Define to 'unsigned long long' if <sys/types.h> does not define. */
#undef uint64_t
Loading