echoIRCd

Changelog

Release history for the echoIRCd daemon. The full commit log lives on git.devtronic.pro/echo/echoIRCd.

5.0.1 — 2026-08-30#

Rolls up the changes since 5.0.0.

Highlights#

  • SASL — added the SCRAM-SHA-256 and ECDSA-NIST256P-CHALLENGE mechanisms; both are challenge/response, so they're advertised even on the plaintext port.
  • Operator privileges — a full privilege model: oper types and reusable capability classes, named privileges enforced at the flood / join / visibility gates, a per-type usermode/chanmode allow-list, and -deny token exclusion. See Operators.
  • Connect notices — the connecting-client snote now shows the IP (tagged ipv4/ipv6), the +x cloaked host, the transport (WebSocket) and TLS version/cipher, and the port / SNI / account — with IP and geo/ASN redacted from non-netadmin opers. Plus a post-connect "now logged in" notice.
  • GeoIP & ASN — a native MaxMind ASN-lookup module, an A:<asn> extban, connect-class and security-group matching on origin AS, and city + ASN added to geo in the connect snote, WHOIS, and GEOIP.
  • IRCv3 — draft/event-playback (JOIN/PART/QUIT/NICK/MODE/TOPIC/KICK replayed into CHATHISTORY) and draft/webpush (RFC 8291/8292 Web Push with VAPID).
  • Localization — server-wide locale via lang/<code>.conf catalogs (fr, es): the welcome burst, numerics, and the snotice / oper-command / xline / WHOIS paths are all translated at a single chokepoint, with English staying zero-cost.
  • Per-SNI branding — a brand block lets one daemon present multiple server/network identities keyed by the TLS SNI host.
  • Operations — an echoircd rehash CLI and SIGHUP in-place config reload, RPL_VERSION enriched with build and toolchain provenance, and the watchdog now names the slow event.

Commits in this release#

  • release: bump version to 5.0.1 (0be6daa)
  • sasl: advertise and relay ECDSA-NIST256P-CHALLENGE (ed58813)
  • sasl: offer and relay SCRAM-SHA-256 (advertised on plaintext too) (dfbe8e8)
  • opers: use the priv-name constants at the auspex checks; remove unused fns (a922a30)
  • io: bound the blocking TLS handshake write side + the wss TLS handshake (369e06e)
  • opers: add users/ignore-privdeaf — reach +D deaf users (2d42fbd)
  • opers: wire eight more privileges over their raw is_oper gates (5dfedb5)
  • docs: document the oper privilege model (types/classes, privileges, mode allowlist) (bbe2682)
  • opers: apply the usermode allowlist to +s (snomask) too (57c4cb0)
  • opers: gate NAMES secret-channel visibility on channels/auspex too (4e72ef7)
  • opers: TokenList -deny exclusion for commands/privs + auspex-gate hidden chans (55863e9)
  • opers: enforce the per-type usermode/chanmode allowlist (e2a64b7)
  • opers: organize privileges and enforce them at flood/join/visibility gates (bc412c2)
  • opertypes: enforced oper privilege system (users/auspex, channels/auspex) (ff380d6)
  • snoop: redact connect-notice IP + geo/ASN to non-netadmin opers (d73f68f)
  • snoop: show the +x cloaked host in the connect notice, not the raw host (0af2ab7)
  • snoop: show connecting IP in the connect snote, tagged ipv4/ipv6 (6a8999a)
  • asn: A:<asn> matching extban (ban/exempt by origin AS); advertise A in EXTBAN (bf1446a)
  • asn: core ASN lookup module (native MMDB); match connect classes + security groups on origin AS (068924d)
  • geoip: read city + ASN from MaxMind dbs; add geo (country/city + ASN) to connect snote, WHOIS and GEOIP (cc13ce0)
  • snoop: show transport (websocket) + TLS version/cipher in the client-connecting snote (f0c4a1c)
  • watchdog: name the slow event/command in the slow-event snote and [watchdog] warning (106bda2)
  • link: announce a member's IJOIN status modes to local channel members so a rejoining services bot shows opped (533666d)
  • docs/ircv3: document draft/event-playback, draft/webpush (WEBPUSH + VAPID ISUPPORT) (8df756b)
  • readme: list draft/event-playback + draft/webpush under IRCv3 features (f7ff5c3)
  • modules: draft/webpush — RFC 8291 (aes128gcm) + RFC 8292 (VAPID ES256) Web Push; WEBPUSH REGISTER/UNREGISTER, VAPID ISUPPORT, off-core delivery, HKDF/round-trip tested (6ecb6f3)
  • modules: draft/event-playback — record JOIN/PART/QUIT/NICK/MODE/TOPIC/KICK into CHATHISTORY, replayed only for cap clients (event_playback config, default on) (6bb8ccd)
  • readme: document server-wide message localization (locale/lang catalogs, fr+es) (9dcc269)
  • i18n: localize the client-facing Closing-link ERROR wrapper via trf (fr, es); QUIT-broadcast reasons stay canonical for S2S (0467173)
  • i18n: sweep all remaining dynamic prose (oper commands, XLINE/FILTER/DNSBL notices, whois/vhost/knock/dcc/title/reputation/tline/rmode, hash, rename) through trf; +\xNN catalog escape; fr+es now 236 entries each (9b51db0)
  • i18n: localize the snotice/announce path — translate at deliver_server_notice chokepoint; rehash, connect/exit, oper-up, login, channel & ojoin notices via trf (fr, es) (ef96bcb)
  • i18n: localize the welcome burst (001-003/251) via trf() dynamic templates (fr, es) (6f8ff39)
  • i18n: server-wide locale via lang/<code>.conf catalogs (fr, es); numeric prose auto-translated at the chokepoint, en = zero-cost passthrough (560c860)
  • websocket: collapse v4-mapped proxy peer so ws_proxyranges matches and X-Real-IP is honored (5914a6d)
  • accounts: oper snotice on post-connect login ('Client X is now logged in as Y') (935f22f)
  • snoop: drop needless clones in the connect notice (hold the &User borrow) (37436d0)
  • snoop: connect notice includes port, sni and account (present fields only) (6e8d6c3)
  • docs: document the brand block (per-SNI server/network identity) in the example config (a587d25)
  • brand: per-SNI server/network identity (welcome, ISUPPORT NETWORK, numeric source prefix) (b6ada85)
  • whois: show client-cert fingerprint (276) to everyone, not just opers/self (f36f803)