about summary refs log tree commit diff
path: root/pounce.1
blob: 2082f72f303f2103f69f1023cfba3c9c6bb3b963 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
.Dd August 20, 2021
.Dt POUNCE 1
.Os
.
.Sh NAME
.Nm pounce
.Nd IRC bouncer
.
.Sh SYNOPSIS
.Nm
.Op Fl LNTev
.Op Fl A Ar local-ca
.Op Fl C Ar local-cert
.Op Fl H Ar local-host
.Op Fl K Ar local-priv
.Op Fl P Ar local-port
.Op Fl Q Ar queue-interval
.Op Fl R Ar blind-req
.Op Fl S Ar bind
.Op Fl U Ar local-path
.Op Fl W Ar local-pass
.Op Fl a Ar sasl-plain
.Op Fl c Ar client-cert
.Op Fl f Ar save
.Op Fl h Ar host
.Op Fl j Ar join
.Op Fl k Ar client-priv
.Op Fl m Ar mode
.Op Fl n Ar nick
.Op Fl p Ar port
.Op Fl q Ar quit
.Op Fl r Ar real
.Op Fl t Ar trust
.Op Fl s Ar size
.Op Fl u Ar user
.Op Fl w Ar pass
.Op Fl y Ar away
.Op Ar config ...
.
.Nm
.Fl o
.Op Fl S Ar bind
.Op Fl h Ar host
.Op Fl p Ar port
.Op Ar config ...
.
.Nm
.Op Fl A Ar ca
.Fl g Ar cert
.
.Nm
.Fl x
.
.Sh DESCRIPTION
The
.Nm
daemon
is a multi-client, TLS-only IRC bouncer.
It maintains a persistent connection to an IRC server
while allowing clients to connect and disconnect,
receiving messages that were missed upon reconnection.
The IRCv3
.Sy server-time
extension is used to indicate
when messages were originally received.
.
.Pp
One instance of
.Nm
must be configured for each IRC network.
Instances of
.Nm
must either use different local ports with
.Fl P
or different local hosts with
.Fl H
and
.Fl U
to be dispatched from the same port by
.Xr calico 1 .
.
.Pp
TLS certificates can be automatically loaded from
.Pa /usr/local/etc/letsencrypt
(or equivalent)
based on the local host set by
.Fl H .
These certificates can be obtained using
.Xr certbot 8 .
.
.Pp
Clients must uniquely identify themselves to
.Nm
by their IRC username.
See
.Sx Client Configuration
for details.
.
.Pp
Options can be loaded from
files listed on the command line.
Files are searched for in
.Pa $XDG_CONFIG_DIRS/pounce
unless the path starts with
.Ql / ,
.Ql \&./
or
.Ql \&../ .
Certificate and private key paths
are searched for in the same manner.
Each option is placed on a line,
and lines beginning with
.Ql #
are ignored.
The options are listed below
following their corresponding flags.
.
.Pp
The arguments are as follows:
.
.Bl -tag -width Ds
.It Fl A Ar path | Cm local-ca No = Ar path
Require clients to authenticate
using a TLS client certificate
signed by the certificate authority loaded from
.Ar path .
See
.Sx Generating Client Certificates .
If
.Fl W
is also set,
clients may instead authenticate
with a server password.
.
.It Fl C Ar path | Cm local-cert No = Ar path
Load TLS certificate from
.Ar path .
The default path is the
.Xr certbot 8
path for the
.Ar host
set by
.Fl H .
.
.It Fl H Ar host | Cm local-host No = Ar host
Bind to
.Ar host .
The default host is localhost.
.
.It Fl K Ar path | Cm local-priv No = Ar path
Load TLS private key from
.Ar path .
The default path is the
.Xr certbot 8
path for the
.Ar host
set by
.Fl H .
.
.It Fl L | Cm palaver
Advertise the
.Sy palaverapp.com
IRCv3 vendor-specific capability to clients.
This option only enables the capability;
push notifications must be provided by the
.Xr pounce-palaver 1
special-purpose client.
.
.It Fl N | Cm no-names
Do not request
.Ql NAMES
for each channel when a client connects.
This avoids already connected clients
receiving unsolicited responses
but prevents new clients from populating user lists.
.
.It Fl P Ar port | Cm local-port No = Ar port
Bind to
.Ar port .
The default port is 6697.
.
.It Fl Q Ar ms | Cm queue-interval No = Ar ms
Set the server send queue interval in milliseconds.
The queue is only used
for automated messages sent by
.Nm .
Messages from clients
are sent to the server immediately.
The default interval is 200 milliseconds.
.
.It Fl R Ar caps | Cm blind-req No = Ar caps
Blindly request the IRCv3 capabilities
.Ar caps .
This can be used to enable hidden capabilities,
such as
.Sy userhost-in-names
on some networks.
.
.It Fl S Ar host | Cm bind No = Ar host
Bind to source address
.Ar host
when connecting to the server.
.
.It Fl T | Cm no-sts
Do not advertise a
strict transport security (STS) policy
to clients.
.
.It Fl U Ar path | Cm local-path No = Ar path
Bind to a UNIX-domain socket at
.Ar path .
Clients are only accepted as dispatched by
.Xr calico 1 .
If
.Ar path
is a directory,
the
.Ar host
set by
.Fl H
is appended to it.
This option takes precedence over
.Fl H
and
.Fl P .
.
.It Fl W Ar pass | Cm local-pass No = Ar pass
Require the server password
.Ar pass
for clients to connect.
The
.Ar pass
string must be hashed using
.Fl x .
If
.Fl A
is also set,
clients may instead authenticate
using a TLS client certificate.
.
.It Fl a Ar user : Ns Ar pass | Cm sasl-plain No = Ar user : Ns Ar pass
Authenticate as
.Ar user
with
.Ar pass
using SASL PLAIN.
Since this method requires
the account password in plaintext,
it is recommended to use SASL EXTERNAL instead with
.Fl e .
.
.It Fl c Ar path | Cm client-cert No = Ar path
Load the TLS client certificate from
.Ar path .
If the private key is in a separate file,
it is loaded with
.Fl k .
With
.Fl e ,
authenticate using SASL EXTERNAL.
Certificates can be generated with
.Fl g .
.
.It Fl e | Cm sasl-external
Authenticate using SASL EXTERNAL,
also known as CertFP.
The TLS client certificate is loaded with
.Fl c .
See
.Sx Configuring CertFP .
.
.It Fl f Ar path | Cm save No = Ar path
Save and load the contents of the buffer from
.Ar path
in
.Pa $XDG_DATA_DIRS/pounce ,
or an absolute or relative path if
.Ar path
starts with
.Ql / ,
.Ql \&./
or
.Ql \&../ .
The file is truncated after loading.
.
.It Fl g Ar path
Generate a TLS client certificate using
.Xr openssl 1
and write it to
.Ar path .
The certificate is signed
by the certificate authority if
.Fl A
is set,
otherwise it is self-signed.
.
.It Fl h Ar host | Cm host No = Ar host
Connect to
.Ar host .
.
.It Fl j Ar channels Oo Ar keys Oc | Cm join No = Ar channels Op Ar keys
Join the comma-separated list of
.Ar channels
with the optional comma-separated list of channel
.Ar keys .
.
.It Fl k Ar path | Cm client-priv No = Ar path
Load the TLS client private key from
.Ar path .
.
.It Fl m Ar mode | Cm mode No = Ar mode
Set the user
.Ar mode .
.
.It Fl n Ar nick | Cm nick No = Ar nick
Set nickname to
.Ar nick .
The default nickname is the user's name.
.
.It Fl o
Print the server certificate chain
to standard output in PEM format
and exit.
.
.It Fl p Ar port | Cm port No = Ar port
Connect to
.Ar port .
The default port is 6697.
.
.It Fl q Ar mesg | Cm quit No = Ar mesg
Quit with message
.Ar mesg
when shutting down.
.
.It Fl r Ar real | Cm real No = Ar real
Set realname to
.Ar real .
The default realname is the same as the nickname.
.
.It Fl s Ar size | Cm size No = Ar size
Set the number of messages contained in the buffer to
.Ar size .
The size must be a power of two.
The default size is 4096.
.
.It Fl t Ar path | Cm trust No = Ar path
Trust the certificate loaded from
.Ar path .
Server name verification is disabled.
See
.Sx Connecting to Servers with Self-signed Certificates .
.
.It Fl u Ar user | Cm user No = Ar user
Set username to
.Ar user .
The default username is the same as the nickname.
.
.It Fl v | Cm verbose
Write IRC messages to standard error:
.Pp
.Bl -tag -width "<<" -compact
.It <<
from
.Nm
to the server
.It >>
from the server to
.Nm
.It ->
from clients to
.Nm
.It <-
from
.Nm
to clients
.El
.
.It Fl w Ar pass | Cm pass No = Ar pass
Log in with the server password
.Ar pass .
.
.It Fl x
Prompt for a password
and output a hash
for use with
.Fl W .
.
.It Fl y Ar mesg | Cm away No = Ar mesg
Set away status to
.Ar mesg
when no clients are connected.
.El
.
.Pp
Client connections are not accepted
until successful login to the server.
If the server connection is lost,
the
.Nm
daemon exits.
.
.Pp
Upon receiving the
.Dv SIGUSR1
signal,
the certificate, private key and local CA
will be reloaded from the paths
specified by
.Fl C ,
.Fl K
and
.Fl A .
.
.Ss Client Configuration
Clients should be configured to
connect to the host and port set by
.Fl H
and
.Fl P ,
with TLS or SSL enabled.
If
.Fl W
is used,
clients must send a server password.
If
.Fl A
is used,
clients must connect with a client certificate
and may request SASL EXTERNAL.
If both are used,
clients may authenticate with either method.
.
.Pp
Clients must register with unique usernames,
for example the name of the client software
or location from which it is connecting.
New clients with the same username
are assumed to be reconnections
and will cause previous connections
to stop receiving messages.
The nickname and real name
sent by clients are ignored.
.
.Pp
Clients which request the
.Sy causal.agency/passive
capability
or with usernames beginning with hyphen
.Ql -
are considered passive
and do not affect automatic away status.
.
.Pp
Pass-through of the following IRCv3 capabilities
is supported:
.Sy account-notify ,
.Sy account-tag ,
.Sy away-notify ,
.Sy batch ,
.Sy cap-notify ,
.Sy chghost ,
.Sy echo-message ,
.Sy extended-join ,
.Sy invite-notify ,
.Sy labeled-response ,
.Sy message-tags ,
.Sy multi-prefix ,
.Sy server-time ,
.Sy setname ,
.Sy userhost-in-names .
.
.Pp
Private messages and notices
sent to the user's own nickname
are relayed only to other clients,
not to the server.
.
.Ss Generating Client Certificates
.Bl -enum
.It
Generate self-signed client certificates and private keys:
.Bd -literal -offset indent
pounce -g client1.pem
pounce -g client2.pem
.Ed
.It
Concatenate the certificate public keys into a CA file:
.Bd -literal -offset indent
openssl x509 -subject -in client1.pem >> ~/.config/pounce/auth.pem
openssl x509 -subject -in client2.pem >> ~/.config/pounce/auth.pem
.Ed
.It
Configure
.Nm
to verify client certificates
against the CA file:
.Bd -literal -offset indent
local-ca = auth.pem
# or: pounce -A auth.pem
.Ed
.El
.
.Pp
Alternatively,
client certificates can be signed
by a generated certificate authority:
.
.Bl -enum
.It
Generate a self-signed certificate authority:
.Bd -literal -offset indent
pounce -g auth.pem
.Ed
.It
Generate and sign client certificates
using the CA:
.Bd -literal -offset indent
pounce -A auth.pem -g client1.pem
pounce -A auth.pem -g client2.pem
.Ed
.It
Since only the public key is needed
for certificate verification,
extract it from the CA:
.Bd -literal -offset indent
openssl x509 -in auth.pem -out ~/.config/pounce/auth.crt
.Ed
.It
Configure
.Nm
to verify client certificates
against the CA:
.Bd -literal -offset indent
local-ca = auth.crt
# or: pounce -A auth.crt
.Ed
.El
.
.Ss Configuring CertFP
.Bl -enum
.It
Generate a new TLS client certificate:
.Bd -literal -offset indent
pounce -g ~/.config/pounce/example.pem
.Ed
.It
Connect to the server using the certificate:
.Bd -literal -offset indent
client-cert = example.pem
# or: pounce -c example.pem
.Ed
.It
Identify with services or use
.Cm sasl-plain ,
then add the certificate fingerprint to your account:
.Bd -literal -offset indent
/msg NickServ CERT ADD
.Ed
.It
Enable SASL EXTERNAL
to require successful authentication when connecting:
.Bd -literal -offset indent
client-cert = example.pem
sasl-external
# or: pounce -e -c example.pem
.Ed
.El
.
.Ss Connecting to Servers with Self-signed Certificates
.Bl -enum
.It
Connect to the server
and write its certificate to a file:
.Bd -literal -offset indent
pounce -o -h irc.example.org > ~/.config/pounce/example.pem
.Ed
.It
Configure
.Nm
to trust the certificate:
.Bd -literal -offset indent
trust = example.pem
# or: pounce -t example.pem
.Ed
.El
.
.Sh ENVIRONMENT
.Bl -tag -width Ds
.It Ev USER
The default nickname.
.El
.
.Sh FILES
.Bl -tag -width Ds
.It Pa $XDG_CONFIG_DIRS/pounce
Configuration files, certificates and private keys
are searched for first in
.Ev $XDG_CONFIG_HOME ,
usually
.Pa ~/.config ,
followed by the colon-separated list of paths
.Ev $XDG_CONFIG_DIRS ,
usually
.Pa /etc/xdg .
.It Pa ~/.config/pounce
The most likely location of configuration files.
.
.It Pa $XDG_DATA_DIRS/pounce
Save files are searched for first in
.Ev $XDG_DATA_HOME ,
usually
.Pa ~/.local/share ,
followed by the colon-separated list of paths
.Ev $XDG_DATA_DIRS ,
usually
.Pa /usr/local/share:/usr/share .
New save files are created in
.Ev $XDG_DATA_HOME .
.It Pa ~/.local/share/pounce
The most likely location of save files.
.El
.
.Sh EXAMPLES
Obtain a certificate
and make its private key available to
.Nm :
.Bd -literal -offset indent
sudo certbot certonly -d irc.example.org
sudo chown :$USER /etc/letsencrypt/live/irc.example.org/privkey.pem
sudo chmod g+r /etc/letsencrypt/live/irc.example.org/privkey.pem
.Ed
.
.Pp
Start
.Nm :
.Bd -literal -offset indent
pounce -H irc.example.org -h irc.tilde.chat -j '#ascii.town'
.Ed
.
.Pp
Equivalent configuration file:
.Bd -literal -offset indent
local-host = irc.example.org
host = irc.tilde.chat
join = #ascii.town
.Ed
.
.Sh SEE ALSO
.Xr calico 1
.
.Sh STANDARDS
.Bl -item
.It
.Rs
.%A Waldo Bastian
.%A Ryan Lortie
.%A Lennart Poettering
.%T XDG Base Directory Specification
.%U https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
.%D November 24, 2010
.Re
.It
.Rs
.%A Kyle Fuller
.%A St\('ephan Kochen
.%A Alexey Sokolov
.%A James Wheare
.%T server-time Extension
.%I IRCv3 Working Group
.%U https://ircv3.net/specs/extensions/server-time
.Re
.It
.Rs
.%A Lee Hardy
.%A Perry Lorier
.%A Kevin L. Mitchell
.%A Attila Molnar
.%A Daniel Oakley
.%A William Pitcock
.%A James Wheare
.%T IRCv3 Client Capability Negotiation
.%I IRCv3 Working Group
.%U https://ircv3.net/specs/core/capability-negotiation
.Re
.It
.Rs
.%A S. Josefsson
.%T The Base16, Base32, and Base64 Data Encodings
.%I IETF
.%R RFC 4648
.%U https://tools.ietf.org/html/rfc4648
.%D October 2006
.Re
.It
.Rs
.%A C. Kalt
.%T Internet Relay Chat: Client Protocol
.%I IETF
.%R RFC 2812
.%U https://tools.ietf.org/html/rfc2812
.%D April 2000
.Re
.It
.Rs
.%A Attila Molnar
.%A James Wheare
.%T IRCv3 Strict Transport Security
.%I IRCv3 Working Group
.%U https://ircv3.net/specs/extensions/sts
.Re
.It
.Rs
.%A Attila Molnar
.%A William Pitcock
.%T IRCv3.2 SASL Authentication
.%I IRCv3 Working Group
.%U https://ircv3.net/specs/extensions/sasl-3.2
.Re
.It
.Rs
.%A K. Zeilenga, Ed.
.%T The PLAIN Simple Authentication and Security Layer (SASL) Mechanism
.%I IETF
.%R RFC 4616
.%U https://tools.ietf.org/html/rfc4616
.%D August 2006
.Re
.El
.
.Ss Extensions
The
.Sy causal.agency/consumer
vendor-specific IRCv3 capability
enables the
.Sy causal.agency/pos
message tag.
The value of this tag
is a 64-bit unsigned integer
indicating the consumer position of the client
after receiving each message,
e.g.\&
.Ql @causal.agency/pos=42069 .
This capability may be requested
with the value of the last
.Sy causal.agency/pos
tag received by the client,
e.g.\&
.Ql CAP REQ causal.agency/consumer=42069 ,
setting its consumer position.
By persisting this value across connections,
a client can ensure no messages are missed,
even in case of network issues or application crashes.
.
.Pp
.%T IRCv3 Client Capability Negotiation
specifies that capabilities MAY have values in
.Ql CAP LS
or
.Ql CAP NEW
responses.
It does not, however,
indicate if
.Ql CAP REQ
capabilities MUST NOT have values.
The
.Nm
daemon parses
.Ql CAP REQ
values in the same way as
.Ql CAP LS
values.
.
.Pp
The
.Sy causal.agency/passive
vendor-specific IRCv3 capability
indicates that a client
should not affect the automatic away status.
.
.Sh AUTHORS
.An June Bug Aq Mt june@causal.agency
.
.Sh CAVEATS
One instance of
.Nm
is required for each server connection.
The
.Nm
daemon must be restarted
if the server connection is lost.
.
.Pp
The
.Nm
daemon makes no distinction between channels.
Elevated activity in one channel
may push messages from a quieter channel
out of the buffer.
.
.Sh BUGS
Send mail to
.Aq Mt list+pounce@causal.agency
or join
.Li #ascii.town
on
.Li irc.tilde.chat .
.
.Pp
A client will sometimes receive its own message,
causing it to be displayed twice.
This happens when a message is sent
while responses are not yet consumed.