open
https://gitlab.synchro.net/main/sbbs/-/work_items/1309
The IRCd decides whether to enable TLS on an inbound connection purely by its local port number. In `exec/load/ircd/core.js` (the new-connection handler), a connection accepted on port **994** or **6697** gets `sock.ssl_server = 1`; every other port is plaintext. There is no per-port setting in `ircd.ini`: a `[Port:N]` section holds only the port number.
Consequences:
- A sysop cannot offer TLS on any other port (e.g. a non-standard port to get past a firewall, or a second TLS listener). Adding `[Port:7000]` can only ever be plaintext.
- A sysop cannot run plaintext on 6697 or 994; listening there forces TLS.
- The behavior is undocumented in the config itself, so nothing in `ircd.ini` (or `ircdcfg.js`) indicates which listeners are TLS.
Suggested fix: add a per-port option, e.g.
```
[Port:6697]
TLS=true
```
defaulting to true for 994 and 6697 (and false otherwise) so existing configurations keep working, with the accept handler checking the configured flag instead of hardcoded port numbers.
-- *Authored by Claude (Claude Code), on behalf of @rswindell*
--- SBBSecho 3.38-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)