--- /dev/null
+WHO documentation, updated on 02 Jan 1999.
+
+Since ircu2.10.02 the WHO command had been changed from what described in
+RFC1459, while still keeping backward compatibility, actually it has been
+changed again in u2.10.05 so that since this release the format of the who
+query is now:
+
+[:source] WHO <mask1> [<options> [<mask2>]]
+
+<mask2> is optional, if mask2 is present it's used for matching and mask1 is
+ignored, otherwise mask1 is used for matching, since mask2 is the last
+parameter it *can* contain a space and this can help when trying to match a
+"realname".
+
+When matching IP numbers the <mask> can be in 3 forms:
+
+- The old and well known IRC masks using * and ? as wanted
+- The IPmask form a.b.c.d/e.f.g.h as used in most firewalls and
+ system configurations, where what is before the / are the bits we expect
+ in the IP number and what is after the / is the "filter mask" telling wich
+ bits whould be considered and wich should be ignored.
+- The IPmask form a.b.c.d/bitcount where bitcount is an integer between 0
+ and 31 (inclusive), the matching will be for the IPs whose first
+ "bitcount" bits are equal to those in a.b.c.d
+
+Note that:
+. The bitcount must be between 0 and 31, 32 is NOT good (and
+ makes no sense to use it... just match against the static IP a.b.c.d)
+. The missing pieces of both the bitmask and the ipnumber in the forms
+ ipnumber/bitmask and ipnumber/bitcount default to zero from right to left,
+ this is NOT what inet_aton and most tools do but makes more sense here
+ IMO, in example /who 194.243/16 is taken as /who 194.243.0.0/255.255.0.0
+ (inet_aton whould take 194.243 as 194.0.0.243).
+. For the above reason and specified validity limits 1.2.3.4/31 becomes
+ 1.2.3.4/255.255.255.254 while 1.2.3.4/32 becomes 1.2.3.4/32.0.0.0 :)
+
+For all the other fields th match happens as has always been, i.e. it's only
+considered the IRC mask with * and ? (that is: don't expect to catch an user
+with "realname" = "1.2.3.4" when doing "/who 1.2/16 h" :)
+
+For both the masks and the options (and thus for all flags) case is NOT
+significative (so "/who <any> o" is exactly the same as "/who <ANY> O".
+
+The "options" part can be as follows:
+
+ [<flags>][%[<fields>[,<querytype>]]]
+
+in which:
+
+ <flags>: can be a sequence of field matching flags, use mode matching flags
+ and special purpose flags
+
+ Field matching flags, when one of these is specified the field in
+ question is matched against the mask, otherwise it's not matched.
+
+ n Nick (in nick!user@host)
+ u Username (in nick!user@host)
+ h Hostname (in nick!user@host)
+ i Numeric IP (the unresolved host)
+ s Servername (the canonic name of the server the guy is on)
+ r Info text (formerly "Realname")
+ a Account name
+
+ If no field-matching flags are specified they default to what old servers
+ used to do: nuhsr (= everything except the numeric IP)
+
+ User mode matching flags (specifying one of these means that only clients
+ with that umode are considered, what is not specified is always matched):
+
+ d Join-delayed channel members
+ o Irc operator
+ [In the future more flags will be supported, basically all
+ usermodes plus the +/- specificators to revert the filtering]
+
+ Special purpose flags:
+
+ x If this is specified the extended visibility of information for opers
+ is applied, what this means depends on the fact that you are local or
+ global operator and on how the admin configured the server (global
+ and eventually local irc opers might be allowed with this flag to see
+ +i local users, to see all +i users, to see users into +p and/or +s
+ channels, and so on). Using the 'x' flag while not being an irc
+ operator is meaningless (it will be ignored), using it while oper'd
+ means that the query is almost certainly logged and the admin might
+ (rightfully) ask you an explanation on why you did.
+
+ The rest, what follows the %, that is [%[fields[,<querytype>]]], is as it
+ has always been since the first who.patch, the <fields> part specifies
+ wich fields to include in the output as:
+
+ c : Include (first) channel name
+ d : Include "distance" in hops (hopcount)
+ f : Include flags (all of them)
+ h : Include hostname
+ i : Include IP
+ l : Include idle time (0 for remote users) [2.10.11+]
+ n : Include nick
+ r : Include real name
+ s : Include server name
+ t : Include the querytype in the reply
+ u : Include userID with eventual ~
+ a : Include account name
+ o : Include oplevel (shows 999 to users without ops in the channel)
+
+And the ,<querytype> final option can be used to specify what you want the
+server to say in the querytype field of the output, useful to filter the
+output in scripts that do a kind of "on 354 ..."
+
+If no %fields are specified the reply is _exactly_ the same as has always
+been, numeric 352, same fields, same order.
+
+If one or more %fields are specified the reply uses a new numeric, since an
+out-of-standard 352 crashes EPIC and confuses several other clients. I used
+354.
+
+:"source" 354 "target" ["querytype"] ["channel"] ["user"]
+ ["IP"] ["host"] ["server"] ["nick"]
+ ["flags"] ["hops"] ["idle"] ["account"]
+ [:"realname"]
+
+Where only the fields specified in the %fields options are present.
+
+"querytype" is the same value passed in the /who command, it is provided to
+simplify scripting, in example one could pass a certain value in the query
+and have that value "signal" back what is to be done with those replies.
+
+The number of lines in the reply is still limited to avoid self-flooding and
+sooner or later another limitation will be added: you will be forced to do
+no more than one /who query every 'n' seconds where 'n' depends on the
+number of fields you actually match (the field-match flags specified before
+% in the option, defaulting to 6 if you don't specify an option at all),
+infact matching against many fields as the default query does severely
+affects the CPU usage of the server and is *much* better to specify with the
+field-matching flags what you are looking for, in example when you are
+looking for all french users a "/who *.fr h" is A LOT better than just "/who
+*.fr" (and actually you want users that have the
+_hostname_ matching *.fr, you wouldn't want to match a japanese user
+that has the realname "ku fung-kay aj.fr" in example...)
+
+Note that:
+
+- An user doing a "/who whatever" or a "/who whatever o"
+ will not see any change (except for the anti-flood limit and sooner or
+ later the CPU usage limit)
+
+- An user doing a "/who #wasteland %n" will get just a list of nicks (lame,
+ very lame way of doing it :-)
+
+- An user doing a "/who 0 o%nuhs" will get a list of the opers with Nick,
+ userID, server and hostname like:
+
+:Amst* 354 Nemesi #wasteland nbakker pc73.a.sn.no Oslo*.org Niels
+
+- An user doing a "/who 0 o%tnuhs,166" will get a list of the opers
+ with Nick, userID, server and hostname like the above but with a
+ request type field of 166 like:
+
+ :Amst* 354 Nemesi 166 #wasteland nbakker pc73.a.sn.no
+ Oslo-R.NO.EU.Undernet.org Niels
+
+ So that he can have in example a script that does
+ on ^354 "% 166" display "There is an oper ..."
+
+- The client will have to sort/format the fields by itself,
+ the _order_ in which flags are passed is not significant, the fields in the
+ reply will always have the same order.
+
+- The maximum number of _lines_ reported as reply for a query
+ is 2048/(n+4) where 'n' is the number of flags "enabled" that is the
+ number of fields included in each reply.
+
+ Actually: 1 field returned = maximum 409 replies
+ 2 fields returned = maximum 341 replies
+ 3 fields returned = maximum 292 replies
+ 4 fields returned = maximum 256 replies
+ 5 fields returned = maximum 227 replies
+ 6 fields returned = maximum 204 replies
+ 7 fields returned = maximum 186 replies (default query)
+ 8 fields returned = maximum 170 replies
+ 9 fields returned = maximum 157 replies
+ 10 fields returned = maximum 146 replies
+
+ If the limit is reached before completing the query the reply is truncated
+ and a new numeric error is issued after the "End of WHO", anyway the "end
+ of" numeric is _always_ sent (otherwise some scripts and clients go
+ crazy).
+
+The actual "mask" to match can have one of the two following forms:
+
+- A comma-separated list of elements: in this case each element
+ is treated as a flat channel or nick name and is not matched to the other
+ elements. Nicks do count in the limit of output lines (they should not be
+ that many anyway), channels count if who asks the query is not on the
+ channel. (That is: a /who #channel gives unlimited output if you are in
+ there).
+
+- A _single_ mask: in this case (no commas, only one element) the mask is
+ first checked to be a full channel or nickname, then it is matched against
+ all relevant fiels as already known. These happens in different steps
+ with replicates-removal so that if one has (?) something like "#wasteland"
+ as "real name" or is on a channel named "#***MyChan***" it all works
+ nicely.
+
+Miscellaneous bug fixes / "undocumented feature" changes:
+
+- /who NickName did not show the user with nick = NickName when it was
+ invisible, even if the nick was given completely (without wildchars) now
+ it does, since one could always see him as /whois NickName. It does not
+ report him twice if he also has in example the userID == NickName and is
+ -i.
+
+- ":source WHO :The Black Hacker" did not report an user having "The Black
+ Hacker" as real name, now it does. Since this can only be done without the
+ flags/format specificator because that would become the "last parameter"
+ an escape has been provided: if you pass to m_who _3_ parameters the first
+ one will be ignored and the last one used for matching, like in example
+ ":source WHO foo %nuh :*Black Hacker*" where "foo" will not be used and
+ the match will happen on "*Black Hacker*". (It was passed through
+ clean_channelname() that prevented the mask from containing spaces and
+ such...)
+
+- When one user was umode -i he was shown or not depending on the
+ fact he was on a +p or +s channel... since we are doing a lookup on the
+ _user_ this makes no sense to me, example:
+ Neme1 : umode -i, on no channels, was SEEN with a /who 0
+ Neme2 : umode -i, on channel #p with chmode +p, was NOT SEEN by /who 0
+ Neme3 : umode -i, on channel #s with chmode +s, was NOT SEEN by /who 0
+
+ Now all users "-i" are matched with a "/who mask", the +i users instead
+ must be on a _common_ channel to be seen.
+
+ Basically being on "one" +s|p channel "forced" a +i status while one might
+ want to be on #secret (mode +s) and have nobody know that he is in there
+ but on the other side stay -i so others can find him. Of course a +s|p
+ channel is never shown in the reply unless who asks the query is in there,
+ if no "visible" channels are available for a -i user he is shown on
+ "channel *".
+
+- When one user is +i is shown _only_ if there is a common channel,
+ the first common channel found is shown in the reply.
+
+- As requested by many persons an escape has been provided for opers,
+ when #defined SHOW_ALL_CHANNELS opers can /who #channel from outside
+ and see users in there even if the channel is +s|+p
+ Each admin decides locally if this feature is enabled to his opers.
+
+- As requested by many admins an escape from the query-size limit
+ has been provided for opers, by #defining UNLIMIT_OPER_QUERY opers
+ can do unlimited sized /who-s (until they get disconnected by max
+ SendQ exceeded ;)
+ Again admins will decide if enable or not this feature.
+
+- A /who a,c,b,d,e,f used to return as many ** END OF WHO as there
+ were elements in the list, since now the command is supposed to be
+ _efficient_ for /who nick1,nick2,nick3 .. I return a _single_ end
+ of query message.
+
+- /who did not work for a channel named in example #**StarWars**
+ now it does handle it properly (the mask was passed through
+ collapse() and then.. did not find that channel, fixed).
+
+- "/who #John" did not report an user having '#John' as "Real name",
+ now it does (and does NOT report him twice if he is ALSO on a
+ channel named #John, strange but true: this can happen).
+
+- "/who a,b,c,d" where a b c and d are channelnames/nicks now uses an hash
+ lookup and therefore is extremely efficient, if _only_ one field is
+ specified it is looked in all the fields; who really wants _only_ users on
+ a specific channel or a single nick (without looking for a match in the
+ other fields) can force the server to consider the parameter as a list
+ adding a comma somewhere, like:
+
+ "/who #Italia," or "/who ,Nemesi"
+
+ Or even better to avoid misbehaviour with other servers:
+ "/who #Italia %... #Italia," or "/who Nemesi %... Nemesi,"
+
+ This will make old servers act properly and new ones and should be the
+ recomended way for GUI based clients to get a channel's userlist and all
+ the infos they want about users on the channel.
+
+- If you use the new numeric, flags will contain all the information about
+ a user on a channel. @ for op'd, + for voiced, and ! for zombie. eg:
+ Isomer #coder-com H@+, where the old behavor of just displaying one of
+ them has been preserved for the old numeric. [2.10.11+]
+
+Regards, Andrea aka Nemesi
+