UnrealIRCd 4.2.4 released (also fixes crash issue)

[Bram M. <sy...@un...>]

(You can unsubscribe from this list here
<https://sourceforge.net/projects/unreal/lists/unreal-notify/unsubscribe>)

Hi everyone,

UnrealIRCd 4.2.4 (stable) is now available for download.

This release fixes a crash issue if UnrealIRCd is configured to use utf8
or chinese character sets in set::allowed-nickchars
<https://www.unrealircd.org/docs/Nick_Character_Sets>. This is not the
default.
We don't expect many users to run their IRCd with this enabled, as the
utf8 support was tagged as experimental and the chinese/gbk
implementation is incomplete.

In addition to the bug fix from above, this release also contains a
number of other fixes and enhancements. In particular the reputation and
connthrottle modules <https://www.unrealircd.org/docs/Connthrottle> are
now working better and there were some major Windows fixes.

*Changes between version 4.2.3 and 4.2.4
*Improvements

  * Improve server linking error messages.
  * Enhance WHOX to WHO auto-conversion for "WHO +s serv.er.name"

*Major issues fixed*

  * A crash issue if using utf8 or chinese in set::allowed-nickchars
    (not the default).
  * The Windows version only accepted very few clients.
  * The Windows version should warn and not error if using old-style regex.
  * The Windows version did not save the reputation database.

*Minor issues fixed
*

  * The 'connthrottle' module incorrectly allowed 0 unknown users in
    when it was throttling, rather than the set rate.
  * The 'reputation' module did not show scores for remote users in
    /WHOIS, only after 5 minutes had passed.
  * Some users may have experienced a "Registration Timeout" error when
    connecting. This happened because their ident server accepted the
    TCP/IP connection but after that failed to respond to the ident request.
    We have now lowered set::ident::read-timeout to 15 seconds to fix this.
  * If successfully logged in using SASL then avoid an "You are already
    logged in" error message that could happen due to PASS forwarding.

*For module coders
*

  * If you are debugging or developing modules then we encourage you to
    use AddressSanitizer.
    This does come at a 5-10x performance slowdown and can consume a lot
    more memory, but it is very useful in tracing common C mistakes such
    as out of bounds read/writes, double frees, and so on. You will see
    exactly where a mistake was made. To use this, in the last ./Config
    question you answer: --enable-asan

*IRC protocol*

  * No changes in this release.

*Future versions (heads up):*

  * We intend to change the default plaintext oper policy from /warn/ to
    /deny/ in the summer of 2019. This will deny /OPER when issued from
    a non-SSL connection.
    For security, IRC Operators should really use SSL/TLS when
    connecting to an IRC server!

*Older release notes*

  * If you are not running previous release, then you may be interested
    in reading the release notes of older 4.2.x versions, these are
    available here
    <https://github.com/unrealircd/unrealircd/blob/unreal42/doc/RELEASE-NOTES.old>.

*Download*
As always, you can download UnrealIRCd from https://www.unrealircd.org/
All releases are signed with our PGP key (key id 0xA7A21B0A108FF4A9)

*Bug reports and feature enhancements
*Please report all bugs and feature suggestions at
https://bugs.unrealircd.org/
Our GitHub repository is available on
https://github.com/unrealircd/unrealircd/

-- 
Bram Matthys
Security researcher                     sy...@vu...
Website:                                  www.vulnscan.org
PGP key:                       www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6