UnrealIRCd 5.0.2 released (fixes desync issue)

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

(You can unsubscribe from this list here
<https://sourceforge.net/projects/unreal/lists/unreal-notify/unsubscribe>)

Hi everyone,

UnrealIRCd 5.0.2 is out. It fixes a desync issue with halfops. When two
servers link, users with halfops will not appear on the other side of
the link, creating a so called "ghost user". This bug is present in both
5.0.0 and 5.0.1.
We recommend users running these versions to apply the "hot patch" to
_fix the issue without a restart_ (see below) or to upgrade to 5.0.2.
To apply the hot patch, run the following command on your IRCd shell:
wget https://www.unrealircd.org/patches/halfop-patcher && sh
./halfop-patcher

Below is a short FAQ / Q&A on the hot patch. Further down is the
original UnrealIRCd 5 announcement.

The complete UnrealIRCd 5.0.2 release notes can be found here
<https://github.com/unrealircd/unrealircd/blob/21278d254963cfa6555e27b38228d7a5c3b8ce48/doc/RELEASE-NOTES.md#unrealircd-502-release-notes>.
The 5.0.2 release contains several /other/ fixes and enhancements, such
as extended server bans
<https://www.unrealircd.org/docs/Extended_server_bans>.

*Q&A on the hot patch*

*How serious is the halfop desync issue? Can it be abused?
*This bug creates a "ghost user". These are users that exist in the
channel on server A but are not seen as in the channel by other users on
server B. First of all this creates a confusing situation where the nick
list is different on server A compared to server B. It can also have
more serious consequences if it is done on purpose. The ghost user /may/
see channel messages without other channel members being aware of it.
This highly depends on the channel settings and the linking topology.
There are also mitigating factors:

  * On a single-server unrealircd network this problem does not exist
  * On a multi-server network, usually at least a few other users are on
    the other side of the link. Those users will see that an additional
    person is present on that side.
  * A server (re)connect is needed to trigger the issue. So a netsplit
    or server restart. As long as your servers stay connected to each
    other, users cannot trigger the issue.

*Which UnrealIRCd versions are affected?
*UnrealIRCd 5.0.0 and 5.0.1. The UnrealIRCd 4.x series are not affected.

*What is hot patching?
*It is possible to fix this issue without having to restart your IRCd.
This is generally welcomed by admins. UnrealIRCd can do this because
most of the code is in modules that can be reloaded on the fly.

*I am on Windows, can I also use the hot patch?*
No, sorry, on Windows you will have to upgrade to UnrealIRCd 5.0.2.

*How do I apply the patch?
*Simply SSH to your IRCd shell and then run:
wget https://www.unrealircd.org/patches/halfop-patcher && sh
./halfop-patcher

*I don't trust the shell script, can I view the exact patch?
*Yes, you can also download the recommended patch as a .tar.gz instead.
It is available from
https://www.unrealircd.org/patches/halfop-patcher.tar.gz

*UnrealIRCd 5 is here!*

After more than 6 months of hard work UnrealIRCd 5 is now our new
"stable" branch. In particular I would like to thank Gottem and 'i' for
their source code contributions and PeGaSuS and westor for testing releases.
When we transitioned from 3.2.x to 4.0.0 there were 175,000 lines of
source code added/removed during 3 years of development. This time it
was 120,000 lines in only 8 months, a major effort!

A short summary of release highlights is available here
<https://www.unrealircd.org/docs/What%27s_new_in_UnrealIRCd_5>. The full
release notes are available here
<https://github.com/unrealircd/unrealircd/blob/21278d254963cfa6555e27b38228d7a5c3b8ce48/doc/RELEASE-NOTES.md#unrealircd-5>.
If you have some spare time, we recommended reading the full release
notes (the new and changed sections, anyway) so you don't miss out on
anything.

If you are upgrading from 4.x to 5.x then it would be wise to read
Upgrading from 4.x <https://www.unrealircd.org/docs/Upgrading_from_4.x>.
In any case, be sure to upgrade your services package first! (if you use
any). UnrealIRCd 5 is known to work with the following services:

  * anope <https://www.anope.org/> (version 2.0.7 or higher) - with the
    "unreal4" protocol module
  * atheme <https://atheme.github.io/atheme.html> (version 7.2.9 or
    higher) - with the "unreal4" protocol module

As always, you can download UnrealIRCd from https://www.unrealircd.org/

*UnrealIRCd 4 is still supported*

UnrealIRCd 4 is now called "oldstable" and will be maintained until 31
December 2020 (major bugfixes only). After that date UnrealIRCd 4 is no
longer supported <https://www.unrealircd.org/docs/UnrealIRCd_4_EOL>.
Admins are recommended to upgrade to UnrealIRCd 5 somewhere in the first
half of 2020.

-- 
Bram Matthys
Security researcher                     sy...@vu...
Website:                                  www.vulnscan.org
PGP key:                       www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6