UnrealIRCd 6.1.1.1 released

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

Hi everyone,

Just a small note: i just released 6.1.1.1 to fix a small bug in 6.1.1 
that is rather specific and probably only affects 1-2% of users, but still:
If a WEBIRC gateway was on IPv6 and was introducing/spoofing an IPv4 
user then the maxperip handling would be incorrect and would also cause 
a small memory leak. The same is the case for if the WEBIRC gateway was 
on IPv4 and it was introducing/spoofing an IPv6 user. I decided to 
release a 6.1.1.1 immediately so new installations from this point won't 
be affected by this bug. Of the 100 people who downloaded 6.1.1 already 
only 1 complained. The bug is very visible with a 
BUG_DECREASE_IPUSERS_BUCKET IRCOp notice when affected user(s) quit so 
it is hard to miss. My advice: if you already installed 6.1.1 then only 
upgrade from 6.1.1 to 6.1.1.1 if this issue really affects you. 
Otherwise, don't bother.

The original 6.1.1 announcement is below:

I'm happy to announce the release of UnrealIRCd 6.1.1 stable. This 
release comes with various bug fixes and performance improvements, 
especially for channels with thousands of users.

It also has more options to override settings per security group, for 
example if you want to give trusted users or bots more rights or higher 
flood rates than regular users. All these options are now in a single 
Special users <https://www.unrealircd.org/docs/Special_users> article on 
the wiki.

Other notable features are showing better connection errors to SSL/TLS 
users and a new proxy { } block for websocket reverse proxies.

See the full release notes below. As usual on *NIX you can upgrade 
easily with the command: ./unrealircd upgrade

Reminder: UnrealIRCd 5 is no longer supported 
<https://www.unrealircd.org/docs/UnrealIRCd_5_EOL> after July 1, 2023. 
Admins should upgrade to UnrealIRCd 6.

      Enhancements:

Enhancements:

  * Two new features that are conditionally on:
      o SSL/TLS users will now correctly receive the error message if
        they are rejected due to throttling (connect-flood) and some
        other situations.
      o DNS lookups are done before throttling. This allows exempting a
        hostname from both maxperip and connect-flood restrictions.
        A good example for IRCCloud would be:

        |except ban { mask *.irccloud.com; type { maxperip;
        connect-flood; } }|

      o Both features are temporarily disabled whenever a high rate of
        connection attempts
        <https://www.unrealircd.org/docs/FAQ#hi-conn-rate> is detected,
        to save CPU and other resources during such an attack. The
        default rate is 1000 per second, so this would be unusual to
        trigger accidentally.
  * It is now possible to override some set settings
    <https://www.unrealircd.org/docs/Set_block#Set_block_for_a_security_group>
    per-security group by having a set block with a name, like set
    unknown-users { }
      o You could use this to set more limitations for unknown-users:

        |set unknown-users { max-channels-per-user 5; static-quit
        "Quit"; static-part yes; } |

      o Or to set higher values (higher than the normal set block) for
        trusted users:

        |security-group trusted-bots { account { BotOne; BotTwo; } } set
        trusted-bots { max-channels-per-user 25; }|

      o Currently the following settings can be used in a set xxx { }
        block: set::auto-join, set::modes-on-connect,
        set::restrict-usermodes, set::max-channels-per-user,
        set::static-quit, set::static-part.
      o See also Special users
        <https://www.unrealircd.org/docs/Special_users> in the
        documentation for applying settings to a security groups.
  * New |proxy { }| block <https://www.unrealircd.org/docs/Proxy_block>
    that can be used for spoofing IP addresses when:
      o Reverse proxying websocket connections (eg. via NGINX, a load
        balancer or other reverse proxy)
      o WEBIRC/CGI:IRC gateways. This will replace the old |webirc { }|
        block in the future, though the old one will still work for now.
  * New setting set::handshake-boot-delay
    <https://www.unrealircd.org/docs/Set_block#set%3A%3Ahandshake-boot-delay>
    which allows server linking autoconnects to kick in (and incoming
    servers on serversonly ports), before allowing clients in. This
    potentially avoids part of the mess when initially linking on-boot.
    This option is not turned on by default, you have to set it explicitly.
      o This is not a useful feature on hubs, as they don't have clients.
      o It can be useful on client servers, if you |autoconnect| to your
        hub.
      o If you connect services to a server with clients this can be
        useful as well, especially in single-server setups. You would
        have to set a low |retrywait| in your anope conf (or similar
        services package) of like |5s| instead of the default |60s|.
        Then after an IRCd restart, your services link in before your
        clients and your IRC users have SASL available straight from the
        start.
  * JSON-RPC:
      o New call |log.list|
        <https://www.unrealircd.org/docs/JSON-RPC:Log#log.list> to fetch
        past 1000 log entries. This functionality is only loaded if you
        include |rpc.modules.default.conf|, so not wasting any memory on
        servers that are not used for JSON-RPC.

      Changes:

  * set::topic-setter
    <https://www.unrealircd.org/docs/Set_block#set::topic-setter> and
    set::ban-setter
    <https://www.unrealircd.org/docs/Set_block#set::ban-setter> are now
    by default set to |nick-user-host| instead of |nick|, so you can see
    the full nick!user@host of who set the topic/ban/exempt/invex.
  * You can no longer (accidentally) load an old |modules.default.conf|.
    People must always use the shipped version of this file as the file
    VERY clearly says in the beginning (see also that file for
    instructions on how to deal with customizations). People run into
    lots of (strange) problems, not only missing nice new functionality,
    but also Services not working because the svslogin module is not
    loaded, etc.
    Usually mistakes with an old modules.default.conf are not
    deliberate, like a cp *.conf of an old installation, so this error
    should be helpful for those users (who otherwise tend to bang their
    head for hours).
  * Some small DNS performance improvements:
      o We now 'negatively cache' unresolved hosts for 60 seconds.
      o The maximum number of cached records (positive and negative) was
        raised to 4096.
      o We no longer use "search domains" to avoid silly lookups for
        like |4.3.2.1.dnsbl.dronebl.org.mydomain.org|.
  * Data buffer chunks bumped from 512 bytes to ~4K. This results in
    less write calls (lower CPU usage) and more data per TCP/IP packet.
  * We now cache sending of lines in |sendto_channel| via a new
    "LineCache" system. It saves CPU on (very) large channels.
  * Several other performance improvements such as checking maxperip via
    a hash table and faster invisibility checks for delayjoin.
  * Blacklist hits are now logged globally. This means they show up in
    snomask |B|, are logged, and show up in the webpanel "Logs" view.
  * The event |REMOTE_CLIENT_JOIN| was mass-triggered when servers were
    syncing. They are now hidden, like |REMOTE_CLIENT_CONNECT|.
  * Update shipped libraries: c-ares to 1.19.1

      Fixes:

  * Crash on FreeBSD/NetBSD when using JSON-RPC, due to clashing
    rpc_call symbol in their libc library.
  * Crash when removing a |listen { }| block for websocket or rpc (or
    changin the port number)
  * When using the webpanel, if an IRC client tried to connect with the
    same IP as the webpanel server, it would often receive the error
    "Too many unknown connections". This only affected non-localhost
    connections.
  * The |require module| block
    <https://www.unrealircd.org/docs/Require_module_block> was only
    checked of one side of the link, thus partially not working.

      Removed:

  * set::maxbanlength
    <https://www.unrealircd.org/docs/Set_block#set::maxbanlength> has
    been removed as it was not deemed useful and only confusing to users
    and admins.

      Developers and protocol:

  * Server to server lines can now be 16384 bytes in size when |PROTOCTL
    BIGLINES| is set. This will allow us to do things more efficiently
    and possibly raise some other limits in the future. This 16k is the
    size of the complete line, including sender, message tags, content
    and \r\n. Also, in server-to-server traffic we now allow 30
    parameters (MAXPARA*2).
    The original input size limits for non-servers remain the same: the
    complete line can be 4k+512, with the non-mtag portion limit set at
    512 bytes (including \r\n), and MAXPARA is still 15 as well.
  * In command handlers, individual |parv[]| elements can be 510 bytes
    max, even if they add up like parv[1] and parv[2] both being 510
    bytes each. If you need more than that, then you need to set the
    flag |CMD_BIGLINES| in |CommandAdd()|, then an individual parameter
    can be near ~16k. This is so, because a lot of the code does not
    expect parameters bigger than 512 bytes (but can still handle the
    total of parameters being greater than 512). The new flag allows
    gradually opting in commands to allow bigger parameters, after such
    code has been checked and modified to handle it.

You can download UnrealIRCd from https://www.unrealircd.org/

-- 
Bram Matthys
Security and software eng...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6