unreal-notify

UnrealIRCd 6.0.1 & 5.2.3 released

[Bram M. <sy...@vu...>]

Hi everyone,

Two new releases today: UnrealIRCd 6.0.1 and UnrealIRCd 5.2.3. Both of 
them fix a number of small issues.

*UnrealIRCd 5*

The UnrealIRCd 5 series will receive bug fixes until July 1, 2022 and 
security fixes until July 1, 2023.
To read what has changed between 5.2.2 and 5.2.3, see the release notes 
<https://github.com/unrealircd/unrealircd/blob/9ea7aebef2d43152ae202d4ac2f7271f93f2de12/doc/RELEASE-NOTES.md#unrealircd-523-release-notes>.

*UnrealIRCd 6*

If you are already running 6.0.0, then see the list of changes between 
6.0.0 and 6.0.1 in the release notes 
<https://github.com/unrealircd/unrealircd/blob/unreal60_dev/doc/RELEASE-NOTES.md#unrealircd-601>. 
If you are new to UnrealIRCd 6 then continue reading below:

UnrealIRCd 6 comes with a completely redone logging system (with 
optional JSON support), named extended bans, four new IRCv3 features, 
GeoIP support and remote includes support built-in.
Additionally, things are more customizable such as what gets sent to 
which snomask. All the +vhoaq channel modes are now modular as well, 
handy for admins who don't want or need halfops or +q/+a. For WHOIS it 
is now customizable in detail who gets to see what.

Many 3rd party modules have not been upgraded yet for use in UnrealIRCd 
6. If you use these, or if you are a bit cautious with upgrading in 
general, then just stay with UnrealIRCd 5 for now.

How to get started with UnrealIRCd 6:

  * For a /short summary/ of the new features, see: What's new in
    UnrealIRCd 6
    <https://www.unrealircd.org/docs/What's_new_in_UnrealIRCd_6>
  * For the /complete list/ of features/changes with all the details,
    see the release notes
    <https://github.com/unrealircd/unrealircd/blob/unreal60_dev/doc/RELEASE-NOTES.md#summary>.
  * Upgrading? Read Upgrading from 5.x to 6.x
    <https://www.unrealircd.org/docs/Upgrading_from_5.x>
  * As always, you can download UnrealIRCd from
    https://www.unrealircd.org/ <https://www.unrealircd.org/>.

-- 
Bram Matthys
Security and software eng...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 6.0.0 released

[Bram M. <sy...@un...>]

Hi everyone,

We are happy to announce UnrealIRCd 6.0.0! This is the first stable 
release of UnrealIRCd 6.

Many thanks to k4be for his help during development, other contributors 
for their feedback and patches, the people who tested the beta’s and 
release candidates, translators and everyone else who made this release 
happen!

UnrealIRCd 6 comes with a completely redone logging system (with 
optional JSON support), named extended bans, four new IRCv3 features, 
GeoIP support and remote includes support built-in.
Additionally, things are more customizable such as what gets sent to 
which snomask. All the +vhoaq channel modes are now modular as well, 
handy for admins who don't want or need halfops or +q/+a. For WHOIS it 
is now customizable in detail who gets to see what.

If you are a bit cautious or depend on 3rd party modules (many of which 
have been upgraded yet by their authors), then feel free to wait for a 
6.0.1 or 6.0.2 release. The previous stable version, UnrealIRCd 5, will 
receive bug fixes until July 1, 2022, followed by another 12 months of 
security fixes.

How to get started:

  * For a /short summary/ of the new features, see: What's new in
    UnrealIRCd 6
    <https://www.unrealircd.org/docs/What's_new_in_UnrealIRCd_6>
  * For the /complete list/ of features/changes with all the details,
    see the release notes
    <https://github.com/unrealircd/unrealircd/blob/893bf864f6c616e891d84916d27e342c252f31aa/doc/RELEASE-NOTES.md#unrealircd-600>.
  * Upgrading? Read Upgrading from 5.x to 6.x
    <https://www.unrealircd.org/docs/Upgrading_from_5.x>
  * As always, you can download UnrealIRCd from
    https://www.unrealircd.org/ <https://www.unrealircd.org/>.

-- 
Bram Matthys
Security and software eng...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 6.0.0-rc2 released

[Bram M. <sy...@un...>]

Hi everyone,

This is the second Release Candidate for UnrealIRCd 6. The plan is to 
have a stable 6.0.0 release the week before Christmas, so please help us 
test this (possibly last) Release Candidate to ensure it is good!
Fire up an U6 test server, link in an U6 server to your existing U5 
network, upgrade a server from U5 to U6 
<https://www.unrealircd.org/docs/Upgrading_from_5.x>. Test real-world 
scenarios and play around.
If you find any issues (big or small), then please report them at 
bugs.unrealircd.org <https://bugs.unrealircd.org/>. Similarly, if you 
are missing any documentation on U6 features, upgrading, or think some 
docs or instructions could be better, let us know as well.

The "Release Candidate" stage means that the code is expected to be of 
production quality. It should no longer crash or have major issues, but 
we need help from the public to verify that this is indeed the case.

*UnrealIRCd 6
*We have been working on UnrealIRCd 6 behind closed doors since July. A 
lot of work has been done during the summer vacation.
UnrealIRCd 6 comes with a completely redone logging system (with 
optional JSON support), named extended bans, four new IRCv3 features, 
geoip support and remote includes support built-in.
Additionally, things are more customizable such as what gets sent to 
which snomask. All the +vhoaq channel modes are now modular as well, 
handy for admins who don't want or need halfops or +q/+a. For WHOIS it 
is now customizable in detail who gets to see what.

How to get started:

  * See the release notes
    <https://github.com/unrealircd/unrealircd/blob/unreal60_dev/doc/RELEASE-NOTES.md#unrealircd-600-rc2>
    for detailed information on all the new features.
  * For a shorter list, see: What's new in UnrealIRCd 6
    <https://www.unrealircd.org/docs/What's_new_in_UnrealIRCd_6>
  * Upgrading? Read Upgrading from 5.x to 6.x
    <https://www.unrealircd.org/docs/Upgrading_from_5.x>
  * As always, you can download UnrealIRCd from
    https://www.unrealircd.org/ <https://www.unrealircd.org/>.

-- 
Bram Matthys
Security and software eng...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 6.0.0-rc1 released

[Bram M. <sy...@un...>]

Hi everyone,

I'm pleased to announce the first Release Candidate for UnrealIRCd 6. 
The "Release Candidate" stage means that the code is (soon) expected to 
be of production quality. It should no longer crash or have major 
issues, but we need help from the public to verify that this is indeed 
the case.

So: fire up a U6 test server, link in an U6 server to your existing U5 
network, upgrade a not-so-important server from U5 to U6, play around, 
and help us!
If you find any issues, please report them at 
https://bugs.unrealircd.org/ <https://bugs.unrealircd.org/>. This way, 
you help us getting ready for a real stable UnrealIRCd 6 release. 
Similarly, if you are missing any documentation on U6 features, 
upgrading, or think some docs or instructions could be better, let us 
know as well.

*UnrealIRCd 6
*We have been working on UnrealIRCd 6 behind closed doors since July. A 
lot of work has been done during the summer vacation.
UnrealIRCd 6 comes with a completely redone logging system (with 
optional JSON support), named extended bans, four new IRCv3 features, 
geoip support and remote includes support built-in.
Additionally, things are more customizable such as what gets sent to 
which snomask. All the +vhoaq channel modes are now modular as well, 
handy for admins who don't want or need halfops or +q/+a. For WHOIS it 
is now customizable in detail who gets to see what.

See the release notes 
<https://github.com/unrealircd/unrealircd/blob/unreal60_dev/doc/RELEASE-NOTES.md#unrealircd-600-rc1> 
of this release for detailed information on all the new features.
If you are upgrading from UnrealIRCd 5 to 6, then read Upgrading from 
5.x to 6.x <https://www.unrealircd.org/docs/Upgrading_from_5.x>.

As always, you can download UnrealIRCd from https://www.unrealircd.org/ 
<https://www.unrealircd.org/>.

-- 
Bram Matthys
Security and software eng...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 6.0.0-beta4 available for testing

[Bram M. <sy...@un...>]

*Fourth beta*
The fourth beta for UnrealIRCd 6 is now available for testing. It fixes 
a serious bug where regular users (without +hoaq) could set some channel 
modes. It also contains a few other fixes such as for memory leaks. See 
the release notes for full details.
This release contains all the planned features for U6 and we need the 
help of the public to test these beta releases. Caution: this beta may 
crash spectacularly, behave weird or in unexpected ways, so don't run it 
on production systems!
If you find any issues, please report them at 
https://bugs.unrealircd.org/ <https://bugs.unrealircd.org/>. This way, 
you help us getting ready for a real stable UnrealIRCd 6 release.

*UnrealIRCd 6
*We have been working on UnrealIRCd 6 behind closed doors since July. A 
lot of work has been done during the summer vacation.
UnrealIRCd 6 comes with a completely redone logging system (with 
optional JSON support), named extended bans, four new IRCv3 features, 
geoip support and remote includes support built-in.
Additionally, things are more customizable such as what gets sent to 
which snomask. All the +vhoaq channel modes are now modular as well, 
handy for admins who don't want or need halfops or +q/+a. For WHOIS it 
is now customizable in detail who gets to see what.

See the release notes 
<https://github.com/unrealircd/unrealircd/blob/unreal60_dev/doc/RELEASE-NOTES.md#unrealircd-600-beta4> 
of this beta release for detailed information on all the new features, 
and also how to update your U5 config to work on U6.
As always, you can download UnrealIRCd from https://www.unrealircd.org/ 
<https://www.unrealircd.org/>. The *NIX/source version is up. The 
Windows version will be uploaded later today.

-- 
Bram Matthys
Security and software eng...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 6.0.0-beta3 available for testing

[Bram M. <sy...@un...>]

*Third beta*
The third beta for UnrealIRCd 6 is now available for testing. Compared 
to beta2 there are more than 10 fixes (see release notes). This release 
contains all the planned features for U6 and we now need the help of the 
public to test these beta releases. Caution: this beta may crash 
spectacularly, behave weird or in unexpected ways, so don't run it on 
production systems!
If you find any issues, please report them at 
https://bugs.unrealircd.org/ <https://bugs.unrealircd.org/>. This way, 
you help us getting ready for a real stable UnrealIRCd 6 release.

*UnrealIRCd 6
*We have been working on UnrealIRCd 6 behind closed doors since July. A 
lot of work has been done during the summer vacation.
UnrealIRCd 6 comes with a completely redone logging system (with 
optional JSON support), named extended bans, four new IRCv3 features, 
geoip support and remote includes support built-in.
Additionally, things are more customizable such as what gets sent to 
which snomask. All the +vhoaq channel modes are now modular as well, 
handy for admins who don't want or need halfops or +q/+a. For WHOIS it 
is now customizable in detail who gets to see what.

See the release notes 
<https://github.com/unrealircd/unrealircd/blob/unreal60_dev/doc/RELEASE-NOTES.md#unrealircd-600-beta3> 
of this beta release for detailed information on all the new features, 
and also how to update your U5 config to work on U6.
As always, you can download UnrealIRCd from https://www.unrealircd.org/ 
<https://www.unrealircd.org/>. The *NIX/source version is up. The 
Windows version will be uploaded later today.

-- 
Bram Matthys
Security and software eng...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 6.0.0-beta2 available for testing

[Bram M. <sy...@un...>]

*Second beta!*
The second beta for UnrealIRCd 6 is now available for testing. Compared 
to beta1 there are a number of fixes (see release notes). This release 
contains all the planned features for U6 and we now need the help of the 
public to test these beta releases. Caution: this beta may crash 
spectacularly, behave weird or in unexpected ways, so don't run it on 
production systems!
If you find any issues, please report them at 
https://bugs.unrealircd.org/ <https://bugs.unrealircd.org/>. This way, 
you help us getting ready for a real stable UnrealIRCd 6 release.

*UnrealIRCd 6
*We have been working on UnrealIRCd 6 behind closed doors since July. A 
lot of work has been done during the summer vacation.
UnrealIRCd 6 comes with a completely redone logging system (with 
optional JSON support), named extended bans, four new IRCv3 features, 
geoip support and remote includes support built-in.
Additionally, things are more customizable such as what gets sent to 
which snomask. All the +vhoaq channel modes are now modular as well, 
handy for admins who don't want or need halfops or +q/+a. For WHOIS it 
is now customizable in detail who gets to see what.

See the release notes 
<https://github.com/unrealircd/unrealircd/blob/unreal60_dev/doc/RELEASE-NOTES.md> 
of this beta release for detailed information on all the new features, 
and also how to update your U5 config to work on U6.
As always, you can download UnrealIRCd from https://www.unrealircd.org/ 
<https://www.unrealircd.org/>. The *NIX/source version is up. The 
Windows version will be uploaded later today.

-- 
Bram Matthys
Security and software eng...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 6.0.0-beta1 released

[Bram M. <sy...@un...>]

*First beta!*
The first beta for UnrealIRCd 6 is now available for download. It 
contains all the planned features for U6 and we now need the help of the 
public to test these beta releases. Caution: this beta may crash 
spectacularly, behave weird or in unexpected ways, so don't run it on 
production systems!
If you find any issues, please report them at 
https://bugs.unrealircd.org/ <https://bugs.unrealircd.org/>. This way, 
you help us getting ready for a real stable UnrealIRCd 6 release.

*UnrealIRCd 6
*We have been working on UnrealIRCd 6 behind closed doors since July. A 
lot of work has been done during the summer vacation.
UnrealIRCd 6 comes with a completely redone logging system (with 
optional JSON support), named extended bans, four new IRCv3 features, 
geoip support and remote includes support built-in.
Additionally, things are more customizable such as what gets sent to 
which snomask. All the +vhoaq channel modes are now modular as well, 
handy for admins who don't want or need halfops or +q/+a. For WHOIS it 
is now customizable in detail who gets to see what.

See the release notes 
<https://github.com/unrealircd/unrealircd/blob/unreal60_dev/doc/RELEASE-NOTES.md> 
of this beta release for detailed information on all the new features, 
and also how to update your U5 config to work on U6.
As always, you can download UnrealIRCd from https://www.unrealircd.org/ 
<https://www.unrealircd.org/>

-- 
Bram Matthys
Security and software eng...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

New staff member, heads up on UnrealIRCd 6 & support for UnrealIRCd 5

[Bram M. <sy...@un...>]

(You can unsubscribe from this list here 
<https://sourceforge.net/projects/unreal/lists/unreal-notify/unsubscribe>)

Hi everyone,

In this update I want to post about 3 things: our new staff member k4be, 
a heads up on UnrealIRCd 6 and the support schedule of UnrealIRCd 5.

*New team member*
Earlier this year k4be silently joined the development team of 
UnrealIRCd. We are happy to welcome him onboard! k4be has been using 
UnrealIRCd for more than 15 years. He knows his way around the source 
code and in the past few years he has been publicly posting 3rd party 
modules.

*UnrealIRCd 6*
We have been working on UnrealIRCd 6 behind closed doors since July. A 
/lot/ of work has been done during the summer vacation.
Very soon we will be releasing our first 6.0.0 beta. Normally we would 
start with an alpha release, but not this time. We are going straight to 
beta because this release already includes all the planned functionality 
for UnrealIRCd 6.0.0. All of the major API changes have been done. A lot 
remains to be tested, but we don't expect major code changes anymore, 
just a lot of bug fixing, documentation updates, and so on. The exact 
features of UnrealIRCd 6 will be mentioned in the 6.0.0-beta1 announcement.

*UnrealIRCd 5*
An important reason to post this separate from the UnrealIRCd 6 
announcement is that I also want to be clear about our commitment to the 
current stable series, UnrealIRCd 5. UnrealIRCd release series tend to 
stay around for quite long. The 3.2.x series existed for 12.5 years and 
UnrealIRCd 4 for 5 years.
The good thing about that is that admins have less hassle with upgrades 
and module coders can use a reasonably stable API.
The downside of maintaining (old) releases is consuming UnrealIRCd 
developer resources but also the need to provide support for them (on 
IRC and forums), users missing out of: new functionality, flexibility, 
more easy ways to do things. This time I hope we've found the middle 
ground between the pros and cons.

The UnrealIRCd 5 support schedule 
<https://www.unrealircd.org/docs/UnrealIRCd_releases> is as follows:

  * January 1, 2022: No new features in UnrealIRCd 5. Only (major) bug
    fixes.
  * July 1, 2022: Security fixes only
  * July 1, 2023: End of all support for UnrealIRCd 5

This means UnrealIRCd 5 will stay supported for another 20 months.

Thanks everyone for using UnrealIRCd and stay tuned for more news about 
UnrealIRCd 6 in the upcoming days.

-- 
Bram Matthys
Security res...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 5.2.2 released

[Bram M. <sy...@un...>]

Hi everyone,

Last release (5.2.1.1) turned out to be good and stable. This UnrealIRCd 
5.2.2 release contains only a few small changes.
The two main problems that are fixed are: an OpenBSD compile issue and a 
problem with Let's Encrypt certificates. See the release notes 
<https://github.com/unrealircd/unrealircd/blob/dbdac4e3045d1b4493de172de01b503873bb7d8a/doc/RELEASE-NOTES.md#unrealircd-522-release-notes> 
for full details.

If you are still using UnrealIRCd 5.0.x then we recommend you to upgrade 
to 5.2.2 somewhere in the next few weeks/months. Just as a reminder: 
5.2.x is the direct successor to 5.0.9, there is no support for 5.0.x 
<https://www.unrealircd.org/docs/FAQ#about-52x>.

As always, you can download UnrealIRCd from https://www.unrealircd.org/

-- 
Bram Matthys
Security and software eng...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 5.2.1 released & small security issue

[Bram M. <sy...@un...>]

Hi everyone,

*New release: UnrealIRCd 5.2.1*
UnrealIRCd 5.2.1 is out! Although it has been only a month since 5.2.0, 
this release comes with several new features and some major bug fixes. 
See the release notes 
<https://github.com/unrealircd/unrealircd/blob/8322a4802670fa951015fde435a42b34d0bbbf27/doc/RELEASE-NOTES.md#unrealircd-521-release-notes> 
for full details.
If you are on 5.0.9 or 5.2.0(.x) then you can easily upgrade by running 
the command: ./unrealircd upgrade
Of course, as always, you can (also) download UnrealIRCd from 
https://www.unrealircd.org/

*Do I need to upgrade?*
For more information on the end of 5.0.x and upgrading to 5.2.x, see 
FAQ: About the new 5.2.x series 
<https://www.unrealircd.org/docs/FAQ#About_the_new_5.2.x_series>.
Admins who wish to take a conservative approach still _don't need to 
rush_ to upgrade from 5.0.x to 5.2.1, they can wait for 5.2.2. If you 
decide not to upgrade right now, then be sure to read on the small 
security issue below.

*Small security issue*
UnrealIRCd 5.0.9, 5.2.0(.x) and 5.2.1-rc1 have an incorrect built-in ban 
exception for "127.*" which intended to exempt localhost ("127.0.0.1"). 
Unfortunately, the obvious fact was overlooked that this can also match 
hostnames such as "127.something.example.org", allowing such users to 
bypass kline, gline and shun. This bug is fixed in 5.2.1, but it can 
also be fixed without upgrading to 5.2.1.
If you are on 5.0.9, 5.2.0.x or 5.2.1-rc1 then simply run the following 
command and it will fix the issue without the need to restart UnrealIRCd:
./unrealircd hot-patch exemptlocalhost
After that you can verify online at IRC as IRCOp with the command "STATS 
except" that the incorrect ban exception on 127.* is gone and the good 
one on 127.0.0.0/8 is listed.
On a side note, even without this patch, you could always have banned 
these users via GZLINE and KILL.

-- 
Bram Matthys
Security and software eng...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 5.2.1-rc1 available for testing

[Bram M. <sy...@un...>]

Hi everyone,

The release candidate for UnrealIRCd 5.2.1 is now available. Even though 
only a month has passed since 5.2.0, there are many enhancements and 
fixes. We welcome anyone to test and report issues to 
https://bugs.unrealircd.org/ so they can be fixed before the 5.2.1 
stable release.

See the release notes 
<https://github.com/unrealircd/unrealircd/blob/94993a03ca8d3c193c0295c33af39270c3f9d27d/doc/RELEASE-NOTES.md#unrealircd-521-rc1-release-notes> 
for full details on everything.

As always, you can download UnrealIRCd from https://www.unrealircd.org/

-- 
Bram Matthys
Security res...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 5.2.0.1 released

[Bram M. <sy...@un...>]

Hi everyone,

This is a small update for the 5.2.0 release. In channels, spamfilters 
of type 'p' were run instead of type 'c'.
Although this is not a major issue for many of us, as spamfilter are 
often placed on both ('pc'), there is now this dot release to make sure 
new installs don't have this bug.
Existing 5.2.0 users can easily fix this issue without the need for a 
restart, simply run: ./unrealircd hot-patch wrongspamfilter520

Below is the 5.2.0 announcement:

UnrealIRCd 5.2.0 is out! This is release comes with lots of new features 
but the two big new things are: an improved and more flexible anti-flood 
block and channel history which can now be stored encrypted on disk and 
allows clients to fetch hundreds/thousands of lines. See the release 
notes 
<https://github.com/unrealircd/unrealircd/blob/unreal52/doc/RELEASE-NOTES.md#unrealircd-5201-release-notes> 
for full details.

For more information on the end of 5.0.x and upgrading to 5.2.x, see 
FAQ: About the new 5.2.x series 
<https://www.unrealircd.org/docs/FAQ#About_the_new_5.2.x_series>. In 
short: this is a big bump similar to what happened between 4.0.x and 4.2.x.

As always, you can download UnrealIRCd from https://www.unrealircd.org/

-- 
Bram Matthys
Security and software eng...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 5.2.0 released

[Bram M. <sy...@un...>]

Hi everyone,

UnrealIRCd 5.2.0 is out! This is release comes with lots of new features 
but the two big new things are: an improved and more flexible anti-flood 
block and channel history which can now be stored encrypted on disk and 
allows clients to fetch hundreds/thousands of lines. See the release 
notes 
<https://github.com/unrealircd/unrealircd/blob/f7933a8d7247aa93845f035a4a5b0b7c29216373/doc/RELEASE-NOTES.md#unrealircd-520-release-notes> 
for full details.

For more information on the end of 5.0.x and upgrading to 5.2.x, see 
FAQ: About the new 5.2.x series 
<https://www.unrealircd.org/docs/FAQ#About_the_new_5.2.x_series>. In 
short: this is a big bump similar to what happened between 4.0.x and 4.2.x.

As always, you can download UnrealIRCd from https://www.unrealircd.org/

-- 
Bram Matthys
Security and software eng...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 5.2.0-rc1 available for testing

[Bram M. <sy...@un...>]

Hi everyone,

The first release candidate for UnrealIRCd 5.2.0 is now available. This 
is a major release with lots of new features that also warrant a lot of 
testing. We welcome anyone to test and report issues to 
https://bugs.unrealircd.org/ so they can be fixed before the 5.2.0 
stable release.

The two main features are: an improved and more flexible anti-flood 
block and channel history which can now be stored encrypted on disk and 
allows clients to fetch hundreds/thousands of lines.
See the release notes 
<https://github.com/unrealircd/unrealircd/blob/173af8c88c5674d21c8b4aea6c8f4236dd1f9a37/doc/RELEASE-NOTES.md#unrealircd-520-rc1-release-notes> 
for full details on these and other new features.

As always, you can download UnrealIRCd from https://www.unrealircd.org/

-- 
Bram Matthys
Security res...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 5.0.9.1 released and update on OpenSSL crashbug

[Bram M. <sy...@un...>]

Hi everyone,

*UnrealIRCd 5.0.9.1 released: build improvements on *NIX*
I've released UnrealIRCd 5.0.9.1 for *NIX. If you are already running 
5.0.9 then there is absolutely NO reason to upgrade to this version. It 
ONLY improves the ./Config and ./configure script.
It fixes a problem where UnrealIRCd did not build on systems with low 
memory and no swap (even though that is kinda the sysadmins fault). And 
it also reduces the compile time by 2-5 minutes when the shipped c-ares 
library is used, eg if there is no system c-ares library available.

*It is confirmed, OpenSSL crashbug also crashes UnrealIRCd on *NIX*
A proof of concept exploit for the OpenSSL CVE-2021-3449 crash bug was 
released today. I've confirmed that it crashes UnrealIRCd if you have 
not updated to OpenSSL 1.1.1k. See the previous announcement 
<https://forums.unrealircd.org/viewtopic.php?f=1&t=9085> for more 
information on that. Again, this is not a bug in UnrealIRCd itself but 
in OpenSSL, this is FYI only.

*Windows build is unaffected by OpenSSL crashbug*
Our Windows build of UnrealIRCd 5.0.9 uses LibreSSL. The proof of 
concept exploit is unable to crash it. The Windows version will thus 
stay at 5.0.9, since there is no LibreSSL upgrade and the 5.0.9.1 
changes only affect compiling on *NIX.

As always you can download UnrealIRCd from https://www.unrealircd.org/

Regards,

Bram Matthys (Syzop)

-- 

Bram Matthys
Security and software eng...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd and the recent OpenSSL advisory (CVE-2021-3449)

[Bram M. <sy...@un...>]

Hi everyone,

Today, the OpenSSL project issued a security advisory 
<https://www.openssl.org/news/secadv/20210325.txt>: "NULL pointer deref 
in signature_algorithms processing (CVE-2021-3449)".
This bug is not UnrealIRCd-specific. It basically means most SSL/TLS 
servers on the Internet can be crashed. Other than crashing the server 
no damage can be done (no execution of code). The bug description is 
very clear so personally I expect exploits to be published soon, today 
or tomorrow, that will allow malicious people to crash SSL/TLS servers 
(apache, nginx, etc).
This also means an attacker can crash UnrealIRCd. And, as we all know, 
crashing an IRC server can be quite troublesome, since it means everyone 
disconnects and a lot of text/havoc on the screen.

We highly recommend to upgrade the OpenSSL package on your 
system/distro. Consult your system/distro security announcements and 
documentation for how to do so.

After upgrading OpenSSL you would have to restart UnrealIRCd to fix the 
crash bug. It cannot be fixed with a /REHASH. Only a restart will cause 
it to load the (upgraded) OpenSSL library.
Or, alternatively, don't do the restart and risk an attacker crashing it 
once, and then let a cron job bring it back up a few minutes later with 
the fixed openssl. Of course, an evil guy may crash all your servers at 
once at some inconvenient time, so whether that is a good idea or not is 
up to you. The choice is yours.

There is technically no need to recompile UnrealIRCd. But, if you are 
restarting UnrealIRCd anyway, then maybe you could consider upgrading 
UnrealIRCd at the same time to latest version (5.0.9 as we speak), to 
kill two birds with one stone. But, again, this is not required!

UnrealIRCd itself does not ship with any openssl code so there will be 
no fixed /source code/ release.
The only /binary releases/ we have that uses an SSL library is the 
Windows one. Currently it is unknown if it is affected by the bug as it 
uses libressl instead of openssl. We will do a new windows release if 
libressl does a security announcement somewhere in the next few days.

Please do not contact us for help with configuring or upgrading your 
OpenSSL. This is not our code, we are simply using this library just 
like most SSL/TLS programs out there.

Regards,

Bram Matthys (Syzop)

-- 

Bram Matthys
Security and software eng...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 5.0.9 released

[Bram M. <sy...@un...>]

Hi everyone,

UnrealIRCd 5.0.9 is out! This release comes with several nice feature 
enhancements. There are no major bug fixes. See the release notes 
<https://github.com/unrealircd/unrealircd/blob/80fbef8b5c1c1276a357423cb912a10601f6d77a/doc/RELEASE-NOTES.md#unrealircd-509-release-notes> 
for full details.

As always, you can download UnrealIRCd from https://www.unrealircd.org/

*Reminder: UnrealIRCd 4 is no longer supported*
UnrealIRCd 4 is no longer supported 
<https://www.unrealircd.org/docs/UnrealIRCd_4_EOL>. Admins must upgrade 
to UnrealIRCd 5.
If you are upgrading from 4.x to 5.x then check out What's new in 
UnrealIRCd 5 
<https://www.unrealircd.org/docs/What%27s_new_in_UnrealIRCd_5> and 
Upgrading from 4.x <https://www.unrealircd.org/docs/Upgrading_from_4.x>. 
In any case, be sure to upgrade your services package first! (if you use 
any).

-- 
Bram Matthys
Security and software eng...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 5.0.9-rc1 available for testing

[Bram M. <sy...@un...>]

Hi everyone,

The release candidate for UnrealIRCd 5.0.9 is now available for testing, 
see the release notes 
<https://github.com/unrealircd/unrealircd/blob/6761cdd66d40eba87175ad1ae6c3403765dfac6f/doc/RELEASE-NOTES.md#unrealircd-509-rc1-release-notes> 
for full details.
Please report any issues you may find on https://bugs.unrealircd.org/ so 
we can get them fixed before the final 5.0.9 release.

As always, you can download UnrealIRCd from https://www.unrealircd.org/

*Reminder: UnrealIRCd 4 is no longer supported*
UnrealIRCd 4 is no longer supported 
<https://www.unrealircd.org/docs/UnrealIRCd_4_EOL>. Admins must upgrade 
to UnrealIRCd 5.
If you are upgrading from 4.x to 5.x then check out What's new in 
UnrealIRCd 5 
<https://www.unrealircd.org/docs/What%27s_new_in_UnrealIRCd_5> and 
Upgrading from 4.x <https://www.unrealircd.org/docs/Upgrading_from_4.x>. 
In any case, be sure to upgrade your services package first! (if you use 
any).

-- 
Bram Matthys
Security res...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 5.0.8 released

[Bram M. <sy...@un...>]

Hi everyone,

UnrealIRCd 5.0.8 is out! The main purpose of this release is to enhance
the reputation functionality. There have also been some other changes
and minor bug fixes. See the release notes
<https://github.com/unrealircd/unrealircd/blob/380e039d9534082adaf75553cb40bc7badac123b/doc/RELEASE-NOTES.md#unrealircd-508-release-notes>
for full details.

*Reminder: UnrealIRCd 4 is no longer supported*
UnrealIRCd 4 is no longer supported
<https://www.unrealircd.org/docs/UnrealIRCd_4_EOL>. Admins must upgrade
to UnrealIRCd 5.
If you are upgrading from 4.x to 5.x then check out What's new in
UnrealIRCd 5
<https://www.unrealircd.org/docs/What%27s_new_in_UnrealIRCd_5> and
Upgrading from 4.x <https://www.unrealircd.org/docs/Upgrading_from_4.x>.
In any case, be sure to upgrade your services package first! (if you use
any).

As always, you can download UnrealIRCd from https://www.unrealircd.org/

-- 
Bram Matthys
Security researcher                     sy...@vu...
Website:                                  www.vulnscan.org
PGP key:                       www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 5.0.8-rc1 available for testing

[Bram M. <sy...@un...>]

(This time with the correct release notes link)

Hi everyone,

The release candidate for UnrealIRCd 5.0.8 is now available for testing,
see the release notes
<https://github.com/unrealircd/unrealircd/blob/99defea611a56aed435ee3df6eeb5deadaa2a060/doc/RELEASE-NOTES.md#unrealircd-508-rc1-release-notes>
for full details.
Please report any issues you may find on https://bugs.unrealircd.org/ so
we can get them fixed before the final 5.0.8 release.

*Reminder: UnrealIRCd 4 End Of Life after 2020*

UnrealIRCd 4 is no longer supported
<https://www.unrealircd.org/docs/UnrealIRCd_4_EOL> after 2020. Admins
must upgrade to UnrealIRCd 5.
If you are upgrading from 4.x to 5.x then check out What's new in
UnrealIRCd 5
<https://www.unrealircd.org/docs/What%27s_new_in_UnrealIRCd_5> and you
may also wish to read Upgrading from 4.x
<https://www.unrealircd.org/docs/Upgrading_from_4.x>. In any case, be
sure to upgrade your services package first! (if you use any).
UnrealIRCd 5 is known to work with the following services:

  * anope <https://www.anope.org/> (version 2.0.7 or higher) - with the
    "unreal4" protocol module
  * atheme <https://atheme.github.io/atheme.html> (version 7.2.9 or
    higher) - with the "unreal4" protocol module

As always, you can download UnrealIRCd from https://www.unrealircd.org/

-- 
Bram Matthys
Security researcher                     sy...@vu...
Website:                                  www.vulnscan.org
PGP key:                       www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 5.0.8-rc1 available for testing

[Bram M. <sy...@un...>]

Hi everyone,

The release candidate for UnrealIRCd 5.0.8 is now available for testing,
see the release notes
<https://github.com/unrealircd/unrealircd/blob/9c85cd5bc62e9c7e3fd3fe2df709ed06989ccbc5/doc/RELEASE-NOTES.md#unrealircd-507-release-notes>
for full details.
Please report any issues you may find on https://bugs.unrealircd.org/ so
we can get them fixed before the final 5.0.8 release.

*Reminder: UnrealIRCd 4 End Of Life after 2020*

UnrealIRCd 4 is no longer supported
<https://www.unrealircd.org/docs/UnrealIRCd_4_EOL> after 2020. Admins
must upgrade to UnrealIRCd 5.
If you are upgrading from 4.x to 5.x then check out What's new in
UnrealIRCd 5
<https://www.unrealircd.org/docs/What%27s_new_in_UnrealIRCd_5> and you
may also wish to read Upgrading from 4.x
<https://www.unrealircd.org/docs/Upgrading_from_4.x>. In any case, be
sure to upgrade your services package first! (if you use any).
UnrealIRCd 5 is known to work with the following services:

  * anope <https://www.anope.org/> (version 2.0.7 or higher) - with the
    "unreal4" protocol module
  * atheme <https://atheme.github.io/atheme.html> (version 7.2.9 or
    higher) - with the "unreal4" protocol module

As always, you can download UnrealIRCd from https://www.unrealircd.org/

-- 
Bram Matthys
Security researcher                     sy...@vu...
Website:                                  www.vulnscan.org
PGP key:                       www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 5.0.7 released

[Bram M. <sy...@un...>]

(You can unsubscribe from this list here
<https://sourceforge.net/projects/unreal/lists/unreal-notify/unsubscribe>)

Hi everyone,

UnrealIRCd 5.0.7 is now available for download. This release mainly
consists of fixes for the 5.x stable series, with some minor
enhancements. See the release notes
<https://github.com/unrealircd/unrealircd/blob/9c85cd5bc62e9c7e3fd3fe2df709ed06989ccbc5/doc/RELEASE-NOTES.md#unrealircd-507-release-notes>
for full details.

*Reminder: UnrealIRCd 4 will be EOL at the end of 2020*

UnrealIRCd 4 will be maintained until 31 December 2020 (security fixes
only!). After that date UnrealIRCd 4 is no longer supported
<https://www.unrealircd.org/docs/UnrealIRCd_4_EOL>. Admins are
recommended to upgrade to UnrealIRCd 5 soon.

*UnrealIRCd 5*

UnrealIRCd 5 was released in December 2019 and is the current "stable"
branch. In particular I would like to thank Gottem and 'i' for their
source code contributions and PeGaSuS and westor for testing releases.
When we transitioned from 3.2.x to 4.0.0 there were 175,000 lines of
source code added/removed during 3 years of development. This time it
was 120,000 lines in only 8 months, a major effort!

A short summary of release highlights for UnrealIRCd 5 in general is
available here
<https://www.unrealircd.org/docs/What%27s_new_in_UnrealIRCd_5>. The full
release notes are available here
<https://github.com/unrealircd/unrealircd/blob/9c85cd5bc62e9c7e3fd3fe2df709ed06989ccbc5/doc/RELEASE-NOTES.md#unrealircd-5>.
If you have some spare time, we recommended reading the full release
notes (the new and changed sections, anyway) so you don't miss out on
anything.

If you are upgrading from 4.x to 5.x then it would be wise to read
Upgrading from 4.x <https://www.unrealircd.org/docs/Upgrading_from_4.x>.
In any case, be sure to upgrade your services package first! (if you use
any). UnrealIRCd 5 is known to work with the following services:

  * anope <https://www.anope.org/> (version 2.0.7 or higher) - with the
    "unreal4" protocol module
  * atheme <https://atheme.github.io/atheme.html> (version 7.2.9 or
    higher) - with the "unreal4" protocol module

As always, you can download UnrealIRCd from https://www.unrealircd.org/

-- 
Bram Matthys
Security researcher                     sy...@vu...
Website:                                  www.vulnscan.org
PGP key:                       www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 5.0.7-rc1 available for testing

[Bram M. <sy...@un...>]

(You can unsubscribe from this list here
<https://sourceforge.net/projects/unreal/lists/unreal-notify/unsubscribe>)

Hi everyone,

The release candidate for UnrealIRCd 5.0.7 is now available for testing,
see the release notes
<https://github.com/unrealircd/unrealircd/blob/2d9024562690131433eccb208dbd5d2c5b35c560/doc/RELEASE-NOTES.md#unrealircd-507-rc1-release-notes>
for full details.

If you find any bugs, please report them on the bugtracker
<https://bugs.unrealircd.org/> so we can get them fixed before the final
5.0.7 release.

*Reminder: UnrealIRCd 4 will be EOL at the end of 2020*

UnrealIRCd 4 will be maintained until 31 December 2020 (security fixes
only!). After that date UnrealIRCd 4 is no longer supported
<https://www.unrealircd.org/docs/UnrealIRCd_4_EOL>. Admins are
recommended to upgrade to UnrealIRCd 5 soon.

*UnrealIRCd 5*

UnrealIRCd 5 was released in December 2019 and is the current "stable"
branch. In particular I would like to thank Gottem and 'i' for their
source code contributions and PeGaSuS and westor for testing releases.
When we transitioned from 3.2.x to 4.0.0 there were 175,000 lines of
source code added/removed during 3 years of development. This time it
was 120,000 lines in only 8 months, a major effort!

A short summary of release highlights for UnrealIRCd 5 in general is
available here
<https://www.unrealircd.org/docs/What%27s_new_in_UnrealIRCd_5>. The full
release notes are available here
<https://github.com/unrealircd/unrealircd/blob/2d9024562690131433eccb208dbd5d2c5b35c560/doc/RELEASE-NOTES.md#unrealircd-5>.
If you have some spare time, we recommended reading the full release
notes (the new and changed sections, anyway) so you don't miss out on
anything.

If you are upgrading from 4.x to 5.x then it would be wise to read
Upgrading from 4.x <https://www.unrealircd.org/docs/Upgrading_from_4.x>.
In any case, be sure to upgrade your services package first! (if you use
any). UnrealIRCd 5 is known to work with the following services:

  * anope <https://www.anope.org/> (version 2.0.7 or higher) - with the
    "unreal4" protocol module
  * atheme <https://atheme.github.io/atheme.html> (version 7.2.9 or
    higher) - with the "unreal4" protocol module

As always, you can download UnrealIRCd from https://www.unrealircd.org/

-- 
Bram Matthys
Security researcher                     sy...@vu...
Website:                                  www.vulnscan.org
PGP key:                       www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6

UnrealIRCd 5.0.6 released

[Bram M. <sy...@un...>]

(You can unsubscribe from this list here
<https://sourceforge.net/projects/unreal/lists/unreal-notify/unsubscribe>)

Hi everyone,

UnrealIRCd 5.0.6 is now available. This is a small small maintenance
release for the stable 5.x series. See the release notes
<https://github.com/unrealircd/unrealircd/blob/422244a2e56fd293c0ad2126dc1af8f9aca6a7c3/doc/RELEASE-NOTES.md#unrealircd-506-release-notes>
for full details.

*Reminder: UnrealIRCd 4 will be EOL at the end of 2020*

UnrealIRCd 4 will be maintained until 31 December 2020 (security fixes
only!). After that date UnrealIRCd 4 is no longer supported
<https://www.unrealircd.org/docs/UnrealIRCd_4_EOL>.
Admins are recommended to upgrade to UnrealIRCd 5 soon.

*UnrealIRCd 5*

UnrealIRCd 5 was released in December 2019 and is the current "stable"
branch. In particular I would like to thank Gottem and 'i' for their
source code contributions and PeGaSuS and westor for testing releases.
When we transitioned from 3.2.x to 4.0.0 there were 175,000 lines of
source code added/removed during 3 years of development. This time it
was 120,000 lines in only 8 months, a major effort!

A short summary of release highlights for UnrealIRCd 5 in general is
available here
<https://www.unrealircd.org/docs/What%27s_new_in_UnrealIRCd_5>. The full
release notes are available here
<https://github.com/unrealircd/unrealircd/blob/422244a2e56fd293c0ad2126dc1af8f9aca6a7c3/doc/RELEASE-NOTES.md#unrealircd-5>.
If you have some spare time, we recommended reading the full release
notes (the new and changed sections, anyway) so you don't miss out on
anything.

If you are upgrading from 4.x to 5.x then it would be wise to read
Upgrading from 4.x <https://www.unrealircd.org/docs/Upgrading_from_4.x>.
In any case, be sure to upgrade your services package first! (if you use
any). UnrealIRCd 5 is known to work with the following services:

  * anope <https://www.anope.org/> (version 2.0.7 or higher) - with the
    "unreal4" protocol module
  * atheme <https://atheme.github.io/atheme.html> (version 7.2.9 or
    higher) - with the "unreal4" protocol module

As always, you can download UnrealIRCd from https://www.unrealircd.org/

-- 
Bram Matthys
Security researcher                     sy...@vu...
Website:                                  www.vulnscan.org
PGP key:                       www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6