UnrealIRCd 6.0.4.2 =================== Another small update to 6.0.4.x: * Fix crash when linking. This requires a certain sequence of events: first a server is linked in successfully, then we need to REHASH, and then a new link attempt has to come in with the same server name (for example because there is a network issue and the old link has not timed out yet). If all that happens, then an UnreaIRCd 6 server may crash, but not always. * Two IRCv3 specifications were ratified which we already supported as drafts: * Change CAP `draft/extended-monitor` to `extended-monitor` * Add message-tag `bot` next to existing (for now) `draft/bot` * Update Turkish translations UnrealIRCd 6.0.4.1 =================== This is a small update to 6.0.4. It fixes the following issues that were present in all 6.0.x versions: * Fix sporadic crash when linking a server (after successful authentication). This feels like a compiler bug. It affected only some people with GCC and only in some situations. When compiled with clang there was no problem. Hopefully we can work around it this way. * Make /INVITE bypass (nearly) all channel mode restrictions, as it used to be in UnrealIRCd 5.x. Both for invites by channel ops and for OperOverride. This also fixes a bug where an IRCOp with OperOverride could not bypass +l (limit) and other restrictions and would have to resort back to using MODE or SAMODE. Only +b and +i could be bypassed via INVITE OperOverride. UnrealIRCd 6.0.4 ----------------- This release comes with lots of features and enhancements. In particular, security groups and mask items now allow you to write cleaner and more flexible configuration files. There are also JSON logging enhancements and several bug fixes. Thanks a lot to everyone who tested the release candidates! If you are already running UnrealIRCd 6 then read below. Otherwise, jump straight to the [summary about UnrealIRCd 6](#Summary) to learn more about UnrealIRCd 6. ### Enhancements: * Show security groups in `WHOIS` * The [security-group block](https://www.unrealircd.org/docs/Security-group_block) has been expanded and the same functionality is now available in [mask items](https://www.unrealircd.org/docs/Mask_item) too: * This means the existing options like `identified`, `webirc`, `tls` and `reputation-score` can be used in `allow::mask` etc. * New options (in both security-group and mask) are: * `connect-time`: time a user is connected to IRC * `security-group`: to check another security group * `account`: services account name * `country`: country code, as found by GeoIP * `realname`: realname (gecos) of the user * `certfp`: certificate fingerprint * Every option also has an exclude- variant, eg. `exclude-country`. If a user matches any `exclude-` option then it is considered not a match. * The modules [connthrottle](https://www.unrealircd.org/docs/Connthrottle), [restrict-commands](https://www.unrealircd.org/docs/Set_block#set::restrict-commands) and [antirandom](https://www.unrealircd.org/docs/Set_block#set::antirandom) now use the new `except` sub-block which is a mask item. The old syntax (eg set::antirandom::except-webirc) is still accepted by UnrealIRCd and converted to the appropriate new setting behind the scenes (set::antirandom::except::webirc). * The modules [blacklist](https://www.unrealircd.org/docs/Blacklist_block) and [antimixedutf8](https://www.unrealircd.org/docs/Set_block#set::antimixedutf8) now also support the `except` block (a mask item). * Other than that the extended functionality is available in these blocks: `allow`, `oper`, `tld`, `vhost`, `deny channel`, `allow channel`. * Example of direct use in a ::mask item: ``` /* Spanish MOTD for Spanish speaking countries */ tld { mask { country { ES; AR; BO; CL; CO; CR; DO; EC; SV; GT; HN; MX; NI; PA; PY; PE; PR; UY; VE; } } motd "motd.es.txt"; rules "rules.es.txt"; } ``` * Example of defining a security group and using it in a mask item later: ``` security-group irccloud { mask { ip1; ip2; ip3; ip4; } } allow { mask { security-group irccloud; } class clients; maxperip 128; } except ban { mask { security-group irccloud; } type { blacklist; connect-flood; handshake-data-flood; } } ``` * Because the mask item is so powerful now, the `password` in the [oper block](https://www.unrealircd.org/docs/Oper_block) is optional now. * We now support oper::auto-login, which means the user will become IRCOp automatically if they match the conditions on-connect. This can be used in combination with [certificate fingerprint](https://www.unrealircd.org/docs/Certificate_fingerprint) authentication for example: ``` security-group Syzop { certfp "1234etc."; } oper Syzop { auto-login yes; mask { security-group Syzop; } operclass netadmin-with-override; class opers; } except ban { mask { security-group Syzop; } type all; } ``` * For [JSON logging](https://www.unrealircd.org/docs/JSON_logging) a number of fields were added when a client is expanded: * `geoip`: with subitem `country_code` (eg. `NL`) * `tls`: with subitems `cipher` and `certfp` * Under subitem `users`: * `vhost`: if the visible host differs from the realhost then this is set (thus for both vhost and cloaked host) * `cloakedhost`: this is always set (except for eg. services users), even if the user is not cloaked so you can easily search on a cloaked host. * `idle_since`: last time the user has spoken (local clients only) * `channels`: list of channels (array), with a maximum of 384 chars. * The JSON logging now also strips ASCII below 32, so color- and control codes. * Support IRCv3 `+draft/channel-context` * Add `example.es.conf` (Spanish example configuration file) * The country of users is now communicated in the [message-tag](https://www.unrealircd.org/docs/Message_tags) `unrealircd.org/geoip` (only to IRCOps). * Add support for linking servers via UNIX domain sockets (`link::outgoing::file`). ### Fixes: * Crash in `except ban` with `~security-group:xyz` * Crash if hideserver module was loaded but `LINKS` was not blocked. * Crash on Windows when using the "Rehash" GUI option. * Infinite loop if one security-group referred to another. * Duplicate entries in the `+beI` lists of `+P` channels. * Regular users were able to -o a service bot (that has umode +S) * Module manager did not stop on compile error * [`set::modes-on-join`](https://www.unrealircd.org/docs/Set_block#set::modes-on-join) did not work with `+f` + timed bans properly, eg `[3t#b1]:10` * Several log messages were missing some information. * Reputation syncing across servers had a small glitch. Fix is mostly useful for servers that were not linked to the network for days or weeks. ### Changes: * Clarified that UnrealIRCd is licensed as "GPLv2 or later" * Fix use of variables in [`set::reject-message](https://www.unrealircd.org/docs/Set_block#set::reject-message) and in [`blacklist::reason](https://www.unrealircd.org/docs/Blacklist_block): previously short forms of variables were (unintentionally) expanded as well, such as `$serv` for `$server`. This is no longer supported, you need to use the correct full variable names. ### Developers and protocol: * The `creationtime` is now communicated of users. Until now this information was only known locally (the thing that was communicated that came close was "last nick change" but that is not the same). This is synced via (early) moddata across servers. Module coders can use `get_connected_time()`. * The `RPL_HOSTHIDDEN` is now sent from `userhost_changed()` so you don't explicitly send it yourself anymore. * The `SVSO` command is back, so services can make people IRCOp again. See `HELPOP SVSO` or [the commit](https://github.com/unrealircd/unrealircd/commit/50e5d91c798e7d07ca0c68d9fca302a6b6610786) for more information. * Due to last change the `HOOKTYPE_LOCAL_OPER` parameters were changed. * Module coders can enhance the [JSON logging](https://www.unrealircd.org/docs/JSON_logging) expansion items for clients and channels via new hooks like `HOOKTYPE_JSON_EXPAND_CLIENT`. This is used by the geoip and tls modules. UnrealIRCd 6.0.3 ----------------- A number of serious issues were discovered in UnrealIRCd 6. Among these is an issue which will likely crash the IRCd sooner or later if you /REHASH with any active clients connected. We suggest everyone who is running UnrealIRCd 6 to upgrade to 6.0.3. Fixes: * Crash in `WATCH` if the IRCd has been rehashed at least once. After doing a `REHASH` with active clients it will likely corrupt memory. It may take several days until after the rehash for the crash to occur, or even weeks/months on smaller networks (accidental triggering, that is). * A `REHASH` with certain remote includes setups could cause a crash or other weird and confusing problems such as complaining about unable to open an ipv6-database or missing snomask configuration. This only affected some people with remote includes, not all. * Potential out-of-bounds write in sending code. In practice it seems harmless on most servers but this cannot be 100% guaranteed. * Unlikely triggered log message would log uninitialized stack data to the log file or send it to ircops. * Channel ops could not remove halfops from a user (`-h`). * After using the `RESTART` command (not recommended) the new IRCd was often no longer writing to log files. * Fix compile problem if you choose to use cURL remote includes but don't have cURL on the system and ask UnrealIRCd to compile cURL. Enhancements: * The default text log format on disk changed. It now includes the server name where the event was generated. Without this, it was sometimes difficult to trace problems, since previously it sometimes looked like there was a problem on your server when it was actually another server on the network. * Old log format: `[DATE TIME] subsystem.EVENT_ID loglevel: ........` * New log format: `[DATE TIME] servername subsystem.EVENT_ID loglevel: ........` Changes: * Any MOTD lines added by services via [`SVSMOTD`](https://www.unrealircd.org/docs/MOTD_and_Rules#SVSMOTD) are now shown at the end of the MOTD-on-connect (unless using a shortmotd). Previously the lines were only shown if you manually ran the `MOTD` command. Developers and protocol: * `LIST Cchname` is `channel->name` now. * get_channel() is now make_channel() and creates if needed, otherwise use find_channel() * The Extended Ban API has been changed a lot. We use a `BanContext` struct now that we pass around a lot. You also don't need to do `+3` magic anymore on the string as it is handled in another layer. When registering the extended ban, `.flag` is now `.letter`, and you also need to set a `.name` to a string due to named extended bans. Have a look at the built-in extban modules to see how to handle the changes. * ModData now has an option `MODDATA_SYNC_EARLY`. See under *Server protocol*. * If you want to lag someone up, don't touch `client->since`, but instead use: `add_fake_lag(client, msec)` * Some client/user struct changes, with `client->user->account` (instead of svid) and `client->uplink->name` being the most important ones. * Possibly more, but above is like 90%+ of the changes that you will encounter. Server protocol ---------------- * When multiple related `SJOIN` messages are generated for the same channel then we now only send the current channel modes (eg `+sntk key`) in the first SJOIN and not in the other ones as they are unneeded for the immediate followup SJOINs, they waste unnecessary bytes and CPU. Such messages may be generated when syncing a channel that has dozens of users and/or bans/exempts/invexes. Ideally this should not need any changes in other software, since we already supported such messages in the past and code for handling it exists way back to 3.2.x, but you better check to be sure! * If you send `PROTOCTL NEXTBANS` then you will receive extended bans with Named EXTended BANs instead of letters (eg: `+b ~account:xyz`), otherwise you receive them with letters (eg: `+b ~a:xyz`). * Some ModData of users is (also) communicated in the `UID` message while syncing using a message tag that only appears in server-to-server traffic, `s2s-md/moddataname=value`. Thus, data such as operinfo, tls cipher, geoip, certfp, sasl and webirc is communicated at the same time as when a remote connection is added. This makes it that a "connecting from" server notice can include all this information and also so code can make an immediate decission on what to do with the user in hooks. ModData modules need to set `mreq.sync = MODDATA_SYNC_EARLY;` if they want this. Servers of course need to enable `MTAGS` in PROTOCTL to see this. * The `SLOG` command is used to broadcast logging messages. This is done for log::destination remote, as used in doc/conf/snomasks.default.conf, for example for link errors, oper ups, flood messages, etc. It also includes all JSON data in a message tag when `PROTOCTL MTAGS` is used. * Bounced modes are gone: these were MODEs that started with a `&` which servers were to act on with reversed logic (add becoming remove and vice versa) and never to send something back to that server. In practice this was almost never used and complicated the code (way) too much. Client protocol ---------------- * Extended bans now have names instead of letters. If a client sends the old format with letters (eg `+b ~a:XYZ`) then the server will convert it to the new format with names (eg: `+b ~account:XYZ`) * Support for `MONITOR` and the other IRCv3 features (see *Enhancements*)