From 37dbdfeee3a7bbeb1d10f620ec64a7ce1d9c17ec Mon Sep 17 00:00:00 2001 From: Bram Matthys Date: Sun, 1 Oct 2017 19:37:29 +0200 Subject: [PATCH] Bump version to 4.0.16-devel. This version is under development. You should always use https://www.unrealircd.org/ for stable releases. In case you wondered what happened with 4.0.15: that version consists of cherry-picked / backports of the two crash fixes from this 'unreal40' development branch. The current code simply wasn't ready yet for a rushed security release. --- .CHANGES.NEW | 2 +- Config | 2 +- configure | 22 ++++++------ configure.ac | 6 ++-- doc/RELEASE-NOTES | 77 ++++++---------------------------------- doc/RELEASE-NOTES.old | 69 +++++++++++++++++++++++++++++++++++ include/win32/setup.h | 4 +-- src/version.c.SH | 2 +- src/win32/unrealinst.iss | 2 +- 9 files changed, 99 insertions(+), 87 deletions(-) diff --git a/.CHANGES.NEW b/.CHANGES.NEW index 344e73513..68d0b46ad 100644 --- a/.CHANGES.NEW +++ b/.CHANGES.NEW @@ -7,7 +7,7 @@ \___/|_| |_|_| \___|\__,_|_|\___/\_| \_| \____/\__,_| Configuration Program - for UnrealIRCd 4.0.14 + for UnrealIRCd 4.0.16-devel This program will help you to compile your IRC server, and ask you questions regarding the compile-time settings of it during the process. diff --git a/Config b/Config index b2649c075..f323835aa 100755 --- a/Config +++ b/Config @@ -452,7 +452,7 @@ echo "" if [ -z "$NOCACHE" ] ; then # This needs to be updated each release so auto-upgrading works for settings, modules, etc!!: - UNREALRELEASES="unrealircd-4.0.14-rc1 unrealircd-4.0.13 unrealircd-4.0.13-rc1 unrealircd-4.0.12.1 unrealircd-4.0.12 unrealircd-4.0.11 unrealircd-4.0.10 unrealircd-4.0.9 unrealircd-4.0.8.4 unrealircd-4.0.8.3 unrealircd-4.0.8.2 unrealircd-4.0.8.1 unrealircd-4.0.8 unrealircd-4.0.7 unrealircd-4.0.6 unrealircd-4.0.5 unrealircd-4.0.4 unrealircd-4.0.3.1" + UNREALRELEASES="unrealircd-4.0.14 unrealircd-4.0.14-rc1 unrealircd-4.0.13 unrealircd-4.0.13-rc1 unrealircd-4.0.12.1 unrealircd-4.0.12 unrealircd-4.0.11 unrealircd-4.0.10 unrealircd-4.0.9 unrealircd-4.0.8.4 unrealircd-4.0.8.3 unrealircd-4.0.8.2 unrealircd-4.0.8.1 unrealircd-4.0.8 unrealircd-4.0.7 unrealircd-4.0.6 unrealircd-4.0.5 unrealircd-4.0.4 unrealircd-4.0.3.1" if [ -f "config.settings" ]; then . ./config.settings else diff --git a/configure b/configure index e6c5f7aa5..3dc64612c 100755 --- a/configure +++ b/configure @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.69 for unrealircd 4.0.14. +# Generated by GNU Autoconf 2.69 for unrealircd 4.0.16-devel. # # Report bugs to . # @@ -580,8 +580,8 @@ MAKEFLAGS= # Identity of this package. PACKAGE_NAME='unrealircd' PACKAGE_TARNAME='unrealircd' -PACKAGE_VERSION='4.0.14' -PACKAGE_STRING='unrealircd 4.0.14' +PACKAGE_VERSION='4.0.16-devel' +PACKAGE_STRING='unrealircd 4.0.16-devel' PACKAGE_BUGREPORT='http://bugs.unrealircd.org/' PACKAGE_URL='http://unrealircd.org/' @@ -1318,7 +1318,7 @@ if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures unrealircd 4.0.14 to adapt to many kinds of systems. +\`configure' configures unrealircd 4.0.16-devel to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1383,7 +1383,7 @@ fi if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of unrealircd 4.0.14:";; + short | recursive ) echo "Configuration of unrealircd 4.0.16-devel:";; esac cat <<\_ACEOF @@ -1535,7 +1535,7 @@ fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -unrealircd configure 4.0.14 +unrealircd configure 4.0.16-devel generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. @@ -2141,7 +2141,7 @@ cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by unrealircd $as_me 4.0.14, which was +It was created by unrealircd $as_me 4.0.16-devel, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ @@ -2550,7 +2550,7 @@ _ACEOF # Minor version number (e.g.: Z in X.Y.Z) -UNREAL_VERSION_MINOR="14" +UNREAL_VERSION_MINOR="16" cat >>confdefs.h <<_ACEOF #define UNREAL_VERSION_MINOR $UNREAL_VERSION_MINOR @@ -2560,7 +2560,7 @@ _ACEOF # The version suffix such as a beta marker or release candidate # marker. (e.g.: -rcX for unrealircd-3.2.9-rcX). This macro is a # string instead of an integer because it contains arbitrary data. -UNREAL_VERSION_SUFFIX="" +UNREAL_VERSION_SUFFIX="-devel" cat >>confdefs.h <<_ACEOF #define UNREAL_VERSION_SUFFIX "$UNREAL_VERSION_SUFFIX" @@ -9085,7 +9085,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by unrealircd $as_me 4.0.14, which was +This file was extended by unrealircd $as_me 4.0.16-devel, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -9148,7 +9148,7 @@ _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -unrealircd config.status 4.0.14 +unrealircd config.status 4.0.16-devel configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" diff --git a/configure.ac b/configure.ac index bdce7a400..a5ede847e 100644 --- a/configure.ac +++ b/configure.ac @@ -8,7 +8,7 @@ dnl src/win32/unrealinst.iss dnl .CHANGES.NEW dnl src/version.c.SH -AC_INIT([unrealircd], [4.0.14], [http://bugs.unrealircd.org/], [], [http://unrealircd.org/]) +AC_INIT([unrealircd], [4.0.16-devel], [http://bugs.unrealircd.org/], [], [http://unrealircd.org/]) AC_CONFIG_SRCDIR([src/ircd.c]) AC_CONFIG_HEADER([include/setup.h]) AC_CONFIG_AUX_DIR([autoconf]) @@ -36,13 +36,13 @@ UNREAL_VERSION_MAJOR=["0"] AC_DEFINE_UNQUOTED([UNREAL_VERSION_MAJOR], [$UNREAL_VERSION_MAJOR], [Major version number (e.g.: Y for X.Y.Z)]) # Minor version number (e.g.: Z in X.Y.Z) -UNREAL_VERSION_MINOR=["14"] +UNREAL_VERSION_MINOR=["16"] AC_DEFINE_UNQUOTED([UNREAL_VERSION_MINOR], [$UNREAL_VERSION_MINOR], [Minor version number (e.g.: Z for X.Y.Z)]) # The version suffix such as a beta marker or release candidate # marker. (e.g.: -rcX for unrealircd-3.2.9-rcX). This macro is a # string instead of an integer because it contains arbitrary data. -UNREAL_VERSION_SUFFIX=[""] +UNREAL_VERSION_SUFFIX=["-devel"] AC_DEFINE_UNQUOTED([UNREAL_VERSION_SUFFIX], ["$UNREAL_VERSION_SUFFIX"], [Version suffix such as a beta marker or release candidate marker. (e.g.: -rcX for unrealircd-3.2.9-rcX)]) AC_PROG_CC diff --git a/doc/RELEASE-NOTES b/doc/RELEASE-NOTES index abc09b834..6379d2be6 100644 --- a/doc/RELEASE-NOTES +++ b/doc/RELEASE-NOTES @@ -1,74 +1,17 @@ -UnrealIRCd 4.0.14 Release Notes +UnrealIRCd 4.0.16-devel Release Notes ================================ -==[ CHANGES BETWEEN 4.0.13 AND 4.0.14 ]== -Enhancements: -* New set::plaintext-policy configuration settings. This defines what - happens to users/ircops/servers that are not using SSL/TLS. - The default settings are: - set { - plaintext-policy { - user allow; /* allow any user to connect */ - oper warn; /* warn on /OPER if not using SSL/TLS */ - server deny; /* deny servers without SSL/TLS, except localhost */ - }; - }; - You can change each of the three classes to 'allow', 'warn' or 'deny'. - See: https://www.unrealircd.org/docs/Set_block#set::plaintext-policy - If your services do not run on localhost and link without SSL/TLS - then you may get an error during linking. In such a case check out: - https://www.unrealircd.org/docs/FAQ#ERROR:_Servers_need_to_use_SSL.2FTLS -* You can now ask UnrealIRCd to verify certificates of server links by: - link irc1.test.net { - [..] - verify-certificate yes; - }; - This will verify the certificate of the link, making sure it is valid, - issued for the specified name (irc1.test.net) and given out by a - trusted Certificate Authority (like Let's Encrypt). - Obviously, if you use self-signed certificates then you can't use this. -* Introduce a concept called "link security level". This will rate the - security of your network from 0 to 2. Whenever security is degraded - due to a new server link UnrealIRCd will print a warning about it. - See https://www.unrealircd.org/docs/Link_security - This also adds a new command /LINKSECURITY (IRCop-only). -* The plaintext-policy and link-security is shown in "CAP LS". +==[ CHANGES BETWEEN 4.0.15 AND 4.0.16 ]== +UnrealIRCd 4.0.16 is not released yet. It is in development. + +==[ CHANGES BETWEEN 4.0.14 AND 4.0.15 ]== Major issues fixed: -* None - -Minor issues fixed: -* If you had a link block named irc1.example.net and did an outgoing - connect to that server, then the server could introduce himself under - a different name, such as irc1.other.net. Not a security issue, since - all authentication has to be passed, but this could cause confusing - autoconnect attempts. -* password::sslclientcert did not accept relative paths -* Compile problem with LibreSSL (regarding SSL_CTX_get0_param) -* set::modes-on-connect: was refusing certain (old) modes like +N - -Other changes: -* The ssl options 'verify-certificate' and 'no-self-signed' have been - removed. Use link::verify-certificate instead. It makes no sense to - verify certificates or prevent self signed certificates elsewhere - such as in vhost or oper, since there is no hostname to match against. -* Weak cipher suites such as 3DES and RC4 are disabled by default but - previously you could still enable them through set::ssl::ciphers. - Now you can no longer, since there is no legitimate reason to do so. -* Update cipher suite to work with TLS 1.3. This ensures you can use - TLS 1.3 in UnrealIRCd 4.0.14+ when OpenSSL supports it (in the future). -* Bump MODDATA_MAX_CLIENT from 8 to 12: needed if you have a lot of - 3rd party modules loaded. Also moved MODDATA_MAX_* to include/config.h - -Module coders: -* You can now attach ModData to server objects as well (including &me). -* Please do not use UmodeDel, CmdoverrideDel and any other *Del() - functions from MOD_UNLOAD. These undocumented functions are unnecessary - since 2008 or so. UnrealIRCd takes care of unloading all module objects. - It can cause a crash if someone unloads the module in UnrealIRCd 4 - (more specifically: double free if unloading modules which use ModData). - Attempts to use these functions in future UnrealIRCd versions may result - in a compile error. +* Fix remotely triggerable crash issue in handshake. This allows a user + to crash an UnrealIRCd server, even those with restrictions such as + password protected hubs. +* Fix another remotely triggerable crash issue. This one requires the + user to connect, join a channel and have channel operator privileges. ==[ CHANGES IN OLDER RELEASES ]== For changes in previous UnrealIRCd releases see doc/RELEASE-NOTES.old or diff --git a/doc/RELEASE-NOTES.old b/doc/RELEASE-NOTES.old index 03653bd6a..1d8f56462 100644 --- a/doc/RELEASE-NOTES.old +++ b/doc/RELEASE-NOTES.old @@ -3,6 +3,75 @@ See doc/RELEASE-NOTES for the latest release notes. This file (doc/RELEASE-NOTES.old) contains the release notes of OLDER releases for historical purposes. +==[ CHANGES BETWEEN 4.0.13 AND 4.0.14 ]== +Enhancements: +* New set::plaintext-policy configuration settings. This defines what + happens to users/ircops/servers that are not using SSL/TLS. + The default settings are: + set { + plaintext-policy { + user allow; /* allow any user to connect */ + oper warn; /* warn on /OPER if not using SSL/TLS */ + server deny; /* deny servers without SSL/TLS, except localhost */ + }; + }; + You can change each of the three classes to 'allow', 'warn' or 'deny'. + See: https://www.unrealircd.org/docs/Set_block#set::plaintext-policy + If your services do not run on localhost and link without SSL/TLS + then you may get an error during linking. In such a case check out: + https://www.unrealircd.org/docs/FAQ#ERROR:_Servers_need_to_use_SSL.2FTLS +* You can now ask UnrealIRCd to verify certificates of server links by: + link irc1.test.net { + [..] + verify-certificate yes; + }; + This will verify the certificate of the link, making sure it is valid, + issued for the specified name (irc1.test.net) and given out by a + trusted Certificate Authority (like Let's Encrypt). + Obviously, if you use self-signed certificates then you can't use this. +* Introduce a concept called "link security level". This will rate the + security of your network from 0 to 2. Whenever security is degraded + due to a new server link UnrealIRCd will print a warning about it. + See https://www.unrealircd.org/docs/Link_security + This also adds a new command /LINKSECURITY (IRCop-only). +* The plaintext-policy and link-security is shown in "CAP LS". + +Major issues fixed: +* None + +Minor issues fixed: +* If you had a link block named irc1.example.net and did an outgoing + connect to that server, then the server could introduce himself under + a different name, such as irc1.other.net. Not a security issue, since + all authentication has to be passed, but this could cause confusing + autoconnect attempts. +* password::sslclientcert did not accept relative paths +* Compile problem with LibreSSL (regarding SSL_CTX_get0_param) +* set::modes-on-connect: was refusing certain (old) modes like +N + +Other changes: +* The ssl options 'verify-certificate' and 'no-self-signed' have been + removed. Use link::verify-certificate instead. It makes no sense to + verify certificates or prevent self signed certificates elsewhere + such as in vhost or oper, since there is no hostname to match against. +* Weak cipher suites such as 3DES and RC4 are disabled by default but + previously you could still enable them through set::ssl::ciphers. + Now you can no longer, since there is no legitimate reason to do so. +* Update cipher suite to work with TLS 1.3. This ensures you can use + TLS 1.3 in UnrealIRCd 4.0.14+ when OpenSSL supports it (in the future). +* Bump MODDATA_MAX_CLIENT from 8 to 12: needed if you have a lot of + 3rd party modules loaded. Also moved MODDATA_MAX_* to include/config.h + +Module coders: +* You can now attach ModData to server objects as well (including &me). +* Please do not use UmodeDel, CmdoverrideDel and any other *Del() + functions from MOD_UNLOAD. These undocumented functions are unnecessary + since 2008 or so. UnrealIRCd takes care of unloading all module objects. + It can cause a crash if someone unloads the module in UnrealIRCd 4 + (more specifically: double free if unloading modules which use ModData). + Attempts to use these functions in future UnrealIRCd versions may result + in a compile error. + ==[ CHANGES BETWEEN 4.0.12 AND 4.0.13 ]== Enhancements: * Support for Strict Transport Security (draft/sts). diff --git a/include/win32/setup.h b/include/win32/setup.h index c6c6c2dfd..d511f1472 100644 --- a/include/win32/setup.h +++ b/include/win32/setup.h @@ -84,10 +84,10 @@ #define UNREAL_VERSION_MAJOR 0 /* Minor version number (e.g.: 1 for Unreal3.2.1) */ -#define UNREAL_VERSION_MINOR 14 +#define UNREAL_VERSION_MINOR 16 /* Version suffix such as a beta marker or release candidate marker. (e.g.: -rcX for unrealircd-3.2.9-rcX) */ -#define UNREAL_VERSION_SUFFIX "" +#define UNREAL_VERSION_SUFFIX "-devel" #endif diff --git a/src/version.c.SH b/src/version.c.SH index c266da733..d264e6c04 100644 --- a/src/version.c.SH +++ b/src/version.c.SH @@ -4,7 +4,7 @@ echo "Extracting src/version.c..." #id=`grep '$Id: Changes,v' ../Changes` #id=`echo $id |sed 's/.* Changes\,v \(.*\) .* Exp .*/\1/'` -id="4.0.14" +id="4.0.16-devel" echo "$id" if test -r version.c diff --git a/src/win32/unrealinst.iss b/src/win32/unrealinst.iss index 2c5169afa..0d76949d3 100644 --- a/src/win32/unrealinst.iss +++ b/src/win32/unrealinst.iss @@ -6,7 +6,7 @@ [Setup] AppName=UnrealIRCd 4 -AppVerName=UnrealIRCd 4.0.14 +AppVerName=UnrealIRCd 4.0.16-devel AppPublisher=UnrealIRCd Team AppPublisherURL=https://www.unrealircd.org AppSupportURL=https://www.unrealircd.org