pegasus/unrealircd
1
0
Fork 0
mirror of https://github.com/unrealircd/unrealircd.git synced 2026-07-08 00:03:12 +02:00
Code Activity

More release notes updates

Browse Source 
(also.. sigh.. have mentioned twice now that we 'disable TLSv1.2' when
 instead i meant to write 'require at least TLSv1.2'... ah well...)
[skip ci]
This commit is contained in:
Bram Matthys
2024-11-17 13:52:02 +01:00
parent 170a27e160
commit e0ec8dd720
1 changed files with 13 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/RELEASE-NOTES.md
+13 -11
View File
@@ -4,21 +4,23 @@ This is the git version.
This release fixes a number of bugs such as IPv6 hosts not resolving
in UnrealIRCd 6.1.8/6.1.8.1 and 100% CPU usage in some circumstances.
It also changes the SSL/TLS defaults to make things a little safer/better.
### Enhancements:
* SSL/TLS:
* [By default](https://www.unrealircd.org/docs/TLS_Ciphers_and_protocols)
only allow AES in GCM mode and no longer in CBC mode.
* When using cURL for remote includes we now explicitly set the minimum
required version to TLSv1.2 and set our default ciphers and ciphersuites.
* Change [default TLS ciphers](https://www.unrealircd.org/docs/TLS_Ciphers_and_protocols)
to only allow AES in GCM mode and no longer in CBC mode.
* When using cURL for [remote includes](https://www.unrealircd.org/docs/Remote_includes)
we now explicitly set the minimum required version to TLSv1.2 and set our
default ciphers and ciphersuites.
Note that by default in UnrealIRCd 6 the built-in (non-cURL) implementation
is used for remote includes, which already used these defaults.
Also note that most distros, like Ubuntu and Debian, already disabled
TLSv1.2 effectively in cURL.
* Regarding ecdh-curves with the default configuration: we now try setting
the curves list to `x25519:secp521r1:secp384r1:prime256v1` first, and if
that fails then we try `secp521r1:secp384r1:prime256v1`. The former could
fail due to SSL library restrictions (old library or when in FIPS mode).
Also note that most distros, like Ubuntu and Debian, already required
TLSv1.2 or later effectively in cURL.
* Regarding default ecdh-curves: we now try to set the curves list to
`x25519:secp521r1:secp384r1:prime256v1` first, and if that fails then
we try `secp521r1:secp384r1:prime256v1`. The former could fail due to
SSL library restrictions (old library or when in FIPS mode).
Previously we were also supposed to do it like that, but due to a bug
always had X25519 turned off.
@@ -38,7 +40,7 @@ in UnrealIRCd 6.1.8/6.1.8.1 and 100% CPU usage in some circumstances.
[Extended server bans](https://www.unrealircd.org/docs/Extended_server_bans)
### Developers and protocol:
* No changes
* No changes, other than the SSL/TLS changes mentioned earlier.
UnrealIRCd 6.1.8.1
-------------------