1
0
mirror of https://github.com/unrealircd/unrealircd.git synced 2026-06-27 21:56:38 +02:00
Commit Graph

6680 Commits

Author SHA1 Message Date
Bram Matthys f92a6fec79 Release notes: clarify flood limit in older versions
@skip-ci
2019-02-06 12:17:47 +01:00
Bram Matthys 70a9a6f6b2 Added INVITE and KNOCK flood protection (command rate limiting).
set::anti-flood::invite-flood defaults to 4 per 60 seconds.
set::anti-flood::knock-flood defaults to 4 per 120 seconds.
2019-02-06 12:00:51 +01:00
Bram Matthys 57f97a5a43 Removed a debugging message and fixed TARGMAX being broken after a REHASH. 2019-02-06 09:24:31 +01:00
Bram Matthys 1e1f750b44 New set::max-targets-per-command which configures the maximum number
of targets accepted for a command, eg /MSG nick1,nick2,nick3,nick4 hi.
Also changed the following defaults (previously hardcoded):
* PRIVMSG from 20 to 4 targets, to counter /amsg spam
* NOTICE from 20 to 1 target, to counter /anotice spam
* KICK from 1 to 4 targets, to make it easier for channel operators
  to quickly kick a large amount of spambots
See https://www.unrealircd.org/docs/Set_block#set::max-targets-per-command

(actually still need to write the documentation)
2019-02-04 17:51:09 +01:00
Bram Matthys 1e6d8ea536 Fix compile problem due to previous commit. 2019-02-04 14:42:17 +01:00
Bram Matthys 9f4296d648 New set::anti-flood::max-concurrent-conversations which configures the
maximum number of conversations a user can have with other users at the
same time. Until now this was hardcoded at limiting /MSG and /INVITE to
20 different users in a 15 second period. The new default is 10 users,
which serves as a protection measure against spambots.
See https://www.unrealircd.org/docs/Set_block#maxcc for more details.
2019-02-04 09:52:08 +01:00
Bram Matthys 7153468081 UnrealIRCd will now warn if your ulines { } are matching UnrealIRCd servers.
See https://www.unrealircd.org/docs/FAQ#WARNING:_Bad_ulines
2019-02-02 08:44:14 +01:00
Bram Matthys be50ef4a1e Get rid of warning on-boot "Channel modes changed at runtime" 2019-02-02 07:53:07 +01:00
Bram Matthys f9415e1a91 m_whox: now accept and transform most classic UnrealIRCd WHO requests
such as "WHO +s serv.er.name" to "WHO serv.er.name s".
It also does advanced transformation such as "WHO -m z" to "WHO -z m"
**copy paste from comment in code**
Flag a: user is away                                            << no longer exists
Flag c <channel>: user is on <channel>                          << no longer exists
Flag g <gcos/realname>: user has string <gcos> in his/her GCOS  << now called 'r'
Flag h <host>: user has string <host> in his/her hostname       << no change
Flag i <ip>: user has string <ip> in his/her IP address         << no change
Flag m <usermodes>: user has <usermodes> set                    << behavior change
Flag n <nick>: user has string <nick> in his/her nickname       << no change
Flag s <server>: user is on server <server>                     << no change
Flag u <user>: user has string <user> in his/her username       << no change
Behavior flags:
Flag M: check for user in channels I am a member of             << no longer exists
Flag R: show users' real hostnames                              << no change (re-added)
Flag I: show users' IP addresses                                << no change (re-added)
**end of paste**
Of course we cannot convert 100% from classic UnrealIRCd WHO to WHOX-style
because things like "WHO +m r" could mean either "search for +m in realname" (WHOX)
or "search for +r in modes" (classic). In cases like this we assume WHOX, so to not
break any WHOX compatibility.

Added matchers: 'R' (show real host) and 'I' (show IP)

This code will need more testing, both by classic WHO and by WHOX users...
2019-02-01 17:46:59 +01:00
Bram Matthys eecd29bdc8 WHOX: adaptions for UnrealIRCd part 1:
* No longer require a ! prefix for ircops to see users
* "WHO *" is no longer different than the rest
  (previously in m_whox would only list users on 1st channel)
Neither is part of the WHOX specs.
2019-02-01 15:21:53 +01:00
Bram Matthys 52e72c2ed9 Update reference to RELEASE-NOTES.old (link used wrong branch) 2019-02-01 14:27:07 +01:00
Bram Matthys 1790efd05d The message sent to users upon *LINE can now be adjusted completely via
set::reject-message::kline and set::reject-message::gline.
See https://www.unrealircd.org/docs/Set_block#set::reject-message
Suggested by k4be in https://bugs.unrealircd.org/view.php?id=5198
2019-02-01 14:25:52 +01:00
Bram Matthys ff9ca3c8ef Add 005 token DEAF=d 2019-01-31 17:47:06 +01:00
Bram Matthys a999b305a5 Remove 005 CMDS= token, which was an unnecessary abstraction and was
not picked up by any other IRCd. The 005 tokens KNOCK MAP USERIP are
now used instead. We do not announce STARTTLS in 005 anymore as this
is way too late (post-handshake, sensitive info already sent and/or
received). Not to mention STARTTLS is not the preferred method to
setup a secure connection in the first place.
Module coders: this means CommandAdd() with M_ANNOUNCE should no
longer be used. If a 3rd party module does use it, then UnrealIRCd
will now raise a warning. In a later UnrealIRCd version the flag
is likely to be removed completely so would cause a compile error.
(I doubt any module uses this anyway... but still..)
2019-01-31 17:34:07 +01:00
Bram Matthys 6cbd2744d7 * The default maximum topic length has been increased from 307 to 360.
* You can now set more custom limits. The default settings are shown below:
  set {
      topic-length 360; /* maximum: 360 */
      away-length 307; /* maximum: 360 */
      quit-length 307; /* maximum: 395 */
      kick-length 307; /* maximum: 360 */
  };
* A new 005 token has been added: QUITLEN. Works similar to KICKLEN.

The ability to adjust the topic length in the configuration file was
requested by Amiga600 in https://bugs.unrealircd.org/view.php?id=4692
At that place is also additional information on why there is a
"maximum" for topic length.
2019-01-30 17:50:17 +01:00
Bram Matthys 41239119f8 Update release notes a bit. 2019-01-30 16:54:56 +01:00
Bram Matthys 88030c63fb 1) Simplify dealing with isupport (numeric 005) stuff from the config code.
There's now no longer a difference between a rehash or boot.
2) Other cleanups in s_conf.c as well. Looks better now.
3) Sort the 005 tokens alphabetically. Enforcing some other 'logical order'
   was futile and this makes things consistent between rehashes.

For module coders this adds some new functions, such as IsupportSet,
IsupportSetFmt and IsupportDelByName. I'll document them later.
2019-01-30 16:42:19 +01:00
Bram Matthys 98fca7979f Code cleanup: internally rename iConf.nicklen to .nick_length to match the
convention that set::some-name is called iConf.some_name
2019-01-30 10:49:44 +01:00
Bram Matthys 5eaa711969 Update release notes to reflect current state. 2019-01-28 16:06:59 +01:00
Bram Matthys d085fb09c1 Three new config items to make topic and ban setter nick!user@host and
to control synchronization of the +beI setter across server links
(that is, the feature just introduced one commit ago):
set {
     topic-setter [nick|nick-user-host]; /* nick = default */
     ban-setter [nick|nick-user-host]; /* nick = default */
     ban-setter-sync [yes|no]; /* yes = default */
};
This also means that --with-topicisnuhost / TOPIC_NICK_IS_NUHOST
is now removed, since this now goes via set::topic-setter.

Also, moved the "first" PROTOCTL from include/common.h to send_proto()
in src/s_serv.c so the bunch of PROTOCTL lines is all in one place
(and so I could conditionally send SJSBY).
Ok, it's not entirely all in one place, PROTOCTL EAUTH is still sent
at another place (early, duh), but still..
2019-01-28 15:41:44 +01:00
Bram Matthys 874d99e0eb For +beI lists the 'set by' and 'set at' information is now synchronized
when servers link. Thus, you can see the real setter and time also after
a netsplit (/mode #channel b). This, unlike before, when setby was
name.of.server and time was the time of the synch.
This requires the entire network to run UnrealIRCd 4.2.2 or later.
Suggested by k4be in https://bugs.unrealircd.org/view.php?id=5183
Technical details: the PROTOCTL token to enable this is "SJSBY" and see
https://www.unrealircd.org/docs/Server_protocol:SJOIN_command for more
information, in particular the last section there.
2019-01-28 14:36:41 +01:00
Bram Matthys 4aa2d47deb Run test framework with a hub in-between to test command propagation. 2019-01-28 09:29:44 +01:00
Bram Matthys ed1f47f80a Can't stand http:// URLs... 2019-01-25 20:50:05 +01:00
Bram Matthys 2a3dd0e350 what is this 'return 0' doing here... 2019-01-23 16:36:42 +01:00
Bram Matthys ac9463a83f Rename hook HOOKTYPE_CAN_SEND_SECURE to HOOKTYPE_SEND_CHANNEL, which is
more descriptive and AFAICT nobody uses this hook in a public 3rd party
module anyway.
2019-01-21 17:02:14 +01:00
Bram Matthys 083826ee94 modules/usermodes/noctcp (+T): 1) only block CTCP's and not CTCP REPLIES,
2) allow IRCOps to bypass user mode +T restrictions. Reported by St3Nl3y,
HeXiLeD and Koragg in https://bugs.unrealircd.org/view.php?id=5166
2019-01-21 16:55:29 +01:00
Bram Matthys ee20160bc3 Add another type for HOOKTYPE_CONFIGTEST and HOOKTYPE_CONFIGRUN
for CONFIG_LISTEN. This so a module can have custom options in
the listen block. Like all other CONFIG_* options you are supposed
to return 1 if your module handles this option and 0 if not.
From HOOKTYPE_CONFIGTEST you can also return -1 to indicate error
for an option that is handled by the module.
Note that 'cep' is passed, that is the option for the variable
that is being checked, and not the 'ce', the parent of the listen
block. If you want to access the parent, then use ce->ce_prevlevel.
2019-01-21 13:55:20 +01:00
Bram Matthys 7a3ba05c03 Similar to previous commit, fix resolving of temporary modules (.so files)
in crash reports as well... and make them in English, regardless of the
users' locale... better for us ;)
2019-01-21 13:37:52 +01:00
Bram Matthys 6fcacdf148 Fix './unrealircd backtrace' not working correctly in non-English environments.
The script symlinks any missing tmp/xxxx.so's to the real module name but
depends on English statements (ugly, yeah, but it works). With a non-English
locale this did previously not work so the backtrace was screwed.
2019-01-21 13:30:15 +01:00
Bram Matthys 41e6d5b7e9 Fix for strangely formatted 'creation date' if compiled with certain locales.
Reported by k4be.
2019-01-21 13:26:22 +01:00
Bram Matthys bcb667c59e New hook HOOKTYPE_WELCOME (aClient *acptr, int after_numeric): allows you
to send a message at very specific places during the initial welcome
https://www.unrealircd.org/docs/Dev:Hook_API#HOOKTYPE_WELCOME
2019-01-21 10:12:46 +01:00
Bram Matthys 25ede84a04 This makes more sense. Also testing announcement bot :D 2019-01-21 10:10:51 +01:00
Bram Matthys c726df5758 Travis-CI: The job exceeded the maximum log length, and has been terminated.
Fantastic. https://github.com/travis-ci/travis-ci/issues/1382
2019-01-18 15:31:14 +01:00
Bram Matthys 013dd06aee Travis-CI: End of argh. 2019-01-18 14:45:55 +01:00
Bram Matthys 3bacb28555 Travis-CI: no comment 2019-01-18 14:24:19 +01:00
Bram Matthys 8a9971618f Travis-CI: ..or without sudo..
I really love this..
2019-01-18 14:05:45 +01:00
Bram Matthys 3e3da94a41 Travis-CI: new image, have to install bundler again. 2019-01-18 14:00:00 +01:00
Bram Matthys 4d5e627b27 Update release notes: * New set::outdated-tls-policy which describes what to
do with clients that use outdated SSL/TLS protocols (eg: TLSv1.0) and
ciphers.  The default settings are to warn in all cases: users connecting,
opers
/OPER'ing up and servers linking in.  The user will see a message telling
them to upgrade their IRC client.  This should help with migrating such
users, since in the future, say one or two years from now, we would want to
change the default to only allow TSLv1.2+ with ciphers that provide Forward
Secrecy.  Instead of rejecting clients without any error message, this
provides a way to warn them and give them some time to upgrade their
outdated IRC client.
https://www.unrealircd.org/docs/Set_block#set::outdated-tls-policy
2019-01-18 13:38:14 +01:00
Bram Matthys 425571a8d2 Update UnrealIRCd version to 4.2.2-dev 2019-01-18 13:22:58 +01:00
Bram Matthys e82dbdce1a Update doc/RELEASE-NOTES.old. Now contains 4.2.0 and 4.2.1 release notes,
I forgot the 4.2.0 one earlier..
2019-01-18 13:20:28 +01:00
Bram Matthys 4681603c52 Fix bug where "link-security" was downgraded to level 1 if using 'spkifp'. 2019-01-18 13:10:51 +01:00
Bram Matthys 778be86c66 Update HELPOP EXTBANS on ~t (timed bans), ~m (msgbypass) and ~T (textban)
since these are loaded by default since UnrealIRCd 4.2.0.
2019-01-14 15:10:23 +01:00
Bram Matthys f4b432ae94 Add RC4 and 3DES to set::ssl::outdated-ciphers, in case anyone uses some
insecure custom ::ciphers setting, this so RC4 and 3DES still get flagged.
2019-01-12 11:29:16 +01:00
Bram Matthys 67d691fce9 * New set::outdated-tls-policy which describes what to do with clients
that use outdated SSL/TLS protocols (eg: TLSv1.0) and ciphers.
  The default settings are to warn in all cases: users connecting,
  opers /OPER'ing up and servers linking in. The user will see a message
  telling them to upgrade their IRC client.
  This should help with migrating such users since in the future, say one
  or two years from now, we would want to change the default to only allow
  TSLv1.2+ with ciphers that provide Forward Secrecy. Instead of rejecting
  clients without any error message, this provides a way to warn them and
  give them some time to upgrade their outdated IRC client.
  https://www.unrealircd.org/docs/Set_block#set::outdated-tls-policy
2019-01-12 11:08:18 +01:00
Bram Matthys 8e7a085474 AppArmor profile in extras/security/apparmor: no changes but make it
clear that this has been tested on Ubuntu 16.04 and Ubuntu 18.04.
2019-01-12 10:52:05 +01:00
Bram Matthys 5fd673d059 Rename PLAINTEXT_POLICY_* to POLICY_ (and similarly, the struct, etc) 2019-01-11 13:27:29 +01:00
Bram Matthys a1d2698ead Provide get_ssl_options_for_client() to get the SSLOptions * for a client. 2019-01-11 13:16:09 +01:00
Bram Matthys b0c8629284 Travis-CI: remove TLS test for libressl-25 (no longer supported)
[skip ci]
2019-01-11 12:34:43 +01:00
Bram Matthys 72a3a445ee Travis-CI: Update OpenSSL and LibreSSL versions
* Remove LibreSSL versions that are no longer supported (2.5.x and 2.6.x).
* Add LibreSSL 2.8.x (current stable) and 2.9.x (current dev)
* OpenSSL releases only had updates in their 'letter suffixes'
2019-01-11 11:54:13 +01:00
Bram Matthys 9668aaaade Travis-CI: Rename .txt files to match $BUILDCONFIG 2019-01-11 11:42:36 +01:00