1
0
mirror of https://github.com/unrealircd/unrealircd.git synced 2026-07-09 10:03:13 +02:00
Bram Matthys 36baf946a3 Guard against multiline+history amplification attacks in CHATHISTORY.
Add a little fake lag based on history result: 400ms for 50 lines
under normal conditions where 50 lines = 50 lines. But this can go
up to 5000ms for worst-case amplification attacks where requesting
50 lines actually returns 50*15=750 lines when each line is a multiline
with max-lines, which gets you close to 350k+. This would only happen
if someone on the channel is doing evil stuff (with presumably consent
of the ops).

Also guard against hiting max sendq. If we are too close, then we
reject the CHATHISTORY request rather than quiting with "Max SendQ
exceeded". This protects against an attack where someone would be
tricked into joining a channel with amplified history (as explained
in previous paragraph), their client would do an automatic CHATHISTORY
request and then the victim would exceed max sendq and thus be killed.

And yes, this and maaaaany other multiline + history interactions
and many "buts" and security/flood concerns are why this implemtnation
took (and still takes) a lot of hours to get right :D.
2026-04-03 07:59:11 +02:00
2026-03-22 13:45:28 +01:00
2023-10-04 05:11:12 +00:00
2021-12-06 13:36:12 +01:00
2000-02-28 22:45:44 +00:00
2026-03-04 09:18:20 +01:00

Mastodon Follow Twitter Follow Linux CI

About UnrealIRCd

UnrealIRCd is an Open Source IRC Server, serving thousands of networks since 1999. It runs on Linux, OS X and Windows and is currently the most widely deployed IRCd with a market share of 37%. UnrealIRCd is a highly advanced IRCd with a strong focus on modularity and security. It uses an advanced and highly configurable configuration file. Other key features include: full IRCv3 support, SSL/TLS, cloaking, JSON-RPC, advanced anti-flood and anti-spam systems, GeoIP, remote includes, and lots of other features. We are also particularly proud on our extensive online documentation.

Versions

  • UnrealIRCd 6 is the stable series since December 2021. It is the only supported version.
  • For full details of release scheduling and EOL dates, see UnrealIRCd releases on the wiki

How to get started

Follow the installation guide on the wiki. See:

Documentation and Support

You can find all documentation online at: https://www.unrealircd.org/docs/

We also have a good FAQ: https://www.unrealircd.org/docs/FAQ

If you are in need of support, you can pop up on #unreal-support on irc.unrealircd.org or ask your question on the forums.

Supported systems

We try to support all major *NIX systems: all Linux distros but also NetBSD, OpenBSD and macOS, provided the OS version was released within the past ~5 years.

We use a private BuildBot instance to test each commit. The tested systems are (others are likely to work too):

  • Linux: Debian (10, 11, 12, 13), Ubuntu (18.04, 20.04, 22.04, 24.04, 26.04)
  • FreeBSD: 15
  • Windows: Visual Studio 2019

UnrealIRCd is architecture-agnostic. Most of the BuildBot workers run on x64 but we also have some on x86 and arm64 to ensure these work as well.

S
Description
Languages
C 94.7%
M4 1.7%
Shell 1.5%
Rich Text Format 1%
Makefile 0.6%
Other 0.5%