ngIRCd Users February 2013

ngircd@lists.barton.de

4 participants
3 discussions

ngIRCd 20.2
by Alexander Barton 18 Feb '13

18 Feb '13

Hello ngIRCd'ers! Sebastian Köhler discovered a severe bug in ngIRCd 20 and 20.1 which can be exploited by arbitrary users to crash the daemon and to lead to denial of service. So here is the next "bug fix only" release for the ngIRCd 20 series: release 20.2. Please note that all releases before 20 are NOT affected by the bug mentioned above. But in the end, all installations should upgrade, ngIRCd 20.2 is the most complete release we have so far, and there should be no reasons to stay with old versions -- besides distributions not having newer releases ... Besides the fix for the DoS mentioned above, ngIRCd 20.2 contains other fixes. The complete ChangeLog lists the following changes: • Security: Fix a denial of service bug in the function handling KICK commands that could be used by arbitrary users to to crash the daemon. • WHO command: Use the currently "displayed hostname" (which can be cloaked!) for hostname matching, not the real one. In other words: don't display all the cloaked users on a specific real hostname! • configure: The header file "netinet/in_systm.h" already is optional in ngIRCd, so don't require it in the configure script. Now ngIRCd can be built on Minix 3 again :-) • Return better "Connection not registered as server link" errors: Now ngIRCd returns a more specific error message for numeric ERR_NOTREGISTERED(451) when a regular user tries to use a command that isn't allowed for users but for servers. • Don't report ERR_NEEDMOREPARAMS(461) when a MDOE command with more modes than nicknames is handled, as well as for channel limit and key changes without specifying the limit or key parameters. This is how a lot (all?) other IRC servers behave, including ircd2.11, InspIRCd, and ircd-seven. And because of clients (tested with Textual and mIRC) sending bogus MODE commands like "MODE -ooo nick", end-users got the expected result as well as correct but misleading error messages ... • Correctly detect when SSL subsystem must be initialized and take outgoing connections (server links!) into account, too. • autogen.sh: Enforce serial test harness on GNU automake >=1.13. The new parallel test harness which is enabled by default starting with automake 1.13 isn't compatible with our test suite. And don't use "egrep -o", insetead use "sed", because it isn't portable and not available on OpenBSD, for example. More information can be found on the homepage <http://ngircd.barton.de/> and its mirror <http://ngircd.berlios.de/>. The primary download locations are: • <ftp://ftp.berlios.de/pub/ngircd/> • <http://ngircd.barton.de/pub/ngircd/> Regards Alex

2 2

Don't disconnect on overlong lines?
by Brett Smith 15 Feb '13

15 Feb '13

Hi folks, Over the past month or so I've received complaints from multiple users, using different clients, about the fact that ngIRCd disconnects them when they send lines longer than the RFC permits. It seems like most ircds simply truncate the line, and this behavior is commonly expected. I think this is something that clients really ought to be more careful about, but unfortunately there are still too many that aren't, and it feels bad to me to punish the user with a disconnect for not manually counting their bytes. Would all consider truncating the line, or some other less disruptive way to handle this case? Maybe the disconnect behavior could stay when STRICT_RFC is defined. Thanks, -- Brett Smith

1 0

Print recent chat messages on user joining a channel
by Xiaohao.M 02 Feb '13

02 Feb '13

Hi all, Does anyone know how to let ngircd prints the latest 10 or 20 history messages on a user joining a channel? For the 'recent-offline-message-push', is that working with server side or just some bot could do? *Thank you,* *Xiaohao (Kevin)*

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

ngIRCd Users February 2013