Repository navigation
Releases: Pintuzoft/Avade
Release list
1.2610-4
Avade for bahamut 2.2.4. A small release for the confirmation page that came with 1.2610-3.
Upgrading
Download Avade-1.2610-4.tar.gz below, or with git: git pull, ./make.sh install and ./avade.sh restart.
tar xzf Avade-1.2610-4.tar.gz
cd Avade-1.2610-4
./install.sh
The database does not change, and nothing new has to be in services.conf. If you use the confirmation page, copy the new web/auth/index.php over the old one on your web server. Your config.php stays as it is.
Changed
- After a click the confirmation page stood still for several seconds and showed nothing. Services looked for web commands every five seconds; they look every second now. The button says "Confirming..." with a spinner the moment it is clicked and can not be clicked twice. From click to answer it is about a second and a half.
- Two notices from NickServ said "unindentified".
INSTALL, section 13: the web server has to be able to read the files of the page. Files copied there as root with no access for others make PHP answer "Access denied." before the page has run.
The host-masking module for bahamut
avade_uhm-1.0.tar.gz is unchanged.
Tested
The test suite (tests/) runs Avade against a real bahamut 2.2.4 hub and leaf with MariaDB: 401 checks. The page was also used on a test network with a real web server and a real mail.
1.2610-3
Avade for bahamut 2.2.4. The link in the mails now has a page behind it, and every mail has a command for IRC as well.
Upgrading
Download Avade-1.2610-3.tar.gz below. It is Avade built and ready to install: the jars, the installer, the configs, the docs, the bahamut module and the confirmation page. Java 17 or newer is all the machine needs.
tar xzf Avade-1.2610-3.tar.gz
cd Avade-1.2610-3
./install.sh
With git instead: git pull, ./make.sh install and ./avade.sh restart.
The database does not change, and nothing new has to be in services.conf. Coming from a version older than 1.2610-1, read the notes of 1.2610-1 first.
New
- The confirmation page,
web/auth/. When someone registers a nick, changes its mail address or asks for a new password, services send a mail with a link. The page behind that link was never part of Avade, so a new installation mailed a dead link. Now it comes along: one PHP file and a settings file, for your web server (it can be another machine than services, the database is all they share). It shows whose address or password the code is about and asks for a click, because mail programs and virus scanners open links by themselves. Services then make the change within five seconds and tell the user on IRC, and the page waits and says what really happened. /NickServ AUTH <code>in every mail. The same code as in the link, as a command for IRC. A network without a page works with that alone, and so does a link that fails.- The setup writes
authurlending in?code=, which needs no rewrite rule on the web server.
Setting the page up is section 13 of INSTALL: copy the folder, fill in config.php, and give the page a database account with four column grants. That account can not read a mail address or a password hash.
If you have a page of your own
Check two things, they fail without any error on the page:
- The row in the
commandtable must have the code inextra(and the address of the visitor inextra2). Services have required it since 1.2004-3: a row without it is tried five times and removed, and nothing is confirmed. - Services put the code right after
authurl, with nothing in between.authurl: https://example.net/auth.phpgiveshttps://example.net/auth.php3f9c..., which is not a page. It has to end in what comes before the code:https://example.net/auth/?code=.
What to add to the config
Nothing has to be added. To use the page that comes with Avade, in services.conf:
authurl: https://example.net/auth/?code=
and /RootServ REHASH.
The host-masking module for bahamut
avade_uhm-1.0.tar.gz is unchanged.
Tested
The test suite (tests/) runs Avade against a real bahamut 2.2.4 hub and leaf with MariaDB: 399 checks. The page runs in a PHP container against the test database with exactly the grants from INSTALL: a link without a code, an unknown code, a link that is only opened, the click, the notice on IRC, the log, the same link twice, and a password change.
1.2610-2
Avade for bahamut 2.2.4. A second review of 1.2610-1 from five sides (security, the core and the sessions, join requests, host masking, everything that can grow), and a check that services really keep working without the database. Every finding and what was done about it is in docs/AUDIT-2026-09.md, under "tenth round".
Upgrade when you can. Some of the fixes are about nicks and identification, see "Fixed" below.
Upgrading
Download Avade-1.2610-2.tar.gz below. It is Avade built and ready to install: the jars, the installer, the configs, the docs and the bahamut module. Java 17 or newer is all the machine needs.
tar xzf Avade-1.2610-2.tar.gz
cd Avade-1.2610-2
./install.sh
With git instead: git pull, ./make.sh install and ./avade.sh restart.
The database does not change, and nothing new has to be in services.conf. Coming from a version older than 1.2610-1, read the notes of 1.2610-1 first: that upgrade changes the database, wants a backup and needs bahamut 2.2.4.
New
- Services keep working without the database. They live in memory, and every change waits in a list until the database has taken it. That was the design all along; memos and mails did not follow it and were refused or lost. Now they do, the lists are written in an order that works after a long outage, and nothing is given up on because the server could not take it right then (down, read only, full, no access). The staff get one short line every half minute:
Database down, waiting: nicks 1, chans 1, access 3, memos 1, mails 1, other 14. - Flood protection. Someone who is not identified to a nick gets 8 commands at once from NickServ, ChanServ and MemoServ and then one every four seconds. Nobody is killed for it.
REGISTERandSET EMAILsend a mail to an address the user types: one ip address gets 10 of them an hour. avade.outis moved aside when it is over 20 MB, also while services run, and only the user running services can read it.- The libraries that come with Avade are listed with their licenses in
lib/README.md.
What to add to the config
Nothing has to be added. Optional, in services.conf, the mails one ip address can ask for in an hour (0 for no limit, opers and the addresses in whitelist are not counted):
maillimit: 10
Fixed
Nicks and identification
- A mail code (
AUTH) still worked after the nick it was made for had been dropped and registered by someone else. Codes belong to one registration, and unused ones go with the nick. - A nick that was frozen while its user was split away kept +r and its identification.
- A nick or channel that was dropped stayed in the sessions of users who were not online right then, and identified them to the next owner of the name.
- An identification to a channel was lost at a services restart.
- The snoop showed a password after two spaces in a row or with the arguments in the wrong order.
Memory and growth
- A user that services kill themselves (
SGLINE, flood) was never removed, with its channels and its services ID.MKICKand a closed channel left the channel in memory with its key and bans. - OperServ's check of new users waited for the database, and its list grew meanwhile.
- NickServ wrote its changes five a minute. They are written every second.
Join requests
- After a netjoin with an older channel, services kept the key and the bans the ircd had dropped and refused joins on them.
- A ban on the masked host of someone with
SET SHOWHOSTdid not stop them. - Someone services have no record of got no answer at all. They are refused and told to reconnect.
Stability
- One error in the work of every second ended the main loop. A row without a nick in the web command table was enough.
- A transaction that failed on something other than the database stayed open.
License texts
- The license header of 29 files had been damaged by an old search and replace, and all of them named an address the FSF left in 2005.
The host-masking module for bahamut
avade_uhm-1.0.tar.gz is the same module as in 1.2610-1, with a license header added. There is no need to rebuild it.
Tested
The test suite (tests/) runs Avade against a real bahamut 2.2.4 hub and leaf with MariaDB: 384 checks. New in it: the database is stopped, made read only and has its grants taken away while every service is in use, a server is split away while a nick is frozen, another is dropped and registered again and a channel is made again, and services are flooded. The same was done by hand on a test network.
1.2610-1
Avade for bahamut 2.2.4. The first release since 1.2311-1, after an audit of the whole code. Every finding and what was done about it is in docs/AUDIT-2026-09.md.
Before you upgrade
- Upgrade the ircd to bahamut 2.2.4 first. Older versions are not supported.
- Take a backup of the database.
./install.shoffers one. The upgrade turns every password into a one way hash and converts the tables to utf8mb4, and an older Avade can not read the database afterwards. - Leave
secretsaltinservices.confas it is. The passwords are read with it when they are hashed. With a wrong salt the upgrade stops and changes nothing. - Java 17 or newer.
Installing and upgrading
Download Avade-1.2610-1.tar.gz below. It is Avade built and ready to install: the jars, the installer, the configs, the docs and the bahamut module. Java is all the machine needs.
tar xzf Avade-1.2610-1.tar.gz
cd Avade-1.2610-1
./install.sh
With git instead: git pull (or git clone https://github.com/Pintuzoft/Avade.git) and ./install.sh.
install.sh puts everything in ~/avade/, keeps a services.conf that is already there and restarts services. A new installation is asked a few questions and gets its services.conf written. The database is upgraded at the first start, from any earlier version to 1.2610-1. Try it on a test network with a copy of your data first: docs/TEST-WITH-PRODUCTION-DATA.md.
What to add to the config
./avade.sh setup makes the changes to services.conf for you, and asks first. By hand, the new commands go in the access lists:
sra:
- uhm
- sjr
csop:
- setpass
sa:
- vhost
- clone
setpass is there instead of getpass, which is gone. A command that is in no list can only be used by a services root admin.
Optional, words that may not be part of a vhost:
vhostforbidden:
- "*admin*"
- "*oper*"
Only when you use the host-masking module, in services.conf:
uhmsalt: <16 to 128 letters and digits>
uhmprefix: mynet
and in the ircd.conf of every server:
modules { path modules; autoload avade_uhm; };
./avade.sh gensalt makes a salt. uhmsalt must not be the same as secretsalt. uhmprefix is the first part of the masked host names, 1 to 16 letters and digits.
The mailer has a config of its own, mailer.conf. ./avade.sh mailer start asks for what it needs and writes it.
reference.conf and mailer-reference.conf explain every setting.
The host-masking module for bahamut
The module for user host-masking is in the package and in the source, in bahamut-module/. avade_uhm-1.0.tar.gz below is the same three files on their own, for the servers of the network: every server needs the module, only one machine needs Avade. It is optional, without it nothing changes on your network. It comes as source, since it has to be built against the bahamut source your ircd was built from (2.2.0 or newer):
tar xzf avade_uhm-1.0.tar.gz
cd avade_uhm-1.0
./build.sh /path/to/bahamut-source /path/to/ircd
With the lines above in the configs it is loaded when the ircd starts, and turned on with /OperServ UHM 1 1. Every step is in INSTALL, section 10.
New
- Passwords are stored as hashes (PBKDF2). GETPASS is gone:
NickServ RESETPASSmails a code, staff useSETPASS. - VOP and HOP access levels, and halfops.
NickServ SET VHOSTandOperServ VHOST.OperServ CLONE: clone limits per ip and range.OperServ UHMand theavade_uhmmodule for bahamut: user host-masking that services can follow.OperServ SJRand the chanflagSJR: services join requests. An AKICK or RESTRICT stops a user before the join, not with a kick after it.- Spamfilter targets and ids, services staff shown in WHOIS, the chanflags of bahamut 2.1.5 and later.
- Memo limits: 30 per nick, 5 unread from one sender.
- AvadeMailer is part of the repository (
mailer/). ./install.shinstalls and starts services, a setup asks for what can not be guessed, and./avade.shstarts, stops and checks them.
Fixed
- Access checks in ChanServ, NickServ and RootServ that could be passed.
- Topic sync, nick matching, IPv6 addresses, ban durations and wildcard matching.
- Services relink to the hub by themselves, and users are still identified after a netsplit or a services restart (for three days).
- A database that hangs no longer takes services down, and nothing touches anyone's access before the nicks and channels are loaded.
- Text is UTF-8 end to end.
- Many smaller bugs in all services, see the audit.
Tested
A test suite (tests/) runs Avade against a real bahamut 2.2.4 hub and leaf with MariaDB: 292 checks. An upgrade from 1.2311-1 with nicks, channels, topics, access lists and memos was run by hand, and on a test network with older data.