Skip to content

1.2610-1

Choose a tag to compare

View all tags
@Pintuzoft Pintuzoft released this 10 Oct 04:51
· 20 commits to master since this release
v1.2610-1
664d452
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Avade for bahamut 2.2.4. The first release since 1.2311-1, after an audit of the whole code. Every finding and what was done about it is in docs/AUDIT-2026-09.md.

Before you upgrade

  • Upgrade the ircd to bahamut 2.2.4 first. Older versions are not supported.
  • Take a backup of the database. ./install.sh offers one. The upgrade turns every password into a one way hash and converts the tables to utf8mb4, and an older Avade can not read the database afterwards.
  • Leave secretsalt in services.conf as it is. The passwords are read with it when they are hashed. With a wrong salt the upgrade stops and changes nothing.
  • Java 17 or newer.

Installing and upgrading

Download Avade-1.2610-1.tar.gz below. It is Avade built and ready to install: the jars, the installer, the configs, the docs and the bahamut module. Java is all the machine needs.

tar xzf Avade-1.2610-1.tar.gz
cd Avade-1.2610-1
./install.sh

With git instead: git pull (or git clone https://github.com/Pintuzoft/Avade.git) and ./install.sh.

install.sh puts everything in ~/avade/, keeps a services.conf that is already there and restarts services. A new installation is asked a few questions and gets its services.conf written. The database is upgraded at the first start, from any earlier version to 1.2610-1. Try it on a test network with a copy of your data first: docs/TEST-WITH-PRODUCTION-DATA.md.

What to add to the config

./avade.sh setup makes the changes to services.conf for you, and asks first. By hand, the new commands go in the access lists:

sra:
 - uhm
 - sjr

csop:
 - setpass

sa:
 - vhost
 - clone

setpass is there instead of getpass, which is gone. A command that is in no list can only be used by a services root admin.

Optional, words that may not be part of a vhost:

vhostforbidden:
 - "*admin*"
 - "*oper*"

Only when you use the host-masking module, in services.conf:

uhmsalt: <16 to 128 letters and digits>
uhmprefix: mynet

and in the ircd.conf of every server:

modules { path modules; autoload avade_uhm; };

./avade.sh gensalt makes a salt. uhmsalt must not be the same as secretsalt. uhmprefix is the first part of the masked host names, 1 to 16 letters and digits.

The mailer has a config of its own, mailer.conf. ./avade.sh mailer start asks for what it needs and writes it.

reference.conf and mailer-reference.conf explain every setting.

The host-masking module for bahamut

The module for user host-masking is in the package and in the source, in bahamut-module/. avade_uhm-1.0.tar.gz below is the same three files on their own, for the servers of the network: every server needs the module, only one machine needs Avade. It is optional, without it nothing changes on your network. It comes as source, since it has to be built against the bahamut source your ircd was built from (2.2.0 or newer):

tar xzf avade_uhm-1.0.tar.gz
cd avade_uhm-1.0
./build.sh /path/to/bahamut-source /path/to/ircd

With the lines above in the configs it is loaded when the ircd starts, and turned on with /OperServ UHM 1 1. Every step is in INSTALL, section 10.

New

  • Passwords are stored as hashes (PBKDF2). GETPASS is gone: NickServ RESETPASS mails a code, staff use SETPASS.
  • VOP and HOP access levels, and halfops.
  • NickServ SET VHOST and OperServ VHOST.
  • OperServ CLONE: clone limits per ip and range.
  • OperServ UHM and the avade_uhm module for bahamut: user host-masking that services can follow.
  • OperServ SJR and the chanflag SJR: services join requests. An AKICK or RESTRICT stops a user before the join, not with a kick after it.
  • Spamfilter targets and ids, services staff shown in WHOIS, the chanflags of bahamut 2.1.5 and later.
  • Memo limits: 30 per nick, 5 unread from one sender.
  • AvadeMailer is part of the repository (mailer/).
  • ./install.sh installs and starts services, a setup asks for what can not be guessed, and ./avade.sh starts, stops and checks them.

Fixed

  • Access checks in ChanServ, NickServ and RootServ that could be passed.
  • Topic sync, nick matching, IPv6 addresses, ban durations and wildcard matching.
  • Services relink to the hub by themselves, and users are still identified after a netsplit or a services restart (for three days).
  • A database that hangs no longer takes services down, and nothing touches anyone's access before the nicks and channels are loaded.
  • Text is UTF-8 end to end.
  • Many smaller bugs in all services, see the audit.

Tested

A test suite (tests/) runs Avade against a real bahamut 2.2.4 hub and leaf with MariaDB: 292 checks. An upgrade from 1.2311-1 with nicks, channels, topics, access lists and memos was run by hand, and on a test network with older data.

Assets 4
Loading