Skip to content

1.2610-2

Choose a tag to compare

View all tags
@Pintuzoft Pintuzoft released this 10 Oct 23:10
· 10 commits to master since this release
v1.2610-2
9329f50
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Avade for bahamut 2.2.4. A second review of 1.2610-1 from five sides (security, the core and the sessions, join requests, host masking, everything that can grow), and a check that services really keep working without the database. Every finding and what was done about it is in docs/AUDIT-2026-09.md, under "tenth round".

Upgrade when you can. Some of the fixes are about nicks and identification, see "Fixed" below.

Upgrading

Download Avade-1.2610-2.tar.gz below. It is Avade built and ready to install: the jars, the installer, the configs, the docs and the bahamut module. Java 17 or newer is all the machine needs.

tar xzf Avade-1.2610-2.tar.gz
cd Avade-1.2610-2
./install.sh

With git instead: git pull, ./make.sh install and ./avade.sh restart.

The database does not change, and nothing new has to be in services.conf. Coming from a version older than 1.2610-1, read the notes of 1.2610-1 first: that upgrade changes the database, wants a backup and needs bahamut 2.2.4.

New

  • Services keep working without the database. They live in memory, and every change waits in a list until the database has taken it. That was the design all along; memos and mails did not follow it and were refused or lost. Now they do, the lists are written in an order that works after a long outage, and nothing is given up on because the server could not take it right then (down, read only, full, no access). The staff get one short line every half minute: Database down, waiting: nicks 1, chans 1, access 3, memos 1, mails 1, other 14.
  • Flood protection. Someone who is not identified to a nick gets 8 commands at once from NickServ, ChanServ and MemoServ and then one every four seconds. Nobody is killed for it. REGISTER and SET EMAIL send a mail to an address the user types: one ip address gets 10 of them an hour.
  • avade.out is moved aside when it is over 20 MB, also while services run, and only the user running services can read it.
  • The libraries that come with Avade are listed with their licenses in lib/README.md.

What to add to the config

Nothing has to be added. Optional, in services.conf, the mails one ip address can ask for in an hour (0 for no limit, opers and the addresses in whitelist are not counted):

maillimit: 10

Fixed

Nicks and identification

  • A mail code (AUTH) still worked after the nick it was made for had been dropped and registered by someone else. Codes belong to one registration, and unused ones go with the nick.
  • A nick that was frozen while its user was split away kept +r and its identification.
  • A nick or channel that was dropped stayed in the sessions of users who were not online right then, and identified them to the next owner of the name.
  • An identification to a channel was lost at a services restart.
  • The snoop showed a password after two spaces in a row or with the arguments in the wrong order.

Memory and growth

  • A user that services kill themselves (SGLINE, flood) was never removed, with its channels and its services ID. MKICK and a closed channel left the channel in memory with its key and bans.
  • OperServ's check of new users waited for the database, and its list grew meanwhile.
  • NickServ wrote its changes five a minute. They are written every second.

Join requests

  • After a netjoin with an older channel, services kept the key and the bans the ircd had dropped and refused joins on them.
  • A ban on the masked host of someone with SET SHOWHOST did not stop them.
  • Someone services have no record of got no answer at all. They are refused and told to reconnect.

Stability

  • One error in the work of every second ended the main loop. A row without a nick in the web command table was enough.
  • A transaction that failed on something other than the database stayed open.

License texts

  • The license header of 29 files had been damaged by an old search and replace, and all of them named an address the FSF left in 2005.

The host-masking module for bahamut

avade_uhm-1.0.tar.gz is the same module as in 1.2610-1, with a license header added. There is no need to rebuild it.

Tested

The test suite (tests/) runs Avade against a real bahamut 2.2.4 hub and leaf with MariaDB: 384 checks. New in it: the database is stopped, made read only and has its grants taken away while every service is in use, a server is split away while a nick is frozen, another is dropped and registered again and a channel is made again, and services are flooded. The same was done by hand on a test network.

Assets 4
Loading