Skip to content

Merge upstream unrealircd 6.2.6-rc1 #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
matheusfillipe merged 45 commits into from
Jun 24, 2026
Merged

Merge upstream unrealircd 6.2.6-rc1 #20

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
45 commits
Select commit Hold shift + click to select a range
f0c0fef
Set PCRE2 limits explicitly (to more sensible defaults), reported by …
syzop Jun 5, 2026
dee26e2
Add const to third argument of unreal_create_match()
syzop Jun 5, 2026
425a9b9
Fix deny channel::mask not working if security group. Reported by PeG…
syzop Jun 5, 2026
cbc9213
Similarly to previous, fix allow channel::except and spamfilter::except
syzop Jun 5, 2026
982325f
Move "make pem" to "./unrealircd makecert" and make tools use this
syzop Jun 5, 2026
be08bc2
Let's call it "./unrealircd mkcert" instead (like mkpasswd). Fix test…
syzop Jun 5, 2026
3571c9e
Create BASEDIR with 0700. Just like we already did for almost all sub…
syzop Jun 5, 2026
b19573d
Update release notes
syzop Jun 5, 2026
27a086b
Add TKL IDs via message tags in S2S.
syzop Jun 7, 2026
74557f2
help.fr.conf: translation update, include eline, tline, new snomasks …
LeCoyote Jun 8, 2026
d5b799d
Server bans and Spamfilters now track how often they are hit and the …
syzop Jun 8, 2026
faecdd6
Config-file based *LINES/Spamfilter: preserve hit counters between re…
syzop Jun 10, 2026
62f3cda
Make spamfilter IDs start with "SPAM" to be more visible. And this also
syzop Jun 10, 2026
5850ec9
Show TKL IDs (and related spamfilter TKL ID, if any) in TKL_ADD, TKL_…
syzop Jun 10, 2026
57ca415
Add whitespace deletion in buildvarstring() so template can have a sp…
syzop Jun 11, 2026
e2ed1ce
Load multiline by default and update release notes a little.
syzop Jun 11, 2026
4384f11
Crule: new server_flood_count() for nick, away, join etc floods.
syzop Jun 12, 2026
029675f
Similar to previous, add total_channel_flood_count() for +f/+F limits…
syzop Jun 13, 2026
3000381
Fix multiline-concat behavior for fallback clients.
syzop Jun 13, 2026
65f918e
Add json_expand_flood_counts() and make available in Central Spamreport
syzop Jun 13, 2026
7667307
JSON-RPC user.get can now expose more fields by forwarding the request
syzop Jun 13, 2026
2089aa4
In RPC_CALL_ERROR show the actual error
syzop Jun 13, 2026
8d78320
JSON-RPC: Remote RPC was broken and causing "not authorized" error me…
syzop Jun 13, 2026
1162da4
* Server linking and certificates: we now treat listener blocks that are
syzop Jun 16, 2026
ce6f078
Deal better with multiple spkifp, such as ECC + ML-DSA. We now cache …
syzop Jun 17, 2026
c100059
Add new function: append_name_list(). Use it at two places where we
syzop Jun 17, 2026
4966b59
Update release notes
syzop Jun 17, 2026
e7459df
Another URL API fix
syzop Jun 17, 2026
d7962e1
Fix crash (NULL pointer) with old-style set::anti-flood block
syzop Jun 17, 2026
320d2c2
Fix theoretical OOB write in chmode_str(). In practice this is no issue.
syzop Jun 18, 2026
b5f45d0
Update NULL check in config_item_allowed_for_config_file() - no real …
syzop Jun 18, 2026
ecde1b6
Add bounds checking to message_tag_escape().
syzop Jun 19, 2026
f5d59dd
Support ratified tags for reply-tag and no-implicit-names (PR #336)
ValwareIRC Jun 19, 2026
59d4977
chathistory: implement draft/chathistory-end tag (PR #337)
ValwareIRC Jun 19, 2026
37977fc
Don't send draft/chathistory-end for AROUND. As around does not have
syzop Jun 19, 2026
570c32e
Fix CHATHISTORY TARGETS sending one target too little if limit is hit
syzop Jun 19, 2026
09a732e
Redo draft/chathistory-end from yesterday in a different way.
syzop Jun 20, 2026
8d1df6a
Make nofakelag also mean that deliberate add_fake_lag() does not lag up.
syzop Jun 20, 2026
3fafd32
Fix end marker missing for 0 result in some CHATHISTORY BETWEEN.
syzop Jun 20, 2026
2475f25
** UnrealIRCd 6.2.6-rc1 **
syzop Jun 20, 2026
cf5703f
Windows packager: get rid of in-innosetup-signing (handled outside th…
syzop Jun 20, 2026
5a93480
SECURITY.md: add "Scope" and "Use of AI or other tools"
syzop Jun 21, 2026
12d92fc
a more minor update:
syzop Jun 21, 2026
684f651
"CAP LS" may only respond 1 line, we now advertise less. "CAP LS 302"…
syzop Jun 22, 2026
9b3919b
Merge upstream unrealircd/unreal60_dev into obbyircd
matheusfillipe Jun 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions Config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,9 +50,12 @@ if [ -z "$BINDIR" -o -z "$DATADIR" -o -z "$CONFDIR" -o -z "$MODULESDIR" -o -z "$
fi


mkdir -p $BASEPATH
mkdir -p $TMPDIR
mkdir -p $PRIVATELIBDIR
mkdir -p $CONFDIR
chmod 0700 $BASEPATH
chmod 0700 $TMPDIR
chmod 0700 $CONFDIR
Comment on lines +53 to +58

@coderabbitai coderabbitai Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Quote and fail-check directory path operations.

Line 53-Line 58 use unquoted path variables, so paths with spaces/globs can create or chmod unintended targets.

Suggested patch 
-mkdir -p $BASEPATH
-mkdir -p $TMPDIR
-mkdir -p $CONFDIR
-chmod 0700 $BASEPATH
-chmod 0700 $TMPDIR
-chmod 0700 $CONFDIR
+mkdir -p "$BASEPATH" || exit 1
+mkdir -p "$TMPDIR" || exit 1
+mkdir -p "$CONFDIR" || exit 1
+chmod 0700 "$BASEPATH" || exit 1
+chmod 0700 "$TMPDIR" || exit 1
+chmod 0700 "$CONFDIR" || exit 1
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
mkdir -p $BASEPATH
mkdir -p $TMPDIR
mkdir -p $PRIVATELIBDIR
mkdir -p $CONFDIR
chmod 0700 $BASEPATH
chmod 0700 $TMPDIR
chmod 0700 $CONFDIR
mkdir -p "$BASEPATH" || exit 1
mkdir -p "$TMPDIR" || exit 1
mkdir -p "$CONFDIR" || exit 1
chmod 0700 "$BASEPATH" || exit 1
chmod 0700 "$TMPDIR" || exit 1
chmod 0700 "$CONFDIR" || exit 1
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Config` around lines 53 - 58, Quote all the path variables in the mkdir and
chmod commands (around lines 53-58) by wrapping $BASEPATH, $TMPDIR, and $CONFDIR
in double quotes to prevent word-splitting and glob expansion. Additionally, add
fail-checks after each mkdir command by appending || exit 1 to ensure the script
exits if any directory creation fails, rather than continuing with invalid
paths.


# Do this even if we're not in advanced mode
if [ "$ADVANCED" = "1" ] ; then
Expand Down Expand Up @@ -188,7 +191,7 @@ if [ "$QUICK" != "1" ] ; then
echo "*******************************************************************************"
echo "Press ENTER to continue"
read cc
$MAKE pem
./unrealircd mkcert

@coderabbitai coderabbitai Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Stop on certificate generation failure before printing success.

Line 194 runs ./unrealircd mkcert without checking status, then always prints success. A failed cert bootstrap currently looks successful.

Suggested patch 
-			./unrealircd mkcert
-			echo "Certificate created successfully."
+			if ./unrealircd mkcert; then
+				echo "Certificate created successfully."
+			else
+				echo "Certificate generation failed."
+				exit 1
+			fi
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Config` at line 194, The ./unrealircd mkcert command does not have its exit
status checked before printing a success message, meaning a failed certificate
generation will still appear successful. After executing the ./unrealircd mkcert
command, check its exit status and only print the success message if the command
succeeds. If the command fails, the script should handle the error appropriately
(typically by exiting with a non-zero status or printing an error message).

echo "Certificate created successfully."
sleep 1
else
Expand Down
22 changes: 4 additions & 18 deletions Makefile.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,6 +224,7 @@ install: all
fi
$(INSTALL) -m 0700 -d $(DESTDIR)@CONFDIR@/tls
$(INSTALL) -m 0600 doc/conf/tls/curl-ca-bundle.crt $(DESTDIR)@CONFDIR@/tls
$(INSTALL) -m 0600 doc/conf/tls/tls.cnf $(DESTDIR)@CONFDIR@/tls
@# delete modules/cap directory, to avoid confusing with U4 to U5 upgrades:
rm -rf $(DESTDIR)@MODULESDIR@/cap
$(INSTALL) -m 0700 -d $(DESTDIR)@MODULESDIR@/third
Expand All @@ -234,11 +235,6 @@ install: all
$(INSTALL) -m 0700 -d $(DESTDIR)@CACHEDIR@
$(INSTALL) -m 0700 -d $(DESTDIR)@PERMDATADIR@
$(INSTALL) -m 0700 -d $(DESTDIR)@LOGDIR@
-@if [ ! -f "$(DESTDIR)@CONFDIR@/tls/server.cert.pem" ] ; then \
$(INSTALL) -m 0600 server.req.pem $(DESTDIR)@CONFDIR@/tls ; \
$(INSTALL) -m 0600 server.key.pem $(DESTDIR)@CONFDIR@/tls ; \
$(INSTALL) -m 0600 server.cert.pem $(DESTDIR)@CONFDIR@/tls ; \
fi
@rm -f $(DESTDIR)@SCRIPTDIR@/source
ln -s @BUILDDIR@ $(DESTDIR)@SCRIPTDIR@/source
@echo ''
Expand Down Expand Up @@ -268,19 +264,9 @@ install: all
echo 'Again, be sure to change to the @SCRIPTDIR@ directory!' ; \
fi

pem: extras/tls.cnf
@echo "Generating server key..."
$(OPENSSLPATH) ecparam -out server.key.pem -name secp384r1 -genkey
@echo "Generating certificate request..."
$(OPENSSLPATH) req -new \
-config extras/tls.cnf -sha256 -out server.req.pem \
-key server.key.pem -nodes
@echo "Generating self-signed certificate..."
$(OPENSSLPATH) req -x509 -days 3650 -sha256 -nodes -in server.req.pem \
-key server.key.pem -out server.cert.pem
@echo "Setting permissions on server.*.pem files..."
chmod o-rwx server.req.pem server.key.pem server.cert.pem
chmod g-rwx server.req.pem server.key.pem server.cert.pem
pem:
@echo "The command 'make pem' is no longer used to generate the TLS certificate."
@echo "Please run './unrealircd mkcert' instead."

Makefile: config.status Makefile.in
./config.status
61 changes: 55 additions & 6 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,19 +3,68 @@
## Supported Versions
* The latest *stable* release of UnrealIRCd 6

See [UnrealIRCd releases](https://www.unrealircd.org/docs/UnrealIRCd_releases) for information on older versions and End Of Life dates.
See [UnrealIRCd releases](https://www.unrealircd.org/docs/UnrealIRCd_releases)
for information on older versions and End Of Life dates.

## Scope

In general, issues triggered by regular users involving memory safety issues
(such as OOB read/write or UAF), sensitive information disclosure, privilege elevation,
Denial of Service (e.g. a crash), or remote code execution fall within the scope of
this security policy.

Issues that require IRCOp rights, server-to-server traffic, or editing of config
files may still fall within scope, but are classified case by case depending on
the impact and circumstances.

Issues that require shell access as the same user running UnrealIRCd are not
considered security issues. See the
[full policy](https://www.unrealircd.org/docs/Policy:_Handling_of_security_issues)
for details.

## Use of AI or other tools

It is normal and acceptable to use tools for finding security vulnerabilities.
We use them ourselves as well: AI, static code analyzers, fuzzing. This is all fine.

If a tool flagged an issue then we ask only **one extra thing**: that you
**reproduce the issue** on your own local server. So: confirm the issue by
actually running UnrealIRCd with a reproducer (which usually means: by sending
IRC traffic to trigger the bug). This is because tools regularly flag something
as an issue but in practice it may be impossible to happen because of some extra
check somewhere or other requirements.

If you are trying to reproduce an issue, then we suggest running `./Config` and
answering `Yes` to the near-last question about AddressSanitizer (ASan),
especially for memory safety issues. Please include the reproducer and any
relevant ASan output in the bug report. ASan output is useful even if a normal
build does not visibly crash. It helps us a lot.

If you used AI, static code analyzers, fuzzing, or similar tools and fail to
follow the procedure above, expect us to ask you again to reproduce the issue.
If you refuse to do so, don't respond in a timely manner, or keep sending reports
without doing so after we asked, then we will close the bug report. For repeat
offenders, we may proceed with putting you on ignore, banning or deleting your
account, or similar. Giving a reproducer is not a big ask and is normal procedure
nowadays. It should be part of your standard workflow if you are a security
researcher.

## Reporting a Vulnerability

Please report issues on the [bug tracker](https://bugs.unrealircd.org) and in the bug submit form **set the 'View Status' to 'private'**.
Please report issues on the [bug tracker](https://bugs.unrealircd.org) and in
the bug submit form **set the 'View Status' to 'private'**.

Do not report security issues on the forums or in a public IRC channel such as #unreal-support.
If you insist on e-mail then you can use syzop@unrealircd.org or security@unrealircd.org. Again, the bug tracker is preferred.
Do not report security issues as a Pull Request, on the forums or in a public
IRC channel such as #unreal-support. If you insist on e-mail then you can use
syzop@unrealircd.org or security@unrealircd.org. Again, the bug tracker is
preferred.

If you are *unsure* if something is a security issue, then report it at the bug tracker as a 'private' bug anyway. Better safe than sorry.
If you found a real issue but are *unsure* if it is a security issue, then
report it at the bug tracker as a 'private' bug anyway. Better safe than sorry.
Do not ask around in public channels or forums.

You should get a response or at least an acknowledgement soon. If you don't hear back within 24 hours, then please try to contact us again.
You should get a response or at least an acknowledgement soon. If you don't hear
back within 24 hours, then please try to contact us again.

## Full policy
See https://www.unrealircd.org/docs/Policy:_Handling_of_security_issues for full information.
7 changes: 6 additions & 1 deletion configure
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7582,6 +7582,11 @@ else case e in #(
e)
printf "%s\n" "#define PRIVATELIBDIR \"$PRIVATELIBDIR\"" >>confdefs.h

# Create the private library directory now with restrictive permissions.
# This must happen here rather than in the Makefile because the bundled
# libraries are installed into it during configure. It must also work when
# configure is run directly without ./Config having created it first.
mkdir -p "$PRIVATELIBDIR" && chmod 0700 "$PRIVATELIBDIR"
LDFLAGS_PRIVATELIBS="-Wl,-rpath,$PRIVATELIBDIR"
LDFLAGS="$LDFLAGS $LDFLAGS_PRIVATELIBS"
export LDFLAGS ;;
Expand Down Expand Up @@ -8893,7 +8898,7 @@ $ac_cv_prog_MAKER install PREFIX=$cur_dir/extras/argon2 || exit 1
# lead to a crash of the currently running IRCd.
rm -f "$PRIVATELIBDIR/"libargon2*
# Now copy the new library files:
cp -av $cur_dir/extras/argon2/lib/* $PRIVATELIBDIR/
cp -av $cur_dir/extras/argon2/lib/* $PRIVATELIBDIR/ || exit 1
CFLAGS="$save_cflags"
LDFLAGS="$save_ldflags"
ARGON2_CFLAGS="-I$cur_dir/extras/argon2/include"
Expand Down
7 changes: 6 additions & 1 deletion configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -558,6 +558,11 @@ AS_IF([test "x$with_privatelibdir" = "xno"],
AS_IF([test "x$PRIVATELIBDIR" = "x"],
[LDFLAGS_PRIVATELIBS=""],
[AC_DEFINE_UNQUOTED([PRIVATELIBDIR], ["$PRIVATELIBDIR"], [Define the location of private libraries])
# Create the private library directory now with restrictive permissions.
# This must happen here rather than in the Makefile because the bundled
# libraries are installed into it during configure. It must also work when
# configure is run directly without ./Config having created it first.
mkdir -p "$PRIVATELIBDIR" && chmod 0700 "$PRIVATELIBDIR"
Comment on lines +561 to +565

@coderabbitai coderabbitai Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Make private-libdir creation failure fatal during configure.

Line 565 currently continues even if mkdir/chmod fails, which can cause later bundled-library install steps to fail in less obvious ways.

Suggested patch 
-		mkdir -p "$PRIVATELIBDIR" && chmod 0700 "$PRIVATELIBDIR"
+		mkdir -p "$PRIVATELIBDIR" && chmod 0700 "$PRIVATELIBDIR" || AC_MSG_ERROR([Unable to initialize private library directory: $PRIVATELIBDIR])
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Create the private library directory now with restrictive permissions.
# This must happen here rather than in the Makefile because the bundled
# libraries are installed into it during configure. It must also work when
# configure is run directly without ./Config having created it first.
mkdir -p "$PRIVATELIBDIR" && chmod 0700 "$PRIVATELIBDIR"
# Create the private library directory now with restrictive permissions.
# This must happen here rather than in the Makefile because the bundled
# libraries are installed into it during configure. It must also work when
# configure is run directly without ./Config having created it first.
mkdir -p "$PRIVATELIBDIR" && chmod 0700 "$PRIVATELIBDIR" || AC_MSG_ERROR([Unable to initialize private library directory: $PRIVATELIBDIR])
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@configure.ac` around lines 561 - 565, The mkdir and chmod commands in the
private library directory creation block do not cause the configure script to
exit if they fail, which can lead to confusing errors later during bundled
library installation. Add error handling to the line containing mkdir -p
"$PRIVATELIBDIR" && chmod 0700 "$PRIVATELIBDIR" so that the configure script
immediately exits with a fatal error if either the directory creation or
permission change operation fails. This ensures failures are caught early and
reported clearly rather than silently allowing the script to continue with an
improperly configured directory.

LDFLAGS_PRIVATELIBS="-Wl,-rpath,$PRIVATELIBDIR"
LDFLAGS="$LDFLAGS $LDFLAGS_PRIVATELIBS"
export LDFLAGS])
Expand Down Expand Up @@ -728,7 +733,7 @@ $ac_cv_prog_MAKER install PREFIX=$cur_dir/extras/argon2 || exit 1
# lead to a crash of the currently running IRCd.
rm -f "$PRIVATELIBDIR/"libargon2*
# Now copy the new library files:
cp -av $cur_dir/extras/argon2/lib/* $PRIVATELIBDIR/
cp -av $cur_dir/extras/argon2/lib/* $PRIVATELIBDIR/ || exit 1
CFLAGS="$save_cflags"
LDFLAGS="$save_ldflags"
ARGON2_CFLAGS="-I$cur_dir/extras/argon2/include"
Expand Down
2 changes: 1 addition & 1 deletion doc/Config.header
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
\___/|_| |_|_| \___|\__,_|_|\___/\_| \_| \____/\__,_|

Configuration Program
for UnrealIRCd 6.2.6
for UnrealIRCd 6.2.6-rc1

@coderabbitai coderabbitai Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Align the Config banner version with the declared release version.

Line 10 says 6.2.6-rc1, while the project version is declared as 6.2.6 in configure.ac (Line 10). This can confuse operators during setup.

Suggested patch 
-                                for UnrealIRCd 6.2.6-rc1
+                                for UnrealIRCd 6.2.6
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
for UnrealIRCd 6.2.6-rc1
for UnrealIRCd 6.2.6
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@doc/Config.header` at line 10, The Config banner in doc/Config.header
displays version 6.2.6-rc1 while the actual project version in configure.ac is
declared as 6.2.6, causing a mismatch that can confuse operators. Update the
version string in the Config.header banner where it says "for UnrealIRCd
6.2.6-rc1" to match the official release version 6.2.6 declared in configure.ac,
ensuring consistency across the configuration files.


This program will help you to compile your IRC server, and ask you
questions regarding the compile-time settings of it during the process.
Expand Down
Loading
Loading