diff --git a/CHANGELOG.md b/CHANGELOG.md index 7318feaa..e0dd974d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,48 @@ # Changelog All notable changes to Ergo will be documented in this file. +## [2.7.0-rc1] - 2021-05-30 + +We're pleased to be publishing Ergo 2.7.0-rc1, our first release candidate under our new name of Ergo. This release contains bug fixes and minor enhancements. + +This release includes changes to the config file format, all of which are fully backwards-compatible and do not require updating the file before upgrading. This release includes no changes to the database format. + +Because the name of the executable has changed from `oragono` to `ergo` (`ergo.exe` on Windows), you may need to update your system configuration (e.g., scripts or systemd unit files that reference the executable). + +Many thanks to [@ajaspers](https://github.com/ajaspers) and [@jesopo](https://github.com/jesopo) for contributing patches, to [@ajaspers](https://github.com/ajaspers), [@ChrisTX](https://github.com/ChrisTX), [@emersion](https://github.com/emersion), [@jwheare](https://github.com/jwheare), [@kylef](https://github.com/kylef), [@Mikaela](https://github.com/Mikaela), [@mogad0n](https://github.com/mogad0n), and [@ProgVal](https://github.com/ProgVal) for reporting issues and helping test, and to our translators for contributing translations. + +### Changed +* The project was renamed from "Oragono" to "Ergo" (#897, thanks to everyone who contributed feedback or voted in the poll) + +### Config changes +* Entries in `server.listeners` now take a new key, `min-tls-version`, that can be used to set the minimum required TLS version; the recommended default value is `1.2` (#1611, thanks [@ChrisTX](https://github.com/ChrisTX)!) +* Added `max-conns` (maximum connection count) and `max-conn-lifetime` (maximum lifetime of a connection before it is cycled) to `datastore.mysql` (#1622) +* Added `massmessage` operator capability to allow sending NOTICEs to all connected users (#1153, #1629, thanks [@jesopo](https://github.com/jesopo)!) + +### Security +* If `require-sasl.enabled` is set to `true`, `tor-listeners.require-sasl` will be automatically set to `true` as well (#1636) +* It is now possible to set the minimum required TLS version, using the `min-tls-version` key in listener configuration +* Configurations that require SASL but allow user registration now produce a warning (#1637) + +### Added: +* Operators with the correct permissions can now send "mass messages", e.g. `/NOTICE $$*` will send a `NOTICE` to all users (#1153, #1629, thanks [@jesopo](https://github.com/jesopo)!) +* Operators can now extend the maximum (non-tags) length of the IRC line using the `server.max-line-len` configuration key. This is not recommended for use outside of "closed-circuit" deployments where IRC operators have full control of all client software. (#1651) + +### Fixed +* `RELAYMSG` now sends a full NUH ("nick-user-host"), instead of only the relay nickname, as the message source (#1647, thanks [@ProgVal](https://github.com/ProgVal), [@jwheare](https://github.com/jwheare), and [@Mikaela](https://github.com/Mikaela)!) +* Fixed a case where channels would remain visible in `/LIST` after unregistration (#1619, thanks [@ajaspers](https://github.com/ajaspers)!) +* Fixed incorrect tags on `JOIN` lines in `+u` ("auditorium") channels (#1642) +* Fixed an issue where LUSERS counts could get out of sync (#1617) +* It was impossible to add a restricted set of snomasks to an operator's permissions; this has been fixed (#1618) +* Fixed incorrect language in `NS INFO` responses (#1627, thanks [@ajaspers](https://github.com/ajaspers)!) +* Fixed a case where the `REGISTER` command would emit an invalid error message (#1633, thanks [@ajaspers](https://github.com/ajaspers)!) + +### Removed +* Removed the `draft/resume-0.5` capability, and the associated `RESUME` and `BRB` commands (#1624) + +### Internal +* Optimized MySQL storage of direct messages (#1615) + ## [2.6.1] - 2021-04-26 Oragono 2.6.1 is a bugfix release, fixing a security issue that is critical for some private server configurations. We regret the oversight. diff --git a/distrib/systemd/oragono.service b/distrib/systemd/ergo.service similarity index 77% rename from distrib/systemd/oragono.service rename to distrib/systemd/ergo.service index 79222d18..2a64d770 100644 --- a/distrib/systemd/oragono.service +++ b/distrib/systemd/ergo.service @@ -1,5 +1,5 @@ [Unit] -Description=oragono +Description=ergo After=network.target # If you are using MySQL for history storage, comment out the above line # and uncomment these two instead (you must independently install and configure @@ -9,9 +9,9 @@ After=network.target [Service] Type=simple -User=oragono -WorkingDirectory=/home/oragono -ExecStart=/home/oragono/oragono run --conf /home/oragono/ircd.yaml +User=ergo +WorkingDirectory=/home/ergo +ExecStart=/home/ergo/ergo run --conf /home/ergo/ircd.yaml ExecReload=/bin/kill -HUP $MAINPID Restart=on-failure LimitNOFILE=1048576 diff --git a/docs/MANUAL.md b/docs/MANUAL.md index 8f245999..122aeb4d 100644 --- a/docs/MANUAL.md +++ b/docs/MANUAL.md @@ -1,12 +1,13 @@ + ___ _ __ __ _ ___ + / _ \ '__/ _` |/ _ \ + | __/ | | (_| | (_) | + \___|_| \__, |\___/ + __/ | + |___/ - ▄▄▄ ▄▄▄· ▄▄ • ▐ ▄ - ▪ ▀▄ █·▐█ ▀█ ▐█ ▀ ▪▪ •█▌▐█▪ - ▄█▀▄ ▐▀▀▄ ▄█▀▀█ ▄█ ▀█▄ ▄█▀▄▪▐█▐▐▌ ▄█▀▄ - ▐█▌.▐▌▐█•█▌▐█ ▪▐▌▐█▄▪▐█▐█▌ ▐▌██▐█▌▐█▌.▐▌ - ▀█▄▀▪.▀ ▀ ▀ ▀ ·▀▀▀▀ ▀█▄▀ ▀▀ █▪ ▀█▄▀▪ + Ergo IRCd Manual + https://ergo.chat/ - Oragono IRCd Manual - https://oragono.io/ _Copyright © Daniel Oaks , Shivaram Lingamneni _ @@ -28,7 +29,7 @@ _Copyright © Daniel Oaks , Shivaram Lingamneni , Shivaram Lingamneni @@ -918,7 +917,7 @@ We may add some additional notes here for specific commands down the line, but r # Working with other software -Oragono should interoperate with most IRC-based software, including bots. If you have problems getting your preferred software to work with Oragono, feel free to report it to us. If the root cause is a bug in Oragono, we'll fix it. +Ergo should interoperate with most IRC-based software, including bots. If you have problems getting your preferred software to work with Ergo, feel free to report it to us. If the root cause is a bug in Ergo, we'll fix it. One exception is services frameworks like [Anope](https://github.com/anope/anope) or [Atheme](https://github.com/atheme/atheme); we have our own services implementations built directly into the server, and since we don't support federation, there's no place to plug in an alternative implementation. (If you are already using Anope or Atheme, we support migrating your database --- see below.) @@ -926,16 +925,16 @@ If you're looking for a bot that supports modern IRCv3 features, check out [bitb ## Kiwi IRC -[Kiwi IRC](https://github.com/kiwiirc/kiwiirc/) is a web-based IRC client with excellent IRCv3 support. In particular, it is the only major client to fully support Oragono's server-side history features. For a demonstration of these features, see the [Oragono testnet](https://testnet.oragono.io/kiwi). +[Kiwi IRC](https://github.com/kiwiirc/kiwiirc/) is a web-based IRC client with excellent IRCv3 support. In particular, it is the only major client to fully support Ergo's server-side history features. For a demonstration of these features, see the [Ergo testnet](https://testnet.ergo.chat/kiwi). -Current versions of Kiwi are 100% static files (HTML and Javascript), running entirely in the end user's browser without the need for a separate server-side backend. This frontend can connect directly to Oragono, using Oragono's support for native websockets. For best interoperability with firewalls, you should run an externally facing web server on port 443 that can serve both the static files and the websocket path, then have it reverse-proxy the websocket path to Oragono. For example, configure the following listener in ircd.yaml: +Current versions of Kiwi are 100% static files (HTML and Javascript), running entirely in the end user's browser without the need for a separate server-side backend. This frontend can connect directly to Ergo, using Ergo's support for native websockets. For best interoperability with firewalls, you should run an externally facing web server on port 443 that can serve both the static files and the websocket path, then have it reverse-proxy the websocket path to Ergo. For example, configure the following listener in ircd.yaml: ```yaml "127.0.0.1:8067": websocket: true ``` -then the following location block in your nginx config (this proxies only `/webirc` on your server to Oragono's websocket listener): +then the following location block in your nginx config (this proxies only `/webirc` on your server to Ergo's websocket listener): ``` location /webirc { @@ -949,7 +948,7 @@ then the following location block in your nginx config (this proxies only `/webi } ``` -then add the following `startupOptions` to Kiwi's `static/config.json` file (see the [Oragono testnet's config.json](https://testnet.oragono.io/kiwi/static/config.json) for a fully functional example): +then add the following `startupOptions` to Kiwi's `static/config.json` file (see the [Ergo testnet's config.json](https://testnet.ergo.chat/kiwi/static/config.json) for a fully functional example): ``` "startupOptions" : { @@ -961,19 +960,19 @@ then add the following `startupOptions` to Kiwi's `static/config.json` file (see ## Migrating from Anope or Atheme -You can import user and channel registrations from an Anope or Atheme database into a new Oragono database (not all features are supported). Use the following steps: +You can import user and channel registrations from an Anope or Atheme database into a new Ergo database (not all features are supported). Use the following steps: -1. Obtain the relevant migration tool from the latest stable release: [anope2json.py](https://github.com/oragono/oragono/blob/stable/distrib/anope/anope2json.py) or [atheme2json.py](https://github.com/oragono/oragono/blob/stable/distrib/atheme/atheme2json.py) respectively. +1. Obtain the relevant migration tool from the latest stable release: [anope2json.py](https://github.com/ergochat/ergo/blob/stable/distrib/anope/anope2json.py) or [atheme2json.py](https://github.com/ergochat/ergo/blob/stable/distrib/atheme/atheme2json.py) respectively. 1. Make a copy of your Anope or Atheme database file. (You may have to stop and start the services daemon to get it to commit all its changes.) 1. Convert the database to JSON, e.g., with `python3 ./anope2json.py anope.db output.json` -1. Copy your desired Oragono config to `./ircd.yaml` (make any desired edits) -1. Run `oragono importdb ./output.json` -1. Run `oragono mkcerts` if necessary to generate self-signed TLS certificates -1. Run `oragono run` to bring up your new Oragono instance +1. Copy your desired Ergo config to `./ircd.yaml` (make any desired edits) +1. Run `ergo importdb ./output.json` +1. Run `ergo mkcerts` if necessary to generate self-signed TLS certificates +1. Run `ergo run` to bring up your new Ergo instance ## Hybrid Open Proxy Monitor (HOPM) -[hopm](https://github.com/ircd-hybrid/hopm) can be used to monitor your server for connections from open proxies, then automatically ban them. To configure hopm to work with oragono, add operator blocks like this to your oragono config file, which grant hopm the necessary privileges: +[hopm](https://github.com/ircd-hybrid/hopm) can be used to monitor your server for connections from open proxies, then automatically ban them. To configure hopm to work with Ergo, add operator blocks like this to your Ergo config file, which grant hopm the necessary privileges: ````yaml # operator classes @@ -1003,28 +1002,28 @@ opers: modes: +is c # password to login with /OPER command - # generated using "oragono genpasswd" + # generated using "ergo genpasswd" password: "$2a$04$JmsYDY6kX3/wwyK3ao0L7.aGJEto0Xm4DyL6/6zOmCpzeweIb8kdO" ```` Then configure hopm like this: ```` -/* oragono */ +/* ergo */ connregex = ".+-.+CONNECT.+-.+ Client Connected \\[([^ ]+)\\] \\[u:([^ ]+)\\] \\[h:([^ ]+)\\] \\[ip:([^ ]+)\\] .+"; -/* A DLINE example for oragono */ +/* A DLINE example for ergo */ kline = "DLINE ANDKILL 2h %i :Open proxy found on your host."; ```` ## Tor -Oragono has code support for adding an .onion address to an IRC server, or operating an IRC server as a Tor onion service ("hidden service"). This is subtle, so you should be familiar with the [Tor Project](https://www.torproject.org/) and the concept of an [onion service](https://www.torproject.org/docs/tor-onion-service.html.en). +Ergo has code support for adding an .onion address to an IRC server, or operating an IRC server as a Tor onion service ("hidden service"). This is subtle, so you should be familiar with the [Tor Project](https://www.torproject.org/) and the concept of an [onion service](https://www.torproject.org/docs/tor-onion-service.html.en). -There are two possible ways to serve Oragono over Tor. One is to add a .onion address to a server that also serves non-Tor clients, and whose IP address is public information. This is relatively straightforward. Add a separate listener, for example `127.0.0.2:6668`, to Oragono's `server.listeners`, then configure it with `tor: true`. Then configure Tor like this: +There are two possible ways to serve Ergo over Tor. One is to add a .onion address to a server that also serves non-Tor clients, and whose IP address is public information. This is relatively straightforward. Add a separate listener, for example `127.0.0.2:6668`, to Ergo's `server.listeners`, then configure it with `tor: true`. Then configure Tor like this: ```` -HiddenServiceDir /var/lib/tor/oragono_hidden_service +HiddenServiceDir /var/lib/tor/ergo_hidden_service HiddenServicePort 6667 127.0.0.2:6668 # these are optional, but can be used to speed up the circuits in the case @@ -1033,25 +1032,25 @@ HiddenServiceNonAnonymousMode 1 HiddenServiceSingleHopMode 1 ```` -Tor provides end-to-end encryption for onion services, so there's no need to enable TLS in Oragono for the listener (`127.0.0.2:6668` in this example). Doing so is not recommended, given the difficulty in obtaining a TLS certificate valid for an .onion address. +Tor provides end-to-end encryption for onion services, so there's no need to enable TLS in Ergo for the listener (`127.0.0.2:6668` in this example). Doing so is not recommended, given the difficulty in obtaining a TLS certificate valid for an .onion address. -The second way is to run Oragono as a true hidden service, where the server's actual IP address is a secret. This requires hardening measures on the Oragono side: +The second way is to run Ergo as a true hidden service, where the server's actual IP address is a secret. This requires hardening measures on the Ergo side: -* Oragono should not accept any connections on its public interfaces. You should remove any listener that starts with the address of a public interface, or with `:`, which means "listen on all available interfaces". You should listen only on `127.0.0.1:6667` and a Unix domain socket such as `/hidden_service_sockets/oragono_tor_sock`. +* Ergo should not accept any connections on its public interfaces. You should remove any listener that starts with the address of a public interface, or with `:`, which means "listen on all available interfaces". You should listen only on `127.0.0.1:6667` and a Unix domain socket such as `/hidden_service_sockets/ergo_tor_sock`. * In this mode, it is especially important that all operator passwords are strong and all operators are trusted (operators have a larger attack surface to deanonymize the server). -* Onion services are at risk of being deanonymized if a client can trick the server into performing a non-Tor network request. Oragono should not perform any such requests (such as hostname resolution or ident lookups) in response to input received over a correctly configured Tor listener. However, Oragono has not been thoroughly audited against such deanonymization attacks --- therefore, Oragono should be deployed with additional sandboxing to protect against this: - * Oragono should run with no direct network connectivity, e.g., by running in its own Linux network namespace. systemd implements this with the [PrivateNetwork](https://www.freedesktop.org/software/systemd/man/systemd.exec.html) configuration option: add `PrivateNetwork=true` to Oragono's systemd unit file. - * Since the loopback adapters are local to a specific network namespace, and the Tor daemon will run in the root namespace, Tor will be unable to connect to Oragono over loopback TCP. Instead, Oragono must listen on a named Unix domain socket that the Tor daemon can connect to. However, distributions typically package Tor with its own hardening profiles, which restrict which sockets it can access. Below is a recipe for configuring this with the official Tor packages for Debian: +* Onion services are at risk of being deanonymized if a client can trick the server into performing a non-Tor network request. Ergo should not perform any such requests (such as hostname resolution or ident lookups) in response to input received over a correctly configured Tor listener. However, Ergo has not been thoroughly audited against such deanonymization attacks --- therefore, Ergo should be deployed with additional sandboxing to protect against this: + * Ergo should run with no direct network connectivity, e.g., by running in its own Linux network namespace. systemd implements this with the [PrivateNetwork](https://www.freedesktop.org/software/systemd/man/systemd.exec.html) configuration option: add `PrivateNetwork=true` to Ergo's systemd unit file. + * Since the loopback adapters are local to a specific network namespace, and the Tor daemon will run in the root namespace, Tor will be unable to connect to Ergo over loopback TCP. Instead, Ergo must listen on a named Unix domain socket that the Tor daemon can connect to. However, distributions typically package Tor with its own hardening profiles, which restrict which sockets it can access. Below is a recipe for configuring this with the official Tor packages for Debian: 1. Create a directory with `0777` permissions such as `/hidden_service_sockets`. -1. Configure Oragono to listen on `/hidden_service_sockets/oragono_tor_sock`, with `tor: true`. -1. Ensure that Oragono has no direct network access as described above, e.g., with `PrivateNetwork=true`. +1. Configure Ergo to listen on `/hidden_service_sockets/ergo_tor_sock`, with `tor: true`. +1. Ensure that Ergo has no direct network access as described above, e.g., with `PrivateNetwork=true`. 1. Next, modify Tor's apparmor profile so that it can connect to this socket, by adding the line ` /hidden_service_sockets/** rw,` to `/etc/apparmor.d/local/system_tor`. 1. Finally, configure Tor with: ```` -HiddenServiceDir /var/lib/tor/oragono_hidden_service -HiddenServicePort 6667 unix:/hidden_service_sockets/oragono_tor_sock +HiddenServiceDir /var/lib/tor/ergo_hidden_service +HiddenServicePort 6667 unix:/hidden_service_sockets/ergo_tor_sock # DO NOT enable HiddenServiceNonAnonymousMode ```` @@ -1063,13 +1062,13 @@ Instructions on how client software should connect to an .onion address are outs ## ZNC -ZNC 1.6.x (still pretty common in distros that package old versions of IRC software) has a [bug](https://github.com/znc/znc/issues/1212) where it fails to recognize certain SASL messages. Oragono supports a compatibility mode that works around this to let ZNC complete the SASL handshake: this can be enabled with `server.compatibility.send-unprefixed-sasl`. +ZNC 1.6.x (still pretty common in distros that package old versions of IRC software) has a [bug](https://github.com/znc/znc/issues/1212) where it fails to recognize certain SASL messages. Ergo supports a compatibility mode that works around this to let ZNC complete the SASL handshake: this can be enabled with `server.compatibility.send-unprefixed-sasl`. -Oragono can emulate certain capabilities of the ZNC bouncer for the benefit of clients, in particular the third-party [playback](https://wiki.znc.in/Playback) module. This enables clients with specific support for ZNC to receive selective history playback automatically. To configure this in [Textual](https://www.codeux.com/textual/), go to "Server properties", select "Vendor specific", uncheck "Do not automatically join channels on connect", and check "Only play back messages you missed". Other clients with support are listed on ZNC's wiki page. +Ergo can emulate certain capabilities of the ZNC bouncer for the benefit of clients, in particular the third-party [playback](https://wiki.znc.in/Playback) module. This enables clients with specific support for ZNC to receive selective history playback automatically. To configure this in [Textual](https://www.codeux.com/textual/), go to "Server properties", select "Vendor specific", uncheck "Do not automatically join channels on connect", and check "Only play back messages you missed". Other clients with support are listed on ZNC's wiki page. ## External authentication systems -Oragono can be configured to call arbitrary scripts to authenticate users; see the `auth-script` section of the config. The API for these scripts is as follows: Oragono will invoke the script with a configurable set of arguments, then send it the authentication data as JSON on the first line (`\n`-terminated) of stdin. The input is a JSON dictionary with the following keys: +Ergo can be configured to call arbitrary scripts to authenticate users; see the `auth-script` section of the config. The API for these scripts is as follows: Ergo will invoke the script with a configurable set of arguments, then send it the authentication data as JSON on the first line (`\n`-terminated) of stdin. The input is a JSON dictionary with the following keys: * `accountName`: during passphrase-based authentication, this is a string, otherwise omitted * `passphrase`: during passphrase-based authentication, this is a string, otherwise omitted @@ -1098,11 +1097,11 @@ success = bool(account_name) and bool(passphrase) and account_name == passphrase print(json.dumps({"success": success})) ``` -Note that after a failed script invocation, Oragono will proceed to check the credentials against its local database. +Note that after a failed script invocation, Ergo will proceed to check the credentials against its local database. ## DNSBLs and other IP checking systems -Similarly, Oragono can be configured to call arbitrary scripts to validate user IPs. These scripts can either reject the connection, or require that the user log in with SASL. In particular, we provide an [oragono-dnsbl](https://github.com/oragono/oragono-dnsbl) plugin for querying DNSBLs. +Similarly, Ergo can be configured to call arbitrary scripts to validate user IPs. These scripts can either reject the connection, or require that the user log in with SASL. In particular, we provide an [oragono-dnsbl](https://github.com/oragono/oragono-dnsbl) plugin for querying DNSBLs. The API is similar to the auth-script API described above (one line of JSON in, one line of JSON out). The input is a JSON dictionary with the following keys: @@ -1119,11 +1118,11 @@ The output is a JSON dictionary with the following keys: # Acknowledgements -Oragono's past and present maintainers and core contributors are: +Ergo's past and present maintainers and core contributors are: * Jeremy Latt (2012-2014) * Edmund Huber (2014-2015) * Daniel Oaks (2016-present) * Shivaram Lingamneni (2017-present) -In addition, Oragono has benefited tremendously from its community of contributors, users, and translators, not to mention collaborations with the wider IRCv3 community. There are too many people to name here --- but we try to credit people for individual contributions in the changelog, please reach out to us if we forgot you :-) +In addition, Ergo has benefited tremendously from its community of contributors, users, and translators, not to mention collaborations with the wider IRCv3 community. There are too many people to name here --- but we try to credit people for individual contributions in the changelog, please reach out to us if we forgot you :-) diff --git a/docs/USERGUIDE.md b/docs/USERGUIDE.md index 9817ce5a..e09f901a 100644 --- a/docs/USERGUIDE.md +++ b/docs/USERGUIDE.md @@ -1,12 +1,12 @@ + ___ _ __ __ _ ___ + / _ \ '__/ _` |/ _ \ + | __/ | | (_| | (_) | + \___|_| \__, |\___/ + __/ | + |___/ - ▄▄▄ ▄▄▄· ▄▄ • ▐ ▄ - ▪ ▀▄ █·▐█ ▀█ ▐█ ▀ ▪▪ •█▌▐█▪ - ▄█▀▄ ▐▀▀▄ ▄█▀▀█ ▄█ ▀█▄ ▄█▀▄▪▐█▐▐▌ ▄█▀▄ - ▐█▌.▐▌▐█•█▌▐█ ▪▐▌▐█▄▪▐█▐█▌ ▐▌██▐█▌▐█▌.▐▌ - ▀█▄▀▪.▀ ▀ ▀ ▀ ·▀▀▀▀ ▀█▄▀ ▀▀ █▪ ▀█▄▀▪ - - Oragono IRCd User Guide - https://oragono.io/ + Ergo IRCd User Guide + https://ergo.chat/ _Copyright © Daniel Oaks , Shivaram Lingamneni _ @@ -18,7 +18,7 @@ _Copyright © Daniel Oaks , Shivaram Lingamneni , Shivaram Lingamneni Shivaram Lingamneni, slingamn,