--- ircd-hybrid/trunk/NEWS	2015/03/01 13:46:24	5635
+++ ircd-hybrid/trunk/NEWS	2016/08/28 18:38:42	7692
@@ -1,6 +1,172 @@
--- Noteworthy changes in version 8.2.6 (2015-??-??)
-o) INFO now also shows configured values of 'max_watch' and 'stats_m_oper_only'
+#######################################################################
+Reminder for package maintainers of ircd-hybrid: ircd-hybrid now has
+GnuTLS support as of version 8.2.13
+#######################################################################
+
+
+-- Noteworthy changes in version 8.2.19 (2016-08-21)
+o) Fixed a possible server name leak in "WHO" with server hiding enabled
+o) "WHO" now allows opers to search by IP address
+o) Admins no longer can see IP addresses in "STATS P" with
+   'serverhide::hide_server_ips' enabled
+o) User mode 'n' now shows nick name changes from remote clients, too
+
+
+-- Noteworthy changes in version 8.2.18 (2016-06-22)
+o) Fixed an assert when a client sends invalid LIST options
+o) Fixed invalid memory stats of channel invites in "STATS z"
+
+
+-- Noteworthy changes in version 8.2.17 (2016-04-21)
+o) Fixed core on "REHASH CONF" with 'general::whowas_history_length'
+   set to 0
+o) Fixed possible core on "INVITE" with 'channel::max_channels' set to 0
+
+
+-- Noteworthy changes in version 8.2.16 (2016-03-20)
+o) Added 'general::whowas_history_length' configuration option which
+   allows to define the maximum length of the WHOWAS nickname history
+o) Services are now allowed to override 'general::min_nonwildcard',
+   and 'general::min_nonwildcard_simple' settings
+o) Minor updates to help files
+
+
+-- Noteworthy changes in version 8.2.15 (2016-02-24)
+o) Added proper support for Raspbian/ARM. Gracias to Beave/2600.net
+   for providing a box for testing purposes.
+o) Fixed an assert with empty user = "" directives in auth {} blocks
+o) "STATS z" now shows allocated listeners
+o) Fixed bug where 'can_flood' auth {} flags did not work on channels
+
+
+-- Noteworthy changes in version 8.2.14 (2016-02-09)
+o) Fixed server clustering
+o) Major cleanups to the configuration subsystem
+o) Improvements to libGeoIP support:
+   - Works now with IPv6 addresses
+   - Added 'libgeoip_database_options', 'libgeoip_ipv4_database_file',
+     and 'libgeoip_ipv6_database_file' configuration directives to the
+     serverinfo {} block
+o) Further improvements to GnuTLS support
+
+
+-- Noteworthy changes in version 8.2.13 (2016-02-02)
+o) Implemented support for GnuTLS. Currently ./configure's autodetection
+   intentionally prefers OpenSSL over GnuTLS, so OpenSSL detection needs
+   to be disabled explicitely by using the --disable-openssl switch.
+o) Minimum supported GnuTLS version is 3.3.8 now
+o) Minimum supported OpenSSL version is 1.0.1d now
+o) Added support for remote REHASH: REHASH <server> <option>
+o) Added 'rehash:remote' irc-operator privilege flag
+o) Added 'rehash' type to shared {} blocks
+o) Fixed minor memory leak with shared {} and cluster {} blocks
+
+
+-- Noteworthy changes in version 8.2.12 (2016-01-05)
+#######################################################################
+o) IMPORTANT: Character case mapping is 'ascii' now. It is recommended
+   to update all servers on the network to prevent possible channel
+   desynchronizations and nick name collision kills
+#######################################################################
+o) Added channel mode +T which forbids NOTICEs to be sent to a channel
+o) Fixed minor SVSTAG memory leak
+o) Fixed broken PART message blocking mechanism
+o) ircd now makes use of up to 8 name servers that are specified in
+   /etc/resolv.conf
+o) The -klinefile, -dlinefile, etc. switches didn't work at all
+o) Fixed possible core on ident lookups if ircd is out of file descriptors
+o) Far client exit notices (+F) now show IP addresses, too
+o) Made idle time look nicer in "STATS v|p" by using a formatted time string
+o) 'general::ts_warn_delta', and 'general::ts_max_delta' can be set to 0 now
+o) Several code cleanups and optimizations. Improved documentation
+
+
+-- Noteworthy changes in version 8.2.11 (2015-11-19)
+o) Implemented IRCv3.2 invite-notify extension
+o) Implemented IRCv3.2 chghost extension
+o) Added channel::invite_delay_channel configuration option
+
+
+-- Noteworthy changes in version 8.2.10 (2015-11-06)
+#######################################################################
+o) IMPORTANT: renamed 'serverhide::links_delay' configuration directive
+   to 'serverhide::flatten_links_delay'
+#######################################################################
+o) Added 'serverhide::flatten_links_file' configuration option
+o) Fixed bug where changing 'serverhide::flatten_links_delay' on runtime
+   would not have any effect
+o) mkpasswd (tools): fixed broken bcrypt support on *BSD in conjunction
+   with the -s and -l switches. Dropped MD5, DES and Extended DES support.
+o) Removed CHALLENGE in favor of ssl certificate fingerprint enabled
+   operator {} blocks
+o) RSA keys with less than 2048 bits are no longer supported; same applies
+   to the DH param file
+o) Added missing irc-operator privilege flags to /stats o. For a full list
+   of flags see doc/reference.conf
+
+
+-- Noteworthy changes in version 8.2.9 (2015-09-13)
+########################################################################
+o) IMPORTANT: database files and links.txt are now stored in /var/lib
+   instead of /etc, so make sure to move your k/d/x-line database files
+   to the new path before (re)starting the ircd
+########################################################################
+o) IMPORTANT: the splitmode logic has been removed along with the
+   following channel {} block configuration directives:
+   'default_split_user_count', 'default_split_server_count',
+   'no_create_on_split', 'no_join_on_split'
+########################################################################
+o) Added 'xline_exempt' to auth {} block flags
+o) 'serverinfo::sid' is now optional. A unique SID is now automatically
+   generated based on the server's name and description
+o) Various fixes to the mkpasswd tool
+o) If supported by the compiler, ircd-hybrid now compiles with
+   '-fstack-protector-strong' instead of '-fstack-protector'
+o) Services can now add RESVs (SQLINEs) that have wildcards in it
+o) Channel name RESVs are now sanity checked for too broad masks
+o) 'class::connectfreq' now works properly with values lower than 300 seconds
+o) Implemented IRCv3.1 account-notify extension
+o) The 'general::oper_pass_resv' configuration directive has been deprecated
+   in favor of the new 'join:resv', and 'nick:resv' irc-operator flags.
+   See doc/reference.conf for more information.
+o) Added 'resv', and 'unresv' irc-operator flags. Previously, all
+   irc-operators were allowed to RESV and UNRESV, regardless of configured
+   privileges.
+o) Added 'close' to irc-operator flags
+o) ircd is using ISO 8601 date and time notation in most places now
+
+
+-- Noteworthy changes in version 8.2.8 (2015-05-10)
+o) ircd now rejects remote k-line requests for user@host mask that don't
+   have at least 'general::min_nonwildcard' non-wildcard characters in it
+o) Configuration related server notices are now sent to admins only as
+   they potentially could leak passwords and other sensitive data to irc
+   operators that don't have administrator privileges
+o) The GLINE/GUNGLINE commands have been removed. KLINE in conjunction
+   with cluster {} and/or shared {} blocks is now the recommended
+   way to add global user@host mask based server bans
+o) Added dline_min_cidr, dline_min_cidr6, kline_min_cidr, and kline_min_cidr6
+   configuration options to the general {} block
+o) Fixed bug where a REHASH would clear all X-Lines and RESVs that have
+   been set with the XLINE/RESV commands
+o) Fixed broken temporary remote XLINEs
+o) The 'general::havent_read_conf' configuration directive has been removed
+o) Various code cleanups
+
+
+-- Noteworthy changes in version 8.2.7 (2015-04-05)
+o) Fixed a potential buffer overflow with the BMASK inter-server command
+o) Fixed undefined behavior in the HELP command module which could
+   lead to stack corruption
+o) Removed useless help files for inter-server commands
+
+
+-- Noteworthy changes in version 8.2.6 (2015-03-29)
+o) INFO now shows configured values of 'max_watch' and 'stats_m_oper_only'
 o) WHOWAS now shows IP addresses to irc operators
+o) Fixed bug that would allow remote clients to bypass the hard
+   limit of max WHOWAS entries to be returned
+o) Code cleanups and performance improvements
 
 
 -- Noteworthy changes in version 8.2.5 (2015-02-24)
@@ -11,7 +177,7 @@ o) Fixed core on Mac OSX 10.10 and possi
 -- Noteworthy changes in version 8.2.4 (2015-02-17)
 o) Added SVSTAG command which services may use to add tags to users which can
    be seen in /whois
-o) Added oper::whois configuration option which allows to override the default
+o) Added 'oper::whois' configuration option which allows to override the default
    RPL_WHOISOPERATOR numeric string shown in /whois.
 o) IRC operators may now use +O on a channel even if they are only a half-op
 o) Fixed bug where TOPIC messages were not n!u@h prefixed in case of TBURST
@@ -32,7 +198,7 @@ o) Fixed bug where "/rehash" would alway
 o) Added channel mode +C which prevents users from sending CTCPs to a channel
 o) Fixes to the NOTICE/PRIVMSG anti-flood logic
 o) Allow to disable the NOTICE/PRIVMSG anti-flood mechanism by setting the
-   general::default_floodcount configuration option to 0
+   'general::default_floodcount' configuration option to 0
 o) Updated some help files
 o) Minor code cleanups and improvements
 o) Operators may now see certificate fingerprints, user modes and hidden
@@ -40,22 +206,22 @@ o) Operators may now see certificate fin
 
 
 -- Noteworthy changes in version 8.2.2 (2015-01-20)
-o) Added support for the "extended-join" client capability
+o) Implemented IRCv3.1 extended-join extension
 o) Channel half-ops can now use INVITE as well
 o) Fixed broken 'make install -jX'
 o) m_opme.c has been added to modules/extra. Can be used on opless channels only.
 o) Added 'opme' to irc-operator flags
 o) Updated several help files
-o) The general::hide_spoof_ips configuration option has been deprecated
-o) The general::true_no_oper_flood configuration option has been deprecated.
+o) The 'general::hide_spoof_ips' configuration option has been deprecated
+o) The 'general::true_no_oper_flood' configuration option has been deprecated.
    Operators still can have higher 'flood' limits with no_oper_flood = yes;
    hoewever, they are no longer allowed to bypass RecvQ limits.
-o) Added general::stats_m_oper_only configuration option
+o) Added 'general::stats_m_oper_only' configuration option
 o) Remote client connection notices (user mode +F) now do show IP addresses, too
 
 
 -- Noteworthy changes in version 8.2.1 (2014-10-21)
-o) Fixed bug where "/undline remote.server IP" did not work as expected
+o) Fixed bug where "UNDLINE remote.server IP" did not work as expected
 o) Servers are now allowed to add/remove K-/D-/X-lines and RESVs
 o) Usermode +G now no longer allows to override +g
 o) Due to potential weakness, TLS session caching and session tickets
@@ -74,7 +240,8 @@ o) Fixed bug where "NOTICE +#somechan" d
    or channels that are set +c (no control codes)
 o) pseudo {} blocks also known as service aliases have been implemented.
    See doc/reference.conf for more information.
-o) Removed general::services_name configuration option. This is now no longer needed.
+o) Removed 'general::services_name' configuration option. This is now no
+   longer needed.
 
 
 -- Noteworthy changes in version 8.2.0rc2 (2014-08-03)
@@ -92,8 +259,10 @@ o) ./configure now requires OpenSSL 0.9.
 
 
 -- Noteworthy changes in version 8.2.0beta4 (2014-07-06)
-o) Channel halfops are now an integral part of ircd-hybrid
+#####################################################################
+o) IMPORTANT: channel halfops are now an integral part of ircd-hybrid
    and can't be disabled anymore
+#####################################################################
 o) Many code cleanups and improvements
 o) Added flood control for the INVITE command. See channel {} block in reference.conf
 o) Changed flood control logic for the KNOCK command. See channel {} block in reference.conf
@@ -104,7 +273,7 @@ o) Added 'throttle_count' configuration
 o) Added 'ssl_message_digest_algorithm' configuration option to serverinfo {} block.
    See doc/reference.conf for more information.
 o) Added support for Elliptic Curve Diffie-Hellman (ECDH). Also an elliptic curve can be
-   specified via the serverinfo::ssl_dh_elliptic_curve configuration option.
+   specified via the 'serverinfo::ssl_dh_elliptic_curve' configuration option.
 o) Removed 'ssl_server_method' and 'ssl_client_method' configuration options.
    ircd now only allows TLSv1, TLSv1.1 and TLSv1.2 protocols depending
    on the OpenSSL version. SSLv3 is no longer supported.
@@ -115,10 +284,10 @@ o) Code cleanups/performance improvement
 
 
 -- Noteworthy changes in version 8.2.0beta2 (2014-05-15)
-########################################################################
-o) IMPORTANT: renamed general::warn_no_nline configuration directive to
-   general::warn_no_connect_block
-########################################################################
+#########################################################################
+o) IMPORTANT: renamed 'general::warn_no_nline' configuration directive to
+   'general::warn_no_connect_block'
+#########################################################################
 o) Fixed bug with WHOIS not showing a list of channel names as expected
 o) Added usermode +q which hides idle and signon time in WHOIS
 o) Added usermode +p which hides channel list in WHOIS
@@ -160,7 +329,7 @@ o) Channel halfops (%) may now no longer
 o) Channel halfops (%) may now no longer KICK other channel halfops
 o) Fixed compile warnings; code cleanups
 o) Fixed bug where the configuration parser wouldn't truncate the network name
-   if general::network_name contains spaces
+   if 'general::network_name' contains spaces
 
 
 -- Noteworthy changes in version 8.1.17 (2014-05-01)
@@ -191,11 +360,11 @@ o) Minor code cleanups and cosmetical fi
 
 
 -- Noteworthy changes in version 8.1.14 (2014-02-25)
-o) WHOWAS now honors serverhide::disable_remote_commands
+o) WHOWAS now honors 'serverhide::disable_remote_commands'
 o) Improved TS6 inter-server communication
 o) Minor code cleanups and speed enhancements
 o) Added 'unxline' oper flag
-o) Added support for "userhost-in-names" client capability
+o) Implemented IRCv3.2 userhost-in-names extension
 o) ircd now allows private RSA keys larger than 2048 bits
 o) Fixed bug where signals stopped from working after restarting
    the ircd via SIGINT
@@ -237,7 +406,7 @@ o) The WHO reply now shows if a nickname
    with NickServ. ('r' status flag)
 o) Fixed some flaws with server hiding
 o) Fixed bug where "STATS P" would leak ip addresses to remotely connected
-   administrators, even if serverhide::hide_server_ips was set to 'yes'
+   administrators, even if 'serverhide::hide_server_ips' was set to 'yes'
 o) Added SVSKILL command
 
 
@@ -275,14 +444,14 @@ o) Fixed possible core with empty motd f
 
 -- Noteworthy changes in version 8.1.5 (2013-07-16)
 o) Fixed bug that would prevent servers from linking together
-   if connect::aftype isn't set
+   if 'connect::aftype' isn't set
 
 
 -- Noteworthy changes in version 8.1.4 (2013-07-05)
 o) Added 'xline' and 'resv' logging types. See doc/reference.conf
    for more information
 o) Fixed bug where remote STATS requests were not rate limited
-o) Fixed core with empty auth::spoof entries
+o) Fixed core with empty 'auth::spoof' entries
 o) Increased oper/auth/connect password length limit from 20 to 128
 o) Minor fixes to nickflood control code
 
@@ -294,14 +463,14 @@ o) Fixed broken --disable-libgeoip switc
 
 
 -- Noteworthy changes in version 8.1.2 (2013-06-20)
-o) Added general::cycle_on_host_change configuration option
-o) Added general::stats_u_oper_only configuration option
+o) Added 'general::cycle_on_host_change' configuration option
+o) Added 'general::stats_u_oper_only' configuration option
 o) Added support for SHA-256 ssl certificate fingerprint based operator {}
    and connect {} blocks.
    In conjunction with Anope 1.9/2.0 IRC-services, clients are now also able
    to automatically identify for their nick with ssl certificate
    fingerprints
-o) Added operator::ssl_connection_required configuration option. See
+o) Added 'operator::ssl_connection_required' configuration option. See
    doc/reference.conf for more information
 o) Added usermode +S (client is connected via SSL/TLS). Allows services
    to keep track of what users are connected via SSL, and allows to see
@@ -346,20 +515,20 @@ o) Improve/cleanup HELP system
 o) Implemented channel mode +M. Clients that haven't identified their
    name with NickServ may not speak in a channel that has this mode set
 o) Fixed weird idletimes shown in /trace
-o) Added 'nononreg' (+R) to general::oper_umodes
+o) Added 'nononreg' (+R) to 'general::oper_umodes'
 o) Added user mode +F (can see remote client connect/exit notices)
 
 
 -- Noteworthy changes in version 8.1.0beta3 (2013-05-05)
 o) PCRE support has been dropped
 o) "STATS o" now shows how many times an operator {} block has been used.
-   Similar to STATS x|q"
+   Similar to "STATS x|q"
 o) Implemented channel mode +c. Known from other ircds, this mode basically
    prevents users from sending messages including control codes to a channel
    that has this mode set
 o) Fixed bug where bans were not checked against non-channel members when
    sending messages to a channel
-o) Removed channel::quiet_on_ban configuration option. This feature is
+o) Removed 'channel::quiet_on_ban' configuration option. This feature is
    now enabled by default
 
 
@@ -372,18 +541,18 @@ o) Fixed spoofs not working as expected
 
 
 -- Noteworthy changes in version 8.1.0beta1 (2013-04-25)
-########################################################################
+#######################################################################
 o) IMPORTANT: name/channel entries can't be stacked any longer within a
    single resv {} block. Each entry now requires its own resv {} block.
    Read doc/reference.conf for more details
 #######################################################################
-o) Added resv::exempt configuration option. Exempt can be either a
+o) Added 'resv::exempt' configuration option. Exempt can be either a
    ISO 3166 alpha-2 two letter country code, or a nick!user@host mask.
    CIDR is supported
-o) Removed channel::restrict_channels configuration option
+o) Removed 'channel::restrict_channels' configuration option
 o) Preliminary libGeoIP support. Currently only used for exempt entries
    in resv {} blocks
-o) Improved WEBIRC authentication; added 'webirc' to auth::flags.
+o) Improved WEBIRC authentication; added 'webirc' to 'auth::flags'.
    A "webirc." spoof is now no longer required
 o) Implemented new memory pool allocator which basically is based upon Tor's
    mempool allocator for Tor cells
@@ -393,14 +562,14 @@ o) Implemented new binary database stora
 o) Channel based resv {} blocks may now contain wildcards
 o) NICK/JOIN now shows the actual reason of reserved nick-/channelnames
 o) contrib/ and its content has been enirely removed from the tree
-o) Added serverhide::hide_services configuration option
-o) Added 'nononreg' (+R) to oper::umodes and general::oper_only_modes
-o) Added support for "away-notify" client capability
+o) Added 'serverhide::hide_services' configuration option
+o) Added 'nononreg' (+R) to 'oper::umodes' and 'general::oper_only_modes'
+o) Implemented IRCv3.1 away-notify extension
 
 
 -- Noteworthy changes in version 8.0.9 (2013-05-16)
 o) Fixed bug where ircd would sometimes drop a services link because
-   of a missing argument to the SVSMODE command
+   of a missing argument to the "SVSMODE" command
 o) Fixed weird idletimes shown in /trace
 
 
@@ -442,10 +611,10 @@ o) INFO now also shows configured values
    and 'stats_e_disabled'
 o) m_webirc.c is now officially supported, and has been moved from contrib/
    to modules/
-o) /whois, /stats p, and /trace may now show fake idle times depending on
-   how the new class::min_idle and class::max_idle configuration directives
-   have been configured. This feature basically works in the same
-   way as it does in csircd
+o) /whois, /stats p, and /trace may now show fake idle times depending
+   on how the new 'class::min_idle' and class::max_idle configuration
+   directives have been configured. This feature basically works in the
+   same way as it does in csircd
 o) The configuration parser now does support 'year' and 'month' units
 
 
@@ -480,14 +649,14 @@ o) Fixed TBURST from leaking the server
 -- Noteworthy changes in version 8.0.0 (2012-10-18)
 o) Fixed an off-by-one with spoofs. Spoofs are now also checked for
    invalid characters
-o) Removed general::use_whois_actually configuration directive. This is
-   now enabled by default
+o) Removed 'general::use_whois_actually' configuration directive.
+   This is now enabled by default
 o) Minor SQUIT handling fixes
 o) Fixed bancache not being updated on CHGHOST/CHGIDENT
 
 
 -- Noteworthy changes in version 8.0.0rc1 (2012-09-28)
-o) Removed general::client_flood configuration option and added the
+o) Removed 'general::client_flood' configuration option and added the
    new 'recvq' configuration directive to class {} blocks.
    The max size of a receive queue can be seen in "STATS Y"
    for each class
@@ -499,16 +668,16 @@ o) Fixed wrong syntax in several languag
 o) Removed &localchannels
 o) PRIVMSG to opers@some.server is no longer supported
 o) Fixed bug that could lead to topic desynchronization
-o) Removed serverhide::disable_hidden configuration option
+o) Removed 'serverhide::disable_hidden' configuration option
 o) Dropped ircd-hybrid-6 GLINE compatibility mode
 o) Removed use_invex, use_except and use_knock configuration options.
    These features are now enabled by default
 
 
 -- Noteworthy changes in version 8.0.0beta2 (2012-07-21)
-o) channel::disable_fake_channels now also disables ascii 29 (mIRC italic)
+o) 'channel::disable_fake_channels' now also disables ascii 29 (mIRC italic)
    when set to yes
-o) Added channel::max_chans_per_oper configuration directive. The old way
+o) Added 'channel::max_chans_per_oper' configuration directive. The old way
    was to let operators join three times the amount of max_chans_per_user
 o) Replaced MODLOAD, MODUNLOAD, MODRELOAD, MODLIST and MODRESTART commands
    with the new MODULE command which can be fed with the LOAD, UNLOAD, RELOAD
@@ -545,8 +714,8 @@ o) Added 'globops', 'restart', 'dline',
    these flags control
 o) Removed Idle-time klines
 o) Cleaned up modules API. Old modules won't work anymore
-o) Removed general::burst_away configuration directive. AWAY bursts are now
-   controlled via connect::flags explicitly
+o) Removed 'general::burst_away' configuration directive. AWAY bursts are now
+   controlled via 'connect::flags' explicitly
 o) Introduced new logging subsystem including log rotation based on
    file sizes. Log timestamp format is ISO8601 now
 o) Added support for remote D-lines
@@ -562,8 +731,8 @@ o) Removed 'ssl_server_protocol' configu
    added 'ssl_client_method' and 'ssl_server_method' instead.
    Both of these options can now be changed at runtime
 o) Oper login IDs are no longer limited to NICKLEN*2
-o) Removed channel::burst_topicwho configuration option. Topicsetters are
-   now sent by default
+o) Removed 'channel::burst_topicwho' configuration option. This feature is now
+   enabled by default
 o) "STATS Y|y" now reports CIDR limits as well
 o) Added m_webirc.c to contrib/
 o) Overall code cleanup and speed improvements