albino
/
ngircd-tor
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Move SSL-related configuration variables to new [SSL] section

This commit is contained in:
Alexander Barton 2011-06-26 00:09:36 +02:00
parent a085444035
commit 946d838de4
4 changed files with 149 additions and 93 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
INSTALL
View File

@ -17,8 +17,8 @@ Differences to version 17
- Support for ZeroConf/Bonjour/Rendezvous service registration has been
removed. The configuration option "NoZeroconf" is no longer available.
- The structure of ngircd.conf has been cleaned up and two new configuration
sections have been introduced: [Limits] and [Options].
- The structure of ngircd.conf has been cleaned up and three new configuration
sections have been introduced: [Limits], [Options], and [SSL].
Lots of configuration variables stored in the [Global] section are now
deprecated there and should be stored in one of these new sections (but
still work in [Global]):
@ -39,11 +39,11 @@ Differences to version 17
"PingTimeout" -> [Limits]
"PongTimeout" -> [Limits]
"PredefChannelsOnly" -> [Options]
"SSLCertFile" -> [Options]
"SSLDHFile" -> [Options]
"SSLKeyFile" -> [Options]
"SSLKeyFilePassword" -> [Options]
"SSLPorts" -> [Options]
"SSLCertFile" -> [SSL], and renamed to "CertFile"
"SSLDHFile" -> [SSL], and renamed to "DHFile"
"SSLKeyFile" -> [SSL], and renamed to "KeyFile"
"SSLKeyFilePassword" -> [SSL], and renamed to "KeyFilePassword"
"SSLPorts" -> [SSL], and renamed to "Ports"
"SyslogFacility" -> [Options]
"WebircPassword" -> [Options]
You should adjust your ngircd.conf and run "ngircd --configtest" to make

32
doc/sample-ngircd.conf.tmpl
View File

@ -12,7 +12,8 @@
# Use "ngircd --configtest" (see manual page ngircd(8)) to validate that the
# server interprets the configuration file as expected!
#
# Please see ngircd.conf(5) for a complete list of configuration options.
# Please see ngircd.conf(5) for a complete list of configuration options
# and their descriptions.
#
[Global]
@ -165,6 +166,23 @@
# "PONG" reply.
;RequireAuthPing = no
# Syslog "facility" to which ngIRCd should send log messages.
# Possible values are system dependent, but most probably auth, daemon,
# user and local1 through local7 are possible values; see syslog(3).
# Default is "local5" for historical reasons, you probably want to
# change this to "daemon", for example.
SyslogFacility = local1
# Password required for using the WEBIRC command used by some
# Web-to-IRC gateways. If not set/empty, the WEBIRC command can't
# be used. (Default: not set)
;WebircPassword = xyz
;[SSL]
# SSL-related configuration options. Please note that this section
# is only available when ngIRCd is compiled with support for SSL!
# So don't forget to remove the ";" above if this is the case ...
# SSL Server Key Certificate
;SSLCertFile = :ETCDIR:/ssl/server-cert.pem
@ -180,18 +198,6 @@
# Additional Listen Ports that expect SSL/TLS encrypted connections
;SSLPorts = 6697, 9999
# Syslog "facility" to which ngIRCd should send log messages.
# Possible values are system dependent, but most probably auth, daemon,
# user and local1 through local7 are possible values; see syslog(3).
# Default is "local5" for historical reasons, you probably want to
# change this to "daemon", for example.
SyslogFacility = local1
# Password required for using the WEBIRC command used by some
# Web-to-IRC gateways. If not set/empty, the WEBIRC command can't
# be used. (Default: not set)
;WebircPassword = xyz
[Operator]
# [Operator] sections are used to define IRC Operators. There may be
# more than one [Operator] block, one for each local operator.

41
man/ngircd.conf.5.tmpl
View File

@ -52,8 +52,8 @@ for numbers all decimal integer values are valid.
In addition, some string or numerical variables accept lists of values,
separated by commas (",").
.SH "SECTION OVERVIEW"
The file can contain blocks of four types: [Global], [Limits], [Options],
[Operator], [Server], and [Channel].
The file can contain blocks of seven types: [Global], [Limits], [Options],
[SSL], [Operator], [Server], and [Channel].
.PP
The main configuration of the server is stored in the
.I [Global]
@ -68,8 +68,10 @@ block are used to tweak different limits and timeouts of the daemon, like the
maximum number of clients allowed to connect to this server. Variables in the
.I [Options]
section can be used to enable or disable specific features of ngIRCd, like
support for IDENT, PAM, IPv6, SSL, and protocol and cloaking features. These
two sections are both optional.
support for IDENT, PAM, IPv6, and protocol and cloaking features. The
.I [SSL]
block contains all SSL-related configuration variables. These three sections
are all optional.
.PP
IRC operators of this server are defined in
.I [Operator]
@ -81,7 +83,7 @@ blocks are used to configure pre-defined ("persistent") IRC channels.
.PP
There can be more than one [Operator], [Server] and [Channel] section per
configuration file (one for each operator, server, and channel), but only
exactly one [Global], one [Limits], and one [Options] section.
exactly one [Global], one [Limits], one [Options], and one [SSL] section.
.SH [GLOBAL]
The
.I [Global]
@ -276,6 +278,23 @@ Let ngIRCd send an "authentication PING" when a new client connects, and
register this client only after receiving the corresponding "PONG" reply.
Default: no.
.TP
\fBSyslogFacility\fR (string)
Syslog "facility" to which ngIRCd should send log messages. Possible
values are system dependent, but most probably "auth", "daemon", "user"
and "local1" through "local7" are possible values; see syslog(3).
Default is "local5" for historical reasons, you probably want to
change this to "daemon", for example.
.TP
\fBWebircPassword\fR (string)
Password required for using the WEBIRC command used by some Web-to-IRC
gateways. If not set or empty, the WEBIRC command can't be used.
Default: not set.
.SH [SSL]
All SSL-related configuration variables are located in the
.I [SSL]
section. Please note that this whole section is only recognized by ngIRCd
when it is compiled with support for SSL using OpenSSL or GnuTLS!
.TP
\fBSSLCertFile\fR (string)
SSL Certificate file of the private server key.
.TP
@ -298,18 +317,6 @@ OpenSSL only: Password to decrypt the private key file.
Same as \fBPorts\fR , except that ngIRCd will expect incoming connections
to be SSL/TLS encrypted. Common port numbers for SSL-encrypted IRC are 6669
and 6697. Default: none.
.TP
\fBSyslogFacility\fR (string)
Syslog "facility" to which ngIRCd should send log messages. Possible
values are system dependent, but most probably "auth", "daemon", "user"
and "local1" through "local7" are possible values; see syslog(3).
Default is "local5" for historical reasons, you probably want to
change this to "daemon", for example.
.TP
\fBWebircPassword\fR (string)
Password required for using the WEBIRC command used by some Web-to-IRC
gateways. If not set or empty, the WEBIRC command can't be used.
Default: not set.
.SH [OPERATOR]
.I [Operator]
sections are used to define IRC Operators. There may be more than one

155
src/ngircd/conf.c
View File

@ -89,6 +89,8 @@ static void Init_Server_Struct PARAMS(( CONF_SERVER *Server ));
#ifdef SSL_SUPPORT
static void Handle_SSL PARAMS(( int Line, char *Var, char *Ark ));
struct SSLOptions Conf_SSLOptions;
/**
@ -377,18 +379,6 @@ Conf_Test( void )
#ifndef STRICT_RFC
printf(" RequireAuthPing = %s\n", yesno_to_str(Conf_AuthPing));
#endif
#ifdef SSL_SUPPORT
printf(" SSLCertFile = %s\n", Conf_SSLOptions.CertFile);
printf(" SSLDHFile = %s\n", Conf_SSLOptions.DHFile);
printf(" SSLKeyFile = %s\n", Conf_SSLOptions.KeyFile);
if (array_bytes(&Conf_SSLOptions.KeyFilePassword))
puts(" SSLKeyFilePassword = <secret>");
else
puts(" SSLKeyFilePassword = ");
array_free_wipe(&Conf_SSLOptions.KeyFilePassword);
printf(" SSLPorts = ");
ports_puts(&Conf_SSLOptions.ListenPorts);
#endif
#ifdef SYSLOG
printf(" SyslogFacility = %s\n",
ngt_SyslogFacilityName(Conf_SyslogFacility));
@ -396,6 +386,24 @@ Conf_Test( void )
printf(" WebircPassword = %s\n", Conf_WebircPwd);
puts("");
#ifdef SSL_SUPPORT
puts("[SSL]");
printf(" CertFile = %s\n", Conf_SSLOptions.CertFile
? Conf_SSLOptions.CertFile : "");
printf(" DHFile = %s\n", Conf_SSLOptions.DHFile
? Conf_SSLOptions.DHFile : "");
printf(" KeyFile = %s\n", Conf_SSLOptions.KeyFile
? Conf_SSLOptions.KeyFile : "");
if (array_bytes(&Conf_SSLOptions.KeyFilePassword))
puts(" KeyFilePassword = <secret>");
else
puts(" KeyFilePassword = ");
array_free_wipe(&Conf_SSLOptions.KeyFilePassword);
printf(" Ports = ");
ports_puts(&Conf_SSLOptions.ListenPorts);
puts("");
#endif
opers_puts();
for( i = 0; i < MAX_SERVERS; i++ ) {
@ -847,7 +855,8 @@ Read_Config( bool ngircd_starting )
strlcpy( section, str, sizeof( section ));
if (strcasecmp(section, "[GLOBAL]") == 0 ||
strcasecmp(section, "[LIMITS]") == 0 ||
strcasecmp(section, "[OPTIONS]") == 0)
strcasecmp(section, "[OPTIONS]") == 0 ||
strcasecmp(section, "[SSL]") == 0)
continue;
if( strcasecmp( section, "[SERVER]" ) == 0 ) {
@ -906,6 +915,10 @@ Read_Config( bool ngircd_starting )
Handle_LIMITS(line, var, arg);
else if(strcasecmp(section, "[OPTIONS]") == 0)
Handle_OPTIONS(line, var, arg);
#ifdef SSL_SUPPORT
else if(strcasecmp(section, "[SSL]") == 0)
Handle_SSL(line, var, arg);
#endif
else if(strcasecmp(section, "[OPERATOR]") == 0)
Handle_OPERATOR(line, var, arg);
else if(strcasecmp(section, "[SERVER]") == 0)
@ -952,9 +965,9 @@ Read_Config( bool ngircd_starting )
#ifdef SSL_SUPPORT
/* Make sure that all SSL-related files are readable */
CheckFileReadable("SSLCertFile", Conf_SSLOptions.CertFile);
CheckFileReadable("SSLDHFile", Conf_SSLOptions.DHFile);
CheckFileReadable("SSLKeyFile", Conf_SSLOptions.KeyFile);
CheckFileReadable("CertFile", Conf_SSLOptions.CertFile);
CheckFileReadable("DHFile", Conf_SSLOptions.DHFile);
CheckFileReadable("KeyFile", Conf_SSLOptions.KeyFile);
#endif
return true;
@ -1100,13 +1113,6 @@ CheckLegacyGlobalOption(int Line, char *Var, char *Arg)
|| strcasecmp(Var, "OperCanUseMode") == 0
|| strcasecmp(Var, "OperServerMode") == 0
|| strcasecmp(Var, "PredefChannelsOnly") == 0
#ifdef SSL_SUPPORT
|| strcasecmp(Var, "SSLCertFile") == 0
|| strcasecmp(Var, "SSLDHFile") == 0
|| strcasecmp(Var, "SSLKeyFile") == 0
|| strcasecmp(Var, "SSLKeyFilePassword") == 0
|| strcasecmp(Var, "SSLPorts") == 0
#endif
|| strcasecmp(Var, "SyslogFacility") == 0
|| strcasecmp(Var, "WebircPassword") == 0) {
Handle_OPTIONS(Line, Var, Arg);
@ -1122,6 +1128,16 @@ CheckLegacyGlobalOption(int Line, char *Var, char *Arg)
Handle_LIMITS(Line, Var, Arg);
return "[Limits]";
}
#ifdef SSL_SUPPORT
if (strcasecmp(Var, "SSLCertFile") == 0
|| strcasecmp(Var, "SSLDHFile") == 0
|| strcasecmp(Var, "SSLKeyFile") == 0
|| strcasecmp(Var, "SSLKeyFilePassword") == 0
|| strcasecmp(Var, "SSLPorts") == 0) {
Handle_SSL(Line, Var + 3, Arg);
return "[SSL]";
}
#endif
return NULL;
}
@ -1302,9 +1318,16 @@ Handle_GLOBAL( int Line, char *Var, char *Arg )
/** TODO: This function and support for these options in the
* [Global] section could be removed starting with ngIRCd
* release 19 (one release after marking it "deprecated"). */
Config_Error(LOG_WARNING,
"%s, line %d (section \"Global\"): \"%s\" is deprecated here, move it to %s!",
NGIRCd_ConfFile, Line, Var, section);
if (strncasecmp(Var, "SSL", 3) == 0) {
Config_Error(LOG_WARNING,
"%s, line %d (section \"Global\"): \"%s\" is deprecated here, move it to %s and rename to \"%s\"!",
NGIRCd_ConfFile, Line, Var, section,
Var + 3);
} else {
Config_Error(LOG_WARNING,
"%s, line %d (section \"Global\"): \"%s\" is deprecated here, move it to %s!",
NGIRCd_ConfFile, Line, Var, section);
}
return;
}
@ -1462,36 +1485,6 @@ Handle_OPTIONS(int Line, char *Var, char *Arg)
return;
}
#endif
#ifdef SSL_SUPPORT
if (strcasecmp(Var, "SSLCertFile") == 0) {
assert(Conf_SSLOptions.CertFile == NULL);
Conf_SSLOptions.CertFile = strdup_warn(Arg);
return;
}
if (strcasecmp(Var, "SSLDHFile") == 0) {
assert(Conf_SSLOptions.DHFile == NULL);
Conf_SSLOptions.DHFile = strdup_warn(Arg);
return;
}
if (strcasecmp(Var, "SSLKeyFile") == 0) {
assert(Conf_SSLOptions.KeyFile == NULL);
Conf_SSLOptions.KeyFile = strdup_warn(Arg);
return;
}
if (strcasecmp(Var, "SSLKeyFilePassword") == 0) {
assert(array_bytes(&Conf_SSLOptions.KeyFilePassword) == 0);
if (!array_copys(&Conf_SSLOptions.KeyFilePassword, Arg))
Config_Error(LOG_ERR,
"%s, line %d (section \"Global\"): Could not copy %s: %s!",
NGIRCd_ConfFile, Line, Var,
strerror(errno));
return;
}
if (strcasecmp(Var, "SSLPorts") == 0) {
ports_parse(&Conf_SSLOptions.ListenPorts, Line, Arg);
return;
}
#endif
#ifdef SYSLOG
if (strcasecmp(Var, "SyslogFacility") == 0) {
Conf_SyslogFacility = ngt_SyslogFacilityID(Arg,
@ -1509,6 +1502,56 @@ Handle_OPTIONS(int Line, char *Var, char *Arg)
Config_Error_Section(Line, Var, "Options");
}
#ifdef SSL_SUPPORT
/**
* Handle variable in [SSL] configuration section.
*
* @param Line Line numer in configuration file.
* @param Var Variable name.
* @param Arg Variable argument.
*/
static void
Handle_SSL(int Line, char *Var, char *Arg)
{
assert(Line > 0);
assert(Var != NULL);
assert(Arg != NULL);
if (strcasecmp(Var, "CertFile") == 0) {
assert(Conf_SSLOptions.CertFile == NULL);
Conf_SSLOptions.CertFile = strdup_warn(Arg);
return;
}
if (strcasecmp(Var, "DHFile") == 0) {
assert(Conf_SSLOptions.DHFile == NULL);
Conf_SSLOptions.DHFile = strdup_warn(Arg);
return;
}
if (strcasecmp(Var, "KeyFile") == 0) {
assert(Conf_SSLOptions.KeyFile == NULL);
Conf_SSLOptions.KeyFile = strdup_warn(Arg);
return;
}
if (strcasecmp(Var, "KeyFilePassword") == 0) {
assert(array_bytes(&Conf_SSLOptions.KeyFilePassword) == 0);
if (!array_copys(&Conf_SSLOptions.KeyFilePassword, Arg))
Config_Error(LOG_ERR,
"%s, line %d (section \"SSL\"): Could not copy %s: %s!",
NGIRCd_ConfFile, Line, Var,
strerror(errno));
return;
}
if (strcasecmp(Var, "Ports") == 0) {
ports_parse(&Conf_SSLOptions.ListenPorts, Line, Arg);
return;
}
Config_Error_Section(Line, Var, "SSL");
}
#endif
/**
* Handle variable in [Operator] configuration section.
*