Commit Graph

1910 Commits

Author SHA1 Message Date
Alexander Barton 1a628fff51 WEBIRC: Don't respect hostname when DNS is disabled
When DNS lookups are disabled, don't set the hostname received by the
WEBIRC command, but use the IP address instead.

Reported by Toni Spets <toni.spets@iki.fi>, thanks!

Closes bug #167.
2013-12-27 22:34:47 +01:00
Alexander Barton b8433e9261 Check for working getaddrinfo() function
At least AIX 4.3.3 and 5.1 have a broken implementation of getaddrinfo()
which doesn't handle "0" as numeric service correctly. This patch adds
a configure check for this case and changes all calling functions to only
use getaddrinfo() if it "works".

See <http://www.stacken.kth.se/lists/heimdal-discuss/2004-05/msg00059.html>
2013-12-27 21:35:13 +01:00
Federico G. Schwindt 5a424f60da Fix spelling 2013-12-07 22:48:31 +00:00
Alexander Barton ae00c100ac Only use unsetenv() when it is available
AIX 4.3 dosn't support it, for example.
2013-11-10 17:08:51 +01:00
Alexander Barton 61d1c864c5 conf-ssl.h: make code compatible with pre-ANSI C compilers 2013-11-09 23:42:56 +01:00
Federico G. Schwindt 9ee3760493 Add comments around some IRC_SetPenalty() calls 2013-11-07 18:17:58 +00:00
Federico G. Schwindt 344185b1bd Rework the penalty handling slightly
Increase the penalty for a command before checking its arguments.  This
makes the handling more consistent and allow us to move more penalties to
Handle_Request().
2013-11-07 16:53:29 +00:00
Federico G. Schwindt fcf61e9e02 Move IRC_SetPenalty() to Handle_Request() when possible
This centralizes the penalty handling. It also exposes some commands that
lack it for our attention.
2013-11-07 16:29:21 +00:00
Federico G. Schwindt 9f236c4b91 Introduce a macro to define the command list
This will pave the way to other changes and simplifies the entries somewhat.
2013-11-07 13:20:08 +00:00
Federico G. Schwindt 00249f3c80 When sending an error use the IRC_WriteErrClient() variant
This ensures that all errors have a 2 second penalty.
2013-11-07 10:45:34 +00:00
Federico G. Schwindt 925b4de298 On bad /oper set the penalty to 10 seconds
This helps against brute-force attempts.
2013-11-06 21:46:53 +00:00
Federico G. Schwindt 48ea69d778 Remove unneded IRC_SetPenalty() calls
IRC_WriteErrClient() already calls IRC_SetPenalty().  While here convert
some IRC_SetPenalty() + IRC_WriteStrClient() to IRC_WriteErrClient().
2013-11-06 18:28:09 +00:00
Federico G. Schwindt 80d0613bf2 Use sizeof() intead of the explicit size 2013-11-06 18:25:11 +00:00
Alexander Barton 4ab688c5e8 Remove wrong #ifdef in Option_String()
This fixes the following error when compiling without zlib support:

  irc.c: In function ‘Option_String’:
  irc.c:487: error: ‘options’ undeclared (first use in this function)

Reported by "der_baer" on #ngircd.
2013-11-01 19:12:35 +01:00
Federico G. Schwindt 8e6db769ac Check and call arc4random_stir() if present
FreeBSD prior to 10.0 does not automatically stir on fork(). Same with
current NetBSD. If arc4random_stir() is present assume is needed and
call it instead of srand().
2013-10-23 16:00:26 +01:00
Federico G. Schwindt 62865f7e19 Add support for longer config lines
With the introduction of CipherList we could have longer config lines.
Handle up to 1024 bytes and warn if the line will be truncated.
2013-10-17 22:10:53 +01:00
Federico G. Schwindt a7dda1b28c Report the correct file on error 2013-10-17 21:52:15 +01:00
Federico G. Schwindt 17589534d0 Add support for arc4random
If arc4random is present it will be used over the srand/rand interface.
This fixes some warnings in OpenBSD-current.
2013-10-16 16:32:06 +01:00
Federico G. Schwindt ea26fd2840 Fix another strcat warning missed in commit 4c5b43 2013-10-16 10:41:40 +01:00
Alexander Barton 4c5b439992 ngircd.c, main(): use strlcat() instead of strcat()
This fixes the following warning on OpenBSD 5.3:

 ngircd.o(.text+0xeb4): In function `main':
  src/ngircd/ngircd.c:300: warning: strcat() is almost always misused,
                                    please use strlcat()

Thanks to Götz Hoffart for reporting this!
2013-10-07 21:56:09 +02:00
Alexander Barton 2798a12444 Actually KILL clients on GLINE/KLINE
Kill all clients that match a new GLINE/KLINE mask and genrate apropriate
KILL commands. These KILL commands can be superfluous, but are required
when the IRC Operator isn't allowd to set remote G-Lines or if there are
older servers in the network that don't kill clients on GLINE/KLINE.

Closes bug #156.
2013-10-01 12:26:34 +02:00
Alexander Barton 02182143c3 Don't forward KILL commands for unknown clients 2013-10-01 12:20:23 +02:00
Alexander Barton b5faf3055b New function IRC_KillClient() to kill clients
The old local function Kill_Nick() in irc.c has been an ugly hack. This
patch implements a generic function for killing clients.

Adjust all callers of Kill_Nick() and respect the return code!
2013-10-01 12:13:17 +02:00
Alexander Barton cccd8fc957 Adjust log messages for invalid and spoofed prefixes
Now invalid prefixes aren't logged no more when originating from an other
server (besides in debug mode), and spoofed prefixes are correctly logged
using LOG_WARNING (from an other server) or LOG_ERR (from a client) levels.

In addition, the log message texts have been adjusted to better reflect
what will happen: commands with invalid prefixes are ignored and logged,
commands with spoofed prefixes will result in the client being disconncted
(regular users) or the command being ignored (other servers).

This cleans up logging of commands related to already KILL'ed clients.
2013-09-26 02:28:16 +02:00
Alexander Barton eccbd97e1f Remove CLIENT.oper_by_my, Client_SetOperByMe() and Client_OperByMe()
All places where Client_OperByMe() is used can either be converted to
Client_HasMode(Client, 'o') or Op_Check().

And Op_Check() itself can use the connection handle for deciding whether
the IRC Operator is a local user or not.
2013-09-25 01:29:23 +02:00
Federico G. Schwindt ec5ab4fcd1 Add support to show user links using "STATS L"
Change "stats L" to show servers and user links and restrict it to
IRC Operators.
2013-09-24 21:17:35 +02:00
Alexander Barton 13a5358a3d Log an error (not info) when working directory can't be changed 2013-09-24 00:04:54 +02:00
Federico G. Schwindt 27b9d32bf2 Change the certificate fingerprint digest to sha256
While here correct some indentation.
2013-09-17 17:35:56 +01:00
Federico G. Schwindt 0985d69cc6 Change cipher defaults
Switch cipher defaults to HIGH:!aNULL:@STRENGTH (OpenSSL) or
SECURE128 (GnuTLS).
2013-09-17 17:15:24 +01:00
Alexander Barton d0977258ee Merge remote-tracking branch 'alex/bug162-SSLCipherList'
* alex/bug162-SSLCipherList:
  Cipher list selection for GnuTLS
  ConnSSL_Init_SSL(): correctly set CONN_SSL flag
  Cipher list selection for OpenSSL
  ConnSSL_InitLibrary(): Code cleanup
2013-09-16 17:32:25 +02:00
Federico G. Schwindt 2cebfc54f5 Fix server reconnection
In some error cases conn_id will be left as SERVER_WAIT and
subsequently ignored in Check_Servers(). Ensure conn_id is set to
NONE before returning from New_Server() if we couldn't establish
the connection.

Prompted by a report from gabrielgi-at-gmail-dot-com.
2013-09-16 02:15:49 +01:00
Alexander Barton de3e5fa77c Don't ignore SSL-related errors during startup
Without this patch, ngIRCd ignores SSL-related messages and continues
to start up but only listens on plain text communication ports -- and
this most probably isn't what the administrator wanted ...

Closes bug #163.
2013-09-16 00:31:03 +02:00
Alexander Barton b9006acee3 Cipher list selection for GnuTLS
This patch implements the missing functionality for cipher list selection
using GnuTLS (our OpenSSL code has this already).
2013-09-15 17:57:47 +02:00
Alexander Barton 51231ac8d4 ConnSSL_Init_SSL(): correctly set CONN_SSL flag
The CONN_SSL flag must be set before any calls to ConnSSL_Free()!
2013-09-15 17:35:52 +02:00
Alexander Barton 84ed46d4c1 Cipher list selection for OpenSSL
This patch introduces the possibility to arbitrarily select ciphers which
should be promoted resp. declined when establishing a SSL connection
with a client by implementing the new configuration option "CipherList".

By default, OpenSSL would accept low and medium strength and RC-4 ciphers,
which nowadays are known to be broken.

This patch only implements the feature for OpenSSL. A GnuTLS counterpart
has to be implemented in another patch ...

Original patch by Bastian <bastian-ngircd@t6l.de>.

Closes bug #162.
2013-09-15 15:09:36 +02:00
Alexander Barton 849f85a05c ConnSSL_InitLibrary(): Code cleanup 2013-09-15 14:09:31 +02:00
Alexander Barton e8e0351985 TRACE: fix error message when there are too many parameters
ircd 2.11 ignores additional parameters silently, but I don't think
that this is the correct behaviour either ...
2013-09-07 00:19:21 +02:00
Alexander Barton 131364def1 IRC_SetPenalty(): Code cleanup 2013-09-07 00:05:49 +02:00
Federico G. Schwindt bcb45da1b4 Add more penalty times
Ensure before every numeric 461 there is a call to IRC_SetPenalty().
2013-09-06 23:02:01 +01:00
Federico G. Schwindt 08f9d31d60 Rework check for number of parameters
Move most of the checks that return numeric 461 into Handle_Request().
2013-09-06 23:01:59 +01:00
Federico G. Schwindt 37609d6a4f Reorder checks
Move oper and Conf_MorePrivacy checks after checking the number of
parameters.
2013-09-05 17:31:57 +01:00
Federico G. Schwindt 33c2d5e4e2 Move the IRC_SetPenalty() call after the asserts 2013-09-05 17:31:57 +01:00
Federico G. Schwindt a98bbc8e0b Correct numeric returned by whois
As per RFC whois should return 431 if no nick is provided.  While
here convert upper check to use irc-macros. As a bonus we get to set
the penalty for free.
2013-09-05 17:31:56 +01:00
Federico G. Schwindt 9f74c0ff07 Minor cosmetic change
Add a define to indicate any client.  While I'm here use hex values
instead of decimal, it's somewhat clearer that they could be OR'ed
together.
2013-09-05 17:31:55 +01:00
Alexander Barton aad92ceafe Don't enforce channel types for other servers
The configuration option "AllowedChannelTypes" must only be enforced for
regular clients and not for remote servers. Channels created by other
servres are always allowed, because they already exist and the daemon
must stay in sync with the network.
2013-09-03 17:13:46 +02:00
Alexander Barton 4102e8fdfe Only log "IDENT ... no result" when IDENT was looked up
Without this patch, ngIRCd logged the "IDENT lookup for connection X:
no result"-message even when IDENT lookups have been disabled using the
"Ident = no" configuration option, which is a little bit misleading.

Reported by "btwe" in #ngircd.
2013-09-02 16:42:20 +02:00
Florian Westphal f8f8a9a041 ngircd: use setgid/setuid errno value in error path
Need to use saved errno value as strerror argument, else you
get bogus output ('success') in the log message.
2013-08-31 22:42:56 +02:00
Alexander Barton 04b947cdc3 Show connection flag "s" (SSL) in RPL_TRACE{LINK|SERVER}
Now you can check if a server-to-server link is SSL-encrypted or not
using the IRC "TRACE" command.

Idea by Götz Hoffart, thanks!
2013-08-31 14:15:24 +02:00
Federico G. Schwindt be2e611680 Change away to be allocated dynamically 2013-08-27 00:06:03 +01:00
Alexander Barton 41f75b6974 Ignore "operation not permitted" while dropping groups
Without this exception, you can't start ngIRCd as user any more,
it is analog to setting the user and group ID.
2013-08-27 00:41:36 +02:00