| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
ngIRCd 27 now checks server certificates, and without `CAFile` set will
reject all server/server connections with a confusing error.
Update documentation to say that `CAFile` is needed to accept incoming
server connections.
Closes #320.
|
|
While it is common for IRC servers to use ERR_NOSUCHNICK instead of
ERR_NOSUCHCHANNEL when a target can be either a channel or a nick, it seems
every other IRCd but UnrealIRCd uses ERR_NOSUCHCHANNEL in this particular case.
|
|
|
|
|
|
This fixes the following compiler warning, for example on OpenSolaris:
conn.c: In function 'Conn_Handler':
conn.c:798:28: warning: format '%ld' expects argument of type 'long int',
but argument 4 has type 'size_t' {aka 'unsigned int'} [-Wformat=]
|
|
|
|
|
|
|
|
|
|
References:
- https://modern.ircdocs.horse/#rplnamreply-353
- https://datatracker.ietf.org/doc/html/rfc2812#page-47
- (RFC 1459 is irrelevant here, as
https://datatracker.ietf.org/doc/html/rfc1459#page-51 uses a different
format)
Closes #313.
|
|
Both setgid(2) as well as setuid(2) can fail with EINVAL in addition to
EPERM, their manual pages state "EINVAL: The user/group ID specified in
uid/gid is not valid in this user namespace ".
So not only treat EPERM as an "acceptable error" and continue with
logging the error, but do the same for EINVAL.
This was triggered by the Void Linux xbps-uunshare(1) tool used for
building "XBPS source packages" and reported by luca in #ngircd. Thanks!
|
|
|
|
Thanks for reporting this on IRC, luca!
|
|
|
|
The LOGNAME environment variable is not set in GitHub "actions", for
example ...
|
|
|
|
|
|
|
|
Periodically "ping" the service manager (every 3 seconds) and set a
status message showing connection statistics.
This enables using the systemd(8) watchdog functionality for the
"ngircd.service" unit.
|
|
This allows the "ngircd.service" systemd(8) unit to use the "notify"
service type, which allows for better status tracking by the service
manager.
|
|
|
|
Wait for the "ERROR :Closing connection" message sent by ngIRCd when
handling the QUIT command, do not wait for "Connection closed" which is
actually output by the telnet(1) command and is implementation
dependant! For example, on Haiku OS, this is not always(!) echoed (the
command seems to hang sometimes?) which results in unpredictable
failures in the test suite ...
|
|
- Try to only search for processes of the current user.
- Prefer using pgrep (in addition to pidof) when available.
- Streamline system overrides.
- Get rid of HEAD_FLAGS: all systems so far support "-1".
- Use "ps -o pid,comm" as the default, which is POSIX.1.
- Use "sort -r" to hopefully get the newest (=highest) PID, which is the
case on older systems not using randomized PIDs at least.
|
|
- Reformat code.
- Cleanup some glitches, streamline scripts ...
- Enable "set -u": Error on unset variables.
- Detect "$srcdir" in prep-server3 script, too.
|
|
Although this is a nice looking solution, it is not that portable: for
example, the "openssl s_client" command of LibreSSL 3.8.2 on OpenBSD 7.4
does not support it.
So let's revert back to the "uglier" but working variant ...
This reverts commit bdb55fb4b322b2c84530855a3b5148a0e387f5b4.
|
|
|
|
This completes commit f96966a6.
|
|
|
|
The number of possible parallel connections is limited by the process
file descriptor limit (among other things). Therefore try to upgrade the
current "soft" limit to its "hard" maximum (but limit it to 100000), and
show an information or even warning, wenn still less than the configured
"MaxConnections" setting.
Please note that ngIRCd and its linked libraries (like PAM) need file
descriptors not only for incoming and outgoing IRC connections, but for
reading files and inter-process communication, too! Therefore the actual
connection limit is _less_ than the file descriptor limit!
This introduces the new MAX_FD_LIMIT (100000) #define.
|
|
|
|
|
|
|
|
|
|
|
|
No longer describe creating self-signed certificates or using "stunnel",
as both is not recommended.
|
|
|
|
This is already mentioned as the default in the manual page and the
sample configuration file, but was actually not enabled in the code!
|
|
|
|
Show proper certificate information for incoming connections, too, and
not "peer did not present a certificate", regardless if the client sent
a certificate or not.
This change is for GnuTLS and similar to what was implemented in commit
for OpenSSL in "S2S-TLS/OpenSSL: Fix handling of certificate information
for incoming connections".
|
|
Without this, the S2S-TLS-Patch not even compiles with GnuTLS because
of the "new" GnuTLS certificate reload support implemented in commit
eead4a63 ("x509_cred_slot").
|
|
|
|
|
|
This includes simplifying cb_connserver_login_ssl() a bit, we do not
have to code for invalid state which was ruled out by an assert() and
therefore can get rid of the goto altogether (and don't log the same
error twice with different messages).
|
|
handshake
The verify callback in OpenSSL is called pretty early, and at that time
it is not possible yet to check which connection it belongs to, and some
connections may have relaxed requirements.
So always return success in the Verify_openssl() callback, and postpone
validation of the TLS session until starting the server handshake in
cb_connserver_login_ssl(), when we know which server this connection
belongs to and which options (like "SSLVerify") are in effect.
The code doing this was already present in cb_connserver_login_ssl(),
but this patch adds a more prominent comment to the function.
|
|
connections
Show proper certificate information for incoming connections, too, and
not "peer did not present a certificate", regardless if the client sent
a certificate or not.
And free the client certificate structure "peer_cert" on incoming
connections as well!
|
|
Set the verification flags in the ConnSSL_SetVerifyProperties_openssl
function only, don't override them in ConnSSL_InitLibrary() afterwards.
No functional changes, now ConnSSL_SetVerifyProperties_openssl() sets
exactly the parameters which ConnSSL_InitLibrary() always overwrote ...
|
|
Setup host name verification even when the "SSLVerify" option is
disabled, because even then the peer can present a valid certificate and
validation would always(!) fail because of the missing host name
verification setup.
|
|
|