ItsOnlyBinary [Sun, 7 Oct 2018 21:33:27 +0000 (22:33 +0100)]
Allow a 5th parameter in WEBIRC
According to an IRCv3 extension, the 5th parameter can be used for extra
flags that are fine to ignore for now, but limiting WEBIRC params to 4
causes a syntax error.
See https://github.com/ircv3/ircv3-ideas/issues/12 for more information.
Alexander Barton [Sun, 25 Mar 2018 19:55:34 +0000 (21:55 +0200)]
Correctly retry outgoing conenctions when forking a resolver failed
When ngIRCd failed to spawn a new resolver subprocess, the connection
structure was still marked as "SERVER_WAIT", and no new attempt to
connect to this server was made.
Thanks to Robert Obermeier for reporting this bug!
Alexander Barton [Sun, 11 Mar 2018 20:06:03 +0000 (21:06 +0100)]
Fix use-after-free while handling ERROR during client login
This patch fixes a "use after free" bug which is hit while processing
ERROR commands while a new client is logging into the server, which
leads to only the CLIENT structure becoming freed, but not the
CONNECTION structure, too. And this leads to the daemon accessing the
already freed CLIENT structure later on ...
So now IRC_ERROR() uses the correct function Conn_Close() to correctly
free both structures.
The CONNECTION structure is cleaned up later on, and the freed CLIENT
structure can't be overwritten during normal operations, therefore this
bug normally can't crash (DoS) the service -- but you can easily hit it
when using the GCC option "-fsanitize=address", or run ngIRCd with
Valgrind.
Thanks a lot to Joseph Bisch <joseph.bisch@gmail.com> for discovering
and reporting this issue!
Alexander Barton [Sun, 11 Mar 2018 19:57:19 +0000 (20:57 +0100)]
Only send TOPIC updates to a channel when the topic actually changed
This prevents the channel from becoming flooded by unecessary TOPIC
update messages, that can happen when IRC services try to enforce a
certain topic but which is already set (at least on the local server),
for example. Therefore still forward it to all servers, but don't inform
local clients (still update setter and timestamp information, though!)
Alexander Barton [Fri, 27 Mar 2015 23:05:39 +0000 (00:05 +0100)]
User mode "C": Allow messages from servers, services, and IRC Ops
Update user mode "C" handling ("Only users that share a channel are
allowed to send messages") to behave like user mode "b" ("block private
messages and notices") and therefore allow messages from servers, services,
and IRC Operators, too.
Alexander Barton [Mon, 29 Jan 2018 22:30:53 +0000 (23:30 +0100)]
Fix Get_Error() usage, take II
This should fix the following compiler warning:
resolve.c:113:1: warning: ‘Get_Error’ defined but not used
[-Wunused-function]
Which can happen, because the logic of commit 543f44bf isn't sufficient:
Get_Error() is only used when neither HAVE_WORKING_GETADDRINFO nor
HAVE_GETNAMEINFO are set ...
Alexander Barton [Sat, 30 Sep 2017 14:48:28 +0000 (16:48 +0200)]
Allow IRC Ops and remote servers to KILL service clients (#242)
In the end, service clients behave like regular users, therefore IRC
operators and servers should be able to KILL them: for example to
resolve nick collisions.
Alexander Barton [Wed, 18 Jan 2017 23:06:46 +0000 (00:06 +0100)]
Fix handling of connection pool allocation and enlargement
The daemon only enlarged its connection pool when accepting new client
connections, not when establishing new outgoing server links.
Thanks to Lukas Braun (k00mi) for reporting this!
In addition this patch streamlines the connection pool allocation, so
that there is only one place in the code allocating the pool: the now
updated Socket2Index() function. The name doesn't quite fit, but this
existing and today quite useless function (because the mapping from
socket number to connection index is 1:1 today) already became called
in almost all relevant code paths, so I decided to reuse it to keep the
patch small ...probably we want to fix the naming in a second patch?
- Add more comments/documentation.
- Add dependencies for services and proxy scanners.
- Add more limit configurations.
- Allow AF_UNIX address family, required for syslog!
- Add homepage :-)
- Remote CAP_SETUID and CAP_SETGID from CapabilityBoundingSet: This is
nor needed, because the unit already sets User=irc and Group=irc.
- Add RestrictAddressFamilies, and restrict it to AF_INET and AF_INET6.
- Read in the Debian "default files", but note: only PARAMS is supported!
- Update debhelper compatibility to version 9.
- Update build-dependencies.
- Change group of ngircd.conf to "irc" in postinst script (this makes
starting ngIRCd as user "irc" easier, for example when using systemd).
- Don't create /var/run/ircd during installation: this is handled by the
SysV init script and the systemd service already.
Immediately shut down connection on receiving ERROR
Don't wait for the peer to close the connection. This allows us to
forward the ERROR mesage in the network, instead of the very generic
"client closed connection" message.
G-LINES: Forbid remote modifications if "AllowRemoteOper" is not set
Explicitely forbid remote servers to modify "x-lines" (G-LINES) when the
"AllowRemoteOper" configuration option isn't set, even when the command
seems to originate from the remote server itself: this prevents GLINE's
to become set during server handshake in this case (what wouldn't be
possible during regular runtime when a remote IRC Op sends the command)
and what can't be undone by IRC Ops later on (because of the missing
"AllowRemoteOper" option) ...
Christoph Biedl [Mon, 5 Dec 2016 19:26:00 +0000 (20:26 +0100)]
Fix building ngIRCd with OpenSSL 1.1
At the moment, ngIRCd fails to build against OpenSSL 1.1 since the
configure check probes for the SSL_library_init symbol which was
removed, but probing for a different function availabe in both versions
solves that problem: SSL_new().
And as SSL_library_init is no longer needed, the patch boils down to
probing SSL_new to assert libssl is available, and disabling the
SSL_library_init invokation from OpenSSL 1.1 on, see also another
application[1] (NSCA-ng) that did pretty much the same.
Patch was compile-tested on both Debian jessie (OpenSSL 1.0.2) and
stretch (OpenSSL 1.1).
This fixes the following correct -Wmisleading-indentation warning
messages of gcc 6.2:
irc-write.c: In function ‘IRC_SendWallops’:
irc-write.c:521:4: warning: this ‘if’ clause does not guard...
irc-write.c:524:5: note: ...this statement, but the latter is
misleadingly indented as if it is guarded by the ‘if’
irc-write.c:526:4: warning: this ‘if’ clause does not guard... []
irc-write.c:529:5: note: ...this statement, but the latter is
misleadingly indented as if it is guarded by the ‘if’
irc-info.c: In function ‘IRC_STATS’:
irc-info.c:895:3: warning: this ‘else’ clause does not guard...
irc-info.c:897:4: note: ...this statement, but the latter is
misleadingly indented as if it is guarded by the ‘else’
No functional changes, the code has been correct, but the indentation
was wrong ...
- Update x86_64/apple/darwin15.6.0 (Apple clang 8.0)
- Update x86_64/unknown/linux-gnu (gcc 4.9.2)
- Update i386/pc/solaris2.11 (gcc 4.8.2), tests have been run both on
Solaris 11.2 and Solaris 11.3 successfully, but the system identifier
is the same ... Thanks to Götz Hoffart <goetz@hoffart.de>!
Alexander Barton [Sat, 19 Dec 2015 18:23:50 +0000 (19:23 +0100)]
autogen.sh, ngindent, platformtest.sh: Fix warnings of "shellcheck"
- SC2006: Use $(..) instead of legacy `..`.
- SC2015: Note that A && B || C is not if-then-else. C may run
when A is true.
- SC2086: Double quote to prevent globbing and word splitting.
- SC2166: Prefer [ p ] && [ q ] as [ p -a q ] is not well defined.
This setting allows to run multiple ngIRCd instances with separate PAM
configurations on each instance. If one sets it to ngircd-foo, PAM will
use /etc/pam.d/ngircd-foo instead of the default /etc/pam.d/ngircd.
Thanks to "somechris" for the patch & pull request!
Add PAMServiceName setting to specify the used PAM configuration
This setting allows to run multiple ngIRCd instances with
PAM configurations on each instance.
If one sets it to "ngircd-foo", PAM will use `/etc/pam.d/ngircd-foo`
instead of the default `/etc/pam.d/ngircd`.
This combination had been successfully tested with ngIRCd 21, but after
further investigation didn't build correctly: it seems as if tcc fails
to correctly link external libraries (e. g. ngipaddr).
Astonishingly the test suite passed nevertheless, with garbled output,
but without the daemon crashing!?
When using tcc with ngIRCd 23 (and current master), the test suite fails
completely because the daemon crashes ... (which actually is good!)
Alexander Barton [Sun, 10 Jan 2016 16:39:43 +0000 (17:39 +0100)]
platformtest.sh: Only show "runs=Y" when test suite succeeded
Display "?" in the "runs" colum when the simple "run test" succeeded but
the test suite failed. And display a message to double check the actual
status, because it is somewhat unclear, if the daemon actually "works"
or not in this case.
Clients can specify multiple targets for the "PRIVMSG", "NOTICE", and
"SQUERY" commands, separated by commas (e. g. "PRIVMSG a,#b,c :text").
Since commit 49ab79d0 ("Limit the number of message targes, and suppress
duplicates"), ngIRCd crashed when the client sent the separator character
only as target(s), e. g. "," or ",,,," etc.!
This patch fixes the bug and adds a test case for this issue.
Thanks to Florian Westphal <fw@strlen.de> for spotting the issue!
Limit the number of message targes, and suppress duplicates
This prevents an user from flooding the server using commands like this:
PRIVMSG nick1,nick1,nick1,...
Duplicate targets are suppressed silently (channels and clients).
In addition, the maximum number of targets per PRIVMSG/NOTICE/... command
are limited to MAX_HNDL_TARGETS (25). If there are more, the daemon sends
the new 407 (ERR_TOOMANYTARGETS_MSG) numeric, containing the first target
that hasn't been handled any more.
Get rid of unclever assert() in Send_Message_Mask()
Either we use assert() to _guarantee_ a certain condition, or we use
if(...) to test for it. But never both.
So get rid of the assert() in Send_Message_Mask() and handle the case
that the target mask doesn't contain a dot (".") as regular error,
don't require the caller to assure that any more.
projects / ngircd-alex.git / log