May 2009 - ngIRCd GIT Updates

Florian Westphal : conn.c: fix NumConnections imbalance
by fw＠arthur.barton.de 17 May '09

17 May '09

Module: ngircd.git Branch: master Commit: 9b1c47220fafeacda1e83b4732e1c8574062aac6 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=9b1c4722… Author: Florian Westphal <fw(a)strlen.de> Date: Sun May 17 21:32:53 2009 +0200 conn.c: fix NumConnections imbalance New_Server() can call Conn_Close() in its error paths, but that function decrements the number of current active connections. Thus we need to increment it earlier. --- src/ngircd/conn.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/src/ngircd/conn.c b/src/ngircd/conn.c index 4c03877..77a2bc1 100644 --- a/src/ngircd/conn.c +++ b/src/ngircd/conn.c @@ -1696,6 +1696,8 @@ New_Server( int Server , ng_ipaddr_t *dest) return; } + /* Conn_Close() decrements this counter again */ + NumConnections++; Client_SetIntroducer( c, c ); Client_SetToken( c, TOKEN_OUTBOUND ); @@ -1725,7 +1727,6 @@ New_Server( int Server , ng_ipaddr_t *dest) return; } #endif - NumConnections++; LogDebug("Registered new connection %d on socket %d (%ld in total).", new_sock, My_Connections[new_sock].sock, NumConnections); Conn_OPTION_ADD( &My_Connections[new_sock], CONN_ISCONNECTING );

1 0

Florian Westphal : SSL/TLS: fix error handling when ssl ctx init for outgoing server link fails
by fw＠arthur.barton.de 17 May '09

17 May '09

Module: ngircd.git Branch: master Commit: 8e2c5816eec58a5de63399a54773dda6a5729c36 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=8e2c5816… Author: Florian Westphal <fw(a)strlen.de> Date: Sun May 17 21:27:27 2009 +0200 SSL/TLS: fix error handling when ssl ctx init for outgoing server link fails --- src/ngircd/conn.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/ngircd/conn.c b/src/ngircd/conn.c index c6095a3..4c03877 100644 --- a/src/ngircd/conn.c +++ b/src/ngircd/conn.c @@ -1722,6 +1722,7 @@ New_Server( int Server , ng_ipaddr_t *dest) Conn_Close( new_sock, "Could not initialize SSL for outgoing connection", NULL, false ); Init_Conn_Struct( new_sock ); Conf_Server[Server].conn_id = NONE; + return; } #endif NumConnections++;

1 0

Florian Westphal : SSL/TLS: fix error path in gnutls ssl ctx allocation
by fw＠arthur.barton.de 17 May '09

17 May '09

Module: ngircd.git Branch: master Commit: f31c3a3aa283bd6a34386e3c2fcdcad9ab36e5c4 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=f31c3a3a… Author: Florian Westphal <fw(a)strlen.de> Date: Sun May 17 21:18:04 2009 +0200 SSL/TLS: fix error path in gnutls ssl ctx allocation --- src/ngircd/conn-ssl.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index fbf796c..ae1646c 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -406,6 +406,7 @@ ConnSSL_Init_SSL(CONNECTION *c) if (ret < 0) { Log(LOG_ERR, "gnutls_set_default_priority: %s", gnutls_strerror(ret)); ConnSSL_Free(c); + return false; } /* * The intermediate (long) cast is here to avoid a warning like: @@ -418,6 +419,7 @@ ConnSSL_Init_SSL(CONNECTION *c) if (ret < 0) { Log(LOG_ERR, "gnutls_credentials_set: %s", gnutls_strerror(ret)); ConnSSL_Free(c); + return false; } gnutls_dh_set_prime_bits(c->ssl_state.gnutls_session, DH_BITS); #endif

1 0

Florian Westphal : manpage: move SSLConnect option to the right section
by fw＠arthur.barton.de 17 May '09

17 May '09

Module: ngircd.git Branch: master Commit: b0931f322b527f24215419e9c73eda7d7f22de6a URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=b0931f32… Author: Florian Westphal <fw(a)strlen.de> Date: Sun May 17 01:22:18 2009 +0200 manpage: move SSLConnect option to the right section --- man/ngircd.conf.5.tmpl | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/man/ngircd.conf.5.tmpl b/man/ngircd.conf.5.tmpl index df15b77..8e5b254 100644 --- a/man/ngircd.conf.5.tmpl +++ b/man/ngircd.conf.5.tmpl @@ -221,9 +221,6 @@ Default: 10. Maximum length of an user nick name (Default: 9, as in RFC 2812). Please note that all servers in an IRC network MUST use the same maximum nick name length! -.TP -\fBSSLConnect\fR -Connect to the remote server using TLS/SSL. Default: false. .SH [OPERATOR] .I [Operator] sections are used to define IRC Operators. There may be more than one @@ -287,6 +284,9 @@ Group of this server (optional). Disable automatic connection even if port value is specified. Default: false. You can use the IRC Operator command CONNECT later on to create the link. .TP +\fBSSLConnect\fR +Connect to the remote server using TLS/SSL. Default: false. +.TP \fBServiceMask\fR Define a (case insensitive) mask matching nick names that should be treated as IRC services when introduced via this remote server. REGULAR SERVERS DON'T NEED

1 0

Florian Westphal : SSL/TLS: remove redundant asserts/ifdefs
by fw＠arthur.barton.de 16 May '09

16 May '09

Module: ngircd.git Branch: master Commit: 5196e9bcb17111c43a71df2d11634b0705600b9f URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=5196e9bc… Author: Florian Westphal <fw(a)strlen.de> Date: Fri May 15 23:28:59 2009 +0200 SSL/TLS: remove redundant asserts/ifdefs --- src/ngircd/conn-ssl.c | 29 ++++++----------------------- 1 files changed, 6 insertions(+), 23 deletions(-) diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index 46f1c9d..fbf796c 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -383,7 +383,6 @@ ConnSSL_Init_SSL(CONNECTION *c) int ret; assert(c != NULL); #ifdef HAVE_LIBSSL - assert(ssl_ctx); if (!ssl_ctx) /* NULL when library initialization failed */ return false; @@ -433,10 +432,7 @@ ConnSSL_PrepareConnect(CONNECTION *c, UNUSED CONF_SERVER *s) bool ret; #ifdef HAVE_LIBGNUTLS int err; -#endif - assert(c != NULL); - assert(s != NULL); -#ifdef HAVE_LIBGNUTLS + err = gnutls_init(&c->ssl_state.gnutls_session, GNUTLS_CLIENT); if (err) { Log(LOG_ERR, "gnutls_init: %s", gnutls_strerror(err)); @@ -471,8 +467,6 @@ ConnSSL_HandleError( CONNECTION *c, const int code, const char *fname ) unsigned long sslerr; int real_errno = errno; - assert( fname ); - ret = SSL_get_error(c->ssl_state.ssl, code); switch (ret) { case SSL_ERROR_WANT_READ: @@ -545,8 +539,7 @@ ConnSSL_LogCertInfo( CONNECTION *c ) #ifdef HAVE_LIBSSL SSL *ssl = c->ssl_state.ssl; - assert( c ); - assert( ssl ); + assert(ssl); Log(LOG_INFO, "New %s connection using cipher %s on socket %d.", SSL_get_version(ssl), SSL_get_cipher(ssl), c->sock); @@ -574,11 +567,8 @@ int ConnSSL_Accept( CONNECTION *c ) { assert(c != NULL); -#ifdef HAVE_LIBSSL - if (!c->ssl_state.ssl) { -#endif -#ifdef HAVE_LIBGNUTLS if (!Conn_OPTION_ISSET(c, CONN_SSL)) { +#ifdef HAVE_LIBGNUTLS int err = gnutls_init(&c->ssl_state.gnutls_session, GNUTLS_SERVER); if (err) { Log(LOG_ERR, "gnutls_init: %s", gnutls_strerror(err)); @@ -600,9 +590,7 @@ ConnSSL_Connect( CONNECTION *c ) #ifdef HAVE_LIBSSL assert(c->ssl_state.ssl); #endif -#ifdef HAVE_LIBGNUTLS assert(Conn_OPTION_ISSET(c, CONN_SSL)); -#endif return ConnectAccept(c, true); } @@ -622,7 +610,6 @@ ConnectAccept( CONNECTION *c, bool connect) #endif #ifdef HAVE_LIBGNUTLS (void) connect; - assert(Conn_OPTION_ISSET(c, CONN_SSL)); ret = gnutls_handshake(c->ssl_state.gnutls_session); if (ret) return ConnSSL_HandleError(c, ret, "gnutls_handshake"); @@ -647,7 +634,8 @@ ConnSSL_Write(CONNECTION *c, const void *buf, size_t count) #ifdef HAVE_LIBGNUTLS bw = gnutls_write(c->ssl_state.gnutls_session, buf, count); #endif - if ( bw > 0 ) return bw; + if (bw > 0) + return bw; if (ConnSSL_HandleError( c, bw, "ConnSSL_Write") == 0) errno = EAGAIN; /* try again */ return -1; @@ -684,11 +672,8 @@ ConnSSL_GetCipherInfo(CONNECTION *c, char *buf, size_t len) { #ifdef HAVE_LIBSSL char *nl; + SSL *ssl = c->ssl_state.ssl; - SSL *ssl; - assert(c != NULL); - assert(len >= 128); - ssl = c->ssl_state.ssl; if (!ssl) return false; *buf = 0; @@ -699,8 +684,6 @@ ConnSSL_GetCipherInfo(CONNECTION *c, char *buf, size_t len) return true; #endif #ifdef HAVE_LIBGNUTLS - assert(c != NULL); - assert(len >= 128); if (Conn_OPTION_ISSET(c, CONN_SSL)) { const char *name_cipher, *name_mac, *name_proto, *name_keyexchange; unsigned keysize;

1 0

Florian Westphal : SSL/TLS: proper indentation, remove erroneous comment
by fw＠arthur.barton.de 13 May '09

13 May '09

Module: ngircd.git Branch: master Commit: 57aa64e1176b47830801cec8615affcc24cfb142 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=57aa64e1… Author: Florian Westphal <fw(a)strlen.de> Date: Wed May 13 17:29:10 2009 +0200 SSL/TLS: proper indentation, remove erroneous comment --- src/ngircd/conn-ssl.c | 15 +++++++-------- 1 files changed, 7 insertions(+), 8 deletions(-) diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index 4ef8f66..46f1c9d 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -518,15 +518,14 @@ ConnSSL_HandleError( CONNECTION *c, const int code, const char *fname ) switch (code) { case GNUTLS_E_AGAIN: case GNUTLS_E_INTERRUPTED: - if (gnutls_record_get_direction(c->ssl_state.gnutls_session)) { /* need write */ - io_event_del(c->sock, IO_WANTREAD); - Conn_OPTION_ADD(c, CONN_SSL_WANT_WRITE); /* fall through */ - break; - } else { /* need read */ - io_event_del(c->sock, IO_WANTWRITE); - Conn_OPTION_ADD(c, CONN_SSL_WANT_READ); + if (gnutls_record_get_direction(c->ssl_state.gnutls_session)) { + Conn_OPTION_ADD(c, CONN_SSL_WANT_WRITE); + io_event_del(c->sock, IO_WANTREAD); + } else { + Conn_OPTION_ADD(c, CONN_SSL_WANT_READ); + io_event_del(c->sock, IO_WANTWRITE); + } break; - } default: assert(code < 0); if (gnutls_error_is_fatal(code)) {

1 0

Florian Westphal : SSL/TLS: proper indentation, remove erroneous comment
by fw＠arthur.barton.de 13 May '09

13 May '09

Module: ngircd.git Branch: master Commit: 11a037340d55e9528b93c72adac7d33b50a5e496 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=11a03734… Author: Florian Westphal <fwestphal(a)astaro.com> Date: Wed May 13 17:29:10 2009 +0200 SSL/TLS: proper indentation, remove erroneous comment --- src/ngircd/conn-ssl.c | 15 +++++++-------- 1 files changed, 7 insertions(+), 8 deletions(-) diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index 4ef8f66..46f1c9d 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -518,15 +518,14 @@ ConnSSL_HandleError( CONNECTION *c, const int code, const char *fname ) switch (code) { case GNUTLS_E_AGAIN: case GNUTLS_E_INTERRUPTED: - if (gnutls_record_get_direction(c->ssl_state.gnutls_session)) { /* need write */ - io_event_del(c->sock, IO_WANTREAD); - Conn_OPTION_ADD(c, CONN_SSL_WANT_WRITE); /* fall through */ - break; - } else { /* need read */ - io_event_del(c->sock, IO_WANTWRITE); - Conn_OPTION_ADD(c, CONN_SSL_WANT_READ); + if (gnutls_record_get_direction(c->ssl_state.gnutls_session)) { + Conn_OPTION_ADD(c, CONN_SSL_WANT_WRITE); + io_event_del(c->sock, IO_WANTREAD); + } else { + Conn_OPTION_ADD(c, CONN_SSL_WANT_READ); + io_event_del(c->sock, IO_WANTWRITE); + } break; - } default: assert(code < 0); if (gnutls_error_is_fatal(code)) {

1 0

Alexander Barton : Update copyright notice, it's 2009 already!
by alex＠arthur.barton.de 05 May '09

05 May '09

Module: ngircd.git Branch: master Commit: fd7e85b798c422f4b95de05b20ad56f59695938a URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=fd7e85b7… Author: Alexander Barton <alex(a)barton.de> Date: Tue May 5 17:08:48 2009 +0200 Update copyright notice, it's 2009 already! --- src/ngircd/ngircd.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/ngircd/ngircd.c b/src/ngircd/ngircd.c index 95c377a..5fc88c9 100644 --- a/src/ngircd/ngircd.c +++ b/src/ngircd/ngircd.c @@ -1,6 +1,6 @@ /* * ngIRCd -- The Next Generation IRC Daemon - * Copyright (c)2001-2008 Alexander Barton (alex(a)barton.de) + * Copyright (c)2001-2009 Alexander Barton (alex(a)barton.de) * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -562,7 +562,7 @@ static void Show_Version( void ) { puts( NGIRCd_Version ); - puts( "Copyright (c)2001-2008 Alexander Barton (<alex(a)barton.de>) and Contributors." ); + puts( "Copyright (c)2001-2009 Alexander Barton (<alex(a)barton.de>) and Contributors." ); puts( "Homepage: <http://ngircd.barton.de/>\n" ); puts( "This is free software; see the source for copying conditions. There is NO" ); puts( "warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." );

1 0

Alexander Barton : Updated Debian "changelog" file for ngIRCd 14.1
by alex＠arthur.barton.de 05 May '09

05 May '09

Module: ngircd.git Branch: refs/tags/rel-14-1 Commit: b1852f30296501a7e0858260bd0c7533d041d627 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=b1852f30… Author: Alexander Barton <alex(a)barton.de> Date: Tue May 5 13:14:23 2009 +0200 Updated Debian "changelog" file for ngIRCd 14.1 --- contrib/Debian/changelog | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/contrib/Debian/changelog b/contrib/Debian/changelog index f41f1d8..abfad7f 100644 --- a/contrib/Debian/changelog +++ b/contrib/Debian/changelog @@ -1,3 +1,9 @@ +ngircd (14.1-0ab1) unstable; urgency=high + + * New "upstream" release ngIRCd 14.1, fixing a security-related bug. + + -- Alexander Barton <alex(a)barton.de> Tue, 5 May 2009 13:13:38 +0200 + ngircd (14-0ab3) unstable; urgency=low * Fixed "Conflicts:" line in debian/control: missing comma.

1 0

Alexander Barton : Updated Debian "changelog" file for ngIRCd 14.1
by alex＠arthur.barton.de 05 May '09

05 May '09

Module: ngircd.git Branch: master Commit: b1852f30296501a7e0858260bd0c7533d041d627 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=b1852f30… Author: Alexander Barton <alex(a)barton.de> Date: Tue May 5 13:14:23 2009 +0200 Updated Debian "changelog" file for ngIRCd 14.1 --- contrib/Debian/changelog | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/contrib/Debian/changelog b/contrib/Debian/changelog index f41f1d8..abfad7f 100644 --- a/contrib/Debian/changelog +++ b/contrib/Debian/changelog @@ -1,3 +1,9 @@ +ngircd (14.1-0ab1) unstable; urgency=high + + * New "upstream" release ngIRCd 14.1, fixing a security-related bug. + + -- Alexander Barton <alex(a)barton.de> Tue, 5 May 2009 13:13:38 +0200 + ngircd (14-0ab3) unstable; urgency=low * Fixed "Conflicts:" line in debian/control: missing comma.

1 0