ngIRCd GIT Updates August 2013

ngircd-commits@lists.barton.de

2 Teilnehmer
66 Diskussionen

Federico G. Schwindt : Change strdup() to strndup()
by alex＠arthur.barton.de 26 Aug '13

26 Aug '13

Module: ngircd.git Branch: master Commit: 3b65f4e38d1ab019513f16b70581ae10574006e8 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=3b65f4e3… Author: Federico G. Schwindt <fgsch(a)lodoss.net> Date: Mon Aug 26 12:18:46 2013 +0100 Change strdup() to strndup() --- src/ngircd/client.c | 3 ++- src/ngircd/conn-ssl.c | 6 +++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/src/ngircd/client.c b/src/ngircd/client.c index 1c71034..72774ca 100644 --- a/src/ngircd/client.c +++ b/src/ngircd/client.c @@ -469,7 +469,8 @@ Client_SetAccountName(CLIENT *Client, const char *AccountName) free(Client->account_name); if (*AccountName) - Client->account_name = strdup(AccountName); + Client->account_name = strndup(AccountName, + CLIENT_NICK_LEN - 1); else Client->account_name = NULL; } diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index 4156fb1..096ff95 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -61,7 +61,7 @@ static gnutls_dh_params_t dh_params; static bool ConnSSL_LoadServerKey_gnutls PARAMS(( void )); #endif -#define CERTFP_LEN (20 * 2 + 1) +#define SHA1_STRING_LEN (20 * 2 + 1) static bool ConnSSL_Init_SSL PARAMS(( CONNECTION *c )); static int ConnectAccept PARAMS(( CONNECTION *c, bool connect )); @@ -723,7 +723,7 @@ ConnSSL_InitCertFp( CONNECTION *c ) assert(c->ssl_state.fingerprint == NULL); - c->ssl_state.fingerprint = malloc(CERTFP_LEN); + c->ssl_state.fingerprint = malloc(SHA1_STRING_LEN); if (!c->ssl_state.fingerprint) return 0; @@ -858,7 +858,7 @@ bool ConnSSL_SetCertFp(CONNECTION *c, const char *fingerprint) { assert (c != NULL); - c->ssl_state.fingerprint = strdup(fingerprint); + c->ssl_state.fingerprint = strndup(fingerprint, SHA1_STRING_LEN - 1); return c->ssl_state.fingerprint != NULL; } #else

1 0

Federico G. Schwindt : private strndup() implementation in case libc does not provide it
by alex＠arthur.barton.de 26 Aug '13

26 Aug '13

Module: ngircd.git Branch: master Commit: 6ac5a82eecb76ec35f3f484149ad668073a52620 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=6ac5a82e… Author: Federico G. Schwindt <fgsch(a)lodoss.net> Date: Mon Aug 26 10:47:04 2013 +0100 private strndup() implementation in case libc does not provide it --- configure.ng | 2 +- src/portab/Makefile.ng | 2 +- src/portab/portab.h | 4 ++++ src/portab/strndup.c | 37 +++++++++++++++++++++++++++++++++++++ 4 files changed, 43 insertions(+), 2 deletions(-) diff --git a/configure.ng b/configure.ng index 7e85225..faf3086 100644 --- a/configure.ng +++ b/configure.ng @@ -188,7 +188,7 @@ AC_CHECK_FUNCS([ \ # Optional functions AC_CHECK_FUNCS_ONCE([ \ gai_strerror getaddrinfo getnameinfo inet_aton sigaction sigprocmask \ - snprintf vsnprintf strdup strlcpy strlcat strtok_r waitpid]) + snprintf vsnprintf strdup strndup strlcpy strlcat strtok_r waitpid]) # -- Configuration options -- diff --git a/src/portab/Makefile.ng b/src/portab/Makefile.ng index dac329f..17edbdf 100644 --- a/src/portab/Makefile.ng +++ b/src/portab/Makefile.ng @@ -15,7 +15,7 @@ EXTRA_DIST = Makefile.ng noinst_LIBRARIES = libngportab.a -libngportab_a_SOURCES = strdup.c strlcpy.c strtok_r.c vsnprintf.c waitpid.c +libngportab_a_SOURCES = strdup.c strndup.c strlcpy.c strtok_r.c vsnprintf.c waitpid.c check_PROGRAMS = portabtest diff --git a/src/portab/portab.h b/src/portab/portab.h index 208d350..a968a3b 100644 --- a/src/portab/portab.h +++ b/src/portab/portab.h @@ -157,6 +157,10 @@ extern size_t strlcpy PARAMS(( char *dst, const char *src, size_t size )); extern char * strdup PARAMS(( const char *s )); #endif +#ifndef HAVE_STRNDUP +extern char * strndup PARAMS((const char *s, size_t maxlen)); +#endif + #ifndef HAVE_STRTOK_R extern char * strtok_r PARAMS((char *str, const char *delim, char **saveptr)); #endif diff --git a/src/portab/strndup.c b/src/portab/strndup.c new file mode 100644 index 0000000..d6e01c9 --- /dev/null +++ b/src/portab/strndup.c @@ -0,0 +1,37 @@ +/* + * ngIRCd -- The Next Generation IRC Daemon + */ + +#include "portab.h" + +/** + * @file + * strndup() implementation. Public domain. + */ + +#ifndef HAVE_STRNDUP + +#include "imp.h" +#include <string.h> +#include <stdlib.h> +#include <sys/types.h> + +#include "exp.h" + +GLOBAL char * +strndup(const char *s, size_t maxlen) +{ + char *dup; + size_t len = strlen(s); + + if (len > maxlen) + len = maxlen; + len++; + dup = malloc(len); + if (dup) + strlcpy(dup, s, len); + return dup; +} + +#endif +

1 0

Federico G. Schwindt : Cosmetic changes to METADATA
by alex＠arthur.barton.de 25 Aug '13

25 Aug '13

Module: ngircd.git Branch: master Commit: 086cf3a2723e2dcc8e1acf49d166e254fe22e7cf URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=086cf3a2… Author: Federico G. Schwindt <fgsch(a)lodoss.net> Date: Sun Aug 25 05:26:08 2013 +0100 Cosmetic changes to METADATA Update certfp and sort entries. --- doc/Protocol.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/Protocol.txt b/doc/Protocol.txt index ae290dd..6b3cfbc 100644 --- a/doc/Protocol.txt +++ b/doc/Protocol.txt @@ -225,11 +225,11 @@ new server link", <serverflag> "M"), even if it doesn't support the given The following <key> names are defined: - "accountname": the account name of a client (can't be empty) - - "host": the hostname of a client (can't be empty) + - "certfp": the certificate fingerprint of a client (can't be empty) - "cloakhost": the cloaked hostname of a client + - "host": the hostname of a client (can't be empty) - "info": info text ("real name") of a client - "user": the user name of a client (can't be empty) - - "certfp": the cert fingerprint of a client III. Numerics used by IRC+ Protocol

1 0

Federico G. Schwindt : Silence warning
by alex＠arthur.barton.de 25 Aug '13

25 Aug '13

Module: ngircd.git Branch: master Commit: 8d01be7bbd2bbfd2524384af3cb9bdefaa87ea48 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=8d01be7b… Author: Federico G. Schwindt <fgsch(a)lodoss.net> Date: Sun Aug 25 00:07:06 2013 +0100 Silence warning Cast the result of the operation to long, not the time(NULL) call. On systems where sizeof(time_t) is other than long this will produce a warning. --- src/ngircd/log.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ngircd/log.c b/src/ngircd/log.c index 028f435..18fb6fa 100644 --- a/src/ngircd/log.c +++ b/src/ngircd/log.c @@ -53,7 +53,7 @@ Log_Message(int Level, const char *msg) if (!Is_Daemon) { /* log to console */ fprintf(stdout, "[%ld:%d %4ld] %s\n", (long)getpid(), Level, - (long)time(NULL) - NGIRCd_Start, msg); + (long)(time(NULL) - NGIRCd_Start), msg); fflush(stdout); } #ifdef SYSLOG

1 0

Federico G. Schwindt : Plug memory leak
by alex＠arthur.barton.de 25 Aug '13

25 Aug '13

Module: ngircd.git Branch: master Commit: eb86d234f8553cb018fe86483ee754817689439a URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=eb86d234… Author: Federico G. Schwindt <fgsch(a)lodoss.net> Date: Fri Aug 23 11:43:28 2013 +0100 Plug memory leak --- src/ngircd/client.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/ngircd/client.c b/src/ngircd/client.c index 3269028..1c71034 100644 --- a/src/ngircd/client.c +++ b/src/ngircd/client.c @@ -126,6 +126,8 @@ Client_Exit( void ) next = (CLIENT *)c->next; if (c->account_name) free(c->account_name); + if (c->cloaked) + free(c->cloaked); free( c ); c = next; }

1 0

Federico G. Schwindt : Implement account login support
by alex＠arthur.barton.de 25 Aug '13

25 Aug '13

Module: ngircd.git Branch: master Commit: 3af0ece2bcf550cccd7b647c111ce503c2faa459 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=3af0ece2… Author: Federico G. Schwindt <fgsch(a)lodoss.net> Date: Thu Aug 22 14:40:30 2013 +0100 Implement account login support This is done via the `accountname' METADATA command and used to automatically identify users after netsplits or across service restarts. --- doc/Protocol.txt | 1 + src/ngircd/client.c | 35 +++++++++++++++++++++++++++++++++++ src/ngircd/client.h | 3 +++ src/ngircd/irc-metadata.c | 2 ++ 4 files changed, 41 insertions(+) diff --git a/doc/Protocol.txt b/doc/Protocol.txt index 59fa617..ae290dd 100644 --- a/doc/Protocol.txt +++ b/doc/Protocol.txt @@ -224,6 +224,7 @@ new server link", <serverflag> "M"), even if it doesn't support the given The following <key> names are defined: + - "accountname": the account name of a client (can't be empty) - "host": the hostname of a client (can't be empty) - "cloakhost": the cloaked hostname of a client - "info": info text ("real name") of a client diff --git a/src/ngircd/client.c b/src/ngircd/client.c index cf0720b..3269028 100644 --- a/src/ngircd/client.c +++ b/src/ngircd/client.c @@ -124,6 +124,8 @@ Client_Exit( void ) { cnt++; next = (CLIENT *)c->next; + if (c->account_name) + free(c->account_name); free( c ); c = next; } @@ -318,6 +320,8 @@ Client_Destroy( CLIENT *Client, const char *LogMsg, const char *FwdMsg, bool Sen } } + if (c->account_name) + free(c->account_name); if (c->cloaked) free(c->cloaked); free( c ); @@ -455,6 +459,21 @@ Client_SetFlags( CLIENT *Client, const char *Flags ) GLOBAL void +Client_SetAccountName(CLIENT *Client, const char *AccountName) +{ + assert(Client != NULL); + + if (Client->account_name) + free(Client->account_name); + + if (*AccountName) + Client->account_name = strdup(AccountName); + else + Client->account_name = NULL; +} + + +GLOBAL void Client_SetAway( CLIENT *Client, const char *Txt ) { /* Set AWAY reason of client */ @@ -973,6 +992,14 @@ Client_Away( CLIENT *Client ) } /* Client_Away */ +GLOBAL char * +Client_AccountName(CLIENT *Client) +{ + assert(Client != NULL); + return Client->account_name; +} + + /** * Make sure that a given nickname is valid. * @@ -1611,6 +1638,14 @@ Client_Announce(CLIENT * Client, CLIENT * Prefix, CLIENT * User) return DISCONNECTED; } + if (Client_AccountName(User)) { + if (!IRC_WriteStrClientPrefix(Client, Prefix, + "METADATA %s accountname :%s", + Client_ID(User), + Client_AccountName(User))) + return DISCONNECTED; + } + if (Conn_GetCertFp(Client_Conn(User))) { if (!IRC_WriteStrClientPrefix(Client, Prefix, "METADATA %s certfp :%s", diff --git a/src/ngircd/client.h b/src/ngircd/client.h index 6d5298f..702f114 100644 --- a/src/ngircd/client.h +++ b/src/ngircd/client.h @@ -59,6 +59,7 @@ typedef struct _CLIENT bool oper_by_me; /* client is local IRC operator on this server? */ char away[CLIENT_AWAY_LEN]; /* AWAY text (valid if mode 'a' is set) */ char flags[CLIENT_FLAGS_LEN]; /* flags of the client */ + char *account_name; /* login account (for services) */ int capabilities; /* enabled IRC capabilities */ } CLIENT; @@ -123,6 +124,7 @@ GLOBAL int Client_MyToken PARAMS(( CLIENT *Client )); GLOBAL CLIENT *Client_TopServer PARAMS(( CLIENT *Client )); GLOBAL CLIENT *Client_NextHop PARAMS(( CLIENT *Client )); GLOBAL char *Client_Away PARAMS(( CLIENT *Client )); +GLOBAL char *Client_AccountName PARAMS((CLIENT *Client)); GLOBAL time_t Client_StartTime PARAMS(( CLIENT *Client )); GLOBAL bool Client_HasMode PARAMS(( CLIENT *Client, char Mode )); @@ -141,6 +143,7 @@ GLOBAL void Client_SetModes PARAMS(( CLIENT *Client, const char *Modes )); GLOBAL void Client_SetFlags PARAMS(( CLIENT *Client, const char *Flags )); GLOBAL void Client_SetIntroducer PARAMS(( CLIENT *Client, CLIENT *Introducer )); GLOBAL void Client_SetAway PARAMS(( CLIENT *Client, const char *Txt )); +GLOBAL void Client_SetAccountName PARAMS((CLIENT *Client, const char *AccountName)); GLOBAL bool Client_ModeAdd PARAMS(( CLIENT *Client, char Mode )); GLOBAL bool Client_ModeDel PARAMS(( CLIENT *Client, char Mode )); diff --git a/src/ngircd/irc-metadata.c b/src/ngircd/irc-metadata.c index 9a1398a..b52512a 100644 --- a/src/ngircd/irc-metadata.c +++ b/src/ngircd/irc-metadata.c @@ -96,6 +96,8 @@ IRC_METADATA(CLIENT *Client, REQUEST *Req) Client_SetInfo(target, Req->argv[2]); else if (*Req->argv[2] && strcasecmp(Req->argv[1], "user") == 0) Client_SetUser(target, Req->argv[2], true); + else if (strcasecmp(Req->argv[1], "accountname") == 0) + Client_SetAccountName(target, Req->argv[2]); else if (*Req->argv[2] && strcasecmp(Req->argv[1], "certfp") == 0) Conn_SetCertFp(Client_Conn(target), Req->argv[2]); else

1 0

Federico G. Schwindt : Fix spelling
by alex＠arthur.barton.de 25 Aug '13

25 Aug '13

Module: ngircd.git Branch: master Commit: a9ffbdea3f3e245326eaa4242f97803b6edad522 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=a9ffbdea… Author: Federico G. Schwindt <fgsch(a)lodoss.net> Date: Thu Aug 22 10:58:36 2013 +0100 Fix spelling --- src/ngircd/irc-metadata.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ngircd/irc-metadata.c b/src/ngircd/irc-metadata.c index 14ffe35..9a1398a 100644 --- a/src/ngircd/irc-metadata.c +++ b/src/ngircd/irc-metadata.c @@ -69,7 +69,7 @@ IRC_METADATA(CLIENT *Client, REQUEST *Req) Client_ID(prefix), Client_ID(target), Req->argv[1], Req->argv[2]); - /* Mark client: it has receiveda a METADATA command */ + /* Mark client: it has received a METADATA command */ if (!Client_HasFlag(target, 'M')) { snprintf(new_flags, sizeof new_flags, "%sM", Client_Flags(target));

1 0

Alexander Barton : ngIRCd Release 20.3
by alex＠arthur.barton.de 23 Aug '13

23 Aug '13

Module: ngircd.git Branch: master Commit: 6dc5471a758b75e58f3855f086f1e5ba1676d931 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=6dc5471a… Author: Alexander Barton <alex(a)barton.de> Date: Fri Aug 23 21:54:40 2013 +0200 ngIRCd Release 20.3 (cherry picked from commit bb6e2779636aa6d74bbff474880829f0183a3c94) Conflicts: ChangeLog NEWS --- ChangeLog | 7 +++++++ NEWS | 8 ++++++++ contrib/Debian/changelog | 6 ++++++ contrib/ngircd.spec | 2 +- 4 files changed, 22 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 9fe53c7..1186276 100644 --- a/ChangeLog +++ b/ChangeLog @@ -102,6 +102,13 @@ ngIRCd 21 and then is used to output individual help texts to specific topics. Please see the file ./doc/Commands.txt for details. +ngIRCd 20.3 (2013-08-23) + + - Security: Fix a denial of service bug (server crash) which could happen + when the configuration option "NoticeAuth" is enabled (which is NOT the + default) and ngIRCd failed to send the "notice auth" messages to new + clients connecting to the server (CVE-2013-5580). + ngIRCd 20.2 (2013-02-15) - Security: Fix a denial of service bug in the function handling KICK diff --git a/NEWS b/NEWS index 0b86a43..a8dc433 100644 --- a/NEWS +++ b/NEWS @@ -65,6 +65,14 @@ ngIRCd 21 and then is used to output individual help texts to specific topics. Please see the file ./doc/Commands.txt for details. +ngIRCd 20.3 (2013-08-23) + + - This release is a bugfix release only, without new features. + - Security: Fix a denial of service bug (server crash) which could happen + when the configuration option "NoticeAuth" is enabled (which is NOT the + default) and ngIRCd failed to send the "notice auth" messages to new + clients connecting to the server (CVE-2013-5580). + ngIRCd 20.2 (2013-02-15) - This release is a bugfix release only, without new features. diff --git a/contrib/Debian/changelog b/contrib/Debian/changelog index 2e39af0..396d1d0 100644 --- a/contrib/Debian/changelog +++ b/contrib/Debian/changelog @@ -1,3 +1,9 @@ +ngircd (20.3-0ab1) unstable; urgency=high + + * New "upstream" release, fixing a security related bug: ngIRCd 20.3. + + -- Alexander Barton <alex(a)barton.de> Fri, 23 Aug 2013 21:53:21 +0200 + ngircd (20.2-0ab1) unstable; urgency=high * New "upstream" release, fixing a security related bug: ngIRCd 20.2. diff --git a/contrib/ngircd.spec b/contrib/ngircd.spec index e2448a4..0469313 100644 --- a/contrib/ngircd.spec +++ b/contrib/ngircd.spec @@ -1,5 +1,5 @@ %define name ngircd -%define version 20.2 +%define version 20.3 %define release 1 %define prefix %{_prefix}

1 0

Tag rel-20.3: Alexander Barton : ngIRCd Release 20.3
by alex＠arthur.barton.de 23 Aug '13

23 Aug '13

Module: ngircd.git Branch: refs/tags/rel-20.3 Tag: 9105b221b164dfff7557eb98253a017418ef8e7e URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=tag;h=9105b221b16… Tagger: Alexander Barton <alex(a)barton.de> Date: Fri Aug 23 21:54:59 2013 +0200 ngIRCd Release 20.3

1 0

Alexander Barton : ngIRCd Release 20.3
by alex＠arthur.barton.de 23 Aug '13

23 Aug '13

Module: ngircd.git Branch: branch-20.x Commit: bb6e2779636aa6d74bbff474880829f0183a3c94 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=bb6e2779… Author: Alexander Barton <alex(a)barton.de> Date: Fri Aug 23 21:54:40 2013 +0200 ngIRCd Release 20.3 --- ChangeLog | 10 +++++++++- NEWS | 11 ++++++++++- contrib/Debian/changelog | 6 ++++++ contrib/ngircd.spec | 2 +- 4 files changed, 26 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 08d337f..5920316 100644 --- a/ChangeLog +++ b/ChangeLog @@ -9,10 +9,18 @@ -- ChangeLog -- +ngIRCd 20.3 (2013-08-23) + + - Security: Fix a denial of service bug (server crash) which could happen + when the configuration option "NoticeAuth" is enabled (which is NOT the + default) and ngIRCd failed to send the "notice auth" messages to new + clients connecting to the server (CVE-2013-5580). + ngIRCd 20.2 (2013-02-15) - Security: Fix a denial of service bug in the function handling KICK - commands that could be used by arbitrary users to to crash the daemon. + commands that could be used by arbitrary users to to crash the daemon + (CVE-2013-1747). - WHO command: Use the currently "displayed hostname" (which can be cloaked!) for hostname matching, not the real one. In other words: don't display all the cloaked users on a specific real hostname! diff --git a/NEWS b/NEWS index 38f6029..d092510 100644 --- a/NEWS +++ b/NEWS @@ -9,11 +9,20 @@ -- NEWS -- +ngIRCd 20.3 (2013-08-23) + + - This release is a bugfix release only, without new features. + - Security: Fix a denial of service bug (server crash) which could happen + when the configuration option "NoticeAuth" is enabled (which is NOT the + default) and ngIRCd failed to send the "notice auth" messages to new + clients connecting to the server (CVE-2013-5580). + ngIRCd 20.2 (2013-02-15) - This release is a bugfix release only, without new features. - Security: Fix a denial of service bug in the function handling KICK - commands that could be used by arbitrary users to to crash the daemon. + commands that could be used by arbitrary users to to crash the daemon + (CVE-2013-1747). ngIRCd 20.1 (2013-01-02) diff --git a/contrib/Debian/changelog b/contrib/Debian/changelog index 2e39af0..396d1d0 100644 --- a/contrib/Debian/changelog +++ b/contrib/Debian/changelog @@ -1,3 +1,9 @@ +ngircd (20.3-0ab1) unstable; urgency=high + + * New "upstream" release, fixing a security related bug: ngIRCd 20.3. + + -- Alexander Barton <alex(a)barton.de> Fri, 23 Aug 2013 21:53:21 +0200 + ngircd (20.2-0ab1) unstable; urgency=high * New "upstream" release, fixing a security related bug: ngIRCd 20.2. diff --git a/contrib/ngircd.spec b/contrib/ngircd.spec index e2448a4..0469313 100644 --- a/contrib/ngircd.spec +++ b/contrib/ngircd.spec @@ -1,5 +1,5 @@ %define name ngircd -%define version 20.2 +%define version 20.3 %define release 1 %define prefix %{_prefix}

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

ngIRCd GIT Updates August 2013