September 2013 - ngIRCd GIT Updates

Alexander Barton : Remove CLIENT.oper_by_my, Client_SetOperByMe() and Client_OperByMe()
by alex＠arthur.barton.de 25 Sep '13

25 Sep '13

Module: ngircd.git Branch: master Commit: eccbd97e1f2599bfb76818fe6bc32967ed07e0c7 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=eccbd97e… Author: Alexander Barton <alex(a)barton.de> Date: Wed Sep 25 01:29:23 2013 +0200 Remove CLIENT.oper_by_my, Client_SetOperByMe() and Client_OperByMe() All places where Client_OperByMe() is used can either be converted to Client_HasMode(Client, 'o') or Op_Check(). And Op_Check() itself can use the connection handle for deciding whether the IRC Operator is a local user or not. --- src/ngircd/client.c | 17 ----------------- src/ngircd/client.h | 3 --- src/ngircd/irc-channel.c | 7 +++++-- src/ngircd/irc-mode.c | 23 +++++++---------------- src/ngircd/irc-oper.c | 13 +++++-------- src/ngircd/irc.c | 6 +++--- src/ngircd/op.c | 2 +- 7 files changed, 21 insertions(+), 50 deletions(-) diff --git a/src/ngircd/client.c b/src/ngircd/client.c index 37b97d6..b1a371f 100644 --- a/src/ngircd/client.c +++ b/src/ngircd/client.c @@ -545,14 +545,6 @@ Client_SetIntroducer( CLIENT *Client, CLIENT *Introducer ) } /* Client_SetIntroducer */ -GLOBAL void -Client_SetOperByMe( CLIENT *Client, bool OperByMe ) -{ - assert( Client != NULL ); - Client->oper_by_me = OperByMe; -} /* Client_SetOperByMe */ - - GLOBAL bool Client_ModeAdd( CLIENT *Client, char Mode ) { @@ -889,14 +881,6 @@ Client_Flags( CLIENT *Client ) } /* Client_Flags */ -GLOBAL bool -Client_OperByMe( CLIENT *Client ) -{ - assert( Client != NULL ); - return Client->oper_by_me; -} /* Client_OperByMe */ - - GLOBAL int Client_Hops( CLIENT *Client ) { @@ -1426,7 +1410,6 @@ New_Client_Struct( void ) c->type = CLIENT_UNKNOWN; c->conn_id = NONE; - c->oper_by_me = false; c->hops = -1; c->token = -1; c->mytoken = -1; diff --git a/src/ngircd/client.h b/src/ngircd/client.h index e5c48b7..c6fcec0 100644 --- a/src/ngircd/client.h +++ b/src/ngircd/client.h @@ -58,7 +58,6 @@ typedef struct _CLIENT char info[CLIENT_INFO_LEN]; /* long user name (user) / info text (server) */ char modes[CLIENT_MODE_LEN]; /* client modes */ int hops, token, mytoken; /* "hops" and "Token" (see SERVER command) */ - bool oper_by_me; /* client is local IRC operator on this server? */ char *away; /* AWAY text (valid if mode 'a' is set) */ char flags[CLIENT_FLAGS_LEN]; /* flags of the client */ char *account_name; /* login account (for services) */ @@ -120,7 +119,6 @@ GLOBAL const char *Client_IPAText PARAMS(( CLIENT *Client )); GLOBAL char *Client_Modes PARAMS(( CLIENT *Client )); GLOBAL char *Client_Flags PARAMS(( CLIENT *Client )); GLOBAL CLIENT *Client_Introducer PARAMS(( CLIENT *Client )); -GLOBAL bool Client_OperByMe PARAMS(( CLIENT *Client )); GLOBAL int Client_Hops PARAMS(( CLIENT *Client )); GLOBAL int Client_Token PARAMS(( CLIENT *Client )); GLOBAL int Client_MyToken PARAMS(( CLIENT *Client )); @@ -142,7 +140,6 @@ GLOBAL void Client_SetInfo PARAMS(( CLIENT *Client, const char *Info )); GLOBAL void Client_SetType PARAMS(( CLIENT *Client, int Type )); GLOBAL void Client_SetHops PARAMS(( CLIENT *Client, int Hops )); GLOBAL void Client_SetToken PARAMS(( CLIENT *Client, int Token )); -GLOBAL void Client_SetOperByMe PARAMS(( CLIENT *Client, bool OperByMe )); GLOBAL void Client_SetModes PARAMS(( CLIENT *Client, const char *Modes )); GLOBAL void Client_SetFlags PARAMS(( CLIENT *Client, const char *Flags )); GLOBAL void Client_SetIntroducer PARAMS(( CLIENT *Client, CLIENT *Introducer )); diff --git a/src/ngircd/irc-channel.c b/src/ngircd/irc-channel.c index d5e7bdd..b286b5a 100644 --- a/src/ngircd/irc-channel.c +++ b/src/ngircd/irc-channel.c @@ -129,7 +129,7 @@ join_allowed(CLIENT *Client, CHANNEL *chan, const char *channame, return false; } - if (Channel_HasMode(chan, 'O') && !Client_OperByMe(Client)) { + if (Channel_HasMode(chan, 'O') && !Client_HasMode(Client, 'o')) { /* Only IRC operators are allowed! */ IRC_WriteErrClient(Client, ERR_OPONLYCHANNEL_MSG, Client_ID(Client), channame); @@ -619,7 +619,10 @@ IRC_LIST( CLIENT *Client, REQUEST *Req ) /* Gotcha! */ if (!Channel_HasMode(chan, 's') || Channel_IsMemberOf(chan, from) - || (!Conf_MorePrivacy && Client_OperByMe(Client))) { + || (!Conf_MorePrivacy + && Client_HasMode(Client, 'o') + && Client_Conn(Client) > NONE)) + { if ((Conf_MaxListSize > 0) && IRC_CheckListTooBig(from, count, Conf_MaxListSize, diff --git a/src/ngircd/irc-mode.c b/src/ngircd/irc-mode.c index e2fa59a..af59683 100644 --- a/src/ngircd/irc-mode.c +++ b/src/ngircd/irc-mode.c @@ -223,11 +223,12 @@ Client_Mode( CLIENT *Client, REQUEST *Req, CLIENT *Origin, CLIENT *Target ) else x[0] = 'B'; break; - case 'c': /* Receive connect notices - * (only settable by IRC operators!) */ + case 'c': /* Receive connect notices */ + case 'q': /* KICK-protected user */ + /* (only settable by IRC operators!) */ if (!set || Client_Type(Client) == CLIENT_SERVER - || Client_OperByMe(Origin)) - x[0] = 'c'; + || Client_HasMode(Origin, 'o')) + x[0] = *mode_ptr; else ok = IRC_WriteErrClient(Origin, ERR_NOPRIVILEGES_MSG, @@ -235,22 +236,12 @@ Client_Mode( CLIENT *Client, REQUEST *Req, CLIENT *Origin, CLIENT *Target ) break; case 'o': /* IRC operator (only unsettable!) */ if (!set || Client_Type(Client) == CLIENT_SERVER) { - Client_SetOperByMe(Target, false); x[0] = 'o'; } else ok = IRC_WriteErrClient(Origin, ERR_NOPRIVILEGES_MSG, Client_ID(Origin)); break; - case 'q': /* KICK-protected user */ - if (!set || Client_Type(Client) == CLIENT_SERVER - || Client_OperByMe(Origin)) - x[0] = 'q'; - else - ok = IRC_WriteErrClient(Origin, - ERR_NOPRIVILEGES_MSG, - Client_ID(Origin)); - break; case 'r': /* Restricted (only settable) */ if (set || Client_Type(Client) == CLIENT_SERVER) x[0] = 'r'; @@ -274,7 +265,7 @@ Client_Mode( CLIENT *Client, REQUEST *Req, CLIENT *Origin, CLIENT *Target ) Client_ID(Origin)); else if (!set || Conf_CloakHostModeX[0] || Client_Type(Client) == CLIENT_SERVER - || Client_OperByMe(Client)) { + || Client_HasMode(Origin, 'o')) { x[0] = 'x'; send_RPL_HOSTHIDDEN_MSG = true; } else @@ -455,7 +446,7 @@ Channel_Mode(CLIENT *Client, REQUEST *Req, CLIENT *Origin, CHANNEL *Channel) /* Check if origin is oper and opers can use mode */ use_servermode = Conf_OperServerMode; - if(Client_OperByMe(Client) && Conf_OperCanMode) { + if(Client_HasMode(Client, 'o') && Conf_OperCanMode) { is_oper = true; } diff --git a/src/ngircd/irc-oper.c b/src/ngircd/irc-oper.c index 4d17085..74f17cc 100644 --- a/src/ngircd/irc-oper.c +++ b/src/ngircd/irc-oper.c @@ -90,12 +90,10 @@ IRC_OPER( CLIENT *Client, REQUEST *Req ) Client_ID(Client)); } - if (!Client_OperByMe(Client)) - Log(LOG_NOTICE|LOG_snotice, - "Got valid OPER for \"%s\" from \"%s\", user is an IRC operator now.", - Req->argv[0], Client_Mask(Client)); + Log(LOG_NOTICE|LOG_snotice, + "Got valid OPER for \"%s\" from \"%s\", user is an IRC operator now.", + Req->argv[0], Client_Mask(Client)); - Client_SetOperByMe(Client, true); return IRC_WriteStrClient(Client, RPL_YOUREOPER_MSG, Client_ID(Client)); } /* IRC_OPER */ @@ -357,9 +355,8 @@ IRC_WALLOPS( CLIENT *Client, REQUEST *Req ) switch (Client_Type(Client)) { case CLIENT_USER: - if (!Client_OperByMe(Client)) - return IRC_WriteErrClient(Client, ERR_NOPRIVILEGES_MSG, - Client_ID(Client)); + if (!Op_Check(Client, Req)) + return Op_NoPrivileges(Client, Req); from = Client; break; case CLIENT_SERVER: diff --git a/src/ngircd/irc.c b/src/ngircd/irc.c index 8c08cdc..34180aa 100644 --- a/src/ngircd/irc.c +++ b/src/ngircd/irc.c @@ -33,6 +33,7 @@ #include "match.h" #include "messages.h" #include "parse.h" +#include "op.h" #include "tool.h" #include "exp.h" @@ -134,9 +135,8 @@ IRC_KILL(CLIENT *Client, REQUEST *Req) assert (Client != NULL); assert (Req != NULL); - if (Client_Type(Client) != CLIENT_SERVER && !Client_OperByMe(Client)) - return IRC_WriteErrClient(Client, ERR_NOPRIVILEGES_MSG, - Client_ID(Client)); + if (Client_Type(Client) != CLIENT_SERVER && !Op_Check(Client, Req)) + return Op_NoPrivileges(Client, Req); /* Get prefix (origin); use the client if no prefix is given. */ if (Req->prefix) diff --git a/src/ngircd/op.c b/src/ngircd/op.c index 2d36cd5..71e7cbc 100644 --- a/src/ngircd/op.c +++ b/src/ngircd/op.c @@ -86,7 +86,7 @@ Op_Check(CLIENT * Client, REQUEST * Req) return c; if (!Client_HasMode(c, 'o')) return NULL; - if (!Client_OperByMe(c) && !Conf_AllowRemoteOper) + if (Client_Conn(c) <= NONE && !Conf_AllowRemoteOper) return NULL; /* The client is an local IRC operator, or this server is configured

1 0

Federico G. Schwindt : Add support to show user links using "STATS L"
by alex＠arthur.barton.de 24 Sep '13

24 Sep '13

Module: ngircd.git Branch: master Commit: ec5ab4fcd1bc361cacb56e999b2b8f0a00caf5a9 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=ec5ab4fc… Author: Federico G. Schwindt <fgsch(a)lodoss.net> Date: Wed Sep 18 23:51:44 2013 +0100 Add support to show user links using "STATS L" Change "stats L" to show servers and user links and restrict it to IRC Operators. --- doc/Commands.txt | 8 ++++++-- src/ngircd/irc-info.c | 14 ++++++++++---- 2 files changed, 16 insertions(+), 6 deletions(-) diff --git a/doc/Commands.txt b/doc/Commands.txt index dde1498..e4f0090 100644 --- a/doc/Commands.txt +++ b/doc/Commands.txt @@ -451,17 +451,21 @@ Status and Informational Commands Show statistics and other information of type <query> of a particular IRC server in the network. . - The following <query> types are supported (case-insensitive): + The following <query> types are supported (case-insensitive where + applicable): . - g Network-wide bans ("G-Lines"). - k Server-local bans ("K-Lines"). - - l Link status (parent server and own link only). + - L Link status (servers and user links). + - l Link status (servers and own link). - m Command usage count. - u Server uptime. . <target> can be a server name, the nickname of a client connected to a specific server, or a mask matching a server name in the network. The server of the current connection is used when <target> is omitted. + . + To use "STATS L" the user must be an IRC Operator. References: - RFC 2812, 3.4.4 "Stats message" diff --git a/src/ngircd/irc-info.c b/src/ngircd/irc-info.c index 1c250a4..79a157c 100644 --- a/src/ngircd/irc-info.c +++ b/src/ngircd/irc-info.c @@ -41,6 +41,7 @@ #include "irc-macros.h" #include "irc-write.h" #include "client-cap.h" +#include "op.h" #include "exp.h" #include "irc-info.h" @@ -865,6 +866,7 @@ IRC_STATS( CLIENT *Client, REQUEST *Req ) unsigned int days, hrs, mins; struct list_head *list; struct list_elem *list_item; + bool more_links = false; assert(Client != NULL); assert(Req != NULL); @@ -909,16 +911,20 @@ IRC_STATS( CLIENT *Client, REQUEST *Req ) list_item = Lists_GetNext(list_item); } break; + case 'L': /* Link status (servers and user links) */ + if (!Op_Check(from, Req)) + return Op_NoPrivileges(from, Req); + more_links = true; + case 'l': /* Link status (servers and own link) */ - case 'L': time_now = time(NULL); for (con = Conn_First(); con != NONE; con = Conn_Next(con)) { cl = Conn_GetClient(con); if (!cl) continue; - if ((Client_Type(cl) == CLIENT_SERVER) - || (cl == Client)) { - /* Server link or our own connection */ + if (Client_Type(cl) == CLIENT_SERVER || + cl == Client || + (more_links && Client_Type(cl) == CLIENT_USER)) { #ifdef ZLIB if (Conn_Options(con) & CONN_ZIP) { if (!IRC_WriteStrClient

1 0

Alexander Barton : Log an error (not info) when working directory can' t be changed
by alex＠arthur.barton.de 24 Sep '13

24 Sep '13

Module: ngircd.git Branch: master Commit: 13a5358a3d9a439e2f6d70f7770d4b7673bfbbc1 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=13a5358a… Author: Alexander Barton <alex(a)barton.de> Date: Tue Sep 24 00:04:54 2013 +0200 Log an error (not info) when working directory can't be changed --- src/ngircd/ngircd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/ngircd/ngircd.c b/src/ngircd/ngircd.c index d76b47d..5637cb2 100644 --- a/src/ngircd/ngircd.c +++ b/src/ngircd/ngircd.c @@ -817,8 +817,8 @@ NGIRCd_Init(bool NGIRCd_NoDaemon) "Changed working directory to \"%s\" ...", pwd->pw_dir); else - Log(LOG_INFO, - "Notice: Can't change working directory to \"%s\": %s!", + Log(LOG_ERR, + "Can't change working directory to \"%s\": %s!", pwd->pw_dir, strerror(errno)); } else Log(LOG_ERR, "Can't get user informaton for UID %d!?", Conf_UID);

1 0

Alexander Barton : doc/PAM.txt: add a slightly more useful example
by alex＠arthur.barton.de 19 Sep '13

19 Sep '13

Module: ngircd.git Branch: master Commit: 99db111bca731490e8e91dfe3efe075179177005 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=99db111b… Author: Alexander Barton <alex(a)barton.de> Date: Thu Sep 19 00:17:36 2013 +0200 doc/PAM.txt: add a slightly more useful example --- doc/PAM.txt | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/doc/PAM.txt b/doc/PAM.txt index 64bbc7b..671f071 100644 --- a/doc/PAM.txt +++ b/doc/PAM.txt @@ -1,9 +1,8 @@ ngIRCd - Next Generation IRC Server + http://ngircd.barton.de/ - (c)2001-2010 Alexander Barton, - alex(a)barton.de, http://www.barton.de/ - + (c)2001-2013 Alexander Barton and Contributors. ngIRCd is free software and published under the terms of the GNU General Public License. @@ -34,3 +33,13 @@ is running as. Therefore a lot of PAM modules aren't working as expected, because they need root privileges ("pam_unix", for example)! Only PAM modules not(!) requiring root privileges (such as "pam_pgsql", "pam_mysql", "pam_opendirectory" ...) can be used in conjunction with ngIRCd. + +More Examples: + + * Use an own "password file" for ngIRCd: + + Note: you can use the htpasswd(1) utility of Apache to manage password + files used by pam_pwdfile, see "man htpasswd"! + + /etc/pam.d/ngircd: + auth required pam_pwdfile.so pwdfile=/etc/ngircd/ngircd.passwd

1 0

Federico G. Schwindt : Change the certificate fingerprint digest to sha256
by alex＠arthur.barton.de 18 Sep '13

18 Sep '13

Module: ngircd.git Branch: master Commit: 27b9d32bf2a851c4acbfdc4d9aa5a55d12c92c10 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=27b9d32b… Author: Federico G. Schwindt <fgsch(a)lodoss.net> Date: Tue Sep 17 17:33:12 2013 +0100 Change the certificate fingerprint digest to sha256 While here correct some indentation. --- src/ngircd/conn-ssl.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index a24a62d..493bcc7 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -62,7 +62,7 @@ static gnutls_priority_t priorities_cache; static bool ConnSSL_LoadServerKey_gnutls PARAMS(( void )); #endif -#define SHA1_STRING_LEN (20 * 2 + 1) +#define SHA256_STRING_LEN (32 * 2 + 1) static bool ConnSSL_Init_SSL PARAMS(( CONNECTION *c )); static int ConnectAccept PARAMS(( CONNECTION *c, bool connect )); @@ -711,7 +711,7 @@ ConnSSL_InitCertFp( CONNECTION *c ) if (!cert) return 0; - if (!X509_digest(cert, EVP_sha1(), digest, &digest_size)) { + if (!X509_digest(cert, EVP_sha256(), digest, &digest_size)) { X509_free(cert); return 0; } @@ -725,7 +725,8 @@ ConnSSL_InitCertFp( CONNECTION *c ) unsigned char digest[MAX_HASH_SIZE]; size_t digest_size; - if (gnutls_certificate_type_get(c->ssl_state.gnutls_session) != GNUTLS_CRT_X509) + if (gnutls_certificate_type_get(c->ssl_state.gnutls_session) != + GNUTLS_CRT_X509) return 0; if (gnutls_x509_crt_init(&cert) != GNUTLS_E_SUCCESS) @@ -739,13 +740,15 @@ ConnSSL_InitCertFp( CONNECTION *c ) return 0; } - if (gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER) != GNUTLS_E_SUCCESS) { + if (gnutls_x509_crt_import(cert, &cert_list[0], + GNUTLS_X509_FMT_DER) != GNUTLS_E_SUCCESS) { gnutls_x509_crt_deinit(cert); return 0; } digest_size = sizeof(digest); - if (gnutls_x509_crt_get_fingerprint(cert, GNUTLS_DIG_SHA1, digest, &digest_size)) { + if (gnutls_x509_crt_get_fingerprint(cert, GNUTLS_DIG_SHA256, digest, + &digest_size)) { gnutls_x509_crt_deinit(cert); return 0; } @@ -755,7 +758,7 @@ ConnSSL_InitCertFp( CONNECTION *c ) assert(c->ssl_state.fingerprint == NULL); - c->ssl_state.fingerprint = malloc(SHA1_STRING_LEN); + c->ssl_state.fingerprint = malloc(SHA256_STRING_LEN); if (!c->ssl_state.fingerprint) return 0; @@ -890,7 +893,7 @@ bool ConnSSL_SetCertFp(CONNECTION *c, const char *fingerprint) { assert (c != NULL); - c->ssl_state.fingerprint = strndup(fingerprint, SHA1_STRING_LEN - 1); + c->ssl_state.fingerprint = strndup(fingerprint, SHA256_STRING_LEN - 1); return c->ssl_state.fingerprint != NULL; } #else

1 0

Federico G. Schwindt : Change cipher defaults
by alex＠arthur.barton.de 18 Sep '13

18 Sep '13

Module: ngircd.git Branch: master Commit: 0985d69cc6c1daa7cdc8f15f93772b12ab3e8271 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=0985d69c… Author: Federico G. Schwindt <fgsch(a)lodoss.net> Date: Tue Sep 17 16:16:51 2013 +0100 Change cipher defaults Switch cipher defaults to HIGH:!aNULL:@STRENGTH (OpenSSL) or SECURE128 (GnuTLS). --- INSTALL | 9 ++++++++- doc/sample-ngircd.conf.tmpl | 6 ++---- man/ngircd.conf.5.tmpl | 7 ++----- src/ngircd/conf.c | 14 ++++++++++++-- src/ngircd/conn-ssl.c | 40 ++++++++++------------------------------ 5 files changed, 34 insertions(+), 42 deletions(-) diff --git a/INSTALL b/INSTALL index de60feb..eec2b37 100644 --- a/INSTALL +++ b/INSTALL @@ -12,11 +12,18 @@ I. Upgrade Information ~~~~~~~~~~~~~~~~~~~~~~ +Differences to previous version + +- Starting with ngIRCd 21, the ciphers used by SSL are configurable and + default to HIGH:!aNULL:@STRENGTH (OpenSSL) or SECURE128 (GnuTLS). + Previous version were using the OpenSSL or GnuTLS defaults, DEFAULT + and NORMAL respectively. + Differences to version 19.x - Starting with ngIRCd 20, users can "cloak" their hostname only when the configuration variable "CloakHostModeX" (introduced in 19.2) is set. - Otherwise, only IRC opertators, other servers, and services are allowed to + Otherwise, only IRC operators, other servers, and services are allowed to set mode +x. This prevents regular users from changing their hostmask to the name of the IRC server itself, which confused quite a few people ;-) diff --git a/doc/sample-ngircd.conf.tmpl b/doc/sample-ngircd.conf.tmpl index 1bdf01e..65da360 100644 --- a/doc/sample-ngircd.conf.tmpl +++ b/doc/sample-ngircd.conf.tmpl @@ -249,11 +249,9 @@ ;CertFile = :ETCDIR:/ssl/server-cert.pem # Select cipher suites allowed for SSL/TLS connections. This defaults - # to the empty string, so all supported ciphers are allowed. Please - # see 'man 1ssl ciphers' (OpenSSL) and 'man 3 gnutls_priority_init' + # to HIGH:!aNULL:@STRENGTH (OpenSSL) or SECURE128 (GnuTLS). + # See 'man 1ssl ciphers' (OpenSSL) or 'man 3 gnutls_priority_init' # (GnuTLS) for details. - # For example, this setting allows only "high strength" cipher suites, - # disables the ones without authentication, and sorts by strength: # For OpenSSL: ;CipherList = HIGH:!aNULL:@STRENGTH # For GnuTLS: diff --git a/man/ngircd.conf.5.tmpl b/man/ngircd.conf.5.tmpl index 862c142..b69649e 100644 --- a/man/ngircd.conf.5.tmpl +++ b/man/ngircd.conf.5.tmpl @@ -367,13 +367,10 @@ when it is compiled with support for SSL using OpenSSL or GnuTLS! SSL Certificate file of the private server key. .TP \fBCipherList\fR (string) -Select cipher suites allowed for SSL/TLS connections. This defaults to the -empty string, so all supported ciphers are allowed. +Select cipher suites allowed for SSL/TLS connections. This defaults to +"HIGH:!aNULL:@STRENGTH" (OpenSSL) or "SECURE128" (GnuTLS). Please see 'man 1ssl ciphers' (OpenSSL) and 'man 3 gnutls_priority_init' (GnuTLS) for details. -For example, this setting allows only "high strength" cipher suites, disables -the ones without authentication, and sorts by strength: -"HIGH:!aNULL:@STRENGTH" (OpenSSL), "SECURE128" (GnuTLS). .TP \fBDHFile\fR (string) Name of the Diffie-Hellman Parameter file. Can be created with GnuTLS diff --git a/src/ngircd/conf.c b/src/ngircd/conf.c index 9ab66e5..9c2c912 100644 --- a/src/ngircd/conf.c +++ b/src/ngircd/conf.c @@ -93,6 +93,12 @@ static void Init_Server_Struct PARAMS(( CONF_SERVER *Server )); #define DEFAULT_LISTEN_ADDRSTR "0.0.0.0" #endif +#ifdef HAVE_LIBSSL +#define DEFAULT_CIPHERS "HIGH:!aNULL:@STRENGTH" +#endif +#ifdef HAVE_LIBGNUTLS +#define DEFAULT_CIPHERS "SECURE128" +#endif #ifdef SSL_SUPPORT @@ -435,8 +441,8 @@ Conf_Test( void ) puts("[SSL]"); printf(" CertFile = %s\n", Conf_SSLOptions.CertFile ? Conf_SSLOptions.CertFile : ""); - printf(" CipherList = %s\n", Conf_SSLOptions.CipherList - ? Conf_SSLOptions.CipherList : ""); + printf(" CipherList = %s\n", Conf_SSLOptions.CipherList ? + Conf_SSLOptions.CipherList : DEFAULT_CIPHERS); printf(" DHFile = %s\n", Conf_SSLOptions.DHFile ? Conf_SSLOptions.DHFile : ""); printf(" KeyFile = %s\n", Conf_SSLOptions.KeyFile @@ -1032,6 +1038,10 @@ Read_Config(bool TestOnly, bool IsStarting) CheckFileReadable("CertFile", Conf_SSLOptions.CertFile); CheckFileReadable("DHFile", Conf_SSLOptions.DHFile); CheckFileReadable("KeyFile", Conf_SSLOptions.KeyFile); + + /* Set the default ciphers if none were configured */ + if (!Conf_SSLOptions.CipherList) + Conf_SSLOptions.CipherList = strdup_warn(DEFAULT_CIPHERS); #endif return true; diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index b16c6b9..a24a62d 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -306,17 +306,10 @@ ConnSSL_InitLibrary( void ) if (!ConnSSL_LoadServerKey_openssl(newctx)) goto out; - if(Conf_SSLOptions.CipherList && *Conf_SSLOptions.CipherList) { - if(SSL_CTX_set_cipher_list(newctx, Conf_SSLOptions.CipherList) == 0 ) { - Log(LOG_ERR, - "Failed to apply OpenSSL cipher list \"%s\"!", - Conf_SSLOptions.CipherList); - goto out; - } else { - Log(LOG_INFO, - "Successfully applied OpenSSL cipher list \"%s\".", - Conf_SSLOptions.CipherList); - } + if (SSL_CTX_set_cipher_list(newctx, Conf_SSLOptions.CipherList) == 0) { + Log(LOG_ERR, "Failed to apply OpenSSL cipher list \"%s\"!", + Conf_SSLOptions.CipherList); + goto out; } SSL_CTX_set_options(newctx, SSL_OP_SINGLE_DH_USE|SSL_OP_NO_SSLv2); @@ -352,25 +345,12 @@ out: if (!ConnSSL_LoadServerKey_gnutls()) goto out; - if(Conf_SSLOptions.CipherList && *Conf_SSLOptions.CipherList) { - err = gnutls_priority_init(&priorities_cache, - Conf_SSLOptions.CipherList, NULL); - if (err != GNUTLS_E_SUCCESS) { - Log(LOG_ERR, - "Failed to apply GnuTLS cipher list \"%s\"!", - Conf_SSLOptions.CipherList); - goto out; - } - Log(LOG_INFO, - "Successfully applied GnuTLS cipher list \"%s\".", + if (gnutls_priority_init(&priorities_cache, Conf_SSLOptions.CipherList, + NULL) != GNUTLS_E_SUCCESS) { + Log(LOG_ERR, + "Failed to apply GnuTLS cipher list \"%s\"!", Conf_SSLOptions.CipherList); - } else { - err = gnutls_priority_init(&priorities_cache, "NORMAL", NULL); - if (err != GNUTLS_E_SUCCESS) { - Log(LOG_ERR, - "Failed to apply GnuTLS cipher list \"NORMAL\"!"); - goto out; - } + goto out; } Log(LOG_INFO, "GnuTLS %s initialized.", gnutls_check_version(NULL)); @@ -505,7 +485,7 @@ ConnSSL_Init_SSL(CONNECTION *c) #ifdef HAVE_LIBGNUTLS Conn_OPTION_ADD(c, CONN_SSL); ret = gnutls_priority_set(c->ssl_state.gnutls_session, priorities_cache); - if (ret != 0) { + if (ret != GNUTLS_E_SUCCESS) { Log(LOG_ERR, "Failed to set GnuTLS session priorities: %s", gnutls_strerror(ret)); ConnSSL_Free(c);

1 0

Alexander Barton : Merge remote-tracking branch 'alex/bug162-SSLCipherList'
by alex＠arthur.barton.de 16 Sep '13

16 Sep '13

Module: ngircd.git Branch: master Commit: d0977258ee14a5178e98c9a00c064d90f0eac9d6 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=d0977258… Author: Alexander Barton <alex(a)barton.de> Date: Mon Sep 16 17:32:25 2013 +0200 Merge remote-tracking branch 'alex/bug162-SSLCipherList' * alex/bug162-SSLCipherList: Cipher list selection for GnuTLS ConnSSL_Init_SSL(): correctly set CONN_SSL flag Cipher list selection for OpenSSL ConnSSL_InitLibrary(): Code cleanup ---

1 0

Alexander Barton : Cipher list selection for GnuTLS
by alex＠arthur.barton.de 16 Sep '13

16 Sep '13

Module: ngircd.git Branch: master Commit: b9006acee3649600226652a8361f13c859726cf2 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=b9006ace… Author: Alexander Barton <alex(a)barton.de> Date: Sun Sep 15 17:57:41 2013 +0200 Cipher list selection for GnuTLS This patch implements the missing functionality for cipher list selection using GnuTLS (our OpenSSL code has this already). --- doc/sample-ngircd.conf.tmpl | 14 ++++++++----- man/ngircd.conf.5.tmpl | 12 ++++++----- src/ngircd/conn-ssl.c | 49 ++++++++++++++++++++++++++++--------------- 3 files changed, 48 insertions(+), 27 deletions(-) diff --git a/doc/sample-ngircd.conf.tmpl b/doc/sample-ngircd.conf.tmpl index a4dbf86..1bdf01e 100644 --- a/doc/sample-ngircd.conf.tmpl +++ b/doc/sample-ngircd.conf.tmpl @@ -248,12 +248,16 @@ # SSL Server Key Certificate ;CertFile = :ETCDIR:/ssl/server-cert.pem - # Select cipher suites allowed for SSL/TLS connections (OpenSSL only). - # This defaults to the empty string, so all supported ciphers are - # allowed. Please see 'man 1ssl ciphers' for details. - # The example below only allows "high strength" cipher suites, disables - # the ones without authentication, and sorts by strength: + # Select cipher suites allowed for SSL/TLS connections. This defaults + # to the empty string, so all supported ciphers are allowed. Please + # see 'man 1ssl ciphers' (OpenSSL) and 'man 3 gnutls_priority_init' + # (GnuTLS) for details. + # For example, this setting allows only "high strength" cipher suites, + # disables the ones without authentication, and sorts by strength: + # For OpenSSL: ;CipherList = HIGH:!aNULL:@STRENGTH + # For GnuTLS: + ;CipherList = SECURE128 # Diffie-Hellman parameters ;DHFile = :ETCDIR:/ssl/dhparams.pem diff --git a/man/ngircd.conf.5.tmpl b/man/ngircd.conf.5.tmpl index 263dec0..862c142 100644 --- a/man/ngircd.conf.5.tmpl +++ b/man/ngircd.conf.5.tmpl @@ -367,11 +367,13 @@ when it is compiled with support for SSL using OpenSSL or GnuTLS! SSL Certificate file of the private server key. .TP \fBCipherList\fR (string) -OpenSSL only: Select cipher suites allowed for SSL/TLS connections. This -defaults to the empty string, so all supported ciphers are allowed. Please see -'man 1ssl ciphers' for details. This setting allows only "high strength" cipher -suites, disables the ones without authentication, and sorts by strength, for -example: "HIGH:!aNULL:@STRENGTH". +Select cipher suites allowed for SSL/TLS connections. This defaults to the +empty string, so all supported ciphers are allowed. +Please see 'man 1ssl ciphers' (OpenSSL) and 'man 3 gnutls_priority_init' +(GnuTLS) for details. +For example, this setting allows only "high strength" cipher suites, disables +the ones without authentication, and sorts by strength: +"HIGH:!aNULL:@STRENGTH" (OpenSSL), "SECURE128" (GnuTLS). .TP \fBDHFile\fR (string) Name of the Diffie-Hellman Parameter file. Can be created with GnuTLS diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index a978967..b16c6b9 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -58,6 +58,7 @@ static bool ConnSSL_LoadServerKey_openssl PARAMS(( SSL_CTX *c )); static gnutls_certificate_credentials_t x509_cred; static gnutls_dh_params_t dh_params; +static gnutls_priority_t priorities_cache; static bool ConnSSL_LoadServerKey_gnutls PARAMS(( void )); #endif @@ -308,12 +309,12 @@ ConnSSL_InitLibrary( void ) if(Conf_SSLOptions.CipherList && *Conf_SSLOptions.CipherList) { if(SSL_CTX_set_cipher_list(newctx, Conf_SSLOptions.CipherList) == 0 ) { Log(LOG_ERR, - "Failed to apply SSL cipher list \"%s\"!", + "Failed to apply OpenSSL cipher list \"%s\"!", Conf_SSLOptions.CipherList); goto out; } else { Log(LOG_INFO, - "Successfully applied SSL cipher list: \"%s\".", + "Successfully applied OpenSSL cipher list \"%s\".", Conf_SSLOptions.CipherList); } } @@ -341,29 +342,43 @@ out: return false; } - if(Conf_SSLOptions.CipherList != NULL) { - Log(LOG_ERR, - "Failed to apply SSL cipher list \"%s\": Not implemented for GnuTLS!", - Conf_SSLOptions.CipherList); - array_free(&Conf_SSLOptions.ListenPorts); - return false; - } - err = gnutls_global_init(); if (err) { Log(LOG_ERR, "Failed to initialize GnuTLS: %s", gnutls_strerror(err)); - array_free(&Conf_SSLOptions.ListenPorts); - return false; + goto out; } - if (!ConnSSL_LoadServerKey_gnutls()) { - array_free(&Conf_SSLOptions.ListenPorts); - return false; + + if (!ConnSSL_LoadServerKey_gnutls()) + goto out; + + if(Conf_SSLOptions.CipherList && *Conf_SSLOptions.CipherList) { + err = gnutls_priority_init(&priorities_cache, + Conf_SSLOptions.CipherList, NULL); + if (err != GNUTLS_E_SUCCESS) { + Log(LOG_ERR, + "Failed to apply GnuTLS cipher list \"%s\"!", + Conf_SSLOptions.CipherList); + goto out; + } + Log(LOG_INFO, + "Successfully applied GnuTLS cipher list \"%s\".", + Conf_SSLOptions.CipherList); + } else { + err = gnutls_priority_init(&priorities_cache, "NORMAL", NULL); + if (err != GNUTLS_E_SUCCESS) { + Log(LOG_ERR, + "Failed to apply GnuTLS cipher list \"NORMAL\"!"); + goto out; + } } Log(LOG_INFO, "GnuTLS %s initialized.", gnutls_check_version(NULL)); initialized = true; return true; +out: + array_free(&Conf_SSLOptions.ListenPorts); + return false; #endif } @@ -489,9 +504,9 @@ ConnSSL_Init_SSL(CONNECTION *c) #endif #ifdef HAVE_LIBGNUTLS Conn_OPTION_ADD(c, CONN_SSL); - ret = gnutls_set_default_priority(c->ssl_state.gnutls_session); + ret = gnutls_priority_set(c->ssl_state.gnutls_session, priorities_cache); if (ret != 0) { - Log(LOG_ERR, "Failed to set GnuTLS default priority: %s", + Log(LOG_ERR, "Failed to set GnuTLS session priorities: %s", gnutls_strerror(ret)); ConnSSL_Free(c); return false;

1 0

Alexander Barton : ConnSSL_Init_SSL(): correctly set CONN_SSL flag
by alex＠arthur.barton.de 16 Sep '13

16 Sep '13

Module: ngircd.git Branch: master Commit: 51231ac8d45bf329f4724a145e6bc7a3ea118570 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=51231ac8… Author: Alexander Barton <alex(a)barton.de> Date: Sun Sep 15 17:35:52 2013 +0200 ConnSSL_Init_SSL(): correctly set CONN_SSL flag The CONN_SSL flag must be set before any calls to ConnSSL_Free()! --- src/ngircd/conn-ssl.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index 059e871..a978967 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -460,7 +460,10 @@ static bool ConnSSL_Init_SSL(CONNECTION *c) { int ret; + + LogDebug("Initializing SSL ..."); assert(c != NULL); + #ifdef HAVE_LIBSSL if (!ssl_ctx) { Log(LOG_ERR, @@ -475,6 +478,7 @@ ConnSSL_Init_SSL(CONNECTION *c) LogOpenSSLError("Failed to create SSL structure", NULL); return false; } + Conn_OPTION_ADD(c, CONN_SSL); ret = SSL_set_fd(c->ssl_state.ssl, c->sock); if (ret != 1) { @@ -484,8 +488,9 @@ ConnSSL_Init_SSL(CONNECTION *c) } #endif #ifdef HAVE_LIBGNUTLS + Conn_OPTION_ADD(c, CONN_SSL); ret = gnutls_set_default_priority(c->ssl_state.gnutls_session); - if (ret < 0) { + if (ret != 0) { Log(LOG_ERR, "Failed to set GnuTLS default priority: %s", gnutls_strerror(ret)); ConnSSL_Free(c); @@ -497,17 +502,20 @@ ConnSSL_Init_SSL(CONNECTION *c) * There doesn't seem to be an alternate GNUTLS API we could use instead, see e.g. * http://www.mail-archive.com/help-gnutls@gnu.org/msg00286.html */ - gnutls_transport_set_ptr(c->ssl_state.gnutls_session, (gnutls_transport_ptr_t) (long) c->sock); - gnutls_certificate_server_set_request(c->ssl_state.gnutls_session, GNUTLS_CERT_REQUEST); - ret = gnutls_credentials_set(c->ssl_state.gnutls_session, GNUTLS_CRD_CERTIFICATE, x509_cred); - if (ret < 0) { - Log(LOG_ERR, "Failed to set SSL credentials: %s", gnutls_strerror(ret)); + gnutls_transport_set_ptr(c->ssl_state.gnutls_session, + (gnutls_transport_ptr_t) (long) c->sock); + gnutls_certificate_server_set_request(c->ssl_state.gnutls_session, + GNUTLS_CERT_REQUEST); + ret = gnutls_credentials_set(c->ssl_state.gnutls_session, + GNUTLS_CRD_CERTIFICATE, x509_cred); + if (ret != 0) { + Log(LOG_ERR, "Failed to set SSL credentials: %s", + gnutls_strerror(ret)); ConnSSL_Free(c); return false; } gnutls_dh_set_prime_bits(c->ssl_state.gnutls_session, DH_BITS_MIN); #endif - Conn_OPTION_ADD(c, CONN_SSL); return true; } @@ -675,7 +683,6 @@ ConnSSL_Accept( CONNECTION *c ) return false; } #endif - LogDebug("Initializing SSL data ..."); if (!ConnSSL_Init_SSL(c)) return -1; }

1 0

Alexander Barton : Cipher list selection for OpenSSL
by alex＠arthur.barton.de 16 Sep '13

16 Sep '13

Module: ngircd.git Branch: master Commit: 84ed46d4c1caaa4ec79a6223c35785afcf1c9d53 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=84ed46d4… Author: Alexander Barton <alex(a)barton.de> Date: Sun Sep 15 15:09:36 2013 +0200 Cipher list selection for OpenSSL This patch introduces the possibility to arbitrarily select ciphers which should be promoted resp. declined when establishing a SSL connection with a client by implementing the new configuration option "CipherList". By default, OpenSSL would accept low and medium strength and RC-4 ciphers, which nowadays are known to be broken. This patch only implements the feature for OpenSSL. A GnuTLS counterpart has to be implemented in another patch ... Original patch by Bastian <bastian-ngircd(a)t6l.de>. Closes bug #162. --- doc/sample-ngircd.conf.tmpl | 7 +++++++ man/ngircd.conf.5.tmpl | 7 +++++++ src/ngircd/conf.c | 10 ++++++++++ src/ngircd/conf.h | 1 + src/ngircd/conn-ssl.c | 24 +++++++++++++++++++++++- 5 files changed, 48 insertions(+), 1 deletion(-) diff --git a/doc/sample-ngircd.conf.tmpl b/doc/sample-ngircd.conf.tmpl index ae1b213..a4dbf86 100644 --- a/doc/sample-ngircd.conf.tmpl +++ b/doc/sample-ngircd.conf.tmpl @@ -248,6 +248,13 @@ # SSL Server Key Certificate ;CertFile = :ETCDIR:/ssl/server-cert.pem + # Select cipher suites allowed for SSL/TLS connections (OpenSSL only). + # This defaults to the empty string, so all supported ciphers are + # allowed. Please see 'man 1ssl ciphers' for details. + # The example below only allows "high strength" cipher suites, disables + # the ones without authentication, and sorts by strength: + ;CipherList = HIGH:!aNULL:@STRENGTH + # Diffie-Hellman parameters ;DHFile = :ETCDIR:/ssl/dhparams.pem diff --git a/man/ngircd.conf.5.tmpl b/man/ngircd.conf.5.tmpl index cf926f9..263dec0 100644 --- a/man/ngircd.conf.5.tmpl +++ b/man/ngircd.conf.5.tmpl @@ -366,6 +366,13 @@ when it is compiled with support for SSL using OpenSSL or GnuTLS! \fBCertFile\fR (string) SSL Certificate file of the private server key. .TP +\fBCipherList\fR (string) +OpenSSL only: Select cipher suites allowed for SSL/TLS connections. This +defaults to the empty string, so all supported ciphers are allowed. Please see +'man 1ssl ciphers' for details. This setting allows only "high strength" cipher +suites, disables the ones without authentication, and sorts by strength, for +example: "HIGH:!aNULL:@STRENGTH". +.TP \fBDHFile\fR (string) Name of the Diffie-Hellman Parameter file. Can be created with GnuTLS "certtool \-\-generate-dh-params" or "openssl dhparam". If this file is not diff --git a/src/ngircd/conf.c b/src/ngircd/conf.c index b10f490..9ab66e5 100644 --- a/src/ngircd/conf.c +++ b/src/ngircd/conf.c @@ -117,6 +117,9 @@ ConfSSL_Init(void) array_free_wipe(&Conf_SSLOptions.KeyFilePassword); array_free(&Conf_SSLOptions.ListenPorts); + + free(Conf_SSLOptions.CipherList); + Conf_SSLOptions.CipherList = NULL; } /** @@ -432,6 +435,8 @@ Conf_Test( void ) puts("[SSL]"); printf(" CertFile = %s\n", Conf_SSLOptions.CertFile ? Conf_SSLOptions.CertFile : ""); + printf(" CipherList = %s\n", Conf_SSLOptions.CipherList + ? Conf_SSLOptions.CipherList : ""); printf(" DHFile = %s\n", Conf_SSLOptions.DHFile ? Conf_SSLOptions.DHFile : ""); printf(" KeyFile = %s\n", Conf_SSLOptions.KeyFile @@ -1869,6 +1874,11 @@ Handle_SSL(const char *File, int Line, char *Var, char *Arg) ports_parse(&Conf_SSLOptions.ListenPorts, Line, Arg); return; } + if (strcasecmp(Var, "CipherList") == 0) { + assert(Conf_SSLOptions.CipherList == NULL); + Conf_SSLOptions.CipherList = strdup_warn(Arg); + return; + } Config_Error_Section(File, Line, Var, "SSL"); } diff --git a/src/ngircd/conf.h b/src/ngircd/conf.h index 948749d..02d2331 100644 --- a/src/ngircd/conf.h +++ b/src/ngircd/conf.h @@ -75,6 +75,7 @@ struct SSLOptions { char *DHFile; /**< File containing DH parameters */ array ListenPorts; /**< Array of listening SSL ports */ array KeyFilePassword; /**< Key file password */ + char *CipherList; /**< Set SSL cipher list to use */ }; #endif diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index 595cb61..059e871 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -305,6 +305,19 @@ ConnSSL_InitLibrary( void ) if (!ConnSSL_LoadServerKey_openssl(newctx)) goto out; + if(Conf_SSLOptions.CipherList && *Conf_SSLOptions.CipherList) { + if(SSL_CTX_set_cipher_list(newctx, Conf_SSLOptions.CipherList) == 0 ) { + Log(LOG_ERR, + "Failed to apply SSL cipher list \"%s\"!", + Conf_SSLOptions.CipherList); + goto out; + } else { + Log(LOG_INFO, + "Successfully applied SSL cipher list: \"%s\".", + Conf_SSLOptions.CipherList); + } + } + SSL_CTX_set_options(newctx, SSL_OP_SINGLE_DH_USE|SSL_OP_NO_SSLv2); SSL_CTX_set_mode(newctx, SSL_MODE_ENABLE_PARTIAL_WRITE); SSL_CTX_set_verify(newctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE, @@ -328,6 +341,14 @@ out: return false; } + if(Conf_SSLOptions.CipherList != NULL) { + Log(LOG_ERR, + "Failed to apply SSL cipher list \"%s\": Not implemented for GnuTLS!", + Conf_SSLOptions.CipherList); + array_free(&Conf_SSLOptions.ListenPorts); + return false; + } + err = gnutls_global_init(); if (err) { Log(LOG_ERR, "Failed to initialize GnuTLS: %s", @@ -339,6 +360,7 @@ out: array_free(&Conf_SSLOptions.ListenPorts); return false; } + Log(LOG_INFO, "GnuTLS %s initialized.", gnutls_check_version(NULL)); initialized = true; return true; @@ -368,7 +390,7 @@ ConnSSL_LoadServerKey_gnutls(void) if (array_bytes(&Conf_SSLOptions.KeyFilePassword)) Log(LOG_WARNING, - "Ignoring KeyFilePassword: Not supported by GnuTLS."); + "Ignoring SSL \"KeyFilePassword\": Not supported by GnuTLS."); if (!Load_DH_params()) return false;

1 0