Module: ngircd.git
Branch: master
Commit: f369177617a0f54e34a1af6fa44d1d1e3f953aeb
URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=f3691776…
Author: Alexander Barton <alex(a)barton.de>
Date: Tue Jul 13 15:10:35 2010 +0200
New configuration option "NoPAM" to disable PAM
When the "NoPAM" configuration option is set and ngIRCd is compiled
with support for PAM, ngIRCd will not call any PAM functions: all
connection attemps without password will succeed instead and all
connection attemps with password will fail.
If ngIRCd is compiled without PAM support, this option is a dummy
option and nothing changes: the global server password will still be
in effect.
---
doc/sample-ngircd.conf | 3 +++
man/ngircd.conf.5.tmpl | 6 ++++++
src/ngircd/conf.c | 7 +++++++
src/ngircd/conf.h | 3 +++
src/ngircd/irc-login.c | 5 ++++-
5 files changed, 23 insertions(+), 1 deletions(-)
diff --git a/doc/sample-ngircd.conf b/doc/sample-ngircd.conf
index daa0801..645d1b8 100644
--- a/doc/sample-ngircd.conf
+++ b/doc/sample-ngircd.conf
@@ -135,6 +135,9 @@
# with support for it.
;NoIdent = no
+ # Don't use PAM, even if ngIRCd has been compiled with support for it.
+ ;NoPAM = no
+
# try to connect to other irc servers using ipv4 and ipv6, if possible
;ConnectIPv6 = yes
;ConnectIPv4 = yes
diff --git a/man/ngircd.conf.5.tmpl b/man/ngircd.conf.5.tmpl
index 46e0308..ad88871 100644
--- a/man/ngircd.conf.5.tmpl
+++ b/man/ngircd.conf.5.tmpl
@@ -210,6 +210,12 @@ If ngIRCd is compiled with IDENT support this can be used to disable IDENT
lookups at run time.
Default: no.
.TP
+\fBNoPAM\fR
+If ngIRCd is compiled with PAM support this can be used to disable all calls
+to the PAM library at runtime; all users connecting without password are
+allowed to connect, all passwords given will fail.
+Default: no.
+.TP
\fBConnectIPv4\fR
Set this to no if you do not want ngIRCd to connect to other IRC servers using
IPv4. This allows usage of ngIRCd in IPv6-only setups.
diff --git a/src/ngircd/conf.c b/src/ngircd/conf.c
index f78eaee..834a1da 100644
--- a/src/ngircd/conf.c
+++ b/src/ngircd/conf.c
@@ -331,6 +331,7 @@ Conf_Test( void )
printf(" PredefChannelsOnly = %s\n", yesno_to_str(Conf_PredefChannelsOnly));
printf(" NoDNS = %s\n", yesno_to_str(Conf_NoDNS));
printf(" NoIdent = %s\n", yesno_to_str(Conf_NoIdent));
+ printf(" NoPAM = %s\n", yesno_to_str(Conf_NoPAM));
#ifdef WANT_IPV6
printf(" ConnectIPv4 = %s\n", yesno_to_str(Conf_ConnectIPv6));
@@ -580,6 +581,7 @@ Set_Defaults(bool InitServers)
Conf_ConnectRetry = 60;
Conf_NoDNS = false;
Conf_NoIdent = false;
+ Conf_NoPAM = false;
Conf_Oper_Count = 0;
Conf_Channel_Count = 0;
@@ -986,6 +988,11 @@ Handle_GLOBAL( int Line, char *Var, char *Arg )
#endif
return;
}
+ if(strcasecmp(Var, "NoPAM") == 0) {
+ /* don't use PAM library to authenticate users */
+ Conf_NoPAM = Check_ArgIsTrue(Arg);
+ return;
+ }
#ifdef WANT_IPV6
/* the default setting for all the WANT_IPV6 special options is 'true' */
if( strcasecmp( Var, "ConnectIPv6" ) == 0 ) {
diff --git a/src/ngircd/conf.h b/src/ngircd/conf.h
index 8e397fa..74abc1d 100644
--- a/src/ngircd/conf.h
+++ b/src/ngircd/conf.h
@@ -152,6 +152,9 @@ GLOBAL bool Conf_NoDNS;
/* Disable IDENT lookups, even when compiled with support for it */
GLOBAL bool Conf_NoIdent;
+/* Disable all usage of PAM, even when compiled with support for it */
+GLOBAL bool Conf_NoPAM;
+
/*
* try to connect to remote systems using the ipv6 protocol,
* if they have an ipv6 address? (default yes)
diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c
index 10e2df8..0789540 100644
--- a/src/ngircd/irc-login.c
+++ b/src/ngircd/irc-login.c
@@ -787,7 +787,10 @@ Hello_User(CLIENT * Client)
/* Sub process */
signal(SIGTERM, Proc_GenericSignalHandler);
Log_Init_Subprocess("Auth");
- result = PAM_Authenticate(Client);
+ if (Conf_NoPAM) {
+ result = (Client_Password(Client)[0] == '\0');
+ } else
+ result = PAM_Authenticate(Client);
write(pipefd[1], &result, sizeof(result));
Log_Exit_Subprocess("Auth");
exit(0);
Module: ngircd.git
Branch: master
Commit: 9cd3494de92eccaa201f42fc8b02fc68c752aca8
URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=9cd3494d…
Author: Alexander Barton <alex(a)barton.de>
Date: Tue Jul 13 22:29:06 2010 +0200
Don't Proc_Kill() childs after Proc_Read(): done there already.
---
src/ngircd/irc-login.c | 3 ---
src/ngircd/proc.c | 2 ++
2 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c
index 8ac5471..93ee07e 100644
--- a/src/ngircd/irc-login.c
+++ b/src/ngircd/irc-login.c
@@ -847,9 +847,6 @@ cb_Read_Auth_Result(int r_fd, UNUSED short events)
if (len == 0)
return;
- /* Make sure authenticator sub-process is dead now ... */
- Proc_Kill(proc);
-
if (len != sizeof(result)) {
Log(LOG_CRIT, "Auth: Got malformed result!");
Reject_Client(client);
diff --git a/src/ngircd/proc.c b/src/ngircd/proc.c
index 11cb039..1e8cac3 100644
--- a/src/ngircd/proc.c
+++ b/src/ngircd/proc.c
@@ -119,6 +119,8 @@ Proc_GenericSignalHandler(int Signal)
/**
* Read bytes from a pipe of a forked child process.
+ * In addition, this function makes sure that the child process is dead
+ * after all data has been read or a fatal error occurred.
*/
GLOBAL size_t
Proc_Read(PROC_STAT *proc, void *buffer, size_t buflen)
Module: ngircd.git
Branch: master
Commit: cf93881dfbd7b6317d2a41f87e9751b74354203b
URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=cf93881d…
Author: Alexander Barton <alex(a)barton.de>
Date: Wed Jul 14 10:27:55 2010 +0200
New function Conn_CloseAllSockets() to close all open sockets
This is useful in forked child processes, for example, to make sure that
they don't hold connections open that the main process wants to close.
---
src/ngircd/conn.c | 17 +++++++++++++++++
src/ngircd/conn.h | 2 ++
2 files changed, 19 insertions(+), 0 deletions(-)
diff --git a/src/ngircd/conn.c b/src/ngircd/conn.c
index f059d91..d8df627 100644
--- a/src/ngircd/conn.c
+++ b/src/ngircd/conn.c
@@ -419,6 +419,23 @@ Conn_Exit( void )
} /* Conn_Exit */
+/**
+ * Close all sockets (file descriptors) of open connections.
+ * This is useful in forked child processes, for example, to make sure that
+ * they don't hold connections open that the main process wants to close.
+ */
+GLOBAL void
+Conn_CloseAllSockets(void)
+{
+ CONN_ID idx;
+
+ for(idx = 0; idx < Pool_Size; idx++) {
+ if(My_Connections[idx].sock > NONE)
+ close(My_Connections[idx].sock);
+ }
+}
+
+
static unsigned int
ports_initlisteners(array *a, const char *listen_addr, void (*func)(int,short))
{
diff --git a/src/ngircd/conn.h b/src/ngircd/conn.h
index a63fcbb..a0bddaa 100644
--- a/src/ngircd/conn.h
+++ b/src/ngircd/conn.h
@@ -102,6 +102,8 @@ GLOBAL long WCounter;
GLOBAL void Conn_Init PARAMS((void ));
GLOBAL void Conn_Exit PARAMS(( void ));
+GLOBAL void Conn_CloseAllSockets PARAMS((void));
+
GLOBAL unsigned int Conn_InitListeners PARAMS(( void ));
GLOBAL void Conn_ExitListeners PARAMS(( void ));