- ngIRCd GIT Updates - lists.barton.de

Alexander Barton : Remove Proc_Kill(), use timeout to kill child processes
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 6ebb31ab35e7f9258f4df9d0bfd111dc75677bfe URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=6ebb31ab… Author: Alexander Barton <alex(a)barton.de> Date: Wed Jul 14 10:29:05 2010 +0200 Remove Proc_Kill(), use timeout to kill child processes This avoids a race and potentionally killing the wrong process on systems that use randomized process IDs; now the child itself is responsible to exit in a timely manner using SIGALRM. --- src/ngircd/conn.c | 4 ---- src/ngircd/irc-login.c | 5 ++++- src/ngircd/proc.c | 30 ++++++++++++------------------ src/ngircd/proc.h | 4 +--- src/ngircd/resolve.c | 7 +++++-- 5 files changed, 22 insertions(+), 28 deletions(-) diff --git a/src/ngircd/conn.c b/src/ngircd/conn.c index d8df627..58a3cbf 100644 --- a/src/ngircd/conn.c +++ b/src/ngircd/conn.c @@ -1091,10 +1091,6 @@ Conn_Close( CONN_ID Idx, const char *LogMsg, const char *FwdMsg, bool InformClie in_k, out_k); } - /* Kill possibly running subprocess */ - if (Proc_InProgress(&My_Connections[Idx].proc_stat)) - Proc_Kill(&My_Connections[Idx].proc_stat); - /* Servers: Modify time of next connect attempt? */ Conf_UnsetServer( Idx ); diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c index b1b739b..03fea99 100644 --- a/src/ngircd/irc-login.c +++ b/src/ngircd/irc-login.c @@ -789,7 +789,10 @@ Hello_User(CLIENT * Client) return DISCONNECTED; } - pid = Proc_Fork(Conn_GetProcStat(conn), pipefd, cb_Read_Auth_Result); + /* Fork child process for PAM authentication; and make sure that the + * process timeout is set higher than the login timeout! */ + pid = Proc_Fork(Conn_GetProcStat(conn), pipefd, + cb_Read_Auth_Result, Conf_PongTimeout + 1); if (pid > 0) { LogDebug("Authenticator for connection %d created (PID %d).", conn, pid); diff --git a/src/ngircd/proc.c b/src/ngircd/proc.c index 1e8cac3..dbcff6f 100644 --- a/src/ngircd/proc.c +++ b/src/ngircd/proc.c @@ -23,6 +23,7 @@ #include "log.h" #include "io.h" +#include "conn.h" #include "exp.h" #include "proc.h" @@ -42,7 +43,7 @@ Proc_InitStruct (PROC_STAT *proc) * Fork a child process. */ GLOBAL pid_t -Proc_Fork(PROC_STAT *proc, int *pipefds, void (*cbfunc)(int, short)) +Proc_Fork(PROC_STAT *proc, int *pipefds, void (*cbfunc)(int, short), int timeout) { pid_t pid; @@ -67,7 +68,10 @@ Proc_Fork(PROC_STAT *proc, int *pipefds, void (*cbfunc)(int, short)) case 0: /* New child process: */ signal(SIGTERM, Proc_GenericSignalHandler); + signal(SIGALRM, Proc_GenericSignalHandler); close(pipefds[0]); + alarm(timeout); + Conn_CloseAllSockets(); return 0; } @@ -88,21 +92,6 @@ Proc_Fork(PROC_STAT *proc, int *pipefds, void (*cbfunc)(int, short)) } /** - * Kill forked child process. - */ -GLOBAL void -Proc_Kill(PROC_STAT *proc) -{ - assert(proc != NULL); - - if (proc->pipe_fd > 0) - io_close(proc->pipe_fd); - if (proc->pid > 0) - kill(proc->pid, SIGTERM); - Proc_InitStruct(proc); -} - -/** * Generic signal handler for forked child processes. */ GLOBAL void @@ -114,12 +103,17 @@ Proc_GenericSignalHandler(int Signal) Log_Subprocess(LOG_DEBUG, "Child got TERM signal, exiting."); #endif exit(1); + case SIGALRM: +#ifdef DEBUG + Log_Subprocess(LOG_DEBUG, "Child got ALARM signal, exiting."); +#endif + exit(1); } } /** * Read bytes from a pipe of a forked child process. - * In addition, this function makes sure that the child process is dead + * In addition, this function makes sure that the child process is ignored * after all data has been read or a fatal error occurred. */ GLOBAL size_t @@ -142,7 +136,7 @@ Proc_Read(PROC_STAT *proc, void *buffer, size_t buflen) else if (bytes_read == 0) LogDebug("Can't read from child process %ld: EOF", proc->pid); #endif - Proc_Kill(proc); + Proc_InitStruct(proc); return (size_t)bytes_read; } diff --git a/src/ngircd/proc.h b/src/ngircd/proc.h index 40a2c29..57612f1 100644 --- a/src/ngircd/proc.h +++ b/src/ngircd/proc.h @@ -26,9 +26,7 @@ typedef struct _Proc_Stat { GLOBAL void Proc_InitStruct PARAMS((PROC_STAT *proc)); GLOBAL pid_t Proc_Fork PARAMS((PROC_STAT *proc, int *pipefds, - void (*cbfunc)(int, short))); - -GLOBAL void Proc_Kill PARAMS((PROC_STAT *proc)); + void (*cbfunc)(int, short), int timeout)); GLOBAL void Proc_GenericSignalHandler PARAMS((int Signal)); diff --git a/src/ngircd/resolve.c b/src/ngircd/resolve.c index b88ec11..9bc3a87 100644 --- a/src/ngircd/resolve.c +++ b/src/ngircd/resolve.c @@ -12,6 +12,8 @@ */ +#define RESOLVER_TIMEOUT (Conf_PongTimeout*3)/4 + #include "portab.h" #include "imp.h" @@ -33,6 +35,7 @@ #include "array.h" #include "conn.h" +#include "conf.h" #include "defines.h" #include "log.h" #include "ng_ipaddr.h" @@ -63,7 +66,7 @@ Resolve_Addr(PROC_STAT * s, const ng_ipaddr_t *Addr, int identsock, assert(s != NULL); - pid = Proc_Fork(s, pipefd, cbfunc); + pid = Proc_Fork(s, pipefd, cbfunc, RESOLVER_TIMEOUT); if (pid > 0) { LogDebug("Resolver for %s created (PID %d).", ng_ipaddr_tostr(Addr), pid); return true; @@ -89,7 +92,7 @@ Resolve_Name( PROC_STAT *s, const char *Host, void (*cbfunc)(int, short)) assert(s != NULL); - pid = Proc_Fork(s, pipefd, cbfunc); + pid = Proc_Fork(s, pipefd, cbfunc, RESOLVER_TIMEOUT); if (pid > 0) { /* Main process */ #ifdef DEBUG

1 0

Alexander Barton : New configuration option "NoPAM" to disable PAM
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: f369177617a0f54e34a1af6fa44d1d1e3f953aeb URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=f3691776… Author: Alexander Barton <alex(a)barton.de> Date: Tue Jul 13 15:10:35 2010 +0200 New configuration option "NoPAM" to disable PAM When the "NoPAM" configuration option is set and ngIRCd is compiled with support for PAM, ngIRCd will not call any PAM functions: all connection attemps without password will succeed instead and all connection attemps with password will fail. If ngIRCd is compiled without PAM support, this option is a dummy option and nothing changes: the global server password will still be in effect. --- doc/sample-ngircd.conf | 3 +++ man/ngircd.conf.5.tmpl | 6 ++++++ src/ngircd/conf.c | 7 +++++++ src/ngircd/conf.h | 3 +++ src/ngircd/irc-login.c | 5 ++++- 5 files changed, 23 insertions(+), 1 deletions(-) diff --git a/doc/sample-ngircd.conf b/doc/sample-ngircd.conf index daa0801..645d1b8 100644 --- a/doc/sample-ngircd.conf +++ b/doc/sample-ngircd.conf @@ -135,6 +135,9 @@ # with support for it. ;NoIdent = no + # Don't use PAM, even if ngIRCd has been compiled with support for it. + ;NoPAM = no + # try to connect to other irc servers using ipv4 and ipv6, if possible ;ConnectIPv6 = yes ;ConnectIPv4 = yes diff --git a/man/ngircd.conf.5.tmpl b/man/ngircd.conf.5.tmpl index 46e0308..ad88871 100644 --- a/man/ngircd.conf.5.tmpl +++ b/man/ngircd.conf.5.tmpl @@ -210,6 +210,12 @@ If ngIRCd is compiled with IDENT support this can be used to disable IDENT lookups at run time. Default: no. .TP +\fBNoPAM\fR +If ngIRCd is compiled with PAM support this can be used to disable all calls +to the PAM library at runtime; all users connecting without password are +allowed to connect, all passwords given will fail. +Default: no. +.TP \fBConnectIPv4\fR Set this to no if you do not want ngIRCd to connect to other IRC servers using IPv4. This allows usage of ngIRCd in IPv6-only setups. diff --git a/src/ngircd/conf.c b/src/ngircd/conf.c index f78eaee..834a1da 100644 --- a/src/ngircd/conf.c +++ b/src/ngircd/conf.c @@ -331,6 +331,7 @@ Conf_Test( void ) printf(" PredefChannelsOnly = %s\n", yesno_to_str(Conf_PredefChannelsOnly)); printf(" NoDNS = %s\n", yesno_to_str(Conf_NoDNS)); printf(" NoIdent = %s\n", yesno_to_str(Conf_NoIdent)); + printf(" NoPAM = %s\n", yesno_to_str(Conf_NoPAM)); #ifdef WANT_IPV6 printf(" ConnectIPv4 = %s\n", yesno_to_str(Conf_ConnectIPv6)); @@ -580,6 +581,7 @@ Set_Defaults(bool InitServers) Conf_ConnectRetry = 60; Conf_NoDNS = false; Conf_NoIdent = false; + Conf_NoPAM = false; Conf_Oper_Count = 0; Conf_Channel_Count = 0; @@ -986,6 +988,11 @@ Handle_GLOBAL( int Line, char *Var, char *Arg ) #endif return; } + if(strcasecmp(Var, "NoPAM") == 0) { + /* don't use PAM library to authenticate users */ + Conf_NoPAM = Check_ArgIsTrue(Arg); + return; + } #ifdef WANT_IPV6 /* the default setting for all the WANT_IPV6 special options is 'true' */ if( strcasecmp( Var, "ConnectIPv6" ) == 0 ) { diff --git a/src/ngircd/conf.h b/src/ngircd/conf.h index 8e397fa..74abc1d 100644 --- a/src/ngircd/conf.h +++ b/src/ngircd/conf.h @@ -152,6 +152,9 @@ GLOBAL bool Conf_NoDNS; /* Disable IDENT lookups, even when compiled with support for it */ GLOBAL bool Conf_NoIdent; +/* Disable all usage of PAM, even when compiled with support for it */ +GLOBAL bool Conf_NoPAM; + /* * try to connect to remote systems using the ipv6 protocol, * if they have an ipv6 address? (default yes) diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c index 10e2df8..0789540 100644 --- a/src/ngircd/irc-login.c +++ b/src/ngircd/irc-login.c @@ -787,7 +787,10 @@ Hello_User(CLIENT * Client) /* Sub process */ signal(SIGTERM, Proc_GenericSignalHandler); Log_Init_Subprocess("Auth"); - result = PAM_Authenticate(Client); + if (Conf_NoPAM) { + result = (Client_Password(Client)[0] == '\0'); + } else + result = PAM_Authenticate(Client); write(pipefd[1], &result, sizeof(result)); Log_Exit_Subprocess("Auth"); exit(0);

1 0

Alexander Barton : Set NoPAM= yes in configuration files used for the testsuite
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 6faf44bc6daf1b8d2e01c08ab15d234aa23ced59 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=6faf44bc… Author: Alexander Barton <alex(a)barton.de> Date: Tue Jul 13 16:48:24 2010 +0200 Set NoPAM=yes in configuration files used for the testsuite --- src/testsuite/ngircd-test1.conf | 1 + src/testsuite/ngircd-test2.conf | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) diff --git a/src/testsuite/ngircd-test1.conf b/src/testsuite/ngircd-test1.conf index 51a57fb..25ec842 100644 --- a/src/testsuite/ngircd-test1.conf +++ b/src/testsuite/ngircd-test1.conf @@ -11,6 +11,7 @@ OperCanUseMode = yes MaxJoins = 4 NoIdent = yes + NoPAM = yes [Operator] Name = TestOp diff --git a/src/testsuite/ngircd-test2.conf b/src/testsuite/ngircd-test2.conf index e6d1696..0805b4e 100644 --- a/src/testsuite/ngircd-test2.conf +++ b/src/testsuite/ngircd-test2.conf @@ -11,6 +11,7 @@ OperCanUseMode = yes MaxJoins = 4 NoIdent = yes + NoPAM = yes [Operator] Name = TestOp

1 0

Alexander Barton : Mark some variables as "unused" to prevent compiler warnings
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 41034950d9cb6bdfc14abe99bf080058189d8933 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=41034950… Author: Alexander Barton <alex(a)barton.de> Date: Tue Jul 13 16:50:00 2010 +0200 Mark some variables as "unused" to prevent compiler warnings Some variables are only used when compiling with IDENT or PAM support or when the debug code is enabled. Mark them as "unused" so that gcc doesn't generate warnings when neither of these options is enabled. --- src/ngircd/client.c | 2 +- src/ngircd/log.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/ngircd/client.c b/src/ngircd/client.c index 8402499..96d40d2 100644 --- a/src/ngircd/client.c +++ b/src/ngircd/client.c @@ -363,7 +363,7 @@ Client_SetUser( CLIENT *Client, const char *User, bool Idented ) * @param User User name to set. */ GLOBAL void -Client_SetOrigUser(CLIENT *Client, const char *User) { +Client_SetOrigUser(CLIENT UNUSED *Client, const char UNUSED *User) { assert(Client != NULL); assert(User != NULL); diff --git a/src/ngircd/log.c b/src/ngircd/log.c index c8dbdd3..0cfe3b7 100644 --- a/src/ngircd/log.c +++ b/src/ngircd/log.c @@ -264,7 +264,7 @@ va_dcl GLOBAL void -Log_Init_Subprocess(char *Name) +Log_Init_Subprocess(char UNUSED *Name) { #ifdef SYSLOG openlog( PACKAGE_NAME, LOG_CONS|LOG_PID, LOG_LOCAL5 ); @@ -277,7 +277,7 @@ Log_Init_Subprocess(char *Name) GLOBAL void -Log_Exit_Subprocess(char *Name) +Log_Exit_Subprocess(char UNUSED *Name) { #ifdef DEBUG Log_Subprocess(LOG_DEBUG, "%s sub-process %ld done.",

1 0

Alexander Barton : Use Proc_GenericSignalHandler() as handler for SIGTERM by default
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 57a2faf4a74c65a6f12caf2d69c34e4f08c659f9 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=57a2faf4… Author: Alexander Barton <alex(a)barton.de> Date: Tue Jul 13 22:04:35 2010 +0200 Use Proc_GenericSignalHandler() as handler for SIGTERM by default --- src/ngircd/irc-login.c | 1 - src/ngircd/proc.c | 1 + src/ngircd/resolve.c | 16 ++-------------- 3 files changed, 3 insertions(+), 15 deletions(-) diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c index 0789540..0bcbe3e 100644 --- a/src/ngircd/irc-login.c +++ b/src/ngircd/irc-login.c @@ -785,7 +785,6 @@ Hello_User(CLIENT * Client) return CONNECTED; } else { /* Sub process */ - signal(SIGTERM, Proc_GenericSignalHandler); Log_Init_Subprocess("Auth"); if (Conf_NoPAM) { result = (Client_Password(Client)[0] == '\0'); diff --git a/src/ngircd/proc.c b/src/ngircd/proc.c index f543883..11cb039 100644 --- a/src/ngircd/proc.c +++ b/src/ngircd/proc.c @@ -66,6 +66,7 @@ Proc_Fork(PROC_STAT *proc, int *pipefds, void (*cbfunc)(int, short)) return -1; case 0: /* New child process: */ + signal(SIGTERM, Proc_GenericSignalHandler); close(pipefds[0]); return 0; } diff --git a/src/ngircd/resolve.c b/src/ngircd/resolve.c index 808ce53..b88ec11 100644 --- a/src/ngircd/resolve.c +++ b/src/ngircd/resolve.c @@ -42,7 +42,6 @@ #include "io.h" -static void Init_Subprocess PARAMS(( void )); static void Do_ResolveAddr PARAMS(( const ng_ipaddr_t *Addr, int Sock, int w_fd )); static void Do_ResolveName PARAMS(( const char *Host, int w_fd )); @@ -70,7 +69,7 @@ Resolve_Addr(PROC_STAT * s, const ng_ipaddr_t *Addr, int identsock, return true; } else if( pid == 0 ) { /* Sub process */ - Init_Subprocess(); + Log_Init_Subprocess("Resolver"); Do_ResolveAddr( Addr, identsock, pipefd[1]); Log_Exit_Subprocess("Resolver"); exit(0); @@ -99,7 +98,7 @@ Resolve_Name( PROC_STAT *s, const char *Host, void (*cbfunc)(int, short)) return true; } else if( pid == 0 ) { /* Sub process */ - Init_Subprocess(); + Log_Init_Subprocess("Resolver"); Do_ResolveName(Host, pipefd[1]); Log_Exit_Subprocess("Resolver"); exit(0); @@ -108,17 +107,6 @@ Resolve_Name( PROC_STAT *s, const char *Host, void (*cbfunc)(int, short)) } /* Resolve_Name */ -/** - * Initialize forked resolver subprocess. - */ -static void -Init_Subprocess(void) -{ - signal(SIGTERM, Proc_GenericSignalHandler); - Log_Init_Subprocess("Resolver"); -} - - #if !defined(HAVE_GETADDRINFO) || !defined(HAVE_GETNAMEINFO) #if !defined(WANT_IPV6) && defined(h_errno) static char *

1 0

Alexander Barton : Don't even fork a PAM-subprocess if "NoPAM" option is set
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 6131822af6c0e2476dd539239d497dc0067271bc URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=6131822a… Author: Alexander Barton <alex(a)barton.de> Date: Tue Jul 13 22:14:53 2010 +0200 Don't even fork a PAM-subprocess if "NoPAM" option is set --- src/ngircd/irc-login.c | 16 ++++++++++++---- 1 files changed, 12 insertions(+), 4 deletions(-) diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c index 0bcbe3e..8ac5471 100644 --- a/src/ngircd/irc-login.c +++ b/src/ngircd/irc-login.c @@ -778,6 +778,17 @@ Hello_User(CLIENT * Client) assert(Client != NULL); conn = Client_Conn(Client); + if (Conf_NoPAM) { + /* Don't do any PAM authentication at all, instead emulate + * the beahiour of the daemon compiled without PAM support: + * because there can't be any "server password", all + * passwords supplied are classified as "wrong". */ + if(Client_Password(Client)[0] == '\0') + return Hello_User_PostAuth(Client); + Reject_Client(Client); + return DISCONNECTED; + } + pid = Proc_Fork(Conn_GetProcStat(conn), pipefd, cb_Read_Auth_Result); if (pid > 0) { LogDebug("Authenticator for connection %d created (PID %d).", @@ -786,10 +797,7 @@ Hello_User(CLIENT * Client) } else { /* Sub process */ Log_Init_Subprocess("Auth"); - if (Conf_NoPAM) { - result = (Client_Password(Client)[0] == '\0'); - } else - result = PAM_Authenticate(Client); + result = PAM_Authenticate(Client); write(pipefd[1], &result, sizeof(result)); Log_Exit_Subprocess("Auth"); exit(0);

1 0

Alexander Barton : Don't Proc_Kill() childs after Proc_Read(): done there already.
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 9cd3494de92eccaa201f42fc8b02fc68c752aca8 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=9cd3494d… Author: Alexander Barton <alex(a)barton.de> Date: Tue Jul 13 22:29:06 2010 +0200 Don't Proc_Kill() childs after Proc_Read(): done there already. --- src/ngircd/irc-login.c | 3 --- src/ngircd/proc.c | 2 ++ 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c index 8ac5471..93ee07e 100644 --- a/src/ngircd/irc-login.c +++ b/src/ngircd/irc-login.c @@ -847,9 +847,6 @@ cb_Read_Auth_Result(int r_fd, UNUSED short events) if (len == 0) return; - /* Make sure authenticator sub-process is dead now ... */ - Proc_Kill(proc); - if (len != sizeof(result)) { Log(LOG_CRIT, "Auth: Got malformed result!"); Reject_Client(client); diff --git a/src/ngircd/proc.c b/src/ngircd/proc.c index 11cb039..1e8cac3 100644 --- a/src/ngircd/proc.c +++ b/src/ngircd/proc.c @@ -119,6 +119,8 @@ Proc_GenericSignalHandler(int Signal) /** * Read bytes from a pipe of a forked child process. + * In addition, this function makes sure that the child process is dead + * after all data has been read or a fatal error occurred. */ GLOBAL size_t Proc_Read(PROC_STAT *proc, void *buffer, size_t buflen)

1 0

Alexander Barton : Authenticated users should be registered without the "~" mark
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 560492a4a4bd2182e3eaa32a5d5db7582be97963 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=560492a4… Author: Alexander Barton <alex(a)barton.de> Date: Tue Jul 13 23:18:54 2010 +0200 Authenticated users should be registered without the "~" mark --- src/ngircd/irc-login.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c index 93ee07e..b1b739b 100644 --- a/src/ngircd/irc-login.c +++ b/src/ngircd/irc-login.c @@ -853,9 +853,10 @@ cb_Read_Auth_Result(int r_fd, UNUSED short events) return; } - if (result == true) + if (result == true) { + Client_SetUser(client, Client_OrigUser(client), true); (void)Hello_User_PostAuth(client); - else + } else Reject_Client(client); }

1 0

Alexander Barton : New function Conn_CloseAllSockets() to close all open sockets
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: cf93881dfbd7b6317d2a41f87e9751b74354203b URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=cf93881d… Author: Alexander Barton <alex(a)barton.de> Date: Wed Jul 14 10:27:55 2010 +0200 New function Conn_CloseAllSockets() to close all open sockets This is useful in forked child processes, for example, to make sure that they don't hold connections open that the main process wants to close. --- src/ngircd/conn.c | 17 +++++++++++++++++ src/ngircd/conn.h | 2 ++ 2 files changed, 19 insertions(+), 0 deletions(-) diff --git a/src/ngircd/conn.c b/src/ngircd/conn.c index f059d91..d8df627 100644 --- a/src/ngircd/conn.c +++ b/src/ngircd/conn.c @@ -419,6 +419,23 @@ Conn_Exit( void ) } /* Conn_Exit */ +/** + * Close all sockets (file descriptors) of open connections. + * This is useful in forked child processes, for example, to make sure that + * they don't hold connections open that the main process wants to close. + */ +GLOBAL void +Conn_CloseAllSockets(void) +{ + CONN_ID idx; + + for(idx = 0; idx < Pool_Size; idx++) { + if(My_Connections[idx].sock > NONE) + close(My_Connections[idx].sock); + } +} + + static unsigned int ports_initlisteners(array *a, const char *listen_addr, void (*func)(int,short)) { diff --git a/src/ngircd/conn.h b/src/ngircd/conn.h index a63fcbb..a0bddaa 100644 --- a/src/ngircd/conn.h +++ b/src/ngircd/conn.h @@ -102,6 +102,8 @@ GLOBAL long WCounter; GLOBAL void Conn_Init PARAMS((void )); GLOBAL void Conn_Exit PARAMS(( void )); +GLOBAL void Conn_CloseAllSockets PARAMS((void)); + GLOBAL unsigned int Conn_InitListeners PARAMS(( void )); GLOBAL void Conn_ExitListeners PARAMS(( void ));

1 0

Alexander Barton : Add pam.{c|h} to project and implement PAM_Authenticate( ) function
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 77870ddf2d87ddf222d87b58cb9afdf0609d49dd URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=77870ddf… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 12:53:08 2010 +0200 Add pam.{c|h} to project and implement PAM_Authenticate() function --- src/ngircd/Makefile.am | 4 +- src/ngircd/pam.c | 139 ++++++++++++++++++++++++++++++++++++++++++++++++ src/ngircd/pam.h | 25 +++++++++ 3 files changed, 166 insertions(+), 2 deletions(-) diff --git a/src/ngircd/Makefile.am b/src/ngircd/Makefile.am index 2bce292..4c9d9fa 100644 --- a/src/ngircd/Makefile.am +++ b/src/ngircd/Makefile.am @@ -21,7 +21,7 @@ sbin_PROGRAMS = ngircd ngircd_SOURCES = ngircd.c array.c channel.c client.c conf.c conn.c conn-func.c \ conn-ssl.c conn-zip.c hash.c io.c irc.c irc-channel.c irc-info.c irc-login.c \ irc-mode.c irc-op.c irc-oper.c irc-server.c irc-write.c lists.c log.c \ - match.c op.c numeric.c parse.c proc.c rendezvous.c resolve.c + match.c op.c numeric.c pam.c parse.c proc.c rendezvous.c resolve.c ngircd_LDFLAGS = -L../portab -L../tool -L../ipaddr @@ -30,7 +30,7 @@ ngircd_LDADD = -lngportab -lngtool -lngipaddr noinst_HEADERS = ngircd.h array.h channel.h client.h conf.h conf-ssl.h conn.h \ conn-func.h conn-ssl.h conn-zip.h hash.h io.h irc.h irc-channel.h \ irc-info.h irc-login.h irc-mode.h irc-op.h irc-oper.h irc-server.h \ - irc-write.h lists.h log.h match.h numeric.h op.h parse.h proc.h \ + irc-write.h lists.h log.h match.h numeric.h op.h pam.h parse.h proc.h \ rendezvous.h resolve.h defines.h messages.h clean-local: diff --git a/src/ngircd/pam.c b/src/ngircd/pam.c new file mode 100644 index 0000000..e6d25bc --- /dev/null +++ b/src/ngircd/pam.c @@ -0,0 +1,139 @@ +/* + * ngIRCd -- The Next Generation IRC Daemon + * Copyright (c)2001-2010 Alexander Barton (alex(a)barton.de) + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * Please read the file COPYING, README and AUTHORS for more information. + * + * PAM User Authentification + */ + +#include "portab.h" + +#ifdef PAM + +#include "imp.h" +#include <assert.h> + +#include "defines.h" +#include "log.h" +#include "conn.h" +#include "client.h" + +#include <stdlib.h> +#include <string.h> + +#ifdef HAVE_SECURITY_PAM_APPL_H +#include <security/pam_appl.h> +#endif + +#ifdef HAVE_PAM_PAM_APPL_H +#include <pam/pam_appl.h> +#endif + +#include "exp.h" +#include "pam.h" + +static char *password; + +/** + * PAM "conversation function". + * This is a callback function used by the PAM library to get the password. + * Please see the PAM documentation for details :-) + */ +static int +password_conversation(int num_msg, const struct pam_message **msg, + struct pam_response **resp, void *appdata_ptr) { + LogDebug("PAM: conv(%d, %d, '%s', '%s')", + num_msg, msg[0]->msg_style, msg[0]->msg, appdata_ptr); + + /* Can we deal with this request? */ + if (num_msg != 1 || msg[0]->msg_style != PAM_PROMPT_ECHO_OFF) { + Log(LOG_ERR, "PAM: Unexpected PAM conversation '%d:%s'!", + msg[0]->msg_style, msg[0]->msg); + return PAM_CONV_ERR; + } + + if (!appdata_ptr) { + /* Sometimes appdata_ptr gets lost!? */ + appdata_ptr = password; + } + + /* Duplicate password ("application data") for the PAM library */ + *resp = calloc(num_msg, sizeof(struct pam_response)); + if (!*resp) { + Log(LOG_ERR, "PAM: Out of memory!"); + return PAM_CONV_ERR; + } + + (*resp)[0].resp = strdup((char *)appdata_ptr); + (*resp)[0].resp_retcode = 0; + + return ((*resp)[0].resp ? PAM_SUCCESS : PAM_CONV_ERR); +} + +/** + * PAM "conversation" structure. + */ +static struct pam_conv conv = { + &password_conversation, + NULL +}; + +/** + * Authenticate a connectiong client using PAM. + * @param Client The client to authenticate. + * @return true when authentication succeeded, false otherwise. + */ +GLOBAL bool +PAM_Authenticate(CLIENT *Client) { + pam_handle_t *pam; + int retval = PAM_SUCCESS; + + LogDebug("PAM: Authenticate \"%s\" (%s) ...", + Client_OrigUser(Client), Client_Mask(Client)); + + /* Set supplied client password */ + if (password) + free(password); + password = strdup(Client_Password(Client)); + conv.appdata_ptr = password; + + /* Initialize PAM */ + retval = pam_start("ngircd", Client_OrigUser(Client), &conv, &pam); + if (retval != PAM_SUCCESS) { + Log(LOG_ERR, "PAM: Failed to create authenticator! (%d)", retval); + return false; + } + + pam_set_item(pam, PAM_RUSER, Client_User(Client)); + pam_set_item(pam, PAM_RHOST, Client_Hostname(Client)); +#ifdef HAVE_PAM_FAIL_DELAY + pam_fail_delay(pam, 0); +#endif + + /* PAM authentication ... */ + retval = pam_authenticate(pam, 0); + + /* Success? */ + if (retval == PAM_SUCCESS) + Log(LOG_INFO, "PAM: Authenticated \"%s\" (%s).", + Client_OrigUser(Client), Client_Mask(Client)); + else + Log(LOG_ERR, "PAM: Error on \"%s\" (%s): %s", + Client_OrigUser(Client), Client_Mask(Client), + pam_strerror(pam, retval)); + + /* Free PAM structures */ + if (pam_end(pam, retval) != PAM_SUCCESS) + Log(LOG_ERR, "PAM: Failed to release authenticator!"); + + return (retval == PAM_SUCCESS); +} + +#endif /* PAM */ + +/* -eof- */ diff --git a/src/ngircd/pam.h b/src/ngircd/pam.h new file mode 100644 index 0000000..74b838d --- /dev/null +++ b/src/ngircd/pam.h @@ -0,0 +1,25 @@ +/* + * ngIRCd -- The Next Generation IRC Daemon + * Copyright (c)2001-2010 Alexander Barton (alex(a)barton.de) + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * Please read the file COPYING, README and AUTHORS for more information. + * + * PAM User Authentification (header) + */ + +#ifdef PAM + +#ifndef __pam_h__ +#define __pam_h__ + +GLOBAL bool PAM_Authenticate PARAMS((CLIENT *Client)); + +#endif /* __pam_h__ */ + +#endif /* PAM */ + +/* -eof- */

1 0