- ngIRCd GIT Updates - lists.barton.de

Alexander Barton : Don't Proc_Kill() childs after Proc_Read(): done there already.
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 9cd3494de92eccaa201f42fc8b02fc68c752aca8 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=9cd3494d… Author: Alexander Barton <alex(a)barton.de> Date: Tue Jul 13 22:29:06 2010 +0200 Don't Proc_Kill() childs after Proc_Read(): done there already. --- src/ngircd/irc-login.c | 3 --- src/ngircd/proc.c | 2 ++ 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c index 8ac5471..93ee07e 100644 --- a/src/ngircd/irc-login.c +++ b/src/ngircd/irc-login.c @@ -847,9 +847,6 @@ cb_Read_Auth_Result(int r_fd, UNUSED short events) if (len == 0) return; - /* Make sure authenticator sub-process is dead now ... */ - Proc_Kill(proc); - if (len != sizeof(result)) { Log(LOG_CRIT, "Auth: Got malformed result!"); Reject_Client(client); diff --git a/src/ngircd/proc.c b/src/ngircd/proc.c index 11cb039..1e8cac3 100644 --- a/src/ngircd/proc.c +++ b/src/ngircd/proc.c @@ -119,6 +119,8 @@ Proc_GenericSignalHandler(int Signal) /** * Read bytes from a pipe of a forked child process. + * In addition, this function makes sure that the child process is dead + * after all data has been read or a fatal error occurred. */ GLOBAL size_t Proc_Read(PROC_STAT *proc, void *buffer, size_t buflen)

1 0

Alexander Barton : Authenticated users should be registered without the "~" mark
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 560492a4a4bd2182e3eaa32a5d5db7582be97963 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=560492a4… Author: Alexander Barton <alex(a)barton.de> Date: Tue Jul 13 23:18:54 2010 +0200 Authenticated users should be registered without the "~" mark --- src/ngircd/irc-login.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c index 93ee07e..b1b739b 100644 --- a/src/ngircd/irc-login.c +++ b/src/ngircd/irc-login.c @@ -853,9 +853,10 @@ cb_Read_Auth_Result(int r_fd, UNUSED short events) return; } - if (result == true) + if (result == true) { + Client_SetUser(client, Client_OrigUser(client), true); (void)Hello_User_PostAuth(client); - else + } else Reject_Client(client); }

1 0

Alexander Barton : New function Conn_CloseAllSockets() to close all open sockets
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: cf93881dfbd7b6317d2a41f87e9751b74354203b URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=cf93881d… Author: Alexander Barton <alex(a)barton.de> Date: Wed Jul 14 10:27:55 2010 +0200 New function Conn_CloseAllSockets() to close all open sockets This is useful in forked child processes, for example, to make sure that they don't hold connections open that the main process wants to close. --- src/ngircd/conn.c | 17 +++++++++++++++++ src/ngircd/conn.h | 2 ++ 2 files changed, 19 insertions(+), 0 deletions(-) diff --git a/src/ngircd/conn.c b/src/ngircd/conn.c index f059d91..d8df627 100644 --- a/src/ngircd/conn.c +++ b/src/ngircd/conn.c @@ -419,6 +419,23 @@ Conn_Exit( void ) } /* Conn_Exit */ +/** + * Close all sockets (file descriptors) of open connections. + * This is useful in forked child processes, for example, to make sure that + * they don't hold connections open that the main process wants to close. + */ +GLOBAL void +Conn_CloseAllSockets(void) +{ + CONN_ID idx; + + for(idx = 0; idx < Pool_Size; idx++) { + if(My_Connections[idx].sock > NONE) + close(My_Connections[idx].sock); + } +} + + static unsigned int ports_initlisteners(array *a, const char *listen_addr, void (*func)(int,short)) { diff --git a/src/ngircd/conn.h b/src/ngircd/conn.h index a63fcbb..a0bddaa 100644 --- a/src/ngircd/conn.h +++ b/src/ngircd/conn.h @@ -102,6 +102,8 @@ GLOBAL long WCounter; GLOBAL void Conn_Init PARAMS((void )); GLOBAL void Conn_Exit PARAMS(( void )); +GLOBAL void Conn_CloseAllSockets PARAMS((void)); + GLOBAL unsigned int Conn_InitListeners PARAMS(( void )); GLOBAL void Conn_ExitListeners PARAMS(( void ));

1 0

Alexander Barton : Add pam.{c|h} to project and implement PAM_Authenticate( ) function
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 77870ddf2d87ddf222d87b58cb9afdf0609d49dd URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=77870ddf… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 12:53:08 2010 +0200 Add pam.{c|h} to project and implement PAM_Authenticate() function --- src/ngircd/Makefile.am | 4 +- src/ngircd/pam.c | 139 ++++++++++++++++++++++++++++++++++++++++++++++++ src/ngircd/pam.h | 25 +++++++++ 3 files changed, 166 insertions(+), 2 deletions(-) diff --git a/src/ngircd/Makefile.am b/src/ngircd/Makefile.am index 2bce292..4c9d9fa 100644 --- a/src/ngircd/Makefile.am +++ b/src/ngircd/Makefile.am @@ -21,7 +21,7 @@ sbin_PROGRAMS = ngircd ngircd_SOURCES = ngircd.c array.c channel.c client.c conf.c conn.c conn-func.c \ conn-ssl.c conn-zip.c hash.c io.c irc.c irc-channel.c irc-info.c irc-login.c \ irc-mode.c irc-op.c irc-oper.c irc-server.c irc-write.c lists.c log.c \ - match.c op.c numeric.c parse.c proc.c rendezvous.c resolve.c + match.c op.c numeric.c pam.c parse.c proc.c rendezvous.c resolve.c ngircd_LDFLAGS = -L../portab -L../tool -L../ipaddr @@ -30,7 +30,7 @@ ngircd_LDADD = -lngportab -lngtool -lngipaddr noinst_HEADERS = ngircd.h array.h channel.h client.h conf.h conf-ssl.h conn.h \ conn-func.h conn-ssl.h conn-zip.h hash.h io.h irc.h irc-channel.h \ irc-info.h irc-login.h irc-mode.h irc-op.h irc-oper.h irc-server.h \ - irc-write.h lists.h log.h match.h numeric.h op.h parse.h proc.h \ + irc-write.h lists.h log.h match.h numeric.h op.h pam.h parse.h proc.h \ rendezvous.h resolve.h defines.h messages.h clean-local: diff --git a/src/ngircd/pam.c b/src/ngircd/pam.c new file mode 100644 index 0000000..e6d25bc --- /dev/null +++ b/src/ngircd/pam.c @@ -0,0 +1,139 @@ +/* + * ngIRCd -- The Next Generation IRC Daemon + * Copyright (c)2001-2010 Alexander Barton (alex(a)barton.de) + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * Please read the file COPYING, README and AUTHORS for more information. + * + * PAM User Authentification + */ + +#include "portab.h" + +#ifdef PAM + +#include "imp.h" +#include <assert.h> + +#include "defines.h" +#include "log.h" +#include "conn.h" +#include "client.h" + +#include <stdlib.h> +#include <string.h> + +#ifdef HAVE_SECURITY_PAM_APPL_H +#include <security/pam_appl.h> +#endif + +#ifdef HAVE_PAM_PAM_APPL_H +#include <pam/pam_appl.h> +#endif + +#include "exp.h" +#include "pam.h" + +static char *password; + +/** + * PAM "conversation function". + * This is a callback function used by the PAM library to get the password. + * Please see the PAM documentation for details :-) + */ +static int +password_conversation(int num_msg, const struct pam_message **msg, + struct pam_response **resp, void *appdata_ptr) { + LogDebug("PAM: conv(%d, %d, '%s', '%s')", + num_msg, msg[0]->msg_style, msg[0]->msg, appdata_ptr); + + /* Can we deal with this request? */ + if (num_msg != 1 || msg[0]->msg_style != PAM_PROMPT_ECHO_OFF) { + Log(LOG_ERR, "PAM: Unexpected PAM conversation '%d:%s'!", + msg[0]->msg_style, msg[0]->msg); + return PAM_CONV_ERR; + } + + if (!appdata_ptr) { + /* Sometimes appdata_ptr gets lost!? */ + appdata_ptr = password; + } + + /* Duplicate password ("application data") for the PAM library */ + *resp = calloc(num_msg, sizeof(struct pam_response)); + if (!*resp) { + Log(LOG_ERR, "PAM: Out of memory!"); + return PAM_CONV_ERR; + } + + (*resp)[0].resp = strdup((char *)appdata_ptr); + (*resp)[0].resp_retcode = 0; + + return ((*resp)[0].resp ? PAM_SUCCESS : PAM_CONV_ERR); +} + +/** + * PAM "conversation" structure. + */ +static struct pam_conv conv = { + &password_conversation, + NULL +}; + +/** + * Authenticate a connectiong client using PAM. + * @param Client The client to authenticate. + * @return true when authentication succeeded, false otherwise. + */ +GLOBAL bool +PAM_Authenticate(CLIENT *Client) { + pam_handle_t *pam; + int retval = PAM_SUCCESS; + + LogDebug("PAM: Authenticate \"%s\" (%s) ...", + Client_OrigUser(Client), Client_Mask(Client)); + + /* Set supplied client password */ + if (password) + free(password); + password = strdup(Client_Password(Client)); + conv.appdata_ptr = password; + + /* Initialize PAM */ + retval = pam_start("ngircd", Client_OrigUser(Client), &conv, &pam); + if (retval != PAM_SUCCESS) { + Log(LOG_ERR, "PAM: Failed to create authenticator! (%d)", retval); + return false; + } + + pam_set_item(pam, PAM_RUSER, Client_User(Client)); + pam_set_item(pam, PAM_RHOST, Client_Hostname(Client)); +#ifdef HAVE_PAM_FAIL_DELAY + pam_fail_delay(pam, 0); +#endif + + /* PAM authentication ... */ + retval = pam_authenticate(pam, 0); + + /* Success? */ + if (retval == PAM_SUCCESS) + Log(LOG_INFO, "PAM: Authenticated \"%s\" (%s).", + Client_OrigUser(Client), Client_Mask(Client)); + else + Log(LOG_ERR, "PAM: Error on \"%s\" (%s): %s", + Client_OrigUser(Client), Client_Mask(Client), + pam_strerror(pam, retval)); + + /* Free PAM structures */ + if (pam_end(pam, retval) != PAM_SUCCESS) + Log(LOG_ERR, "PAM: Failed to release authenticator!"); + + return (retval == PAM_SUCCESS); +} + +#endif /* PAM */ + +/* -eof- */ diff --git a/src/ngircd/pam.h b/src/ngircd/pam.h new file mode 100644 index 0000000..74b838d --- /dev/null +++ b/src/ngircd/pam.h @@ -0,0 +1,25 @@ +/* + * ngIRCd -- The Next Generation IRC Daemon + * Copyright (c)2001-2010 Alexander Barton (alex(a)barton.de) + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * Please read the file COPYING, README and AUTHORS for more information. + * + * PAM User Authentification (header) + */ + +#ifdef PAM + +#ifndef __pam_h__ +#define __pam_h__ + +GLOBAL bool PAM_Authenticate PARAMS((CLIENT *Client)); + +#endif /* __pam_h__ */ + +#endif /* PAM */ + +/* -eof- */

1 0

Alexander Barton : Add new pam.{c|h} module to Xcode project
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: fb4b5acfb8871c43e34dc2aa9c354a86f14f9293 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=fb4b5acf… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 12:54:01 2010 +0200 Add new pam.{c|h} module to Xcode project Adjust Xcode project and Mac OS X static config.h header to use PAM. --- contrib/MacOSX/config.h | 12 +++++++++++- contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj | 10 ++++++++++ 2 files changed, 21 insertions(+), 1 deletions(-) diff --git a/contrib/MacOSX/config.h b/contrib/MacOSX/config.h index 66465e2..72c8875 100644 --- a/contrib/MacOSX/config.h +++ b/contrib/MacOSX/config.h @@ -1,6 +1,6 @@ /* * ngIRCd -- The Next Generation IRC Daemon - * Copyright (c)2001-2009 Alexander Barton (alex(a)barton.de) + * Copyright (c)2001-2010 Alexander Barton (alex(a)barton.de) * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -51,6 +51,9 @@ /* Define if IPV6 protocol should be enabled */ #define WANT_IPV6 1 +/* Define if PAM should be used */ +#define PAM 1 + /* -- Supported features -- */ /* Define if SSP C support is enabled. */ @@ -105,4 +108,11 @@ #define HAVE_DNSSERVICEREGISTRATIONCREATE 1 #endif +#ifdef PAM +/* Define to 1 if you have the `pam_authenticate' function. */ +#define HAVE_PAM_AUTHENTICATE 1 +/* Define to 1 if you have the <pam/pam_appl.h> header file. */ +#define HAVE_PAM_PAM_APPL_H 1 +#endif + /* -eof- */ diff --git a/contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj b/contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj index d36d25b..d3a7617 100644 --- a/contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj +++ b/contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj @@ -7,6 +7,8 @@ objects = { /* Begin PBXBuildFile section */ + FA2D564A11EA158B00D37A35 /* pam.c in Sources */ = {isa = PBXBuildFile; fileRef = FA2D564911EA158B00D37A35 /* pam.c */; }; + FA2D567B11EA1AB300D37A35 /* libpam.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = FA2D567A11EA1AB300D37A35 /* libpam.dylib */; }; FA322D350CEF74B1001761B3 /* array.c in Sources */ = {isa = PBXBuildFile; fileRef = FA322CD90CEF74B1001761B3 /* array.c */; }; FA322D360CEF74B1001761B3 /* channel.c in Sources */ = {isa = PBXBuildFile; fileRef = FA322CDB0CEF74B1001761B3 /* channel.c */; }; FA322D370CEF74B1001761B3 /* client.c in Sources */ = {isa = PBXBuildFile; fileRef = FA322CDD0CEF74B1001761B3 /* client.c */; }; @@ -56,6 +58,9 @@ /* Begin PBXFileReference section */ FA1A6BBC0D6857BB00AA8F71 /* misc-test.e */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = "misc-test.e"; sourceTree = "<group>"; }; FA1A6BBD0D6857D900AA8F71 /* who-test.e */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = "who-test.e"; sourceTree = "<group>"; }; + FA2D564811EA158B00D37A35 /* pam.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = pam.h; sourceTree = "<group>"; }; + FA2D564911EA158B00D37A35 /* pam.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; path = pam.c; sourceTree = "<group>"; }; + FA2D567A11EA1AB300D37A35 /* libpam.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libpam.dylib; path = usr/lib/libpam.dylib; sourceTree = SDKROOT; }; FA322BBA0CEF72E4001761B3 /* ngIRCd */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = ngIRCd; sourceTree = BUILT_PRODUCTS_DIR; }; FA322CD60CEF74B1001761B3 /* Makefile.am */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = Makefile.am; sourceTree = "<group>"; }; FA322CD90CEF74B1001761B3 /* array.c */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = sourcecode.c.c; path = array.c; sourceTree = "<group>"; }; @@ -231,6 +236,7 @@ buildActionMask = 2147483647; files = ( FA322DC10CEF77CB001761B3 /* libz.dylib in Frameworks */, + FA2D567B11EA1AB300D37A35 /* libpam.dylib in Frameworks */, ); runOnlyForDeploymentPostprocessing = 0; }; @@ -257,6 +263,7 @@ FA322D630CEF750F001761B3 /* Makefile.am */, 1AB674ADFE9D54B511CA2CBB /* Products */, FA322DC00CEF77CB001761B3 /* libz.dylib */, + FA2D567A11EA1AB300D37A35 /* libpam.dylib */, ); name = ngIRCd; sourceTree = "<group>"; @@ -348,6 +355,8 @@ FA322D0B0CEF74B1001761B3 /* rendezvous.h */, FA322D0C0CEF74B1001761B3 /* resolve.c */, FA322D0D0CEF74B1001761B3 /* resolve.h */, + FA2D564811EA158B00D37A35 /* pam.h */, + FA2D564911EA158B00D37A35 /* pam.c */, ); path = ngircd; sourceTree = "<group>"; @@ -688,6 +697,7 @@ FAA3D27B0F139CDC00B2447E /* conn-ssl.c in Sources */, FA85178C0FA061EC006A1F5A /* op.c in Sources */, FA99428C10E82A27007F27ED /* proc.c in Sources */, + FA2D564A11EA158B00D37A35 /* pam.c in Sources */, ); runOnlyForDeploymentPostprocessing = 0; };

1 0

Alexander Barton : Implement asynchronous user authentication using PAM
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 808d4f6e85c13ff231321de76f9b356ec13110d4 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=808d4f6e… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 12:56:33 2010 +0200 Implement asynchronous user authentication using PAM For each client connection a child process is forked which handles the actual PAM authentication and reports the result back to the master process using a pipe for communication. While the PAM authentication is in process the daemon does not block. --- src/ngircd/irc-login.c | 108 +++++++++++++++++++++++++++++++++++++++++++++--- 1 files changed, 102 insertions(+), 6 deletions(-) diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c index 906b669..b6cda6f 100644 --- a/src/ngircd/irc-login.c +++ b/src/ngircd/irc-login.c @@ -20,13 +20,16 @@ #include <stdlib.h> #include <string.h> #include <strings.h> +#include <unistd.h> #include "ngircd.h" #include "conn-func.h" #include "conf.h" #include "channel.h" +#include "io.h" #include "log.h" #include "messages.h" +#include "pam.h" #include "parse.h" #include "irc.h" #include "irc-info.h" @@ -37,11 +40,17 @@ static bool Hello_User PARAMS(( CLIENT *Client )); +static bool Hello_User_PostAuth PARAMS(( CLIENT *Client )); static void Kill_Nick PARAMS(( char *Nick, char *Reason )); static void Introduce_Client PARAMS((CLIENT *To, CLIENT *Client, int Type)); +static void Reject_Client PARAMS((CLIENT *Client)); + static void cb_introduceClient PARAMS((CLIENT *Client, CLIENT *Prefix, void *i)); +#ifdef PAM +static void cb_Read_Auth_Result PARAMS((int r_fd, UNUSED short events)); +#endif /** * Handler for the IRC command "PASS". @@ -760,18 +769,105 @@ IRC_PONG(CLIENT *Client, REQUEST *Req) static bool Hello_User(CLIENT * Client) { +#ifdef PAM + int pipefd[2], result; + CONN_ID conn; + pid_t pid; + + assert(Client != NULL); + conn = Client_Conn(Client); + + pid = Proc_Fork(Conn_GetProcStat(conn), pipefd, cb_Read_Auth_Result); + if (pid > 0) { + LogDebug("Authenticator for connection %d created (PID %d).", + conn, pid); + return CONNECTED; + } else { + /* Sub process */ + signal(SIGTERM, Proc_GenericSignalHandler); + Log_Init_Subprocess("Auth"); + result = PAM_Authenticate(Client); + write(pipefd[1], &result, sizeof(result)); + Log_Exit_Subprocess("Auth"); + exit(0); + } +#else assert(Client != NULL); - /* Check password ... */ + /* Check global server password ... */ if (strcmp(Client_Password(Client), Conf_ServerPwd) != 0) { /* Bad password! */ - Log(LOG_ERR, - "Client \"%s\" rejected (connection %d): Bad password!", - Client_Mask(Client), Client_Conn(Client)); - Conn_Close(Client_Conn(Client), NULL, "Bad password", true); + Reject_Client(Client); return DISCONNECTED; } + return Hello_User_PostAuth(Client); +#endif +} + +#ifdef PAM + +/** + * Read result of the authenticatior sub-process from pipe + */ +static void +cb_Read_Auth_Result(int r_fd, UNUSED short events) +{ + CONN_ID conn; + CLIENT *client; + int result; + size_t len; + PROC_STAT *proc; + + LogDebug("Auth: Got callback on fd %d, events %d", r_fd, events); + conn = Conn_GetFromProc(r_fd); + if (conn == NONE) { + /* Ops, none found? Probably the connection has already + * been closed!? We'll ignore that ... */ + io_close(r_fd); + LogDebug("Auth: Got callback for unknown connection!?"); + return; + } + proc = Conn_GetProcStat(conn); + client = Conn_GetClient(conn); + + /* Read result from pipe */ + len = Proc_Read(proc, &result, sizeof(result)); + if (len == 0) + return; + + /* Make sure authenticator sub-process is dead now ... */ + Proc_Kill(proc); + + if (len != sizeof(result)) { + Log(LOG_CRIT, "Auth: Got malformed result!"); + Reject_Client(client); + return; + } + + if (result == true) + (void)Hello_User_PostAuth(client); + else + Reject_Client(client); +} + +#endif + + +static void +Reject_Client(CLIENT *Client) +{ + Log(LOG_ERR, + "User \"%s\" rejected (connection %d): Access denied!", + Client_Mask(Client), Client_Conn(Client)); + Conn_Close(Client_Conn(Client), NULL, + "Access denied! Bad password?", true); +} + + +static bool +Hello_User_PostAuth(CLIENT *Client) +{ Introduce_Client(NULL, Client, CLIENT_USER); if (!IRC_WriteStrClient @@ -805,7 +901,7 @@ Hello_User(CLIENT * Client) IRC_SetPenalty(Client, 1); return CONNECTED; -} /* Hello_User */ +} static void

1 0

Alexander Barton : Initial documentation for using PAM with ngIRCd
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 583c50476bee24a8da9459163b609ac80353e63e URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=583c5047… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 13:07:07 2010 +0200 Initial documentation for using PAM with ngIRCd --- doc/PAM.txt | 36 ++++++++++++++++++++++++++++++++++++ 1 files changed, 36 insertions(+), 0 deletions(-) diff --git a/doc/PAM.txt b/doc/PAM.txt new file mode 100644 index 0000000..64bbc7b --- /dev/null +++ b/doc/PAM.txt @@ -0,0 +1,36 @@ + + ngIRCd - Next Generation IRC Server + + (c)2001-2010 Alexander Barton, + alex(a)barton.de, http://www.barton.de/ + + ngIRCd is free software and published under the + terms of the GNU General Public License. + + -- PAM.txt -- + + +ngIRCd can optionally be compiled to use PAM, the Pluggable Authentication +Modules library, for user authentication. When compiled with PAM support, +ngIRCd will authenticate all users connecting to the daemon using the +configured PAM modules in an asynchronous child process. + +To enable PAM, you have to pass the command line parameter "--with-pam" to +the "configure" script. Please see the PAM documentation ("man 7 pam") for +details and information about configuring PAM and its individual modules. + +A very simple -- and quite useless ;-) -- example would be: + + /etc/pam.d/ngircd: + auth required pam_debug.so + +Here the "pam_debug" module will be called each time a client connects to +the ngIRCd and has sent its PASS, NICK, and USER commands. + +Please note ONE VERY IMPORTANT THING: + +All the PAM modules are executed with the privileges of the user ngIRCd +is running as. Therefore a lot of PAM modules aren't working as expected, +because they need root privileges ("pam_unix", for example)! +Only PAM modules not(!) requiring root privileges (such as "pam_pgsql", +"pam_mysql", "pam_opendirectory" ...) can be used in conjunction with ngIRCd.

1 0

Alexander Barton : Make sure signal.h is #include'd when needed
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 28424d013d4909a7d5a2501537ad39ae74873724 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=28424d01… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 13:22:19 2010 +0200 Make sure signal.h is #include'd when needed --- src/ngircd/irc-login.c | 1 + src/ngircd/resolve.c | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c index b6cda6f..10e2df8 100644 --- a/src/ngircd/irc-login.c +++ b/src/ngircd/irc-login.c @@ -20,6 +20,7 @@ #include <stdlib.h> #include <string.h> #include <strings.h> +#include <signal.h> #include <unistd.h> #include "ngircd.h" diff --git a/src/ngircd/resolve.c b/src/ngircd/resolve.c index d121b0a..808ce53 100644 --- a/src/ngircd/resolve.c +++ b/src/ngircd/resolve.c @@ -23,6 +23,7 @@ #include <sys/socket.h> #include <netinet/in.h> #include <netdb.h> +#include <signal.h> #ifdef IDENTAUTH #ifdef HAVE_IDENT_H

1 0

Alexander Barton : Use correct preprocessor syntax when testing for PAM and IDENTAUTH
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 03457135b727fc39bb6601b8fb434db2680edc82 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=03457135… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 13:22:48 2010 +0200 Use correct preprocessor syntax when testing for PAM and IDENTAUTH --- src/ngircd/client.c | 2 +- src/ngircd/client.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/ngircd/client.c b/src/ngircd/client.c index 44123ea..8402499 100644 --- a/src/ngircd/client.c +++ b/src/ngircd/client.c @@ -367,7 +367,7 @@ Client_SetOrigUser(CLIENT *Client, const char *User) { assert(Client != NULL); assert(User != NULL); -#ifdef PAM & IDENTAUTH +#if defined(PAM) && defined(IDENTAUTH) strlcpy(Client->orig_user, User, sizeof(Client->orig_user)); #endif } /* Client_SetOrigUser */ diff --git a/src/ngircd/client.h b/src/ngircd/client.h index 352ddf3..bd000a5 100644 --- a/src/ngircd/client.h +++ b/src/ngircd/client.h @@ -43,7 +43,7 @@ typedef struct _CLIENT char pwd[CLIENT_PASS_LEN]; /* password received of the client */ char host[CLIENT_HOST_LEN]; /* hostname of the client */ char user[CLIENT_USER_LEN]; /* user name ("login") */ -#ifdef PAM & IDENTAUTH +#if defined(PAM) && defined(IDENTAUTH) char orig_user[CLIENT_USER_LEN];/* user name supplied by USER command */ #endif char info[CLIENT_INFO_LEN]; /* long user name (user) / info text (server) */

1 0

Alexander Barton : io.c: Include conn.h when using the select() API
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 37ee0a331394d990e514a1a7b2b52ecb879b9701 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=37ee0a33… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 13:24:45 2010 +0200 io.c: Include conn.h when using the select() API --- src/ngircd/io.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/ngircd/io.c b/src/ngircd/io.c index e811e81..cb2b55a 100644 --- a/src/ngircd/io.c +++ b/src/ngircd/io.c @@ -105,6 +105,7 @@ static bool io_event_change_devpoll(int fd, short what); #ifdef IO_USE_SELECT #include "defines.h" /* for conn.h */ #include "proc.h" /* for PROC_STAT (needed by conf.h) */ +#include "conn.h" /* for CONN_ID (needed by conf.h) */ #include "conf.h" /* for Conf_MaxConnections */ static fd_set readers;

1 0