- ngIRCd GIT Updates - lists.barton.de

Alexander Barton : Add new pam.{c|h} module to Xcode project
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: fb4b5acfb8871c43e34dc2aa9c354a86f14f9293 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=fb4b5acf… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 12:54:01 2010 +0200 Add new pam.{c|h} module to Xcode project Adjust Xcode project and Mac OS X static config.h header to use PAM. --- contrib/MacOSX/config.h | 12 +++++++++++- contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj | 10 ++++++++++ 2 files changed, 21 insertions(+), 1 deletions(-) diff --git a/contrib/MacOSX/config.h b/contrib/MacOSX/config.h index 66465e2..72c8875 100644 --- a/contrib/MacOSX/config.h +++ b/contrib/MacOSX/config.h @@ -1,6 +1,6 @@ /* * ngIRCd -- The Next Generation IRC Daemon - * Copyright (c)2001-2009 Alexander Barton (alex(a)barton.de) + * Copyright (c)2001-2010 Alexander Barton (alex(a)barton.de) * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -51,6 +51,9 @@ /* Define if IPV6 protocol should be enabled */ #define WANT_IPV6 1 +/* Define if PAM should be used */ +#define PAM 1 + /* -- Supported features -- */ /* Define if SSP C support is enabled. */ @@ -105,4 +108,11 @@ #define HAVE_DNSSERVICEREGISTRATIONCREATE 1 #endif +#ifdef PAM +/* Define to 1 if you have the `pam_authenticate' function. */ +#define HAVE_PAM_AUTHENTICATE 1 +/* Define to 1 if you have the <pam/pam_appl.h> header file. */ +#define HAVE_PAM_PAM_APPL_H 1 +#endif + /* -eof- */ diff --git a/contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj b/contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj index d36d25b..d3a7617 100644 --- a/contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj +++ b/contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj @@ -7,6 +7,8 @@ objects = { /* Begin PBXBuildFile section */ + FA2D564A11EA158B00D37A35 /* pam.c in Sources */ = {isa = PBXBuildFile; fileRef = FA2D564911EA158B00D37A35 /* pam.c */; }; + FA2D567B11EA1AB300D37A35 /* libpam.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = FA2D567A11EA1AB300D37A35 /* libpam.dylib */; }; FA322D350CEF74B1001761B3 /* array.c in Sources */ = {isa = PBXBuildFile; fileRef = FA322CD90CEF74B1001761B3 /* array.c */; }; FA322D360CEF74B1001761B3 /* channel.c in Sources */ = {isa = PBXBuildFile; fileRef = FA322CDB0CEF74B1001761B3 /* channel.c */; }; FA322D370CEF74B1001761B3 /* client.c in Sources */ = {isa = PBXBuildFile; fileRef = FA322CDD0CEF74B1001761B3 /* client.c */; }; @@ -56,6 +58,9 @@ /* Begin PBXFileReference section */ FA1A6BBC0D6857BB00AA8F71 /* misc-test.e */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = "misc-test.e"; sourceTree = "<group>"; }; FA1A6BBD0D6857D900AA8F71 /* who-test.e */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = "who-test.e"; sourceTree = "<group>"; }; + FA2D564811EA158B00D37A35 /* pam.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = pam.h; sourceTree = "<group>"; }; + FA2D564911EA158B00D37A35 /* pam.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; path = pam.c; sourceTree = "<group>"; }; + FA2D567A11EA1AB300D37A35 /* libpam.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libpam.dylib; path = usr/lib/libpam.dylib; sourceTree = SDKROOT; }; FA322BBA0CEF72E4001761B3 /* ngIRCd */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = ngIRCd; sourceTree = BUILT_PRODUCTS_DIR; }; FA322CD60CEF74B1001761B3 /* Makefile.am */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = Makefile.am; sourceTree = "<group>"; }; FA322CD90CEF74B1001761B3 /* array.c */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = sourcecode.c.c; path = array.c; sourceTree = "<group>"; }; @@ -231,6 +236,7 @@ buildActionMask = 2147483647; files = ( FA322DC10CEF77CB001761B3 /* libz.dylib in Frameworks */, + FA2D567B11EA1AB300D37A35 /* libpam.dylib in Frameworks */, ); runOnlyForDeploymentPostprocessing = 0; }; @@ -257,6 +263,7 @@ FA322D630CEF750F001761B3 /* Makefile.am */, 1AB674ADFE9D54B511CA2CBB /* Products */, FA322DC00CEF77CB001761B3 /* libz.dylib */, + FA2D567A11EA1AB300D37A35 /* libpam.dylib */, ); name = ngIRCd; sourceTree = "<group>"; @@ -348,6 +355,8 @@ FA322D0B0CEF74B1001761B3 /* rendezvous.h */, FA322D0C0CEF74B1001761B3 /* resolve.c */, FA322D0D0CEF74B1001761B3 /* resolve.h */, + FA2D564811EA158B00D37A35 /* pam.h */, + FA2D564911EA158B00D37A35 /* pam.c */, ); path = ngircd; sourceTree = "<group>"; @@ -688,6 +697,7 @@ FAA3D27B0F139CDC00B2447E /* conn-ssl.c in Sources */, FA85178C0FA061EC006A1F5A /* op.c in Sources */, FA99428C10E82A27007F27ED /* proc.c in Sources */, + FA2D564A11EA158B00D37A35 /* pam.c in Sources */, ); runOnlyForDeploymentPostprocessing = 0; };

1 0

Alexander Barton : Implement asynchronous user authentication using PAM
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 808d4f6e85c13ff231321de76f9b356ec13110d4 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=808d4f6e… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 12:56:33 2010 +0200 Implement asynchronous user authentication using PAM For each client connection a child process is forked which handles the actual PAM authentication and reports the result back to the master process using a pipe for communication. While the PAM authentication is in process the daemon does not block. --- src/ngircd/irc-login.c | 108 +++++++++++++++++++++++++++++++++++++++++++++--- 1 files changed, 102 insertions(+), 6 deletions(-) diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c index 906b669..b6cda6f 100644 --- a/src/ngircd/irc-login.c +++ b/src/ngircd/irc-login.c @@ -20,13 +20,16 @@ #include <stdlib.h> #include <string.h> #include <strings.h> +#include <unistd.h> #include "ngircd.h" #include "conn-func.h" #include "conf.h" #include "channel.h" +#include "io.h" #include "log.h" #include "messages.h" +#include "pam.h" #include "parse.h" #include "irc.h" #include "irc-info.h" @@ -37,11 +40,17 @@ static bool Hello_User PARAMS(( CLIENT *Client )); +static bool Hello_User_PostAuth PARAMS(( CLIENT *Client )); static void Kill_Nick PARAMS(( char *Nick, char *Reason )); static void Introduce_Client PARAMS((CLIENT *To, CLIENT *Client, int Type)); +static void Reject_Client PARAMS((CLIENT *Client)); + static void cb_introduceClient PARAMS((CLIENT *Client, CLIENT *Prefix, void *i)); +#ifdef PAM +static void cb_Read_Auth_Result PARAMS((int r_fd, UNUSED short events)); +#endif /** * Handler for the IRC command "PASS". @@ -760,18 +769,105 @@ IRC_PONG(CLIENT *Client, REQUEST *Req) static bool Hello_User(CLIENT * Client) { +#ifdef PAM + int pipefd[2], result; + CONN_ID conn; + pid_t pid; + + assert(Client != NULL); + conn = Client_Conn(Client); + + pid = Proc_Fork(Conn_GetProcStat(conn), pipefd, cb_Read_Auth_Result); + if (pid > 0) { + LogDebug("Authenticator for connection %d created (PID %d).", + conn, pid); + return CONNECTED; + } else { + /* Sub process */ + signal(SIGTERM, Proc_GenericSignalHandler); + Log_Init_Subprocess("Auth"); + result = PAM_Authenticate(Client); + write(pipefd[1], &result, sizeof(result)); + Log_Exit_Subprocess("Auth"); + exit(0); + } +#else assert(Client != NULL); - /* Check password ... */ + /* Check global server password ... */ if (strcmp(Client_Password(Client), Conf_ServerPwd) != 0) { /* Bad password! */ - Log(LOG_ERR, - "Client \"%s\" rejected (connection %d): Bad password!", - Client_Mask(Client), Client_Conn(Client)); - Conn_Close(Client_Conn(Client), NULL, "Bad password", true); + Reject_Client(Client); return DISCONNECTED; } + return Hello_User_PostAuth(Client); +#endif +} + +#ifdef PAM + +/** + * Read result of the authenticatior sub-process from pipe + */ +static void +cb_Read_Auth_Result(int r_fd, UNUSED short events) +{ + CONN_ID conn; + CLIENT *client; + int result; + size_t len; + PROC_STAT *proc; + + LogDebug("Auth: Got callback on fd %d, events %d", r_fd, events); + conn = Conn_GetFromProc(r_fd); + if (conn == NONE) { + /* Ops, none found? Probably the connection has already + * been closed!? We'll ignore that ... */ + io_close(r_fd); + LogDebug("Auth: Got callback for unknown connection!?"); + return; + } + proc = Conn_GetProcStat(conn); + client = Conn_GetClient(conn); + + /* Read result from pipe */ + len = Proc_Read(proc, &result, sizeof(result)); + if (len == 0) + return; + + /* Make sure authenticator sub-process is dead now ... */ + Proc_Kill(proc); + + if (len != sizeof(result)) { + Log(LOG_CRIT, "Auth: Got malformed result!"); + Reject_Client(client); + return; + } + + if (result == true) + (void)Hello_User_PostAuth(client); + else + Reject_Client(client); +} + +#endif + + +static void +Reject_Client(CLIENT *Client) +{ + Log(LOG_ERR, + "User \"%s\" rejected (connection %d): Access denied!", + Client_Mask(Client), Client_Conn(Client)); + Conn_Close(Client_Conn(Client), NULL, + "Access denied! Bad password?", true); +} + + +static bool +Hello_User_PostAuth(CLIENT *Client) +{ Introduce_Client(NULL, Client, CLIENT_USER); if (!IRC_WriteStrClient @@ -805,7 +901,7 @@ Hello_User(CLIENT * Client) IRC_SetPenalty(Client, 1); return CONNECTED; -} /* Hello_User */ +} static void

1 0

Alexander Barton : Initial documentation for using PAM with ngIRCd
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 583c50476bee24a8da9459163b609ac80353e63e URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=583c5047… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 13:07:07 2010 +0200 Initial documentation for using PAM with ngIRCd --- doc/PAM.txt | 36 ++++++++++++++++++++++++++++++++++++ 1 files changed, 36 insertions(+), 0 deletions(-) diff --git a/doc/PAM.txt b/doc/PAM.txt new file mode 100644 index 0000000..64bbc7b --- /dev/null +++ b/doc/PAM.txt @@ -0,0 +1,36 @@ + + ngIRCd - Next Generation IRC Server + + (c)2001-2010 Alexander Barton, + alex(a)barton.de, http://www.barton.de/ + + ngIRCd is free software and published under the + terms of the GNU General Public License. + + -- PAM.txt -- + + +ngIRCd can optionally be compiled to use PAM, the Pluggable Authentication +Modules library, for user authentication. When compiled with PAM support, +ngIRCd will authenticate all users connecting to the daemon using the +configured PAM modules in an asynchronous child process. + +To enable PAM, you have to pass the command line parameter "--with-pam" to +the "configure" script. Please see the PAM documentation ("man 7 pam") for +details and information about configuring PAM and its individual modules. + +A very simple -- and quite useless ;-) -- example would be: + + /etc/pam.d/ngircd: + auth required pam_debug.so + +Here the "pam_debug" module will be called each time a client connects to +the ngIRCd and has sent its PASS, NICK, and USER commands. + +Please note ONE VERY IMPORTANT THING: + +All the PAM modules are executed with the privileges of the user ngIRCd +is running as. Therefore a lot of PAM modules aren't working as expected, +because they need root privileges ("pam_unix", for example)! +Only PAM modules not(!) requiring root privileges (such as "pam_pgsql", +"pam_mysql", "pam_opendirectory" ...) can be used in conjunction with ngIRCd.

1 0

Alexander Barton : Make sure signal.h is #include'd when needed
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 28424d013d4909a7d5a2501537ad39ae74873724 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=28424d01… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 13:22:19 2010 +0200 Make sure signal.h is #include'd when needed --- src/ngircd/irc-login.c | 1 + src/ngircd/resolve.c | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c index b6cda6f..10e2df8 100644 --- a/src/ngircd/irc-login.c +++ b/src/ngircd/irc-login.c @@ -20,6 +20,7 @@ #include <stdlib.h> #include <string.h> #include <strings.h> +#include <signal.h> #include <unistd.h> #include "ngircd.h" diff --git a/src/ngircd/resolve.c b/src/ngircd/resolve.c index d121b0a..808ce53 100644 --- a/src/ngircd/resolve.c +++ b/src/ngircd/resolve.c @@ -23,6 +23,7 @@ #include <sys/socket.h> #include <netinet/in.h> #include <netdb.h> +#include <signal.h> #ifdef IDENTAUTH #ifdef HAVE_IDENT_H

1 0

Alexander Barton : Use correct preprocessor syntax when testing for PAM and IDENTAUTH
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 03457135b727fc39bb6601b8fb434db2680edc82 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=03457135… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 13:22:48 2010 +0200 Use correct preprocessor syntax when testing for PAM and IDENTAUTH --- src/ngircd/client.c | 2 +- src/ngircd/client.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/ngircd/client.c b/src/ngircd/client.c index 44123ea..8402499 100644 --- a/src/ngircd/client.c +++ b/src/ngircd/client.c @@ -367,7 +367,7 @@ Client_SetOrigUser(CLIENT *Client, const char *User) { assert(Client != NULL); assert(User != NULL); -#ifdef PAM & IDENTAUTH +#if defined(PAM) && defined(IDENTAUTH) strlcpy(Client->orig_user, User, sizeof(Client->orig_user)); #endif } /* Client_SetOrigUser */ diff --git a/src/ngircd/client.h b/src/ngircd/client.h index 352ddf3..bd000a5 100644 --- a/src/ngircd/client.h +++ b/src/ngircd/client.h @@ -43,7 +43,7 @@ typedef struct _CLIENT char pwd[CLIENT_PASS_LEN]; /* password received of the client */ char host[CLIENT_HOST_LEN]; /* hostname of the client */ char user[CLIENT_USER_LEN]; /* user name ("login") */ -#ifdef PAM & IDENTAUTH +#if defined(PAM) && defined(IDENTAUTH) char orig_user[CLIENT_USER_LEN];/* user name supplied by USER command */ #endif char info[CLIENT_INFO_LEN]; /* long user name (user) / info text (server) */

1 0

Alexander Barton : io.c: Include conn.h when using the select() API
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 37ee0a331394d990e514a1a7b2b52ecb879b9701 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=37ee0a33… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 13:24:45 2010 +0200 io.c: Include conn.h when using the select() API --- src/ngircd/io.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/ngircd/io.c b/src/ngircd/io.c index e811e81..cb2b55a 100644 --- a/src/ngircd/io.c +++ b/src/ngircd/io.c @@ -105,6 +105,7 @@ static bool io_event_change_devpoll(int fd, short what); #ifdef IO_USE_SELECT #include "defines.h" /* for conn.h */ #include "proc.h" /* for PROC_STAT (needed by conf.h) */ +#include "conn.h" /* for CONN_ID (needed by conf.h) */ #include "conf.h" /* for Conf_MaxConnections */ static fd_set readers;

1 0

Alexander Barton : New function Conn_GetProcStat()
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: bf8b64630443b2bd3fe2a298f860ea0d492df649 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=bf8b6463… Author: Alexander Barton <alex(a)barton.de> Date: Sun Jul 11 15:15:23 2010 +0200 New function Conn_GetProcStat() Get PROC_STAT sub-process structure of a given connection. --- src/ngircd/conn.c | 17 ++++++++++++++++- src/ngircd/conn.h | 3 ++- src/ngircd/resolve.c | 1 - 3 files changed, 18 insertions(+), 3 deletions(-) diff --git a/src/ngircd/conn.c b/src/ngircd/conn.c index 9da618f..f4efff1 100644 --- a/src/ngircd/conn.c +++ b/src/ngircd/conn.c @@ -68,7 +68,6 @@ #include "log.h" #include "ng_ipaddr.h" #include "parse.h" -#include "proc.h" #include "resolve.h" #include "tool.h" @@ -2099,6 +2098,22 @@ Conn_GetClient( CONN_ID Idx ) return c ? c->client : NULL; } +/** + * Get PROC_STAT sub-process structure of a connection. + * @param Idx Connection index number + * @return PROC_STAT structure + */ +GLOBAL PROC_STAT * +Conn_GetProcStat(CONN_ID Idx) +{ + CONNECTION *c; + + assert(Idx >= 0); + c = array_get(&My_ConnArray, sizeof (CONNECTION), (size_t)Idx); + assert(c != NULL); + return &c->proc_stat; +} /* Conn_GetProcStat */ + /** * Get CONN_ID from file descriptor associated to a subprocess structure. diff --git a/src/ngircd/conn.h b/src/ngircd/conn.h index e9b470b..a63fcbb 100644 --- a/src/ngircd/conn.h +++ b/src/ngircd/conn.h @@ -44,11 +44,11 @@ typedef long CONN_ID; #include "client.h" +#include "proc.h" #ifdef CONN_MODULE #include "defines.h" -#include "proc.h" #include "array.h" #include "tool.h" #include "ng_ipaddr.h" @@ -115,6 +115,7 @@ GLOBAL void Conn_SyncServerStruct PARAMS(( void )); GLOBAL CONN_ID Conn_GetFromProc PARAMS((int fd)); GLOBAL CLIENT* Conn_GetClient PARAMS((CONN_ID i)); +GLOBAL PROC_STAT* Conn_GetProcStat PARAMS((CONN_ID i)); #ifdef SSL_SUPPORT GLOBAL bool Conn_GetCipherInfo PARAMS((CONN_ID Idx, char *buf, size_t len)); GLOBAL bool Conn_UsesSSL PARAMS((CONN_ID Idx)); diff --git a/src/ngircd/resolve.c b/src/ngircd/resolve.c index f8c39cf..26ad103 100644 --- a/src/ngircd/resolve.c +++ b/src/ngircd/resolve.c @@ -35,7 +35,6 @@ #include "defines.h" #include "log.h" #include "ng_ipaddr.h" -#include "proc.h" #include "exp.h" #include "resolve.h"

1 0

Alexander Barton : Make Proc_Kill() more fault-tolerant
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 7b5e2fe38e7af696155e687924462c4b9fe951bc URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=7b5e2fe3… Author: Alexander Barton <alex(a)barton.de> Date: Sun Jul 11 16:54:44 2010 +0200 Make Proc_Kill() more fault-tolerant --- src/ngircd/proc.c | 7 ++++--- 1 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/ngircd/proc.c b/src/ngircd/proc.c index 75c1aaf..3eb3d80 100644 --- a/src/ngircd/proc.c +++ b/src/ngircd/proc.c @@ -93,10 +93,11 @@ GLOBAL void Proc_Kill(PROC_STAT *proc) { assert(proc != NULL); - assert(proc->pipe_fd >= 0); - io_close(proc->pipe_fd); - kill(proc->pid, SIGTERM); + if (proc->pipe_fd > 0) + io_close(proc->pipe_fd); + if (proc->pid > 0) + kill(proc->pid, SIGTERM); Proc_InitStruct(proc); }

1 0

Alexander Barton : Refactor Resolve_Read() into generic Proc_Read() function
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 79be1c477e167892b12b77dcef1d298d9d017d3c URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=79be1c47… Author: Alexander Barton <alex(a)barton.de> Date: Sun Jul 11 16:58:30 2010 +0200 Refactor Resolve_Read() into generic Proc_Read() function --- src/ngircd/conn.c | 4 ++-- src/ngircd/proc.c | 27 +++++++++++++++++++++++++++ src/ngircd/proc.h | 2 ++ src/ngircd/resolve.c | 28 ---------------------------- src/ngircd/resolve.h | 1 - 5 files changed, 31 insertions(+), 31 deletions(-) diff --git a/src/ngircd/conn.c b/src/ngircd/conn.c index f4efff1..f059d91 100644 --- a/src/ngircd/conn.c +++ b/src/ngircd/conn.c @@ -1952,7 +1952,7 @@ cb_Connect_to_Server(int fd, UNUSED short events) } /* Read result from pipe */ - len = Resolve_Read(&Conf_Server[i].res_stat, dest_addrs, sizeof(dest_addrs)); + len = Proc_Read(&Conf_Server[i].res_stat, dest_addrs, sizeof(dest_addrs)); if (len == 0) return; @@ -2005,7 +2005,7 @@ cb_Read_Resolver_Result( int r_fd, UNUSED short events ) } /* Read result from pipe */ - len = Resolve_Read(&My_Connections[i].proc_stat, readbuf, sizeof readbuf -1); + len = Proc_Read(&My_Connections[i].proc_stat, readbuf, sizeof readbuf -1); if (len == 0) return; diff --git a/src/ngircd/proc.c b/src/ngircd/proc.c index 3eb3d80..f543883 100644 --- a/src/ngircd/proc.c +++ b/src/ngircd/proc.c @@ -116,4 +116,31 @@ Proc_GenericSignalHandler(int Signal) } } +/** + * Read bytes from a pipe of a forked child process. + */ +GLOBAL size_t +Proc_Read(PROC_STAT *proc, void *buffer, size_t buflen) +{ + ssize_t bytes_read = 0; + + assert(buffer != NULL); + assert(buflen > 0); + + bytes_read = read(proc->pipe_fd, buffer, buflen); + if (bytes_read < 0) { + if (errno == EAGAIN) + return 0; + Log(LOG_CRIT, "Can't read from child process %ld: %s", + proc->pid, strerror(errno)); + bytes_read = 0; + } +#if DEBUG + else if (bytes_read == 0) + LogDebug("Can't read from child process %ld: EOF", proc->pid); +#endif + Proc_Kill(proc); + return (size_t)bytes_read; +} + /* -eof- */ diff --git a/src/ngircd/proc.h b/src/ngircd/proc.h index a7bff4f..40a2c29 100644 --- a/src/ngircd/proc.h +++ b/src/ngircd/proc.h @@ -32,6 +32,8 @@ GLOBAL void Proc_Kill PARAMS((PROC_STAT *proc)); GLOBAL void Proc_GenericSignalHandler PARAMS((int Signal)); +GLOBAL size_t Proc_Read PARAMS((PROC_STAT *proc, void *buffer, size_t buflen)); + #endif /* -eof- */ diff --git a/src/ngircd/resolve.c b/src/ngircd/resolve.c index 26ad103..d121b0a 100644 --- a/src/ngircd/resolve.c +++ b/src/ngircd/resolve.c @@ -462,32 +462,4 @@ Do_ResolveName( const char *Host, int w_fd ) } /* Do_ResolveName */ -/** - * Read result of resolver sub-process from pipe - */ -GLOBAL size_t -Resolve_Read( PROC_STAT *s, void* readbuf, size_t buflen) -{ - ssize_t bytes_read; - - assert(buflen > 0); - - /* Read result from pipe */ - bytes_read = read(Proc_GetPipeFd(s), readbuf, buflen); - if (bytes_read < 0) { - if (errno == EAGAIN) - return 0; - - Log( LOG_CRIT, "Resolver: Can't read result: %s!", strerror(errno)); - bytes_read = 0; - } -#ifdef DEBUG - else if (bytes_read == 0) - Log( LOG_DEBUG, "Resolver: Can't read result: EOF"); -#endif - Proc_Kill(s); - return (size_t)bytes_read; -} - - /* -eof- */ diff --git a/src/ngircd/resolve.h b/src/ngircd/resolve.h index 9759a2c..044ceec 100644 --- a/src/ngircd/resolve.h +++ b/src/ngircd/resolve.h @@ -18,7 +18,6 @@ GLOBAL bool Resolve_Addr PARAMS((PROC_STAT * s, const ng_ipaddr_t * Addr, int identsock, void (*cbfunc) (int, short))); GLOBAL bool Resolve_Name PARAMS((PROC_STAT * s, const char *Host, void (*cbfunc) (int, short))); -GLOBAL size_t Resolve_Read PARAMS((PROC_STAT * s, void *buf, size_t buflen)); #endif

1 0

Alexander Barton : Detect PAM libraries
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 761b2284b953de0d5c2f847e55e3fbc030243178 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=761b2284… Author: Alexander Barton <alex(a)barton.de> Date: Sun Jul 11 17:01:45 2010 +0200 Detect PAM libraries --- INSTALL | 6 ++++++ configure.in | 34 +++++++++++++++++++++++++++++++++- src/ngircd/conf.c | 8 ++++++++ src/ngircd/ngircd.c | 14 +++++--------- 4 files changed, 52 insertions(+), 10 deletions(-) diff --git a/INSTALL b/INSTALL index 60e7b5e..f84ee3f 100644 --- a/INSTALL +++ b/INSTALL @@ -184,6 +184,12 @@ standard locations. to the daemon, for example by using "/etc/hosts.{allow|deny}". The "libwrap" is required for this option. +* PAM: + --with-pam[=<path>] + + Enable support for PAM, the Pluggable Authentication Modules library. + See doc/PAM.txt for details. + IV. Useful make-targets ~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/configure.in b/configure.in index 57883ed..79ab22a 100644 --- a/configure.in +++ b/configure.in @@ -33,6 +33,7 @@ AH_TEMPLATE([IRCPLUS], [Define if IRC+ protocol should be used]) AH_TEMPLATE([WANT_IPV6], [Define if IPV6 protocol should be enabled]) AH_TEMPLATE([ZEROCONF], [Define if support for Zeroconf should be included]) AH_TEMPLATE([IDENTAUTH], [Define if the server should do IDENT requests]) +AH_TEMPLATE([PAM], [Define if PAM should be used]) AH_TEMPLATE([HAVE_sockaddr_in_len], [Define if sockaddr_in.sin_len exists]) AH_TEMPLATE([TARGET_OS], [Target operating system name]) @@ -479,6 +480,33 @@ if test "$x_identauth_on" = "yes"; then AC_CHECK_HEADERS(ident.h,,AC_MSG_ERROR([required C header missing!])) fi +# compile in PAM support? + +x_pam_on=no +AC_ARG_WITH(pam, + [ --with-pam enable user authentication using PAM], + [ if test "$withval" != "no"; then + if test "$withval" != "yes"; then + CFLAGS="-I$withval/include $CFLAGS" + CPPFLAGS="-I$withval/include $CPPFLAGS" + LDFLAGS="-L$withval/lib $LDFLAGS" + fi + AC_CHECK_LIB(pam, pam_authenticate) + AC_CHECK_FUNCS(pam_authenticate, x_pam_on=yes, + AC_MSG_ERROR([Can't enable PAM support!]) + ) + fi + ] +) +if test "$x_pam_on" = "yes"; then + AC_DEFINE(PAM, 1) + AC_CHECK_HEADERS(security/pam_appl.h,pam_ok=yes) + if test "$pam_ok" != "yes"; then + AC_CHECK_HEADERS(pam/pam_appl.h,pam_ok=yes, + AC_MSG_ERROR([required C header missing!])) + fi +fi + # compile in IRC+ protocol support? x_ircplus_on=yes @@ -657,10 +685,14 @@ echo $ECHO_N " I/O backend: $ECHO_C" echo $ECHO_N " IPv6 protocol: $ECHO_C" echo $ECHO_N "$x_ipv6_on $ECHO_C" - echo $ECHO_N " SSL support: $ECHO_C" echo "$x_ssl_lib" +echo $ECHO_N " PAM support: $ECHO_C" +test "$x_pam_on" = "yes" \ + && echo "yes" \ + || echo "no" + echo # -eof- diff --git a/src/ngircd/conf.c b/src/ngircd/conf.c index 33a607b..f78eaee 100644 --- a/src/ngircd/conf.c +++ b/src/ngircd/conf.c @@ -291,7 +291,9 @@ Conf_Test( void ) puts( "[GLOBAL]" ); printf(" Name = %s\n", Conf_ServerName); printf(" Info = %s\n", Conf_ServerInfo); +#ifndef PAM printf(" Password = %s\n", Conf_ServerPwd); +#endif printf(" WebircPassword = %s\n", Conf_WebircPwd); printf(" AdminInfo1 = %s\n", Conf_ServerAdmin1); printf(" AdminInfo2 = %s\n", Conf_ServerAdmin2); @@ -1401,6 +1403,12 @@ Validate_Config(bool Configtest, bool Rehash) "No administrative information configured but required by RFC!"); } +#ifdef PAM + if (Conf_ServerPwd[0]) + Config_Error(LOG_ERR, + "This server uses PAM, \"Password\" will be ignored!"); +#endif + #ifdef DEBUG servers = servers_once = 0; for (i = 0; i < MAX_SERVERS; i++) { diff --git a/src/ngircd/ngircd.c b/src/ngircd/ngircd.c index 0319d83..ec42b23 100644 --- a/src/ngircd/ngircd.c +++ b/src/ngircd/ngircd.c @@ -360,7 +360,6 @@ Fill_Version( void ) #ifdef ZLIB if( NGIRCd_VersionAddition[0] ) strlcat( NGIRCd_VersionAddition, "+", sizeof NGIRCd_VersionAddition ); - strlcat( NGIRCd_VersionAddition, "ZLIB", sizeof NGIRCd_VersionAddition ); #endif #ifdef SSL_SUPPORT @@ -370,49 +369,46 @@ Fill_Version( void ) #ifdef TCPWRAP if( NGIRCd_VersionAddition[0] ) strlcat( NGIRCd_VersionAddition, "+", sizeof NGIRCd_VersionAddition ); - strlcat( NGIRCd_VersionAddition, "TCPWRAP", sizeof NGIRCd_VersionAddition ); #endif #ifdef ZEROCONF if( NGIRCd_VersionAddition[0] ) strlcat( NGIRCd_VersionAddition, "+", sizeof NGIRCd_VersionAddition ); - strlcat( NGIRCd_VersionAddition, "ZEROCONF", sizeof NGIRCd_VersionAddition ); #endif #ifdef IDENTAUTH if( NGIRCd_VersionAddition[0] ) strlcat( NGIRCd_VersionAddition, "+", sizeof NGIRCd_VersionAddition ); - strlcat( NGIRCd_VersionAddition, "IDENT", sizeof NGIRCd_VersionAddition ); #endif +#ifdef PAM + if (NGIRCd_VersionAddition[0]) + strlcat(NGIRCd_VersionAddition, "+", sizeof NGIRCd_VersionAddition); + strlcat(NGIRCd_VersionAddition, "PAM", sizeof NGIRCd_VersionAddition); +#endif #ifdef DEBUG if( NGIRCd_VersionAddition[0] ) strlcat( NGIRCd_VersionAddition, "+", sizeof NGIRCd_VersionAddition ); - strlcat( NGIRCd_VersionAddition, "DEBUG", sizeof NGIRCd_VersionAddition ); #endif #ifdef SNIFFER if( NGIRCd_VersionAddition[0] ) strlcat( NGIRCd_VersionAddition, "+", sizeof NGIRCd_VersionAddition ); - strlcat( NGIRCd_VersionAddition, "SNIFFER", sizeof NGIRCd_VersionAddition ); #endif #ifdef STRICT_RFC if( NGIRCd_VersionAddition[0] ) strlcat( NGIRCd_VersionAddition, "+", sizeof NGIRCd_VersionAddition ); - strlcat( NGIRCd_VersionAddition, "RFC", sizeof NGIRCd_VersionAddition ); #endif #ifdef IRCPLUS if( NGIRCd_VersionAddition[0] ) strlcat( NGIRCd_VersionAddition, "+", sizeof NGIRCd_VersionAddition ); - strlcat( NGIRCd_VersionAddition, "IRCPLUS", sizeof NGIRCd_VersionAddition ); #endif #ifdef WANT_IPV6 if (NGIRCd_VersionAddition[0]) strlcat(NGIRCd_VersionAddition, "+", sizeof(NGIRCd_VersionAddition)); - strlcat(NGIRCd_VersionAddition, "IPv6", sizeof(NGIRCd_VersionAddition)); #endif if( NGIRCd_VersionAddition[0] )

1 0