- ngIRCd GIT Updates - lists.barton.de

Florian Westphal : manpage: move SSLConnect option to the right section
by fw＠arthur.barton.de 17 Mai '09

17 Mai '09

Module: ngircd.git Branch: master Commit: b0931f322b527f24215419e9c73eda7d7f22de6a URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=b0931f32… Author: Florian Westphal <fw(a)strlen.de> Date: Sun May 17 01:22:18 2009 +0200 manpage: move SSLConnect option to the right section --- man/ngircd.conf.5.tmpl | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/man/ngircd.conf.5.tmpl b/man/ngircd.conf.5.tmpl index df15b77..8e5b254 100644 --- a/man/ngircd.conf.5.tmpl +++ b/man/ngircd.conf.5.tmpl @@ -221,9 +221,6 @@ Default: 10. Maximum length of an user nick name (Default: 9, as in RFC 2812). Please note that all servers in an IRC network MUST use the same maximum nick name length! -.TP -\fBSSLConnect\fR -Connect to the remote server using TLS/SSL. Default: false. .SH [OPERATOR] .I [Operator] sections are used to define IRC Operators. There may be more than one @@ -287,6 +284,9 @@ Group of this server (optional). Disable automatic connection even if port value is specified. Default: false. You can use the IRC Operator command CONNECT later on to create the link. .TP +\fBSSLConnect\fR +Connect to the remote server using TLS/SSL. Default: false. +.TP \fBServiceMask\fR Define a (case insensitive) mask matching nick names that should be treated as IRC services when introduced via this remote server. REGULAR SERVERS DON'T NEED

1 0

Florian Westphal : SSL/TLS: remove redundant asserts/ifdefs
by fw＠arthur.barton.de 16 Mai '09

16 Mai '09

Module: ngircd.git Branch: master Commit: 5196e9bcb17111c43a71df2d11634b0705600b9f URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=5196e9bc… Author: Florian Westphal <fw(a)strlen.de> Date: Fri May 15 23:28:59 2009 +0200 SSL/TLS: remove redundant asserts/ifdefs --- src/ngircd/conn-ssl.c | 29 ++++++----------------------- 1 files changed, 6 insertions(+), 23 deletions(-) diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index 46f1c9d..fbf796c 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -383,7 +383,6 @@ ConnSSL_Init_SSL(CONNECTION *c) int ret; assert(c != NULL); #ifdef HAVE_LIBSSL - assert(ssl_ctx); if (!ssl_ctx) /* NULL when library initialization failed */ return false; @@ -433,10 +432,7 @@ ConnSSL_PrepareConnect(CONNECTION *c, UNUSED CONF_SERVER *s) bool ret; #ifdef HAVE_LIBGNUTLS int err; -#endif - assert(c != NULL); - assert(s != NULL); -#ifdef HAVE_LIBGNUTLS + err = gnutls_init(&c->ssl_state.gnutls_session, GNUTLS_CLIENT); if (err) { Log(LOG_ERR, "gnutls_init: %s", gnutls_strerror(err)); @@ -471,8 +467,6 @@ ConnSSL_HandleError( CONNECTION *c, const int code, const char *fname ) unsigned long sslerr; int real_errno = errno; - assert( fname ); - ret = SSL_get_error(c->ssl_state.ssl, code); switch (ret) { case SSL_ERROR_WANT_READ: @@ -545,8 +539,7 @@ ConnSSL_LogCertInfo( CONNECTION *c ) #ifdef HAVE_LIBSSL SSL *ssl = c->ssl_state.ssl; - assert( c ); - assert( ssl ); + assert(ssl); Log(LOG_INFO, "New %s connection using cipher %s on socket %d.", SSL_get_version(ssl), SSL_get_cipher(ssl), c->sock); @@ -574,11 +567,8 @@ int ConnSSL_Accept( CONNECTION *c ) { assert(c != NULL); -#ifdef HAVE_LIBSSL - if (!c->ssl_state.ssl) { -#endif -#ifdef HAVE_LIBGNUTLS if (!Conn_OPTION_ISSET(c, CONN_SSL)) { +#ifdef HAVE_LIBGNUTLS int err = gnutls_init(&c->ssl_state.gnutls_session, GNUTLS_SERVER); if (err) { Log(LOG_ERR, "gnutls_init: %s", gnutls_strerror(err)); @@ -600,9 +590,7 @@ ConnSSL_Connect( CONNECTION *c ) #ifdef HAVE_LIBSSL assert(c->ssl_state.ssl); #endif -#ifdef HAVE_LIBGNUTLS assert(Conn_OPTION_ISSET(c, CONN_SSL)); -#endif return ConnectAccept(c, true); } @@ -622,7 +610,6 @@ ConnectAccept( CONNECTION *c, bool connect) #endif #ifdef HAVE_LIBGNUTLS (void) connect; - assert(Conn_OPTION_ISSET(c, CONN_SSL)); ret = gnutls_handshake(c->ssl_state.gnutls_session); if (ret) return ConnSSL_HandleError(c, ret, "gnutls_handshake"); @@ -647,7 +634,8 @@ ConnSSL_Write(CONNECTION *c, const void *buf, size_t count) #ifdef HAVE_LIBGNUTLS bw = gnutls_write(c->ssl_state.gnutls_session, buf, count); #endif - if ( bw > 0 ) return bw; + if (bw > 0) + return bw; if (ConnSSL_HandleError( c, bw, "ConnSSL_Write") == 0) errno = EAGAIN; /* try again */ return -1; @@ -684,11 +672,8 @@ ConnSSL_GetCipherInfo(CONNECTION *c, char *buf, size_t len) { #ifdef HAVE_LIBSSL char *nl; + SSL *ssl = c->ssl_state.ssl; - SSL *ssl; - assert(c != NULL); - assert(len >= 128); - ssl = c->ssl_state.ssl; if (!ssl) return false; *buf = 0; @@ -699,8 +684,6 @@ ConnSSL_GetCipherInfo(CONNECTION *c, char *buf, size_t len) return true; #endif #ifdef HAVE_LIBGNUTLS - assert(c != NULL); - assert(len >= 128); if (Conn_OPTION_ISSET(c, CONN_SSL)) { const char *name_cipher, *name_mac, *name_proto, *name_keyexchange; unsigned keysize;

1 0

Florian Westphal : SSL/TLS: proper indentation, remove erroneous comment
by fw＠arthur.barton.de 13 Mai '09

13 Mai '09

Module: ngircd.git Branch: master Commit: 57aa64e1176b47830801cec8615affcc24cfb142 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=57aa64e1… Author: Florian Westphal <fw(a)strlen.de> Date: Wed May 13 17:29:10 2009 +0200 SSL/TLS: proper indentation, remove erroneous comment --- src/ngircd/conn-ssl.c | 15 +++++++-------- 1 files changed, 7 insertions(+), 8 deletions(-) diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index 4ef8f66..46f1c9d 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -518,15 +518,14 @@ ConnSSL_HandleError( CONNECTION *c, const int code, const char *fname ) switch (code) { case GNUTLS_E_AGAIN: case GNUTLS_E_INTERRUPTED: - if (gnutls_record_get_direction(c->ssl_state.gnutls_session)) { /* need write */ - io_event_del(c->sock, IO_WANTREAD); - Conn_OPTION_ADD(c, CONN_SSL_WANT_WRITE); /* fall through */ - break; - } else { /* need read */ - io_event_del(c->sock, IO_WANTWRITE); - Conn_OPTION_ADD(c, CONN_SSL_WANT_READ); + if (gnutls_record_get_direction(c->ssl_state.gnutls_session)) { + Conn_OPTION_ADD(c, CONN_SSL_WANT_WRITE); + io_event_del(c->sock, IO_WANTREAD); + } else { + Conn_OPTION_ADD(c, CONN_SSL_WANT_READ); + io_event_del(c->sock, IO_WANTWRITE); + } break; - } default: assert(code < 0); if (gnutls_error_is_fatal(code)) {

1 0

Florian Westphal : SSL/TLS: proper indentation, remove erroneous comment
by fw＠arthur.barton.de 13 Mai '09

13 Mai '09

Module: ngircd.git Branch: master Commit: 11a037340d55e9528b93c72adac7d33b50a5e496 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=11a03734… Author: Florian Westphal <fwestphal(a)astaro.com> Date: Wed May 13 17:29:10 2009 +0200 SSL/TLS: proper indentation, remove erroneous comment --- src/ngircd/conn-ssl.c | 15 +++++++-------- 1 files changed, 7 insertions(+), 8 deletions(-) diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index 4ef8f66..46f1c9d 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -518,15 +518,14 @@ ConnSSL_HandleError( CONNECTION *c, const int code, const char *fname ) switch (code) { case GNUTLS_E_AGAIN: case GNUTLS_E_INTERRUPTED: - if (gnutls_record_get_direction(c->ssl_state.gnutls_session)) { /* need write */ - io_event_del(c->sock, IO_WANTREAD); - Conn_OPTION_ADD(c, CONN_SSL_WANT_WRITE); /* fall through */ - break; - } else { /* need read */ - io_event_del(c->sock, IO_WANTWRITE); - Conn_OPTION_ADD(c, CONN_SSL_WANT_READ); + if (gnutls_record_get_direction(c->ssl_state.gnutls_session)) { + Conn_OPTION_ADD(c, CONN_SSL_WANT_WRITE); + io_event_del(c->sock, IO_WANTREAD); + } else { + Conn_OPTION_ADD(c, CONN_SSL_WANT_READ); + io_event_del(c->sock, IO_WANTWRITE); + } break; - } default: assert(code < 0); if (gnutls_error_is_fatal(code)) {

1 0

Alexander Barton : Update copyright notice, it's 2009 already!
by alex＠arthur.barton.de 05 Mai '09

05 Mai '09

Module: ngircd.git Branch: master Commit: fd7e85b798c422f4b95de05b20ad56f59695938a URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=fd7e85b7… Author: Alexander Barton <alex(a)barton.de> Date: Tue May 5 17:08:48 2009 +0200 Update copyright notice, it's 2009 already! --- src/ngircd/ngircd.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/ngircd/ngircd.c b/src/ngircd/ngircd.c index 95c377a..5fc88c9 100644 --- a/src/ngircd/ngircd.c +++ b/src/ngircd/ngircd.c @@ -1,6 +1,6 @@ /* * ngIRCd -- The Next Generation IRC Daemon - * Copyright (c)2001-2008 Alexander Barton (alex(a)barton.de) + * Copyright (c)2001-2009 Alexander Barton (alex(a)barton.de) * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -562,7 +562,7 @@ static void Show_Version( void ) { puts( NGIRCd_Version ); - puts( "Copyright (c)2001-2008 Alexander Barton (<alex(a)barton.de>) and Contributors." ); + puts( "Copyright (c)2001-2009 Alexander Barton (<alex(a)barton.de>) and Contributors." ); puts( "Homepage: <http://ngircd.barton.de/>\n" ); puts( "This is free software; see the source for copying conditions. There is NO" ); puts( "warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." );

1 0

Alexander Barton : Updated Debian "changelog" file for ngIRCd 14.1
by alex＠arthur.barton.de 05 Mai '09

05 Mai '09

Module: ngircd.git Branch: refs/tags/rel-14-1 Commit: b1852f30296501a7e0858260bd0c7533d041d627 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=b1852f30… Author: Alexander Barton <alex(a)barton.de> Date: Tue May 5 13:14:23 2009 +0200 Updated Debian "changelog" file for ngIRCd 14.1 --- contrib/Debian/changelog | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/contrib/Debian/changelog b/contrib/Debian/changelog index f41f1d8..abfad7f 100644 --- a/contrib/Debian/changelog +++ b/contrib/Debian/changelog @@ -1,3 +1,9 @@ +ngircd (14.1-0ab1) unstable; urgency=high + + * New "upstream" release ngIRCd 14.1, fixing a security-related bug. + + -- Alexander Barton <alex(a)barton.de> Tue, 5 May 2009 13:13:38 +0200 + ngircd (14-0ab3) unstable; urgency=low * Fixed "Conflicts:" line in debian/control: missing comma.

1 0

Alexander Barton : Updated Debian "changelog" file for ngIRCd 14.1
by alex＠arthur.barton.de 05 Mai '09

05 Mai '09

Module: ngircd.git Branch: master Commit: b1852f30296501a7e0858260bd0c7533d041d627 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=b1852f30… Author: Alexander Barton <alex(a)barton.de> Date: Tue May 5 13:14:23 2009 +0200 Updated Debian "changelog" file for ngIRCd 14.1 --- contrib/Debian/changelog | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/contrib/Debian/changelog b/contrib/Debian/changelog index f41f1d8..abfad7f 100644 --- a/contrib/Debian/changelog +++ b/contrib/Debian/changelog @@ -1,3 +1,9 @@ +ngircd (14.1-0ab1) unstable; urgency=high + + * New "upstream" release ngIRCd 14.1, fixing a security-related bug. + + -- Alexander Barton <alex(a)barton.de> Tue, 5 May 2009 13:13:38 +0200 + ngircd (14-0ab3) unstable; urgency=low * Fixed "Conflicts:" line in debian/control: missing comma.

1 0

Tag rel-14-1: Alexander Barton : ngIRCd release 14.1
by alex＠arthur.barton.de 05 Mai '09

05 Mai '09

Module: ngircd.git Branch: refs/tags/rel-14-1 Tag: 6411a2197218db4a6d9e619ee51ebbc3cd67fa3f URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=tag;h=6411a219721… Tagger: Alexander Barton <alex(a)barton.de> Date: Tue May 5 13:04:17 2009 +0200 ngIRCd release 14.1

1 0

Alexander Barton : ngIRCd release 14.1
by alex＠arthur.barton.de 05 Mai '09

05 Mai '09

Module: ngircd.git Branch: master Commit: 822c1e9265cfe31de6688924528dd7dc788872b5 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=822c1e92… Author: Alexander Barton <alex(a)barton.de> Date: Tue May 5 12:58:51 2009 +0200 ngIRCd release 14.1 --- ChangeLog | 13 +++++++++++++ NEWS | 6 ++++++ configure.in | 2 +- contrib/ngircd.spec | 2 +- 4 files changed, 21 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index c5bc401..adba5f6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,6 +10,19 @@ -- ChangeLog -- +ngIRCd Release 14.1 (2009-05-05) + + - Security: fix remotely triggerable crash in SSL/TLS code. + - BSD start script contrib/ngircd.sh has been renamed to ngircd-bsd.sh. + - New start/stop script for RedHat-based distributions: + contrib/ngircd-redhat.init, thanks to Naoya Nakazawa <naoya(a)sanow.net>. + - Doxygen: update source code repository link to GIT. + - Debian: build ngircd-full-dbg package. + - Allow ping timeout quit messages to show the timeout value. + - Fix error handling on compressed links. + - Fix server list announcement. + - Do not remove hostnames from info text. + ngIRCd Release 14 (2009-04-20) - Display IPv6 addresses as "[<addr>]" when accepting connections. diff --git a/NEWS b/NEWS index e92a57c..25494c2 100644 --- a/NEWS +++ b/NEWS @@ -10,6 +10,12 @@ -- NEWS -- +ngIRCd Release 14.1 (2009-05-05) + + - Security: fix remotely triggerable crash in SSL/TLS code. + - Debian: build ngircd-full-dbg package. + - Allow ping timeout quit messages to show the timeout value. + ngIRCd Release 14 (2009-04-20) ngIRCd 14~rc1 (2009-03-29) diff --git a/configure.in b/configure.in index 221875d..6738dd6 100644 --- a/configure.in +++ b/configure.in @@ -12,7 +12,7 @@ # -- Initialisation -- AC_PREREQ(2.50) -AC_INIT(ngircd, 14) +AC_INIT(ngircd, 14.1) AC_CONFIG_SRCDIR(src/ngircd/ngircd.c) AC_CANONICAL_TARGET AM_INIT_AUTOMAKE(1.6) diff --git a/contrib/ngircd.spec b/contrib/ngircd.spec index dcd2650..1e72f30 100644 --- a/contrib/ngircd.spec +++ b/contrib/ngircd.spec @@ -1,5 +1,5 @@ %define name ngircd -%define version 14 +%define version 14.1 %define release 1 %define prefix %{_prefix}

1 0

Alexander Barton : Added start/stop script for Red Hat based distributions
by alex＠arthur.barton.de 05 Mai '09

05 Mai '09

Module: ngircd.git Branch: master Commit: 5b4a3eda08029b01fb00c3968cac4df5848e06a7 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=5b4a3eda… Author: Alexander Barton <alex(a)barton.de> Date: Tue May 5 12:50:55 2009 +0200 Added start/stop script for Red Hat based distributions Script contributed by Naoya Nakazawa <naoya(a)sanow.net>. --- contrib/Makefile.am | 3 +- contrib/README | 3 + contrib/ngircd-redhat.init | 119 ++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 124 insertions(+), 1 deletions(-) diff --git a/contrib/Makefile.am b/contrib/Makefile.am index edc0f57..ab6b342 100644 --- a/contrib/Makefile.am +++ b/contrib/Makefile.am @@ -11,7 +11,8 @@ SUBDIRS = Debian MacOSX -EXTRA_DIST = README ngircd.spec systrace.policy ngindent ngircd-bsd.sh +EXTRA_DIST = README ngircd.spec systrace.policy ngindent ngircd-bsd.sh \ + ngircd-redhat.init maintainer-clean-local: rm -f Makefile Makefile.in diff --git a/contrib/README b/contrib/README index c9d8265..353e2bb 100644 --- a/contrib/README +++ b/contrib/README @@ -22,6 +22,9 @@ ngindent ngircd-bsd.sh - Start script for FreeBSD. +ngircd-redhat.init + - Start/stop script for RedHat-based distributions (like CentOS). + ngircd.spec - RPM "spec" file. diff --git a/contrib/ngircd-redhat.init b/contrib/ngircd-redhat.init new file mode 100644 index 0000000..f63eba7 --- /dev/null +++ b/contrib/ngircd-redhat.init @@ -0,0 +1,119 @@ +#!/bin/sh +# +# ngIRCd start and stop script for RedHat based distributions. +# Written by Naoya Nakazawa <naoya(a)sanow.net> for CentOS 5.2, 2009. +# +# chkconfig: 2345 01 +# description: ngIRCd is an Open Source server for \ +# the Internet Relay Chat (IRC), which \ +# is developed and published under \ +# the terms of the GNU General Public +# Licence (URL: http://www.gnu.org/licenses/gpl.html) \ +# ngIRCd means "next generation IRC daemon", \ +# it's written from scratch and not deduced from the \ +# "grandfather of IRC daemons", the daemon of the IRCNet. +# +# processname: /usr/sbin/ngircd +# config: /etc/ngircd +# pidfile: /var/run/ngircd.pid + +PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin +DAEMON=/usr/sbin/ngircd +NAME=ngIRCd +BASENAME=ngircd +CONF=/etc/$BASENAME.conf +DESC="IRC daemon" +PARAMS="-f $CONF" + +# Source function library. +. /etc/init.d/functions + +# Get config. +test -f /etc/sysconfig/network && . /etc/sysconfig/network +test -f /etc/sysconfig/makuosan && . /etc/sysconfig/makuosan + +# Check that networking is up. +[ "${NETWORKING}" = "yes" ] || exit 0 + +[ -x $DAEMON ] || exit 1 +[ -f $CONF ] || exit 2 + +RETVAL=0 + +start(){ + echo -n $"Starting $NAME: " + daemon $DAEMON $PARAMS + RETVAL=$? + [ $RETVAL -eq 0 ] && touch /var/lock/subsys/$BASENAME + echo + return $RETVAL +} + +stop(){ + echo -n $"Stopping $NAME: " + killproc $DAEMON + RETVAL=$? + if [ $RETVAL -eq 0 ] ; then + rm -f /var/lock/subsys/$BASENAME + fi + echo + return $RETVAL +} + +reload(){ + echo -n $"Reloading configuration: " + killproc $DAEMON -HUP + RETVAL=$? + echo + return $RETVAL +} + +restart(){ + stop + start +} + +condrestart(){ + [ -e /var/lock/subsys/$BASENAME ] && restart + return 0 +} + +check_config(){ + $DAEMON $PARAMS --configtest >/dev/null 2>&1 + [ $? -eq 0 ] && return 0 + + echo -n $"Configuration of $NAME is not valid, won't (re)start!" + echo -n $"Run \"$DAEMON --configtest\" and fix it up ..." + exit 6 +} + +# See how we were called. +case "$1" in + start) + check_config + start + ;; + stop) + stop + ;; + status) + status $NAME + ;; + restart) + restart + ;; + reload) + reload + ;; + condrestart) + condrestart + ;; + test) + check_config + ;; + *) + echo $"Usage: $0 {start|stop|status|restart|condrestart|reload|test}" + RETVAL=1 +esac + +exit $RETVAL

1 0