- ngIRCd GIT Updates - lists.barton.de

Florian Westphal : SSL/TLS: proper indentation, remove erroneous comment
by fw＠arthur.barton.de 13 Mai '09

13 Mai '09

Module: ngircd.git Branch: master Commit: 57aa64e1176b47830801cec8615affcc24cfb142 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=57aa64e1… Author: Florian Westphal <fw(a)strlen.de> Date: Wed May 13 17:29:10 2009 +0200 SSL/TLS: proper indentation, remove erroneous comment --- src/ngircd/conn-ssl.c | 15 +++++++-------- 1 files changed, 7 insertions(+), 8 deletions(-) diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index 4ef8f66..46f1c9d 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -518,15 +518,14 @@ ConnSSL_HandleError( CONNECTION *c, const int code, const char *fname ) switch (code) { case GNUTLS_E_AGAIN: case GNUTLS_E_INTERRUPTED: - if (gnutls_record_get_direction(c->ssl_state.gnutls_session)) { /* need write */ - io_event_del(c->sock, IO_WANTREAD); - Conn_OPTION_ADD(c, CONN_SSL_WANT_WRITE); /* fall through */ - break; - } else { /* need read */ - io_event_del(c->sock, IO_WANTWRITE); - Conn_OPTION_ADD(c, CONN_SSL_WANT_READ); + if (gnutls_record_get_direction(c->ssl_state.gnutls_session)) { + Conn_OPTION_ADD(c, CONN_SSL_WANT_WRITE); + io_event_del(c->sock, IO_WANTREAD); + } else { + Conn_OPTION_ADD(c, CONN_SSL_WANT_READ); + io_event_del(c->sock, IO_WANTWRITE); + } break; - } default: assert(code < 0); if (gnutls_error_is_fatal(code)) {

1 0

Florian Westphal : SSL/TLS: proper indentation, remove erroneous comment
by fw＠arthur.barton.de 13 Mai '09

13 Mai '09

Module: ngircd.git Branch: master Commit: 11a037340d55e9528b93c72adac7d33b50a5e496 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=11a03734… Author: Florian Westphal <fwestphal(a)astaro.com> Date: Wed May 13 17:29:10 2009 +0200 SSL/TLS: proper indentation, remove erroneous comment --- src/ngircd/conn-ssl.c | 15 +++++++-------- 1 files changed, 7 insertions(+), 8 deletions(-) diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index 4ef8f66..46f1c9d 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -518,15 +518,14 @@ ConnSSL_HandleError( CONNECTION *c, const int code, const char *fname ) switch (code) { case GNUTLS_E_AGAIN: case GNUTLS_E_INTERRUPTED: - if (gnutls_record_get_direction(c->ssl_state.gnutls_session)) { /* need write */ - io_event_del(c->sock, IO_WANTREAD); - Conn_OPTION_ADD(c, CONN_SSL_WANT_WRITE); /* fall through */ - break; - } else { /* need read */ - io_event_del(c->sock, IO_WANTWRITE); - Conn_OPTION_ADD(c, CONN_SSL_WANT_READ); + if (gnutls_record_get_direction(c->ssl_state.gnutls_session)) { + Conn_OPTION_ADD(c, CONN_SSL_WANT_WRITE); + io_event_del(c->sock, IO_WANTREAD); + } else { + Conn_OPTION_ADD(c, CONN_SSL_WANT_READ); + io_event_del(c->sock, IO_WANTWRITE); + } break; - } default: assert(code < 0); if (gnutls_error_is_fatal(code)) {

1 0

Alexander Barton : Update copyright notice, it's 2009 already!
by alex＠arthur.barton.de 05 Mai '09

05 Mai '09

Module: ngircd.git Branch: master Commit: fd7e85b798c422f4b95de05b20ad56f59695938a URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=fd7e85b7… Author: Alexander Barton <alex(a)barton.de> Date: Tue May 5 17:08:48 2009 +0200 Update copyright notice, it's 2009 already! --- src/ngircd/ngircd.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/ngircd/ngircd.c b/src/ngircd/ngircd.c index 95c377a..5fc88c9 100644 --- a/src/ngircd/ngircd.c +++ b/src/ngircd/ngircd.c @@ -1,6 +1,6 @@ /* * ngIRCd -- The Next Generation IRC Daemon - * Copyright (c)2001-2008 Alexander Barton (alex(a)barton.de) + * Copyright (c)2001-2009 Alexander Barton (alex(a)barton.de) * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -562,7 +562,7 @@ static void Show_Version( void ) { puts( NGIRCd_Version ); - puts( "Copyright (c)2001-2008 Alexander Barton (<alex(a)barton.de>) and Contributors." ); + puts( "Copyright (c)2001-2009 Alexander Barton (<alex(a)barton.de>) and Contributors." ); puts( "Homepage: <http://ngircd.barton.de/>\n" ); puts( "This is free software; see the source for copying conditions. There is NO" ); puts( "warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." );

1 0

Alexander Barton : Updated Debian "changelog" file for ngIRCd 14.1
by alex＠arthur.barton.de 05 Mai '09

05 Mai '09

Module: ngircd.git Branch: refs/tags/rel-14-1 Commit: b1852f30296501a7e0858260bd0c7533d041d627 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=b1852f30… Author: Alexander Barton <alex(a)barton.de> Date: Tue May 5 13:14:23 2009 +0200 Updated Debian "changelog" file for ngIRCd 14.1 --- contrib/Debian/changelog | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/contrib/Debian/changelog b/contrib/Debian/changelog index f41f1d8..abfad7f 100644 --- a/contrib/Debian/changelog +++ b/contrib/Debian/changelog @@ -1,3 +1,9 @@ +ngircd (14.1-0ab1) unstable; urgency=high + + * New "upstream" release ngIRCd 14.1, fixing a security-related bug. + + -- Alexander Barton <alex(a)barton.de> Tue, 5 May 2009 13:13:38 +0200 + ngircd (14-0ab3) unstable; urgency=low * Fixed "Conflicts:" line in debian/control: missing comma.

1 0

Alexander Barton : Updated Debian "changelog" file for ngIRCd 14.1
by alex＠arthur.barton.de 05 Mai '09

05 Mai '09

Module: ngircd.git Branch: master Commit: b1852f30296501a7e0858260bd0c7533d041d627 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=b1852f30… Author: Alexander Barton <alex(a)barton.de> Date: Tue May 5 13:14:23 2009 +0200 Updated Debian "changelog" file for ngIRCd 14.1 --- contrib/Debian/changelog | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/contrib/Debian/changelog b/contrib/Debian/changelog index f41f1d8..abfad7f 100644 --- a/contrib/Debian/changelog +++ b/contrib/Debian/changelog @@ -1,3 +1,9 @@ +ngircd (14.1-0ab1) unstable; urgency=high + + * New "upstream" release ngIRCd 14.1, fixing a security-related bug. + + -- Alexander Barton <alex(a)barton.de> Tue, 5 May 2009 13:13:38 +0200 + ngircd (14-0ab3) unstable; urgency=low * Fixed "Conflicts:" line in debian/control: missing comma.

1 0

Tag rel-14-1: Alexander Barton : ngIRCd release 14.1
by alex＠arthur.barton.de 05 Mai '09

05 Mai '09

Module: ngircd.git Branch: refs/tags/rel-14-1 Tag: 6411a2197218db4a6d9e619ee51ebbc3cd67fa3f URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=tag;h=6411a219721… Tagger: Alexander Barton <alex(a)barton.de> Date: Tue May 5 13:04:17 2009 +0200 ngIRCd release 14.1

1 0

Alexander Barton : ngIRCd release 14.1
by alex＠arthur.barton.de 05 Mai '09

05 Mai '09

Module: ngircd.git Branch: master Commit: 822c1e9265cfe31de6688924528dd7dc788872b5 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=822c1e92… Author: Alexander Barton <alex(a)barton.de> Date: Tue May 5 12:58:51 2009 +0200 ngIRCd release 14.1 --- ChangeLog | 13 +++++++++++++ NEWS | 6 ++++++ configure.in | 2 +- contrib/ngircd.spec | 2 +- 4 files changed, 21 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index c5bc401..adba5f6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,6 +10,19 @@ -- ChangeLog -- +ngIRCd Release 14.1 (2009-05-05) + + - Security: fix remotely triggerable crash in SSL/TLS code. + - BSD start script contrib/ngircd.sh has been renamed to ngircd-bsd.sh. + - New start/stop script for RedHat-based distributions: + contrib/ngircd-redhat.init, thanks to Naoya Nakazawa <naoya(a)sanow.net>. + - Doxygen: update source code repository link to GIT. + - Debian: build ngircd-full-dbg package. + - Allow ping timeout quit messages to show the timeout value. + - Fix error handling on compressed links. + - Fix server list announcement. + - Do not remove hostnames from info text. + ngIRCd Release 14 (2009-04-20) - Display IPv6 addresses as "[<addr>]" when accepting connections. diff --git a/NEWS b/NEWS index e92a57c..25494c2 100644 --- a/NEWS +++ b/NEWS @@ -10,6 +10,12 @@ -- NEWS -- +ngIRCd Release 14.1 (2009-05-05) + + - Security: fix remotely triggerable crash in SSL/TLS code. + - Debian: build ngircd-full-dbg package. + - Allow ping timeout quit messages to show the timeout value. + ngIRCd Release 14 (2009-04-20) ngIRCd 14~rc1 (2009-03-29) diff --git a/configure.in b/configure.in index 221875d..6738dd6 100644 --- a/configure.in +++ b/configure.in @@ -12,7 +12,7 @@ # -- Initialisation -- AC_PREREQ(2.50) -AC_INIT(ngircd, 14) +AC_INIT(ngircd, 14.1) AC_CONFIG_SRCDIR(src/ngircd/ngircd.c) AC_CANONICAL_TARGET AM_INIT_AUTOMAKE(1.6) diff --git a/contrib/ngircd.spec b/contrib/ngircd.spec index dcd2650..1e72f30 100644 --- a/contrib/ngircd.spec +++ b/contrib/ngircd.spec @@ -1,5 +1,5 @@ %define name ngircd -%define version 14 +%define version 14.1 %define release 1 %define prefix %{_prefix}

1 0

Alexander Barton : Added start/stop script for Red Hat based distributions
by alex＠arthur.barton.de 05 Mai '09

05 Mai '09

Module: ngircd.git Branch: master Commit: 5b4a3eda08029b01fb00c3968cac4df5848e06a7 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=5b4a3eda… Author: Alexander Barton <alex(a)barton.de> Date: Tue May 5 12:50:55 2009 +0200 Added start/stop script for Red Hat based distributions Script contributed by Naoya Nakazawa <naoya(a)sanow.net>. --- contrib/Makefile.am | 3 +- contrib/README | 3 + contrib/ngircd-redhat.init | 119 ++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 124 insertions(+), 1 deletions(-) diff --git a/contrib/Makefile.am b/contrib/Makefile.am index edc0f57..ab6b342 100644 --- a/contrib/Makefile.am +++ b/contrib/Makefile.am @@ -11,7 +11,8 @@ SUBDIRS = Debian MacOSX -EXTRA_DIST = README ngircd.spec systrace.policy ngindent ngircd-bsd.sh +EXTRA_DIST = README ngircd.spec systrace.policy ngindent ngircd-bsd.sh \ + ngircd-redhat.init maintainer-clean-local: rm -f Makefile Makefile.in diff --git a/contrib/README b/contrib/README index c9d8265..353e2bb 100644 --- a/contrib/README +++ b/contrib/README @@ -22,6 +22,9 @@ ngindent ngircd-bsd.sh - Start script for FreeBSD. +ngircd-redhat.init + - Start/stop script for RedHat-based distributions (like CentOS). + ngircd.spec - RPM "spec" file. diff --git a/contrib/ngircd-redhat.init b/contrib/ngircd-redhat.init new file mode 100644 index 0000000..f63eba7 --- /dev/null +++ b/contrib/ngircd-redhat.init @@ -0,0 +1,119 @@ +#!/bin/sh +# +# ngIRCd start and stop script for RedHat based distributions. +# Written by Naoya Nakazawa <naoya(a)sanow.net> for CentOS 5.2, 2009. +# +# chkconfig: 2345 01 +# description: ngIRCd is an Open Source server for \ +# the Internet Relay Chat (IRC), which \ +# is developed and published under \ +# the terms of the GNU General Public +# Licence (URL: http://www.gnu.org/licenses/gpl.html) \ +# ngIRCd means "next generation IRC daemon", \ +# it's written from scratch and not deduced from the \ +# "grandfather of IRC daemons", the daemon of the IRCNet. +# +# processname: /usr/sbin/ngircd +# config: /etc/ngircd +# pidfile: /var/run/ngircd.pid + +PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin +DAEMON=/usr/sbin/ngircd +NAME=ngIRCd +BASENAME=ngircd +CONF=/etc/$BASENAME.conf +DESC="IRC daemon" +PARAMS="-f $CONF" + +# Source function library. +. /etc/init.d/functions + +# Get config. +test -f /etc/sysconfig/network && . /etc/sysconfig/network +test -f /etc/sysconfig/makuosan && . /etc/sysconfig/makuosan + +# Check that networking is up. +[ "${NETWORKING}" = "yes" ] || exit 0 + +[ -x $DAEMON ] || exit 1 +[ -f $CONF ] || exit 2 + +RETVAL=0 + +start(){ + echo -n $"Starting $NAME: " + daemon $DAEMON $PARAMS + RETVAL=$? + [ $RETVAL -eq 0 ] && touch /var/lock/subsys/$BASENAME + echo + return $RETVAL +} + +stop(){ + echo -n $"Stopping $NAME: " + killproc $DAEMON + RETVAL=$? + if [ $RETVAL -eq 0 ] ; then + rm -f /var/lock/subsys/$BASENAME + fi + echo + return $RETVAL +} + +reload(){ + echo -n $"Reloading configuration: " + killproc $DAEMON -HUP + RETVAL=$? + echo + return $RETVAL +} + +restart(){ + stop + start +} + +condrestart(){ + [ -e /var/lock/subsys/$BASENAME ] && restart + return 0 +} + +check_config(){ + $DAEMON $PARAMS --configtest >/dev/null 2>&1 + [ $? -eq 0 ] && return 0 + + echo -n $"Configuration of $NAME is not valid, won't (re)start!" + echo -n $"Run \"$DAEMON --configtest\" and fix it up ..." + exit 6 +} + +# See how we were called. +case "$1" in + start) + check_config + start + ;; + stop) + stop + ;; + status) + status $NAME + ;; + restart) + restart + ;; + reload) + reload + ;; + condrestart) + condrestart + ;; + test) + check_config + ;; + *) + echo $"Usage: $0 {start|stop|status|restart|condrestart|reload|test}" + RETVAL=1 +esac + +exit $RETVAL

1 0

Alexander Barton : Renamed contrib/ngircd.sh to contrib/ngircd-bsd.sh
by alex＠arthur.barton.de 05 Mai '09

05 Mai '09

Module: ngircd.git Branch: master Commit: a83554b572255add47d0694d9e85a301a3a0e6b8 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=a83554b5… Author: Alexander Barton <alex(a)barton.de> Date: Tue May 5 11:41:26 2009 +0200 Renamed contrib/ngircd.sh to contrib/ngircd-bsd.sh --- contrib/Makefile.am | 4 ++-- contrib/README | 8 ++------ contrib/{ngircd.sh => ngircd-bsd.sh} | 0 3 files changed, 4 insertions(+), 8 deletions(-) diff --git a/contrib/Makefile.am b/contrib/Makefile.am index 2125c10..edc0f57 100644 --- a/contrib/Makefile.am +++ b/contrib/Makefile.am @@ -1,6 +1,6 @@ # # ngIRCd -- The Next Generation IRC Daemon -# Copyright (c)2001-2008 Alexander Barton (alex(a)barton.de) +# Copyright (c)2001-2009 Alexander Barton (alex(a)barton.de) # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by @@ -11,7 +11,7 @@ SUBDIRS = Debian MacOSX -EXTRA_DIST = README ngircd.spec systrace.policy ngindent ngircd.sh +EXTRA_DIST = README ngircd.spec systrace.policy ngindent ngircd-bsd.sh maintainer-clean-local: rm -f Makefile Makefile.in diff --git a/contrib/README b/contrib/README index f32005e..c9d8265 100644 --- a/contrib/README +++ b/contrib/README @@ -1,7 +1,7 @@ ngIRCd - Next Generation IRC Server - (c)2001-2005 Alexander Barton, + (c)2001-2009 Alexander Barton, alex(a)barton.de, http://www.barton.de/ ngIRCd is free software and published under the @@ -19,7 +19,7 @@ MacOSX/ ngindent - Script to indent the code of ngIRCd in the "standard way". -ngircd.sh +ngircd-bsd.sh - Start script for FreeBSD. ngircd.spec @@ -27,7 +27,3 @@ ngircd.spec systrace.policy - Systrace policy file for OpenBSD (and probably NetBSD). - - --- -$Id: README,v 1.3 2006/07/23 11:34:32 alex Exp $ diff --git a/contrib/ngircd.sh b/contrib/ngircd-bsd.sh similarity index 100% rename from contrib/ngircd.sh rename to contrib/ngircd-bsd.sh

1 0

Florian Westphal : security: fix remotely triggerable crash in SSL/TLS code
by alex＠arthur.barton.de 05 Mai '09

05 Mai '09

Module: ngircd.git Branch: master Commit: 627b0b713c52406e50c84bb9459e7794262920a2 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=627b0b71… Author: Florian Westphal <fw(a)strlen.de> Date: Mon May 4 23:51:24 2009 +0200 security: fix remotely triggerable crash in SSL/TLS code When a server is running with SSL/TLS support compiled in, it is trivial to crash the server by sending an MOTD request via another server in the network. - ONLY servers without ssl/tls support compiled in are not affected. Disabling SSL in the configuration (no ssl listening ports, etc) does NOT help. - servers that are running standalone (i.e., not connected to any other servers) are not affected, either. This affects all ngircd releases since ngircd 13 (earlier versions have no SSL/TLS support). --- src/ngircd/conn.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/src/ngircd/conn.c b/src/ngircd/conn.c index 9752a61..c6095a3 100644 --- a/src/ngircd/conn.c +++ b/src/ngircd/conn.c @@ -1951,6 +1951,9 @@ Conn_GetClient( CONN_ID Idx ) GLOBAL bool Conn_GetCipherInfo(CONN_ID Idx, char *buf, size_t len) { + if (Idx < 0) + return false; + assert(Idx < (int) array_length(&My_ConnArray, sizeof(CONNECTION))); return ConnSSL_GetCipherInfo(&My_Connections[Idx], buf, len); } @@ -1958,6 +1961,9 @@ Conn_GetCipherInfo(CONN_ID Idx, char *buf, size_t len) GLOBAL bool Conn_UsesSSL(CONN_ID Idx) { + if (Idx < 0) + return false; + assert(Idx < (int) array_length(&My_ConnArray, sizeof(CONNECTION))); return Conn_OPTION_ISSET(&My_Connections[Idx], CONN_SSL); } #endif

1 0