- ngIRCd GIT Updates - lists.barton.de

Alexander Barton : Fix syntax of ERR_LISTFULL_MSG(478) numeric
by alex＠arthur.barton.de 27 Dez '14

27 Dez '14

Module: ngircd.git Branch: master Commit: bd8d4e710c0cb597ef10f23691602256d44895ea URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=bd8d4e71… Author: Alexander Barton <alex(a)barton.de> Date: Sat Dec 27 01:39:07 2014 +0100 Fix syntax of ERR_LISTFULL_MSG(478) numeric Pointed out by "wowaname" in #ngircd, thanks! --- src/ngircd/messages.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/ngircd/messages.h b/src/ngircd/messages.h index a56bf86..0115a06 100644 --- a/src/ngircd/messages.h +++ b/src/ngircd/messages.h @@ -1,6 +1,6 @@ /* * ngIRCd -- The Next Generation IRC Daemon - * Copyright (c)2001-2013 Alexander Barton (alex(a)barton.de) and Contributors. + * Copyright (c)2001-2014 Alexander Barton (alex(a)barton.de) and Contributors. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -141,7 +141,7 @@ #define ERR_BADCHANNELKEY_MSG "475 %s %s :Cannot join channel (+k) -- Wrong channel key" #define ERR_NOCHANMODES_MSG "477 %s %s :Channel doesn't support modes" #define ERR_NEEDREGGEDNICK_MSG "477 %s %s :Cannot send to channel (+M) -- You need to be identified to a registered account to message this channel" -#define ERR_LISTFULL_MSG "478 %s %s %s: Channel list is full (%d)" +#define ERR_LISTFULL_MSG "478 %s %s %s :Channel list is full (%d)" #define ERR_NOPRIVILEGES_MSG "481 %s :Permission denied" #define ERR_CHANOPRIVSNEEDED_MSG "482 %s %s :You are not channel operator" #define ERR_CHANOPPRIVTOOLOW_MSG "482 %s %s :Your privileges are too low"

1 0

Alexander Barton : Enhance debug messages while sending CHANINFO commands
by alex＠arthur.barton.de 20 Dez '14

20 Dez '14

Module: ngircd.git Branch: master Commit: 9a931a549b7e1b0979ce5f6088edf5136546f3ed URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=9a931a54… Author: Alexander Barton <alex(a)barton.de> Date: Sat Dec 20 15:35:47 2014 +0100 Enhance debug messages while sending CHANINFO commands --- src/ngircd/numeric.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/ngircd/numeric.c b/src/ngircd/numeric.c index b0ceeef..7d32ddc 100644 --- a/src/ngircd/numeric.c +++ b/src/ngircd/numeric.c @@ -216,7 +216,8 @@ Send_CHANINFO(CLIENT * Client, CHANNEL * Chan) bool has_k, has_l; #ifdef DEBUG - Log(LOG_DEBUG, "Sending CHANINFO commands ..."); + Log(LOG_DEBUG, "Sending CHANINFO commands for \"%s\" ...", + Channel_Name(Chan)); #endif modes = Channel_Modes(Chan);

1 0

Alexander Barton : Reset "last try" timer when enabling a passive server
by alex＠arthur.barton.de 20 Dez '14

20 Dez '14

Module: ngircd.git Branch: master Commit: 3c30490d54da941e368d54aeb63cf56cf1aef345 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=3c30490d… Author: Alexander Barton <alex(a)barton.de> Date: Sat Dec 20 15:31:30 2014 +0100 Reset "last try" timer when enabling a passive server This results in a new connection attempt as soon as possible. --- src/ngircd/conf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/ngircd/conf.c b/src/ngircd/conf.c index 5f8c392..221e7a9 100644 --- a/src/ngircd/conf.c +++ b/src/ngircd/conf.c @@ -618,6 +618,7 @@ Conf_EnablePassiveServer(const char *Name) && (Conf_Server[i].port > 0)) { /* BINGO! Enable server */ Conf_Server[i].flags &= ~CONF_SFLAG_DISABLED; + Conf_Server[i].lasttry = 0; return true; } }

1 0

Alexander Barton : Change log message for "Can't resolve address"
by alex＠arthur.barton.de 10 Dez '14

10 Dez '14

Module: ngircd.git Branch: master Commit: 62503353525fd893156731521edc95b2bd6a1f6f URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=62503353… Author: Alexander Barton <alex(a)barton.de> Date: Wed Dec 10 11:11:42 2014 +0100 Change log message for "Can't resolve address" --- src/ngircd/resolve.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/ngircd/resolve.c b/src/ngircd/resolve.c index 0d6a294..3279190 100644 --- a/src/ngircd/resolve.c +++ b/src/ngircd/resolve.c @@ -217,8 +217,8 @@ ReverseLookup(const ng_ipaddr_t *IpAddr, char *resbuf, size_t reslen) assert(reslen >= NG_INET_ADDRSTRLEN); ng_ipaddr_tostr_r(IpAddr, tmp_ip_str); - Log_Subprocess(LOG_WARNING, "%s: Can't resolve address \"%s\": %s", - funcname, tmp_ip_str, errmsg); + Log_Subprocess(LOG_WARNING, "Can't resolve address \"%s\": %s [%s].", + tmp_ip_str, errmsg, funcname); strlcpy(resbuf, tmp_ip_str, reslen); return false; }

1 0

Alexander Barton : Change log messages issued for IP address forgeries
by alex＠arthur.barton.de 10 Dez '14

10 Dez '14

Module: ngircd.git Branch: master Commit: 7e14bd3b58522ac34f0af29182248df1577d99c9 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=7e14bd3b… Author: Alexander Barton <alex(a)barton.de> Date: Wed Dec 10 11:01:51 2014 +0100 Change log messages issued for IP address forgeries --- src/ngircd/resolve.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/ngircd/resolve.c b/src/ngircd/resolve.c index be41ec8..0d6a294 100644 --- a/src/ngircd/resolve.c +++ b/src/ngircd/resolve.c @@ -334,14 +334,16 @@ static void Log_Forgery_NoIP(const char *ip, const char *host) { Log_Subprocess(LOG_WARNING, - "Possible forgery: %s resolved to %s (which has no ip address)", ip, host); + "Possible forgery: %s resolved to \"%s\", which has no IP address!", + ip, host); } static void Log_Forgery_WrongIP(const char *ip, const char *host) { Log_Subprocess(LOG_WARNING, - "Possible forgery: %s resolved to %s (which points to different address)", ip, host); + "Possible forgery: %s resolved to \"%s\", which points to a different address!", + ip, host); }

1 0

Alexander Barton : Merge remote-tracking branch 'alex/TestsuiteNoDNS'
by alex＠arthur.barton.de 01 Nov '14

01 Nov '14

Module: ngircd.git Branch: master Commit: 31b3c83c1f1b18fa1ed0501e95ed8e5f6cc6d407 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=31b3c83c… Author: Alexander Barton <alex(a)barton.de> Date: Sat Nov 1 20:14:09 2014 +0100 Merge remote-tracking branch 'alex/TestsuiteNoDNS' * alex/TestsuiteNoDNS: Test suite: Don't use DNS lookups ---

1 0

Alexander Barton : Test suite: Don't use DNS lookups
by alex＠arthur.barton.de 01 Nov '14

01 Nov '14

Module: ngircd.git Branch: master Commit: 3f807e104572b38143a1015be57d875088ceaebb URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=3f807e10… Author: Alexander Barton <alex(a)barton.de> Date: Thu Apr 17 23:57:38 2014 +0200 Test suite: Don't use DNS lookups Different operating systems do behave quite differently when doing DNS lookups, for example "127.0.0.1" sometimes resolves to "localhost" and sometimes to "localhost.localdomain" (for example OpenBSD). And other systems resolve "localhost" to the real host name (for example Cygwin). So not using DNS at all makes the test site much more portable. --- src/testsuite/channel-test.e | 2 +- src/testsuite/check-idle.e | 2 +- src/testsuite/connect-test.e | 2 +- src/testsuite/invite-test.e | 2 +- src/testsuite/join-test.e | 2 +- src/testsuite/kick-test.e | 2 +- src/testsuite/message-test.e | 31 ++++++++++++------------------- src/testsuite/misc-test.e | 8 ++++---- src/testsuite/mode-test.e | 2 +- src/testsuite/ngircd-test1.conf | 1 + src/testsuite/ngircd-test2.conf | 1 + src/testsuite/opless-channel-test.e | 2 +- src/testsuite/server-link-test.e | 2 +- src/testsuite/stress-A.e | 2 +- src/testsuite/who-test.e | 6 +++--- src/testsuite/whois-test.e | 14 +++++++------- 16 files changed, 38 insertions(+), 43 deletions(-) diff --git a/src/testsuite/channel-test.e b/src/testsuite/channel-test.e index dd7eb66..39ad16a 100644 --- a/src/testsuite/channel-test.e +++ b/src/testsuite/channel-test.e @@ -1,7 +1,7 @@ # ngIRCd test suite # Channel test -spawn telnet localhost 6789 +spawn telnet 127.0.0.1 6789 expect { timeout { exit 1 } "Connected" diff --git a/src/testsuite/check-idle.e b/src/testsuite/check-idle.e index 41b8eb4..ad112b2 100644 --- a/src/testsuite/check-idle.e +++ b/src/testsuite/check-idle.e @@ -1,7 +1,7 @@ # ngIRCd test suite # Idle test -spawn telnet localhost 6789 +spawn telnet 127.0.0.1 6789 expect { timeout { exit 1 } "Connected" diff --git a/src/testsuite/connect-test.e b/src/testsuite/connect-test.e index 662f5f7..b51be0d 100644 --- a/src/testsuite/connect-test.e +++ b/src/testsuite/connect-test.e @@ -1,7 +1,7 @@ # ngIRCd test suite # Server connect test -spawn telnet localhost 6789 +spawn telnet 127.0.0.1 6789 expect { timeout { exit 1 } "Connected" diff --git a/src/testsuite/invite-test.e b/src/testsuite/invite-test.e index 3716d19..5179d8a 100644 --- a/src/testsuite/invite-test.e +++ b/src/testsuite/invite-test.e @@ -1,7 +1,7 @@ # ngIRCd test suite # INVITE test -spawn telnet localhost 6789 +spawn telnet 127.0.0.1 6789 expect { timeout { exit 1 } "Connected" diff --git a/src/testsuite/join-test.e b/src/testsuite/join-test.e index 28b4c54..c088f5c 100644 --- a/src/testsuite/join-test.e +++ b/src/testsuite/join-test.e @@ -1,7 +1,7 @@ # ngIRCd test suite # JOIN test -spawn telnet localhost 6789 +spawn telnet 127.0.0.1 6789 expect { timeout { exit 1 } "Connected" diff --git a/src/testsuite/kick-test.e b/src/testsuite/kick-test.e index 3d3c1ee..89da611 100644 --- a/src/testsuite/kick-test.e +++ b/src/testsuite/kick-test.e @@ -1,7 +1,7 @@ # ngIRCd test suite # KICK test -spawn telnet localhost 6789 +spawn telnet 127.0.0.1 6789 expect { timeout { exit 1 } "Connected" diff --git a/src/testsuite/message-test.e b/src/testsuite/message-test.e index 0e70640..5dc325d 100644 --- a/src/testsuite/message-test.e +++ b/src/testsuite/message-test.e @@ -1,7 +1,7 @@ # ngIRCd test suite # PRIVMSG and NOTICE test -spawn telnet localhost 6789 +spawn telnet 127.0.0.1 6789 expect { timeout { exit 1 } "Connected" @@ -72,24 +72,17 @@ expect { "MODE nick :-b" } -# The following two tests using "localhost" as host name -# had to be disabled, because there are operating systems -# out there, that use "localhost.<domain>" as host name -# for 127.0.0.1 instead of just "localhost". -# (for example OpenBSD 4, OpenSolaris, ...) -# -#send "privmsg ~user\%localhost :test\r" -#expect { -# timeout { exit 1 } -# "@* PRIVMSG nick :test" -#} -# -#send "privmsg Nick!~User@LocalHost :test\r" -#expect { -# timeout { exit 1 } -# "@* PRIVMSG nick :test" -# "401" -#} +send "privmsg ~user\%127.0.0.1 :test\r" +expect { + timeout { exit 1 } + "@* PRIVMSG nick :test" +} + +send "privmsg Nick!~User(a)127.0.0.1 :test\r" +expect { + timeout { exit 1 } + "@* PRIVMSG nick :test" +} send "away :away\r" expect { diff --git a/src/testsuite/misc-test.e b/src/testsuite/misc-test.e index a83bc5b..f69e7c3 100644 --- a/src/testsuite/misc-test.e +++ b/src/testsuite/misc-test.e @@ -1,7 +1,7 @@ # ngIRCd test suite # Misc test -spawn telnet localhost 6789 +spawn telnet 127.0.0.1 6789 expect { timeout { exit 1 } "Connected" @@ -130,7 +130,7 @@ expect { send "userhost nick\r" expect { timeout { exit 1 } - -re ":ngircd.test.server 302 nick :?nick=+.*@(localhos.*|127.0.0.1)" + -re ":ngircd.test.server 302 nick :?nick=+.*@127.0.0.1" } send "userhost doesnotexist\r" @@ -142,7 +142,7 @@ expect { send "userhost nick doesnotexist nick doesnotexist\r" expect { timeout { exit 1 } - -re ":ngircd.test.server 302 nick :nick=+.*@(localhos.*|127.0.0.1) nick=+.*(a)(localhos.*|127.0.0.1)" + -re ":ngircd.test.server 302 nick :nick=+.*@127.0.0.1 nick=+.*(a)127.0.0.1" } send "away :testing\r" @@ -154,7 +154,7 @@ expect { send "userhost nick nick nick nick nick nick\r" expect { timeout { exit 1 } - -re ":ngircd.test.server 302 nick :nick=-.*@(localhos.*|127.0.0.1) nick=-.*(a)(localhos.*|127.0.0.1) nick=-.*(a)(localhos.*|127.0.0.1) nick=-.*(a)(localhos.*|127.0.0.1) nick=-.*(a)(localhos.*|127.0.0.1)\r" + -re ":ngircd.test.server 302 nick :nick=-.*@127.0.0.1 nick=-.*(a)127.0.0.1 nick=-.*(a)127.0.0.1 nick=-.*(a)127.0.0.1 nick=-.*(a)127.0.0.1\r" } send "quit\r" diff --git a/src/testsuite/mode-test.e b/src/testsuite/mode-test.e index d6726a4..86e4f2d 100644 --- a/src/testsuite/mode-test.e +++ b/src/testsuite/mode-test.e @@ -1,7 +1,7 @@ # ngIRCd test suite # MODE test -spawn telnet localhost 6789 +spawn telnet 127.0.0.1 6789 expect { timeout { exit 1 } "Connected" diff --git a/src/testsuite/ngircd-test1.conf b/src/testsuite/ngircd-test1.conf index 0d0cccc..4dec533 100644 --- a/src/testsuite/ngircd-test1.conf +++ b/src/testsuite/ngircd-test1.conf @@ -17,6 +17,7 @@ OperCanUseMode = yes Ident = no IncludeDir = /var/empty + DNS = no PAM = no [Operator] diff --git a/src/testsuite/ngircd-test2.conf b/src/testsuite/ngircd-test2.conf index c9d7f6c..0d24c4a 100644 --- a/src/testsuite/ngircd-test2.conf +++ b/src/testsuite/ngircd-test2.conf @@ -17,6 +17,7 @@ OperCanUseMode = yes Ident = no IncludeDir = /var/empty + DNS = no PAM = no [Operator] diff --git a/src/testsuite/opless-channel-test.e b/src/testsuite/opless-channel-test.e index 7d94172..4611fe1 100644 --- a/src/testsuite/opless-channel-test.e +++ b/src/testsuite/opless-channel-test.e @@ -1,7 +1,7 @@ # ngIRCd test suite # Op-less channel test -spawn telnet localhost 6789 +spawn telnet 127.0.0.1 6789 expect { timeout { exit 1 } "Connected" diff --git a/src/testsuite/server-link-test.e b/src/testsuite/server-link-test.e index cf3fae8..910f8c8 100644 --- a/src/testsuite/server-link-test.e +++ b/src/testsuite/server-link-test.e @@ -1,7 +1,7 @@ # ngIRCd test suite # server-server link test -spawn telnet localhost 6790 +spawn telnet 127.0.0.1 6790 expect { timeout { exit 1 } "Connected" diff --git a/src/testsuite/stress-A.e b/src/testsuite/stress-A.e index 256d5d1..d51adaa 100644 --- a/src/testsuite/stress-A.e +++ b/src/testsuite/stress-A.e @@ -3,7 +3,7 @@ set timeout 30 -spawn telnet localhost 6789 +spawn telnet 127.0.0.1 6789 expect { timeout { exit 1 } "Connected" diff --git a/src/testsuite/who-test.e b/src/testsuite/who-test.e index a41e6b6..39d50ed 100644 --- a/src/testsuite/who-test.e +++ b/src/testsuite/who-test.e @@ -1,7 +1,7 @@ # ngIRCd test suite # WHO test -spawn telnet localhost 6789 +spawn telnet 127.0.0.1 6789 expect { timeout { exit 1 } "Connected" @@ -62,7 +62,7 @@ expect { ":ngircd.test.server 352 nick #channel * * ngircd.test.server nick G@ :0 Real Name" } -send "who localhos*\r" +send "who 127.0.0.*\r" expect { timeout { exit 1 } ":ngircd.test.server 352 nick \* * * ngircd.test.server nick G :0 Real Name" @@ -120,7 +120,7 @@ expect { "305 nick" } -send "who ??cal*ho*\r" +send "who ??7.*0*\r" expect { timeout { exit 1 } ":ngircd.test.server 352 nick \* * * ngircd.test.server nick H* :0 Real Name" diff --git a/src/testsuite/whois-test.e b/src/testsuite/whois-test.e index 16b1184..44eee66 100644 --- a/src/testsuite/whois-test.e +++ b/src/testsuite/whois-test.e @@ -1,7 +1,7 @@ # ngIRCd test suite # WHOIS test -spawn telnet localhost 6789 +spawn telnet 127.0.0.1 6789 expect { timeout { exit 1 } "Connected" @@ -17,7 +17,7 @@ expect { send "whois nick\r" expect { timeout { exit 1 } - "311 nick nick ~user localhost* \* :Real Name\r" + "311 nick nick ~user 127.0.0.1 \* :Real Name\r" } expect { timeout { exit 1 } @@ -27,25 +27,25 @@ expect { send "whois *\r" expect { timeout { exit 1 } - "311 nick nick ~user localhost* \* :Real Name\r" + "311 nick nick ~user 127.0.0.1* \* :Real Name\r" } send "whois n*\r" expect { timeout { exit 1 } - "311 nick nick ~user localhost* \* :Real Name\r" + "311 nick nick ~user 127.0.0.1* \* :Real Name\r" } send "whois ?ick\r" expect { timeout { exit 1 } - "311 nick nick ~user localhost* \* :Real Name\r" + "311 nick nick ~user 127.0.0.1* \* :Real Name\r" } send "whois ????,n?*k\r" expect { timeout { exit 1 } - "311 nick nick ~user localhost* \* :Real Name\r" + "311 nick nick ~user 127.0.0.1* \* :Real Name\r" } send "whois unknown\r" @@ -61,7 +61,7 @@ expect { send "whois ngircd.test.server2 nick\r" expect { timeout { exit 1 } - ":ngircd.test.server2 311 nick nick ~user localhost* \* :Real Name\r" + ":ngircd.test.server2 311 nick nick ~user 127.0.0.1* \* :Real Name\r" } send "whois nosuchserver unknown\r"

1 0

Alexander Barton : Merge branch 'CipherListNoSSL3'
by alex＠arthur.barton.de 26 Okt '14

26 Okt '14

Module: ngircd.git Branch: master Commit: 6e4235443eb4dee0930a65e613c8bf5e00331f73 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=6e423544… Author: Alexander Barton <alex(a)barton.de> Date: Sun Oct 26 11:58:22 2014 +0100 Merge branch 'CipherListNoSSL3' * CipherListNoSSL3: INSTALL: List the changed SSL CipherList default value. Update "CipherList" to not enable SSLv3 by default ---

1 0

Alexander Barton : INSTALL: List the changed SSL CipherList default value.
by alex＠arthur.barton.de 26 Okt '14

26 Okt '14

Module: ngircd.git Branch: master Commit: cdcf474f159ad0c3c2a652cdbfa5e7f09171667c URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=cdcf474f… Author: Alexander Barton <alex(a)barton.de> Date: Sun Oct 26 11:55:28 2014 +0100 INSTALL: List the changed SSL CipherList default value. --- INSTALL | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/INSTALL b/INSTALL index cf33fa3..0aa853c 100644 --- a/INSTALL +++ b/INSTALL @@ -12,12 +12,21 @@ I. Upgrade Information ~~~~~~~~~~~~~~~~~~~~~~ +Differences to version 22.x + +- The default value of the SSL "CipherList" variable has been changed to + "HIGH:!aNULL:@STRENGTH:!SSLv3" (OpenSSL) and "SECURE128:-VERS-SSL3.0" + (GnuTLS) to disable the old SSLv3 protocol by default. + To enable connections of clients still requiring the weak SSLv3 protocol, + the "CipherList" must be set to its old value (not recommended!), which + was "HIGH:!aNULL:@STRENGTH" (OpenSSL) and "SECURE128" (GnuTLS), see below. + Differences to version 20.x - Starting with ngIRCd 21, the ciphers used by SSL are configurable and - default to HIGH:!aNULL:@STRENGTH (OpenSSL) or SECURE128 (GnuTLS). - Previous version were using the OpenSSL or GnuTLS defaults, DEFAULT - and NORMAL respectively. + default to "HIGH:!aNULL:@STRENGTH" (OpenSSL) or "SECURE128" (GnuTLS). + Previous version were using the OpenSSL or GnuTLS defaults, "DEFAULT" + and "NORMAL" respectively. - When adding GLINE's or KLINE's to ngIRCd 21 (or newer), all clients matching the new mask will be KILL'ed. This was not the case with earlier versions

1 0

Alexander Barton : Update "CipherList" to not enable SSLv3 by default
by alex＠arthur.barton.de 26 Okt '14

26 Okt '14

Module: ngircd.git Branch: master Commit: 100de3e4ccaab10524821d4262f6a8c3342224f8 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=100de3e4… Author: Alexander Barton <alex(a)barton.de> Date: Thu Oct 16 13:42:24 2014 +0200 Update "CipherList" to not enable SSLv3 by default Idea, initial patch, and testing by Christoph Biedl <ngircd.anoy(a)manchmal.in-ulm.de> --- doc/sample-ngircd.conf.tmpl | 4 ++-- man/ngircd.conf.5.tmpl | 4 ++-- src/ngircd/conf.c | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/doc/sample-ngircd.conf.tmpl b/doc/sample-ngircd.conf.tmpl index 1d07822..b5db1d9 100644 --- a/doc/sample-ngircd.conf.tmpl +++ b/doc/sample-ngircd.conf.tmpl @@ -259,9 +259,9 @@ # See 'man 1ssl ciphers' (OpenSSL) or 'man 3 gnutls_priority_init' # (GnuTLS) for details. # For OpenSSL: - ;CipherList = HIGH:!aNULL:@STRENGTH + ;CipherList = HIGH:!aNULL:@STRENGTH:!SSLv3 # For GnuTLS: - ;CipherList = SECURE128 + ;CipherList = SECURE128:-VERS-SSL3.0 # Diffie-Hellman parameters ;DHFile = :ETCDIR:/ssl/dhparams.pem diff --git a/man/ngircd.conf.5.tmpl b/man/ngircd.conf.5.tmpl index 9b2ed08..0d57f90 100644 --- a/man/ngircd.conf.5.tmpl +++ b/man/ngircd.conf.5.tmpl @@ -1,7 +1,7 @@ .\" .\" ngircd.conf(5) manual page template .\" -.TH ngircd.conf 5 "Jan 2014" ngIRCd "ngIRCd Manual" +.TH ngircd.conf 5 "Oct 2014" ngIRCd "ngIRCd Manual" .SH NAME ngircd.conf \- configuration file of ngIRCd .SH SYNOPSIS @@ -375,7 +375,7 @@ SSL Certificate file of the private server key. .TP \fBCipherList\fR (string) Select cipher suites allowed for SSL/TLS connections. This defaults to -"HIGH:!aNULL:@STRENGTH" (OpenSSL) or "SECURE128" (GnuTLS). +"HIGH:!aNULL:@STRENGTH:!SSLv3" (OpenSSL) or "SECURE128:-VERS-SSL3.0" (GnuTLS). Please see 'man 1ssl ciphers' (OpenSSL) and 'man 3 gnutls_priority_init' (GnuTLS) for details. .TP diff --git a/src/ngircd/conf.c b/src/ngircd/conf.c index 6692ecb..5f8c392 100644 --- a/src/ngircd/conf.c +++ b/src/ngircd/conf.c @@ -88,10 +88,10 @@ static void Init_Server_Struct PARAMS(( CONF_SERVER *Server )); #endif #ifdef HAVE_LIBSSL -#define DEFAULT_CIPHERS "HIGH:!aNULL:@STRENGTH" +#define DEFAULT_CIPHERS "HIGH:!aNULL:@STRENGTH:!SSLv3" #endif #ifdef HAVE_LIBGNUTLS -#define DEFAULT_CIPHERS "SECURE128" +#define DEFAULT_CIPHERS "SECURE128:-VERS-SSL3.0" #endif #ifdef SSL_SUPPORT

1 0