- ngIRCd Users - lists.barton.de

ngIRCd Release 27~rc1
by Alexander Barton 26 Apr '24

26 Apr '24

Hello ngIRCd Community! More than three years have passed since the last release of ngIRCd (<http://ngircd.barton.de>) – a free, portable and lightweight Internet Relay Chat server for small or private networks – and more than 130 individual patches have accumulated in the Git “master branch” in the meantime. Some are cosmetic, some bring new functionality, others improve the documentation or fix bugs. All in all, it’s more than time for the next “big” release of ngIRCd! And here it is, the 1st release candidate for the upcoming ngIRCd release 27! The most prominent and possibly breaking(!) change is that ngIRCd now validates SSL/TLS certificates on server-server links. Until now, ngIRCd optionally used encrypted server-server links (when `SSLConnect = yes` is set in a `[Server]` block, which is not the default) but never checked and validated any certificates. Oh my! Most probably we never should have released it this way in ngIRCd 13 back in 2008 … I hope you all were aware of this, right? Because you never configured a CA to trust, for example …? But finally we made it, and _ngIRCd now validates SSL/TLS certificates on outgoing server-server links by default_ and **drops**(!) connections when the remote certificate is invalid (for example self-signed, expired, not matching the host name, …). Therefore you have to make sure that all relevant _certificates are valid_ (or to disable certificate validation on this connection using the new `SSLVerify = false` setting in the affected `[Server]` block, where the remote certificate is not valid and you can not fix this issue). The original patch for OpenSSL certificate validation on server-links dates back to 2009 and was written by Florian Westphal and extended for GnuTLS in 2014 by Christoph Biedl. But it took us another 10 years to bring it to life … oh my! Many thanks to both Florian and Christoph! (This closes issue #120) But that’s not all. In addition to the above, the following noteworthy changes are listed in the `NEWS` file (<https://github.com/ngircd/ngircd/blob/master/NEWS>): - Add support for the “sd_notify” protocol of `systemd(8)`: Periodically “ping” the service manager (every 3 seconds) and set a status message showing current connection statistics which then is included in `systemctl status ngircd.service` output. In addition, this enables using the `systemd(8)` watchdog functionality (`WatchdogSec`) for the `ngircd.service` unit and allows it to use the `notify` service type, which results in better status tracking by the service manager. - Try to set file descriptor limit to its maximum and show info on startup: The number of possible parallel connections is limited by the file descriptor limit of the process (among other things). Therefore try to upgrade the current “soft” limit to its “hard” maximum (but limited to 100000 instead of “infinite”), and show an information or even warning when the limit is still less than the configured `MaxConnections` setting. Please note that ngIRCd and its linked libraries (like PAM) need file descriptors not only for incoming and outgoing IRC connections, but for reading files and inter-process communication, too! Therefore the actual connection limit is less(!) than the file descriptor limit! - Add a _Docker file_ (contrib/Dockerfile) and corresponding documentation (doc/Container.md) to the project. The resulting container is based on the latest Debian “stable-slim” container and built using a “build container”. - No longer use a default built-in value for the `IncludeDir` directive when a configuration file was explicitly specified on the command line using `--config`/`-f`: This way no default include directory is scanned when a possibly non-default configuration file is used which (intentionally) did not specify an `IncludeDir` directive. So now you can use `-f /dev/null` for checking all built-in defaults, regardless of any local configuration files in the default drop-in directory (which would have been read in until this change). - The server `Name` in the `[Global]` section of the configuration file no longer needs to be set: When not set (or empty), ngIRCd now tries to deduce a valid IRC server name from the local host name (“node name”), possibly adding a `.host` extension when the host name does not contain a dot (`.`) which is required in an IRC server name (“ID”). This new behavior, with all configuration parameters now being optional, allows running ngIRCd without any configuration file at all. - Autodetect support for IPv6 by default: Until now, IPv6 support was disabled by default, which seems a bit outdated in 2024. Note: You still can pass `--enable-ipv6`/`--disable-ipv6` to the `./configure` script to forcefully activate or deactivate IPv6 support. - Do IDENT requests even when DNS lookups are disabled: Up to now disabling DNS in the configuration disabled IDENT lookups as well (for no good reason). Now you can activate/deactivate DNS lookups and IDENT requests completely separately. Thanks for reporting this, Miniontoby! Closes #291. - Allow SSL client-only configurations without keys/certificates: You don’t need to configure certificates/keys as long as you don’t configure SSL-enabled listening ports. This can make sense when you want to only link your local daemon to an uplink server using SSL and only have clients on your local host or in your fully trusted network, where SSL is not required. - Respect `SSLConnect` option for incoming connections and do not accept incoming plain-text (“non SSL”) server connections for servers configured with `SSLConnect` enabled. This change prevents an authenticated client-server being able to force the server-server to send its password on a plain-text connection when SSL/TLS was intended. - Add a new option `Autojoin` to `[Channel]` blocks: When it is set, ngIRCd automatically joins all local users to this channel on connect. Note: The users must have permissions to access the channel, otherwise joining them will fail. Thanks Ivan Agarkov for the initial patch! - Hide invisible (+i) users on `WHOIS <pattern>`: Let’s behave like most(?) other IRC daemons (at least ircd2.11) and hide all +i users when `WHOIS` is used with a pattern. Otherwise privacy of this users is not guaranteed and the +i mode a bit useless … Reported by Cahata on #ngircd, thanks! - Make the debug log level (`--debug`/`-d` command line option) always available, not only when `./configure`’d with `--enable-debug`: the latter now only enables additional checks (like the tests done using `assert`(2)) and is signalled by adding `+DEBUG` to the version “feature string”. This change enables everyone to get even more detailed logging when required. - Allow IRC operators to use the `WHO` command on any channel. - Send the `NAMES` list and channel topic to users “forcefully” joined to a channel using `NJOIN`, like they joined on their own using `JOIN`, and streamline the order of `NAMES` list and channel topic messages. Closes #288. - Added a new command line option `-y`/`--syslog`, with which logging to syslog can be activated/deactivated separately from running on the console (using `--nodaemon`) or in the background. Thanks Katherine Peeters for the patch and pull request! Closes #294. - Update, enhance and extend our documentation in `README.md`, `INSTALL.md`, `doc/HowToRelease.txt` and the manual pages `ngircd`(8) and `ngircd.conf`(5), add a new `doc/QuickStart.md` document, and convert some more documentation files to Markdown (`AUTHORS.md`, `contrib/README.md`, `doc/FAQ.md`, `doc/SSL.md`). And the `ChangeLog` (<https://github.com/ngircd/ngircd/blob/master/ChangeLog>) has even more details and lists all the fixes, minor enhancements and tweaks. You can download ngIRCd 27~rc1 from the download section on our homepage at <https://ngircd.barton.de> (mirror: <https://ngircd.sourceforge.io>) and GitHub: <https://github.com/ngircd/ngircd/releases/tag/rel-27-rc1>. The primary download locations are: - <https://github.com/ngircd/ngircd/releases> - <https://ngircd.barton.de/pub/ngircd/> - <https://ngircd.sourceforge.io/pub/ngircd/> It would be great if as many people as possible try to build this release candidate code on as many platforms as possible! Please report any issues and glitches you find to the GitHub issue tracker (<https://github.com/ngircd/ngircd/issues>), the mailing list (ngircd(a)lists.barton.de), or to the #ngircd channel on IRC: <irc://irc.barton.de/ngircd>. Enhancements and additions to the documentation, manual pages and the homepage are welcome as well! The easiest way to test ngIRCd is to run the `./contrib/platformtest.sh` script which is included in the distribution archives, for example like this: $ curl -#LO "https://ngircd.barton.de/pub/ngircd/ngircd-27~rc1.tar.gz" $ tar xzf "ngircd-27~rc1.tar.gz" $ cd ngircd-27~rc1 $ ./contrib/platformtest.sh This will take a few minutes (4-5) as our test suite takes some time because of the “penalties” that the test clients have to cope with (the compile run itself is quite fast), and should result in a nice summary like this: the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/pc/linux-gnu gcc 12.2.0 27~rc1 24-04-13 alex Y Y Y Y 1 If you like, and especially if you are on a bit more “special” system (non-amd64, non-arm64, non-Linux?), you can say “Hello!” in the <irc://irc.barton.de/ngircd> IRC channel and post this result line there: then we can include it in the `doc/Platforms.txt` (<https://github.com/ngircd/ngircd/blob/master/doc/Platforms.txt>) file. Thanks a lot to all contributors & testers! Happy testing and have fun! Alex

1 1

set syslog level
by ubq323 13 Jul '22

13 Jul '22

hi, is there any way to set the syslog level ngircd uses? my syslog is somewhat full of spam from server connections, which i don't really need to know about

2 1

Passwords required for connection?
by Marisa Giancarla 03 Jun '22

03 Jun '22

Hello, I am setting up ngircd on ubuntu but when people try and connect the connections are refused and it complains about a password being incorrect. I don't want people to have to set a password when logging in but the password is not set in the config file. Any ideas? Marisa

3 6

Hello from a new user
by Keith Christian 29 Mai '22

29 Mai '22

I'm interested in compiling and running ngIrcd on a recent Cygwin installation. When I have an opportunity to do so, I will reply here with results or questions. Thanks everyone, and nice to be here! Keith

1 0

ngIRCd Mailing List
by Alexander Barton 08 Mai '22

08 Mai '22

Hi All! I updated the mailing list software on my server from Mailman 2 to Mailman 3, which basically is a new separate installation. And therefore the list address as well as the URL of the web interface changed. The new links are: - Liste email address: ngIRCd Users <ngircd(a)lists.barton.de> - Web interface: <https://lists.barton.de/mailman3/postorius/lists/ngircd.lists.barton.de/> - Archive: <https://lists.barton.de/mailman3/hyperkitty/list/ngircd@lists.barton.de/> All subscribers should have been migrated automatically, and the old list address forwards to the new one — so hopefully, when all goes well, the transition should be seamless and you don’t need to do anything. I updated the links on the ngIRCd home page, too, and a few redirections from the old URLs to the new ones are in place as well. But please note that you need to create a new account when you want to manage your subscription via the web interface: the old passwords were NOT migrated. This is not required when using the email interface by sending list commands to <ngircd-request(a)lists.barton.de>. Regards Alex

1 0

Ignore AllowRemoteOper for services
by SomeHacker 27 Jan '22

27 Jan '22

ngIRCd should ignore AllowRemoteOper setting for services. If disallowed, it prevents certain features (e.g. AKILL which sets a G-Line) from working, and enabling it would make the server vulnerable to malicious operators on other servers. Still can't register on GitHub. SomeHacker

1 0

20 years of ngIRCd 🥳
by Götz Hoffart 27 Jan '22

27 Jan '22

⛳️🎯🎖🎉🎉🥳 2001-12-11 Thanks Alex for your service and dedication!

2 1

Channel mode for IRC operators (feature request)
by SomeHacker 22 Okt '21

22 Okt '21

ngIRCd could support a special channel mode for IRC operators, used in some cases. If implemented, it would make OperCanUseMode and OperChanPAutoOp config options be less weird when noticed by unfamiliar users. Such feature is implemented in InspIRCd, see [https://docs.inspircd.org/3/modules/ojoin/] and [https://docs.inspircd.org/3/modules/operprefix/]. This feature request can be copied to GitHub as well, I can't register there. SomeHacker

1 0

A handful of patches
by Mateusz Latusek 18 Mär '21

18 Mär '21

Hello, Here are my patches to ngIRCd. The first three commits are quite simple and make it a little more configurable. The last one is bigger though and fixes some problems I found with message routing. It does pass make check, but it needs some more testing in a multiserver environment. Regs, M. -- matlibhax.com matlibhax.com/~matlib <https://matlibhax.com/~matlib/>

1 0

Possible Server Password Issue?
by jrmu 18 Feb '21

18 Feb '21

Greetings, My teammate may have found a bug. When you specify a server password for ngircd.conf and turn off PAM on openbsd, some clients are unable to connect even if a server password is configured in the IRC client. I suspect this is because ngircd expects a server password immediately whereas some clients first send the nick and only later do they send the server password. Here's what led to my suspicion: chewy$ nc chewy.coconut.ircnow.org 6667 NOTICE * :*** Looking up your hostname NOTICE * :*** Found your hostname: chewy.ircnow.org pass BLAHBLAHBLAH nick chewy user chewy * * :chewy :chewy.coconut.ircnow.org 001 chewy :Welcome to the Internet Relay Network chewy!~chewy@ chewy.ircnow.org But if I send the password in a different order: chewy$ nc chewy.coconut.ircnow.org 6667 NOTICE * :*** Looking up your hostname NOTICE * :*** Found your hostname: chewy.ircnow.org nick chewy user chewy * * :chewy ERROR :Access denied: Bad password? chewy$ nc chewy.coconut.ircnow.org 6667 NOTICE * :*** Looking up your hostname NOTICE * :*** Found your hostname: chewy.ircnow.org nick chewy pass BLAHBLAH :chewy.coconut.ircnow.org 462 chewy :Connection already registered user chewy * * :chewy ERROR :Access denied: Bad password?

1 0

ngIRCd Release 26.1
by Alexander Barton 02 Jan '21

02 Jan '21

Hello all, and happy new year! The very first commit to the ngIRCd source code repository was made on December 11 2001, back then in CVS. And today, roughly years later, I just released ngIRCd 26.1, the free, portable and lightweight Internet Relay Chat server for small or private networks. Version 26.1 is a bug fix release only, without new features. If you aren't affected by any of the fixed issues, there is no need for a timely upgrade if you are already running ngIRCd 26. The ChangeLog file lists the following changes (and can be seen online here: https://github.com/ngircd/ngircd/blob/rel-26.1/ChangeLog): - Fix a "format string" compiler warning (detected on OpenBSD). - No longer set "AI_ADDRCONFIG" when resolving host names, even when it exists: with this option set, on an IPv6-only host, we prevent 127.0.0.1 to get translated properly, even when the loopback interface has this address configured! And as the test suite uses 127.0.0.1, it was broken on IPv6-only hosts. The drawback is that the resolver possibly returns more addresses now, even of an unsupported/not connected address family; but this shouldn't do much harm in practice, as ngIRCd iterates over all returned addresses while trying to establish an outgoing connection. Closes #281. - Revert "Show allowed channel types in ISUPPORT(005) numeric only", which was introduced in 26~rc1: This lead to some IRC clients assuming "oh, no channel prefix characters at all, so no channels at all, so no PRIVMSG can go to any channel" when "AllowedChannelTypes" was set to the empty string ("") -- which is not the case when there are pre-defined channel set up or other servers still having channels! So "allowed channel types" != "supported channel types", and we always have to list all supported ones in the ISUPPORT(005) numeric! Closes #285. - Test suite: Wait 2 seconds after reloading the daemon, which is required because on reload, all listening ports are closed, configuration updated, and then opened again. This lead to subsequent tests running while the daemon isn't listening on any ports, and that's why some tests could fail. Closes #280. - platformtest.sh: Try to mangle CLang name more intelligently. - Documentation: Fixed URLs of Atheme IRC services, updated all mentions from CVS to Git, and updated Platforms.txt -- Oh, and it is 2021 now! ;-) You can download ngIRCd 26.1 from the download section on our homepage at https://ngircd.barton.de (mirror: https://ngircd.sourceforge.io). The primary download locations are: • https://github.com/ngircd/ngircd/releases • https://ngircd.barton.de/pub/ngircd/ • https://ngircd.sourceforge.io/pub/ngircd/ Thanks a lot to all contributors & testers! Stay safe and have fun! Alex

1 1

ngIRCD 26 on OpenBSD: warnings
by Götz Hoffart 29 Dez '20

29 Dez '20

./configure --with-openssl … make … CC conf.o conf.c: In function 'Conf_Test': conf.c:391: warning: format '%ld' expects type 'long int', but argument 2 has type 'time_t' CC conn.o CC conn-encoding.o …

2 1

ngIRCd on Apple Silicon / M1
by Götz Hoffart 10 Dez '20

10 Dez '20

Standard ./configure / make will produce x86_64 binaries. Platform: Apple M1, Big Sur / macOS 11.0.1, XCode 12.2 Apple clang version 12.0.0 (clang-1200.0.32.27) Target: x86_64-apple-darwin20.1.0 With some IKEA KLOPPE it works, though: $ make distclean $ CC="/usr/bin/cc" CFLAGS="-target arm64-apple-macos11" ./configure --host=aarch64-apple-darwin --target=aarch64-apple-darwin --build=aarch64-apple-darwin $ make -j8 $ file src/ngircd/ngircd src/ngircd/ngircd: Mach-O 64-bit executable arm64 $ src/ngircd/ngircd --version ngIRCd 26-IRCPLUS+SYSLOG+ZLIB-aarch64/apple/darwin Copyright (c)2001-2020 Alexander Barton (<alex(a)barton.de>) and Contributors. Homepage: <http://ngircd.barton.de/> Congrats, Alex, one more platform to conquer :-) … how do I pass over these recommendations to contrib/platformtest? Regards Götz

1 1

ngIRC 26 on OpenBSD 6.7 x86-64: 🤟
by Götz Hoffart 26 Sep '20

26 Sep '20

the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/unknown/openbsd6.7 gcc 4.2.1 26 20-09-26 goetz Y Y y Y 3 WARNING: Some tests have been skipped! Please double check that the ngIRCd daemon starts up, runs and handles IRC connections successfully! (`expect` is missing by default on OpenBSD)

1 0

ngIRCd Release 26
by Alexander Barton 22 Jun '20

22 Jun '20

Hello all! After two release candidates, here it is, the next major release of ngIRCd, the free, portable and lightweight Internet Relay Chat server for small or private networks: Release 26! This release contains all fixes and enhancements since ngIRCd 25, please see the ChangeLog file for a detailed list of all changes. You can find it online here: https://github.com/ngircd/ngircd/blob/rel-26/ChangeLog The NEWS file (https://github.com/ngircd/ngircd/blob/rel-26/NEWS) lists the following new features since ngIRCd 25: • Add AppStream metadata file (contrib/de.barton.ngircd.metainfo.xml). • Various bug fixes, see the ChangeLog. No new or changed functionality. • Allow up to 512 characters per line in MOTD and help text files (but keep in mind that lines can't get that long, because they have to be prefixed before being sent to the client). But this allows for more fancy MOTDs :-) Closes #271. • Show the actually allowed channel types in the ISUPPORT(005) numeric which are configured by the "AllowedChannelTypes" configuration variable. Closes #273. • Handle commands in the read buffer before reading more data and don't wait for the network in this case: If there are more bytes in the read buffer already than a single valid IRC command can get long (513 bytes), wait for this/those command(s) to be handled first and don't try to read even more data from the network (which most probably would overflow the read buffer of this connection soon). • Log G-/K-Line changes only when not initiated by a server: this prevents the log from becoming spammed during "net bursts". • Update test suite to include SSL tests, including checking for reloading certificates during runtime. • Add support for GnuTLS certificate reload, which is quite handy when using Let's Encrypt, for example. Until now this was only supported when linked with OpenSSL. Thanks a lot, Hilko Bengen <bengen(a)hilluzination.de>! • Allow setting arbitrary channel modes in the configuration file by handling them like in MODE commands, and allow multiple "Modes =" lines per [Channel] section. Thanks to Michi <michi+ngircd(a)dataswamp.org>! Closes #55. • Add "FNC" (forced nick changes) to ISUPPORT(005) numeric. Most probably this doesn't make any difference to any client, but it seems correct. See <http://www.irc.org/tech_docs/005.html> for details. • Enhance handling of command line errors, and return with exit code 0 ("no error") when "--help" or "--version" is used (which resulted in exit code 1, "error" before). Exit with code 2 ("command line error") for all other invalid command line options, and show the error message itself on stderr (instead of stdout and exit code 1, "generic error", as before). This new behavior is more in line with the GNU "coding standards", see <https://www.gnu.org/prep/standards/html_node/_002d_002dhelp.html>. • Add ./contrib/nglog.sh: This script parses the log output of ngircd(8), and colorizes the messages according to their log level. Example usage: ngircd -f $PWD/doc/sample-ngircd.conf -np | ./contrib/nglog.sh • Enlarge buffers of info texts to 128 bytes. This includes: • "Real name" of a client (4th filed of the USER command). • Server info text ("Info" configuration option). • Admin info texts and email address ("AdminInfo1", "AdminInfo2" and "AdminEmail" configuration options). • Network name ("Network" configuration option). The limit was 64 bytes before ... Closes #258. You can download ngIRCd 26~rc1 from the download section on our homepage at https://ngircd.barton.de (mirror: https://ngircd.sourceforge.io). The primary download locations are: • https://github.com/ngircd/ngircd/releases • https://ngircd.barton.de/pub/ngircd/ • https://ngircd.sourceforge.io/pub/ngircd/ Thanks a lot to all contributors & testers! Stay safe and have fun! Alex

2 2

Test failure (server-login-test)
by Sam James 21 Jun '20

21 Jun '20

Hi there, I’m currently hitting 1 test failure (server-login-test) since ngircd-25, same with 26 (not tested 24, IIRC). I’ve pasted the relevant test logs, let me know if any more can be provided that are useful. Any ideas on this? It seems to happen independent of architecture. $ cat ngircd-test3.log [19907:5 0] ngIRCd 26-IPv6+PAM+SSL+SYSLOG+ZLIB-x86_64/pc/linux-gnu starting ... [19907:6 0] Using configuration file "./ngircd-test3.conf" ... [19907:3 0] Can't read help text file "/usr/share/doc/ngircd-26/Commands.txt": No such file or directory [19907:4 0] No help text available, HELP command will be of limited use. [19907:4 0] Not specifying a full path name to "./ngircd-test3.conf" can cause problems when rehashing the server! [19907:4 0] Maximum penalty increase ('MaxPenaltyTime') is set to 1, this is not recommended! [19907:6 0] OpenSSL 1.1.1g 21 Apr 2020 initialized. [19907:6 0] ServerUID must not be root(0), using "nobody" instead. [19907:6 0] Running as user nobody(65534), group nobody(65534), with PID 19907. [19907:6 0] Not running with changed root directory. [19907:6 0] IO subsystem: epoll (hint size 100, initial maxfd 100, masterfd 3). [19907:6 0] Now listening on [127.0.0.1]:6789 (socket 6). [19907:6 0] Now listening on [127.0.0.1]:6790 (socket 7). [19907:5 0] Server "ngircd.test.server" (on "gentoo") ready. [19907:6 1] Accepted connection 8 from "127.0.0.1:44330" on socket 7. [19907:6 1] Connection 8: initialized TLSv1.3 using cipher TLS_AES_256_GCM_SHA384. [19907:6 4] Shutting down connection 8 (Got QUIT command) with "127.0.0.1:44330" ... [19907:5 4] Client unregistered (connection 8): Got QUIT command. [19907:6 4] Connection 8 with "127.0.0.1:44330" closed (in: 0.0k, out: 0.1k). [19907:6 4] Got signal "Hangup" ... [19907:5 4] Re-reading configuration NOW! [19907:6 4] Using configuration file "./ngircd-test3.conf" ... [19907:3 4] Can't read help text file "/usr/share/doc/ngircd-26/Commands.txt": No such file or directory [19907:4 4] No help text available, HELP command will be of limited use. [19907:4 4] Not specifying a full path name to "./ngircd-test3.conf" can cause problems when rehashing the server! [19907:4 4] Maximum penalty increase ('MaxPenaltyTime') is set to 1, this is not recommended! [19907:6 4] Shutting down all listening sockets (2 total) ... [19907:6 4] OpenSSL 1.1.1g 21 Apr 2020 initialized. [19907:6 4] Now listening on [127.0.0.1]:6789 (socket 6). [19907:6 4] Now listening on [127.0.0.1]:6790 (socket 7). [19907:5 4] Re-reading of configuration done. [19907:6 4] Accepted connection 8 from "127.0.0.1:44332" on socket 7. [19907:6 4] Connection 8: initialized TLSv1.3 using cipher TLS_AES_256_GCM_SHA384. [19907:6 7] Shutting down connection 8 (Got QUIT command) with "127.0.0.1:44332" ... [19907:5 7] Client unregistered (connection 8): Got QUIT command. [19907:6 7] Connection 8 with "127.0.0.1:44332" closed (in: 0.0k, out: 0.1k). [19907:6 7] Got signal "Terminated" ... [19907:5 7] Server going down NOW! [19907:6 7] Shutting down all listening sockets (2 total) ... [19907:5 7] ngIRCd done, served 2 connections. $ cat src/testsuite/logs/server-login-test.log spawn telnet 127.0.0.1 6789 Trying 127.0.0.1... Connected to 127.0.0.1.PASS pwd1 0210-IRC+ ngIRCd|testsuite0:CHLMSX P SERVER ngircd.test.server3 :Testsuite Server Emulation Escape character is '^]'. :ngircd.test.server PASS pwd3 0210-IRC ngIRCd|26 PZ :ngircd.test.server SERVER ngircd.test.server 1 :ngIRCd Test-Server 1 :ngircd.test.server SERVER ngircd.test.server2 2 2 :ngIRCd Test-Server 2 :ngircd.test.server PING :ngircd.test.server Full log: $ make check make ngircd-TEST-Binary tests.sh make[1]: Entering directory '/var/tmp/portage/net-irc/ngircd-26/work/ngircd-26/src/testsuite' cp ../ngircd/ngircd T-ngircd1 cp ../ngircd/ngircd T-ngircd2 cp ../ngircd/ngircd T-ngircd3 [ -f getpid.sh ] || ln -s ./getpid.sh . rm -f tests-skipped.lst make[1]: Nothing to be done for 'tests.sh'. make[1]: Leaving directory '/var/tmp/portage/net-irc/ngircd-26/work/ngircd-26/src/testsuite' make check-TESTS make[1]: Entering directory '/var/tmp/portage/net-irc/ngircd-26/work/ngircd-26/src/testsuite' starting server 1 ... ok. PASS: start-server1 running connect-test ...... ok. PASS: connect-test starting server 2 ... ok. PASS: start-server2 running channel-test ....................... ok. PASS: channel-test running invite-test ...................... ok. PASS: invite-test running join-test ............... ....... ok. PASS: join-test running kick-test ....................... ok. PASS: kick-test running message-test ............................ ok. PASS: message-test running misc-test ............................. ok. PASS: misc-test running mode-test ................................. ok. PASS: mode-test running opless-channel-test ........ ok. PASS: opless-channel-test running who-test ..................................... ok. PASS: who-test running whois-test ............ .... ok. PASS: whois-test running server-link-test ........... ok. PASS: server-link-test running server-login-test ..... failure! FAIL: server-login-test stopping server 2 ... ok. PASS: stop-server2 stressing server with 5 clients (be patient!): checking stress script ... ok. started client 1/5. started client 2/5. started client 3/5. started client 4/5. started client 5/5. waiting for clients to complete: ... ok. PASS: stress-server.sh stopping server 1 ... ok. PASS: stop-server1 PASS: prep-server3 starting server 3 ... ok. PASS: start-server3 running connect-ssl-cert1-test ...... ok. PASS: connect-ssl-cert1-test PASS: switch-server3 reloading server 3 ... ok. PASS: reload-server3 running connect-ssl-cert2-test ...... ok. PASS: connect-ssl-cert2-test PASS: cleanup-server3 stopping server 3 ... ok. PASS: stop-server3 =========================================== 1 of 26 tests failed Please report to ngircd-ml(a)ngircd.barton.de =========================================== make[1]: *** [Makefile:335: check-TESTS] Error 1 make[1]: Leaving directory '/var/tmp/portage/net-irc/ngircd-26/work/ngircd-26/src/testsuite' make: *** [Makefile:462: check-am] Error 2

2 1

ngIRCd Release 26~rc1
by Alexander Barton 11 Jun '20

11 Jun '20

Hello all! It's bee a while since our last release, ngIRCd 25 back in January 2019, but eventually we will have a next release "really soon" – at least compared to this time frame ;) Please welcome the 1st release candidate for ngIRCd 26! You can download ngIRCd 26~rc1 from the download section on our homepage at https://ngircd.barton.de (mirror: https://ngircd.sourceforge.io). The primary download locations are: • https://github.com/ngircd/ngircd/releases • https://ngircd.barton.de/pub/ngircd/ • https://ngircd.sourceforge.io/pub/ngircd/ Your help with testing ngIRCd 26~rc1 is highly appreciated! Please report any issues and glitches you find to this mailing list, the GitHub issue tracker (https://github.com/ngircd/ngircd/issues) or to the #ngircd channel on IRC: <irc://irc.barton.de/ngircd>. Enhancements and additions to the documentation, manual pages and the homepage are welcome as well! The easiest way to test ngIRCd is to run the ./contrib/platformtest.sh script which is included in the distribution archives, for example like this: $ curl -#LO "https://ngircd.barton.de/pub/ngircd/ngircd-26~rc1.tar.gz" $ tar xzf "ngircd-26~rc1.tar.gz" $ cd ngircd-26~rc1 $ ./contrib/platformtest.sh This will take a few minutes (4-5) as our test suite takes some time because of the "penalties" that the test clients have to cope with (the compile run itself is quite fast), and should result in a nice summary like this: > the executable works ("runs") as expected --+ > tests run successfully ("make check") --+ | > ngIRCd compiles ("make") --+ | | > ./configure works --+ | | | > | | | | > Platform Compiler ngIRCd Date Tester C M T R * > --------------------------- ------------ ---------- -------- -------- - - - - - > x86_64/pc/linux-gnu gcc 8.3.0 26~rc1 20-05-10 alex Y Y Y Y 1 The ChangeLog lists the following items for ngIRCd 26~rc1, since release 25 back in January 2019: • Tweak & update doc/HowToRelease.txt, .mailmap and AUTHORS files. • Allow up to 512 characters per line in MOTD and help text files (but keep in mind that lines can't get that long, because they have to be prefixed before being sent to the client). But this allows for more fancy MOTDs :-) Closes #271. • Show the actually allowed channel types in the ISUPPORT(005) numeric which are configured by the "AllowedChannelTypes" configuration variable. Closes #273. • Handle commands in the read buffer before reading more data and don't wait for the network in this case: If there are more bytes in the read buffer already than a single valid IRC command can get long (513 bytes), wait for this/those command(s) to be handled first and don't try to read even more data from the network (which most probably would overflow the read buffer of this connection soon). • Update Travis-CI configuration, "sudo" is deprecated • Log G-/K-Line changes only when not initiated by a server: this prevents the log from becoming spammed during "net bursts". • Update test suite to include SSL tests, including checking for reloading certificates during run time • Makefile.am: Replace "make" with "${MAKE}". This fixes warnings like this: "warning: jobserver unavailable: using -j1. Add `+' to parent make rule." Thanks to Sam James (sam_c) <sam(a)cmpct.info>! Closes #270. • Add support for GnuTLS certificate reload, which is quite handy when using Let's Encrypt, for example. Until now this was only supported when linked with OpenSSL. Thanks a lot, Hilko Bengen <bengen(a)hilluzination.de>! • Remove deprecated legacy configuration options and related functions that have been marked for removal for quite some time: • PredefChannelsOnly (v22) • NoticeAuth (v24) • NoXXX (v19) • Old '[GLOBAL]' section handling (v19) Thanks to Michi <michi+ngircd(a)dataswamp.org> for the patch! • Fix recursion bug on write errors: Depending on the stack size, too many clients on the same channel quitting at the same time would trigger a crash due to too many recursive calls to Conn_Close(). Thanks to Michi <michi+ngircd(a)dataswamp.org> for the patch! • Fix builds using GCC option -fno-common, which is the default starting with GCC 10. Thanks to Michi <michi+ngircd(a)dataswamp.org> for the patch! Closes #266. • Convert INSTALL and README files to Markdown. • Allow setting arbitrary channel modes in the configuration file by handling them like in MODE commands, and allow multiple "Modes =" lines per [Channel] section. Thanks to Michi <michi+ngircd(a)dataswamp.org>! Closes #55. • Add "FNC" (forced nick changes) to ISUPPORT(005) numeric. Most probably this doesn't make any difference to any client, but it seems correct. See <http://www.irc.org/tech_docs/005.html> for details. • Reuse old SSL key if loading a new one failed. • Remove outdated OpenBSD/NetBSD systrace.policy. • Enhance handling of command line errors, and return with exit code 0 ("no error") when "--help" or "--version" is used (which resulted in exit code 1, "error" before). Exit with code 2 ("command line error") for all other invalid command line options, and show the error message itself on stderr (instead of stdout and exit code 1, "generic error", as before). This new behavior is more in line with the GNU "coding standards", see <https://www.gnu.org/prep/standards/html_node/_002d_002dhelp.html>. • Fix and update Xcode project: Reference correct contrib/Makefile.am file, correctly sort contrib/nglog.sh and add "ORGANIZATIONNAME" setting. • contrib/ngindent.sh: Add more GNU indent options for better results, and add the ".sh" suffix to bring this script in line with the others in the contrib/ folder. • Add ./contrib/nglog.sh: This script parses the log output of ngircd(8), and colorizes the messages according to their log level. Example usage: ngircd -f $PWD/doc/sample-ngircd.conf -np | ./contrib/nglog.sh • Log received signals with their names using strsignal(3), when available. • Make test suite compatible with Haiku OS. • Fix host mask cloaking bug, don't cloak multiple times: Previously, each server would cloak every user's host mask. The problem is that if a network has more than one server, then a user's host mask would get cloaked twice. This patch ensures that a server only cloaks the host mask if it has not yet been cloaked (the period indicates it's still an IP address). Thanks to JRMU <jrmu(a)lecturify.com> for the patch! Closes #228. • Enlarge buffers of info texts to 128 bytes. This includes: • "Real name" of a client (4th filed of the USER command). • Server info text ("Info" configuration option). • Admin info texts and email address ("AdminInfo1", "AdminInfo2" and "AdminEmail" configuration options). • Network name ("Network" configuration option). The limit was 64 bytes before ... Closes #258. • Streamline handling of invalid and unset server name: Don't exit during runtime (REHASH command, HUP signal), because the server name can't be changed in this case anyway and the new invalid name will be ignored. • Fix and extend documentation: Fix some typos, fix syntax of LINKS and LIST commands, whitespace and spelling fixes, update dependencies and add some more information about IRCv3 support. Thanks to Thanks Windree, Étienne Mollier <etienne.mollier(a)mailoo.org> and Christoph Biedl <debian.axhn(a)manchmal.in-ulm.de>. Closes #264. • Slightly reorder startup steps, and enhance logging: • Show name of configuration file at the beginning of start up. • Add a message when ngIRCd is ready, including its host name. • Show name of configuration file on REHASH (SIGHUP), too. • Change level of "done message" to NOTICE, like "starting" & "ready". • Initialize IO functions before channels, connections, clients, ... • configure.ng: OpenSSL can depends on lz or latomic so use pkg-config to find those dependencies and fallback to existing mechanism. Closes #256. • ngircd.conf.5: Fix wording as suggested by lintian. Thanks a lot to all contributors & testers! Stay safe and have fun! Alex

1 1

about ngircd.conf file
by Shailendra K Garg 07 Jun '20

07 Jun '20

Sir, if ngircd is chrooted to /var/ngircd then what are changes made to ngircd.conf files are acceptable by rehasing ? i tried to change nicklen, it didnt accept though i cud restart ngircd to change nicklen could u be kind to answer my question ? Thanks & regards -- Using Opera's mail client: http://www.opera.com/mail/

2 1

Bug report: clients disconnected upon WHO
by jrmu 06 Mär '20

06 Mär '20

Greetings, Testah / Koragg has discovered a bug (at least using the default config on openbsd) that causes ngircd to disconnect clients. If you type /who #channel on a large channel (say with 500 users), ngircd immediately terminates the connection with this error: Write buffer space exhausted (connection 84, limit is 32768 bytes, 96 bytes new, 32719 bytes pending) I have managed to reproduce it consistently, and have concluded now that this is at least one cause for irccloud being unable to conect to my network. jrmu IRCNow

1 0

SSL error with IRCCloud
by jrmu 27 Jan '20

27 Jan '20

Greetings, I have a user connected who attempts to connect to ngircd using IRCCloud, but she gets disconnected after about 60 seconds. Here is the error message I see in /var/log/messages: Jan 26 04:37:57 irc1 ngircd[]: User "nick!uid15@9ec26277" unregistered (connection 87): Write error. Jan 26 04:38:26 irc1 ngircd[]: SSL protocol error: SSL_accept (error:140260FC:SSL routines:ACCEPT_SR_CLNT_HELLO:unknown protocol) Jan 26 04:38:26 irc1 ngircd[]: Client unregistered (connection 87): SSL accept error, closing socket. Jan 26 04:40:32 irc1 ngircd[]: User "nick!~uid15@9ec26277" registered (connection 87). I am running ngIRCd 25~10-ge954b59d-CHARCONV+IDENT+IPv6+IRCPLUS+SSL+SYSLOG+ZLIB-x86_64/unknown/openbsd6.5 I can't see any further error logs on my side, so I was hoping one of the developers could contact #irccloud on freenode and speak with the lead developer jwheare. The user says she can't see any further error logs on her side. I am using OpenSSL, I think, on OpenBSD 6.5. jrmu

2 2

ngircd-25 on SGI IRIX 6.5
by Götz Hoffart 29 Dez '19

29 Dez '19

IRIS-01 24% contrib/platformtest.sh $(basename contrib/platformtest.sh): Checking ngIRCd base source directory ... $(basename contrib/platformtest.sh): ngIRCd base source directory not found!? IRIS-01 25% pwd /usr/people/allerb/ngircd-25 IRIS-01 26% uname -a IRIX64 IRIS-01 6.5 07202013 IP27 IRIS-01 27% echo $SHELL /bin/csh ~~~~~~~~~ IRIS-01 35% ./configure ngIRCd 25 has been configured with the following options: Host: mips-sgi-irix6.5 Compiler: cc -c99 Compiler flags: -g -DSYSCONFDIR='"$(sysconfdir)"' -DDOCDIR='"$(docdir)"' Libraries: -lz 'ngircd' binary: /usr/local/sbin Configuration file: /usr/local/etc Manual pages: /usr/local/share/man Documentation: /usr/local/share/doc/ngircd Syslog support: yes Enable debug code: no zlib compression: yes IRC sniffer: no Use TCP Wrappers: no Strict RFC mode: no IDENT support: no IRC+ protocol: yes IPv6 protocol: no I/O backend: /dev/poll PAM support: no SSL support: no libiconv support: no IRIS-01 35% make […] ld32: WARNING 15 : Multiply defined:(Conf_MaxConnectionsIP) in ngircd.o and channel.o (2nd definition ignored). ld32: WARNING 15 : Multiply defined:(Conf_MaxNickLength) in ngircd.o and channel.o (2nd definition ignored). ld32: WARNING 15 : Multiply defined:(Conf_MaxListSize) in ngircd.o and channel.o (2nd definition ignored). ld32: WARNING 15 : Multiply defined:(Conf_MaxPenaltyTime) in ngircd.o and channel.o (2nd definition ignored). ld32: WARNING 15 : Multiply defined:(Conf_AuthPing) in ngircd.o and channel.o (2nd definition ignored). ld32: WARNING 15 : Multiply defined:(Conf_SyslogFacility) in ngircd.o and channel.o (2nd definition ignored). ld32: Giving up after printing 50 warnings. Use -wall to print all warnings. Making all in testsuite Making all in man GEN ngircd.conf.5 GEN ngircd.8 Making all in contrib Making all in Debian Making all in MacOSX Making all in ngIRCd.xcodeproj Making all in ngIRCd.pmdoc IRIS-01 35% src/ngircd/ngircd --help ngIRCd 25-IRCPLUS+SYSLOG+ZLIB-mips/sgi/irix6.5 Copyright (c)2001-2019 Alexander Barton (<alex(a)barton.de>) and Contributors. Homepage: <http://ngircd.barton.de/> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. -f, --config <f> use file <f> as configuration file -n, --nodaemon don't fork and don't detach from controlling terminal -p, --passive disable automatic connections to other servers -t, --configtest read, validate and display configuration; then exit -V, --version output version information and exit -h, --help display this help and exit

1 0

ngircd patch for censor module
by jrmu 21 Okt '19

21 Okt '19

Greetings po||ux, Here is the patch. Sorry it is a bit messy. I was not able to figure out how to edit the autoconf files so I just edited the makefile directly to add the libpcre library: Only in ngircd/src/ngircd: censor.c /* Copyright (C) 2019 by jrmu <jrmu(a)lecturify.com> Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted. This software is offered as-is, without any warranty. */ #include <stdio.h> #include <string.h> #include <stdlib.h> #include <pcre.h> #define OVECCOUNT 30 /* should be a multiple of 3 */ /** * Indicates whether a message matches a list of regular expressions. * * @param msg The message to test * @param msg_len The length of msg * @param re An array of compiled regular expressions * @param re_len The length of re * @param out The matched string to return or NULL * @return Boolean for whether the message should be censored. */ bool censor(char *msg, size_t msg_len, pcre **re, size_t re_len, char *match) { int rc; int ovector[OVECCOUNT]; /* actual length needed because pcre_exec scans past \0 */ int len = strnlen(msg, msg_len); for (unsigned int i = 0; i < re_len && re[i]; i++) { rc = pcre_exec(re[i], NULL, msg, len, 0, 0, ovector, OVECCOUNT); if (rc >= 0) { strlcpy(match, msg+ovector[0], ovector[1]-ovector[0]+1); return true; } } return false; } diff -ru ngircd-barton/src/ngircd/client.c ngircd/src/ngircd/client.c --- ngircd-barton/src/ngircd/client.c Wed Sep 4 00:28:34 2019 +++ ngircd/src/ngircd/client.c Mon Sep 16 07:57:43 2019 @@ -337,7 +337,9 @@ assert(Client != NULL); assert(Hostname != NULL); - if (Conf_CloakHost[0]) { + /* Only cloak the hostmask if it has not yet been cloaked (the period + * indicates it's still an IP address). */ + if (Conf_CloakHost[0] && strchr(Client->host, '.')) { char cloak[GETID_LEN]; strlcpy(cloak, Hostname, GETID_LEN); diff -ru ngircd-barton/src/ngircd/client.h ngircd/src/ngircd/client.h --- ngircd-barton/src/ngircd/client.h Wed Sep 4 00:28:34 2019 +++ ngircd/src/ngircd/client.h Mon Sep 16 07:57:43 2019 @@ -27,7 +27,7 @@ #define CLIENT_UNKNOWNSERVER 0x0080 /* unregistered server connection */ #define CLIENT_GOTPASS_2813 0x0100 /* client did send PASS, RFC 2813 style */ #ifndef STRICT_RFC -# define CLIENT_WAITAUTHPING 0x0200 /* waiting for AUTH PONG from client */ +#define CLIENT_WAITAUTHPING 0x0200 /* waiting for AUTH PONG from client */ #endif #define CLIENT_WAITCAPEND 0x0400 /* waiting for "CAP END" command */ #define CLIENT_ANY 0xFFFF diff -ru ngircd-barton/src/ngircd/conf.c ngircd/src/ngircd/conf.c --- ngircd-barton/src/ngircd/conf.c Wed Sep 4 00:28:34 2019 +++ ngircd/src/ngircd/conf.c Mon Sep 16 12:22:32 2019 @@ -68,6 +68,8 @@ char *Var, char *Arg )); static void Handle_CHANNEL PARAMS((const char *File, int Line, char *Var, char *Arg )); +static void Handle_CENSOR PARAMS((const char *File, int Line, + char *Var, char *Arg )); static void Config_Error PARAMS((const int Level, const char *Format, ...)); @@ -332,6 +334,8 @@ bool config_valid; size_t predef_channel_count; struct Conf_Channel *predef_chan; + size_t predef_censor_count; + struct Conf_Censor *predef_censor; Use_Log = false; @@ -388,7 +392,7 @@ printf(" MaxConnectionsIP = %d\n", Conf_MaxConnectionsIP); printf(" MaxJoins = %d\n", Conf_MaxJoins > 0 ? Conf_MaxJoins : -1); printf(" MaxNickLength = %u\n", Conf_MaxNickLength - 1); - printf(" MaxPenaltyTime = %ld\n", Conf_MaxPenaltyTime); + printf(" MaxPenaltyTime = %lld\n", Conf_MaxPenaltyTime); printf(" MaxListSize = %d\n", Conf_MaxListSize); printf(" PingTimeout = %d\n", Conf_PingTimeout); printf(" PongTimeout = %d\n", Conf_PongTimeout); @@ -490,6 +494,17 @@ printf(" KeyFile = %s\n\n", predef_chan->keyfile); } + predef_censor_count = array_length(&Conf_Censors, sizeof(*predef_censor)); + predef_censor = array_start(&Conf_Censors); + + for (i = 0; i < predef_censor_count; i++, predef_censor++) { + if (!predef_censor->file) + continue; + puts( "[CENSOR]" ); + printf(" File = %s\n\n", predef_censor->file); + } + /* "Censor" section */ + return (config_valid ? 0 : 1); } @@ -757,7 +772,7 @@ strlcat(Conf_HelpFile, HELP_FILE, sizeof(Conf_HelpFile)); strcpy(Conf_ServerPwd, ""); strlcpy(Conf_PidFile, PID_FILE, sizeof(Conf_PidFile)); - Conf_UID = Conf_GID = 0; + Conf_UID = Conf_GID = 703; /* Limits */ Conf_ConnectRetry = 60; @@ -818,7 +833,6 @@ Conf_SyslogFacility = 0; #endif #endif - /* Initialize server configuration structures */ if (InitServers) { for (i = 0; i < MAX_SERVERS; @@ -901,6 +915,12 @@ int i, n; FILE *fd; DIR *dh; + size_t predef_censor_count; + struct Conf_Censor *predef_censor; + const char *error; + int line = 0; + char filters[LINE_LEN][LINE_LEN]; + int erroffset; Log(LOG_INFO, "Using configuration file \"%s\" ...", NGIRCd_ConfFile); @@ -1049,6 +1069,41 @@ Conf_SSLOptions.CipherList = strdup_warn(DEFAULT_CIPHERS); #endif + /* Load censor files */ + predef_censor_count = array_length(&Conf_Censors, sizeof(*predef_censor)); + predef_censor = array_start(&Conf_Censors); + + for (unsigned int i = 0; i < predef_censor_count; i++, predef_censor++) { +// LogDebug("\n\nCensor file: %s\n", predef_censor->file); + if (predef_censor->file) { + fd = fopen(predef_censor->file, "r"); + if (fd) { + while (fgets(filters[line], LINE_LEN, fd)) { + ngt_TrimLastChr(filters[line], '\n'); + line++; + } + fclose(fd); + pcre **re = calloc(sizeof(pcre *), line); + if (!re) { + Config_Error(LOG_ERR, "Can't allocate memory for censor rules"); + break; + } + for (int i = 0; i < line; i++) { + re[i] = pcre_compile(filters[i], PCRE_CASELESS, &error, &erroffset, NULL); + if (!re[i]) { + Config_Error(LOG_ERR, "Can't compile censor rules"); + break; + } + LogDebug("Line: %d, Filter: %s, Re: %p", i, filters[i], re[i]); + } + predef_censor->re = re; + predef_censor->len = line; + } else { + Config_Error(LOG_ERR, "Can't read %s", predef_censor->file); + } + } + } + /* Censor filters */ return true; } @@ -1150,6 +1205,18 @@ continue; } + if (strcasecmp(section, "[CENSOR]") == 0) { + count = array_length(&Conf_Censors, + sizeof(struct Conf_Censor)); + if (!array_alloc(&Conf_Censors, + sizeof(struct Conf_Censor), count)) { + Config_Error(LOG_ERR, + "Could not allocate memory for new censor (line %d)", + line); + } + continue; + } + Config_Error(LOG_ERR, "%s, line %d: Unknown section \"%s\"!", File, line, section); @@ -1187,6 +1254,8 @@ Handle_SERVER(File, line, var, arg); else if (strcasecmp(section, "[CHANNEL]") == 0) Handle_CHANNEL(File, line, var, arg); + else if (strcasecmp(section, "[CENSOR]") == 0) + Handle_CENSOR(File, line, var, arg); else Config_Error(LOG_ERR, "%s, line %d: Variable \"%s\" outside section!", @@ -1646,7 +1715,7 @@ return; } if (strcasecmp(Var, "MaxPenaltyTime") == 0) { - Conf_MaxPenaltyTime = atol(Arg); + Conf_MaxPenaltyTime = atoll(Arg); if (Conf_MaxPenaltyTime < -1) Conf_MaxPenaltyTime = -1; /* "unlimited" */ return; @@ -2193,6 +2262,40 @@ } /** + * Handle variable in [CENSOR] configuration section. + * + * @param Line Line number in configuration file. + * @param Var Variable name. + * @param Arg Variable argument. + */ +static void +Handle_CENSOR(const char *File, int Line, char *Var, char *Arg) +{ + size_t len; + struct Conf_Censor *censor; + + assert( File != NULL ); + assert( Line > 0 ); + assert( Var != NULL ); + assert( Arg != NULL ); + + censor = array_get(&Conf_Censors, sizeof(*censor), + array_length(&Conf_Censors, sizeof(*censor)) - 1); + if (!censor) + return; + + if (strcasecmp(Var, "File") == 0) { + /* Censor file */ + len = strlcpy(censor->file, Arg, sizeof(censor->file)); + if (len >= sizeof(censor->file)) + Config_Error_TooLong(File, Line, Var); + return; + } + + Config_Error_Section(File, Line, Var, "Censor"); +} + +/** * Validate server configuration. * * Please note that this function uses exit(1) on fatal errors and therefore @@ -2280,8 +2383,8 @@ if (Conf_MaxPenaltyTime != -1) Config_Error(LOG_WARNING, - "Maximum penalty increase ('MaxPenaltyTime') is set to %ld, this is not recommended!", - Conf_MaxPenaltyTime); + "Maximum penalty increase ('MaxPenaltyTime') is set to %lld, this is not recommended!", + (long long)Conf_MaxPenaltyTime); #ifdef DEBUG servers = servers_once = 0; diff -ru ngircd-barton/src/ngircd/conf.h ngircd/src/ngircd/conf.h --- ngircd-barton/src/ngircd/conf.h Wed Sep 4 00:28:34 2019 +++ ngircd/src/ngircd/conf.h Mon Sep 16 07:57:43 2019 @@ -27,6 +27,8 @@ #include "proc.h" #include "conf-ssl.h" +#include <pcre.h> + /** * Configured IRC operator. * Please note that the name of the IRC operaor and his nick have nothing to @@ -101,7 +103,7 @@ /** Server info text */ GLOBAL char Conf_ServerInfo[CLIENT_INFO_LEN]; -/** Global server passwort */ +/** Global server password */ GLOBAL char Conf_ServerPwd[CLIENT_PASS_LEN]; /** Administrative information */ @@ -283,8 +285,16 @@ GLOBAL void Conf_DebugDump PARAMS((void)); #endif +/** Censorship rules, one per file */ +struct Conf_Censor { + char file[FNAME_LEN]; /** File path */ + pcre **re; /** Patterns to match against */ + size_t len; /** length of regex patterns array */ +}; -#endif +/** Array of censorship rules */ +GLOBAL array Conf_Censors; +#endif /* -eof- */ diff -ru ngircd-barton/src/ngircd/irc.c ngircd/src/ngircd/irc.c --- ngircd-barton/src/ngircd/irc.c Wed Sep 4 00:28:34 2019 +++ ngircd/src/ngircd/irc.c Mon Sep 16 11:27:55 2019 @@ -38,6 +38,7 @@ #include "op.h" #include "irc.h" +#include "censor.c" static char *Option_String PARAMS((CONN_ID Idx)); static bool Send_Message PARAMS((CLIENT *Client, REQUEST *Req, int ForceType, @@ -511,6 +512,7 @@ #endif } /* Option_String */ + /** * Send a message to target(s). * @@ -534,6 +536,12 @@ char *message = NULL; char *targets[MAX_HNDL_TARGETS]; int i, target_nr = 0; + size_t predef_censor_count; + struct Conf_Censor *predef_censor; + char match[COMMAND_LEN]; + char msg[COMMAND_LEN]; + pcre **re; + int re_len; assert(Client != NULL); assert(Req != NULL); @@ -572,6 +580,26 @@ #endif message = Req->argv[1]; + /* Check censorship rules */ + + predef_censor_count = array_length(&Conf_Censors, sizeof(*predef_censor)); + predef_censor = array_start(&Conf_Censors); + + if (strlcpy(msg, message, COMMAND_LEN) >= COMMAND_LEN) { + LogDebug("Error copying message!"); + } else { + for (unsigned int i = 0; i < predef_censor_count; i++, predef_censor++) { + re = predef_censor->re; + re_len = predef_censor->len; + if (re && censor(msg, COMMAND_LEN, re, re_len, match)) { + LogDebug("Message: %s, match: %s", msg, match); + snprintf(msg, COMMAND_LEN, "Your message to %s was dropped because it contains profanity or spam: %s. If this is an error, please report it in #help.", currentTarget, match); + currentTarget = Client_ID(Client); + message = msg; + break; + } + } + } /* handle msgtarget = msgto *("," msgto) */ currentTarget = strtok_r(currentTarget, ",", &strtok_last); ngt_UpperStr(Req->command); diff -ru ngircd-barton/src/ngircd/ngircd.c ngircd/src/ngircd/ngircd.c --- ngircd-barton/src/ngircd/ngircd.c Wed Sep 4 00:28:34 2019 +++ ngircd/src/ngircd/ngircd.c Mon Sep 16 07:57:43 2019 @@ -560,7 +560,7 @@ #if !defined(SINGLE_USER_OS) /** - * Get user and group ID of unprivileged "nobody" user. + * Get user and group ID of unprivileged "_ngircd" user. * * @param uid User ID * @param gid Group ID @@ -584,7 +584,7 @@ } #endif - pwd = getpwnam("nobody"); + pwd = getpwnam("_ngircd"); if (!pwd) return false; @@ -700,11 +700,11 @@ if (Conf_UID == 0) { pwd = getpwuid(0); Log(LOG_INFO, - "ServerUID must not be %s(0), using \"nobody\" instead.", + "ServerUID must not be %s(0), using \"_ngircd\" instead.", pwd ? pwd->pw_name : "?"); if (!NGIRCd_getNobodyID(&Conf_UID, &Conf_GID)) { Log(LOG_WARNING, - "Could not get user/group ID of user \"nobody\": %s", + "Could not get user/group ID of user \"_ngircd\": %s", errno ? strerror(errno) : "not found" ); goto out; } Only in /etc/ngircd: profanity \b(smart|fat|dumb|big)?(ass|arse)(hol|whol)?e?s?\b bastard \bbdsm\b bitch blow\s?job bollock \bboners?\b \bboo+b(ies|s)?\b \bbugger(ed|ing)?s?\b butt(w?hole|plug) \bcirclejerk \bclit(s)?\b \bcock(s|suck.*)?\b \bcrap(py|ped|ping|per|tastic)?\b \b[ck]um(mer|ming|shot)?s?\b [ck]un+il+ingus \b[c|k]unt(s|lick.*)?\b \b(god-?)?damn \bdick (tele)?dildo \bdykes?\b eja[ck]ulat.* \b(dumb|nazi)?fag+(ot)?(it+)?s?\b \bfap(ping|pening|ed)?s?\b fellat(e|io) \bfook(er)?s?\b \b(m[ou]ther|m[ou]tha|father|sister|goat|cyber|finger|fist)?fuc?k+ fuc?k+(a|er|in|ing|ed|wad|head|off|whit)?s?\b \bfcuk(er|ing)?\b fudge\s*packers? \bfux(or)?s?\b gang\s*bang gay\s*(slave|lords?|sex) g[eo]t(ting|ten)? laid (phone|hot|core|\banal|\boral)\s*sex \bhorn(y|iest) (jack|jerk)\-*\s*off \bjizz jizz\b \bkock(suck.*)?s?\b \blady\s*boys? lmf?ao\b mast[eu]rbat \bmofos?\b \bnigg(er|a)(s|z)?\b nutsacks? \bphu(ck|q)(ed|ing|ked)?s?\b \bpiss(ed|ing|in|es|er|ers|off)?\b \bpuss(e|y|ys|ies)\b \bretard(ed)?s?\b \brim(ming|job)?s?\b \bscrewing\b \bshag(ging)?\b \bshe\-*males? \bshit|shit\b \bskank(y|s)?\b \bslut(ty|ting|s)?\b \btit+(s|y|ies|wank|ywank)\b \btwat(head|ty)?\b \bturds?\b \bwank(y|er)?s?\b \b(cam)?whor(e|ing)?(house)?s?\b \bwtf\b shibboleth /etc/ngircd/ngircd.conf: [Censor] File = /etc/ngircd/profanity jrmu

1 0

IRC+ Spec
by jrmu 09 Sep '19

09 Sep '19

Greetings po||ux , I am working right now on a pcre filter. So far I tested it and I managed to kludge something together that can filter out privmsgs I also have a set of bad words filters and spam filters you can use as default, I'd like to contribute that later once I get it polished. In the meantime, I wanted to ask you, I am very interested in setting up a standard to directly compete with IRCv3 because I'm extremely frustrated with IRCv3. In general, that community doesn't care about making IRC usable for normal people. It seems to me they want to keep IRC for their own cliques so they can fight with bots and stroke their own ego. I saw you were working on IRC+ and I'd like to extend that and propose some specs and begin implementing them right away in ngircd. I've discussed with the psybnc community and they are interested in having me either maintain the code or fork the project. God willing, I want to code many of the mobile-friendly features into psybnc that I had discussed earlier. Here are the features I want to achieve from IRC+: 1) Recipient confirmations when a message is delivered 2) Better support for mobile clients that have frequent disconnections 3) Standardized, in-band file upload (no web browser needed) 4) Audio/video streaming in a way that is fully compatible with SIP 5) Message sync across irc clients on multiple devices 6) HTTP tunneling to bypass firewalls 7) Buddy lists 8) Standardized registration interface As far as I can tell, none of these critical features are being addressed by the IRCv3 team. The domain name ircplus.org seems available. I'd like to purchase it and call this spec IRC+. I'd like to start with your protocol plus add the above extensions. Since you used the name first, I believe you own it and so I wanted to ask for your blessing. Are you OK with me proceeding? I will contribute code and specs under a BSD-like license (https://lecturify.com/license.html), it will all be open and freely redistributable. jrmu

1 0

ngIRCd 25 on Mac OS X 10.4.11 / PowerPC
by Götz Hoffart 08 Sep '19

08 Sep '19

the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - powerpc/apple/darwin8.11.0 gcc 4.0.1 25 19-09-08 sysop Y Y Y Y 3 real 4m6.141s user 0m21.255s sys 0m23.724s Still running fine :-) Regards Götz

1 0

Hostmask bug?
by jrmu 04 Sep '19

04 Sep '19

Greetings po||ux, This is jrmu from IRC. So, I took a look at this issue: https://github.com/ngircd/ngircd/issues/228 OK po||ux , it's confirmed, the reason why the hashes aren't working is because ngircd hashes twice. Suppose I have 2 ngircd servers (X and Y) set up connected to each other. The salt is 9UdVFZOQszoWpvLAIXSvqF. On server X I use telnet to connect to 127.0.0.1 port 6667. So the hostmask is 127.0.0.1, and the salt is appended to get the string 127.0.0.19UdVFZOQszoWpvLAIXSvqF. This is hashed to give fde34f9b on the other server, the hostmask is fde34f9b. The salt 9UdVFZOQszoWpvLAIXSvqF is appended to give the string fde34f9b9UdVFZOQszoWpvLAIXSvqF, this is then hashed to give 93973dfb. So on server X, the hostmask is fde34f9b, and on server Y the hostmask is 93973dfb. What needs to be done is server Y must not hash the hostmask a 2nd time, and just pass through as is. The question now is, when a new user connects to X, should server X broadcast the uncloaked IP address and let server Y cloak it again; or should server X broadcast the cloaked IP and server Y should *not* cloak? I have a fix using the 2nd solution (server Y does not cloak): https://github.com/ngircd/ngircd/blob/master/src/ngircd/client.c line 340 I change the line to read: if (Conf_CloakHost[0] && strchr(Client->host, '.')) { That appears to solve the bug. I tested it and it seems to be working on my side. If you want demo servers to verify, just PM me on IRC. Now the hostmask renders properly before cloaking a host, the server will check to see if there is a period in the hostname, if so it has not yet been cloaked; if there is no ., it has already been cloaked and there's no need to cloak a second time. jrmu

2 2

Hostmask bug?
by jrmu 30 Aug '19

30 Aug '19

Greetings po||ux, This is jrmu from IRC. So, I took a look at this issue: https://github.com/ngircd/ngircd/issues/228 OK po||ux , it's confirmed, the reason why the hashes aren't working is because ngircd hashes twice. Suppose I have 2 ngircd servers (X and Y) set up connected to each other. The salt is 9UdVFZOQszoWpvLAIXSvqF. On server X I use telnet to connect to 127.0.0.1 port 6667. So the hostmask is 127.0.0.1, and the salt is appended to get the string 127.0.0.19UdVFZOQszoWpvLAIXSvqF. This is hashed to give fde34f9b on the other server, the hostmask is fde34f9b. The salt 9UdVFZOQszoWpvLAIXSvqF is appended to give the string fde34f9b9UdVFZOQszoWpvLAIXSvqF, this is then hashed to give 93973dfb. So on server X, the hostmask is fde34f9b, and on server Y the hostmask is 93973dfb. What needs to be done is server Y must not hash the hostmask a 2nd time, and just pass through as is. The question now is, when a new user connects to X, should server X broadcast the uncloaked IP address and let server Y cloak it again; or should server X broadcast the cloaked IP and server Y should *not* cloak? I have a fix using the 2nd solution (server Y does not cloak): https://github.com/ngircd/ngircd/blob/master/src/ngircd/client.c line 340 I change the line to read: if (Conf_CloakHost[0] && strchr(Client->host, '.')) { That appears to solve the bug. I tested it and it seems to be working on my side. If you want demo servers to verify, just PM me on IRC. Now the hostmask renders properly before cloaking a host, the server will check to see if there is a period in the hostname, if so it has not yet been cloaked; if there is no ., it has already been cloaked and there's no need to cloak a second time. jrmu

1 0

ngIRCd 25 on NetBSD 8 on mipsel / Cobalt Qube2 👏🏻
by Götz Hoffart 09 Aug '19

09 Aug '19

250 MHz R5200 MIPS CPU, 64 MB RAM, IDE harddisc … # time ./configure ngIRCd 25 has been configured with the following options: Host: mipsel-unknown-netbsd8.0 Compiler: gcc Compiler flags: -g -O2 -pipe -W -Wall -Wpointer-arith -Wstrict-prototypes -fstack-protector -DSYSCONFDIR='"$(sysconfdir)"' -DDOCDIR='"$(docdir)"' Libraries: -lz 'ngircd' binary: /usr/local/sbin Configuration file: /usr/local/etc Manual pages: /usr/local/share/man Documentation: /usr/local/share/doc/ngircd Syslog support: yes Enable debug code: no zlib compression: yes IRC sniffer: no Use TCP Wrappers: no Strict RFC mode: no IDENT support: no IRC+ protocol: yes IPv6 protocol: no I/O backend: kqueue() PAM support: no SSL support: no libiconv support: no 372.42 real 219.75 user 119.73 sys # uname -a NetBSD galinastarowoitowa.3rz.de 8.0 NetBSD 8.0 (GENERIC) #0: Tue Jul 17 14:59:51 UTC 2018 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/cobalt/compile/GENERIC cobalt # gcc --version gcc (nb2 20180327) 5.5.0 # time ./contrib/platformtest.sh the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - mipsel/unknown/netbsd8.0 gcc 5.5.0 25 19-08-09 root Y Y y Y 3 WARNING: Some tests have been skipped! Please double check that the ngIRCd daemon starts up, runs and handles IRC connections successfully! 385.38 real 240.10 user 129.03 sys https://twitter.com/3rz_de/status/1159588288614850565

1 0

ngIRCd Release 25
by Alexander Barton 25 Jan '19

25 Jan '19

Hello ngIRCd'ers! Exactly two years have passed since ngIRCd release 24 in January 2017, and since then, some bug fixes and minor new feature enhancements have accumulated. So here we go, please welcome the next stable version of ngIRCd, the free, portable and lightweight Internet Relay Chat server for small or private networks: ngIRCd Release 25! You can download ngIRCd from the download section on our homepage at https://ngircd.barton.de (mirror: http://ngircd.sourceforge.net), the primary download locations are: • https://github.com/ngircd/ngircd/releases • https://ngircd.barton.de/pub/ngircd/ • http://ngircd.sourceforge.net/pub/ngircd/ The NEWS file (which you can find at https://ngircd.barton.de/doc/NEWS) lists the following changes since the last stable release • Implement new configuration option "MaxPenaltyTime", which configures the maximum penalty time increase in seconds, per penalty event. Set to -1 for no limit (the default), 0 to disable penalties altogether. ngIRCd doesn't use penalty increases higher than 2 seconds during normal operation, so values higher than 1 rarely make sense. Disabling (or reducing) penalties can greatly speed up "make check" runs for example, see below, but are mostly a debugging feature and normally not meant to be used on production systems! Some example timings running "make check" from my macOS workstation: - MaxPenaltyTime not set: 4:41,79s - "MaxPenaltyTime = 1": 3:14,71s - "MaxPenaltyTime = 0": 25,46s Closes #249 and #251. • Update Xcode project for latest Xcode version (10.0) • Allow a 5th parameter in WEBIRC. Thanks to "ItsOnlyBinary". Closes #247. • Only send TOPIC updates to a channel when the topic actually changed: This prevents the channel from becoming flooded by unnecessary TOPIC update messages, that can happen when IRC services try to enforce a certain topic but which is already set (at least on the local server), for example. Therefore still forward it to all servers, but don't inform local clients (still update setter and timestamp information, though!). • Update Xcode project for latest Xcode version (9.2). This includes adding missing and deleting obsolete file references. • Handle user mode "C" ("Only users that share a channel are allowed to send messages") like user mode "b" ("block private messages and notices"): allow messages from servers, services, and IRC Operators, too. Change proposed by "wowaname" back in 2015 in #ngircd, thanks! • Allow IRC Ops and remote servers to KILL service clients: such clients behave like regular users, therefore IRC operators and servers should be able to KILL them: for example to resolve nick collisions. Closes #242. Please see the ChangeLog (https://ngircd.barton.de/doc/ChangeLog) for a complete list of all changes, or even read the Git commit history at GitHub (https://github.com/ngircd/ngircd) -- there you can find the our issue tracker as well. Have fun! Alex

1 0

ngIRCd Release 25~rc1
by Alexander Barton 29 Aug '18

29 Aug '18

Hello ngIRCd users! A very long time has passed since our last release, more than 1.5 years. But finally I managed to prepare the "release candidate 1" for the next version, which will be ngIRCd 25, our lightweight and portable Internet Relay Chat server for small and private networks. I started by tagging the source code in Git, creating the archive files and uploading them to GitHub and the mirrors, and then "forgot" to write the announcement here... but finally, here we go! But please don't be surprised that the dates in the NEWS and ChangeLog files are already a little bit older ... You can download this release candidate from the download section on our homepage <https://ngircd.barton.de> (<https://ngircd.mirror.3rz.org>) and GitHub. The primary download locations are: • https://github.com/ngircd/ngircd/releases • https://ngircd.barton.de/pub/ngircd • https://ngircd.mirror.3rz.org/pub/ngircd Please help test this release candidate, and report any issues you find to this mailing list or on IRC: <irc://irc.barton.de/ngircd>. Enhancements to the documentation and the homepage are welcome, too! The easiest way to test ngIRCd is to run the ./contrib/platformtest.sh script: $ curl -#LO "https://ngircd.barton.de/pub/ngircd/ngircd-25~rc1.tar.gz" $ tar xzf "ngircd-25~rc1.tar.gz" $ cd ngircd-25~rc1 $ ./contrib/platformtest.sh This script runs quire some time, which is normal, but please report all problems! The result should look something like this: > the executable works ("runs") as expected --+ > tests run successfully ("make check") --+ | > ngIRCd compiles ("make") --+ | | > ./configure works --+ | | | > | | | | > Platform Compiler ngIRCd Date Tester C M T R * > -------------------- ---------- -------- -------- -------- - - - - - > x86_64/pc/linux-gnu gcc 6.3.0 25~rc1 18-08-29 alex Y Y Y Y 1 Please feel free to use the issue tracker on GitHub and/or create "pull requests" there, so we can easily keep track of them: • https://github.com/ngircd/ngircd • https://github.com/ngircd/ngircd/issues The ChangeLog lists the following items since release 24: • Update config.guess (2018-03-08) and config.sub (2018-03-08) files. • Correctly retry to establish an outgoing connections when forking of the resolver sub-process failed (for example because of lack of free memory). Until now, such a connection was never retried once this error was hit. Thanks to Robert Obermeier for reporting this bug! Closes #243. • Fix a "use after free" bug which can be triggered on a newly established connection when the daemon handles an ERROR command received from the peer during client login. Thanks a lot to Joseph Bisch <joseph.bisch(a)gmail.com> for discovering and reporting this issue! • Only send TOPIC updates to a channel when the topic actually changed: This prevents the channel from becoming flooded by unnecessary TOPIC update messages, that can happen when IRC services try to enforce a certain topic but which is already set (at least on the local server), for example. Therefore still forward it to all servers, but don't inform local clients (still update setter and timestamp information, though). • Update Xcode project for latest Xcode version (9.2). This includes adding missing and deleting obsolete file references. • Handle user mode "C" ("Only users that share a channel are allowed to send messages") like user mode "b" ("block private messages and notices"): allow messages from servers, services, and IRC Operators, too. Change proposed by "wowaname" back in 2015 in #ngircd, thanks! • Fix some compiler warnings. • Add contrib/ngircd.logcheck: Some sample logcheck(8) rules. • Allow IRC Ops and remote servers to KILL service clients: such clients behave like regular users, therefore IRC operators and servers should be able to KILL them: for example to resolve nick collisions. Closes #242. • Don't forward KILLs to other servers if they've been blocked locally: This prevents clients from killing IRC services, for example. Closes #238 and #239. • Fix a cross-compiler issue related to the Get_Error() function. Closes #240 and #241. • Update ./doc/Services.txt, enhance configuration examples. Thanks a lot to all contributors! Ah, and sorry Götz: I forgot to merge your updates to the Platforms.txt file for this release candidate, oh my! But I already merged it into "master" a few seconds ago, so that it will definitely be included in the final release. Alex

1 0

Make all channels permanent, by default?
by Duncan Bayne 25 Mär '18

25 Mär '18

Hi All, I'm trying to use ngircd in such a manner that all channels are: (a) persisted by default, even if created by non-privileged users, and (b) persisted between restarts of the daemon >From reading the docs I gather (b) 'just happens' with +P, but I have no idea how to achieve (a). Could someone please point me at the relevant documentation? Thanks :) -- Duncan Bayne +61 420 817 082 | https://duncan.bayne.id.au/ I usually check my mail every 24 - 48 hours. If there's something urgent going on, please send me an SMS or call me.

3 11

ngIRCd 24 on WSL / Ubuntu on Win10
by Götz Hoffart 11 Mär '18

11 Mär '18

This is Windows 10 (1709/Creator’s Update) with ‘Windows Subsystem for Linux’ (WSL), and Ubuntu on top, compiling ngIRCd in my Windows home folder: ngIRCd 24 has been configured with the following options: Host: x86_64-pc-linux-gnu Compiler: gcc Compiler flags: -g -O2 -pipe -W -Wall -Wpointer-arith -Wstrict-prototypes -fstack-protector -DSYSCONFDIR='"$(sysconfdir)"' -DDOCDIR='"$(docdir)"' 'ngircd' binary: /usr/local/sbin Configuration file: /usr/local/etc Manual pages: /usr/local/share/man Documentation: /usr/local/share/doc/ngircd Syslog support: yes Enable debug code: no zlib compression: no IRC sniffer: no Use TCP Wrappers: no Strict RFC mode: no IDENT support: no IRC+ protocol: yes IPv6 protocol: no I/O backend: epoll(), select() PAM support: no SSL support: no libiconv support: no platformtest.sh: Running "make" ... /mnt/c/Users/goetz/Downloads/ngircd-24/missing: line 52: autoheader: command not found WARNING: `autoheader' is missing on your system. You should only need it if you modified `acconfig.h' or `configure.ac'. You might want to install the `Autoconf' and `GNU m4' packages. Grab them from any GNU archive site. touch: cannot touch '[src/config.h].in': No such file or directory ar: `u' modifier ignored since `D' is the default (see `U') ar: `u' modifier ignored since `D' is the default (see `U') ar: `u' modifier ignored since `D' is the default (see `U') irc.c: In function ‘Option_String’: irc.c:491:9: warning: variable ‘options’ set but not used [-Wunused-but-set-variable] UINT16 options; ^ platformtest.sh: Running "make check" ... the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/pc/linux-gnu[*] gcc 5.4.0 24 18-03-07 goetz Y Y y Y 1 WARNING: Some tests have been skipped! Please double check that the ngIRCd daemon starts up, runs and handles IRC connections successfully! [*] WSL/Win10 $ uname -a Linux DESKTOP-1B0PG2S 4.4.0-43-Microsoft #1-Microsoft Wed Dec 31 14:42:53 PST 2014 x86_64 x86_64 x86_64 GNU/Linux

2 1

ngircd 24 for VoCore2 - mipsel/OpenWRT/uclibc
by Götz Hoffart 28 Jan '18

28 Jan '18

Hi, ngircd 24 runs on the VoCore2 mini computer (mipsel/OpenWRT/uclibc): http://vocore.io/v2.html <http://vocore.io/v2.html> Build system is Ubuntu 14.04 LTS x86_64 for cross-compiling, with the VoCore2/OpenWRT tools installed from <http://vocore.io/v2u.html <http://vocore.io/v2u.html>> -> Downloads -> Toolchain: Download (Ubuntu 14.04 x64). 1) Unpack the toolchain I unpacked these to ~/vocore2 and removed the "outer-shell" directories. 2) Prepare cross-build $ PATH=$PATH:/home/goetz/vocore2/bin $ export PATH $ STAGING_DIR=/home/goetz/vocore2/ $ export STAGING_DIR 3) Fix "resolve.c" Otherwise we’ll run into [1]: $ diff ngircd-24/src/ngircd/resolve-orig.c ngircd-24/src/ngircd/resolve.c 112,113d111 < #if !defined(HAVE_GETADDRINFO) || !defined(HAVE_GETNAMEINFO) < #if !defined(WANT_IPV6) && defined(h_errno) 130,131d127 < #endif < #endif Basically, we need to “enforce” the definition of Get_Error. Without removing the conditionals, it will be missing and the cross-build will fail. 3) Configure for cross-build $ ./configure --build=mipsel-unknown-linux-gnu --host=mipsel-openwrt-linux-uclibc --build=x86_64-unknown-linux-gnu Check that the line checking whether we are cross compiling... yes is there. The summary should look similar to: ngIRCd 24 has been configured with the following options: Host: mipsel-openwrt-linux-uclibc Compiler: mipsel-openwrt-linux-uclibc-gcc -std=gnu99 Compiler flags: -g -O2 -pipe -W -Wall -Wpointer-arith -Wstrict-prototypes -DSYSCONFDIR='"$(sysconfdir)"' -DDOCDIR='"$(docdir)"' 'ngircd' binary: /usr/local/sbin Configuration file: /usr/local/etc Manual pages: /usr/local/share/man Documentation: /usr/local/share/doc/ngircd Syslog support: yes Enable debug code: no zlib compression: no IRC sniffer: no Use TCP Wrappers: no Strict RFC mode: no IDENT support: no IRC+ protocol: yes IPv6 protocol: no I/O backend: epoll(), select() PAM support: no SSL support: no libiconv support: no 4) Build ngircd from source $ make CC=mipsel-openwrt-linux-uclibc-gcc LD=mipsel-openwrt-linux-uclibc-ld 5) Check correct binary type $ file src/ngircd/ngircd src/ngircd/ngircd: ELF 32-bit LSB executable, MIPS, MIPS32 rel2 version 1, dynamically linked (uses shared libs), not stripped Looking good! Now you can copy over the binary to your VoCore2 and run it. [1]: Error with unpatched resolve.c: resolve.c: In function 'ForwardLookup': resolve.c:285:11: warning: implicit declaration of function 'Get_Error' [-Wimplicit-function-declaration] hostname, Get_Error(h_errno)); ^ resolve.c:236:56: warning: unused parameter 'af' [-Wunused-parameter] ForwardLookup(const char *hostname, array *IpAddr, int af) ^ CCLD ngircd client.o: In function `Client_Init': ngircd-24/src/ngircd/client.c:94: warning: gethostbyname is obsolescent, use getnameinfo() instead. resolve.o: In function `ForwardLookup': ngircd-24/src/ngircd/resolve.c:284: undefined reference to `Get_Error' collect2: error: ld returned 1 exit status [2] Machine info: BusyBox v1.23.2 (2016-09-03 09:56:08 CST) built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- CHAOS CALMER (Chaos Calmer, r49378) ----------------------------------------------------- * 1 1/2 oz Gin Shake with a glassful * 1/4 oz Triple Sec of broken ice and pour * 3/4 oz Lime Juice unstrained into a goblet. * 1 1/2 oz Orange Juice * 1 tsp. Grenadine Syrup ----------------------------------------------------- root@VoCore2:~# cat /proc/cpuinfo system type : MediaTek MT7628AN ver:1 eco:2 machine : VoCore2 processor : 0 cpu model : MIPS 24KEc V5.5 BogoMIPS : 385.84 wait instruction : yes microsecond timers : yes tlb_entries : 32 extra interrupt vector : yes hardware watchpoint : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb] isa : mips1 mips2 mips32r1 mips32r2 ASEs implemented : mips16 dsp shadow register sets : 1 kscratch registers : 0 package : 0 core : 0 VCED exceptions : not available VCEI exceptions : not available root@VoCore2:~# free -m total used free shared buffers Mem: 126476 37180 89296 252 4524 -/+ buffers: 32656 93820 Swap: 0 0 0 root@VoCore2:~# uname -a Linux VoCore2 3.18.29 #22 Sun Oct 16 21:00:17 CST 2016 mips GNU/Linux root@VoCore2:~# ./ngircd -n […] [2803:4 0] No help text available, HELP command will be of limited use. [2803:4 0] No administrative information configured but required by RFC! [2803:5 0] ngIRCd 24-IRCPLUS+SYSLOG-mipsel/openwrt/linux-uclibc started. [2803:6 0] Using configuration file "/usr/local/etc/ngircd.conf" ... [2803:6 0] ServerUID must not be root(0), using "nobody" instead. [2803:6 0] Running as user nobody(65534), group nogroup(65534), with PID 2803. [2803:6 0] Not running with changed root directory. [2803:6 0] IO subsystem: epoll (hint size 100, initial maxfd 100, masterfd 3). [2803:6 0] Now listening on [0.0.0.0]:6667 (socket 6). Regards Götz -- http://www.3rz.org <http://www.3rz.org/>

1 0

Ngrcd test case failure
by Ugur Koc 10 Dez '17

10 Dez '17

Hi, One test case failed on my MacOSX (10.13.2) I attached the compilation and execution log. Best, ugur

1 0

ngircd 24 on Solaris 11.3: 👍🏻
by Götz Hoffart 21 Jan '17

21 Jan '17

the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - i386/pc/solaris2.11 gcc 4.8.2 24 17-01-21 goetz Y Y Y Y 4

1 0

ngircd 24 on FreeBSD 11: 👍🏻
by Götz Hoffart 20 Jan '17

20 Jan '17

the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/unknown/freebsd11.0 FreeBSD clang 3.8.0 24 17-01-21 goetz Y Y Y Y 3

1 0

ngircd 24 on FreeBSD 10.3: 👍🏻
by Götz Hoffart 20 Jan '17

20 Jan '17

the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/unknown/freebsd10.3 FreeBSD clang 3.4.1 24 17-01-20 goetz Y Y Y Y 3

1 0

ngIRCd Release 24
by Alexander Barton 20 Jan '17

20 Jan '17

Hello All! Here it is, the next stable version of ngIRCd, the free, portable and lightweight Internet Relay Chat server for small or private networks: ngIRCd Release 24! You can download ngIRCd from the download section on our homepage <https://ngircd.barton.de> (<https://ngircd.mirror.3rz.org>), the primary download locations are: • https://ngircd.barton.de/pub/ngircd/ • https://ngircd.mirror.3rz.org/pub/ngircd/ The NEWS file (<https://ngircd.barton.de/doc/NEWS>) lists the following changes since the last release: • Log privilege violations and failed OPER request with log level "error" and send it to the "&SERVER" channel, too. • Immediately shut down connection when receiving an "ERROR" command, don't wait for the peer to close the connection. This allows the daemon to forward the received "ERROR" message in the network, instead of the very generic "client closed connection" message. • Explicitly forbid remote servers to modify "x-lines" (G-LINES) when the "AllowRemoteOper" configuration option isn't set, even when the command seems to originate from the remote server itself: this prevents GLINE's to become set during server handshake in this case (what wouldn't be possible during regular runtime when a remote IRC Op sends the command) and what can't be undone by IRC Ops later on (because of the missing "AllowRemoteOper" option) ... • Update Xcode project for latest Xcode version (8.0), and fix "duplicate symbols" error messages when building (linking) the binary. • Add "Documentation" variables to systemd configuration files. • Make sure that SYSCONFDIR is always set, which can be handy when using source code linters when ./configure hasn't been run already. • Add the new "PAMServiceName" configuration option to specify the name used as PAM service name. This setting allows to run multiple ngIRCd instances with different PAM configurations for each instance. Thanks to Christian Aistleitner <christian(a)quelltextlich.at> for the patch, closes #226. • Add an ".editorconfig" file to the project. • Limit the number of message target, and suppress duplicates: This prevents an user from flooding the server using commands like this: "PRIVMSG nick1,nick1,nick1,...". Duplicate targets are suppressed silently (channels and clients). In addition, the maximum number of targets per PRIVMSG, NOTICE, ... command are limited to MAX_HNDL_TARGETS (25). If there are more, the daemon sends the new 407 (ERR_TOOMANYTARGETS_MSG) numeric, containing the first target that hasn't been handled any more. Closes #187. • Make contrib/platformtest.sh script more portable, and only show "runs=Y" when the test suite really has been passed successfully. Please see the ChangeLog (<https://ngircd.barton.de/doc/ChangeLog>) for a complete list of all changes, or even read the Git commit history at GitHub (<https://github.com/ngircd/ngircd>) -- there you can find our issue tracker as well. THANK YOU to all users, bug reporters, contributors, packagers, testers, and supporters: this release wouldn't have been possible without your work and support! Have fun! Alex

1 0

ngIRCd Release 24~rc1
by Alexander Barton 08 Jan '17

08 Jan '17

Hello all! More than a year after our last stable release, quite a few patches and bug fixes found their way into our source tree. So here it is: the first release candidate for ngIRCd 24, the lightweight and portable Internet Relay Chat server for small and private networks. You can download this release candidate from the download section on our homepage <https://ngircd.barton.de> (<https://ngircd.mirror.3rz.org>), the primary download locations are: • https://ngircd.barton.de/pub/ngircd/ • https://ngircd.mirror.3rz.org/pub/ngircd/ Please help test this release candidate, and report any issues you find to this mailing list or on IRC: <irc://irc.barton.de/ngircd>. Enhancements to the documentation and the homepage are welcome as well! The easiest way to test ngIRCd is to run the ./contrib/platformtest.sh script: $ curl -#LO "https://ngircd.barton.de/pub/ngircd/ngircd-24~rc1.tar.gz" $ tar xzf "ngircd-24~rc1.tar.gz" $ cd "ngircd-24~rc1" $ ./contrib/platformtest.sh This script runs quire some time, which is normal, but please report all problems! The result should look something like this: > the executable works ("runs") as expected --+ > tests run successfully ("make check") --+ | > ngIRCd compiles ("make") --+ | | > ./configure works --+ | | | > | | | | > Platform Compiler ngIRCd Date Tester C M T R * > --------------------------- ------------ ---------- -------- -------- - - - - - > x86_64/pc/linux-gnu gcc 4.9.2 24~rc1 17-01-08 alex Y Y Y Y 1 In addition I'm curious to add and update systems to the list of tested platforms (doc/Platforms.txt); so please send updates for this file when you are on some "exotic" OS and/or compiler which is lacking or outdated there (I can test Linux and OS X myself, no need to report this). Please feel free to use the issue tracker on GitHub and/or create "pull requests" there, so we can easily keep track of them: • https://github.com/ngircd/ngircd • https://github.com/ngircd/ngircd/issues The ChangeLog lists the following items since release 23: • Log privilege violations and failed OPER request with log level "error" and send it to the "&SERVER" channel, too. • Immediately shut down connection when receiving an "ERROR" command, don't wait for the peer to close the connection. This allows the daemon to forward the received "ERROR" message in the network, instead of the very generic "client closed connection" message. • Fix sending of entry duration (no negative values!) when synchronizing "x-lines" (G-LINES). • List expiration (G-LINES): use same log level as when setting, and log this event to the &SERVER channel, too. • Explicitly forbid remote servers to modify "x-lines" (G-LINES) when the "AllowRemoteOper" configuration option isn't set, even when the command seems to originate from the remote server itself: this prevents GLINE's to become set during server handshake in this case (what wouldn't be possible during regular runtime when a remote IRC Op sends the command) and what can't be undone by IRC Ops later on (because of the missing "AllowRemoteOper" option) ... • Make scripts and init-files in ./contrib executable. • Fix building ngIRCd with OpenSSL 1.1. Thanks to Christoph Biedl <ngircd.anoy(a)manchmal.in-ulm.de> for the patch! • Fix code indentation warnings of gcc 6.2. • Update config.guess (2016-04-02) and config.sub (2016-03-30) files. • Fix warnings of the "shellcheck" linter in autogen.sh, contrib/ngindent and contrib/platformtest.sh. • Update Xcode project for latest Xcode version (8.0), and fix "duplicate symbols" error messages when building (linking) the binary. • Add "Documentation" variables to systemd configuration files. • Make sure that SYSCONFDIR is always set, which can be handy when using source code linters when ./configure hasn't been run already. • Add the new "PAMServiceName" configuration option to specify the name used as PAM service name. This setting allows to run multiple ngIRCd instances with different PAM configurations for each instance. Thanks to Christian Aistleitner <christian(a)quelltextlich.at> for the patch, closes #226. • Add an ".editorconfig" file to the project. • Travis-CI: use "container-based infrastructure". • Limit the number of message targets, and suppress duplicates: This prevents an user from flooding the server using commands like this: "PRIVMSG nick1,nick1,nick1,...". Duplicate targets are suppressed silently (channels and clients). In addition, the maximum number of targets per PRIVMSG, NOTICE, ... command are limited to MAX_HNDL_TARGETS (25). If there are more, the daemon sends the new 407 (ERR_TOOMANYTARGETS_MSG) numeric, containing the first target that hasn't been handled any more. Closes #187. • Test suite: Add new test for server-server logins. • contrib/ngindent: Fix shebang line. • Make contrib/platformtest.sh script more portable, and only show "runs=Y" when the test suite really has been passed successfully. • Code cleanup in the NJON handler and the function killing clients as well as the function sending messages to a "mask" (cleaner code, more fault tolerant, better code comments). • Update and enhance documentation: README file, doc/Platforms.txt, doc/Modes.txt, doc/Commands.txt, doc/PAM.txt. • Fix NJOIN not propagating "half ops" status: ngIRCd tested for the wrong prefix of "half ops" when processing NJOIN commands and therefore never classified a remote user as "half op". Thanks to wowaname for pointing this out on #ngircd! Thanks a lot to all contributors! Alex

1 0

Building against openssl 1.1
by Christoph Biedl 05 Dez '16

05 Dez '16

Hello, at the moment, ngircd fails to build against openssl 1.1 since the configure check probes for the SSL_library_init symbol which was removed. Since however ngircd does not use that symbol (and appearently this did not break execution), probing for a different function availabe in both version solves that problem. Was tested (./autogen.sh && ./configure --with-openssl && make) on both Debian jessie (openssl 1.0.2) and stretch with openssl 1.1 installed. Cheers, Christoph

2 3

ngIRCd on Solaris 11.2, 11.3
by Götz Hoffart 08 Feb '16

08 Feb '16

Test machine is a Supermicro-based server, Intel Xeon CPU E5-2609 v3 @ 1.90GHz, 32 GB RAM. platformtest can’t seem to distinguish between 11.2 and 11.3, uname -r returns “5.11”, uname -v returns “11.3”, which would be better suited here. Solaris 11.2: $ uname -a SunOS supermicro 5.11 11.2 i86pc i386 i86pc the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - i386/pc/solaris2.11 gcc 4.8.2 23 16-02-07 goetz Y Y Y Y 4 (but: make-check runs about 10mins …) Solaris 11.3: $ uname -a SunOS supermicro 5.11 11.3 i86pc i386 i86pc the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - i386/pc/solaris2.11 gcc 4.8.2 23 16-02-08 goetz Y Y Y Y 4

1 0

ngIRCd 23 compiled with Intel Parallel Studio 2016
by Götz Hoffart 13 Jan '16

13 Jan '16

ngIRCd 23 has been configured with the following options: Host: x86_64-unknown-linux-gnu Compiler: /usr/local/intcomp/bin/icc -std=gnu99 Compiler flags: -g -O2 -pipe -W -Wall -Wpointer-arith -Wstrict-prototypes -fstack-protector -DSYSCONFDIR='"$(sysconfdir)"' -DDOCDIR='"$(docdir)"' Libraries: -lz 'ngircd' binary: /usr/local/sbin Configuration file: /usr/local/etc Manual pages: /usr/local/share/man Documentation: /usr/local/share/doc/ngircd Syslog support: yes Enable debug code: no zlib compression: yes IRC sniffer: no Use TCP Wrappers: no Strict RFC mode: no IDENT support: no IRC+ protocol: yes IPv6 protocol: no I/O backend: epoll(), select() PAM support: no SSL support: no libiconv support: no platformtest.sh: Checking for GIT tree ... platformtest.sh: Checking for "./contrib/../configure" script ... platformtest.sh: Running "./contrib/../configure" script ... platformtest.sh: Running "make" ... platformtest.sh: Running "make check" ... the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/unknown/linux-gnu icc (ICC) 16.0.1 20151021 23 16-01-13 goetz Y Y Y Y 1

1 0

ngIRCd 23 compiled with tcc
by Götz Hoffart 10 Jan '16

10 Jan '16

sighandlers.o: 'NGIRCd_SignalQuit' defined twice sighandlers.o: 'NGIRCd_SignalRestart' defined twice sighandlers.o: 'NGIRCd_DebugLevel' defined twice sighandlers.o: 'NGIRCd_ConfFile' defined twice sighandlers.o: 'NGIRCd_ProtoID' defined twice platformtest.sh: Running "make check" ... send: spawn id exp6 not open while executing "send "privmsg ~user\%127.0.0.1 :test\r"" (file "./message-test.e" line 75) send: spawn id exp6 not open while executing "send "nick nick\r"" (file "./misc-test.e" line 10) send: spawn id exp6 not open while executing "send "nick nick\r"" (file "./mode-test.e" line 10) send: spawn id exp6 not open while executing "send "nick nick\r"" (file "./opless-channel-test.e" line 10) send: spawn id exp6 not open while executing "send "nick nick\r"" (file "./who-test.e" line 10) send: spawn id exp6 not open while executing "send "nick nick\r"" (file "./whois-test.e" line 10) make[3]: *** [check-TESTS] Error 1 make[2]: *** [check-am] Error 2 make[1]: *** [check-recursive] Error 1 make: *** [check-recursive] Error 1 the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/unknown/linux-gnu tcc 0.9.25 23 16-01-09 goetz Y Y N Y 1 $ uname -a Linux s1.hoffart.de 2.6.32-5-amd64 #1 SMP Wed Jun 17 16:09:06 UTC 2015 x86_64 GNU/Linux

2 1

ngIRCd 23 compiled with nwcc
by Götz Hoffart 09 Jan '16

09 Jan '16

/var/tmp/cpp16.cpp - 0 error(s), 0 warning(s) /var/tmp/cpp16.cpp - 0 error(s), 0 warning(s) platformtest.sh: Running "make check" ... /var/tmp/cpp16.cpp - 0 error(s), 0 warning(s) send: spawn id exp6 not open while executing "send "version ngircd.test.server\r"" (file "./server-link-test.e" line 22) send: spawn id exp6 not open while executing "send "nick IdleTest\r"" (file "./check-idle.e" line 10) make[3]: *** [check-TESTS] Error 1 make[2]: *** [check-am] Error 2 make[1]: *** [check-recursive] Error 1 make: *** [check-recursive] Error 1 the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/unknown/linux-gnu nwcc 0.8.2 23 16-01-09 goetz Y Y N Y 1

1 0

ngIRCd 23 on Minix 3.3.0
by Götz Hoffart 06 Jan '16

06 Jan '16

$ uname -a Minix myminix.example.com 3.3.0 Minix 3.3.0 (GENERIC) i386 $ CC=clang ./configure ngIRCd 23 has been configured with the following options: Host: i386-pc-minix Compiler: clang Compiler flags: -g -O2 -pipe -W -Wall -Wpointer-arith -Wstrict-prototypes -fstack-protector -DSYSCONFDIR='"$(sysconfdir)"' -DDOCDIR='"$(docdir)"' Libraries: -lz 'ngircd' binary: /usr/local/sbin Configuration file: /usr/local/etc Manual pages: /usr/local/share/man Documentation: /usr/local/share/doc/ngircd Syslog support: yes Enable debug code: no zlib compression: yes IRC sniffer: no Use TCP Wrappers: no Strict RFC mode: no IDENT support: no IRC+ protocol: yes IPv6 protocol: no I/O backend: poll() PAM support: no SSL support: no libiconv support: no clang: warning: argument unused during compilation: '-g' platformtest.sh: Running "make check" ... clang: warning: argument unused during compilation: '-g' the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - i386/pc/minix clang 3.4 23 16-01-06 goetz Y Y N Y Can’t get through configure with lcc or pcc, though …

1 0

ngIRCd 23 on Linux 1.2.12 / S.u.S.E. 1995/08
by Götz Hoffart 06 Jan '16

06 Jan '16

Linux 1.2.12 (susi95.3rz.org) (ttyp0) susi95 login: root Last login: Tue Jan 5 23:14:29 on tty1 Linux 1.2.12. (POSIX). You have mail. HOW YOU CAN TELL THAT IT'S GOING TO BE A ROTTEN DAY: #32: You call your answering service and they've never heard of you. susi95:~# uname -a Linux susi95 1.2.12 #3 Sun Jul 30 06:18:00 MET DST 1995 i686 susi95:~# joe Couldn't load termcap/terminfo entry susi95:~# TERM=vt100 susi95:~# joe [...] # ./configure [...] ngIRCd 23 has been configured with the following options: Host: i686-pc-linux-gnu Compiler: gcc Compiler flags: -g -O2 -pipe -W -Wall -Wpointer-arith -Wstrict-prototypes -DSYSCONFDIR='"$(sysconfdir)"' -DDOCDIR='"$(docdir)"' 'ngircd' binary: /usr/local/sbin Configuration file: /usr/local/etc Manual pages: /usr/local/share/man Documentation: /usr/local/share/doc/ngircd Syslog support: yes Enable debug code: no zlib compression: no IRC sniffer: no Use TCP Wrappers: no Strict RFC mode: no IDENT support: no IRC+ protocol: yes IPv6 protocol: no I/O backend: select() PAM support: no SSL support: no libiconv support: no platformtest.sh: Running "make check" ... ** WARNING: The vsnprintf() function of this system isn't standard ** conformant and returns a WRONG result: -1 (should be 12)! The test ** result has been ignored but may lead to errors during execution! the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - i686/pc/linux-gnu 2.6.3 23 16-01-06 goetz Y Y y Y 1 platformtest.sh: Warning: Some tests have been skipped! # file src/ngircd/ngircd src/ngircd/ngircd: Linux/i386 demand-paged executable (QMAGIC) not stripped # ls -l src/ngircd/ngircd -rwxr-xr-x 1 root root 636093 Jan 6 14:43 src/ngircd/ngircd # strip !$ strip src/ngircd/ngircd # ls -l !$ -rwxr-xr-x 1 root root 299008 Jan 6 14:45 src/ngircd/ngircd @AB: one thing – the “Tester” was not filled out by the platformtest script, it was just empty … Cool stuff, folks, that this runs unmodified on a quite old Linux! Keep on hackin’! Regards Götz

1 0

ngircd 23 on Debian Potato / Kernel 2.2.19
by Götz Hoffart 23 Dez '15

23 Dez '15

the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - i686/pc/linux-gnu 2.95.2 23 15-12-23 goetz Y Y Y Y 1 # cat /etc/debian_version 2.2 # uname -a Linux potato 2.2.19 #1 Sat Jun 9 13:04:06 EST 2001 i686 unknown # ldd src/ngircd/ngircd libc.so.6 => /lib/libc.so.6 (0x40015000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

1 0

ngircd 23 on ArchLinux
by Goetz Hoffart 14 Dez '15

14 Dez '15

[root@ba ngircd-23]# ./contrib/platformtest.sh platformtest.sh: Checking ngIRCd base source directory ... platformtest.sh: - source directory: ./contrib/.. platformtest.sh: - working directory: /root/src/ngircd-23 platformtest.sh: Checking for GIT tree ... platformtest.sh: Checking for "./contrib/../configure" script ... platformtest.sh: Running "./contrib/../configure" script ... platformtest.sh: Running "make" ... ar: `u' modifier ignored since `D' is the default (see `U') ar: `u' modifier ignored since `D' is the default (see `U') ar: `u' modifier ignored since `D' is the default (see `U') platformtest.sh: Running "make check" ... the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/unknown/linux-gnu gcc 5.3.0 23 15-12-14 root Y Y y Y 1 platformtest.sh: Warning: Some tests have been skipped! ]# uname -a Linux ba 4.2.5-1-ARCH #1 SMP PREEMPT Tue Oct 27 08:13:28 CET 2015 x86_64 GNU/Linux

3 2

ngircd 23 on SuSE 5.2 / Kernel 2.0.33
by Goetz Hoffart 30 Nov '15

30 Nov '15

Note that the network on my 2.0.33 machine is somewhat broken, therefore I had to transfer the ngircd-tarball by attaching a small harddisc to it, also to transfer the config.log back ... # uname -a Linux susi52 2.0.33 #2 Sat Jan 11 16:17:36 MET 2014 i686 unknown [...] ngIRCd 23 has been configured with the following options: Host: i686-pc-linux-gnu Compiler: gcc Compiler flags: -g -O2 -pipe -W -Wall -Wpointer-arith -Wstrict-prototypes -DSYSCONFDIR='"$(sysconfdir)"' -DDOCDIR='"$(docdir)"' Libraries: -lz 'ngircd' binary: /usr/local/sbin Configuration file: /usr/local/etc Manual pages: /usr/local/share/man Documentation: /usr/local/share/doc/ngircd Syslog support: yes Enable debug code: no zlib compression: yes IRC sniffer: no Use TCP Wrappers: no Strict RFC mode: no IDENT support: no IRC+ protocol: yes IPv6 protocol: no I/O backend: select() PAM support: no SSL support: no libiconv support: no [...] "expect -nobrace timeout { exit 1 } "402" # note this is not specified in RFC 2812, but probably should be " invoked from within "expect { timeout { exit 1 } "402" # note this is not specified in RFC 2812, but probably should be }" (file "./misc-test.e" line 48) make[3]: *** [check-TESTS] Error 1 make[2]: *** [check-am] Error 2 make[1]: *** [check-recursive] Error 1 make: *** [check-recursive] Error 1 the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - i686/pc/linux-gnu 2.7.2.1 23 15-11-30 goetz Y Y N Y 1 [...] configure:4173: gcc -c -g -O2 conftest.c >&5 conftest.c:12: stdbool.h: No such file or directory conftest.c:18: warning: invalid character in macro parameter name conftest.c:18: badly punctuated parameter list in `#define' conftest.c:19: warning: invalid character in macro parameter name conftest.c:19: badly punctuated parameter list in `#define' conftest.c:20: badly punctuated parameter list in `#define' conftest.c:36: two `l's in integer constant conftest.c:39: two `l's in integer constant configure:4173: $? = 1 configure: failed program was: Pls find full config.log attached.

1 0

ngircd 23 on OpenBSD 3.5
by Götz Hoffart 30 Nov '15

30 Nov '15

Works: platformtest.sh: Checking ngIRCd base source directory ... platformtest.sh: - source directory: contrib/.. platformtest.sh: - working directory: /home/goetz/goetz/ngircd-23 platformtest.sh: Checking for GIT tree ... platformtest.sh: Checking for "contrib/../configure" script ... platformtest.sh: Running "contrib/../configure" script ... platformtest.sh: Running "make" ... platformtest.sh: Running "make check" ... the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - i386/unknown/openbsd3.5 2.95.3 23 15-11-27 goetz Y Y y Y 3 platformtest.sh: Warning: Some tests have been skipped! $ uname -a OpenBSD obsd35.3rz.org 3.5 GENERIC#34 i386 $ gcc -v Reading specs from /usr/lib/gcc-lib/i386-unknown-openbsd3.5/2.95.3/specs gcc version 2.95.3 20010125 (prerelease, propolice)

2 1

ngIRCd Release 23
by Alexander Barton 16 Nov '15

16 Nov '15

Hi ngIRCd'ers! Our last "feature release" is over one year old, so the next release is quite overdue. But you can relax, here it is: ngIRCd Release 23! This release isn't the one with the most changes or the greatest new features in ngIRCd's history, but makes ngIRCd more compatible, more consistent, and adds some nice new functionality. Please see the ChangeLog for the whole story (online at <http://ngircd.barton.de/doc/ChangeLog> and included in the source distribution). The NEWS file lists the following new features since ngIRCd 22.1: • Use "NOTICE *" before registration instead of "NOTICE AUTH". "AUTH" is a valid nickname so sending notices to it is probably not a good idea. Use "*" as the target instead as done with numerics when the nick is not available. This mimics the behavior in Charybdis, IRCD-Hybrid, InspIRCd 2.2, Plexus 4, etc. Closes #217. The "NoticeAuth" configuration variable (ngircd.conf) has been renamed to "NoticeBeforeRegistration" accordingly, but the old name is still supported for compatibility reasons. • Implement new channel mode "N" (regular users can't change their nick name while on this channel). Closes #214. • Keep track of who placed bans, invites, and excepts. Idee and implementation by LucentW, Thanks! Closes #203. • Implement numeric RPL_LISTSTART(321). lightIRC and other clients expecting RPL_LISTSTART should now behave correctly. Idee and implementation by LucentW, Thanks! Closes #207. • Streamline the effect of "MorePrivacy" option: Update documentation in ngircd.conf(5); don't hide channels for IRC Ops on LIST and don't hide IP addresses/host names on WHOIS when "MorePrivacy" is in effect. This closes #198. • IRC operators now can kick anyone when "OperCanMode" is set. Idee and implementation by LucentW, Thanks! Closes #202. • Implement user mode "I": Hide channels on WHOIS: this mode prevents ngIRCd from showing channels on WHOIS (IRC Operators can always see the channel list). Idee and implementation by LucentW, Thanks! Closes #197. • INVITE command: Implement ERR_USERNOTONSERV(504) numeric and make sure that the target user is on the same server when inviting other users to local ("&") channels. Idea by Cahata, thanks! Closes #183. • MODE command: Always report channel creation time. Up to now when receiving a MODE command, ngIRCd only reported the channel creation time to clients that were members of the channel. This patch reports the channel creation time to all clients, regardless if they are joined to that channel or not. At least ircd-seven behaves like this. This closes #188. Reported by Cahata, thanks! You can find more information on our homepage at <http://ngircd.barton.de/> and its mirror <http://ngircd.mirror.3rz.org/>. The primary download locations are: • <http://ngircd.barton.de/pub/ngircd/> • <http://ngircd.mirror.3rz.org/pub/ngircd/> THANK YOU to all users, bug reporters, contributors, packagers, testers, and supporters: this release wouldn't have been possible without your work! Have fun! Alex

1 0

ask about ngircd
by Agung Kurniawan 02 Nov '15

02 Nov '15

hello i'm ubuntu newbie from indonesia, and i want ask how to configure transfer file / sending file on ngircd, im use ubuntu 12.04 for server and pidgin for client chat thankyou best regrads, agung Kurniawan

2 1

ngIRCd Release 23~rc1
by Alexander Barton 06 Sep '15

06 Sep '15

Hello all! Please give a warm welcome to ngIRCd Release 23~rc1, our just published first release candidate for the next "feature release" of ngIRCd, the lightweight and portable Internet Relay Chat server for small and private networks. There have been 56 commits since our last stable release, ngIRCd 22.1. The NEWS file lists these new features: • Use "NOTICE *" before registration instead of "NOTICE AUTH". "AUTH" is a valid nickname so sending notices to it is probably not a good idea. Use "*" as the target instead as done with numerics when the nick is not available. This mimics the behavior in Charybdis, IRCD-Hybrid, InspIRCd 2.2, Plexus 4, etc. Closes #217. The "NoticeAuth" configuration variable (ngircd.conf) has been renamed to "NoticeBeforeRegistration" accordingly, but the old name is still supported for compatibility reasons. • Implement new channel mode "N" (regular users can't change their nick name while on this channel). Closes #214. • Keep track of who placed bans, invites, and excepts. Idee and implementation by LucentW, Thanks! Closes #203. • Implement numeric RPL_LISTSTART(321). lightIRC and other clients expecting RPL_LISTSTART should now behave correctly. Idee and implementation by LucentW, Thanks! Closes #207. • Streamline the effect of "MorePrivacy" option: Update documentation in ngircd.conf(5); don't hide channels for IRC Ops on LIST and don't hide IP addresses/host names on WHOIS when "MorePrivacy" is in effect. This closes #198. • IRC operators now can kick anyone when "OperCanMode" is set. Idee and implementation by LucentW, Thanks! Closes #202. • Implement user mode "I": Hide channels on WHOIS: this mode prevents ngIRCd from showing channels on WHOIS (IRC Operators can always see the channel list). Idee and implementation by LucentW, Thanks! Closes #197. • INVITE command: Implement ERR_USERNOTONSERV(504) numeric and make sure that the target user is on the same server when inviting other users to local ("&") channels. Idea by Cahata, thanks! Closes #183. • MODE command: Always report channel creation time. Up to now when receiving a MODE command, ngIRCd only reported the channel creation time to clients that were members of the channel. This patch reports the channel creation time to all clients, regardless if they are joined to that channel or not. At least ircd-seven behaves like this. This closes #188. Reported by Cahata, thanks! Please test this release candidate thoroughly and report all glitches, problems, errors, and regressions you encounter! Best is to file bugs and feature requests here: • ngIRCd Bug Tracker: <http://ngircd.barton.de/bugzilla/> You can find more information on our homepage at <http://ngircd.barton.de/> and its mirror <http://ngircd.mirror.3rz.org/>. The primary download locations are: • <http://ngircd.barton.de/pub/ngircd/> • <http://ngircd.mirror.3rz.org/pub/ngircd/> And as usual: a big THANKS to all users, bug reporters, contributors, packagers, testers, and supporters: Your work is highly appreciated! Have fun! Alex

1 0

Reproducible builds
by Christoph Biedl 26 Aug '15

26 Aug '15

Hello, at the moment ngircd fails the tests for reproducible builds in Debian since it uses the __DATE__ and __TIME__ macros for the INFO command. Instead of patching this out I decided to implement an optional constant BIRTHTIME that allows you to set a time stamp for the "Birth Date" information, in seconds since the epoch, like in export CFLAGS += -DBIRTHTIME=$(shell date +%s --date="2015/08/15 23:42:22") In the future, Debian will provide a SOURCE_DATE_EPOCH environment variable, dealing with the situation until then will be my job. The time format was taken from the NGIRCd_StartStr formatting in ngircd.c so the "Birth Date" and "On-line since" lines in the INFO output look similar: :irc.example.net 371 nick :ngIRCd 22.1-IDENT+IPv6+IRCPLUS+PAM+SSL+SYSLOG+ZLIB-x86_64/pc/linux-gnu :irc.example.net 371 nick :Birth Date: Tue Aug 25 2015 at 18:11:11 (CEST) :irc.example.net 371 nick :On-line since Tue Aug 25 2015 at 18:11:33 (CEST) :irc.example.net 374 nick :End of INFO list The format of the time stamped is changed, but as far as I can tell, there's no rule that is violated by that. Bonus level: Reformat the messages so the time stamps are aligned. Christoph --- a/src/ngircd/irc-info.c +++ b/src/ngircd/irc-info.c @@ -556,7 +556,15 @@ NGIRCd_Version)) return DISCONNECTED; -#if defined(__DATE__) && defined(__TIME__) +#if defined(BIRTHDATE) + char t_str[60]; + time_t t = BIRTHDATE; + (void)strftime(t_str, sizeof(t_str), "%a %b %d %Y at %H:%M:%S (%Z)", + localtime(&t)); + snprintf(msg, sizeof(msg), "Birth Date: %s", t_str); + if (!IRC_WriteStrClient(Client, RPL_INFO_MSG, Client_ID(prefix), msg)) + return DISCONNECTED; +#elif defined(__DATE__) && defined(__TIME__) snprintf(msg, sizeof(msg), "Birth Date: %s at %s", __DATE__, __TIME__); if (!IRC_WriteStrClient(Client, RPL_INFO_MSG, Client_ID(prefix), msg)) return DISCONNECTED;

2 1

Re: [ngIRCd-ML] questions about the chat log history
by Arno Duwel 29 Apr '15

29 Apr '15

> Hello.I'm choi. > I have a some question. > I want to save client's chat log history together in one of the server. > Is it possible. Hello choi! I am new to this mailing list (hello all, hello Arthur Barton … thank you for your wonderful server! :) ) – but I would like to reply to your message: As far as I understand it: IRC servers are not really meant to log messages that users are sending. You could probably find similar questions already if you google them. It's probably not uncommon to ask this. While I think that it is great that IRC servers respect the privacy of their users – it is likely that there are personal or special conditions where it is wanted to log conversations of course! The best way to do this is to log in as a user. Most clients save the logfiles. And you just need to log into your ngircd-server as a user and join the channel you would like to log. If you do not want to start a full desktop-irc-client you could be interested in using a bot for something like this. There are hundreds of little helper-programs out there - and I have currently only used supybot so far (more current: limnoria) which runs well with ngircd. The bot logs in as a user – and you can configure such a bot to log everything that is said - or just special times for example. And a bot may help you in lots of other cases as well. I believe that there will be dozens of different solutions for your problem – but the server itself will not log everything. You will want some kind of logged-in user/bot for this. I hope this helps. Good luck to you!

1 0

questions about the chat log history
by yoonsung choi 29 Apr '15

29 Apr '15

Hello.I'm choi. I have a some question. I want to save client's chat log history together in one of the server. Is it possible. I will wait for the reply . Thank you .

1 0

questions about the ngIRC
by yoonsung choi 29 Apr '15

29 Apr '15

My name is Choi . I want to save the contents of the chat , name , time as all log Is this possible? I want you to tell me if possible way. Thank you .

1 0

operator command
by Daiki Akiyoshi 21 Apr '15

21 Apr '15

I am a student worker at a college and learning how to set up ngircd. I have a trouble to log on as IRC operator. I configured an [Oper] section on config file. After I use /OPER command to be an IRC operator, log file says: "Got valid OPER for "Name" from "Nickname!~Name@com", user is an IRC operator now. However, when I use commands such as kick, it says "your privileges are too low". Does anyone have any idea how to fix this? I really appreciate your help. Warmly, Daiki Akiyoshi Earlham College'18

2 2

Compilation results ngIRCd 22.1 with tcc, Open64 5.0, SolarisStudio 12.3
by Götz Hoffart 13 Apr '15

13 Apr '15

ngIRCd 22.1 has been configured with the following options: Host: x86_64-unknown-linux-gnu Compiler: tcc Compiler flags: -g -DSYSCONFDIR='"$(sysconfdir)"' -DDOCDIR='"$(docdir)"' Libraries: -lz 'ngircd' binary: /usr/local/sbin Configuration file: /usr/local/etc Manual pages: /usr/local/share/man Documentation: /usr/local/share/doc/ngircd Syslog support: yes Enable debug code: no zlib compression: yes IRC sniffer: no Use TCP Wrappers: no Strict RFC mode: no IDENT support: no IRC+ protocol: yes IPv6 protocol: no I/O backend: epoll(), select() PAM support: no SSL support: no libiconv support: no the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/unknown/linux-gnu tcc 0.9.25 22.1 15-04-13 goetz Y Y N Y 1 ============================================================================== ngIRCd 22.1 has been configured with the following options: Host: x86_64-unknown-linux-gnu Compiler: /opt/open64-5.0/bin/opencc -std=gnu99 Compiler flags: -g -O2 -pipe -W -Wall -Wpointer-arith -Wstrict-prototypes -fstack-protector -DSYSCONFDIR='"$(sysconfdir)"' -DDOCDIR='"$(docdir)"' Libraries: -lz 'ngircd' binary: /usr/local/sbin Configuration file: /usr/local/etc Manual pages: /usr/local/share/man Documentation: /usr/local/share/doc/ngircd Syslog support: yes Enable debug code: no zlib compression: yes IRC sniffer: no Use TCP Wrappers: no Strict RFC mode: no IDENT support: no IRC+ protocol: yes IPv6 protocol: no I/O backend: epoll(), select() PAM support: no SSL support: no libiconv support: no […] opencc WARNING: unknown flag: -fstack-protector opencc WARNING: unknown flag: -fstack-protector opencc WARNING: unknown flag: -fstack-protector opencc WARNING: unknown flag: -fstack-protector opencc WARNING: unknown flag: -fstack-protector opencc WARNING: unknown flag: -fstack-protector opencc WARNING: unknown flag: -fstack-protector opencc WARNING: unknown flag: -fstack-protector opencc WARNING: unknown flag: -fstack-protector opencc WARNING: unknown flag: -fstack-protector "io.c", line 409: Warning: Variable __d0 in fucntion io_library_init_select might be used uninitialized "io.c", line 409: Warning: Variable __d1 in fucntion io_library_init_select might be used uninitialized "io.c", line 410: Warning: Variable __d0 in fucntion io_library_init_select might be used uninitialized "io.c", line 410: Warning: Variable __d1 in fucntion io_library_init_select might be used uninitialized "io.c", line 671: Warning: Variable __d0 in fucntion io_library_shutdown might be used uninitialized "io.c", line 671: Warning: Variable __d1 in fucntion io_library_shutdown might be used uninitialized "io.c", line 672: Warning: Variable __d0 in fucntion io_library_shutdown might be used uninitialized "io.c", line 672: Warning: Variable __d1 in fucntion io_library_shutdown might be used uninitialized opencc WARNING: unknown flag: -fstack-protector opencc WARNING: unknown flag: -fstack-protector opencc WARNING: unknown flag: -fstack-protector […] the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/unknown/linux-gnu Open64 22.1 15-04-13 goetz Y Y Y Y 1 ============================================================================== ngIRCd 22.1 has been configured with the following options: Host: x86_64-unknown-linux-gnu Compiler: /opt/solarisstudio12.3/bin/suncc Compiler flags: -g -DSYSCONFDIR='"$(sysconfdir)"' -DDOCDIR='"$(docdir)"' Libraries: -lz 'ngircd' binary: /usr/local/sbin Configuration file: /usr/local/etc Manual pages: /usr/local/share/man Documentation: /usr/local/share/doc/ngircd Syslog support: yes Enable debug code: no zlib compression: yes IRC sniffer: no Use TCP Wrappers: no Strict RFC mode: no IDENT support: no IRC+ protocol: yes IPv6 protocol: no I/O backend: epoll(), select() PAM support: no SSL support: no libiconv support: no […] platformtest.sh: Running "make" ... "io.c", line 791: warning: statement not reached "io.c", line 887: warning: statement not reached "io.c", line 910: warning: statement not reached platformtest.sh: Running "make check" ... […] the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/unknown/linux-gnu unknown 22.1 15-04-13 goetz Y Y Y Y 1 Grüße Götz -- ③rz :: Regionales Retro-Rechenzentrum, Freiburg :: http://www.3rz.org Für Freunde außer-gewöhnlicher Datenverarbeitung

1 0

ngIRCd Git Repository & Bug Tracker moving to GitHub
by Alexander Barton 07 Apr '15

07 Apr '15

Hi ngIRCd'ers! After becoming more and more dissatisfied with Bugzilla, and without Debian supporting it any more in their current releases, I decided to no longer use my own Bugzilla installation but to move the main ngIRCd Git Repository to GitHub and to use their issue tracker. I created a new "GitHub organization", which you can find here: <https://github.com/ngircd/> There you'll find our two sub-projects, the daemon itself and our website: • <https://github.com/ngircd/ngircd> • <https://github.com/ngircd/ngircd-web> All old bug reports have been migrated to GitHub, and HTTP redirects are in place, so that you should reach suitable pages even when using old URLs pointing to the now uninstalled Bugzilla installation. The migration of the existing bug reports has a few drawbacks: • You must re-subscribe to all bugs that you are interested in, • all GitHub issues are created by "alexbarton" (me), the real author information can only be seen in the description text, • and all issues creation dates are "now", the real dates can be seen in the description as well. • All attachments are … gone. If someone cares I can try to make them available somewhere (yes, I do have backups!). All the currently open bugs didn't have any attachments. While migration the bug/issue tracker to GitHub, I'm going to use the GitHub repository as the new "master repository" in the future, too. Up to now, I always used my own repository on <git://ngircd.barton.de/ngircd.git> and mirrored it periodically to GitHub. From now on, I will push all commits directly to GitHub – and mirror it back to my own repository. So basically you don't have to change anything in your setup (I hope!). The new Git repository URLs are: • <https://github.com/ngircd/ngircd.git> • <https://github.com/ngircd/ngircd-web.git> So what should you do? – Nothing. Keep smiling! ;-) Everything should work as before, and … • if you were using the bug tracker, have a look at the GitHub issues and (re-)subscribe to all issues that you are interested in; • if you are using Git, update your remotes to point to the new addresses as stated above. Please let me know when you encounter any broken links or other problems! I'm going to update the documentation included in the source tree (README, doc/GIT.txt, etc.) in the next few days … Thanks! Alex

1 0

ngIRCd 22.1
by Alexander Barton 06 Apr '15

06 Apr '15

Hello World! ngIRCd 22 has been released on October 11 2014, and since then, a few "glitches" and bugs have been found. Therefore here it is: the next ngIRCd release named 22.1. The most severe bug was "WHO #channel" showing all invisible users and hiding all visible, the logic was reversed! This bug has been introduced back in August 2013 and affects ngIRCd releases 21, 21.1, and 22. Thanks a lot to "Cahata" for reporting this in #ngircd! And the most prominent change in ngIRCd 22.1 is that the default value of the "CipherList" configuration variable has been changed to not enable SSLv3 by default. Idea, initial patch, and testing by Christoph Biedl; Thanks a lot! (And please make sure to adjust this variable accordingly if you still have to support old and insecure(!) clients! You can check the current value using "ngircd --configtest" before upgrading. See "INSTALL" for details.) As usual, you can find the whole ChangeLog online on the ngIRCd homepage <http://ngircd.barton.de/doc/ChangeLog> and below: - Update doc/Platforms.txt and doc/FAQ.txt. - Fix spelling of RPL_WHOISBOT message text. - Don't send nick name as default PART reason: No other IRC daemon seems to do this (today?). Closes #185. Reported by Cahata in #ngircd, thanks! - Fix "WHO #<chan>" showing invisible users and hiding all visible, the logic was reversed! This bug has been introduced by commit c74115f2, "Simplify mode checking on channels and users within a channel", ngIRCd releases 21, 21.1, and 22 are affected :-( Problem reported by Cahata in #ngircd, Thanks! - Fix typo in src/testsuite/README - Auth PING: Fix our information text for manual sending of "PONG". Up to now, ngIRCd doesn't send a valid IRC command at all, oops! - Auth PING: Fix internal time stamp conversion and don't send a prefix in our PING command. The prefix confuses WeeChat, at least, which doesn't send an appropriate PONG in the case ... Debugging and patch by "wowaname" on #ngircd, thanks! - Fix syntax of ERR_LISTFULL_MSG(478) numeric. Pointed out by "wowaname" in #ngircd, thanks! - Enhance debug messages while sending CHANINFO commands. - Reset "last try" timer when enabling a passive server. This results in a new connection attempt as soon as possible. - Change log message for "Can't resolve address" and for IP address forgeries. - doc/HowToRelease.txt: Add note about the bug tracker. - Update "CipherList" to not enable SSLv3 by default. Idea, initial patch, and testing by Christoph Biedl <ngircd.anoy(a)manchmal.in-ulm.de>. - Change ngIRCd test suite not to use DNS lookups: Different operating systems do behave quite differently when doing DNS lookups, for example "127.0.0.1" sometimes resolves to "localhost" and sometimes to "localhost.localdomain" (for example OpenBSD). And other OS resolve "localhost" to the real host name (for example Cygwin). So not using DNS at all makes the test site much more portable. You can find more information on our homepage at <http://ngircd.barton.de/> and its mirror <http://ngircd.mirror.3rz.org/>. The primary download location is: • <http://ngircd.barton.de/pub/ngircd/> THANKS to all users, bug reporters, contributors, packagers, and supporters! Have fun! Alex

1 0

ngircd 22 on iBook G3 / OS X 10.3.9
by Götz Hoffart 22 Mär '15

22 Mär '15

No regression: ngIRCd 22 has been configured with the following options: Host: powerpc-apple-darwin7.9.0 Compiler: gcc -std=gnu99 Compiler flags: -g -O2 -pipe -W -Wall -Wpointer-arith -Wstrict-prototypes -DSYSCONFDIR='"$(sysconfdir)"' -DDOCDIR='"$(docdir)"' Libraries: -lz 'ngircd' binary: /usr/local/sbin Configuration file: /usr/local/etc Manual pages: /usr/local/share/man Documentation: /usr/local/share/doc/ngircd Syslog support: yes Enable debug code: no zlib compression: yes IRC sniffer: no Use TCP Wrappers: no Strict RFC mode: no IDENT support: no IRC+ protocol: yes IPv6 protocol: no I/O backend: kqueue() PAM support: no SSL support: no libiconv support: no the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - powerpc/apple/darwin7.9.0 gcc 3.3 22 15-03-22 goetz Y Y Y Y 3 $ uname -a Darwin jadzia.local 7.9.0 Darwin Kernel Version 7.9.0: Wed Mar 30 20:11:17 PST 2005; root:xnu/xnu-517.12.7.obj~1/RELEASE_PPC Power Macintosh powerpc $ sw_vers ProductName: Mac OS X ProductVersion: 10.3.9 BuildVersion: 7W98 $ date Sun Mar 22 15:08:05 CET 2015

2 1

ngircd 22 on Solaris 11.2 / x86-64
by Götz Hoffart 17 Mär '15

17 Mär '15

Only pre-install I did was "pkg install gcc-45". ngIRCd 22 has been configured with the following options: Host: i386-pc-solaris2.11 Compiler: gcc -std=gnu99 Compiler flags: -g -O2 -pipe -W -Wall -Wpointer-arith -Wstrict-prototypes -fstack-protector -DSYSCONFDIR='"$(sysconfdir)"' -DDOCDIR='"$(docdir)"' Libraries: -lz -lsocket -lnsl 'ngircd' binary: /usr/local/sbin Configuration file: /usr/local/etc Manual pages: /usr/local/share/man Documentation: /usr/local/share/doc/ngircd Syslog support: yes Enable debug code: no zlib compression: yes IRC sniffer: no Use TCP Wrappers: no Strict RFC mode: no IDENT support: no IRC+ protocol: yes IPv6 protocol: no I/O backend: /dev/poll PAM support: no SSL support: no libiconv support: no $ contrib/platformtest.sh platformtest.sh: Checking ngIRCd base source directory ... platformtest.sh: - source directory: contrib/.. platformtest.sh: - working directory: /export/home/goetz/ngircd-22 platformtest.sh: Checking for GIT tree ... platformtest.sh: Checking for "contrib/../configure" script ... platformtest.sh: Running "contrib/../configure" script ... platformtest.sh: Running "make" ... platformtest.sh: Running "make check" ... make: Fatal error: Command failed for target `check-TESTS' Current working directory /export/home/goetz/ngircd-22/src/testsuite make: Fatal error: Command failed for target `check-am' Current working directory /export/home/goetz/ngircd-22/src/testsuite make: Fatal error: Command failed for target `check-recursive' Current working directory /export/home/goetz/ngircd-22/src make: Fatal error: Command failed for target `check-recursive' the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - i386/pc/solaris2.11 gcc 4.5.2 22 15-03-17 goetz Y Y N Y 4 $ uname -a SunOS vulkan 5.11 11.2 i86pc i386 i86pc

2 1

Server not configured error
by wally 09 Mär '15

09 Mär '15

Hello, Im having a bit of an issue connecting two servers. This is my main server(s1) ngircd.conf [server] #S2 name = secondserver.net host = 192.168.1.102 port = 6667 MyPassword = <scrubbed> PeerPassword = <scrubbed> Group = 4 [server]#S3 name = backupmain.net host = 192.168.1.103 port = 6667 MyPassword = <scrubbed> PeerPassword = <scrubbed> Group = 4 This is the ngircd from my backup server (s3) [Server] #S1 name = mainservername.net host = 192.168.1.101 port = 6667 MyPassword = <scrubbed> PeerPassword = <scrubbed> Group = 4 The connection to s2 works fine. No issues there. When I start up the backup server with ngircd -n, I get the "backupmain.net" is not configured here." Have I missed something?

3 3

Message to all
by wally 13 Feb '15

13 Feb '15

Is it possible to post a message in all rooms so that it looks like the message is coming from the server? Like a broadcast message? If not from the server, at least from My admin username?

2 1

Test suite can't cope with zombies
by taylanbayirli＠gmail.com 05 Feb '15

05 Feb '15

This could be seen as a bug in GNU Guix (or Nix?) as well but, the test suite of ngircd uses some "kill -0" calls to determine whether a process is still alive after receiving a SIGTERM, and that doesn't work in Guix's build processes because it's a strongly encapsulated environment in which PID 1 is a Guile process running a certain script which apparently doesn't fulfill the expected role, of a real PID 1 (init) process, to wait(2) for disowned and killed processes, which makes them turn into zombies. I don't know of a trivial solution, so do as you wish. :-) (The Guix recipe will just disable the running of 'make check' for now.) Taylan

2 3

General message to all
by walter 03 Feb '15

03 Feb '15

Is it possible to post a message in all rooms so that it looks like the message is coming from the server? Like a broadcast message? If not from the server, at least from My admin username?

1 0

sorry for all the questions..got another
by wally 13 Jan '15

13 Jan '15

Still trying to muddle my way through running my own server. Sorry for all the questions. Is there a way to have specific people automatically get chan-op status? Or allow them to get it via a password system? Like the system-op option in the config? If it helps, I use PAM for authentication.

2 1

Unknown target for status code 493
by wally 08 Jan '15

08 Jan '15

I've gotten this message a few times in my logs. I was wondering what it means? Unknown target for status code 493

2 1

write error /broken pipe
by wally 03 Jan '15

03 Jan '15

Hello..I'm getting quite a few of these write errors and broken pipes in my log. Based on the random usernames associated, I'm guessing someone is trying to spam/ddos/hack? my server..but I'm not sure. Normal users are able to connect without issue. I also have PAM enabled. User "zFXC2n1KEoU3!zFXC2n1KEoU3@<scrubbed>" unregistered (connection 25): Write error. Connection 25 with "127.0.0.1:39102" closed (in: 1.1k, out: 10.2k). Write error on connection 27 (socket 27): Broken pipe! Shutting down connection 27 (Write error) with "127.0.0.1:39104" ... User "fUAQTQEbC4h!fUAQTQEbC4h@<scrubbed>" unregistered (connection 27): Write error. Connection 27 with "127.0.0.1:39104" closed (in: 1.1k, out: 10.1k). Write error on connection 32 (socket 32): Broken pipe! Shutting down connection 32 (Write error) with "127.0.0.1:39109" ... User "p_Yc__a!p_Yc__a@<scrubbed>" unregistered (connection 32): Write error. Connection 32 with "127.0.0.1:39109" closed (in: 0.9k, out: 9.6k). Write error on connection 33 (socket 33): Broken pipe! Shutting down connection 33 (Write error) with "127.0.0.1:39110" ... User "gFY!gFY@<scrubbed>" unregistered (connection 33): Write error. Connection 33 with "127.0.0.1:39110" closed (in: 0.6k, out: 9.2k). Write error on connection 34 (socket 34): Broken pipe! Shutting down connection 34 (Write error) with "127.0.0.1:39111" ... "wkYPV!wkYPV@<scrubbed>" unregistered (connection 34): Write error.

2 1

watching for connections.
by wally 27 Dez '14

27 Dez '14

Im not sure if this is relevant to irssi or to ngircd, so please forgive my ignorance. Is there a way to view when users connect to the server, but not joined to the room? Right now I just watch the logs with tail -f, but I'd like to be able to see in the client if possible. I use irssi.

2 1

help with setup and configure server
by Railgun 26 Dez '14

26 Dez '14

hello i hope i can get hel here, i have setup my own ngircs server, ir works, fine, but where can i get the OP status, there is no NickServ or ChanServ i have confugre an ID and a psswort, at the config file, but how i can get the status? regards railgun

2 1

Logging
by wally 16 Dez '14

16 Dez '14

I see that ngircd logs to syslog. But I was wondering if there was a way to change it to its own log? something along the lines of /var/log/ngircd.log?

3 2

[PATCH] Optionally validate certificates on TLS server links
by Christoph Biedl 05 Nov '14

05 Nov '14

Bugzilla#120 is a *really* long-standing issue, and it's a very important one: The peer's certificate is *not* validated on a server link, rendering the security on such links useless since a man-in-the-middle attacker can easily capture all the traffic and re-encode it without even being noticed. More than five years ago, Florian Westphal wrote a patch to mitigate the issue but it was never completed nor made it to master. So I took the liberty to rebase the patch onto rel-22, update the configuration variables to reflect the rel-19-ish configuration changes, and to fix a common error in certificate validation: The certificate's CN must match the host name the client connects to. This is anything but ready for prime time. Please test in every conceivable way, there are many. Especially CRL is completely untested. If you have an SSL/TLS guru at hand, please seek his advice. There are many, many pitfalls in this area and certainly some are still present. Host name validation should not solely done against the CN, this is rather a last resort [citation needed]. Also, an outgoing connection probably does not work against work SNI but certainly should. Also to do: Minor code style cleanup, some more error checking. Cheers, Christoph, beware of easter eggs commit 34539e7e0cafe660c5f1a1670a4a5d0b20a1922e Author: Christoph Biedl <debian.axhn(a)manchmal.in-ulm.de> Date: Sun Nov 2 14:48:34 2014 +0100 Optionally validate certificates on TLS server links Based on From: Florian Westphal <fw(a)strlen.de> Date: Mon, 18 May 2009 00:29:02 +0200 Subject: [PATCH] SSL/TLS: add initial certificate support to openssl backend diff --git a/doc/sample-ngircd.conf.tmpl b/doc/sample-ngircd.conf.tmpl index b5db1d9..a4d58b9 100644 --- a/doc/sample-ngircd.conf.tmpl +++ b/doc/sample-ngircd.conf.tmpl @@ -251,6 +251,13 @@ # is only available when ngIRCd is compiled with support for SSL! # So don't forget to remove the ";" above if this is the case ... + # SSL Trusted CA Certificates File (for verifying peer certificates) + ;CAFile = /etc/ssl/CA/cacert.pem + + # Certificate Revocation File (for marking otherwise valid + # certficates as invalid) + ;CRLFile = /etc/ssl/CA/crl.pem + # SSL Server Key Certificate ;CertFile = :ETCDIR:/ssl/server-cert.pem @@ -275,6 +282,9 @@ # Additional Listen Ports that expect SSL/TLS encrypted connections ;Ports = 6697, 9999 + # Enforce Client Certificates? (Default: false) + ;RequireClientCert = false + [Operator] # [Operator] sections are used to define IRC Operators. There may be # more than one [Operator] block, one for each local operator. diff --git a/man/ngircd.conf.5.tmpl b/man/ngircd.conf.5.tmpl index 0d57f90..f383045 100644 --- a/man/ngircd.conf.5.tmpl +++ b/man/ngircd.conf.5.tmpl @@ -370,6 +370,13 @@ All SSL-related configuration variables are located in the section. Please note that this whole section is only recognized by ngIRCd when it is compiled with support for SSL using OpenSSL or GnuTLS! .TP +\fBCAFile (string)\fR +Filename pointing to the Trusted CA Certificates. This is required for +verifying peer certificates and must be set if <RequireClientCert> is set. +.TP +\fBCRLFile (string)\fR +Filename of Certificate Revocation List. +.TP \fBCertFile\fR (string) SSL Certificate file of the private server key. .TP @@ -398,6 +405,10 @@ OpenSSL only: Password to decrypt the private key file. Same as \fBPorts\fR , except that ngIRCd will expect incoming connections to be SSL/TLS encrypted. Common port numbers for SSL-encrypted IRC are 6669 and 6697. Default: none. +.TP +\fBRequireClientCert (boolean)\fR +Do not accept SSL connections from clients that do not have a valid certificate. Defaults to false. +Also see \fBSSLVerify\fR below. .SH [OPERATOR] .I [Operator] sections are used to define IRC Operators. There may be more than one diff --git a/src/ngircd/conf.c b/src/ngircd/conf.c index 5f8c392..a116a07 100644 --- a/src/ngircd/conf.c +++ b/src/ngircd/conf.c @@ -112,8 +112,16 @@ ConfSSL_Init(void) free(Conf_SSLOptions.CertFile); Conf_SSLOptions.CertFile = NULL; + free(Conf_SSLOptions.CAFile); + Conf_SSLOptions.CAFile = NULL; + + free(Conf_SSLOptions.CRLFile); + Conf_SSLOptions.CRLFile = NULL; + free(Conf_SSLOptions.DHFile); Conf_SSLOptions.DHFile = NULL; + + Conf_SSLOptions.RequireClientCert = false; array_free_wipe(&Conf_SSLOptions.KeyFilePassword); array_free(&Conf_SSLOptions.ListenPorts); @@ -462,7 +470,8 @@ Conf_Test( void ) printf( " Host = %s\n", Conf_Server[i].host ); printf( " Port = %u\n", (unsigned int)Conf_Server[i].port ); #ifdef SSL_SUPPORT - printf( " SSLConnect = %s\n", Conf_Server[i].SSLConnect?"yes":"no"); + printf( " SSLConnect = %s\n", yesno_to_str(Conf_Server[i].SSLConnect)); + printf( " SSLVerify = %s\n", yesno_to_str(Conf_Server[i].SSLVerify)); #endif printf( " MyPassword = %s\n", Conf_Server[i].pwd_in ); printf( " PeerPassword = %s\n", Conf_Server[i].pwd_out ); @@ -1037,6 +1046,11 @@ Read_Config(bool TestOnly, bool IsStarting) CheckFileReadable("CertFile", Conf_SSLOptions.CertFile); CheckFileReadable("DHFile", Conf_SSLOptions.DHFile); CheckFileReadable("KeyFile", Conf_SSLOptions.KeyFile); + if (Conf_SSLOptions.RequireClientCert) { + CheckFileReadable("CAFile", Conf_SSLOptions.CAFile); + if (Conf_SSLOptions.CRLFile) + CheckFileReadable("CRLFile", Conf_SSLOptions.CRLFile); + } /* Set the default ciphers if none were configured */ if (!Conf_SSLOptions.CipherList) @@ -1912,6 +1926,20 @@ Handle_SSL(const char *File, int Line, char *Var, char *Arg) Conf_SSLOptions.CipherList = strdup_warn(Arg); return; } + if (strcasecmp(Var, "CAFile") == 0) { + assert(Conf_SSLOptions.CAFile == NULL); + Conf_SSLOptions.CAFile = strdup_warn( Arg ); + return; + } + if (strcasecmp(Var, "CRLFile") == 0) { + assert(Conf_SSLOptions.CRLFile == NULL); + Conf_SSLOptions.CRLFile = strdup_warn( Arg ); + return; + } + if (strcasecmp(Var, "RequireClientCert") == 0) { + Conf_SSLOptions.RequireClientCert = Check_ArgIsTrue( Arg ); + return; + } Config_Error_Section(File, Line, Var, "SSL"); } @@ -2043,6 +2071,10 @@ Handle_SERVER(const char *File, int Line, char *Var, char *Arg ) New_Server.SSLConnect = Check_ArgIsTrue(Arg); return; } + if( strcasecmp( Var, "SSLVerify" ) == 0 ) { + New_Server.SSLVerify = Check_ArgIsTrue(Arg); + return; + } #endif if( strcasecmp( Var, "Group" ) == 0 ) { /* Server group */ @@ -2277,6 +2309,10 @@ Validate_Config(bool Configtest, bool Rehash) array_length(&Conf_Channels, sizeof(struct Conf_Channel))); #endif +#ifdef SSL_SUPPORT + if (Conf_SSLOptions.RequireClientCert && array_bytes(&Conf_ListenPorts)) + Log(LOG_WARNING, "SSL certificate validation enabled, (RequireClientCert=yes), but non-SSL listening ports are set"); +#endif return config_valid; } @@ -2407,6 +2443,9 @@ Init_Server_Struct( CONF_SERVER *Server ) Proc_InitStruct(&Server->res_stat); Server->conn_id = NONE; memset(&Server->bind_addr, 0, sizeof(Server->bind_addr)); +#ifdef SSL_SUPPORT + Server->SSLVerify = false; +#endif } /* -eof- */ diff --git a/src/ngircd/conf.h b/src/ngircd/conf.h index aa80b8d..12ad6f5 100644 --- a/src/ngircd/conf.h +++ b/src/ngircd/conf.h @@ -61,6 +61,7 @@ typedef struct _Conf_Server ng_ipaddr_t dst_addr[2]; /**< List of addresses to connect to */ #ifdef SSL_SUPPORT bool SSLConnect; /**< Establish connection using SSL? */ + bool SSLVerify; /**< Verify server certificate using CA? */ #endif char svs_mask[CLIENT_ID_LEN]; /**< Mask of nicknames that should be treated and counted as services */ @@ -76,6 +77,9 @@ struct SSLOptions { array ListenPorts; /**< Array of listening SSL ports */ array KeyFilePassword; /**< Key file password */ char *CipherList; /**< Set SSL cipher list to use */ + char *CAFile; /**< Trusted CA certificates file */ + char *CRLFile; /**< Certificate revocation file */ + bool RequireClientCert; /**< Enforce client certifiactes? */ }; #endif diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c index c9bbdd2..3e21ad2 100644 --- a/src/ngircd/conn-ssl.c +++ b/src/ngircd/conn-ssl.c @@ -47,8 +47,11 @@ static SSL_CTX * ssl_ctx; static DH *dh_params; static bool ConnSSL_LoadServerKey_openssl PARAMS(( SSL_CTX *c )); +static bool ConnSSL_SetVerifyProperties_openssl PARAMS(( SSL_CTX *c )); #endif +#define MAX_CERT_CHAIN_LENGTH 10 /* XXX: do not hardcode */ + #ifdef HAVE_LIBGNUTLS #include <sys/types.h> #include <sys/stat.h> @@ -61,10 +64,16 @@ static bool ConnSSL_LoadServerKey_openssl PARAMS(( SSL_CTX *c )); #define MAX_HASH_SIZE 64 /* from gnutls-int.h */ +gnutls_x509_crl_t *crl_list; +gnutls_x509_crt_t *ca_list; +size_t crl_list_size; +size_t ca_list_size; + static gnutls_certificate_credentials_t x509_cred; static gnutls_dh_params_t dh_params; static gnutls_priority_t priorities_cache; static bool ConnSSL_LoadServerKey_gnutls PARAMS(( void )); +static bool ConnSSL_SetVerifyProperties_gnutls PARAMS(( void )); #endif #define SHA256_STRING_LEN (32 * 2 + 1) @@ -126,6 +135,34 @@ out: * @param info Additional information text or NULL. */ static void +LogOpenSSL_CertInfo(X509 *cert, const char *msg) +{ + BIO *mem; + char *memptr; + long len; + + assert(cert); + assert(msg); + + if (!cert) return; + + mem = BIO_new(BIO_s_mem()); + if (!mem) return; + + X509_NAME_print_ex(mem, X509_get_subject_name (cert), 4, XN_FLAG_ONELINE); + X509_NAME_print_ex(mem, X509_get_issuer_name (cert), 4, XN_FLAG_ONELINE); + if (BIO_write(mem, "", 1) == 1) { + len = BIO_get_mem_data(mem, &memptr); + assert(memptr); + assert(len>0); + Log(LOG_INFO, "%s: \"%s\"", msg, memptr); + } + + (void)BIO_set_close(mem, BIO_CLOSE); + BIO_free(mem); +} + +static void LogOpenSSLError(const char *error, const char *info) { unsigned long err = ERR_get_error(); @@ -167,9 +204,33 @@ pem_passwd_cb(char *buf, int size, int rwflag, void *password) static int -Verify_openssl(UNUSED int preverify_ok, UNUSED X509_STORE_CTX *x509_ctx) +Verify_openssl(int preverify_ok, X509_STORE_CTX *ctx) { - return 1; + X509 *err_cert; + int err, depth; + + err_cert = X509_STORE_CTX_get_current_cert(ctx); + err = X509_STORE_CTX_get_error(ctx); + depth = X509_STORE_CTX_get_error_depth(ctx); + + LogDebug("preverify_ok %d error:num=%d:%s:depth=%d", + preverify_ok, err, X509_verify_cert_error_string(err), depth); + + if (preverify_ok != 1) { + /* + * if certificates are not being enforced, ignore any errors. + * its possible to check if a connection has a valid certificate + * by testing the CONN_SSL_PEERCERT_OK flag. + * This can be used to enforce certificates for incoming servers, + * but not irc clients. + */ + if (!Conf_SSLOptions.RequireClientCert) + preverify_ok = 1; + else + Log(LOG_ERR, "verify error:num=%d:%s:depth=%d", err, + X509_verify_cert_error_string(err), depth); + } + return preverify_ok; } #endif @@ -317,6 +378,9 @@ ConnSSL_InitLibrary( void ) goto out; } + if (!ConnSSL_SetVerifyProperties_openssl(newctx)) + goto out; + SSL_CTX_set_options(newctx, SSL_OP_SINGLE_DH_USE|SSL_OP_NO_SSLv2); SSL_CTX_set_mode(newctx, SSL_MODE_ENABLE_PARTIAL_WRITE); SSL_CTX_set_verify(newctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE, @@ -358,6 +422,9 @@ out: goto out; } + if (!ConnSSL_SetVerifyProperties_gnutls()) + goto out; + Log(LOG_INFO, "GnuTLS %s initialized.", gnutls_check_version(NULL)); initialized = true; return true; @@ -370,6 +437,30 @@ out: #ifdef HAVE_LIBGNUTLS static bool +ConnSSL_SetVerifyProperties_gnutls(void) +{ + int err; + + if (Conf_SSLOptions.CAFile) { + err = gnutls_certificate_set_x509_trust_file(x509_cred, Conf_SSLOptions.CAFile, GNUTLS_X509_FMT_PEM); + if (err < 0) { + Log(LOG_ERR, "Failed to load x509 trust file %s: %s", Conf_SSLOptions.CAFile, gnutls_strerror(err)); + return false; + } + } + if (Conf_SSLOptions.CRLFile) { + err = gnutls_certificate_set_x509_crl_file(x509_cred, Conf_SSLOptions.CRLFile, GNUTLS_X509_FMT_PEM); + if (err < 0) { + Log(LOG_ERR, "Failed to load x509 crl file %s: %s", Conf_SSLOptions.CRLFile, gnutls_strerror(err)); + return false; + } + } + + return true; +} + + +static bool ConnSSL_LoadServerKey_gnutls(void) { int err; @@ -455,6 +546,48 @@ ConnSSL_LoadServerKey_openssl(SSL_CTX *ctx) } +static bool +ConnSSL_SetVerifyProperties_openssl(SSL_CTX * ctx) +{ + X509_STORE *store = NULL; + X509_LOOKUP *lookup; + int verify_flags = SSL_VERIFY_PEER; + bool ret = false; + + if (!Conf_SSLOptions.CAFile) + return true; + + if (SSL_CTX_load_verify_locations(ctx, Conf_SSLOptions.CAFile, NULL) != 1) { + LogOpenSSLError("SSL_CTX_load_verify_locations", NULL); + goto out; + } + + store = SSL_CTX_get_cert_store(ctx); + assert(store); + lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file()); + if (!lookup) { + LogOpenSSLError("X509_STORE_add_lookup", Conf_SSLOptions.CRLFile); + goto out; + } + + if (1 != X509_load_crl_file(lookup, Conf_SSLOptions.CRLFile, X509_FILETYPE_PEM)) { + LogOpenSSLError("X509_load_crl_file", Conf_SSLOptions.CRLFile); + goto out; + } + + if (Conf_SSLOptions.RequireClientCert) + verify_flags |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT; + + SSL_CTX_set_verify(ctx, verify_flags, Verify_openssl); + SSL_CTX_set_verify_depth(ctx, MAX_CERT_CHAIN_LENGTH); + ret = true; + out: + free(Conf_SSLOptions.CRLFile); + Conf_SSLOptions.CRLFile = NULL; + return ret; +} + + #endif static bool ConnSSL_Init_SSL(CONNECTION *c) @@ -540,7 +673,11 @@ ConnSSL_PrepareConnect(CONNECTION *c, UNUSED CONF_SERVER *s) Conn_OPTION_ADD(c, CONN_SSL_CONNECT); #ifdef HAVE_LIBSSL assert(c->ssl_state.ssl); - SSL_set_verify(c->ssl_state.ssl, SSL_VERIFY_NONE, NULL); + + if (s->SSLVerify) + SSL_set_verify(c->ssl_state.ssl, SSL_VERIFY_PEER, Verify_openssl); + else + SSL_set_verify(c->ssl_state.ssl, SSL_VERIFY_NONE, NULL); #endif return true; } @@ -639,27 +776,191 @@ ConnSSL_HandleError(CONNECTION * c, const int code, const char *fname) } +#ifdef HAVE_LIBGNUTLS +static bool check_verification(unsigned output) +{ + char errmsg[256] = ""; + + if (output & GNUTLS_CERT_SIGNER_NOT_FOUND) + strlcpy(errmsg, "No Issuer found", sizeof errmsg); + if (output & GNUTLS_CERT_SIGNER_NOT_CA) { + if (errmsg[0]) + strlcat(errmsg, " ,", sizeof errmsg); + strlcat(errmsg, "Issuer is not a CA", sizeof errmsg); + } + if (output & GNUTLS_CERT_INSECURE_ALGORITHM) { + if (errmsg[0]) + strlcat(errmsg, " ,", sizeof errmsg); + strlcat(errmsg, "Insecure Algorithm", sizeof errmsg); + } + if (output & GNUTLS_CERT_REVOKED) { + if (errmsg[0]) + strlcat(errmsg, " ,", sizeof errmsg); + strlcat(errmsg, "Certificate Revoked", sizeof errmsg); + } +#ifdef DEBUG + if (output & GNUTLS_CERT_INVALID) + assert(errmsg[0]); /* check for unhandled error */ +#endif + if (!(output & GNUTLS_CERT_INVALID) && !errmsg[0]) { + LogDebug("Certificate verified."); + return true; + } + Log(LOG_ERR, "Certificate Validation failed: %s", errmsg); + return false; +} + +static void *LogMalloc(size_t s) +{ + void *mem = malloc(s); + if (!mem) + Log(LOG_ERR, "Out of memory: Could not allocate %lu byte", (unsigned long) s); + return mem; +} + +static void +LogGnuTLS_CertInfo(gnutls_x509_crt_t cert, const char *msg) +{ + char *dn, *issuer_dn; + size_t size = 0; + int err = gnutls_x509_crt_get_dn(cert, NULL, &size); + if (size == 0 || (err && err != GNUTLS_E_SHORT_MEMORY_BUFFER)) + goto err_crt_get; + dn = LogMalloc(size); + if (!dn) + return; + err = gnutls_x509_crt_get_dn(cert, dn, &size); + if (err) { + err_crt_get: + Log(LOG_ERR, "gnutls_x509_crt_get_dn: %s", err ? gnutls_strerror(err) : "size == 0"); + return; + } + gnutls_x509_crt_get_issuer_dn(cert, NULL, &size); + assert(size); + issuer_dn = LogMalloc(size); + if (!issuer_dn) { + Log(LOG_INFO, "%s: Distinguished Name: %s", msg, dn); + free(dn); + return; + } + gnutls_x509_crt_get_issuer_dn(cert, issuer_dn, &size); + Log(LOG_INFO, "%s: Distinguished Name: \"%s\", Issuer \"%s\"", msg, dn, issuer_dn); + free(dn); + free(issuer_dn); +} +#endif + static void ConnSSL_LogCertInfo( CONNECTION *c ) { + const char *comp_alg = "no compression"; + bool cert_seen = false, cert_ok = false, cn_match = false; + char msg[128]; #ifdef HAVE_LIBSSL + const void *comp; + X509 *client_cert = NULL; SSL *ssl = c->ssl_state.ssl; assert(ssl); - - Log(LOG_INFO, "Connection %d: initialized %s using cipher %s.", - c->sock, SSL_get_version(ssl), SSL_get_cipher(ssl)); + comp=SSL_get_current_compression(ssl); + if (comp) { + Conn_OPTION_ADD(c, CONN_SSL_COMPRESSION); + comp_alg = SSL_COMP_get_name(comp); + } + Log(LOG_INFO, "Connection %d: initialized %s using cipher %s, %s.", + c->sock, SSL_get_version(ssl), SSL_get_cipher(ssl), comp_alg); + client_cert = SSL_get_peer_certificate(ssl); + if (client_cert) { + int err = SSL_get_verify_result(ssl); + if (err == X509_V_OK) + cert_ok = true; + else + Log(LOG_ERR, "Certificate Validation failed: %s", X509_verify_cert_error_string(err)); + X509_NAME *subjectName; + char cn[256]; + subjectName = X509_get_subject_name(client_cert); + X509_NAME_get_text_by_NID( + subjectName, NID_commonName, cn, sizeof(cn)); + if (strcmp (cn, c->host) == 0) + cn_match = true; + else + Log(LOG_ERR, "CN mismatch! Got \"%s\", expected \"%s\"", cn, c->host); + + snprintf(msg, sizeof(msg), "%svalid peer certificate", cert_ok ? "":"in"); + LogOpenSSL_CertInfo(client_cert, msg); + X509_free(client_cert); + cert_seen = true; + } #endif #ifdef HAVE_LIBGNUTLS + unsigned int status; + int ret; + gnutls_credentials_type_t cred; gnutls_session_t sess = c->ssl_state.gnutls_session; gnutls_cipher_algorithm_t cipher = gnutls_cipher_get(sess); + gnutls_compression_method_t comp = gnutls_compression_get(sess); - Log(LOG_INFO, "Connection %d: initialized %s using cipher %s-%s.", + if (comp != GNUTLS_COMP_NULL) + comp_alg = gnutls_compression_get_name(comp); + Log(LOG_INFO, "Connection %d: initialized %s using cipher %s-%s, %s.", c->sock, gnutls_protocol_get_name(gnutls_protocol_get_version(sess)), gnutls_cipher_get_name(cipher), - gnutls_mac_get_name(gnutls_mac_get(sess))); + gnutls_mac_get_name(gnutls_mac_get(sess)), + comp_alg); + ret = gnutls_certificate_verify_peers2(c->ssl_state.gnutls_session, &status); + if (ret < 0) + Log(LOG_ERR, "gnutls_certificate_verify_peers2 failed: %s", gnutls_strerror(ret)); + if (ret == 0 && check_verification(status)) + cert_ok = true; + + cred = gnutls_auth_get_type (c->ssl_state.gnutls_session); + if (cred == GNUTLS_CRD_CERTIFICATE) { + gnutls_x509_crt_t cert; + unsigned cert_list_size; + const gnutls_datum_t *cert_list = gnutls_certificate_get_peers(sess, &cert_list_size); + if (!cert_list) { + Log(LOG_ERR, "gnutls_certificate_get_peers() failed"); + return; + } + assert(cert_list_size > 0); + gnutls_x509_crt_init(&cert); + gnutls_x509_crt_import(cert, cert_list, GNUTLS_X509_FMT_DER); + + char *cn; + size_t size = 0; + int err = gnutls_x509_crt_get_dn_by_oid(cert, + GNUTLS_OID_X520_COMMON_NAME, + 0, 0, NULL, &size); + if (size == 0 || (err && err != GNUTLS_E_SHORT_MEMORY_BUFFER)) + goto done_cn_validation; + cn = LogMalloc(size); + if (!cn) + goto done_cn_validation; + gnutls_x509_crt_get_dn_by_oid (cert, + GNUTLS_OID_X520_COMMON_NAME, + 0, 0, cn, &size); + if (strcmp (cn, c->host) == 0) + cn_match = true; + else + Log(LOG_ERR, "CN mismatch! Got \"%s\", expected \"%s\"", cn, c->host); + free (cn); +done_cn_validation: + + snprintf(msg, sizeof(msg), "%svalid peer certificate", cert_ok ? "":"in"); + LogGnuTLS_CertInfo(cert, msg); + gnutls_x509_crt_deinit(cert); + cert_seen = true; + } #endif + /* + * can be used later to check if connection was authenticated, e.g. if inbound connection + * tries to register itself as server. could also restrict /OPER to authenticated connections, etc. + */ + if (cert_ok && cn_match) + Conn_OPTION_ADD(c, CONN_SSL_PEERCERT_OK); + if (!cert_seen) + Log(LOG_INFO, "Peer did not present a certificate"); } @@ -676,12 +977,15 @@ ConnSSL_Accept( CONNECTION *c ) assert(c != NULL); if (!Conn_OPTION_ISSET(c, CONN_SSL)) { #ifdef HAVE_LIBGNUTLS + gnutls_certificate_request_t req; int err = gnutls_init(&c->ssl_state.gnutls_session, GNUTLS_SERVER); if (err) { Log(LOG_ERR, "Failed to initialize new SSL session: %s", gnutls_strerror(err)); return false; } + req = Conf_SSLOptions.RequireClientCert ? GNUTLS_CERT_REQUIRE : GNUTLS_CERT_REQUEST; + gnutls_certificate_server_set_request(c->ssl_state.gnutls_session, req); #endif if (!ConnSSL_Init_SSL(c)) return -1; @@ -744,7 +1048,7 @@ ConnSSL_InitCertFp( CONNECTION *c ) gnutls_x509_crt_deinit(cert); return 0; } - + if (gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER) != GNUTLS_E_SUCCESS) { gnutls_x509_crt_deinit(cert); diff --git a/src/ngircd/conn.c b/src/ngircd/conn.c index 6256154..418728e 100644 --- a/src/ngircd/conn.c +++ b/src/ngircd/conn.c @@ -269,6 +269,7 @@ server_login(CONN_ID idx) Conf_ServerName, Conf_ServerInfo); } + /** * IO callback for established non-SSL client and server connections. * @@ -335,6 +336,48 @@ Conn_Init( void ) Init_Conn_Struct(i); } /* Conn_Init */ + +/* + * create protocol and server identification. + * The syntax used by ngIRCd in PASS commands and the extended flags + * are described in doc/Protocol.txt + * + * @param i connection index, may be < 0 to get compile-time constants + * @return pointer to static buffer with the connection flags matching i. + */ +GLOBAL const char* +Conn_BuildProtoID(CONN_ID i) +{ + static char proto[256]; +#ifdef IRCPLUS + snprintf(proto, sizeof(proto), "%s%s %s|%s:%s", PROTOVER, PROTOIRCPLUS, PACKAGE_NAME, PACKAGE_VERSION, IRCPLUSFLAGS); +#ifdef ZLIB + /* don't bother with link compression if ssl already does it */ +#ifdef SSL_SUPPORT + if (i < 0 || !Conn_OPTION_ISSET(&My_Connections[i], CONN_SSL_COMPRESSION)) +#else + if (i < 0) +#endif + strlcat(proto, "Z", sizeof(proto)); +#endif + if (Conf_OperCanMode) + strlcat(proto, "o", sizeof(proto)); +#else + snprintf(proto, sizeof(proto), "%s%s %s|%s", PROTOVER, PROTOIRC, PACKAGE_NAME, PACKAGE_VERSION); +#endif + strlcat(proto, " P", sizeof(proto)); +#ifdef ZLIB +#ifdef SSL_SUPPORT + if (i < 0 || !Conn_OPTION_ISSET(&My_Connections[i], CONN_SSL_COMPRESSION)) +#else + if (i < 0) +#endif + strlcat(proto, "Z", sizeof(proto)); +#endif + return proto; +} + + /** * Clean up connection module. */ @@ -2523,6 +2566,7 @@ static void cb_connserver_login_ssl(int sock, short unused) { CONN_ID idx = Socket2Index(sock); + int serveridx; assert(idx >= 0); if (idx < 0) { @@ -2540,10 +2584,25 @@ cb_connserver_login_ssl(int sock, short unused) return; } + serveridx = Conf_GetServer(idx); + assert(serveridx >= 0); + if (serveridx < 0) + goto err; + Log( LOG_INFO, "SSL connection %d with \"%s:%d\" established.", idx, My_Connections[idx].host, Conf_Server[Conf_GetServer( idx )].port ); + if (Conf_Server[serveridx].SSLVerify && + !Conn_OPTION_ISSET(&My_Connections[idx], CONN_SSL_PEERCERT_OK)) + { + Log(LOG_ERR, "SSLVerify enabled for %d, but peer certificate check failed", idx); + goto err; + } server_login(idx); + return; + err: + Log(LOG_ERR, "SSL connection on socket %d failed!", sock); + Conn_Close(idx, "Can't connect!", NULL, false); } diff --git a/src/ngircd/conn.h b/src/ngircd/conn.h index c642541..258dcb5 100644 --- a/src/ngircd/conn.h +++ b/src/ngircd/conn.h @@ -40,7 +40,9 @@ #define CONN_SSL 32 /* this connection is SSL encrypted */ #define CONN_SSL_WANT_WRITE 64 /* SSL/TLS library needs to write protocol data */ #define CONN_SSL_WANT_READ 128 /* SSL/TLS library needs to read protocol data */ -#define CONN_SSL_FLAGS_ALL (CONN_SSL_CONNECT|CONN_SSL|CONN_SSL_WANT_WRITE|CONN_SSL_WANT_READ) +#define CONN_SSL_PEERCERT_OK 256 /* peer presented a valid certificate (used to check inbound server auth */ +#define CONN_SSL_COMPRESSION 512 /* SSL/TLS link is compressed */ +#define CONN_SSL_FLAGS_ALL (CONN_SSL_CONNECT|CONN_SSL|CONN_SSL_WANT_WRITE|CONN_SSL_WANT_READ|CONN_SSL_PEERCERT_OK|CONN_SSL_COMPRESSION) #endif typedef int CONN_ID; @@ -143,6 +145,7 @@ GLOBAL char *Conn_GetCertFp PARAMS((CONN_ID Idx)); GLOBAL bool Conn_SetCertFp PARAMS((CONN_ID Idx, const char *fingerprint)); GLOBAL bool Conn_UsesSSL PARAMS((CONN_ID Idx)); +GLOBAL const char* Conn_BuildProtoID PARAMS((CONN_ID i)); #ifdef SSL_SUPPORT GLOBAL bool Conn_GetCipherInfo PARAMS((CONN_ID Idx, char *buf, size_t len)); #endif diff --git a/src/ngircd/irc-server.c b/src/ngircd/irc-server.c index 92186af..6f64c3b 100644 --- a/src/ngircd/irc-server.c +++ b/src/ngircd/irc-server.c @@ -97,6 +97,21 @@ IRC_SERVER( CLIENT *Client, REQUEST *Req ) return DISCONNECTED; } +#ifdef SSL_SUPPORT + /* + * This check is only done if RequireClientCert is disabled, and this Servers [SERVER] section has + * "SSLVerify" enabled. + * (if RequireClientCert is set, certificate validation is done during SSL/TLS handshake) + */ + CONN_ID con = Client_Conn (Client); + if (Conf_Server[i].SSLVerify && !(Conn_Options(con) & CONN_SSL_PEERCERT_OK)) { + Log(LOG_ERR, "Connection %d: SSLVerify is set, and server \"%s\" did not present a valid certificate", + Client_Conn(Client), Req->argv[0]); + Conn_Close(Client_Conn(Client), NULL, "No valid SSL certificate", true); + return DISCONNECTED; + } +#endif + /* Is there a registered server with this ID? */ if (!Client_CheckID(Client, Req->argv[0])) return DISCONNECTED;

1 0

Re: [ngIRCd-ML] Fixing site influence on testsuite success
by Christoph Biedl 22 Okt '14

22 Okt '14

[ something ate my message, second try ] Hello, there's a longstanding issue in ngircd, at least on (Debian) Linux using glibc: Some tests in src/festsuite rely on a certain order of the entries in /etc/hosts. Appearently the first entry that points to 127.0.0.1 is returned when getnameinfo, same for gethostbyaddr, is called for that IP address. Up to three tests (misc, who, whois) assume the result is or begins with "localhost", and will fail otherwise. This usually happens if the administrator of the site where ngircd is built has decided to have an entry about the host name at the first place in /etc/hosts. Now I'm not aware whether there's a rule about this at all. And even if, it is violated that often I'd call it a bad idea to try educating users. Instead, ngircd should work around it. Two ways I can think of: Before running the tests, call getnameinfo on 127.0.0.1 and patch any non-"localhost*" result into the expect files. This looks kludgy, especially since some tests use pattern matching like in 'send "who ??cal*ho*\r"'. So after a few hours of trying, a second idea: Enhance ngircd's resolver to resolve 127.0.0.1 into "localhost" no matter what. To avoid surprises, this should be controllable by another command line option. Using LD_PRELOAD during the tests was a variant. Thoughts? Christoph

1 3

Patch to Disable SSLv3 (POODLE)
by lists＠packetmail.net 16 Okt '14

16 Okt '14

Hello, some time ago I had created some patches for a specific cipher list with ngircd. In reference to the SSLv3 issue (POODLE) the below patch also addresses this issue. The key is just adding "SSL_OP_NO_SSLv3" to the SSL_CTX_set_options function. --- /backup/archives/system_101514/root/src/ngircd-22/src/ngircd/conn-ssl.c 2014-10-13 09:57:54.000000000 -0500 +++ ./src/ngircd/conn-ssl.c 2014-10-15 09:35:23.000000000 -0500 @@ -324,7 +324,8 @@ Log(LOG_INFO, "Successfully applied SSL CipherList=%s", "EDH+aRSA:!SSLv2:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS"); } - SSL_CTX_set_options(newctx, SSL_OP_SINGLE_DH_USE|SSL_OP_NO_SSLv2); + /* NCF, Oct 15 2014, Disable SSLv3 (POODLE) */ + SSL_CTX_set_options(newctx, SSL_OP_SINGLE_DH_USE|SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3); SSL_CTX_set_mode(newctx, SSL_MODE_ENABLE_PARTIAL_WRITE); SSL_CTX_set_verify(newctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE, Verify_openssl); Cheers, Nathan

3 5

ngIRCd 22~rc1
by Alexander Barton 11 Okt '14

11 Okt '14

Hello again! I tagged the first release candidate for our upcoming next „feature release“ of ngIRCd today: ngIRCd Release 22~rc1. There have been more than 100 individual commits since ngIRCd 21, the NEWS file lists 20 new „features“, please pick your favorite yourself: • Sync "except lists" between servers: Up to now, ban, invite, and G-Line lists have been synced between servers while linking -- but obviously nobody noticed that except list have been missing ever since. Until now. Thanks to "j4jackj", who reported this issue in #ngircd. • Allow longer user names (up to 63 characters) for authentication. • Increase MAX_SERVERS from 16 to 64: There are installations out there that would like to configure more than 16 links per server, so increase this limit. Best would be to get rid of MAX_SERVERS altogether and make if fully dynamic, but start with this quick and dirty hack ... • Test suite/platformtest.sh: Detect when tests have been skipped. • Allow "DefaultUserModes" to set all possible modes, including modes only settable by IRC Operators. • Implement user mode "F": "relaxed flood protection". Clients with mode "F" set are allowed to rapidly send data to the daemon. This mode is only settable by IRC Operators and can cause problems in the network -- so be careful and only set it on "trusted" clients! User mode "F" is used by Bahamut for this purpose, for example. • Use server password when PAM is compiled in but disabled. • Streamline punctuation of log messages. • Return ISUPPORT(005) numerics on "VERSION". This is how ircd-seven, Charybdis, Hybrid, and InspIRCd behave, for example. • configure: Only link "contrib/Debian" if it exists, which isn't the case on "VPATH builds", for example. • Show the account name in WHOIS. This uses the same numeric as Charybdis and ircu families: WHOISLOGGEDIN(330). • Pattern matching: Remove "range matching" in our pattern matching code using the "[...]" syntax, because [ and ] are valid characters in nick names and one has to quote them currently using the "\" character, which is quite unexpected for users. • platformtest.sh: New option "-x", don't regenerate build system and allow using separate source and build trees. • Test suite: explicitly enable glibc memory checking. • Make "MODE -k" handling more robust and compatible, send "fake '*' key" in all replies. • portabtest: Actually test the functions snprintf(), strlcpy(), strlcat(), and vsnprintf() for correctness, not only existence (which was quite useless, because if they weren't available, the program could not have been linked at all ...). • Implement new configuration option "Network": it is used to set the (completely optional) "network name", to which this instance of the daemon belongs. When set, this name is used in the ISUPPORT(005) numeric which is sent to all clients connecting to the server after logging in. • Update doc/Platforms.txt. • Various code cleanups, remove unused code, streamline error handling. Remove all imp.h and exp.h header files, support non-standard vsnprintf() return codes, and fix some K&R C portability issues. Streamline DEBUG_ARRAY, DEBUG_BUFFER, DEBUG_IO, DEBUG_ZIP definitions. • Increase penalty time to 10 seconds when handling OPER commands with an invalid password. Please test this release candidate thoroughly and report all glitches, problems, errors, and regressions you encounter! Best is to file bugs and feature requests here: ngIRCd Bug Tracker: <http://ngircd.barton.de/bugzilla/> You can find more information on our homepage at <http://ngircd.barton.de/> and its mirror <http://http://ngircd.mirror.3rz.org/>. The primary download locations is: • <http://ngircd.barton.de/pub/ngircd/> And as usual: a big THANKS to all users, bug reporters, contributors, packagers, and supporters! Have fun! Alex

1 1

Re: [ngIRCd-ML] Feld "Benutzername" soll nicht den wahren Benutzernamen des Host-OS-Kontos eines jeden Besuchers anzeigen
by Max Rieger 04 Okt '14

04 Okt '14

Am 04.10.2014 um 19:07 schrieb Götz Hoffart: > Am 04.10.2014 um 18:32 schrieb Max Rieger <root(a)dynamic-port.net>: > >> When i write in an new line "CloakUserToNick = secret", save the file and reload/restart the IRC-Server, i can not see an change at field "Benutzername" (for english: Username. But not Nickname!) at my User-Entry in IRC-Client and at every another Users. > The setting for that is 'yes' or 'no', not 'secret'. After setting this you must HUP or restart ngIRCd. > > Did you see/read that the setting of the username is done by the IRC client? You can change it there. > >> Before i check for change, i have me logout from my IRC-Channel and login again. And value-set "yes" is that self, why "no". > I don’t understand these two sentences, sorry. > > Regards > Götz Before i write to this ML, i have it check with "CloakUserToNick = yes" and "CloakUserToNick = no". To this time i have not see an change but now can sea an change. Thanks! rfnddh4imk2rst7w.onion

1 0

Feld "Benutzername" soll nicht den wahren Benutzernamen des Host-OS-Kontos eines jeden Besuchers anzeigen
by Max Rieger 04 Okt '14

04 Okt '14

Hallo! Ich wusste nicht, dass es bei IRC üblich ist den echten Benutzernamen, mit dem man sich beim eigenen Betriebssystem angemeldet hat, mit zu übertragen und gar für Besucher anzuzeigen. Für mich und die Besucher stellt das ein Sicherheitsproblem dar. Mit "CloakHost" kann ich das Problem nicht beheben - dass wurde mir als Lösung aus dem IRC-Raum "ngircd" des Servers "irc.barton.de" genannt, vermeintliche Lösung also. Der Wert zu "Benutzername" wird sicherlich nicht zur Identifikation vom IRC-Server gebraucht, weder noch unter einander oder liege ich da falsch? Weil selbst wenn, könnte man ja wenigstens dafür sorgen, dass jeder sich anmeldende Besucher stattdessen einen zufälligen Zeichensalat für "Benutzername" bekommt, der nur bis zum wieder abmelden und Time-out gilt. Ich bitte um eine schnelle Lösung. Danke!

2 2

Custom PAM module
by Alexey Kuznetsov 15 Sep '14

15 Sep '14

Hello! I'm looking forward to use ngIRCd on my Debian box. I need simple as possible ircd with one feature: allow users to protect his nick names from overtaking. It can be done with NICKSERV bots. Unfortunately Debian has no nickserv services packaged yet and this is not an option. I see ngIRCd has PAM module authentication support which can help me a lot. I can configure ngIRCd to use PAM but I do not know how to allow non registered users to join using PAM. Can you suggest PAM configuration file, which is going to allow ALL users to connect, but ask for password for registered users on system (or pwd file). This will allow me to protect registred names and allow guests to connect to the server. That would be nice if this will appears in ngIRCd documentation as well. -- AK

3 2

Porting over an old ircd config to ngircd
by Henry Podham 14 Sep '14

14 Sep '14

Hi all, I'm trying to switch my very old IRC server from using ircd (from 10 years ago) to the newer ngircd. I've been mulling over the old ircd config trying to understand the Y, C and H lines that were put there long ago. However, I'm having trouble figuring out how to translate all these old config lines into the ngircd format. Has anyone else ported over old configs understand them enough to provide some guidance? Thanks, Henry

2 1

ngIRCd 21.1 with gcc + musl-libc
by Götz Hoffart 13 Sep '14

13 Sep '14

ngIRCd 21.1 has been configured with the following options: Host: x86_64-unknown-linux-gnu Compiler: /usr/local/musl/bin/musl-gcc -std=gnu99 Compiler flags: -g -O2 -pipe -W -Wall -Wpointer-arith -Wstrict-prototypes -fstack-protector -DSYSCONFDIR='"$(sysconfdir)"' -DDOCDIR='"$(docdir)"' 'ngircd' binary: /usr/local/sbin Configuration file: /usr/local/etc Manual pages: /usr/local/share/man Documentation: /usr/local/share/doc/ngircd Syslog support: yes Enable debug code: no zlib compression: no IRC sniffer: no Use TCP Wrappers: no Strict RFC mode: no IDENT support: no IRC+ protocol: yes IPv6 protocol: no I/O backend: epoll(), select() PAM support: no SSL support: no libiconv support: no the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/unknown/linux-gnu gcc 4.4.5 21.1 14-09-13 goetz Y Y Y Y 1 $ uname -a Linux s1.hoffart.de 2.6.32-5-amd64 #1 SMP Sat Jul 12 16:47:57 UTC 2014 x86_64 GNU/Linux $ cat /etc/debian_version 6.0.10 Grüße Götz

1 0

username length
by Marco Schirrmeister 03 Sep '14

03 Sep '14

Hello, the username length is set to 20 in the source code. (defines.h CLIENT_USER_LEN) I need to use authentication on our irc server. But unfortunately our user id that we can use is the email address. There is no other shorter uid yet. The email addresses are of course longer then 20 for most of the users. Do you see a problem of increasing this value to 50? Except that max messages length will be shorter. I mean if I would change it, do other parts of the code need to be changed? Or could there maybe strange problems in whatever cases? I tested it and it works in general, but I still wanted to ask. Thanks Marco

2 3

ngircd servers connection
by Иван Дементьев 01 Sep '14

01 Sep '14

Dear Alex, Is it possible to connect couple of ngircds using '/connect <IP-address>' command when you are IRCOP? I tried such command in irc-client (Xchat): /connect 192.168.1.2 /connect 192.168.1.2 6667 In both cases I saw message: ' 192.168.1.2 : No such server ' In configuration file I have no any [Server] sections except default where all directives are commented. Hmm... config file is fully default actually :) -- Thank you Ivan Dementev

2 1

SSL and plain-text interfaces
by Aroon Pahwa 25 Aug '14

25 Aug '14

Hi, I’m trying to configure ngIRCd to listen on all interfaces for SSL connections and only on localhost for non-SSL connections. As far as I can tell, you can only specify interfaces in the Global configuration section and can only specify Ports in the SSL configuration section (not additional interfaces). So there is no way to open a non-SSL port on a different interface than SSL. Any ideas on how to achieve this? Is a code change required? Thanks, Aroon

2 2

SonarQube
by Götz Hoffart 10 Aug '14

10 Aug '14

http://www.sonarqube.org “SonarQube is an open source platform for Continuous Inspection of code quality.” “Offers reports on duplicated code, coding standards, unit tests, code coverage,complex code, potential bugs, comments and design and architecture.” Grüße Götz

1 0

Kline question
by Neuman1812 01 Aug '14

01 Aug '14

is kline a valid command? I get command not found. and its not listed in the help. I am node of a small group of servers. I keep getting this bot attached to my server, and I'd like to ban it.

2 1

ngIRCd 21.1 on armv7l / arm7hf with Arch Linux ARM (ALARM)
by Götz Hoffart 26 Jul '14

26 Jul '14

# contrib/platformtest.sh platformtest.sh: Checking ngIRCd base source directory ... platformtest.sh: Checking for GIT tree ... platformtest.sh: Checking for "./configure" script ... platformtest.sh: Running "./configure" script ... platformtest.sh: Running "make" ... platformtest.sh: Running "make check" ... portabtest.c: In function ‘main’: portabtest.c:45:6: warning: the address of ‘snprintf’ will always evaluate as ‘true’ [-Waddress] if( ! snprintf ) Panic( "snprintf", 2 ); ^ portabtest.c:46:6: warning: the address of ‘vsnprintf’ will always evaluate as ‘true’ [-Waddress] if( ! vsnprintf ) Panic( "vsnprintf", 2 ); ^ portabtest.c:47:6: warning: the address of ‘strlcpy’ will always evaluate as ‘true’ [-Waddress] if( ! strlcpy ) Panic( "strlcpy", 2 ); ^ portabtest.c:48:6: warning: the address of ‘strlcat’ will always evaluate as ‘true’ [-Waddress] if( ! strlcat ) Panic( "strlcat", 2 ); ^ the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - armv7l/unknown/linux-gnueabihf gcc 4.8.2 21.1 14-07-15 goetz Y Y Y Y 5 [root@alarm ngircd-21.1]# uname -a Linux alarm 3.5.7-14-ARCH #1 PREEMPT Mon Jun 30 13:06:45 MDT 2014 armv7l GNU/Linux

2 1

ngIRCd 21.1 on Yosemite with minor warnings
by Götz Hoffart 26 Jul '14

26 Jul '14

$ contrib/platformtest.sh platformtest.sh: Checking ngIRCd base source directory ... platformtest.sh: Checking for GIT tree ... platformtest.sh: Checking for "./configure" script ... platformtest.sh: Running "./configure" script ... platformtest.sh: Running "make" ... /Library/Developer/CommandLineTools/usr/bin/ranlib: file: libngportab.a(strdup.o) has no symbols /Library/Developer/CommandLineTools/usr/bin/ranlib: file: libngportab.a(strndup.o) has no symbols /Library/Developer/CommandLineTools/usr/bin/ranlib: file: libngportab.a(strlcpy.o) has no symbols /Library/Developer/CommandLineTools/usr/bin/ranlib: file: libngportab.a(strtok_r.o) has no symbols /Library/Developer/CommandLineTools/usr/bin/ranlib: file: libngportab.a(waitpid.o) has no symbols /Library/Developer/CommandLineTools/usr/bin/ranlib: file: libngportab.a(strdup.o) has no symbols /Library/Developer/CommandLineTools/usr/bin/ranlib: file: libngportab.a(strndup.o) has no symbols /Library/Developer/CommandLineTools/usr/bin/ranlib: file: libngportab.a(strlcpy.o) has no symbols /Library/Developer/CommandLineTools/usr/bin/ranlib: file: libngportab.a(strtok_r.o) has no symbols /Library/Developer/CommandLineTools/usr/bin/ranlib: file: libngportab.a(waitpid.o) has no symbols conn.c:821:1: warning: unused function 'SSL_WantWrite' [-Wunused-function] SSL_WantWrite(UNUSED const CONNECTION *c) ^ 1 warning generated. platformtest.sh: Running "make check" ... the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/apple/darwin14.0.0 A-clang 6.0 21.1 14-07-25 goetz Y Y Y Y 3 $ uname -a Darwin kubrick.hoffart.de 14.0.0 Darwin Kernel Version 14.0.0: Wed Jul 16 00:46:31 PDT 2014; root:xnu-2782.1.43.0.2~2/RELEASE_X86_64 x86_64 $ sw_vers ProductName: Mac OS X ProductVersion: 10.10 BuildVersion: 14A299l Regards Götz

2 1

Ngircd rehash/permission issues
by Neuman1812 26 Jul '14

26 Jul '14

I Got ngircd to work, but I think I may have miss compiled or mis-installed it. I get this error Can't read configuration "/usr/local/etc/ngircd.conf": Permission denied when attemping to /rehash the server. I was downloaded the 21.1 version but was only able to "make install" with "sudo make install" So now when I run it, I have to run the command / /ngircd21.1/$ sudo ngircd / Im really sorry if this is a basic question, Im still learning linux permissions... FYI..the other error i get is Error writing PID file (/var/run/ngircd/ngircd.pid): Permission denied

3 4

listen interface per port
by Rodrigo Valiña Gutiérrez 21 Jun '14

21 Jun '14

Hi, I was thinking about configuring ngircd to listen in port 6667 for 127.0.0.1 and listen in port 6697 (ssl) for 0.0.0.0 (to allow local unencrypted access for webchat and bots, and only ssl from remote hosts). But I don't think it is possible in the current configuration format. It is reasonable that requierment? I think it would need an interface(s) specification for each given port.

1 0

ngIRCd 21.1
by Alexander Barton 07 Mai '14

07 Mai '14

Hi all! Today I released ngIRCd 21.1, a bug-fix only release for ngIRCd 21. This release doesn't contain new features, but fixes a few "glitches" in ngIRCd 21 that have been reported over the past few months. The NEWS file lists the following: • Don't ignore but use the server password when PAM is compiled in but disabled. Thanks to Roy Sindre Norangshol <roy.sindre(a)norangshol.no>! • doc/Platforms.txt: Update from master branch. • doc/Services.txt: Update information for Anope 2.x. • configure: add support for the LDFLAGS_END and LIBS_END variables to add linker flags and libraries at the end of the configure run (CFLAGS_END has been implemented already). • Update Copyright notices for 2014 :-) There are no security fixes included, nevertheless all installations should update: ngIRCd 21.1 is fully backwards compatible and the update should be straight forward, no configuration changes are required. You can find the NEWS file (listing all new and changed features) and the ChangeLog file (listing all changes in greater detail) in the distribution archives as well as online: • <http://ngircd.barton.de/doc/NEWS> • <http://ngircd.barton.de/doc/ChangeLog> And even more information can be found here: • Homepage: <http://ngircd.barton.de/> (<http://ngircd.mirror.3rz.org>) • Bug tracker: <http://ngircd.barton.de/bugzilla/> • Downloads: • HTTP 1: <http://ngircd.barton.de/pub/ngircd/> • HTTP 2: <http://ngircd.mirror.3rz.org/pub/ngircd/> Please note: The BerliOS platform is shutting down, so our BerliOS mirror site will become unavailable and all old links to BerliOS will become unreachable! (see <http://developer.berlios.de/forum/forum.php?forum_id=39220>) But don't worry too much, ngIRCd already gained a new mirror site, located at <http://ngircd.mirror.3rz.org>, provided by Götz Hoffart. Thanks a lot! And as usual, a big thanks to all users, bug reporters, contributors, packagers, and supporters! Regards Alex

3 3

ngIRCd 21.1 on OpenBSD 5.5 / SPARC
by Götz Hoffart 05 Mai '14

05 Mai '14

the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - sparc/unknown/openbsd5.5 gcc 4.2.1 21.1 14-05-03 goetz Y Y Y Y 3 # uname -a OpenBSD qsun.3rz.org 5.5 GENERIC#85 sparc

2 1

message storaging time
by Иван Дементьев 22 Apr '14

22 Apr '14

Hi! I use ngircd under uLinux working on bfin537. And my question is - how long does ngircd storage messages from one user to another if another user has lost connection for a long time (minute / hour / day)? I tried to find the answer in source code, but unfortunately I have not enough expirience in C-programming. So my search stuck in <Conn_Handler(void)> in <conn.c> file. So, how long? :) -- Ivan Dementev

2 1

ngIRCd 21.1 on …
by Götz Hoffart 18 Apr '14

18 Apr '14

the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - i386/unknown/netbsdelf1.5.2 egcs-1.1.2 21.1 14-03-29 root Y Y N Y # uname -a NetBSD 1.5.2 NetBSD 1.5.2 (GENERIC) #3: Sat Aug 18 23:37:05 CEST 2001 he@hamster.urc.uninett.no:/usr/src/sys/arch/i386/compile/GENERIC i386 the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - powerpc/apple/darwin7.9.0 gcc 3.3 21.1 14-04-14 goetz Y Y Y Y 3 jadzia:~/ goetz$ uname -a Darwin jadzia.local 7.9.0 Darwin Kernel Version 7.9.0: Wed Mar 30 20:11:17 PST 2005; root:xnu/xnu-517.12.7.obj~1/RELEASE_PPC Power Macintosh powerpc jadzia:~/ goetz$ sw_vers ProductName: Mac OS X ProductVersion: 10.3.9 BuildVersion: 7W98

1 0

Proposed patch for COMMAND_LEN "Request too long" disconnect
by lists＠packetmail.net 14 Apr '14

14 Apr '14

Hi, First and foremost, I am not proficient with C. The below patch addresses the forceful disconnect of clients who may paste or compose more data than COMMAND_LEN in ngircd-21.1. RFC 2812 states "IRC messages are always lines of characters terminated with a CR-LF (Carriage Return - Line Feed) pair, and these messages SHALL NOT exceed 512 characters in length, counting all characters including the trailing CR-LF." The below trivial patch avoids client termination. ngricd will already truncate messages at COMMAND_LEN and insert [CUT] into them indicating they have been truncated by the daemon. This patch eliminates some client frustrations when running an RFC-compliant IRCd. I appreciate the insight and wisdom of others regarding this patch. If I unleashed the kracken with this horrible patch I apologize in advance, it's highly likely I've done something wrong with the below :) Cheers, Nathan Fowler --- ./src/ngircd/conn.c 2014-03-18 20:36:34.000000000 -0500 +++ ./src/ngircd/conn.c 2014-04-14 13:33:10.000000000 -0500 @@ -1948,8 +1948,17 @@ "Request too long (connection %d): %d bytes (max. %d expected)!", Idx, array_bytes(&My_Connections[Idx].rbuf), COMMAND_LEN - 1); - Conn_Close(Idx, NULL, "Request too long", true); - return 0; + /* Conn_Close(Idx, NULL, "Request too long", true); */ + Conn_WriteStr( Idx, + ":%s NOTICE %s :%sRequest too long, %d bytes (max. %d expected)!", + Client_ID(Client_ThisServer()), Client_ID(c), + NOTICE_TXTPREFIX, + array_bytes(&My_Connections[Idx].rbuf), + COMMAND_LEN - 1); + + array_trunc(&My_Connections[Idx].rbuf); + + /* return 0; */ } len_processed += (unsigned int)len;

1 0

Ngircd shutting down constantly by client?
by Michiel van Es 30 Mär '14

30 Mär '14

Hello, I am running Ngircd 21 on CentOS 6.5 64 bit. I compiled Ngircd from source with OpenSSL and PAM to provide the CIA triad (Confidentiality, Integrity and Authentication). I store my passwords with htpassword with crypt and a salt (crypt() alone is not safe enough). I have noticed that my Ngircd daemon shuts down whenever a client or an ip makes a connection to my port and sends a bogus SSL handshake: Mar 29 03:42:06 mail ngircd[29098]: Accepted connection 8 from "222.151.83.101:6728" on socket 7. Mar 29 03:42:06 mail ngircd[29098]: SSL protocol error: SSL_accept (error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol) Mar 29 03:42:06 mail ngircd[29098]: Shutting down connection 8 (SSL accept error, closing socket) with "222.151.83.101:6728" ... Mar 29 03:42:06 mail ngircd[29098]: Client unregistered (connection 8): SSL accept error, closing socket. Mar 29 03:42:06 mail ngircd[29098]: Connection 8 with "222.151.83.101:6728" closed (in: 0.0k, out: 0.0k). Mar 29 03:43:06 mail ngircd[29098]: Server going down NOW! Mar 29 03:43:06 mail ngircd[29098]: Shutting down all listening sockets (1 total) ... Mar 29 03:43:06 mail ngircd[29098]: ngIRCd done, served 1 connection. I automatically restart the Ngircd daemon with a check script but directly after it gets hit again: Mar 29 03:44:01 mail ngircd[29168]: ngIRCd 21-IRCPLUS+PAM+SSL+SYSLOG+ZLIB-x86_64/unknown/linux-gnu started. Mar 29 03:44:01 mail ngircd[29168]: Using configuration file "/usr/local/etc/ngircd.conf" ... Mar 29 03:44:01 mail ngircd[29168]: Configuration option "DHFile" not set! Mar 29 03:44:01 mail ngircd[29168]: OpenSSL 1.0.1e-fips 11 Feb 2013 initialized. Mar 29 03:44:01 mail ngircd[29169]: Running as user ngircd(494), group ngircd(495), with PID 29169. Mar 29 03:44:01 mail ngircd[29169]: Not running with changed root directory. Mar 29 03:44:01 mail ngircd[29169]: IO subsystem: epoll (hint size 100, initial maxfd 100, masterfd 4). Mar 29 03:44:01 mail ngircd[29169]: Created pre-defined channel "#pragmasec". Mar 29 03:44:01 mail ngircd[29169]: Created pre-defined channel "#prive". Mar 29 03:44:01 mail ngircd[29169]: Now listening on [0.0.0.0]:6667 (socket 7). Mar 29 03:44:23 mail ngircd[29169]: Accepted connection 8 from "222.151.83.101:62835" on socket 7. Mar 29 03:44:23 mail ngircd[29169]: SSL protocol error: SSL_accept (error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol) Mar 29 03:44:23 mail ngircd[29169]: Shutting down connection 8 (SSL accept error, closing socket) with "222.151.83.101:62835" ... Mar 29 03:44:23 mail ngircd[29169]: Client unregistered (connection 8): SSL accept error, closing socket. Mar 29 03:44:23 mail ngircd[29169]: Connection 8 with "222.151.83.101:62835" closed (in: 0.0k, out: 0.0k). Mar 29 03:45:23 mail ngircd[29169]: Server going down NOW! Mar 29 03:45:23 mail ngircd[29169]: Shutting down all listening sockets (1 total) ... Mar 29 03:45:23 mail ngircd[29169]: ngIRCd done, served 1 connection. This continues all during the night and I notice that the connection is coming from Japan (if the IP is not spoofed or a Tor endpoint): [user@mail ~]$ host 222.151.83.101 101.83.151.222.in-addr.arpa domain name pointer 222-151-083-101.jp.fiberbit.net. I can offcourse block the ip but it seems Ngircd can not withstand the strange SSL connection from the client and shuts itself down. My config is here: http://www.pragmasec.nl/ngircd.txt (its also a manual how to setup Ngircd + SSL + PAM with hashed+salted passwords - something I think a lot of users are looking for who are wanting PAM auth) How can I fix this? Is it Ngircd related or related to my config? THanks for any tips or help. Regards, Michiel

3 5

ngIRCd 21.1 on OS X 10.9.2, llvm/clang
by Götz Hoffart 27 Mär '14

27 Mär '14

the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/apple/darwin13.1.0 A-clang 5.1 21.1 14-03-27 gh Y Y Y Y 3 G’Night, Götz

1 0

ngIRCd 21.1 on … Open64, Solaris Studio, tcc
by Götz Hoffart 27 Mär '14

27 Mär '14

the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/unknown/linux-gnu Open64 21.1 14-03-27 goetz Y Y Y Y 1 the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/unknown/linux-gnu unknown 21.1 14-03-27 goetz Y Y Y Y 1 (Solaris Studio 12.3, 'cc') the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - x86_64/unknown/linux-gnu tcc 0.9.25 21.1 14-03-27 goetz Y Y Y Y 1 Grüße Götz

1 0

ngIRCd 21 still running fine on PowerPC 750, OS X 10.3.9
by Götz Hoffart 13 Jan '14

13 Jan '14

iBook G3/800: jadzia:~/ngircd-21 goetz$ sw_vers ProductName: Mac OS X ProductVersion: 10.3.9 BuildVersion: 7W98 jadzia:~/ngircd-21 goetz$ uname -a Darwin jadzia.local 7.9.0 Darwin Kernel Version 7.9.0: Wed Mar 30 20:11:17 PST 2005; root:xnu/xnu-517.12.7.obj~1/RELEASE_PPC Power Macintosh powerpc jadzia:~/ngircd-21 goetz$ gcc --version gcc (GCC) 3.3 20030304 (Apple Computer, Inc. build 1671) [] ngIRCd 21 has been configured with the following options: Host: powerpc-apple-darwin7.9.0 Compiler: gcc -std=gnu99 Compiler flags: -g -O2 -pipe -W -Wall -Wpointer-arith -Wstrict-prototypes -DSYSCONFDIR='"$(sysconfdir)"' -DDOCDIR='"$(docdir)"' Libraries: -lz 'ngircd' binary: /usr/local/sbin Configuration file: /usr/local/etc Manual pages: /usr/local/share/man Documentation: /usr/local/share/doc/ngircd Syslog support: yes Enable debug code: no zlib compression: yes IRC sniffer: no Use TCP Wrappers: no Strict RFC mode: no IDENT support: no IRC+ protocol: yes IPv6 protocol: no I/O backend: kqueue() PAM support: no SSL support: no libiconv support: no the executable works ("runs") as expected --+ tests run successfully ("make check") --+ | ngIRCd compiles ("make") --+ | | ./configure works --+ | | | | | | | Platform Compiler ngIRCd Date Tester C M T R * --------------------------- ------------ ---------- -------- -------- - - - - - powerpc/apple/darwin7.9.0 gcc 3.3 21 14-01-11 goetz Y Y Y Y 3

2 1

ngircd runs well but generates an error when run as a service
by John Bleichert 12 Jan '14

12 Jan '14

Hello, I am running ngircd on Debian stable. It is SSL enabled via Gnu_TLS and runs fine when run from the command line. However, attempting to start the server with service ngircd start or /etc/init.d/ngircd start generates an SSL error (see below). Any suggestions on how to get more debug data? I installed it as a binary package. Note that I have been running ngircd for years on FreeBSD (thanks!) but am new to running this on Debian. Note also that I am only running an SSL server at the moment, not a “plain” one. Error output is below. Should I take this up with the package maintainer? Thanks! John service ngircd start: Jan 11 13:59:18 boogie ngircd[9566]: ngircd 19.2-SYSLOG+ZLIB+SSL+IRCPLUS+IPv6-x86_64/pc/linux-gnu started. Jan 11 13:59:18 boogie ngircd[9566]: Using configuration file "/etc/ngircd/ngircd.conf" ... Jan 11 13:59:18 boogie ngircd[9566]: Warning: Error during SSL initialization, continuing ... Jan 11 13:59:18 boogie ngircd[9567]: Running as user irc(39), group irc(39), with PID 9567. Jan 11 13:59:18 boogie ngircd[9567]: Not running with changed root directory. Jan 11 13:59:18 boogie ngircd[9567]: IO subsystem: epoll (hint size 100, initial maxfd 100, masterfd 4). Jan 11 13:59:18 boogie ngircd[9567]: Created pre-defined channel "#syborg" Jan 11 13:59:18 boogie ngircd[9567]: Now listening on [192.168.1.120]:2431 (socket 8). command line: Jan 11 14:00:29 boogie ngircd[9714]: ngircd 19.2-SYSLOG+ZLIB+SSL+IRCPLUS+IPv6-x86_64/pc/linux-gnu started. Jan 11 14:00:29 boogie ngircd[9714]: Using configuration file "/etc/ngircd/ngircd.conf" ... Jan 11 14:00:29 boogie ngircd[9714]: gnutls 2.12.20 initialized. Jan 11 14:00:29 boogie ngircd[9715]: Running as user irc(39), group irc(39), with PID 9715. Jan 11 14:00:29 boogie ngircd[9715]: Not running with changed root directory. Jan 11 14:00:29 boogie ngircd[9715]: IO subsystem: epoll (hint size 100, initial maxfd 100, masterfd 4). Jan 11 14:00:29 boogie ngircd[9715]: Created pre-defined channel "#syborg" Jan 11 14:00:29 boogie ngircd[9715]: Now listening on [192.168.1.120]:2431 (socket 8). ------------------------------------------------------------------------------ John Bleichert - syborg(a)earthlink.net The heat from below can burn your eyes out!

3 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

ngIRCd Users