This patch provides code to validate the server certificate in
server links, defeating nasty man-in-the-middle attacks on server
links.
Features:
- Check whether the certificate is signed by a trusted certificate
authority (CA).
- Check the host name, including wildcard certificates and Subject
Alternative Names.
- Optionally check against a certificate revocation list (CRL).
- Implementation for both OpenSSL and GnuTLS linkage.
Left for another day:
- Parameterize the TLS parameter of an outbound connection. Currently,
it's hardcoded to disable all versions before TLSv1.1.
- Using certificate as CA-certificate. They work for GnuTLS only but
perhaps this should rather raise an error there, too.
- Optional OCSP checking.
- Checking client certificates. Code is there but this first needs some
consideration about the use cases. This could replace all other
authentication methods, for both client-server and server-server
connections.
This patch is based on a patch by Florian Westphal from 2009, which
implemented this for OpenSSL only:
From: Florian Westphal <fw@strlen.de>
Date: Mon, 18 May 2009 00:29:02 +0200
Subject: SSL/TLS: Add initial certificate support to OpenSSL backend
Commit message modified by Alex Barton.
Closes#120, "Server links using TLS/SSL need certificate validation".
Supersedes PR #8, "Options for verifying and requiring SSL client
certificates", which had (incomplete?) code for OpenSSL, no GnuTLS.
Move most information regarding configuring ngIRCd into the
doc/QuickStart.md document, only describe building and installing ngIRCd
in the INSTALL.md file. Don't duplicate content!
Add references where this makes sense.
No longer use a default built-in value for the "IncludeDir" directive
when a configuration file was explicitly specified on the command line
using "--config"/"-f": This way no default include directory is scanned
when a possibly non-default configuration file is used which
(intentionally) did not specify an "IncludeDir" directive.
With this patch you now can use "-f /dev/null" for checking all built-in
defaults, regardless of any local configuration files in the default
drop-in directory (which would have been read in until this change).
The "Info" option in the "[Global]" section is optional (so comment it
out in the sample configuration file) and set to the server software
name and its version when not set (so add this information to the sample
configuration file and the ngircd.conf(5) manual page).
The server "Name" in the "[Global]" section of the configuration file is
optional now: When not set (or empty), ngIRCd now tries to deduce a
valid IRC server name from the local host name ("node name"), possibly
adding a ".host" extension when the host name does not contain a dot
(".") which is required in an IRC server name ("ID").
This new behaviour, with all configuration parameters now being
optional, allows running ngIRCd without any configuration file at all.
- Bring sample-ngircd.conf and ngircd.conf.5 description in line.
- Fix configuration parsing, it always showed the 'Unknown variable
"Autojoin"' error message, even when everything was perfectly fine.
- And fix a build error (at least on macOS with Apple Clang 14):
login.c:234:3: error: call to undeclared function 'IRC_JOIN'; ISO
C99 and later do not support implicit function declarations
[-Wimplicit-function-declaration]
IRC_JOIN(Client, &Req);
^
The #include for the "irc.channel.h" header was missing!
- Remove a unused variable that caused a compiler warning:
login.c:222:12: warning: unused variable 'n' [-Wunused-variable]
size_t i, n, channel_count = array_length(&Conf_Channels, sizeof(*conf_chan));
^
- Add a explicit cast to fix a compiler warning:
login.c:235:15: warning: assigning to 'char *' from 'const char[51]'
discards qualifiers [-Wincompatible-pointer-types-discards-qualifiers]
Req.argv[0] = conf_chan->name;
^ ~~~~~~~~~~~~~~~
It can happen that a channel is +k, but no key is set: for example by
misconfiguring a pre-defined channel. In this case, ngIRCd sent an
invalud CHANINFO command ("CHANINFO #test +Pk 0 :'", note the unset
key represented by the two spaces) to its peers.
Fix this and enhance the CHANINFO documentation.
The max length is actually 126 (< 127), since the check errors out if
length >= 127. See
<https://github.com/ngircd/ngircd/blob/master/src/ngircd/conf.c#L1487>.
I didn't look through the history to see when the change happened. I
just happened to find during a migration that my 140 character MOTD
didn't work.
Update sample configuration file as well as the man page.
This option configures the maximum penalty time increase in seconds, per
penalty event. Set to -1 for no limit (the default), 0 to disable
penalties altogether. ngIRCd doesn't use penalty increases higher than 2
seconds during normal operation, so values higher than 1 rarely make
sense.
Disabling (or reducing) penalties can greatly speed up "make check" runs
for example, see below, but are mostly a debugging feature and normally
not meant to be used on production systems!
Some example timings running "make check" from my macOS workstation:
- MaxPenaltyTime not set: 4:41,79s
- "MaxPenaltyTime = 1": 3:14,71s
- "MaxPenaltyTime = 0": 25,46s
Closes#249.
