Don't accept incoming plain-text ("non SSL") server connections for
servers configured with "SSLConnect" enabled.
If "SSLConnect" is not set for an incoming connection the server still
accepts both plain-text and encrypted connections.
This change prevents an authenticated client-server being able to force
the server-server to send its password on a plain-text connection when
SSL/TLS was intended.
Always try to close a connection with errors immediately, but try hard
to avoid too much recursion.
Without this patch, an outgoing server connection could get stuck in an
"endless" state trying to write out data over and over again.
This tries to fix 04de1423eb.
Thanks Katherine Peeters for the patch and pull request!
Closes#294.
* katp32/master:
Improve documentation for --syslog
Added command line flag to enable syslog
Split NoSyslog from behaviour of NoDaemon
- Bring sample-ngircd.conf and ngircd.conf.5 description in line.
- Fix configuration parsing, it always showed the 'Unknown variable
"Autojoin"' error message, even when everything was perfectly fine.
- And fix a build error (at least on macOS with Apple Clang 14):
login.c:234:3: error: call to undeclared function 'IRC_JOIN'; ISO
C99 and later do not support implicit function declarations
[-Wimplicit-function-declaration]
IRC_JOIN(Client, &Req);
^
The #include for the "irc.channel.h" header was missing!
- Remove a unused variable that caused a compiler warning:
login.c:222:12: warning: unused variable 'n' [-Wunused-variable]
size_t i, n, channel_count = array_length(&Conf_Channels, sizeof(*conf_chan));
^
- Add a explicit cast to fix a compiler warning:
login.c:235:15: warning: assigning to 'char *' from 'const char[51]'
discards qualifiers [-Wincompatible-pointer-types-discards-qualifiers]
Req.argv[0] = conf_chan->name;
^ ~~~~~~~~~~~~~~~
Let's behave like most(?) other IRC daemons (at least ircd2.11) and hide
all +i users when WHOIS is used with a pattern. Otherwise privacy of
this users is not guaranteed and the +i mode a bit useless ...
Reported by Cahata on #ngircd, thanks!
All numeric replies must originate from an IRC server, never from a
client. So fix the RPL_INVITING message!
Thanks tommyrot for reporting this!
Closes#307.
The debug log messages are always available and a runtime option (since
commit c7de505c), but the assert()'s are only active when ngIRCd was
configured with the "--enable-debug" option.
So only add "+DEBUG" to the version string when the latter is the case.
This basically means to unifdef DEBUG in (almost) all places.
We keep it in src/portab/portab.h so DEBUG stays available to
enable assert(). Also add a comment about this.
Implement new numeric ERR_INVALIDMODEPARAM_MSG(696) and:
- Reject channel keys with spaces and return ERR_INVALIDMODEPARAM_MSG;
This was possible until now and resulted in garbled IRC commands later.
- Reject empty channel keys and return ERR_INVALIDMODEPARAM_MSG;
This was possible until now and resulted in garbled IRC commands later.
- Return ERR_INVALIDMODEPARAM_MSG when user limit is out of bounds;
This was silently ignored until now.
Closes#290. Thanks Val Lorentz for reporting it!
This relates to #290 and considerations which errors to show when: and I
think it is the better approach to give feedback instead of silently
failing.
Note that this code path is also used when handling modes of channels
defined in "[Channel]" blocks in configuration files: in this case the
client is the local server and we can't send messages to it, because it
has no socket connection! Therefore we need those "is_machine" checks
and log an error im this case.
Don't forbid the local server to change modes on local channels: this
happens when overriding modes on local (&) channels in the server
configuration file, for example, and is perfectly fine.
Without this patch, the server worked as expected but showed critical
error messages for each local channel in its configuration file:
"Got remote MODE command for local channel!? Ignored."
Conf_GetServer() can return NULL when the server introducing the client
had a write error for example, and is being disconnected.
So make sure that we have a valid server before calling Conf_NickIsService()!
This fixes the following compiler warning, for example on OpenBSD:
conf.c: In function 'Conf_Test':
conf.c:391: warning: format '%ld' expects type 'long int', but argument
2 has type 'time_t'
Thanks to Götz Hoffart for reporting this!
Basically, the issue described in #281 is that the test suite uses the
IPv4 address 127.0.0.1 on an IPv6-only host. But this is the "safest"
thing to do in (almost) all other setups: relaying on DNS host names
makes things even more complex, as different systems map 127.0.0.1
differently (including the reverse lookup; that's why we switched to
127.0.0.1 back in 2014, see commit 3f807e1045).
But with AI_ADDRCONFIG set, on an IPv6-only host, we prevent 127.0.0.1
to get translated properly, even when the loopback interface has this
address configured! So don't set it any more.
The drawback is that the resolver possibly returns more addresses now,
even of an unsupported/not connected address family; but this shouldn't
do much harm in practice, as ngIRCd iterates over all returned addresses
while trying to establish an outgoing connection.
Closes#281.
The ISUPPORT(005) numeric lists only channel prefixes which are listed
in the "AllowedChannelTypes" configuration option. And if this is the
empty string ("") for example, this now results in IRC clients assuming
"oh, no channel prefix characters at all, so no channels at all, so no
PRIVMSG can go to any channel" -- which is not the case when there are
pre-defined channel set up or other servers still having channels!
So "allowed channel types" != "supported channel types", and we always
have to list all supported ones in the ISUPPORT(005) numeric!
This reverts commit 4b7e8db418.
Closes#285.
On reload, all listening ports are closed, configuration updated, and
then opened again. Which leads to subsequent tests running while the
daemon isn't listening on any ports, and that's why the tests fail.
The "proper" way whould be to loop and check for open ports, but waiting
is what the start-server.sh script does right now, so stick with this in
reload-server.sh for now as well.
This fixes the issue, at least on my RaspberryPi ...
Closes#280.
It can happen that a channel is +k, but no key is set: for example by
misconfiguring a pre-defined channel. In this case, ngIRCd sent an
invalud CHANINFO command ("CHANINFO #test +Pk 0 :'", note the unset
key represented by the two spaces) to its peers.
Fix this and enhance the CHANINFO documentation.
The SERVER command is only valid with a prefix when received from other
servers, so make sure that there is one and disconnect the peer if not
(instead of crashing ...).
This obsoletes PR #275.
Thanks Hilko Bengen (hillu) for finding & reporting this as well for the
patch & pull request! But I think this is the "more correct" fix.
Prior to this commit, the PONG wasn't registered correctly, becauuse the
"last ping" time was set to time(NULL), which could be bigger than the
"last data" time stamp, for example when handling the read buffer took
more than 1 second -- and this resulted in the PONG time out kicking in
effectively disconnecting a newly linked server for example, because
ngIRCd thought it was still waiting for a PONG: last data < last ping.
Now the "last ping" value has three possible values:
0: new connection, no PING, no PONG so far.
1: got a PONG, no longer waiting for a PONG.
<t>: time stamp of last sent out PING command.
This patch completely broke the PING-PONG logic: now ngIRCd never
disconnects any stale peers but keeps sending out PINGs over and over
again ...
The real issue (server disconnects right after connect) will be fixed in
the next commit, but let's revert to the somewhat "half-broken but
'known' state" first ...
This reverts commit 79a917f954.
Change the line buffer in the Read_TextFile() function from 127 to
COMMAND_LEN (=512) bytes. Lines can't even get that long, because they
have to be prefixed before being sent to the client, so this is a sane
maximum.
This allows for even more "fancy" and "wider" MOTDs :-)
Closes#271.
Don't use the "standard" IRC SSL port 6697, as this easily collides with
real (ng)IRCd instances running on the same machine.
And by reusing port 6790, which is already used by the "test server #2",
we don't need any other port than the test suite already uses.
