1
0
mirror of https://github.com/osmarks/ngircd.git synced 2024-12-15 03:10:27 +00:00
Commit Graph

151 Commits

Author SHA1 Message Date
Alexander Barton
58ee4df2ae S2S-TLS: Fix formatting and sort new SSL options in ngircd.conf manual page 2024-03-23 20:19:01 +01:00
Christoph Biedl
817937b218 Support for server certificate validation on server links [S2S-TLS]
This patch provides code to validate the server certificate in
server links, defeating nasty man-in-the-middle attacks on server
links.

Features:

- Check whether the certificate is signed by a trusted certificate
  authority (CA).
- Check the host name, including wildcard certificates and Subject
  Alternative Names.
- Optionally check against a certificate revocation list (CRL).
- Implementation for both OpenSSL and GnuTLS linkage.

Left for another day:

- Parameterize the TLS parameter of an outbound connection. Currently,
  it's hardcoded to disable all versions before TLSv1.1.
- Using certificate as CA-certificate. They work for GnuTLS only but
  perhaps this should rather raise an error there, too.
- Optional OCSP checking.
- Checking client certificates. Code is there but this first needs some
  consideration about the use cases. This could replace all other
  authentication methods, for both client-server and server-server
  connections.

This patch is based on a patch by Florian Westphal from 2009, which
implemented this for OpenSSL only:

  From: Florian Westphal <fw@strlen.de>
  Date: Mon, 18 May 2009 00:29:02 +0200
  Subject: SSL/TLS: Add initial certificate support to OpenSSL backend

Commit message modified by Alex Barton.

Closes #120, "Server links using TLS/SSL need certificate validation".
Supersedes PR #8, "Options for verifying and requiring SSL client
certificates", which had (incomplete?) code for OpenSSL, no GnuTLS.
2024-03-23 20:19:01 +01:00
Alexander Barton
c8798fcec0 Bring manual page more in line with README.md and homepage 2024-03-23 19:58:23 +01:00
Alexander Barton
b4c8e74ccb Use a default "IncludeDir" only when no config file was specified
No longer use a default built-in value for the "IncludeDir" directive
when a configuration file was explicitly specified on the command line
using "--config"/"-f": This way no default include directory is scanned
when a possibly non-default configuration file is used which
(intentionally) did not specify an "IncludeDir" directive.

With this patch you now can use "-f /dev/null" for checking all built-in
defaults, regardless of any local configuration files in the default
drop-in directory (which would have been read in until this change).
2024-01-21 20:15:47 +01:00
Alexander Barton
bb8b6f0fba Make the description of the "Info" option more precise
The "Info" option in the "[Global]" section is optional (so comment it
out in the sample configuration file) and set to the server software
name and its version when not set (so add this information to the sample
configuration file and the ngircd.conf(5) manual page).
2024-01-21 01:20:46 +01:00
Alexander Barton
3c39094b52 Deduce a server name when not set in the configuration
The server "Name" in the "[Global]" section of the configuration file is
optional now: When not set (or empty), ngIRCd now tries to deduce a
valid IRC server name from the local host name ("node name"), possibly
adding a ".host" extension when the host name does not contain a dot
(".") which is required in an IRC server name ("ID").

This new behaviour, with all configuration parameters now being
optional, allows running ngIRCd without any configuration file at all.
2024-01-21 01:20:46 +01:00
Alexander Barton
445e559dbd Update and enhance the manual pages a bit 2023-09-17 22:03:12 +02:00
Alexander Barton
8fdb8f90b1 Merge branch 'katp32/master'
Thanks Katherine Peeters for the patch and pull request!

Closes #294.

* katp32/master:
  Improve documentation for --syslog
  Added command line flag to enable syslog
  Split NoSyslog from behaviour of NoDaemon
2023-09-17 21:37:45 +02:00
Alexander Barton
30ba325dde Various fixes and enhancements for the "Autojoin" patch
- Bring sample-ngircd.conf and ngircd.conf.5 description in line.
- Fix configuration parsing, it always showed the 'Unknown variable
  "Autojoin"' error message, even when everything was perfectly fine.
- And fix a build error (at least on macOS with Apple Clang 14):
    login.c:234:3: error: call to undeclared function 'IRC_JOIN'; ISO
    C99 and later do not support implicit function declarations
    [-Wimplicit-function-declaration]
       IRC_JOIN(Client, &Req);
       ^
  The #include for the "irc.channel.h" header was missing!
- Remove a unused variable that caused a compiler warning:
    login.c:222:12: warning: unused variable 'n' [-Wunused-variable]
       size_t i, n, channel_count = array_length(&Conf_Channels, sizeof(*conf_chan));
                 ^
- Add a explicit cast to fix a compiler warning:
    login.c:235:15: warning: assigning to 'char *' from 'const char[51]'
    discards qualifiers [-Wincompatible-pointer-types-discards-qualifiers]
       Req.argv[0] = conf_chan->name;
                   ^ ~~~~~~~~~~~~~~~
2023-09-17 19:56:07 +02:00
Ivan Agarkov
cfd7d4288e Channel autojoin functionality 2023-09-16 12:40:33 +02:00
Katherine Peeters
dc412a450e
Improve documentation for --syslog 2022-11-01 16:21:56 -07:00
Alexander Barton
79ffa9132b 2022 =:)
Happy new year!
2022-01-01 16:05:09 +01:00
Alexander Barton
2ff76d7f48 2021! :-)
Happy new year!
2021-01-01 15:38:26 +01:00
Alexander Barton
15c7444283 Update description text in manual page, too! 2020-05-26 23:00:25 +02:00
Alexander Barton
03aec7d0b3 ngIRCd Release 26~rc1 2020-05-10 17:13:51 +02:00
Alexander Barton
9c5e42458e Update documentation to reflect "[Channel]->Modes" changes
No longer mention "[Channel]->Key" and "[Channel]->MaxUsers".
2020-03-29 23:17:21 +02:00
Alexander Barton
f5fa7db4ba 2020! 2020-01-21 22:02:40 +01:00
Alexander Barton
e954b59d41 Fix some typos (documentation files, ngircd.conf manual page, ...)
Spotted by Étienne Mollier <etienne.mollier@mailoo.org> and Christoph
Biedl <debian.axhn@manchmal.in-ulm.de>, see Debian bug #932462
(https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=932462). Thank you!
2019-07-21 16:23:07 +02:00
Christoph Biedl
aec86aa84c ngircd.conf.5: Fix wording as suggested by lintian 2019-01-28 10:45:53 +01:00
shankari
fe01ef9a51 Fix documentation of MotdPhrase length (#254)
The max length is actually 126 (< 127), since the check errors out if
length >= 127. See
<https://github.com/ngircd/ngircd/blob/master/src/ngircd/conf.c#L1487>.

I didn't look through the history to see when the change happened. I
just happened to find during a migration that my 140 character MOTD
didn't work.

Update sample configuration file as well as the man page.
2019-01-03 14:06:01 +01:00
Alexander Barton
96bad2b861 2019! 2019-01-02 00:10:06 +01:00
Alexander Barton
456eea6f18
Implement new configuration option "MaxPenaltyTime" (#251)
This option configures the maximum penalty time increase in seconds, per
penalty event. Set to -1 for no limit (the default), 0 to disable
penalties altogether. ngIRCd doesn't use penalty increases higher than 2
seconds during normal operation, so values higher than 1 rarely make
sense.

Disabling (or reducing) penalties can greatly speed up "make check" runs
for example, see below, but are mostly a debugging feature and normally
not meant to be used on production systems!

Some example timings running "make check" from my macOS workstation:

- MaxPenaltyTime not set: 4:41,79s
- "MaxPenaltyTime = 1":   3:14,71s
- "MaxPenaltyTime = 0":     25,46s

Closes #249.
2018-11-28 14:13:09 +01:00
Alexander Barton
34bdb0d98a 2018! 2018-02-09 22:02:21 +01:00
Alexander Barton
2bb917f05a 2017! 2017-01-15 22:07:11 +01:00
Alexander Barton
bfebdaece8 ngircd.conf.5.tmpl: Fix spelling
Thanks to Christoph Biedl.
2017-01-07 15:52:23 +01:00
Christian Aistleitner
e84000f7b8 Add PAMServiceName setting to specify the used PAM configuration
This setting allows to run multiple ngIRCd instances with
PAM configurations on each instance.
If one sets it to "ngircd-foo", PAM will use `/etc/pam.d/ngircd-foo`
instead of the default `/etc/pam.d/ngircd`.
2016-06-05 23:48:29 +02:00
Alexander Barton
6a5569c27d Update copyright notices for 2016 2016-01-04 22:43:58 +01:00
Alexander Barton
64c265cf33 Merge pull request #217 from SaberUK/master+notice-auth
Use "NOTICE *" before registration instead of "NOTICE AUTH".
2015-08-01 14:51:04 +02:00
Alexander Barton
a5ca8be658 Streamline ".gitignore" files 2015-07-19 03:03:06 +02:00
Peter Powell
5545e1bebf Rename NoticeAuth to NoticeBeforeRegistration.
The old name is still supported for compatibility reasons.
2015-07-14 14:43:19 +01:00
Peter Powell
d118cd74b6 Use "NOTICE *" before registration instead of "NOTICE AUTH".
AUTH is a valid nickname so sending notices to it is probably not
a good idea. Use * as the target instead as done with numerics
when the nick is not available.

This mimics the behaviour in Charybdis, IRCD-Hybrid, InspIRCd 2.2,
Plexus 4, etc.
2015-07-14 14:37:42 +01:00
Alexander Barton
a43d79aeff Update ngircd.conf.5: "CloadUserToNick" hides user and real name
Closes #208.
2015-05-15 23:15:09 +02:00
Alexander Barton
f8f7f83f5a Streamline effect of "MorePrivacy" option (WHOIS, LIST)
- Update documentation in ngircd.conf(5)
- LIST: Don't hide channels for IRC Ops when "MorePrivacy" is in effect
- WHOIS: Don't hide IP addresses/hostnames when "MorePrivacy" is in effect

Closes #198
2015-05-13 22:42:51 +02:00
Alexander Barton
100de3e4cc Update "CipherList" to not enable SSLv3 by default
Idea, initial patch, and testing by Christoph Biedl
<ngircd.anoy@manchmal.in-ulm.de>
2014-10-16 13:42:24 +02:00
Alexander Barton
d314c75a37 Allow "DefaultUserModes" to set all possible modes
Let IRC_MODE() detect that the "fake" MODE command originated on the local
sever, which enables all modes to be settable using "DefaultUserModes"
that can be set by regular MODE commands, including modes only settable by
IRC Operators.
2014-03-18 16:43:21 +01:00
Alexander Barton
3b24ebf122 ngircd.conf.5: Update manual page 2014-01-19 15:32:20 +01:00
Alexander Barton
86bdf6e1d4 Implement new configuration option "Network"
The new configuration variable "Network" is used to set the (completely
optional) "network name", to which this instance of the daemon belongs.
When set, this name is used in the ISUPPORT(005) numeric which is sent to
all clients connecting to the server after logging in.

Closes bug #165.
2013-12-27 23:16:11 +01:00
Alexander Barton
c34b91d8dd Update (date of) manual pages 2013-10-07 23:02:27 +02:00
Federico G. Schwindt
0985d69cc6 Change cipher defaults
Switch cipher defaults to HIGH:!aNULL:@STRENGTH (OpenSSL) or
SECURE128 (GnuTLS).
2013-09-17 17:15:24 +01:00
Alexander Barton
b9006acee3 Cipher list selection for GnuTLS
This patch implements the missing functionality for cipher list selection
using GnuTLS (our OpenSSL code has this already).
2013-09-15 17:57:47 +02:00
Alexander Barton
84ed46d4c1 Cipher list selection for OpenSSL
This patch introduces the possibility to arbitrarily select ciphers which
should be promoted resp. declined when establishing a SSL connection
with a client by implementing the new configuration option "CipherList".

By default, OpenSSL would accept low and medium strength and RC-4 ciphers,
which nowadays are known to be broken.

This patch only implements the feature for OpenSSL. A GnuTLS counterpart
has to be implemented in another patch ...

Original patch by Bastian <bastian-ngircd@t6l.de>.

Closes bug #162.
2013-09-15 15:09:36 +02:00
Alexander Barton
2bacb8210b Implement new configuration option "DefaultUserModes"
The new configuration option "DefaultUserModes" lists user modes that
become automatically set on new local clients right after login.

Please note that only modes can be set that the client could set on
itself, you can't set "a" (away) or "o" (IRC Op), for example! User
modes "i" (invisible) or "x" (cloaked) etc. are "interesting", though.

Default: set no modes (like without this patch).

Closes bug #160.
2013-08-26 21:17:10 +02:00
Alexander Barton
5258fb7f7c Implement new configuration option "AllowedChannelTypes"
The new configuration variable "AllowedChannelTypes" lists all allowed
channel types (channel prefixes) for newly created channels on the local
server. By default, all supported channel types are allowed.

If set to the empty string, local clients can't create new channels at
all, which equals the old "PredefChannelsOnly = yes" setting.

This patch deprecates the "PredefChannelsOnly" variable, too, but it is
still supported and translated to the apropriate "AllowedChannelTypes"
setting. When "PredefChannelsOnly" is processed, a warning message is
logged.

Closes bug #152.
2013-08-04 14:10:12 +02:00
Alexander Barton
5115756b79 Slightly update ngircd.8 manual page 2013-07-17 14:36:54 +02:00
Alexander Barton
f206fda8ae Implement new configuration option "IncludeDir"
The option "IncludeDir" in the [Options] section can be used
to specify a directory which can contain further configuration
files and configuration file snippets matching the pattern
"*.conf" that should be read in after the main configuration
file ("ngircd.conf" by default) has been parsed.

Closes bug #157.
2013-05-24 22:34:53 +02:00
Alexander Barton
f295117fba New configuration option "IdleTimeout": exit daemon when idle
This patch implements a new configuration option "IdleTimeout" in the
[Limits] section of the configuration file which can be used to set a
timeout (in seconds) after which the whole daemon will shutdown when no
more connections are left active after handling at least one client.

The default is 0, "never".

This can be useful for testing or when ngIRCd is started using "socket
activation" with systemd(8), for example.
2013-02-04 23:15:53 +01:00
Alexander Barton
60a9a7f118 Add a note that "help file" is updated on startup and REHASH only 2013-01-01 15:35:58 +01:00
Alexander Barton
d2a1f6aa4b Document "HelpFile" in sample-ngircd.conf and ngircd.conf.5 2012-12-31 21:03:23 +01:00
Alexander Barton
1e5a7aac87 Makefiles: Correctly quote sed expressions
Now the Makefiles support spaces in "$sysconfdir", which isn't uncommon
for Cygwin for example, when $HOME contains whitespaces ("/home/User Name")
and ngIRCd is installed into the user home ("./configure --prefix=$HOME").
2012-12-25 19:14:31 +01:00
Alexander Barton
48326e061a Spelling fix: "nick name" -> "nickname" 2012-11-02 14:30:19 +01:00