Update documentation on CAFile

ngIRCd 27 now checks server certificates, and without `CAFile` set will reject all server/server connections with a confusing error.
Update documentation to say that `CAFile` is needed to accept incoming server connections.

.github/workflows/ci.yml

@@ -28,32 +28,53 @@ on:
 
 jobs:
   build_and_distcheck:
-
-    name: Configure ngIRCd sources and run make targets "all" and "distcheck"
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
+    name: build+test
+    strategy:
+      matrix:
+        os:
+          - ubuntu
+          - macos
+        toolchain:
+          - gcc
+          - llvm
+        include:
+          - os: ubuntu
+            toolchain: gcc
+            install_cmd: |
+              sudo apt update
+              sudo apt install build-essential expect libident-dev libpam0g-dev libssl-dev libwrap0-dev pkg-config telnet zlib1g-dev gcc
+            configure_cmd: |
+              ./configure CC=gcc --enable-ipv6 --with-iconv --with-ident --with-openssl --with-pam --with-tcp-wrappers --with-zlib
+          - os: ubuntu
+            toolchain: llvm
+            install_cmd: |
+              sudo apt update
+              sudo apt install build-essential expect libident-dev libpam0g-dev libssl-dev libwrap0-dev pkg-config telnet zlib1g-dev clang
+            configure_cmd: |
+              ./configure CC=clang --enable-ipv6 --with-iconv --with-ident --with-openssl --with-pam --with-tcp-wrappers --with-zlib  
+          - os: macos
+            toolchain: gcc
+            install_cmd: |
+              brew update
+              brew install autoconf automake expect openssl@3 pkg-config telnet zlib gcc
+            configure_cmd: |
+              ./configure CC=gcc --enable-ipv6 --with-iconv --with-openssl --with-zlib
+          - os: macos
+            toolchain: llvm
+            install_cmd: |
+              brew update
+              brew install autoconf automake expect openssl@3 pkg-config telnet zlib llvm
+            configure_cmd: |
+              ./configure CC=clang --enable-ipv6 --with-iconv --with-openssl --with-zlib
+    runs-on: ${{ matrix.os }}-latest
     steps:
     - uses: actions/checkout@v4
-    - uses: awalsh128/cache-apt-pkgs-action@v1
-      with:
-        packages: >
-          autoconf
-          automake
-          build-essential
-          expect
-          libident-dev
-          libpam0g-dev
-          libssl-dev
-          libwrap0-dev
-          pkg-config
-          telnet
-          zlib1g-dev
-        version: 1.0
+    - name: Install dependencies
+      run: ${{ matrix.install_cmd }}
     - name: Generate build system files
       run: ./autogen.sh
     - name: Configure the build system
-      run: ./configure --enable-ipv6 --with-iconv --with-ident --with-openssl --with-pam --with-tcp-wrappers --with-zlib
+      run: ${{ matrix.configure_cmd }}
     - name: Build everything
       run: make all
     - name: Create distribution archive and run tests

doc/SSL.md

@@ -26,7 +26,7 @@ SSL-encrypted connections and plain-text connects can't run on the same network
 port (which is a limitation of the IRC protocol); therefore you have to define
 separate port(s) in your `[SSL]` block in the configuration file.
 
-A minimal configuration for *accepting* SSL-encrypted client & server
+A minimal configuration for *accepting* SSL-encrypted client
 connections looks like this:
 
 ``` ini
@@ -36,11 +36,12 @@ KeyFile = /etc/ssl/certs/my-privkey.pem
 Ports = 6697, 6698
 ```
 
-In this case, the server only deals with *incoming* connections and never has to
-validate SSL certificates itself, and therefore no "Certificate Authorities" are
-needed.
+In this case, the server only deals with unauthenticated incoming
+connections and never has to validate SSL certificates itself, and therefore
+no "Certificate Authorities" are needed.
 
-If you want to use *outgoing* SSL-connections to other servers, you need to add:
+If you want to use *outgoing* SSL-connections to other servers or accept
+incoming *server* connections, you need to add:
 
 ``` ini
 [SSL]

src/ngircd/irc-mode.c

@@ -62,6 +62,7 @@ IRC_MODE( CLIENT *Client, REQUEST *Req )
 {
 	CLIENT *cl, *origin;
 	CHANNEL *chan;
+	bool is_valid_nick, is_valid_chan;
 
 	assert(Client != NULL);
 	assert(Req != NULL);
@@ -76,10 +77,12 @@ IRC_MODE( CLIENT *Client, REQUEST *Req )
 		Client = Client_Search(Req->prefix);
 
 	/* Channel or user mode? */
+	is_valid_nick = Client_IsValidNick(Req->argv[0]);
+	is_valid_chan = Channel_IsValidName(Req->argv[0]);
 	cl = NULL; chan = NULL;
-	if (Client_IsValidNick(Req->argv[0]))
+	if (is_valid_nick)
 		cl = Client_Search(Req->argv[0]);
-	if (Channel_IsValidName(Req->argv[0]))
+	if (is_valid_chan)
 		chan = Channel_Search(Req->argv[0]);
 
 	if (cl)
@@ -88,8 +91,12 @@ IRC_MODE( CLIENT *Client, REQUEST *Req )
 		return Channel_Mode(Client, Req, origin, chan);
 
 	/* No target found! */
-	return IRC_WriteErrClient(Client, ERR_NOSUCHNICK_MSG,
-			Client_ID(Client), Req->argv[0]);
+	if (is_valid_nick)
+		return IRC_WriteErrClient(Client, ERR_NOSUCHNICK_MSG,
+				Client_ID(Client), Req->argv[0]);
+	else
+		return IRC_WriteErrClient(Client, ERR_NOSUCHCHANNEL_MSG,
+				Client_ID(Client), Req->argv[0]);
 } /* IRC_MODE */
 
 /**