0
0
Fork 0
mirror of https://github.com/matrix-construct/construct synced 2024-11-04 21:08:57 +01:00
Commit graph

106 commits

Author SHA1 Message Date
Jilles Tjoelker
e053adc87e commio: Explicitly ignore return value from setsockopt(TCP_DEFER_ACCEPT). 2014-03-02 22:09:08 +01:00
Jilles Tjoelker
6993ae2760 libratbox: Abort if the restart callback returns. 2014-02-28 00:53:13 +01:00
Jilles Tjoelker
3cbcc11195 commio: Add error string for SSL trouble. 2014-02-24 00:06:19 +01:00
Jilles Tjoelker
5ef68b1398 Replace double semicolons with single; place null statement on its own line.
No functional change is intended.
2014-02-23 22:23:34 +01:00
Jilles Tjoelker
899b05d387 balloc: Fix memory leak when get_block() fails. 2014-02-23 22:14:47 +01:00
Keith Buck
784ce5c1cc Remove SSL_OP_NO_COMPRESSION from openssl initialization.
SSL_OP_NO_COMPRESSION was presumably added in an attempt to prevent
information leakage in a manner similar to recent attacks on HTTPS.
However, assuming that IRC is vulnerable to the same class of attacks is
incorrect: the behavior of the IRC protocol (a single long-running
connection) is not the same as that of HTTPS (multiple ephemeral
connections). HTTPS's use of ephemeral connections means that certain
assumptions can be made about the contents of the compression
algorithm's dictionaries and the content exchanged between the client
and server (e.g. the content being nearly the same for each connection),
which is not true for IRC. Additionally, they rely on the attacker being
able to coerce the client into creating many HTTPS connections (and
resending some secret token belonging to the user, along with
attacker-controlled data) each time, none of which is possible with IRC.
Lastly, since compression is no longer performed, this option will
result in leaking the lengths of messages transmitted to and from the
client. This option does reduce CPU utilization on Charybdis servers but
also increases bandwidth consumed.
2014-02-21 09:17:29 +00:00
Jilles Tjoelker
fab79c5d25 libratbox: Fix undefined behaviour advancing pointer beyond end of array.
The C standard does not allow constructing pointers beyond one past the end
of an array. Therefore, if size is an unsigned type (size_t), then
buf + size is never less than buf.

Clang on 32-bit took advantage of the undefined behaviour, causing
segfaults.

Lightly tested.
2014-02-16 16:06:01 +01:00
William Pitcock
bf4e01a427 libratbox: regenerate autotools files 2014-02-08 18:35:24 +00:00
William Pitcock
7aa40f6d2c libratbox/gnutls: add gnutls v3 api compatibility without breaking v2 2014-02-08 18:34:49 +00:00
Jilles Tjoelker
362ef2d9ee openssl: Improve security using options recommanded by Argure.
Note that these are not available in old versions of OpenSSL (like FreeBSD
9.x base OpenSSL), so allow them to be missing.

A side effect may be slightly higher CPU consumption and network traffic.
2014-01-15 22:25:26 +01:00
Jilles Tjoelker
9799bea4a1 openssl: Use cipher list suggested by Argure. 2014-01-15 22:13:47 +01:00
Jilles Tjoelker
cee842a829 openssl: Fix compiler warning. 2014-01-15 22:09:57 +01:00
Jilles Tjoelker
fabc3174fe openssl: Set some sort of session id context.
Without a session id context and if client certificates are used, OpenSSL
fails the handshake if an attempt is made to reuse an old session. Various
clients could not reconnect after a disconnection because of this.

See https://bugzilla.mozilla.org/show_bug.cgi?id=858394#c34 for a bug
report.
2014-01-15 22:04:12 +01:00
William Pitcock
b6e799f5df libratbox/openssl: check that ECDHE is really available on redhat derivatives (closes #43) 2013-11-30 19:55:01 +00:00
Mantas Mikulėnas
320d34a606 libratbox/crypt: fix difference from glibc in sha256_crypt()
rb_crypt() was generating different SHA256 ($5$) hashes than glibc,
making hashes generated with charybdis unusable in ratbox and other
software, and vice versa.
2013-10-23 15:47:28 +03:00
Patrick Godschalk
31d2201519 Have OpenSSL version check use cpp 2013-09-06 20:05:49 +02:00
Patrick Godschalk
81998134b7 Set ECDHE on OpenSSL 1.00+. 2013-09-03 14:16:57 +02:00
Quora Dodrill
97b0e99e2a libratbox/openssl: Fix possible memory leak with SSL certificate fingerprints 2013-08-14 09:54:57 -07:00
Quora Dodrill
f997930e7c Revert "libratbox/openssl: Fix possible memory leak with SSL dertificate fingerprints"
This reverts commit 6ecd598ec0.
2013-08-14 09:54:18 -07:00
Quora Dodrill
6ecd598ec0 libratbox/openssl: Fix possible memory leak with SSL dertificate fingerprints 2013-08-14 09:50:12 -07:00
Antoine Beaupré
e4cf89d403 rerun aclocal to include pkg.m4
this also updates aclocal from 1.11.1 to 1.11.6
2013-07-17 20:26:47 -04:00
Antoine Beaupré
2bd29df9e1 Revert "libratbox: Remove broken gnutls support."
This reverts commit f2d58c6d72.
2013-06-10 12:19:02 -04:00
Antoine Beaupré
608e20b4fa Revert "Remove more gnutls references."
This reverts commit 6a25507e90.
2013-06-10 12:18:43 -04:00
William Pitcock
373d6d79e3 libratbox/crypt: remove blowfish support since it has the stupid advertising clause 2012-09-29 17:28:04 -05:00
William Pitcock
a85566b151 sigio: use siginfo_t instead of struct siginfo, per glibc commit r4efeffc1d5 2012-07-25 10:34:50 -05:00
Aaron Sethman
21acd0961c Disable timerfd/signalfd on openvz, it seems broken
(imported from libratbox r27395 by nenolod)
2012-05-18 21:16:13 -05:00
Jilles Tjoelker
6a25507e90 Remove more gnutls references. 2012-04-18 00:38:44 +02:00
Jilles Tjoelker
271a98feb1 libratbox: Run autoreconf. 2012-04-17 22:35:56 +02:00
Jilles Tjoelker
f2d58c6d72 libratbox: Remove broken gnutls support. 2012-04-17 22:34:11 +02:00
Keith Buck
77444dcc1f gnutls: Fix certfp server link auth. 2012-04-07 21:51:31 +00:00
Keith Buck
3d7890b99c gnutls: Fix ssld crash when executing a SSL connection to another server. 2012-04-07 17:40:22 +00:00
Elly Fong-Jones
2682bc3053 libratbox: use rb_listen(), not listen().
Signed-off-by: Elly Fong-Jones <elly@leptoquark.net>
2012-04-03 01:19:07 -04:00
Jilles Tjoelker
797a29f353 libratbox: Allow defer_accept on FreeBSD.
Note that you must have options ACCEPT_FILTER_DATA in your kernel
configuration or load the accf_data kernel module. The functionality is
not in the GENERIC kernel.
2012-03-20 00:33:31 +01:00
William Pitcock
aa4737a049 libratbox: make defer_accept optional. 2012-03-17 09:48:25 -05:00
William Pitcock
77cb59b319 libratbox: add support for TCP_DEFER_ACCEPT on linux
This allows for some further hardening against synflooding and connection flooding
where no data is actually sent, as the kernel will simply ignore those connections
(well, as far as the ircd is concerned anyway).
2012-03-17 09:16:39 -05:00
Nathan Phillip Brink
422cf3bb86 Detect a potential infinite loop in ./configure in AC_DEFINE_DIR.
Fixes the changes made to AC_DEFINE_DIR in
c74836dc4a.
2012-03-02 01:51:30 +00:00
Nathan Phillip Brink
c74836dc4a Add explicit support for being installed into a system triggered with --enable-fhs-paths.
Add two mechanism for avoiding name-collisions in a system-wide
installation of charybdis. The ssld and bandb daemons, intended to be
directly used by ircd and not the user, install into libexec when
--enable-fhs-paths is set. For binaries which are meant to be in PATH
(bindir), such as ircd and viconf, there is now an option
--with-program-prefix=progprefix inspired by automake. If the user
specifies --with-program-prefix=charybdis, the ircd binary is named
charybdisircd when installed.

Add support for saving the pidfile to a rundir and storing the ban
database in localstatedir instead of in sysconfdir. This is, again,
conditional on --enable-fhs-paths.

Fix(?) genssl.sh to always write created SSL key/certificate/dh
parameters to the sysconfdir specified during ./configure. The
previous behavior was to assume that the user ran genssl.sh after
ensuring that his current working directory was either sysconfdir or a
sibling directory of sysconfdir.
2012-03-01 02:41:09 +00:00
William Pitcock
54bec06e97 Re-libtoolize. 2012-02-04 04:18:48 -06:00
William Pitcock
a949ab1a1c configure: set version to charybdis 3.4.0-dev 2012-02-04 04:14:20 -06:00
Jilles Tjoelker
d74fa5b502 Prefer PATH_MAX to non-standard MAXPATHLEN. 2011-10-28 16:45:18 +02:00
William Pitcock
08d019eb49 libtoolize 2011-05-08 11:20:34 -05:00
William Pitcock
b6d0720c1c configure: Add --with-custom-branding and --with-custom-version options. 2011-05-08 08:55:32 -05:00
Jilles Tjoelker
e732a57bd1 Cope with OPENSSL_VERSION_NUMBER not being a long.
Contrary to the documentation, this is the case on recent FreeBSD at least.
2011-03-20 18:46:32 +01:00
Elizabeth Jennifer Myers
f171dafb59 Add endian test to autoconf and convert crypt to use it. 2011-01-24 21:03:00 -05:00
Elizabeth Jennifer Myers
48dc39f771 Add blowfish to libratbox crypt.
Also change u_int*_t to uint*_t whilst I'm here.
2011-01-17 05:01:11 -05:00
Jilles Tjoelker
af9e5b5ef7 Fix compiler warnings. 2011-01-08 17:40:12 +01:00
Elizabeth Jennifer Myers
08c2568cb9 Add SHA256/SHA512 support to crypt.c and fix up the MD5 component (it seemed to have been broken). In addition, unconditionally use the libratbox crypt. 2011-01-06 01:29:22 -05:00
Jilles Tjoelker
86510a73f9 libratbox: Unbreak compile. 2010-12-15 21:48:26 +01:00
William Pitcock
07e14084eb libratbox: Use the server SSL certificate on outgoing connections. 2010-12-13 22:58:09 -06:00
William Pitcock
56c1612ff3 libratbox: Clean up uses of strcpy(). 2010-11-23 08:52:18 -06:00