X-Git-Url: https://jfr.im/git/solanum.git/blobdiff_plain/999c42bad813dd4d0d2009c053bd53301dc43bc8..04e5ed6c57154114cca330767e3bfb1006b46ee9:/ircd/newconf.c diff --git a/ircd/newconf.c b/ircd/newconf.c index 79c76bac..5d9bdf8f 100644 --- a/ircd/newconf.c +++ b/ircd/newconf.c @@ -28,6 +28,7 @@ #include "wsproc.h" #include "privilege.h" #include "chmode.h" +#include "certfp.h" #define CF_TYPE(x) ((x) & CF_MTYPE) @@ -224,7 +225,7 @@ conf_set_serverinfo_sid(void *data) return; } - strcpy(ServerInfo.sid, sid); + rb_strlcpy(ServerInfo.sid, sid, sizeof(ServerInfo.sid)); } } @@ -243,30 +244,30 @@ conf_set_serverinfo_network_name(void *data) static void conf_set_serverinfo_vhost(void *data) { - if(rb_inet_pton(AF_INET, (char *) data, &ServerInfo.ip.sin_addr) <= 0) + struct rb_sockaddr_storage addr; + + if(rb_inet_pton_sock(data, &addr) <= 0 || GET_SS_FAMILY(&addr) != AF_INET) { conf_report_error("Invalid IPv4 address for server vhost (%s)", (char *) data); return; } - ServerInfo.ip.sin_family = AF_INET; - ServerInfo.specific_ipv4_vhost = 1; + + ServerInfo.bind4 = addr; } static void conf_set_serverinfo_vhost6(void *data) { -#ifdef RB_IPV6 - if(rb_inet_pton(AF_INET6, (char *) data, &ServerInfo.ip6.sin6_addr) <= 0) + + struct rb_sockaddr_storage addr; + + if(rb_inet_pton_sock(data, &addr) <= 0 || GET_SS_FAMILY(&addr) != AF_INET6) { conf_report_error("Invalid IPv6 address for server vhost (%s)", (char *) data); return; } - ServerInfo.specific_ipv6_vhost = 1; - ServerInfo.ip6.sin6_family = AF_INET6; -#else - conf_report_error("Warning -- ignoring serverinfo::vhost6 -- IPv6 support not available."); -#endif + ServerInfo.bind6 = addr; } static void @@ -295,7 +296,7 @@ conf_set_modules_module(void *data) m_bn = rb_basename((char *) data); - if(findmodule_byname(m_bn) == -1) + if(findmodule_byname(m_bn) == NULL) load_one_module((char *) data, MAPI_ORIGIN_EXTENSION, false); rb_free(m_bn); @@ -320,7 +321,6 @@ static struct mode_table umode_table[] = { {"invisible", UMODE_INVISIBLE }, {"locops", UMODE_LOCOPS }, {"noforward", UMODE_NOFORWARD }, - {"regonlymsg", UMODE_REGONLYMSG}, {"servnotice", UMODE_SERVNOTICE}, {"wallop", UMODE_WALLOP }, {"operwall", UMODE_OPERWALL }, @@ -351,6 +351,8 @@ static struct mode_table auth_table[] = { {"need_ssl", CONF_FLAGS_NEED_SSL }, {"need_sasl", CONF_FLAGS_NEED_SASL }, {"extend_chans", CONF_FLAGS_EXTEND_CHANS }, + {"allow_sctp", CONF_FLAGS_ALLOW_SCTP }, + {"kline_spoof_ip", CONF_FLAGS_KLINE_SPOOF }, {NULL, 0} }; @@ -359,7 +361,9 @@ static struct mode_table connect_table[] = { { "compressed", SERVER_COMPRESSED }, { "encrypted", SERVER_ENCRYPTED }, { "topicburst", SERVER_TB }, + { "sctp", SERVER_SCTP }, { "ssl", SERVER_SSL }, + { "no-export", SERVER_NO_EXPORT }, { NULL, 0 }, }; @@ -772,7 +776,6 @@ conf_set_class_cidr_ipv4_bitlen(void *data) } -#ifdef RB_IPV6 static void conf_set_class_cidr_ipv6_bitlen(void *data) { @@ -785,7 +788,6 @@ conf_set_class_cidr_ipv6_bitlen(void *data) yy_class->cidr_ipv6_bitlen = *(unsigned int *) data; } -#endif static void conf_set_class_number_per_cidr(void *data) @@ -830,21 +832,29 @@ conf_set_class_sendq(void *data) yy_class->max_sendq = *(unsigned int *) data; } -static char *listener_address; +static char *listener_address[2]; static int conf_begin_listen(struct TopConf *tc) { - rb_free(listener_address); - listener_address = NULL; + for (int i = 0; i < ARRAY_SIZE(listener_address); i++) { + rb_free(listener_address[i]); + listener_address[i] = NULL; + } + yy_wsock = 0; + yy_defer_accept = 0; return 0; } static int conf_end_listen(struct TopConf *tc) { - rb_free(listener_address); - listener_address = NULL; + for (int i = 0; i < ARRAY_SIZE(listener_address); i++) { + rb_free(listener_address[i]); + listener_address[i] = NULL; + } + yy_wsock = 0; + yy_defer_accept = 0; return 0; } @@ -861,46 +871,42 @@ conf_set_listen_wsock(void *data) } static void -conf_set_listen_port_both(void *data, int ssl) +conf_set_listen_port_both(void *data, int ssl, int sctp) { conf_parm_t *args = data; for (; args; args = args->next) { if(CF_TYPE(args->type) != CF_INT) { - conf_report_error - ("listener::port argument is not an integer " "-- ignoring."); + conf_report_error("listener::port argument is not an integer -- ignoring."); continue; } - if(listener_address == NULL) + if(listener_address[0] == NULL) { - if (!ssl) - { - conf_report_warning("listener 'ANY/%d': support for plaintext listeners may be removed in a future release per RFC 7194. " - "It is suggested that users be migrated to SSL/TLS connections.", args->v.number); + if (sctp) { + conf_report_error("listener::sctp_port has no addresses -- ignoring."); + } else { + add_tcp_listener(args->v.number, NULL, AF_INET, ssl, ssl || yy_defer_accept, yy_wsock); + add_tcp_listener(args->v.number, NULL, AF_INET6, ssl, ssl || yy_defer_accept, yy_wsock); } - add_listener(args->v.number, listener_address, AF_INET, ssl, ssl || yy_defer_accept, yy_wsock); -#ifdef RB_IPV6 - add_listener(args->v.number, listener_address, AF_INET6, ssl, ssl || yy_defer_accept, yy_wsock); -#endif } else { int family; -#ifdef RB_IPV6 - if(strchr(listener_address, ':') != NULL) + if(strchr(listener_address[0], ':') != NULL) family = AF_INET6; else -#endif family = AF_INET; - if (!ssl) - { - conf_report_warning("listener '%s/%d': support for plaintext listeners may be removed in a future release per RFC 7194. " - "It is suggested that users be migrated to SSL/TLS connections.", listener_address, args->v.number); + if (sctp) { +#ifdef HAVE_LIBSCTP + add_sctp_listener(args->v.number, listener_address[0], listener_address[1], ssl, yy_wsock); +#else + conf_report_error("Warning -- ignoring listener::sctp_port -- SCTP support not available."); +#endif + } else { + add_tcp_listener(args->v.number, listener_address[0], family, ssl, ssl || yy_defer_accept, yy_wsock); } - - add_listener(args->v.number, listener_address, family, ssl, ssl || yy_defer_accept, yy_wsock); } } } @@ -908,20 +914,33 @@ conf_set_listen_port_both(void *data, int ssl) static void conf_set_listen_port(void *data) { - conf_set_listen_port_both(data, 0); + conf_set_listen_port_both(data, 0, 0); } static void conf_set_listen_sslport(void *data) { - conf_set_listen_port_both(data, 1); + conf_set_listen_port_both(data, 1, 0 ); +} + +static void +conf_set_listen_sctp_port(void *data) +{ + conf_set_listen_port_both(data, 0, 1); +} + +static void +conf_set_listen_sctp_sslport(void *data) +{ + conf_set_listen_port_both(data, 1, 1); } static void conf_set_listen_address(void *data) { - rb_free(listener_address); - listener_address = rb_strdup(data); + rb_free(listener_address[1]); + listener_address[1] = listener_address[0]; + listener_address[0] = rb_strdup(data); } static int @@ -1301,7 +1320,17 @@ conf_end_connect(struct TopConf *tc) return 0; } - if(EmptyString(yy_server->host)) + if((yy_server->flags & SERVER_SSL) && EmptyString(yy_server->certfp)) + { + conf_report_error("Ignoring connect block for %s -- no fingerprint provided for SSL connection.", + yy_server->name); + return 0; + } + + if(EmptyString(yy_server->connect_host) + && GET_SS_FAMILY(&yy_server->connect4) != AF_INET + && GET_SS_FAMILY(&yy_server->connect6) != AF_INET6 + ) { conf_report_error("Ignoring connect block for %s -- missing host.", yy_server->name); @@ -1326,23 +1355,53 @@ conf_end_connect(struct TopConf *tc) static void conf_set_connect_host(void *data) { - rb_free(yy_server->host); - yy_server->host = rb_strdup(data); - if (strchr(yy_server->host, ':')) - yy_server->aftype = AF_INET6; + struct rb_sockaddr_storage addr; + + if(rb_inet_pton_sock(data, &addr) <= 0) + { + rb_free(yy_server->connect_host); + yy_server->connect_host = rb_strdup(data); + } + else if(GET_SS_FAMILY(&addr) == AF_INET) + { + yy_server->connect4 = addr; + } + else if(GET_SS_FAMILY(&addr) == AF_INET6) + { + yy_server->connect6 = addr; + } + else + { + conf_report_error("Unsupported IP address for server connect host (%s)", + (char *)data); + return; + } } static void conf_set_connect_vhost(void *data) { - if(rb_inet_pton_sock(data, (struct sockaddr *)&yy_server->my_ipnum) <= 0) + struct rb_sockaddr_storage addr; + + if(rb_inet_pton_sock(data, &addr) <= 0) + { + rb_free(yy_server->bind_host); + yy_server->bind_host = rb_strdup(data); + } + else if(GET_SS_FAMILY(&addr) == AF_INET) + { + yy_server->bind4 = addr; + } + else if(GET_SS_FAMILY(&addr) == AF_INET6) + { + yy_server->bind6 = addr; + } + else { - conf_report_error("Invalid IP address for server connect vhost (%s)", - (char *) data); + conf_report_error("Unsupported IP address for server connect vhost (%s)", + (char *)data); return; } - - yy_server->flags |= SERVER_VHOSTED; } static void @@ -1397,10 +1456,8 @@ conf_set_connect_aftype(void *data) if(rb_strcasecmp(aft, "ipv4") == 0) yy_server->aftype = AF_INET; -#ifdef RB_IPV6 else if(rb_strcasecmp(aft, "ipv6") == 0) yy_server->aftype = AF_INET6; -#endif else conf_report_error("connect::aftype '%s' is unknown.", aft); } @@ -1559,15 +1616,6 @@ conf_set_general_hide_error_messages(void *data) conf_report_error("Invalid setting '%s' for general::hide_error_messages.", val); } -static void -conf_set_general_kline_delay(void *data) -{ - ConfigFileEntry.kline_delay = *(unsigned int *) data; - - /* THIS MUST BE HERE to stop us being unable to check klines */ - kline_queued = false; -} - static void conf_set_general_stats_k_oper_only(void *data) { @@ -1667,15 +1715,19 @@ conf_set_general_certfp_method(void *data) { char *method = data; - if (!rb_strcasecmp(method, "sha1")) - ConfigFileEntry.certfp_method = RB_SSL_CERTFP_METH_SHA1; - else if (!rb_strcasecmp(method, "sha256")) - ConfigFileEntry.certfp_method = RB_SSL_CERTFP_METH_SHA256; - else if (!rb_strcasecmp(method, "sha512")) - ConfigFileEntry.certfp_method = RB_SSL_CERTFP_METH_SHA512; + if (!rb_strcasecmp(method, CERTFP_NAME_CERT_SHA1)) + ConfigFileEntry.certfp_method = RB_SSL_CERTFP_METH_CERT_SHA1; + else if (!rb_strcasecmp(method, CERTFP_NAME_CERT_SHA256)) + ConfigFileEntry.certfp_method = RB_SSL_CERTFP_METH_CERT_SHA256; + else if (!rb_strcasecmp(method, CERTFP_NAME_CERT_SHA512)) + ConfigFileEntry.certfp_method = RB_SSL_CERTFP_METH_CERT_SHA512; + else if (!rb_strcasecmp(method, CERTFP_NAME_SPKI_SHA256)) + ConfigFileEntry.certfp_method = RB_SSL_CERTFP_METH_SPKI_SHA256; + else if (!rb_strcasecmp(method, CERTFP_NAME_SPKI_SHA512)) + ConfigFileEntry.certfp_method = RB_SSL_CERTFP_METH_SPKI_SHA512; else { - ConfigFileEntry.certfp_method = RB_SSL_CERTFP_METH_SHA1; + ConfigFileEntry.certfp_method = RB_SSL_CERTFP_METH_CERT_SHA1; conf_report_error("Ignoring general::certfp_method -- bogus certfp method %s", method); } } @@ -2043,6 +2095,7 @@ conf_begin_opm(struct TopConf *tc) yy_opm_address_ipv4 = yy_opm_address_ipv6 = NULL; yy_opm_port_ipv4 = yy_opm_port_ipv6 = yy_opm_timeout = 0; delete_opm_proxy_scanner_all(); + delete_opm_listener_all(); return 0; } @@ -2062,28 +2115,28 @@ conf_end_opm(struct TopConf *tc) if(yy_opm_port_ipv4 > 0) { if(yy_opm_address_ipv4 != NULL) - create_opm_listener(yy_opm_address_ipv4, yy_opm_port_ipv4); + conf_create_opm_listener(yy_opm_address_ipv4, yy_opm_port_ipv4); else { char ip[HOSTIPLEN]; - if(!rb_inet_ntop_sock((struct sockaddr *)&ServerInfo.ip, ip, sizeof(ip))) + if(!rb_inet_ntop_sock((struct sockaddr *)&ServerInfo.bind4, ip, sizeof(ip))) conf_report_error("No opm::listen_ipv4 nor serverinfo::vhost directive; cannot listen on IPv4"); else - create_opm_listener(ip, yy_opm_port_ipv4); + conf_create_opm_listener(ip, yy_opm_port_ipv4); } } if(yy_opm_port_ipv6 > 0) { if(yy_opm_address_ipv6 != NULL) - create_opm_listener(yy_opm_address_ipv6, yy_opm_port_ipv6); + conf_create_opm_listener(yy_opm_address_ipv6, yy_opm_port_ipv6); else { char ip[HOSTIPLEN]; - if(!rb_inet_ntop_sock((struct sockaddr *)&ServerInfo.ip6, ip, sizeof(ip))) + if(!rb_inet_ntop_sock((struct sockaddr *)&ServerInfo.bind6, ip, sizeof(ip))) conf_report_error("No opm::listen_ipv6 nor serverinfo::vhost directive; cannot listen on IPv6"); else - create_opm_listener(ip, yy_opm_port_ipv6); + conf_create_opm_listener(ip, yy_opm_port_ipv6); } } @@ -2138,7 +2191,7 @@ conf_set_opm_listen_address_both(void *data, bool ipv6) const char *confstr = (ipv6 ? "opm::listen_ipv6" : "opm::listen_ipv4"); char *ip = data; - if(!rb_inet_pton_sock(ip, (struct sockaddr *)&addr)) + if(!rb_inet_pton_sock(ip, &addr)) { conf_report_error("%s is an invalid address: %s", confstr, ip); return; @@ -2146,7 +2199,6 @@ conf_set_opm_listen_address_both(void *data, bool ipv6) if(ipv6) { -#ifdef RB_IPV6 if(GET_SS_FAMILY(&addr) != AF_INET6) { conf_report_error("%s is of the wrong address type: %s", confstr, ip); @@ -2160,10 +2212,6 @@ conf_set_opm_listen_address_both(void *data, bool ipv6) } yy_opm_address_ipv6 = rb_strdup(ip); -#else - conf_report_error("%s requires IPv6 support in your ircd", confstr, ip); - return; -#endif } else { @@ -2201,14 +2249,6 @@ conf_set_opm_listen_port_both(void *data, bool ipv6) int port = *((int *)data); const char *confstr = (ipv6 ? "opm::port_ipv6" : "opm::port_ipv4"); -#ifndef RB_IPV6 - if(ipv6) - { - conf_report_error("%s requires IPv6 support in your ircd", confstr); - return; - } -#endif - if(port > 65535 || port <= 0) { conf_report_error("%s is out of range: %d", confstr, port); @@ -2272,7 +2312,7 @@ conf_set_opm_scan_ports_all(void *data, const char *node, const char *type) conf_report_error("%s argument is not an integer -- ignoring.", node); continue; } - + if(args->v.number > 65535 || args->v.number <= 0) { conf_report_error("%s argument is not an integer between 1 and 65535 -- ignoring.", node); @@ -2635,9 +2675,7 @@ static struct ConfEntry conf_class_table[] = { { "ping_time", CF_TIME, conf_set_class_ping_time, 0, NULL }, { "cidr_ipv4_bitlen", CF_INT, conf_set_class_cidr_ipv4_bitlen, 0, NULL }, -#ifdef RB_IPV6 { "cidr_ipv6_bitlen", CF_INT, conf_set_class_cidr_ipv6_bitlen, 0, NULL }, -#endif { "number_per_cidr", CF_INT, conf_set_class_number_per_cidr, 0, NULL }, { "number_per_ip", CF_INT, conf_set_class_number_per_ip, 0, NULL }, { "number_per_ip_global", CF_INT,conf_set_class_number_per_ip_global, 0, NULL }, @@ -2685,7 +2723,6 @@ static struct ConfEntry conf_general_table[] = { "compression_level", CF_INT, conf_set_general_compression_level, 0, NULL }, { "havent_read_conf", CF_YESNO, conf_set_general_havent_read_conf, 0, NULL }, { "hide_error_messages",CF_STRING, conf_set_general_hide_error_messages,0, NULL }, - { "kline_delay", CF_TIME, conf_set_general_kline_delay, 0, NULL }, { "stats_k_oper_only", CF_STRING, conf_set_general_stats_k_oper_only, 0, NULL }, { "stats_i_oper_only", CF_STRING, conf_set_general_stats_i_oper_only, 0, NULL }, { "default_umodes", CF_QSTRING, conf_set_general_default_umodes, 0, NULL }, @@ -2710,6 +2747,7 @@ static struct ConfEntry conf_general_table[] = { "client_exit", CF_YESNO, NULL, 0, &ConfigFileEntry.client_exit }, { "collision_fnc", CF_YESNO, NULL, 0, &ConfigFileEntry.collision_fnc }, { "resv_fnc", CF_YESNO, NULL, 0, &ConfigFileEntry.resv_fnc }, + { "post_registration_delay", CF_TIME, NULL, 0, &ConfigFileEntry.post_registration_delay }, { "connect_timeout", CF_TIME, NULL, 0, &ConfigFileEntry.connect_timeout }, { "default_floodcount", CF_INT, NULL, 0, &ConfigFileEntry.default_floodcount }, { "default_ident_timeout", CF_INT, NULL, 0, &ConfigFileEntry.default_ident_timeout }, @@ -2720,6 +2758,7 @@ static struct ConfEntry conf_general_table[] = { "hide_spoof_ips", CF_YESNO, NULL, 0, &ConfigFileEntry.hide_spoof_ips }, { "dline_with_reason", CF_YESNO, NULL, 0, &ConfigFileEntry.dline_with_reason }, { "kline_with_reason", CF_YESNO, NULL, 0, &ConfigFileEntry.kline_with_reason }, + { "hide_tkdline_duration", CF_YESNO, NULL, 0, &ConfigFileEntry.hide_tkdline_duration }, { "map_oper_only", CF_YESNO, NULL, 0, &ConfigFileEntry.map_oper_only }, { "max_accept", CF_INT, NULL, 0, &ConfigFileEntry.max_accept }, { "max_monitor", CF_INT, NULL, 0, &ConfigFileEntry.max_monitor }, @@ -2760,7 +2799,9 @@ static struct ConfEntry conf_general_table[] = { "max_ratelimit_tokens", CF_INT, NULL, 0, &ConfigFileEntry.max_ratelimit_tokens }, { "away_interval", CF_INT, NULL, 0, &ConfigFileEntry.away_interval }, { "hide_opers_in_whois", CF_YESNO, NULL, 0, &ConfigFileEntry.hide_opers_in_whois }, + { "hide_opers", CF_YESNO, NULL, 0, &ConfigFileEntry.hide_opers }, { "certfp_method", CF_STRING, conf_set_general_certfp_method, 0, NULL }, + { "drain_reason", CF_QSTRING, NULL, BUFSIZE, &ConfigFileEntry.drain_reason }, { "\0", 0, NULL, 0, NULL } }; @@ -2789,6 +2830,7 @@ static struct ConfEntry conf_channel_table[] = { "autochanmodes", CF_QSTRING, conf_set_channel_autochanmodes, 0, NULL }, { "displayed_usercount", CF_INT, NULL, 0, &ConfigChannel.displayed_usercount }, { "strip_topic_colors", CF_YESNO, NULL, 0, &ConfigChannel.strip_topic_colors }, + { "opmod_send_statusmsg", CF_YESNO, NULL, 0, &ConfigChannel.opmod_send_statusmsg }, { "\0", 0, NULL, 0, NULL } }; @@ -2821,6 +2863,8 @@ newconf_init() add_conf_item("listen", "wsock", CF_YESNO, conf_set_listen_wsock); add_conf_item("listen", "port", CF_INT | CF_FLIST, conf_set_listen_port); add_conf_item("listen", "sslport", CF_INT | CF_FLIST, conf_set_listen_sslport); + add_conf_item("listen", "sctp_port", CF_INT | CF_FLIST, conf_set_listen_sctp_port); + add_conf_item("listen", "sctp_sslport", CF_INT | CF_FLIST, conf_set_listen_sctp_sslport); add_conf_item("listen", "ip", CF_QSTRING, conf_set_listen_address); add_conf_item("listen", "host", CF_QSTRING, conf_set_listen_address);