Commit graph

151 commits

Author SHA1 Message Date
Simon Arlott
30053ab982
gcc7 fixes: make fallthrough explicit 2018-01-19 23:26:03 +00:00
Aaron Jones
e081bf2988
libratbox/src/mbedtls.c: check public/private keys match 2018-01-06 16:05:48 +00:00
Simon Arlott
268044ea40
Add workaround for Linux SCTP_I_WANT_MAPPED_V4_ADDR bug on older kernels 2017-08-24 20:08:22 +01:00
Simon Arlott
6003ce763c
Add outgoing SCTP connect support 2017-08-24 20:08:21 +01:00
Simon Arlott
c6ad9b0c5f
Add basic SCTP listener support that binds to multiple addresses
This only supports two addresses as the intended use is 1 IPv4 and 1 IPv6
address on a single-homed host, and the only supported configuration of
outgoing connections to other servers is to bind a single IPv4 or IPv6
address.
2017-08-24 20:08:20 +01:00
Simon Arlott
589dbf4d0f
rb_connect: use SO_ERROR 2017-08-24 20:08:19 +01:00
Simon Arlott
9caecc9348
rb_inet_pton_sock: initialise sockaddr to zero 2017-08-24 20:08:19 +01:00
Simon Arlott
de2934965c
remove RB_IPV6 2017-08-20 12:54:46 +01:00
Simon Arlott
fa2367e3f3
librb: remove zstring
rb_zstring_serialized leaks memory while doing nothing with its
arguments... nothing is using zstring so remove it
2017-08-06 18:40:24 +01:00
Simon Arlott
1272b289e6
librb: dictionary_add mishandles replacing elements
This can only happen with soft asserts otherwise it will crash instead.

Nothing currently uses the return value of rb_dictionary_add.
2017-08-06 18:38:35 +01:00
Simon Arlott
4b1cce65ed
ircd: send tags on every message
Simplify linebuf by introducing fsnprint to manage a list of printfs.
Add a msgbuf unparse cache for send functions that loop.
2017-08-06 16:21:29 +01:00
Aaron Jones
515467e527
mbedtls.c: minor fixups
- Add (void) casts for unused function parameters
- Rearrange member in `struct rb_mbedtls_cfg_context' for data alignment
- Document a `clang-4.0 -Weverything' (-Wcast-qual) diagnostic
- Avoid pointless conversions between positive/negative error codes
- Use capital hexadecimals in error codes and properly cast to
  (unsigned int) for %x/%X
2017-07-30 18:41:32 +01:00
Simon Arlott
e5c434a2df
librb: add rb_snprintf_try_append
For when it might fit, or it might not.
2017-07-30 17:04:06 +01:00
Simon Arlott
8573c3409e
librb: rb_snprinf_append: handle error return value from vsnprintf() 2017-07-30 17:03:30 +01:00
Simon Arlott
7a06833fb4
librb: linebuf: reduce the number of "put" implementations from 4 to 1 2017-07-30 15:51:45 +01:00
Simon Arlott
4c7d1de8f3
librb: linebuf needs to use the buffer limit from msgbuf_unparse_prefix 2017-07-29 23:32:27 +01:00
Simon Arlott
2100c58d09
librb: rb_rawbuf_length: do something if soft assert fails
correct the value of rb->len
2017-07-29 22:46:10 +01:00
Simon Arlott
9f46eae691
linebuf: increase buffer size to accommodate IRCv3 tags 2017-07-29 22:46:06 +01:00
Simon Arlott
33ded5fc57
librb: remove unnecessary NULL from the end of rb_string_to_array output 2017-07-29 22:46:04 +01:00
Simon Arlott
b5ad4cdfde
make soft asserts better by allowing them to be used in expressions 2017-07-29 22:39:53 +01:00
Simon Arlott
45285c4a73
librb: rb_lib_loop: avoid clang static analysis warning 2017-07-29 22:39:49 +01:00
Simon Arlott
630c15211d
librb: rb_linebuf_copy_raw: remove unused assignment 2017-07-29 22:28:47 +01:00
Simon Arlott
b0adc7bf97
librb: commio: Must set addrlen before every call to accept()
If an IPv4 connection is dropped by the pre-callback, and there is a
pending IPv6 connection on the same listening socket then the retried
accept() will be unable to populate `st` because `addrlen` will be too
small. Also initialise `st` each time to avoid a clang static analysis
warning.
2017-07-29 22:20:05 +01:00
Aaron Jones
c3abf98286
MbedTLS: Disable TLSv1.0 2016-12-30 17:59:48 +00:00
Aaron Jones
35cd299395
OpenSSL: Disable TLSv1.0
Also some misc other cleanups/additions to bring it in line with the
release/3.5 backend
2016-12-30 17:59:46 +00:00
Aaron Jones
5bcd4c7c60
GNUTLS: Provide a default priority string, disable TLSv1.0 in it
The user can still override this choice with the ssl_cipher_list option
in ircd.conf -- this is the only backend that will allow you to do so.
2016-12-30 17:59:35 +00:00
Aaron Jones
05281d7a0d
TLS backends: Move some library-dependent functions to the proper location
The comment incorrectly stated these were library-agnostic; infact, they
use library-dependent data types or macro names.
2016-11-15 12:16:03 +00:00
Simon Arlott
d8f0b5d763
cppcheck: fix various warnings/errors
[ircd/match.c:316]: (error) Shifting a negative value is undefined behaviour
[librb/src/patricia.c:55]: (error) Shifting a negative value is undefined behaviour
[modules/m_alias.c:64]: (portability) '(void*)message' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined.
[modules/m_time.c:111]: (warning) %u in format string (no. 9) requires 'unsigned int' but the argument type is 'signed int'.
[modules/m_time.c:111]: (warning) %u in format string (no. 10) requires 'unsigned int' but the argument type is 'signed int'.
[librb/src/dictionary.c:819]: (warning) %d in format string (no. 3) requires 'int' but the argument type is 'unsigned int'.
[librb/src/radixtree.c:1080]: (warning) %d in format string (no. 3) requires 'int' but the argument type is 'unsigned int'.
[ircd/s_user.c:351] -> [ircd/s_user.c:357]: (warning) Either the condition '0!=source_p' is redundant or there is possible null pointer dereference: source_p.
[extensions/ip_cloaking_3.0.c:109]: (warning, inconclusive) The buffer 'buf' may not be null-terminated after the call to strncpy().
[ircd/chmode.c:256]: (style) Clarify calculation precedence for '&' and '?'.
[modules/m_help.c:100]: (style) Clarify calculation precedence for '&' and '?'.
[modules/m_knock.c:169]: (style) Clarify calculation precedence for '&' and '?'.
[modules/m_stats.c:628]: (style) Clarify calculation precedence for '&' and '?'.
[modules/m_stats.c:727]: (style) Clarify calculation precedence for '&' and '?'.
[librb/src/radixtree.c:601]: (style) Clarify calculation precedence for '&' and '?'.
[librb/src/radixtree.c:704]: (style) Clarify calculation precedence for '&' and '?'.
[librb/src/radixtree.c:739]: (style) Clarify calculation precedence for '&' and '?'.
[librb/src/radixtree.c:763]: (style) Clarify calculation precedence for '&' and '?'.
[librb/src/radixtree.c:768]: (style) Clarify calculation precedence for '&' and '?'.
[librb/src/radixtree.c:774]: (style) Clarify calculation precedence for '&' and '?'.
[librb/src/radixtree.c:781]: (style) Clarify calculation precedence for '&' and '?'.
[librb/src/radixtree.c:786]: (style) Clarify calculation precedence for '&' and '?'.
[librb/src/radixtree.c:791]: (style) Clarify calculation precedence for '&' and '?'.
[librb/src/radixtree.c:804]: (style) Clarify calculation precedence for '&' and '?'.
[ircd/wsproc.c:372]: (style) Unused variable: len
[modules/core/m_modules.c:382]: (style) Unused variable: i
[modules/m_stats.c:741]: (style) Unused variable: amsg
[ircd/authproc.c:390]: (style) Unused variable: iter
[ircd/authproc.c:391]: (style) Unused variable: client_p
2016-10-28 20:13:36 +01:00
Simon Arlott
01dd3da541
rb_string_to_array: document parv array size 2016-10-22 22:36:47 +01:00
Aaron Jones
42e6fbaa8c
OpenSSL: Adjust ciphersuite order and update documentation 2016-10-18 11:17:41 +00:00
Aaron Jones
98c4aaeaff
MbedTLS: Adjust ciphersuite order and update documentation 2016-10-18 11:16:38 +00:00
Aaron Jones
56fbe141a1
GNUTLS: Forward-port release/3.5 improvements
The changes made in this file are detailed in release/3.5 commits
4d89c83c32 through ecfdcb08e8 inclusive.

Some slight alterations are necessary; librb instead of libratbox,
snprintf() instead of rb_snprintf(), etc. Also, release/4 has
offline certificate digesting functionality. For more insight,
simply diff the gnutls.c between release/3.5 and release/4.
2016-09-17 17:53:01 +00:00
Aaron Jones
dd066596dc
MbedTLS: Forward-port release/3.5 improvements
The changes made in this file are detailed in release/3.5 commits
295c8f7d37 through 265dc4e53c inclusive.

Some slight alterations are necessary; librb instead of libratbox,
snprintf() instead of rb_snprintf(), etc. Also, release/4 has
offline certificate digesting functionality. For more insight,
simply diff the mbedtls.c between release/3.5 and release/4.
2016-09-17 17:19:31 +00:00
Aaron Jones
73470f0b3c
OpenSSL: Forward-port release/3.5 improvements
The changes made in this file are detailed in release/3.5 commits
1f30c8943b through 92c04c6b9d inclusive.

Some slight alterations are necessary; librb instead of libratbox,
snprintf() instead of rb_snprintf(), etc. Also, release/4 has
offline certificate digesting functionality. For more insight,
simply diff the openssl.c between release/3.5 and release/4.
2016-09-17 17:03:21 +00:00
Aaron Jones
c4acd427ac
MbedTLS: Misc backend cleanups
This is a forward-port of release/3.5 commit 566f4678

* Add generic direction enum for negotiation setup.

* Rename a rather long wrapper function to a shorter one consistent with
  what it does.

* Rework context setup function.

* Don't check for handshake state before beginning handshaking.

  The old backend began a handshake and then stepped into the callback
  function if it was interrupted; the current one just jumps right into
  it, so there is no need to check if it has previously succeeded,
  because it hasn't been attempted yet.

* Add missing errno assignment to one of the handshake wrappers.

* Don't bother checking if SSL_P(F) is NULL when we already checked if
  F->ssl is NULL -- this should be impossible.

* Don't bother checking if SSL_C(F) is NULL -- this was a no-op.

* Change the socket send and recv functions to not peer into a foreign
  ratbox structure -- use the correct function to get the socket fd.

* Rewrap some lines and function arguments.

Other backends will be brought into line with this backend soon.

This will enable easier maintenance of the backends, by reducing the
diffs between them, which should make different behaviour easier to
spot.
2016-09-10 08:51:09 +00:00
Aaron Jones
73c486c7a5
MbedTLS: Treat 0 bytes read/written to socket properly
At the moment, if a link quits in just the right (wrong [1]) way,
the quit reason will resemble:

    <-- foo (~bar@baz) has quit (Read error: (-0x0) )

This should resolve that.

[1] Peers should send a close_notify alert before abruptly shutting
    down their socket. This will result in a sane quit message:

    <-- foo (~bar@baz) has quit (Read error: (-0x7880) SSL -
    The peer notified us that the connection is going to be closed)

[ci skip]
2016-09-09 01:47:18 +00:00
Aaron Jones
7272518795
MbedTLS: Initial attempt to port release/3.5 commit 89d4c468 to this branch 2016-09-04 03:50:29 +00:00
Simon Arlott
1315fd5920
librb: set sockaddr port to 0 in success path
Instead of only in the failure path, which causes
all sorts of annoying server connection failures
when we try to repeatedly reuse the same port.
2016-09-03 14:36:17 +01:00
Aaron Jones
94f114641c
OpenSSL: Initialise if LibreSSL
LibreSSL's definition of OPENSSL_VERSION_NUMBER bites us in the ass,
*again*.
2016-09-01 19:29:47 +00:00
Aaron Jones
572c2d4b05
OpenSSL: Initialise one context at a time
If initialising the server context fails, but the client one succeeds,
we will not only leak memory, but the error message reported for
initialising the server context might not make sense, because we
initialise the client context after and that could erase or change the
list of queued errors.

This scenario is considered rare. Nevertheless, we now initialise the
client context after *successfully* initialising the server context.
2016-08-30 10:30:17 +00:00
Aaron Jones
31145ea0b3
TLS Backends: Harmomise the rb_ssl_get_cipher() function
The GNUTLS backend reports the version in use for the client as well
as its ciphersuite -- do the same for the other 2 backends.
2016-08-20 04:16:33 +01:00
Aaron Jones
4906854293
GNUTLS: Avoid null dereference in constructing ciphersuite 2016-08-19 20:26:43 +00:00
Aaron Jones
6971019a09
GNUTLS: Cleanup fingerprint generation
Removes intermediate buffer, properly check return values
2016-08-19 19:14:40 +00:00
Aaron Jones
add3f90b9f
openssl: Avoid use-after-free when rehashing fails to load new files
Commit cf12678 introduced a fix for issue #186 by freeing the old SSL_CTX
structure before constructing a new one, which could disconnect existing
clients otherwise.

Unfortunately, the freeing is done first, which means that if setting up
a new structure fails for any reason, there will be no usable structures
left, but they are still referenced.

This fix moves the freeing to the end of the function, using intermediate
new variables in the meantime. This problem was discovered while testing
against OpenSSL 1.1.0 RC6.
2016-08-12 13:34:13 +00:00
William Pitcock
2e29fd422d librb: remove one more VMS detritius 2016-06-19 21:47:59 -05:00
William Pitcock
0268efc78c librb: we have no plans to support VMS 2016-06-19 21:47:23 -05:00
William Pitcock
cfb1020589 librb: dictionaries which use integer keys may use 0 legitimately 2016-06-17 23:29:11 -05:00
Aaron Jones
499612f19e
mbedtls backend: indicate reason for TLS session termination
[ci skip]
2016-06-12 11:33:41 +00:00
Aaron Jones
47a66e154f
librb: silence some fairly harmless compiler warnings
These include warnings about "break" statements that will never be
executed (because they are after "return" statements), unused macros
(lost to code refactoring or never even used in the first place),
functions that call abort() or loop indefinitely but aren't marked with
the "noreturn" attribute, and use of variables possibly uninitialised
(a false positive).
2016-06-01 20:54:11 +00:00
Aaron Jones
d5ad6015c5
openssl: use snprintf(3) instead of rb_snprintf() 2016-06-01 18:04:43 +00:00