summary refs log tree commit diff
path: root/chat.c (follow)
Commit message (Collapse)AuthorAge
* Open save file once in uiLoad() and keep it open until uiSave()Klemens Nanni2021-06-11
| | | | | | | | | | | | | | | | | Opening the same file *path* twice is a TOCTOU, although not a critical one: worst case we load from one file and save to another - the impact depends on how and when catgirl is started the next anyway. More importantly, keeping the file handle open at runtime allows us to drop all filesystem related promises for `-s/save' on OpenBSD. uiLoad() now opens "r+", meaning "Open for reading and writing." up front so uiSave() can write to it. In the case of a nonexistent save file, it now opens with "w" meaning "Open for writing. The file is created if it does not exist.", i.e. the same write/create semantics as "w" except uiLoad() no longer truncates. existing files. uiSave() now truncates the save file to avoid appending in general.
* OpenBSD: Hoist loading save file to drop filesystem read-accessKlemens Nanni2021-06-11
| | | | | | After TLS cert/key files, the save file is the only file being read from; do so before pleding and drop the "rpath" promise all together: log files will only be created and written to.
* Move unveilAll back into mainJune McEnroe2021-06-10
| | | | It doesn't do as much anymore, so move it back inline.
* OpenBSD: Drop now unneeded promise from initial pledgeKlemens Nanni2021-06-10
| | | | | | | Both ssl(8) as well as ncurses(3) related files are now read completely by the time of ircConfig() and uiInitEarly() respectively, so read access to the filesystem is no longer needed at all unless the "log" or "save" options are used.
* OpenBSD: Remove now obsolete unveil codeKlemens Nanni2021-06-10
| | | | | | | | | | | Previous tls_default_ca_cert_file(3) hoisting makes this possible: all TLS related files are fully loaded into memory by ircConfig() such that ircConnect() will not do any file I/O. Call ircConfig() before pledge(2) in the `-o' "print cert" case so this works out -- that order should have been preserved in the previous a989e15 "OpenBSD: hoist -o/printCert code to simplify" but fixing it now nicely demonstrates the achivement even more so.
* Replace catf with seprintfJune McEnroe2021-06-09
|
* OpenBSD: pledge minimum promises from the startKlemens Nanni2021-06-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | catgirl needs: - "stdio tty" at all times - "rpath inet dns" once at startup for terminfo(5) and ssl(8) - "proc exec" iff -R/restrict options is disabled - "rpath wpath cpath" iff -s/save or -l/log options is enabled Status quo: catgirl starts with the superset of all possible promises "stdio rpath wpath cpath inet dns tty proc exec", drops offline with "stdio rpath wpath cpath tty proc exec" and possibly drops to either of "stdio rpath wpath cpath tty", "stdio tty proc exec" or "stdio tty" depending on the options used. Such step-by-step reduction is straight forward and easy to model along the process runtime, but it comes with the drawback of starting with too broad promises right from the beginning, i.e. `catgirl -R -h host' is able to execute code and write to filesystems even though it must never do so according the (un)used options. Lay out required promises up front and pledge in two stages: 1. initial setup, i.e. fixed "stdio tty" plus temporary "rpath inet dns" plus potential "rpath wpath cpath" plus potential "proc exec" 2. final rutime, i.e. fixed "stdio tty" plus potential "rpath wpath cpath" plus potential "proc exec" This way the above mentioned usage example can never execute or write files, hence less potential for bugs and more accurate modelling of catgirl's runtime -- dropping "inet dns" alone in between also becomes obsolete with this approach.
* OpenBSD: unveil after ncurses(3) init to support TERMINFOKlemens Nanni2021-06-09
| | | | | | | | | | | | initscr(3) in uiInitEarly() attempts more than /usr/share/terminfo/, see `mandoc -O tag=TERMINFO ncurses`. Even though non-default terminfo handling seems rare and it is unlikely to have ever caused a problem for catgirl users on OpenBSD, the current is still wrong by oversimplifying it. Avoid the entire curses/unveil clash by setting up the screen before unveiling.
* OpenBSD: hoist -o/printCert code to simplifyKlemens Nanni2021-06-09
| | | | | | | | | | Nothing but the TLS handshake is required, so skip all other setup. On OpenBSD, unveil() handling needs fixing which will involve code reshuffling -- this is the first related but standalone step. Also pledge this one-off code path individually such with simpler and tighter promises while here.
* Pad kiosk username with zero, not spaceJune McEnroe2021-06-06
| | | | Oops!
* OpenBSD: unveil XDG directories only when neededKlemens Nanni2021-06-06
| | | | | | | | | | | | | | | The (not perfectly obvious) way catgirl crafts directories gets triggered by unveilAll() even if no passed option requires filesystem access: $ env -i TERM=xterm ./catgirl -h irc.hackint.eu -R -n nobody catgirl: HOME unset Here unveil(2) is used due to the "restrict" option, but besides terminfo(5) and certificates catgirl does not need any other files, yet it tries to init the data path -- passing XDG_DATA_HOME=/var/empty makes above invocation work showing how the then successful path setup is not required. Fix this by not unveiling the unneeded data path in the first place.
* Hash the username in kiosk modeJune McEnroe2021-05-27
| | | | So that the first part of $SSH_CLIENT can be passed as username.
* Disable nick and channel colors with hash bound 0June McEnroe2021-03-08
|
* Error if hash bound is less than 2June McEnroe2021-02-25
| | | | Bad things happen otherwise.
* Change default timestamp format to %XJune McEnroe2021-01-27
| | | | This respects the user's locale settings.
* Add toggleable display of timestampsJune McEnroe2021-01-27
|
* Drop filesystem access iff possibleKlemens Nanni2021-01-23
| | | | | | | Log files and state save/restore both require read/write access to the filesystem, both during start and exit. If neither features are used, catgirl may run with "stdio tty".
* Drop exec capability iff restrictedKlemens Nanni2021-01-23
| | | | Nothing must be executed when running /copy, et al.
* Drop network capability after ircConnect()Klemens Nanni2021-01-23
| | | | | | catgirl has no reconnect feature and generally must not do anything but read/write from/to the connected socket which does not require "inet" or "dns" promises.
* Call pledge(2) after unveil(2)Klemens Nanni2021-01-23
| | | | | | Simplify logic, be more idiomatic and finalize by pledging after all unveiling is done by omitting the "unveil" promise and thereby not allowing further calls to it.
* Separate kiosk mode from restrict modeJune McEnroe2021-01-23
| | | | | | | | | | | Restrict mode will focus on sandboxing, while kiosk will continue to restrict IRC access through a public kiosk. Kiosk mode without restrict mode allows execution of man 1 catgirl with /help, assuming external sandboxing. The /list and /part commands are also added to the list of disabled commands in kiosk mode, since they are pointless without access to /join.
* Add -I highlight option and /highlightJune McEnroe2021-01-16
|
* Rename ignore code to filterJune McEnroe2021-01-16
|
* Sandbox with unveil(2) on OpenBSD in restricted modeJune McEnroe2021-01-10
| | | | I wrote all this in vi and it was nice.
* Print chain to stdout with -oJune McEnroe2021-01-10
|
* Exit immediately when using -oJune McEnroe2021-01-10
|
* Add -o and -t options to trust self-signed certificatesJune McEnroe2021-01-09
|
* Allow configuring the upper bound of the hash functionJune McEnroe2021-01-09
| | | | | | | This allows limiting the nick colors used to the 16-color terminal set without modifying the TERM environment variable. Produces different results from just using the default configuration in a 16-color terminal, but what can you do?
* Sandbox with pledge(2) on OpenBSDJune McEnroe2021-01-06
|
* Split /exec lines by \r as well as \nJune McEnroe2020-11-24
| | | | | This fixes local rendering of /exec toilet --irc, which outputs \r\n line endings.
* Avoid eating C-c while connectingJune McEnroe2020-10-12
| | | | | Split UI initialization into two steps either side of the call to connect, so that C-c works as interrupt while it's blocked.
* Use configPath to load TLS cert/privJune McEnroe2020-08-20
|
* Say "OpenSSL" in additional permission noticesJune McEnroe2020-08-04
| | | | LibreSSL is "a modified version of that library".
* Bump ParamCap to 254June McEnroe2020-06-24
| | | | | | | | | | | | Apparently IRCds have decided that the 15-parameter limit doesn't matter anymore. 254 is the maximum number of single-byte parameters (following a single-byte command) which fit in a 512-byte CR-LF-terminated line. When everyone decides that the 512-byte line length limit doesn't matter either, I will delete my software and people can use some JavaScript garbage instead. This makes struct Message 2080 bytes, but there's only ever one or two of them around at once. Avoid passing it by value to handle.
* Add additional permission for linking with LibreSSLJune McEnroe2020-06-08
| | | | https://www.gnu.org/licenses/gpl-faq.en.html#GPLIncompatibleLibs
* Revert "Send blank line after 10 minutes idle"June McEnroe2020-05-18
| | | | | | This reverts commit 1d5c4a5e346f0a295818441eb37697be283130ec. This is fixed instead by pounce using TCP keepalive.
* Use a for loop for getoptJune McEnroe2020-04-02
|
* Generate short option string with a loopJune McEnroe2020-04-02
| | | | | Also change the way option structs are initialized so that the array sorts the same way as the switch statement.
* Add /ignore message filtering patternsJune McEnroe2020-03-31
|
* Replace some declaration; while loops with for loopsJune McEnroe2020-03-30
| | | | | I should have been using this for getopt loops already but the call here is slightly too long to fit on one line as a for loop.
* Add text macrosJune McEnroe2020-03-30
|
* Add logging functionsJune McEnroe2020-03-25
| | | | The mkdir dance is a bit awkward...
* Assume worst case for unknown user and host in splitMessageJune McEnroe2020-03-23
| | | | | | The default USERLEN of 9 doesn't have a great source, the RFC only says that nicks are length 9, so my assumption is that usernames are not longer.
* Send blank line after 10 minutes idleJune McEnroe2020-03-17
| | | | | | | Without this, I was having catgirl "time out" from pounce's POV, but without catgirl noticing anything... I still don't understand this. Been using this fix for a couple weeks though and it stopped happening, and it's otherwise harmless, but yikes.
* Various small cleanupsJune McEnroe2020-02-16
| | | | Haven't really gone through ui.c yet.
* Set defaults for various types of modesJune McEnroe2020-02-15
| | | | | | | These are actually from RFC 1459, since that seems to be the more likely lowest common denominator, so I should maybe it it to STANDARDS (along with ircdocs' section on ISUPPORT). RFC 2812 has a lot of stuff that isn't currently used.
* Replace small integers in size_t with uintJune McEnroe2020-02-15
|
* Separate network info from selfJune McEnroe2020-02-15
|
* Add /execJune McEnroe2020-02-13
|
* Rename procPipe to utilPipeJune McEnroe2020-02-13
|
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-11-20 09:35:39 +0000