summary refs log tree commit diff
path: root/bounce.c (follow)
Commit message (Collapse)AuthorAge
* Rename all local-related options to local-June McEnroe2020-01-12
| | | | | | | This disambiguates client-ca and client-pass from client-cert and client-key, which apply to opposite sides of the program. The old option names will continue to work.
* Use the CAP_PREAD rightJune McEnroe2020-01-12
| | | | Required for the rewind call when loading the CA.
* Add option to set local client CAJune McEnroe2020-01-12
| | | | | | | | | This is a little bit messy. Allows setting either -A or -W or both. Implements SASL EXTERNAL for clients that expect that when connecting with a client certificate. Need to test that reloading still works inside capsicum, since I suspect that rewind call may be blocked.
* Rename -A and -Q to -y and -qJune McEnroe2020-01-07
| | | | | | | | | | | The other upper-case options are related to the listening side of things, not the server side, so this is more consistent. This is incompatible, but will fail loudly, and I expect these options are more likely set in a configuration file, if they are set at all. I also want to free up -A for setting a client CA, but assuming your away message is not also an existing file path, that will continue to fail loudly.
* Revert "Exit when server gets POLLHUP"June McEnroe2019-12-22
| | | | | | | Turns out the more likely thing is that the fd will just continue to be POLLIN and produce zero-length reads. This reverts commit 5707b15920a1ce57f01db0d592487d833218be9d.
* Exit when server gets POLLHUPJune McEnroe2019-12-20
| | | | | | This should maybe gracefully inform clients of what happened, but for now this is much better than the infinite poll loop that happened previously.
* Reference openssl(1) by absolute pathedef2019-11-27
| | | | | This still allows using openssl(1) from PATH, but defaults to using ${LIBRESSL_PREFIX}/bin/openssl.
* Declare globals as extern in headers, and define in source fileMichael Forney2019-11-21
| | | | | | | | | | | | | | | Otherwise, each source file that includes the header gets its own definition, and according to the C standard (C99 6.9p5): > If an identifier declared with external linkage is used in an > expression (other than as part of the operand of a sizeof operator > whose result is an integer constant), somewhere in the entire > program there shall be exactly one external definition for the > identifier Most compilers use the .bss section for zero data, but if it uses .data instead, or if -Wl,--warn-common is used, this will cause a linking error.
* Request NAMES on sync by defaultJune McEnroe2019-11-15
| | | | This inverts the meaning of -N!
* Rename listen to localJune McEnroe2019-11-10
|
* Check that password is hashedJune McEnroe2019-11-08
|
* Only change AWAY status for registered clientsJune McEnroe2019-11-08
| | | | | | Turns out I did eventually fix this, because I may want to implement "passive clients" for logging or notification stuff, which wouldn't affect AWAY status either.
* Include path in readlinkat errorJune McEnroe2019-11-07
|
* Call clientConsume before clientRecvJune McEnroe2019-11-07
| | | | | This might reduce the frequency of a client getting its own message back because it was behind in the ring when it sent it.
* Declare more missing functions and deal with lack of SO_NOSIGPIPEJune McEnroe2019-11-06
|
* Define one CERTBOT_PATH rather than two format stringsJune McEnroe2019-11-06
|
* Change license to GPLv3June McEnroe2019-11-06
| | | | | | | | | | | | | | > Notwithstanding any other provision of this License, if you modify the > Program, your modified version must prominently offer all users > interacting with it remotely through a computer network (if your version > supports such interaction) an opportunity to receive the Corresponding > Source of your version by providing access to the Corresponding Source > from a network server at no charge, through some standard or customary > means of facilitating copying of software. This potentially means that every freenode user, for example, is interacting with this software, and offering the corresponding source to each of them is an unreasonable burden.
* Add flag to generate a client certificateJune McEnroe2019-11-06
| | | | | This is essentially the command freenode tells you to run: <https://freenode.net/kb/answer/certfp>.
* Use explicit_bzero from LibreSSLJune McEnroe2019-11-06
|
* Clean up bounce.cJune McEnroe2019-11-05
|
* Use "priv" instead of "key" in optionsJune McEnroe2019-11-05
| | | | Let all words be four letter words.
* Use arc4random_bufJune McEnroe2019-11-05
|
* Implement SASL EXTERNALJune McEnroe2019-11-05
|
* Add options for TLS client certificateJune McEnroe2019-11-04
|
* Hash client passwords with cryptJune McEnroe2019-11-04
|
* Rename bind-unix to bind-pathJune McEnroe2019-11-03
|
* Append bindHost to bindPath if it is a directoryJune McEnroe2019-11-03
|
* Fix trying to cap_rights_limit a NULL saveFileJune McEnroe2019-11-02
|
* Implement UNIX-domain bindingJune McEnroe2019-11-02
|
* Limit saveFile to CAP_WRITEJune McEnroe2019-11-01
|
* Implement capsicum workaround for certbotJune McEnroe2019-11-01
|
* Reload certificates using openatJune McEnroe2019-11-01
| | | | | This is more versatile since files are more likely to be replaced than overwritten.
* Re-read cert and key from the same FILEsJune McEnroe2019-11-01
|
* Use capsicumJune McEnroe2019-11-01
|
* Use explicit_bzero to clear passwordsJune McEnroe2019-10-31
| | | | | GNU doesn't implement memset_s, but both FreeBSD and GNU implement explicit_bzero. Darwin doesn't, so #define it in terms of memset_s.
* Send clients their own QUIT on shutdownJune McEnroe2019-10-31
|
* Iterator over pollfds in reverseJune McEnroe2019-10-31
| | | | | | | | | | | This has two advantages: 1. When removing a client, we don't need to break the loop, since the swap-remove will replace the current pollfd with one we've already handled and we can safely move on to the next (previous) one. 2. If a new client connects for the same consumer (for example if the previous one is going to time out), it will start consuming messages for that consumer, rather than them being sent to the old client.
* Clear passwords from memory with memset_sJune McEnroe2019-10-31
|
* Remove client count FIXMEJune McEnroe2019-10-30
| | | | This minor thing would take too much code convolution to do.
* Add option for ring sizeJune McEnroe2019-10-30
|
* Set away status upon connectingJune McEnroe2019-10-30
|
* Allocate ring buffer at runtimeJune McEnroe2019-10-29
|
* Implement getopt_long-integrated configuration parsingJune McEnroe2019-10-29
|
* Lock save fileJune McEnroe2019-10-28
|
* Add option to save and load ring contents across restartsJune McEnroe2019-10-28
|
* Add quit message optionJune McEnroe2019-10-28
|
* Move entire login flow to state and reorganize itJune McEnroe2019-10-28
|
* Output ring info on SIGINFOJune McEnroe2019-10-27
|
* Reload certificate on SIGUSR1June McEnroe2019-10-27
|
* Explicitly tls_handshake new clientsJune McEnroe2019-10-27
| | | | | This prevents a client connecting, sending nothing, and getting blocked in tls_read immediately.
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-11-16 12:46:39 +0000