Commit Graph

930 Commits (dfa9a6427fdb8b0af28849ec4e66a5905eb27b4f)

Author SHA1 Message Date
Klemens Nanni dfa9a6427f Disable /exec in Kiosk mode (as documented) 2021-07-13 15:16:22 -04:00
Klemens Nanni 2a87dc22ac /whois takes an optional nick argument 2021-07-13 15:16:22 -04:00
C. McEnroe 60660a780e Reword and clarify parts of the manual
Mostly related to the utilities options.
2021-07-13 15:16:22 -04:00
C. McEnroe ddb331d8dc Use CS command for paramless /op and /voice
Should match the actual /cs command.
2021-07-13 15:16:22 -04:00
C. McEnroe 91f00dee0d Condense markup for ignore/highlight format 2021-07-13 15:16:22 -04:00
C. McEnroe cad20da70a Point out precedence of multiple files and flags 2021-07-13 15:16:22 -04:00
C. McEnroe c76d76205f Zero out server password after sending
Also send it directly using ircSend to avoid copying it and logging
it to <debug>.
2021-07-13 15:16:22 -04:00
Klemens Nanni 9559fe9d23 Make -o/printCert not load any files, pledge even earlier
No point in trying to load a self-signed server certificate which we
are about to get from the server in the first place.

No need to read client certificate/key files when all we want is the
server certificate:  in TLS the server always sends its certificate
before the client replies with any key material, i.e. catgirl sending
client data is useless.

catgirl(1) synopsis also notes how these options are irrelevant in the
-o/printCert case.

As a result, ircConfig() no longer requires any filesystem I/O in this
case, so hoist the purely network I/O related pledge() call to enforce
this -- more secure, self-documenting code!
2021-07-13 15:16:22 -04:00
C. McEnroe 320aeaf435 Attempt to keep "security" in README accurate
It's a short summary trying to cover different systems...
2021-07-13 15:16:22 -04:00
Klemens Nanni 5bfba6df52 OpenBSD: merge unveil and pledge logic a bit
This reads somewhat clearer as code is grouped by features instead of
security mechanisms by simply merging identical tests/conditions.

No functional change.
2021-07-13 15:16:22 -04:00
Klemens Nanni 7793ca36bb OpenBSD: unveil logs regardless of restrict mode
Simplify logic and decouple the two features such that the code gets
even more self-ducumenting.

Previously `catgirl -R -l' would never unveil and therefore "proc exec"
could execute arbitrary paths without "rpath" as is usual unveil/pledge
semantic.

Now that `catgirl -l' alone triggers unveil(2), previous "proc exec"
alone is not enough since the first unveil() hides everything else from
filesystem;  unveil all of root executable-only in order to restore
non-restrict mode's visibility.

This leaves yields distinct cases wrt. filesystem visibility
(hoisted save file functionality excluded):

1. restrict on,  log off:  no access
2. restrict on,  log on :  logdir write/create
3. restrict off, log off:  all exec-only
4. restrict off, log on :  logdir write/create, all else exec-only

In the first case `unveil("/", "")' could be used but with no benefit as
the later lack of "rpath wpath cpath", i.e. filesystem access is revoked
entirely by pledge alone already.

Practically, this does not change functionality but improves correctness
and readability.
2021-07-13 15:16:22 -04:00
C. McEnroe 44457f85c6 Save invited channel for /join 2021-07-02 15:24:11 -04:00
C. McEnroe 54251acae3 Move security to the features list
The restrict option now enables real sandboxing on the two main
target systems.
2021-06-28 11:55:07 -04:00
C. McEnroe ca50352169 OpenBSD: unveil the log directory specifically
The call to logOpen() will have already created the directory. Still
use dataMkdir() as a convenient way to get the created path.
2021-06-28 09:57:10 -04:00
C. McEnroe cbc9545cb3 FreeBSD: Use capsicum_helpers.h 2021-06-28 09:11:02 -04:00
C. McEnroe cb62d92f54 Set MANDIR in chroot 2021-06-25 12:19:11 -04:00
C. McEnroe 56c31ae442 FreeBSD: Limit rights on log directory 2021-06-25 12:19:11 -04:00
C. McEnroe b48d0d607c FreeBSD: Limit rights on save file 2021-06-25 11:50:14 -04:00
C. McEnroe 1239ffa689 FreeBSD: Limit rights on stdio and socket 2021-06-25 11:50:14 -04:00
C. McEnroe 981ebc4f12 Remove explicit tls_handshake(3) from ircConnect
The first call to ircFormat, which calls tls_write(3) in turn, will
perform the handshake anyway. This way the handshake happens after
the final pledge(2) call.
2021-06-25 11:50:14 -04:00
C. McEnroe a0cc519829 Move setting CLOEXEC on socket to ircConnect 2021-06-25 11:50:14 -04:00
C. McEnroe 16b34e5cd2 FreeBSD: Enter capabilities mode if restricted 2021-06-25 11:50:14 -04:00
C. McEnroe fece6e6eb6 Keep log directory open, use mkdirat(2) and openat(2) 2021-06-25 11:50:14 -04:00
C. McEnroe 21a9954e7c Encourage packagers to patch in text macros
Maybe no one will ever do it but I think it's a fun idea.
2021-06-24 15:04:37 -04:00
C. McEnroe 60ff44cf4e Stop at previous \ when expanding macros
There was no reason to ever require whitespace before the macro
name.
2021-06-24 14:10:49 -04:00
C. McEnroe 65280c0b60 Replace SIGWINCH XXX comment with better explanation 2021-06-21 18:27:35 -04:00
Klemens Nanni b6cedf7dba Register SIGWINCH handler before TLS connect
Otherwise resizing the terminal will end catgirl until a handler is
registered, e.g. while in ircConnect():

	catgirl: tls_handshake: (null)

Hoist registration right after uiInitEarly() as earliest possible point
in main() since initscr(3) sets up various signals incl. SIGWINCH, i.e.
initialise `cursesWinch' afterwards to pick up curses(3)'s handler.
2021-06-21 18:11:09 -04:00
Klemens Nanni 2b7f62dbd4 Handle EINTR from connect(2) gracefully
Resizing the window early on may return early due to SIGWINCH.
Continue asynchronously in that case instead of exiting.
2021-06-21 17:58:28 -04:00
C. McEnroe a79a3fc9f6 Use NS and CS server aliases
I think I didn't use these originally because they were misconfigured
on tilde.chat, but they work now, and supposedly server aliases
should be more secure/reliable.
2021-06-21 17:26:43 -04:00
C. McEnroe 73181be1ca Open log files with CLOEXEC 2021-06-21 13:31:05 -04:00
C. McEnroe 1a336de95c Open save file with CLOEXEC
Otherwise a lingering process from /copy for example could hold the
lock.
2021-06-21 13:26:55 -04:00
Klemens Nanni 585039fb6e Use "secure" libtls ciphers
d3e90b6 'Use libtls "compat" ciphers' from 2018 fell back to "compat"
ciphers to support irc.mozilla.org which now yields NXDOMAIN.

All modern networks (should) support secure ciphers, so drop the
hopefully unneeded list of less secure ciphers by avoiding
tls_config_set_ciphers(3) and therefore sticking to the "secure" aka.
"default" set of ciphers in libtls.

A quick check shows that almost all of the big/known IRC networks
support TLS1.3 already;  those who do not at least comply with
SSL_CTX_set_cipher_list(3)'s "HIGH" set as can be tested like this:

	echo \
	  irc.hackint.org \
	  irc.tilde.chat \
	  irc.libera.chat \
	  irc.efnet.nl \
	  irc.oftc.net |
	xargs -tn1 \
	openssl s_client -quiet -cipher HIGH -no_ign_eof -port 6697 -host
2021-06-20 20:25:56 -04:00
Klemens Nanni 3a38e36717 OpenBSD: Only unveil used directories
dataMkdir() already picked the appropiate directory so make it
return that such that unveilData() can go as only that one directory
needs unveiling.
2021-06-20 20:21:00 -04:00
C. McEnroe e2bebca7dc Handle "\1ACTION\1" empty actions 2021-06-20 19:22:20 -04:00
C. McEnroe da374e6e61 Don't match actions in notices 2021-06-20 18:17:38 -04:00
C. McEnroe b3631a7e32 Handle TLS_WANNT_POLL{IN,OUT} from tls_handshake(3)
For blocking sockets it should be retried immediately.
2021-06-20 16:48:53 -04:00
C. McEnroe a5a225c52c Add -m mode option to set user modes 2021-06-18 12:28:09 -04:00
C. McEnroe d3b2f86a4b Handle 338 as whois reply
Used by Solanum for "actually using host".
2021-06-17 20:18:37 -04:00
C. McEnroe 03931d4bb3 Match window substrings case-sensitively
Case-insensitivity was copied from regular complete(), but other
commands which take substrings (/open and /copy) match case-sensitively.
2021-06-17 19:07:56 -04:00
C. McEnroe 0d888b88d0 Match windows by substring in /window
This could just iterate over idNames instead, but using complete
means more recently used windows will match first.
2021-06-17 18:52:47 -04:00
C. McEnroe a8c1f02976 Clean up if restricted && logEnable, pipe creation 2021-06-17 18:26:09 -04:00
C. McEnroe 188fc678bd Add mailing list archive to README 2021-06-17 12:11:55 -04:00
Klemens Nanni 948e6d5479 chat.tmux.conf: Make window selection hotkeys match window numbers
The 'pick chat network' binding on F1 lists tmux windows as follows
and tmux's `choose-tree -Z' lets you jump to the window by pressing the
key denoted inside parantheses.

Set `base-index 1' so as to make window indices match up the hotkey
number instead of being off-by-one due to the session itself being the
first entry in the list.

  (0)   - chat-5: 8 windows (group chat: chat-0,chat-1,chat-2,chat-3,chat-4,chat-5,chat-6) (attached)
  (1)   ├─>   1: hackint: "example.com"
  (2)   ├─>   2: efnet: "example.com"
  ...

PS: Update existing sessions by updating chat.tmux.conf, pressing F5
then running `prefix-: move-window -r' to renumber all windows.
2021-06-17 11:37:40 -04:00
C. McEnroe d2bec49931 Send PINGs when server is quiet and die if no response
Every time we receive from the server, reset a timer. The first
time the timer triggers, send a PING. The second time the timer
triggers, die from ping timeout.

I'm not sure about these two intervals: 2 minutes of idle before a
PING, 30s for the server to respond to the PING.
2021-06-15 16:59:24 -04:00
Klemens Nanni b690bd0b83 OpenBSD: Simplify promise creation after seprintf() introduction
Just truncate the initial promises back to the final ones after pledging
for the first time, saving code and memory.

Assign `ptr' in all initial `seprintf()' calls for consistency while
here.
2021-06-15 13:20:09 -04:00
Klemens Nanni 3e0b38e48e OpenBSD: pledge final promises earlier
No need to wait for so long.

This also brings all the pledge code on one screen and helps show how
ircConnect() is the only relevant part in between initial and final
promises.
2021-06-14 17:15:11 -04:00
Klemens Nanni 1ccadd7c72 Treat `-T's optional argument as optional
`-T[format]' is not possible with getopt(3) but getopt_long(3) supports
"T::" exactly for that, so make the command line option go in line with
configuration files and documentation.

While here, check `has_arg' explicitly as getopt_long(3) only documents
mnemonic values not numerical ones.
2021-06-14 17:00:15 -04:00
C. McEnroe e18c585701 Add \com text macro 2021-06-14 14:29:16 -04:00
Klemens Nanni 9c7ceb23bb /exec without controlling terminal
Otherwise "/exec sh </dev/tty" takes over and catgirl must effectively
be killed to stop the madness;  with this diff:

	catgirl  input| /exec sh </dev/tty
	catgirl output| /bin/sh: cannot open /dev/tty: Device not configured
	catgirl output| Process exits with status 1

Do the same for `-C/Copy', `-N/notify' and `-O/open' alike.
2021-06-13 16:46:34 -04:00
Klemens Nanni 4c0cdae4e5 Exit on data directory creation error
No point in creating (sub)directories when the given root failed already
as is the case when e.g. XDG_DATA_HOME/catgirl/ itself is bogus
(cleaned stderr intermangled with ncurses setup/catgirl output):

	$ env -i TERM=xterm XDG_DATA_HOME=/ ./catgirl -h irc.hackint.eu -n nobody -l
	catgirl: //catgirl/: Permission denied
	catgirl: //catgirl/log: No such file or directory
	catgirl: //catgirl/log/hackint: No such file or directory
	catgirl: //catgirl/log/hackint/NickServ: No such file or directory
	catgirl: //catgirl/: Permission denied
	catgirl: //catgirl/log/hackint/NickServ/2021-06-13.log: No such file or directory
2021-06-13 14:04:48 -04:00