~irc/github.com/solanum-ircd/solanum.git/librb, branch amdj/modules

Increase tags to 8191 bytes and max count to 30

2025-10-10T19:09:40Z

If we receive an incoming message from a client that has over 4094 bytes of tag data (not including leading '@' or trailing ' '), reject the message with ERR_INPUTTOOLONG (417) per the message-tags spec. Similarly, give the same numeric if the client specifies the new maximum of 30 tags, since we can't distinguish between a client that gives us 30 tags and one that gives us more than 30. The spec says we are not allowed to truncate tags at all, and having 30 means we could have potentially truncated the incoming tag data.

librb/src/openssl.c: certfp: ignore the error X509_V_ERR_INVALID_PURPOSE (#454)

2025-06-11T15:58:13Z

LetsEncrypt are going to be removing the clientAuth EKU from all of their issued certificates in February 2026. Conformant TLS implementations that verify a client certificate following PKIX guidelines will reject these certificates. Fortunately we have our own verification callback, as we do not participate in the Web PKI. Ignore the error code corresponding to an invalid key usage.

GitHub CI Workflow: Bump OS and compiler versions (#447)

2025-02-25T23:41:18Z

* GitHub CI Workflow: Bump OS and compiler versions * CI: fix for clang 18/19 - Don't enable -Werror during the execution of ./configure and drop -Wunused-value from --enable-warnings - librb/src/crypt.c: remove old-style function decls - rb_dictionary: define type of arguments, fix callees - rb_radixtree: fix spurious out-of-bounds diagnostic Co-authored-by: Doug Freed

Accept expired certificates

2024-06-28T19:55:38Z

Delay rehashing until we're not processing events

2023-11-06T14:22:55Z

Fixes crash introduced by 0ab6dbbc651ddd1c26cb7baa6e6cf86890a4abd2. It's probably a regression since it defeats a system designed to stop this from happening, but I didn't dig through the history. rehash() closes listeners. If we happen to get a single epoll() result that wants to first rehash and then accept a connection, the epoll info will point to a freed rb_fde_t. Other selectors should have similar problems, but we didn't investigate that. rb_fde_ts are normally batched up and freed outside the event processing, but as of the above commit close_listeners() screws that up by closing pending FDs immediately in order to create new listeners. I think it might be a bit better to revert this behaviour and simply not close listeners if we are going to open new ones over them, but have opted for the smallest reasonable change I can think of. Helped-by: Eric Mertens

librb/helper: pass our fd limit to the child

2022-10-21T07:04:09Z

Instead of arbitrarily limiting it to 256. This avoids an issue with busy authds "running out" of fds because librb says no more.

Add semicolon to fix a compile error in librb/src/arc4random.c

2022-09-30T17:27:26Z

Remove missed Winsock2 check

2022-08-26T22:58:49Z

Remove ancient portability code (#361)

2022-08-25T00:53:52Z

Remove portability code for systems that don't follow at least SUSv3. This fairly closely aligns with ISO C99, which solanum already requires.

OpenSSL 3.0 compatibility

2022-08-25T00:36:47Z

Edited by @aaronmdjones: - Correct some data types and casts - Minor style fixups (e.g. we put * on the variable name not the type) - librb/src/openssl.c: - Defer call of BIO_free(3ssl) to the end of the conditional block to avoid having calls to it in multiple paths - Check the return value of SSL_CTX_set0_tmp_dh_pkey(3ssl) because if it fails then we must use EVP_PKEY_free(3ssl) to avoid a memory leak This could fail if, for example, the user supplied DSA parameters in the DH parameters file instead. - ircd/newconf.c: - Check whether OSSL_DECODER_CTX_new_for_pkey(3ssl) was able to parse the given CHALLANGE public key as a valid RSA public key, and then check whether OSSL_DECODER_from_bio(3ssl) actually loads it successfully - ircd/s_newconf.c: - Use EVP_PKEY_free(3ssl) instead of OPENSSL_free(3ssl) on EVP_PKEY pointers; this will avoid inadvertent memory leaks if the EVP_PKEY structure contains any dynamically-allocated child members - modules/m_challenge.c: - Unconditionally use EVP(3ssl) to generate the SHA-1 digest of the random challenge; this API has been around for a very long time and is available in all supported versions of OpenSSL - Add lots of error checking to all steps of the process Tested against 1.1.1 and 3.0; both with missing and provided DH parameters (which works as you'd expect; the server will not negotiate a DHE cipher without them), and CHALLENGE, including missing keys or keys of the wrong type (e.g. when you supply an EdDSA key instead of an RSA key). This does break compatibility with OpenSSL 1.1.0 and below, which are now all end-of-life and unsupported anyway. Closes #357