diff -r d66fa5f585df Config --- a/Config Sun Jan 22 17:09:10 2012 +0100 +++ b/Config Sun Jan 22 14:46:20 2012 -0600 @@ -45,9 +45,6 @@ ARG="$ARG--with-disable-extendedban-stacking "; fi fi -if [ "$NOSPOOF" != "1" ] ; then -ARG="$ARG--disable-nospoof " -fi if [ "$CRYPTOIRCD" = "1" ] ; then if test x"$SSLDIR" = "x" ; then ARG="$ARG--enable-ssl " @@ -310,7 +307,6 @@ c="" n="" UNREALCWD="`pwd`" -NOSPOOF="1" DPATH="`pwd`" SPATH="`pwd`/src/ircd" DEFPERM="0600" @@ -407,43 +403,6 @@ clear fi -TEST="" -while [ -z "$TEST" ] ; do - if [ "$NOSPOOF" = "1" ] ; then - TEST="Yes" - else - TEST="No" - fi - echo "" - echo "Many older operating systems have an insecure TCP/IP stack" - echo "which may be vulnerable to IP spoofing attacks, if you run" - echo "an operating system that is vulnerable to such attacks" - echo "enable this option." - echo "This option also prevents blind proxies (eg: HTTP POST proxies)" - echo "and other blind clients from connecting (eg: protects against" - echo "the Firefox XPS IRC Attack)." - echo "" - echo "Do you want to enable the server anti-spoof protection?" - echo $n "[$TEST] -> $c" - read cc - if [ -z "$cc" ] ; then - cc=$TEST - fi - case "$cc" in - [Yy]*) - NOSPOOF="1" - ;; - [Nn]*) - NOSPOOF="" - ;; - *) - echo "" - echo "You must enter either Yes or No" - TEST="" - ;; - esac -done - TEST="$DPATH" echo "" echo "What directory are all the server configuration files in?" @@ -960,7 +919,6 @@ rm -f config.settings cat > config.settings << __EOF__ # -NOSPOOF="$NOSPOOF" DPATH="$DPATH" SPATH="$SPATH" INET6="$INET6" diff -r d66fa5f585df configure --- a/configure Sun Jan 22 17:09:10 2012 +0100 +++ b/configure Sun Jan 22 14:46:20 2012 -0600 @@ -690,7 +690,6 @@ with_dpath with_fd_setsize with_spath -enable_nospoof enable_prefixaq with_showlistmodes with_topicisnuhost @@ -1334,9 +1333,6 @@ --disable-option-checking ignore unrecognized --enable/--with options --disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no) --enable-FEATURE[=ARG] include FEATURE [ARG=yes] - --disable-nospoof Disable spoofing protection (requires clients to - respond to a randomly generated PING packet after - USER and NICK but before using other commands) --disable-prefixaq Enable chanadmin (+a) and chanowner (+q) prefixes --enable-ssl= enable ssl will check /usr/local/ssl /usr/lib/ssl /usr/ssl /usr/pkg /usr/sfw /usr/local /usr @@ -6066,20 +6062,6 @@ fi -# enable nospoof by default; protects against javascript POST attacks and much more ;-) -# Check whether --enable-nospoof was given. -if test "${enable_nospoof+set}" = set; then : - enableval=$enable_nospoof; -else - enable_nospoof=yes -fi - -if test $enable_nospoof = "yes"; then : - -$as_echo "#define NOSPOOF /**/" >>confdefs.h - -fi - # Check whether --enable-prefixaq was given. if test "${enable_prefixaq+set}" = set; then : enableval=$enable_prefixaq; @@ -6582,7 +6564,6 @@ - if test "x$ac_cv_env_PKG_CONFIG_set" != "xset"; then if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}pkg-config", so it can be a program name with args. @@ -6752,7 +6733,6 @@ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_TRE_CFLAGS=`$PKG_CONFIG --cflags "tre >= 0.7.5" 2>/dev/null` - test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi @@ -6769,7 +6749,6 @@ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_TRE_LIBS=`$PKG_CONFIG --libs "tre >= 0.7.5" 2>/dev/null` - test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi @@ -6789,9 +6768,9 @@ _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then - TRE_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "tre >= 0.7.5" 2>&1` + TRE_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors "tre >= 0.7.5" 2>&1` else - TRE_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "tre >= 0.7.5" 2>&1` + TRE_PKG_ERRORS=`$PKG_CONFIG --print-errors "tre >= 0.7.5" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$TRE_PKG_ERRORS" >&5 @@ -6905,7 +6884,6 @@ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_CARES_CFLAGS=`$PKG_CONFIG --cflags "libcares >= 1.6.0" 2>/dev/null` - test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi @@ -6922,7 +6900,6 @@ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_CARES_LIBS=`$PKG_CONFIG --libs "libcares >= 1.6.0" 2>/dev/null` - test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi @@ -6942,9 +6919,9 @@ _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then - CARES_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libcares >= 1.6.0" 2>&1` + CARES_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors "libcares >= 1.6.0" 2>&1` else - CARES_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libcares >= 1.6.0" 2>&1` + CARES_PKG_ERRORS=`$PKG_CONFIG --print-errors "libcares >= 1.6.0" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$CARES_PKG_ERRORS" >&5 diff -r d66fa5f585df configure.ac --- a/configure.ac Sun Jan 22 17:09:10 2012 +0100 +++ b/configure.ac Sun Jan 22 14:46:20 2012 -0600 @@ -489,14 +489,6 @@ [AC_DEFINE_UNQUOTED([SPATH], ["`pwd`/src/ircd"], [Define the location of the executable]) BINDIR="`pwd`/src/ircd"]) -# enable nospoof by default; protects against javascript POST attacks and much more ;-) -AC_ARG_ENABLE([nospoof], - [AS_HELP_STRING([--disable-nospoof], [Disable spoofing protection (requires clients to respond to a randomly generated PING packet after USER and NICK but before using other commands)])], - [], - [enable_nospoof=yes]) -AS_IF([test $enable_nospoof = "yes"], - [AC_DEFINE([NOSPOOF], [], [Define if you want spoof protection])]) - AC_ARG_ENABLE([prefixaq], [AS_HELP_STRING([--disable-prefixaq],[Enable chanadmin (+a) and chanowner (+q) prefixes])], [], diff -r d66fa5f585df doc/unreal32docs.html --- a/doc/unreal32docs.html Sun Jan 22 17:09:10 2012 +0100 +++ b/doc/unreal32docs.html Sun Jan 22 14:46:20 2012 -0600 @@ -2689,9 +2689,13 @@ Maximum time to wait for a time server reply. This is a value between 1 and 5, more is not possible because it causes too much inaccuracy. This setting is 3 by default and there's probably no good reason to change it.

+

set::ping-cookie <yes|no>
+ Send a challenge using PING, which clients respond to using PONG. This is helpful for + preventing blind HTTP-POST attacks and other things, as well as stopping spoofed TCP on + older operating systems with broken TCP stacks. The default is yes.

set::pingpong-warning <yes|no>
- When NOSPOOF is enabled (usually on Windows), send a warning to each user to use - '/quote pong ..' if they are having problems connecting? The default is no.

+ When set::ping-cookie is enabled (usually on Windows), send a warning to each user + to use '/quote pong ..' if they are having problems connecting? The default is no.

set::watch-away-notification <yes|no>
Allows you to enable/disable AWAY notification in WATCH. The default is yes.

diff -r d66fa5f585df include/dynconf.h --- a/include/dynconf.h Sun Jan 22 17:09:10 2012 +0100 +++ b/include/dynconf.h Sun Jan 22 14:46:20 2012 -0600 @@ -168,6 +168,7 @@ #ifdef INET6 unsigned short default_ipv6_clone_mask; #endif /* INET6 */ + int use_ping_cookie; }; #ifndef DYNCONF_C @@ -401,6 +402,7 @@ int cgiirc_type; /* cheat :( */ unsigned has_cgiirc_hosts:1; unsigned has_cgiirc_webpass:1; + unsigned has_use_ping_cookie:1; }; diff -r d66fa5f585df include/modversion.h --- a/include/modversion.h Sun Jan 22 17:09:10 2012 +0100 +++ b/include/modversion.h Sun Jan 22 14:46:20 2012 -0600 @@ -49,11 +49,7 @@ #else #define MYTOKEN_ZIP "" #endif - #if defined(NOSPOOF) - #define MYTOKEN_NOSPOOF "/NOSPF" - #else - #define MYTOKEN_NOSPOOF "" - #endif + #define MYTOKEN_NOSPOOF "/NOSPF" #if !defined(EXTCMODE) #define MYTOKEN_EXTCMODE "/NOEXTC" #else diff -r d66fa5f585df include/setup.h.in --- a/include/setup.h.in Sun Jan 22 17:09:10 2012 +0100 +++ b/include/setup.h.in Sun Jan 22 14:46:20 2012 -0600 @@ -238,9 +238,6 @@ /* Define if you do not have the index function. */ #undef NOINDEX -/* Define if you want spoof protection */ -#undef NOSPOOF - /* Define to 1 if your system has no in6addr_any. */ #undef NO_IN6ADDR_ANY diff -r d66fa5f585df include/struct.h --- a/include/struct.h Sun Jan 22 17:09:10 2012 +0100 +++ b/include/struct.h Sun Jan 22 14:46:20 2012 -0600 @@ -451,11 +451,7 @@ #ifdef USE_SSL #define IsSSL(x) IsSecure(x) #endif -#ifdef NOSPOOF #define IsNotSpoof(x) ((x)->nospoof == 0) -#else -#define IsNotSpoof(x) (1) -#endif #define GetHost(x) (IsHidden(x) ? (x)->user->virthost : (x)->user->realhost) #define GetIP(x) ((x->user && x->user->ip_str) ? x->user->ip_str : (MyConnect(x) ? Inet_ia2p(&x->ip) : NULL)) @@ -1030,9 +1026,7 @@ short lastsq; /* # of 2k blocks when sendqueued called last */ dbuf sendQ; /* Outgoing message queue--if socket full */ dbuf recvQ; /* Hold for data incoming yet to be parsed */ -#ifdef NOSPOOF u_int32_t nospoof; /* Anti-spoofing random number */ -#endif int proto; /* ProtoCtl options */ long sendM; /* Statistics: protocol messages send */ long sendK; /* Statistics: total k-bytes send */ diff -r d66fa5f585df src/modules/m_nick.c --- a/src/modules/m_nick.c Sun Jan 22 17:09:10 2012 +0100 +++ b/src/modules/m_nick.c Sun Jan 22 14:46:20 2012 -0600 @@ -692,22 +692,24 @@ } else if (!sptr->name[0]) { -#ifdef NOSPOOF - /* - * Client setting NICK the first time. - * - * Generate a random string for them to pong with. - */ - sptr->nospoof = getrandom32(); + if (iConf.use_ping_cookie) + { + /* + * Client setting NICK the first time. + * + * Generate a random string for them to pong with. + */ + sptr->nospoof = getrandom32(); - if (PINGPONG_WARNING) - sendto_one(sptr, ":%s NOTICE %s :*** If you are having problems" - " connecting due to ping timeouts, please" - " type /quote pong %X or /raw pong %X now.", - me.name, nick, sptr->nospoof, sptr->nospoof); + if (PINGPONG_WARNING) + sendto_one(sptr, ":%s NOTICE %s :*** If you are having problems" + " connecting due to ping timeouts, please" + " type /quote pong %X or /raw pong %X now.", + me.name, nick, sptr->nospoof, sptr->nospoof); - sendto_one(sptr, "PING :%X", sptr->nospoof); -#endif /* NOSPOOF */ + sendto_one(sptr, "PING :%X", sptr->nospoof); + } + #ifdef CONTACT_EMAIL sendto_one(sptr, ":%s NOTICE %s :*** If you need assistance with a" @@ -746,11 +748,10 @@ ** may reject the client and call exit_client for it ** --must test this and exit m_nick too!!! */ -#ifndef NOSPOOF - if (USE_BAN_VERSION && MyConnect(sptr)) + if (!iConf.use_ping_cookie && USE_BAN_VERSION && MyConnect(sptr)) sendto_one(sptr, ":IRC!IRC@%s PRIVMSG %s :\1VERSION\1", me.name, nick); -#endif + sptr->lastnick = TStime(); /* Always local client */ if (register_user(cptr, sptr, nick, sptr->user->username, NULL, NULL, NULL) == FLUSH_BUFFER) diff -r d66fa5f585df src/modules/m_pingpong.c --- a/src/modules/m_pingpong.c Sun Jan 22 17:09:10 2012 +0100 +++ b/src/modules/m_pingpong.c Sun Jan 22 14:46:20 2012 -0600 @@ -154,12 +154,9 @@ */ DLLFUNC int m_nospoof(aClient *cptr, aClient *sptr, int parc, char *parv[]) { -#ifdef NOSPOOF unsigned long result; -#endif Debug((DEBUG_NOTICE, "NOSPOOF")); -#ifdef NOSPOOF if (IsNotSpoof(cptr)) return 0; if (IsRegistered(cptr)) @@ -191,7 +188,6 @@ /* Homer compatibility */ sendto_one(cptr, ":%X!nospoof@%s PRIVMSG %s :\1VERSION\1", cptr->nospoof, me.name, cptr->name); -#endif return 0; } @@ -206,10 +202,8 @@ aClient *acptr; char *origin, *destination; -#ifdef NOSPOOF if (!IsRegistered(cptr)) return m_nospoof(cptr, sptr, parc, parv); -#endif if (parc < 2 || *parv[1] == '\0') { diff -r d66fa5f585df src/s_conf.c --- a/src/s_conf.c Sun Jan 22 17:09:10 2012 +0100 +++ b/src/s_conf.c Sun Jan 22 14:46:20 2012 -0600 @@ -1726,6 +1726,7 @@ i->watch_away_notification = 1; i->new_linking_protocol = 1; i->uhnames = 1; + i->use_ping_cookie = 1; #ifdef INET6 i->default_ipv6_clone_mask = 64; #endif /* INET6 */ @@ -7252,6 +7253,9 @@ else if (!strcmp(cep->ce_varname, "pingpong-warning")) { tempiConf.pingpong_warning = config_checkval(cep->ce_vardata, CFG_YESNO); } + else if (!strcmp(cep->ce_varname, "ping-cookie")) { + tempiConf.use_ping_cookie = config_checkval(cep->ce_vardata, CFG_YESNO); + } else if (!strcmp(cep->ce_varname, "watch-away-notification")) { tempiConf.watch_away_notification = config_checkval(cep->ce_vardata, CFG_YESNO); } @@ -7841,6 +7845,10 @@ CheckNull(cep); CheckDuplicate(cep, pingpong_warning, "pingpong-warning"); } + else if (!strcmp(cep->ce_varname, "ping-cookie")) { + CheckNull(cep); + CheckDuplicate(cep, use_ping_cookie, "ping-cookie"); + } else if (!strcmp(cep->ce_varname, "watch-away-notification")) { CheckNull(cep); CheckDuplicate(cep, watch_away_notification, "watch-away-notification"); diff -r d66fa5f585df src/s_debug.c --- a/src/s_debug.c Sun Jan 22 17:09:10 2012 +0100 +++ b/src/s_debug.c Sun Jan 22 14:46:20 2012 -0600 @@ -53,9 +53,8 @@ #ifdef SHOW_INVISIBLE_LUSERS 'i', #endif -#ifdef NOSPOOF + /* NOSPOOF is always compiled in now. --nenolod */ 'n', -#endif #ifdef VALLOC 'V', #endif