From e880d18bb32834981c202a998f793eb02c989f44 Mon Sep 17 00:00:00 2001 From: "Luis R. Rodriguez" Date: Fri, 15 Aug 2014 15:53:31 -0400 Subject: [PATCH 1/3] irssi: embrace the Developer Certificate of Origin for contributions The Linux kernel started to embrace a light weight development contribution agreement process called the Developer Certificate of Origin (DCO) circa 2004. Attorneys all over the planet have conferred a lot of respect and appreciation for this document and it provides a light weight alternative to cumbersome and controversial Contribution License Agreements (CLAs). Similar to streamlining FOSS licenses we also all stand to gain from streamlining a light weight contribution agreement process for development and in light of this the the Linux Foundation recently has made the DCO a standalone project [0] so that any FOSS project under any FOSS license can take advantage of the same gains. The motivation and intent is documented on my blog post [1] and later covered extensively on lwn [2] after James Bottomley's talk, and Bradley Kuhn went on extensively about it as well [3]. Lets take advantage of the new shiny DCO and embrace it for contributions. [0] http://developercertificate.org/ [1] http://www.do-not-panic.com/2014/02/developer-certificate-of-origin.html [2] http://lwn.net/Articles/592503/ [3] http://ebb.org/bkuhn/blog/2014/06/09/do-not-need-cla.html Signed-off-by: Luis R. Rodriguez --- CONTRIBUTING | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 CONTRIBUTING diff --git a/CONTRIBUTING b/CONTRIBUTING new file mode 100644 index 00000000..f2889597 --- /dev/null +++ b/CONTRIBUTING @@ -0,0 +1,49 @@ + +This project embraces the Developer Certificate of Origin (DCO) for +contributions. This means you must agree to the following prior to submitting +patches, if you agree with this developer certificate you acknowledge this by +adding a Signed-off-by tag to your patch commit log. Every submitted patch +must have this. + +The source for the DCO: + +http://developercertificate.org/ + +----------------------------------------------------------------------- + +Developer Certificate of Origin +Version 1.1 + +Copyright (C) 2004, 2006 The Linux Foundation and its contributors. +660 York Street, Suite 102, +San Francisco, CA 94110 USA + +Everyone is permitted to copy and distribute verbatim copies of this +license document, but changing it is not allowed. + + +Developer's Certificate of Origin 1.1 + +By making a contribution to this project, I certify that: + +(a) The contribution was created in whole or in part by me and I + have the right to submit it under the open source license + indicated in the file; or + +(b) The contribution is based upon previous work that, to the best + of my knowledge, is covered under an appropriate open source + license and I have the right under that license to submit that + work with modifications, whether created in whole or in part + by me, under the same open source license (unless I am + permitted to submit under a different license), as indicated + in the file; or + +(c) The contribution was provided directly to me by some other + person who certified (a), (b) or (c) and I have not modified + it. + +(d) I understand and agree that this project and the contribution + are public and that a record of the contribution (including all + personal information I submit with it, including my sign-off) is + maintained indefinitely and may be redistributed consistent with + this project or the open source license(s) involved. From ea7476addfb71eaa06897a440950eb8f59658dd8 Mon Sep 17 00:00:00 2001 From: "Luis R. Rodriguez" Date: Fri, 15 Aug 2014 16:01:35 -0400 Subject: [PATCH 2/3] irssi core: add window console set active support We can't go to the console window easily right now, we'll want this in case irssi needs to prompt the user for something sensitive such as a password. Signed-off-by: Luis R. Rodriguez --- src/fe-common/core/fe-windows.c | 16 ++++++++++++++++ src/fe-common/core/fe-windows.h | 2 ++ src/fe-common/core/window-commands.c | 10 ++++++++++ 3 files changed, 28 insertions(+) diff --git a/src/fe-common/core/fe-windows.c b/src/fe-common/core/fe-windows.c index bf9d7154..be44ab7d 100644 --- a/src/fe-common/core/fe-windows.c +++ b/src/fe-common/core/fe-windows.c @@ -70,6 +70,8 @@ WINDOW_REC *window_create(WI_ITEM_REC *item, int automatic) rec = g_new0(WINDOW_REC, 1); rec->refnum = window_get_new_refnum(); + if (rec->refnum == 1) + rec->console = 1; rec->level = settings_get_level("window_default_level"); windows = g_slist_prepend(windows, rec); @@ -353,6 +355,20 @@ WINDOW_REC *window_find_refnum(int refnum) return NULL; } +WINDOW_REC *window_find_console(void) +{ + GSList *tmp; + + for (tmp = windows; tmp != NULL; tmp = tmp->next) { + WINDOW_REC *rec = tmp->data; + + if (rec->console) + return rec; + } + + return NULL; +} + WINDOW_REC *window_find_name(const char *name) { GSList *tmp; diff --git a/src/fe-common/core/fe-windows.h b/src/fe-common/core/fe-windows.h index 613f15f8..28ac671c 100644 --- a/src/fe-common/core/fe-windows.h +++ b/src/fe-common/core/fe-windows.h @@ -35,6 +35,7 @@ struct _WINDOW_REC { unsigned int immortal:1; unsigned int sticky_refnum:1; unsigned int destroying:1; + unsigned int console:1; /* window-specific command line history */ HISTORY_REC *history; @@ -75,6 +76,7 @@ const char *window_get_active_name(WINDOW_REC *window); WINDOW_REC *window_find_level(void *server, int level); WINDOW_REC *window_find_closest(void *server, const char *name, int level); WINDOW_REC *window_find_refnum(int refnum); +WINDOW_REC *window_find_console(void); WINDOW_REC *window_find_name(const char *name); WINDOW_REC *window_find_item(SERVER_REC *server, const char *name); diff --git a/src/fe-common/core/window-commands.c b/src/fe-common/core/window-commands.c index a975fe5c..aa791da1 100644 --- a/src/fe-common/core/window-commands.c +++ b/src/fe-common/core/window-commands.c @@ -842,6 +842,16 @@ static void cmd_foreach_window(const char *data) active_win = old; } +void window_console(void) +{ + WINDOW_REC *window; + + window = window_find_console(); + if (!window) + return; + window_set_active(window); +} + void window_commands_init(void) { settings_add_bool("lookandfeel", "active_window_ignore_refnum", TRUE); From c0ce6d38dc7a5ae8cc22e2bd0d57fbfc31774f89 Mon Sep 17 00:00:00 2001 From: "Luis R. Rodriguez" Date: Fri, 15 Aug 2014 16:06:33 -0400 Subject: [PATCH 3/3] irssi core: enable prompting for client certificate password irssi supports letting you specify the client SSL password using the ssl_pass primitive on the configuration file. Its a terrible idea to be putting passwords on unencrypted files though so some security rational folks won't ever want to do this. If you currently don't supply one irssi goes on and assumes you do not want to use it, and depending on the server configuration it may or not fail on the SSL handshake and not allow any connection to go through... Freenode lets you authenticate your username with an SSL client certificate so this is not desirable behavior. This adds support to irrsi so that if an SSL client certificate was supplied and if no password was set we prompt the user for one. Upon disconnects we won't have to re-enter the password but just in case for whatever reason SSL needs it we redraw the screen to the console screen should the user have to enter a password again. Users that do not have a password on the SSL client certificate can just either enter an empty password upon the prompt or set an empty password on the configuration file. Its a bad idea to be using passwordless client certificate files anyway, so let them do a bit more work. We only prompt for a password if and only if the client certificate was set, if you have different client certificate files or use the client certificate for different connections you'll be asked for a password for each server SSL connection. Signed-off-by: Luis R. Rodriguez --- src/core/network-openssl.c | 41 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 39 insertions(+), 2 deletions(-) diff --git a/src/core/network-openssl.c b/src/core/network-openssl.c index 768fd540..23258c63 100644 --- a/src/core/network-openssl.c +++ b/src/core/network-openssl.c @@ -37,6 +37,8 @@ #include #endif +void window_console(void); + /* ssl i/o channel object */ typedef struct { @@ -434,6 +436,7 @@ static int get_pem_password_callback(char *buffer, int max_length, int rwflag, v char *password; size_t length; + /* should not happen but better leave it */ if (pass == NULL) return 0; @@ -447,6 +450,35 @@ static int get_pem_password_callback(char *buffer, int max_length, int rwflag, v return length; } +static int prompt_pem_password_callback(char *buffer, int max_length, int rwflag, void *pem_cert) +{ + char *password, prompt[256]; + size_t length; + + window_console(); + + /* should not happen but better leave it */ + if (pem_cert == NULL) + return 0; + + snprintf(prompt, 256, "Enter Passphrase for %s:", (char *) pem_cert); + password = getpass(prompt); + + if (!password) + return 0; + + length = strlen(password); + + if (length > max_length) + return 0; + + strncpy(buffer, password, length); + irssi_redraw(); + + return length; +} + + static GIOChannel *irssi_ssl_get_iochannel(GIOChannel *handle, int port, SERVER_REC *server) { GIOSSLChannel *chan; @@ -476,8 +508,13 @@ static GIOChannel *irssi_ssl_get_iochannel(GIOChannel *handle, int port, SERVER_ return NULL; } SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2); - SSL_CTX_set_default_passwd_cb(ctx, get_pem_password_callback); - SSL_CTX_set_default_passwd_cb_userdata(ctx, (void *)mypass); + if (mypass) { + SSL_CTX_set_default_passwd_cb(ctx, get_pem_password_callback); + SSL_CTX_set_default_passwd_cb_userdata(ctx, (void *)mypass); + } else if (mycert && *mycert) { + SSL_CTX_set_default_passwd_cb(ctx, prompt_pem_password_callback); + SSL_CTX_set_default_passwd_cb_userdata(ctx, (void *)mycert); + } if (mycert && *mycert) { char *scert = NULL, *spkey = NULL;