Hi Michael, dlg, and ports,
A diff to fix ngircd in -current follows, addressing the latest changes in
pledge_socket[0]. The diff removes a setsockopt(2) call using IPv4-only
IPPROTO_IP on an AF_INET6 socket, and bumps the package.
After today's "sysupgrade -s", ngircd failed to start; logging syscall
105, setsockopt(2), with the "inet" pledge(2) call.
> $ uname -a
> OpenBSD gjain 8.0 GENERIC.MP#14 amd64
>
> $ doas ktrace ngircd -n
> [20372:5 0] ngIRCd
> 27-CHARCONV+IPv6+IRCPLUS+SSL+SYSLOG+ZLIB-x86_64/unknown/openbsd8.0 starting
> ...
> [20372:6 0] Using default configuration file "/etc/ngircd/ngircd.conf" ...
> [20372:4 0] No administrative information configured but required by RFC!
> [20372:6 0] File descriptor limit is 1024; "MaxConnections" is not set.
> [20372:6 0] Running as user _ngircd(703), group _ngircd(703), with PID
> 20372.
> [20372:6 0] Not running with changed root directory.
> [20372:6 0] IO subsystem: kqueue (initial maxfd 100, masterfd 3).
> ngircd[20372]: pledge "inet", syscall 105
> Abort trap
>
> $ doas kdump | tail
> 20372 ngircd RET setsockopt 0
> 20372 ngircd CALL fcntl(6,F_GETFL)
> 20372 ngircd RET fcntl 2
> 20372 ngircd CALL fcntl(6,F_SETFL,0x6<O_RDWR|O_NONBLOCK>)
> 20372 ngircd RET fcntl 0
> 20372 ngircd CALL setsockopt(6,SOL_SOCKET,SO_REUSEADDR,0x6fcb807ec944,4)
> 20372 ngircd RET setsockopt 0
> 20372 ngircd CALL setsockopt(6,0<ip>,3,0x6fcb807ec944,4)
> 20372 ngircd PLDG setsockopt, "inet", errno 1 Operation not permitted
> 20372 ngircd PSIG SIGABRT SIG_DFL
Checking src for recent changes, I stumbled about dlg's commit[0] and
tried to follow allowed and forbidden combinations. A few printf
debugging attempts later, I ended up with the following debug diff,
demonstrating that ngircd calls "setsockopt(..., IPPROTO_IP, IP_TOS,
...)" on an AF_INET6 socket.
> --- src/ngircd/conn.c.orig Fri Sep 4 21:13:41 2026
> +++ src/ngircd/conn.c Fri Sep 4 22:49:47 2026
> @@ -625,6 +625,7 @@
>
> set_v6_only(af, sock);
>
> + Log(LOG_CRIT, "AAAAA: %s - %d", ng_ipaddr_tostr(&addr), af);
> if (!Init_Socket(sock))
> return -1;
>
> @@ -2205,6 +2206,7 @@
>
> /* Set type of service (TOS) */
> #if defined(IPPROTO_IP) && defined(IPTOS_LOWDELAY)
> + Log(LOG_ERR, "AAAAA");
> value = IPTOS_LOWDELAY;
> if (setsockopt(Sock, IPPROTO_IP, IP_TOS, &value,
> (socklen_t) sizeof(value))) {
> @@ -2214,6 +2216,7 @@
> } else
> LogDebug("IP_TOS on socket %d has been set to
> IPTOS_LOWDELAY.",
> Sock);
> + Log(LOG_ERR, "AAAAA over");
> #endif
>
> return true;
> $ ./src/ngircd/ngircd -n
> [44944:5 0] ngIRCd
> 28-CHARCONV+IPv6+IRCPLUS+SSL+SYSLOG+ZLIB-x86_64/unknown/openbsd8.0 starting
> ...
> [44944:6 0] Using default configuration file "/etc/ngircd/ngircd.conf" ...
> [44944:4 0] Can't read default configuration file
> "/etc/ngircd/ngircd.conf": No such file or directory - Ignored.
> [44944:3 0] Can't read MOTD file "/etc/ngircd/ngircd.motd": No such file
> or directory
> [44944:3 0] Can't read help text file
> "/usr/local/share/doc/ngircd/Commands.txt": No such file or directory
> [44944:4 0] No help text available, HELP command will be of limited use.
> [44944:4 0] No server name configured, using host name "gjain.host".
> [44944:4 0] No administrative information configured but required by RFC!
> [44944:6 0] File descriptor limit is 100000; "MaxConnections" is not set.
> [44944:3 0] Can't change group ID to ?(703): Operation not permitted!
> [44944:3 0] Can't drop supplementary group IDs: Operation not permitted!
> [44944:3 0] Can't change user ID to ?(703): Operation not permitted!
> [44944:6 0] Running as user alvar(1000), group alvar(1000), with PID 44944.
> [44944:6 0] Not running with changed root directory.
> [44944:6 0] IO subsystem: kqueue (initial maxfd 100, masterfd 3).
> [44944:2 0] AAAAA: 0:: - 24
> [44944:3 0] AAAAA
> ngircd[44944]: pledge "inet", syscall 105
> Abort trap (core dumped)
Since this should never could have worked, I have removed the call in my diff.
Building an ngircd package with the attached diff allows me to run ngircd
again.
In case all of this has nothing to do with dlg's change, please excuse my
stupidity on a public mailing list.
Best,
Alvar
[0]:
https://github.com/openbsd/src/commit/f2b65ce05bc267cd9c039c0e3cfa2cc70718938d
diff --git Makefile Makefile
index 18929caadd2..099ff908503 100644
--- Makefile
+++ Makefile
@@ -1,6 +1,6 @@
COMMENT = lightweight irc server
-DISTNAME = ngircd-27
+DISTNAME = ngircd-28
CATEGORIES = net
diff --git distinfo distinfo
index f7d160ce0dc..2ab15caa713 100644
--- distinfo
+++ distinfo
@@ -1,2 +1,2 @@
-SHA256 (ngircd-27.tar.gz) = /TjvITOdr4HWr0pjC6Oy3lGhtCwYGEPud2NaWmYf5zw=
-SIZE (ngircd-27.tar.gz) = 554709
+SHA256 (ngircd-28.tar.gz) = 1K5dT18T0Tb3fnqv8s3ID807mhcawxworbri9GQ8BKg=
+SIZE (ngircd-28.tar.gz) = 564580
diff --git patches/patch-src_ngircd_conn_c patches/patch-src_ngircd_conn_c
new file mode 100644
index 00000000000..48782e562a5
--- /dev/null
+++ patches/patch-src_ngircd_conn_c
@@ -0,0 +1,23 @@
+Index: src/ngircd/conn.c
+--- src/ngircd/conn.c.orig
++++ src/ngircd/conn.c
+@@ -2203,19 +2203,6 @@ Init_Socket( int Sock )
+ /* ignore this error */
+ }
+
+- /* Set type of service (TOS) */
+-#if defined(IPPROTO_IP) && defined(IPTOS_LOWDELAY)
+- value = IPTOS_LOWDELAY;
+- if (setsockopt(Sock, IPPROTO_IP, IP_TOS, &value,
+- (socklen_t) sizeof(value))) {
+- LogDebug("Can't set socket option IP_TOS: %s!",
+- strerror(errno));
+- /* ignore this error */
+- } else
+- LogDebug("IP_TOS on socket %d has been set to IPTOS_LOWDELAY.",
+- Sock);
+-#endif
+-
+ return true;
+ } /* Init_Socket */
+
