adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-10-30 17:21:59 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

schat - Cannot chat with self-signed certs. #1099

New Issue
Open
opened 2026-10-05 05:03:09 +02:00 by adam · 2 comments
adam commented 2026-10-05 05:03:09 +02:00
Owner
Copy link
Copy source

Git bisect shows commit 4442af724f - "Validate TLS certificate of IRC server." caused this regression.

How should znc handle this?

znc -D log from commit 4442af724f:

[2026-08-16 03:34:23.215107] TDNS: SCHAT::(s)KindOne_, connecting to [10.10.1.2] using bindhost [10.10.1.2]
[2026-08-16 03:34:23.265110] (KindTwo/EFNet) ZNC -> CLI [:(s)KindOne_!(s)KindOne_@10.10.1.2 PRIVMSG KindTwo :*** Connected.]
[2026-08-16 03:34:23.282111] SCHAT::(s)KindTwo: No cert
[2026-08-16 03:34:23.282111] SCHAT::(s)KindTwo == SockError(Anonymous SSL cert is not allowed, Unknown error 12569)
[2026-08-16 03:34:23.282111] (KindOne/EFnet) ZNC -> CLI [:(s)KindTwo!(s)KindTwo@10.10.1.2 PRIVMSG KindOne_ :*** Connected.]
[2026-08-16 03:34:23.282111] (KindOne/EFnet) ZNC -> CLI [:(s)KindTwo!(s)KindTwo@10.10.1.2 PRIVMSG KindOne_ :*** Disconnected.]
[2026-08-16 03:34:23.293112] SSLVerifyHost: checking 10.10.1.2
[2026-08-16 03:34:23.293112] SSLVerifyHost: Found CN Example
[2026-08-16 03:34:23.293112] SSLVerifyHost: host doesn't match
[2026-08-16 03:34:23.293112] SCHAT::(s)KindOne_: Bad cert
[2026-08-16 03:34:23.293112] SCHAT::(s)KindOne_ == SockError(Invalid SSL certificate: hostname doesn't match, self signed certificate, Unknown error 12569)
[2026-08-16 03:34:23.293112] (KindTwo/EFNet) ZNC -> CLI [:(s)KindOne_!(s)KindOne_@10.10.1.2 PRIVMSG KindTwo :*** Disconnected.]

znc -D log from a commit before "Validate TLS certificate of IRC server." without the issue:

[2026-08-16 03:01:44.758090] (KindOne/EFnet) CLI -> ZNC [PRIVMSG *schat :chat KindTwo]
[2026-08-16 03:01:44.759090] (KindOne/EFnet) ZNC -> IRC [PRIVMSG KindTwo :\x01DCC SCHAT chat 168427778 3109\x01]
[2026-08-16 03:01:44.859096] (KindTwo/EFNet) IRC -> ZNC [:KindOne_!~KindOne@777.777.777.777 PRIVMSG KindTwo :\x01DCC SCHAT chat 168427778 3109\x01]
[2026-08-16 03:01:44.859096] (KindTwo/EFNet) ZNC -> CLI [:(s)KindOne_!(s)KindOne_@10.10.1.2 PRIVMSG KindTwo :*** Incoming DCC SCHAT, Accept ? (yes/no)]
[2026-08-16 03:01:47.550250] (KindTwo/EFNet) CLI -> ZNC [PRIVMSG (s)KindOne_ :yes]
[2026-08-16 03:01:47.550250] TDNS: initiating resolving of [10.10.1.2] and bindhost [10.10.1.2]
[2026-08-16 03:01:47.550250] TDNS: SCHAT::(s)KindOne_, connecting to [10.10.1.2] using bindhost [10.10.1.2]
[2026-08-16 03:01:47.601252] (KindTwo/EFNet) ZNC -> CLI [:(s)KindOne_!(s)KindOne_@10.10.1.2 PRIVMSG KindTwo :*** Connected.]
[2026-08-16 03:01:47.620254] (KindOne/EFnet) ZNC -> CLI [:(s)KindTwo!(s)KindTwo@10.10.1.2 PRIVMSG KindOne_ :*** Connected.]
[2026-08-16 03:01:51.725488] (KindTwo/EFNet) CLI -> ZNC [PRIVMSG (s)KindOne_ :...]
[2026-08-16 03:01:51.725488] (KindOne/EFnet) ZNC -> CLI [:(s)KindTwo!(s)KindTwo@10.10.1.2 PRIVMSG KindOne_ :...]
[2026-08-16 03:02:09.398499] (KindOne/EFnet) CLI -> ZNC [PRIVMSG (s)KindTwo :...]
[2026-08-16 03:02:09.398499] (KindTwo/EFNet) ZNC -> CLI [:(s)KindOne_!(s)KindOne_@10.10.1.2 PRIVMSG KindTwo :...]
Git bisect shows commit 4442af724f061a5b9baf7e80c644f41b027a65a2 - "Validate TLS certificate of IRC server." caused this regression. How should znc handle this? znc -D log from commit 4442af724f061a5b9baf7e80c644f41b027a65a2: ``` [2026-08-16 03:34:23.215107] TDNS: SCHAT::(s)KindOne_, connecting to [10.10.1.2] using bindhost [10.10.1.2] [2026-08-16 03:34:23.265110] (KindTwo/EFNet) ZNC -> CLI [:(s)KindOne_!(s)KindOne_@10.10.1.2 PRIVMSG KindTwo :*** Connected.] [2026-08-16 03:34:23.282111] SCHAT::(s)KindTwo: No cert [2026-08-16 03:34:23.282111] SCHAT::(s)KindTwo == SockError(Anonymous SSL cert is not allowed, Unknown error 12569) [2026-08-16 03:34:23.282111] (KindOne/EFnet) ZNC -> CLI [:(s)KindTwo!(s)KindTwo@10.10.1.2 PRIVMSG KindOne_ :*** Connected.] [2026-08-16 03:34:23.282111] (KindOne/EFnet) ZNC -> CLI [:(s)KindTwo!(s)KindTwo@10.10.1.2 PRIVMSG KindOne_ :*** Disconnected.] [2026-08-16 03:34:23.293112] SSLVerifyHost: checking 10.10.1.2 [2026-08-16 03:34:23.293112] SSLVerifyHost: Found CN Example [2026-08-16 03:34:23.293112] SSLVerifyHost: host doesn't match [2026-08-16 03:34:23.293112] SCHAT::(s)KindOne_: Bad cert [2026-08-16 03:34:23.293112] SCHAT::(s)KindOne_ == SockError(Invalid SSL certificate: hostname doesn't match, self signed certificate, Unknown error 12569) [2026-08-16 03:34:23.293112] (KindTwo/EFNet) ZNC -> CLI [:(s)KindOne_!(s)KindOne_@10.10.1.2 PRIVMSG KindTwo :*** Disconnected.] ``` --- znc -D log from a commit before "Validate TLS certificate of IRC server." without the issue: ``` [2026-08-16 03:01:44.758090] (KindOne/EFnet) CLI -> ZNC [PRIVMSG *schat :chat KindTwo] [2026-08-16 03:01:44.759090] (KindOne/EFnet) ZNC -> IRC [PRIVMSG KindTwo :\x01DCC SCHAT chat 168427778 3109\x01] [2026-08-16 03:01:44.859096] (KindTwo/EFNet) IRC -> ZNC [:KindOne_!~KindOne@777.777.777.777 PRIVMSG KindTwo :\x01DCC SCHAT chat 168427778 3109\x01] [2026-08-16 03:01:44.859096] (KindTwo/EFNet) ZNC -> CLI [:(s)KindOne_!(s)KindOne_@10.10.1.2 PRIVMSG KindTwo :*** Incoming DCC SCHAT, Accept ? (yes/no)] [2026-08-16 03:01:47.550250] (KindTwo/EFNet) CLI -> ZNC [PRIVMSG (s)KindOne_ :yes] [2026-08-16 03:01:47.550250] TDNS: initiating resolving of [10.10.1.2] and bindhost [10.10.1.2] [2026-08-16 03:01:47.550250] TDNS: SCHAT::(s)KindOne_, connecting to [10.10.1.2] using bindhost [10.10.1.2] [2026-08-16 03:01:47.601252] (KindTwo/EFNet) ZNC -> CLI [:(s)KindOne_!(s)KindOne_@10.10.1.2 PRIVMSG KindTwo :*** Connected.] [2026-08-16 03:01:47.620254] (KindOne/EFnet) ZNC -> CLI [:(s)KindTwo!(s)KindTwo@10.10.1.2 PRIVMSG KindOne_ :*** Connected.] [2026-08-16 03:01:51.725488] (KindTwo/EFNet) CLI -> ZNC [PRIVMSG (s)KindOne_ :...] [2026-08-16 03:01:51.725488] (KindOne/EFnet) ZNC -> CLI [:(s)KindTwo!(s)KindTwo@10.10.1.2 PRIVMSG KindOne_ :...] [2026-08-16 03:02:09.398499] (KindOne/EFnet) CLI -> ZNC [PRIVMSG (s)KindTwo :...] [2026-08-16 03:02:09.398499] (KindTwo/EFNet) ZNC -> CLI [:(s)KindOne_!(s)KindOne_@10.10.1.2 PRIVMSG KindTwo :...] ``` <!-- github-sync-id:5167123771 -->
adam commented 2026-10-05 05:03:10 +02:00
Author
Owner
Copy link
Copy source

How should znc handle this?

Good question. Without any certificate check schat is not actually secure. So the correct fingerprint would need to somehow be communicated first, perhaps via IRC, but that would be a protocol change. Another option is to provide that as command line option when accepting the chat and requiring user to somehow know the fingerprint

Either way, as is, the module is now useless. And since noone complained about this since 2014, noone is using it. So I think it can be safely removed

> How should znc handle this? Good question. Without any certificate check schat is not actually secure. So the correct fingerprint would need to somehow be communicated first, perhaps via IRC, but that would be a protocol change. Another option is to provide that as command line option when accepting the chat and requiring user to somehow know the fingerprint Either way, as is, the module is now useless. And since noone complained about this since 2014, noone is using it. So I think it can be safely removed <!-- github-comment-id:5312967902 -->
adam commented 2026-10-05 05:03:11 +02:00
Author
Owner
Copy link
Copy source

well, I suppose one could make a non-self-signed cert for their IP, and use that

well, I suppose one could make a non-self-signed cert for their IP, and use that <!-- github-comment-id:5313014680 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#1099