From: "Alvar Penning" Subject: [update, pledge fix] ngircd: 28 To: "Michael" Cc: , Date: Fri, 04 Sep 2026 23:38:17 +0200 Hi Michael, dlg, and ports, A diff to fix ngircd in -current follows, addressing the latest changes in pledge_socket[0]. The diff removes a setsockopt(2) call using IPv4-only IPPROTO_IP on an AF_INET6 socket, and bumps the package. After today's "sysupgrade -s", ngircd failed to start; logging syscall 105, setsockopt(2), with the "inet" pledge(2) call. > $ uname -a > OpenBSD gjain 8.0 GENERIC.MP#14 amd64 > > $ doas ktrace ngircd -n > [20372:5 0] ngIRCd 27-CHARCONV+IPv6+IRCPLUS+SSL+SYSLOG+ZLIB-x86_64/unknown/openbsd8.0 starting ... > [20372:6 0] Using default configuration file "/etc/ngircd/ngircd.conf" ... > [20372:4 0] No administrative information configured but required by RFC! > [20372:6 0] File descriptor limit is 1024; "MaxConnections" is not set. > [20372:6 0] Running as user _ngircd(703), group _ngircd(703), with PID 20372. > [20372:6 0] Not running with changed root directory. > [20372:6 0] IO subsystem: kqueue (initial maxfd 100, masterfd 3). > ngircd[20372]: pledge "inet", syscall 105 > Abort trap > > $ doas kdump | tail > 20372 ngircd RET setsockopt 0 > 20372 ngircd CALL fcntl(6,F_GETFL) > 20372 ngircd RET fcntl 2 > 20372 ngircd CALL fcntl(6,F_SETFL,0x6) > 20372 ngircd RET fcntl 0 > 20372 ngircd CALL setsockopt(6,SOL_SOCKET,SO_REUSEADDR,0x6fcb807ec944,4) > 20372 ngircd RET setsockopt 0 > 20372 ngircd CALL setsockopt(6,0,3,0x6fcb807ec944,4) > 20372 ngircd PLDG setsockopt, "inet", errno 1 Operation not permitted > 20372 ngircd PSIG SIGABRT SIG_DFL Checking src for recent changes, I stumbled about dlg's commit[0] and tried to follow allowed and forbidden combinations. A few printf debugging attempts later, I ended up with the following debug diff, demonstrating that ngircd calls "setsockopt(..., IPPROTO_IP, IP_TOS, ...)" on an AF_INET6 socket. > --- src/ngircd/conn.c.orig Fri Sep 4 21:13:41 2026 > +++ src/ngircd/conn.c Fri Sep 4 22:49:47 2026 > @@ -625,6 +625,7 @@ > > set_v6_only(af, sock); > > + Log(LOG_CRIT, "AAAAA: %s - %d", ng_ipaddr_tostr(&addr), af); > if (!Init_Socket(sock)) > return -1; > > @@ -2205,6 +2206,7 @@ > > /* Set type of service (TOS) */ > #if defined(IPPROTO_IP) && defined(IPTOS_LOWDELAY) > + Log(LOG_ERR, "AAAAA"); > value = IPTOS_LOWDELAY; > if (setsockopt(Sock, IPPROTO_IP, IP_TOS, &value, > (socklen_t) sizeof(value))) { > @@ -2214,6 +2216,7 @@ > } else > LogDebug("IP_TOS on socket %d has been set to IPTOS_LOWDELAY.", > Sock); > + Log(LOG_ERR, "AAAAA over"); > #endif > > return true; > $ ./src/ngircd/ngircd -n > [44944:5 0] ngIRCd 28-CHARCONV+IPv6+IRCPLUS+SSL+SYSLOG+ZLIB-x86_64/unknown/openbsd8.0 starting ... > [44944:6 0] Using default configuration file "/etc/ngircd/ngircd.conf" ... > [44944:4 0] Can't read default configuration file "/etc/ngircd/ngircd.conf": No such file or directory - Ignored. > [44944:3 0] Can't read MOTD file "/etc/ngircd/ngircd.motd": No such file or directory > [44944:3 0] Can't read help text file "/usr/local/share/doc/ngircd/Commands.txt": No such file or directory > [44944:4 0] No help text available, HELP command will be of limited use. > [44944:4 0] No server name configured, using host name "gjain.host". > [44944:4 0] No administrative information configured but required by RFC! > [44944:6 0] File descriptor limit is 100000; "MaxConnections" is not set. > [44944:3 0] Can't change group ID to ?(703): Operation not permitted! > [44944:3 0] Can't drop supplementary group IDs: Operation not permitted! > [44944:3 0] Can't change user ID to ?(703): Operation not permitted! > [44944:6 0] Running as user alvar(1000), group alvar(1000), with PID 44944. > [44944:6 0] Not running with changed root directory. > [44944:6 0] IO subsystem: kqueue (initial maxfd 100, masterfd 3). > [44944:2 0] AAAAA: 0:: - 24 > [44944:3 0] AAAAA > ngircd[44944]: pledge "inet", syscall 105 > Abort trap (core dumped) Since this should never could have worked, I have removed the call in my diff. Building an ngircd package with the attached diff allows me to run ngircd again. In case all of this has nothing to do with dlg's change, please excuse my stupidity on a public mailing list. Best, Alvar [0]: https://github.com/openbsd/src/commit/f2b65ce05bc267cd9c039c0e3cfa2cc70718938d diff --git Makefile Makefile index 18929caadd2..099ff908503 100644 --- Makefile +++ Makefile @@ -1,6 +1,6 @@ COMMENT = lightweight irc server -DISTNAME = ngircd-27 +DISTNAME = ngircd-28 CATEGORIES = net diff --git distinfo distinfo index f7d160ce0dc..2ab15caa713 100644 --- distinfo +++ distinfo @@ -1,2 +1,2 @@ -SHA256 (ngircd-27.tar.gz) = /TjvITOdr4HWr0pjC6Oy3lGhtCwYGEPud2NaWmYf5zw= -SIZE (ngircd-27.tar.gz) = 554709 +SHA256 (ngircd-28.tar.gz) = 1K5dT18T0Tb3fnqv8s3ID807mhcawxworbri9GQ8BKg= +SIZE (ngircd-28.tar.gz) = 564580 diff --git patches/patch-src_ngircd_conn_c patches/patch-src_ngircd_conn_c new file mode 100644 index 00000000000..48782e562a5 --- /dev/null +++ patches/patch-src_ngircd_conn_c @@ -0,0 +1,23 @@ +Index: src/ngircd/conn.c +--- src/ngircd/conn.c.orig ++++ src/ngircd/conn.c +@@ -2203,19 +2203,6 @@ Init_Socket( int Sock ) + /* ignore this error */ + } + +- /* Set type of service (TOS) */ +-#if defined(IPPROTO_IP) && defined(IPTOS_LOWDELAY) +- value = IPTOS_LOWDELAY; +- if (setsockopt(Sock, IPPROTO_IP, IP_TOS, &value, +- (socklen_t) sizeof(value))) { +- LogDebug("Can't set socket option IP_TOS: %s!", +- strerror(errno)); +- /* ignore this error */ +- } else +- LogDebug("IP_TOS on socket %d has been set to IPTOS_LOWDELAY.", +- Sock); +-#endif +- + return true; + } /* Init_Socket */ +