From: Michael Poole <mdpoole@troilus.org>
Date: Thu, 3 Aug 2006 03:05:02 +0000 (+0000)
Subject: Report two kinds of configuration file bugs.
X-Git-Url: http://git.pk910.de/?p=ircu2.10.12-pk.git;a=commitdiff_plain;h=7dd3942661f64726fb4fbf6c3c1739f92a50fe56

Report two kinds of configuration file bugs.


git-svn-id: file:///home/klmitch/undernet-ircu/undernet-ircu-svn/ircu2/branches/u2_10_12_branch@1720 c9e4aea6-c8fd-4c43-8297-357d70d61c8c
---

diff --git a/ChangeLog b/ChangeLog
index 0f9a52d..36223cf 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2006-08-02  Michael Poole <mdpoole@troilus.org>
+
+	* ircd/ircd_parser.y (connectblock): Check for too-long password.
+	(operblock): Comment why we don't check password length.  Move
+	PRIV_PROPAGATE test earlier (so a buggy edit, rehash, /oper will
+	not crash).
+	(clientblock): Check for too-long password.
+
 2006-08-02  Michael Poole <mdpoole@troilus.org>
 
 	* include/channel.h (struct Ban): Fix typo in doxygen comment.
diff --git a/ircd/ircd_parser.y b/ircd/ircd_parser.y
index 261f1d5..4f47c95 100644
--- a/ircd/ircd_parser.y
+++ b/ircd/ircd_parser.y
@@ -420,6 +420,8 @@ connectblock: CONNECT
   parse_error("Missing name in connect block");
  else if (pass == NULL)
   parse_error("Missing password in connect block");
+ else if (strlen(pass) > PASSWDLEN)
+  parse_error("Password too long in connect block");
  else if (host == NULL)
   parse_error("Missing host in connect block");
  else if (strchr(host, '*') || strchr(host, '?'))
@@ -521,10 +523,14 @@ operblock: OPER '{' operitems '}' ';'
     parse_error("Missing name in operator block");
   else if (pass == NULL)
     parse_error("Missing password in operator block");
+  /* Do not check password length because it may be crypted. */
   else if (host == NULL)
     parse_error("Missing host in operator block");
   else if (c_class == NULL)
     parse_error("Invalid or missing class in operator block");
+  else if (!FlagHas(&privs_dirty, PRIV_PROPAGATE)
+           && !FlagHas(&c_class->privs_dirty, PRIV_PROPAGATE))
+    parse_error("Operator block for %s and class %s have no LOCAL setting", name, c_class->cc_name);
   else {
     aconf = make_conf(CONF_OPERATOR);
     aconf->name = name;
@@ -533,9 +539,6 @@ operblock: OPER '{' operitems '}' ';'
     aconf->conn_class = c_class;
     memcpy(&aconf->privs, &privs, sizeof(aconf->privs));
     memcpy(&aconf->privs_dirty, &privs_dirty, sizeof(aconf->privs_dirty));
-    if (!FlagHas(&privs_dirty, PRIV_PROPAGATE)
-        && !FlagHas(&c_class->privs_dirty, PRIV_PROPAGATE))
-      parse_error("Operator block for %s and class %s have no LOCAL setting", name, c_class->cc_name);
   }
   if (!aconf) {
     MyFree(name);
@@ -685,6 +688,8 @@ clientblock: CLIENT
 
   if (!c_class)
     parse_error("Invalid or missing class in Client block");
+  else if (pass && strlen(pass) > PASSWDLEN)
+    parse_error("Password too long in connect block");
   else if (ip && !ipmask_parse(ip, &addr, &addrbits))
     parse_error("Invalid IP address %s in Client block", ip);
   else {