[Linuxdcpp-team] [Bug 1419478] Re: Mitigating classic NMDC CTM DOS attacks

2015-03-22 Thread Gabberworld
UserConnection.cpp } else if(aLine[0] == '<') { fire(UserConnectionListener::ProtocolError(), this, _("CTM2HUB")); return; } else if(!isSet(FLAG_NMDC)) { fire(UserConnectionListener::ProtocolError(), this, _("Invalid data"));

[Linuxdcpp-team] [Bug 1419478] Re: Mitigating classic NMDC CTM DOS attacks

2015-03-22 Thread Gabberworld
for line 69 -- You received this bug notification because you are a member of Dcplusplus-team, which is subscribed to DC++. https://bugs.launchpad.net/bugs/1419478 Title: Mitigating classic NMDC CTM DOS attacks Status in DC++: Fix Committed Bug description: Proposal and discussion log fr

[Linuxdcpp-team] [Bug 1419478] Re: Mitigating classic NMDC CTM DOS attacks

2015-03-22 Thread poy
yeah good catch; fixed. in lack of a more evolved solution, the log messages will have to do for now. -- You received this bug notification because you are a member of Dcplusplus-team, which is subscribed to DC++. https://bugs.launchpad.net/bugs/1419478 Title: Mitigating classic NMDC CTM DOS a

[Linuxdcpp-team] [Bug 1419478] Re: Mitigating classic NMDC CTM DOS attacks

2015-03-22 Thread Gabberworld
if (aError.compare(0, 7, "CTM2HUB") == 0) maybe you should use something like that ? -- You received this bug notification because you are a member of Dcplusplus-team, which is subscribed to DC++. https://bugs.launchpad.net/bugs/1419478 Title: Mitigating classic NMDC CTM DOS attacks Status i

[Linuxdcpp-team] [Branch ~dcplusplus-team/dcplusplus/trunk] Rev 3404: Update translation templates

2015-03-22 Thread noreply
revno: 3404 committer: poy branch nick: repo-bzr timestamp: Sun 2015-03-22 20:41:53 +0100 message: Update translation templates modified: dcpp/po/libdcpp.pot help/po/dcpp-help.pot installer/po/dcpp-installer.pot win32/po/dcpp-w

[Linuxdcpp-team] [Bug 1419478] Re: Mitigating classic NMDC CTM DOS attacks

2015-03-22 Thread Gabberworld
one thing i dont like is the +if(cc_blocked) + { + LogManager::getInstance()->message(str(F_("Blocked a C-C connection to a hub ('%1%:%2%'; request from '%3%')") % aServer % aPort % aHubUrl)); + return true; + } is there possible add that it not show

[Linuxdcpp-team] [Bug 1419478] Re: Mitigating classic NMDC CTM DOS attacks

2015-03-22 Thread Gabberworld
yeah, tested that code and it actualy works for webpages too if (aError.compare(0, 7, "CTM2HUB", 7 == 0)) <-- 7 == 0 i think because of that it works for webpages too weird -- You received this bug notification because you are a member of Dcplusplus-team, which is subscribed to DC++. https://

[Linuxdcpp-team] [Bug 1425276] Re: The Unicode mirror character and possibly other similar ones can be used for nick spoofing in ADC hubs

2015-03-22 Thread poy
related: bug 1390988. -- You received this bug notification because you are a member of Dcplusplus-team, which is subscribed to DC++. https://bugs.launchpad.net/bugs/1425276 Title: The Unicode mirror character and possibly other similar ones can be used for nick spoofing in ADC hubs Status

[Linuxdcpp-team] [Bug 1425276] Re: The Unicode mirror character and possibly other similar ones can be used for nick spoofing in ADC hubs

2015-03-22 Thread poy
I think it should be decided at a protocol level how to handle these; otherwise, programs would transmit information they have changed in ways they thought were correct but based on their own rules, which may differ from one program to the other. Eg when browsing a file list, should DC++ transmit

[Linuxdcpp-team] [Bug 1419478] Re: Mitigating classic NMDC CTM DOS attacks

2015-03-22 Thread poy
thanks; renamed some variables to be more protocol-agnostic (in preparation of tackling bug 1435038) and applied in rev 552709a7d491. not tested! ** Changed in: dcplusplus Status: Confirmed => Fix Committed -- You received this bug notification because you are a member of Dcplusplus-team

[Linuxdcpp-team] [Bug 1435038] [NEW] Implement hub C-C blocking for ADC

2015-03-22 Thread poy
Public bug reported: In NMDC, hubs wishing to block C-C can send a "CTM2HUB"; DC++ will block any further C-C connection to these hubs. Think about doing it for ADC too, while keeping in mind C-C connections to hubs can make sense in ADC (eg to transfer bloom information). See bug 1419478 for de

[Linuxdcpp-team] [Bug 1419478] Re: Mitigating classic NMDC CTM DOS attacks

2015-03-22 Thread poy
** Information type changed from Public to Public Security -- You received this bug notification because you are a member of Dcplusplus-team, which is subscribed to DC++. https://bugs.launchpad.net/bugs/1419478 Title: Mitigating classic NMDC CTM DOS attacks Status in DC++: Confirmed Bug de

[Linuxdcpp-team] [Bug 1419454] Re: Error in processing NMDC search requests allows DC++ to be used for UDP DDOS attacks

2015-03-22 Thread poy
nice! adapted a bit (made the parsing func static, in particular) and pushed rev 0bf6563f200c. please test; i have only verified it doesn't crash but we have to make sure the flaw exposed here has actually been fixed. ** Changed in: dcplusplus Status: Confirmed => Fix Committed -- You rec

[Linuxdcpp-team] [Bug 1419454] Re: Error in processing NMDC search requests allows DC++ to be used for UDP DDOS attacks

2015-03-22 Thread poy
** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Dcplusplus-team, which is subscribed to DC++. https://bugs.launchpad.net/bugs/1419454 Title: Error in processing NMDC search requests allows DC++ to be used fo

[Linuxdcpp-team] [Bug 1419454] Re: Error in processing NMDC search requests allows DC++ to be used for UDP DDOS attacks

2015-03-22 Thread iceman50
last patch had logging remnants. ** Patch added: "patch.diff" https://bugs.launchpad.net/dcplusplus/+bug/1419454/+attachment/4352210/+files/patch.diff ** Patch removed: "patch.diff" https://bugs.launchpad.net/dcplusplus/+bug/1419454/+attachment/4352193/+files/patch.diff -- You received

[Linuxdcpp-team] [Bug 1419454] Re: Error in processing NMDC search requests allows DC++ to be used for UDP DDOS attacks

2015-03-22 Thread iceman50
Updated diff ** Patch added: "patch.diff" https://bugs.launchpad.net/dcplusplus/+bug/1419454/+attachment/4352193/+files/patch.diff -- You received this bug notification because you are a member of Dcplusplus-team, which is subscribed to DC++. https://bugs.launchpad.net/bugs/1419454 Title:

[Linuxdcpp-team] [Bug 1435007] [NEW] The "/clear" command scrolls back to the top

2015-03-22 Thread poy
Public bug reported: in the DC++ chat, executing the "/clear" command while telling it to keep more lines shown than can be displayed in a single page of the chat control (eg "/clear 100") scrolls back to the top. it should scroll to the end if the chat was already scrolled to the end before runni

[Linuxdcpp-team] [Bug 1434997] [NEW] Switch the regex impl from boost to libstdc++

2015-03-22 Thread poy
Public bug reported: now that libstdc++ fully implements regex, stop using boost and switch to it. differences in the syntax have however been noted, so think about: - providing boost regex features when using the libstdc++ impl; - migration (either automatic or documented); - performance evaluat

[Linuxdcpp-team] [Bug 1414362] Re: Regex defined for ADL Search does not work with v0.850

2015-03-22 Thread poy
reverting back to boost regex; i am opening a new bug thread to look into doing this transition better in the future. ** Changed in: dcplusplus Status: New => Fix Committed -- You received this bug notification because you are a member of Dcplusplus-team, which is subscribed to DC++. http