Skip to content
Snippets Groups Projects
  1. Apr 17, 2023
  2. Apr 16, 2023
  3. Apr 15, 2023
    • Rob Swindell's avatar
      More changes · 1e5186d6
      Rob Swindell authored
      1e5186d6
    • Rob Swindell's avatar
      Add option to delete bad incoming packets (not rename them) · 7914da93
      Rob Swindell authored
      So a sysop now has 3 choices for SBBSecho's handling of incoming bad packets:
       - delete them
       - rename them *.bad
       - rename them *.reason.bad (the default)
      
      If SBBSecho is configured to rename bad packets, but the rename fails, the
      error is logged (as before) but the packet is not deleted (this is a change
      from previous behavior).
      
      Always log the *reason* a pkt was determined bad in the "Bad packet detected"
      log message.
      7914da93
    • Rob Swindell's avatar
      By default SBBSecho will now include the 'reason' in bad packet filenames · 9a253736
      Rob Swindell authored
      When bad packets are detected and renamed to ".bad" files, include the reason
      in the new filename (e.g. "ff69453a.src-addr.bad" or "ff69453a.pkt-passwd.bad"
      instead of just "ff69453a.bad") to make it easier for a sysop to determine
      what to do with the bad packets without having to search through log files
      to discover the reason *why* SBBSecho considered the packet to be bad.
      This behavior can be disabled if desired by setting EchoCfg->Global->Verbose
      Bad Packet Names to "No". Note: the reason used is the *last* reason
      detected/logged for a packet to be considered bad; it's possible that there
      are multiple reasons that a packet may be considered bad. All reasons will be
      logged, but only the last reason is used in the new bad packet filename.
      
      Also added the missing "Delete Packets" option (to EchoCfg->Global). Though
      this setting was added in sbbsecho v3.0 (and settable via sbbsecho.ini), it
      was never exposed via EchoCfg; I don't think that was intentional. Normally,
      you'd always want to leave this set to Yes (the default) to delete processed
      packets, but when debugging, it may be desirable to leave the packet files
      in place. This what the old sbbbsecho v2 '-x' command-line option used to be
      used for (disable the deleting of processed packets).
      
      Moved the Global Settings, EchoMail Settings, and File Paths config menus to
      the upper left of the screen in EchoCfg. The placement seemed inconsistent
      and erratic, so this is a bit of a cosmetic improvement.
      9a253736
    • Rob Swindell's avatar
      Differentiate between type 2+ (FSC-48) and 2e (FSC-39) packets · 50754bf5
      Rob Swindell authored
      Using the same logic that SBBSecho uses to decide if a packet header is in
      fact 2+ (the auxNet field must be non-zero), otherwise, type reported is 2e.
      50754bf5
    • Rob Swindell's avatar
      Address a couple of Coverity-reported defects · 4f9a8b20
      Rob Swindell authored
      CID 452331
      CID 452330
      4f9a8b20
  4. Apr 14, 2023
    • Rob Swindell's avatar
      Add -A (capital a) option to enable alternate/ASCII arrow symbol mode · b3c63244
      Rob Swindell authored
      The CP437 character characters used for the arrow indicators aren't always
      mapped to the expected characters in all fonts (e.g. on Windows), so add an
      option to use ASCII alternatives (<>^v) when that's a problem.
      b3c63244
    • Rob Swindell's avatar
      Break with legacy command-line syntax (e.g. don't support /options) for SCFG · f881f667
      Rob Swindell authored
      Command-line options must begin with '-' (not ye olde CPM/DOS '/option')
      Command-line options are now all case sensitive (e.g. '-a' not '-A').
      
      Remove '-d' (long deprecated for '-id')
      Remove '-t' (long deprecated, do nothing)
      f881f667
    • Rob Swindell's avatar
      Use more appropriate typed-integer ini file get/set functions · 89f12cc2
      Rob Swindell authored
      I noticed when setting a security level's lines per message value > 32767
      in SCFG->System->Security Level Values, the value would be read back as 1 or
      or some other crazy value. That was because we were writing this value
      (and all the security level 16-bit values) using iniSetShortInt(). These are
      *unsigned* 16-bit values, so that we should have been using iniSetUShortInt().
      We'll just use iniSetUInteger() instead to fix that/those issues.
      
      And since promotion/conversion from uint16_t or uint32_t to uint has no impact
      when creating a decimal representation of a number, just use iniSetUInteger()
      everywhere we're setting unsigned integer settings in the main config .ini
      files. If/when these fields are made larger in the future, this code will just
      work.
      
      When reading .ini integers, use the more appropriate iniGet[U]Int16 functions
      instead of iniGet[U]Short and use iniGetUInteger for reading enums or any
      values that are immediately typecast to a uchar/uint8_t.
      
      Replaced some other use of [u]short that I found when searching with stdint.h
      types.
      89f12cc2
    • Rob Swindell's avatar
      84527be0
    • Rob Swindell's avatar
      Pass max_lines to editfile() and msgeditor() functions · 1a2011ec
      Rob Swindell authored
      Rather than recomputing (possibly differently) the max lines in multiple
      places.
      
      This also enables the possibility that editfile() could be used to edit files
      of > 10K lines in the future. <shrug>
      1a2011ec
    • Rob Swindell's avatar
      Clamp the security level lines per message value between 1 and 65535 · 0ecf245c
      Rob Swindell authored
      If a user's security level lines per message was set to '0', bad things would
      happen to the heap if the user posted/sent a message. '1' is a reasonable
      minimum value. If you don't want a user/group of users to send/post messages,
      there are restrictions for achieving that. Also this setting is (currently,
      at least) 16-bit, so clamp it there too on the high end.
      
      Also clamp the expire-to security level setting between 0 and 99, while we're
      here and noticed that this value wasn't being sanitized either.
      0ecf245c
  5. Apr 13, 2023
    • Rob Swindell's avatar
      When writing messages with a 'top' in raw-input-mode, don't add excessive CRLF · 2d9f8a32
      Rob Swindell authored
      If the top already ends in a blank line, no additional CRLF is warranted
      (between the 'top' and the raw-input message 'body').
      2d9f8a32
    • Rob Swindell's avatar
      Bounds-check the buffer being written in msgeditor() · ff386400
      Rob Swindell authored
      Replace the suspicious strcpy/strcat's in msgeditor(), the built-in line
      editor, with bounds-enforced snprintf() calls.
      Also, properly define MAX_LINE_LEN to account for the trailing \r\n on each
      line. It appears we've been under allocating the total possible message buffer
      size (by 2 bytes per line) for a while now.
      These 2 changes together should fix issue #547: apparent heap corruption due
      to 'buf' overflow in msgeditor().
      Also added a line count check/cap-enforcement with logged error message if
      exceeded (should never happen).
      
      Also fixed in this commit: off-by-one when enforcing max message length in
      msgeditor().
      
      Also added checks that the 'cols' (used in MAX_LINE_LEN) are reasonable values
      (40+), 2 was below the threshold of what would be expected to work since
      there is logic that deducts 4 from cols, for example.
      ff386400
    • Rob Swindell's avatar
      Fix false "SUSPECTED BOUNCE ATTACK ATTEMPT" for IPv6 FTP-data connections · 3e2c3176
      Rob Swindell authored
      This bug only impacted non-passive FTP connections. Using an FTP client
      with active (not passive) data connections over an IPv6 connection would
      false-trigger the "bounce attack" detection and the FTP server responded with
      "504 Bad port number" and logged a hack attempt in data/hack.log.
      
      The issue was that we were comparing the socket address structure (which
      contains other fields besides the address itself) between the control and
      proposed-data connections. While this logic worked okay for IPv4,
      it did not for IPv6 (the 2 structs contained some non-address differences).
      Rather than modify the socket address structures to match where needed, I'm
      just comparing the string representation of the addresses, since that's
      what we really care about anyway.
      
      Thank to "mark i" of Truck Stop BBS for alerting me to this issue
      3e2c3176
    • Deucе's avatar
      Allow overriding MIN_MAC_OSX_VERSION · 218a0ca5
      Deucе authored
      218a0ca5
    • Rob Swindell's avatar
      Make the '?' key pull up the online help too · a59d7d36
      Rob Swindell authored
      Sometimes F1 doesn't work, Ctrl-Z isn't documented, but there is a '?' displayed
      when help is available, so it's reasonable to assume someone might try/use it.
      a59d7d36
    • Rob Swindell's avatar
  6. Apr 11, 2023
  7. Apr 10, 2023
  8. Apr 09, 2023
    • Rob Swindell's avatar
    • Rob Swindell's avatar
      Fix typos · 773c986f
      Rob Swindell authored
      773c986f
    • Rob Swindell's avatar
      If XTRN.DAT can't be opened, try lowercase xtrn.dat · fc7d5cbc
      Rob Swindell authored
      This lowercase's the entire path.
      
      Fixes issue #543
      fc7d5cbc
    • Rob Swindell's avatar
      Fix 20+ year old bug that allowed getstr(... K_WRAP) to overflow wordwrap buf · 131f9d7c
      Rob Swindell authored
      The sbbs_t::wordwrap[] buffer was 81 characters (80 printable characters, plus
      NUL terminator) and sbbs_t.getstr(), when used with the K_WRAP mode flag could
      potentially write more than 81 characters to this buffer (e.g. when using a
      wider than 80 column terminal and writing a message with the internal line
      editor which calls sbbs_t::getstr(... K_WRAP)) - would corrupt sbbs_t members
      after wordwrap[], which included pointers that would be freed in the sbbs_t
      destructor (~sbbs_t) and subsequently page/segfault as seen in issue #545.
      
      This change increases the wordwrap buffer to likely twice the same needed
      (maximum columns + NUL terminator) and adds wordwrap bounds checking to
      sbbs_t::getstr().
      
      There were comments indicating crash sightings in the sbsb_t destructor going
      back to 2002, so this commit removes those comments.
      
      Thanks to Nelgin for providing the gdb dump details ('print *this') that was
      the clue needed to reach the root-cause determination.
      
      This fixes issue #545.
      131f9d7c
  9. Apr 08, 2023
  10. Apr 07, 2023
Loading