mammon.ext.ircv3.sasl: Allow 400-length continuation lines #89
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| cli.sasl_tmp = '' | ||
| cli.sasl_tmp += raw_data | ||
| # allow 4 'continuation' lines before rejecting for length | ||
| if len(cli.sasl_tmp) > 400 * 4: |
There was a problem hiding this comment.
Could you make this configurable?
There was a problem hiding this comment.
Could if we really wanted to, but I don't think users can REG a passphrase
long enough to overrun this right now. (Though, given we accept 2048 rather
than 512... might do it actually. Don't think I took that into account)
Once we have other mechanisms than PLAIN, might be good to allow larger
values too.
On Saturday, January 30, 2016, Valentin Lorentz notifications@github.com
wrote:
In mammon/ext/ircv3/sasl.py
#89 (comment):cli.dump_numeric('905', ['SASL message too long']) cli.sasl = None
cli.sasl_tmp = ''returnelif len(raw_data) == 400:if not hasattr(cli, 'sasl_tmp'):cli.sasl_tmp = ''cli.sasl_tmp += raw_data# allow 4 'continuation' lines before rejecting for lengthif len(cli.sasl_tmp) > 400 \* 4:Could you make this configurable?
—
Reply to this email directly or view it on GitHub
https://github.com/mammon-ircd/mammon/pull/89/files#r51342828.
|
👍 |
kaniini
added a commit
that referenced
this pull request
Jan 30, 2016
mammon.ext.ircv3.sasl: Allow 400-length continuation lines
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This lets the
AUTHENTICATEcommand accept the 400-length continuation lines. This allows four 400-length lines and one more line (either just a+or the rest of the password).If they send more 400-length lines after those first four, it will reject it for length. We can change that without too much trouble, but it's probably good to limit it to stop it from just endlessly growing.
Fixes #87 and #70.
Also threw in a small fix in
m_sasl_plainto dump904when they send an invalid line.