Merge branch 'streaming-userfile-aggressiveness' into next

* streaming-userfile-aggressiveness:
  Fix non-hubs being able to update other bots
  Only accept share lines from the bot sending the userfile
  Fix leaf bots being able to initiate userfile transfer to hubs

Conflicts:
	doc/UPDATES

doc/UPDATES

@@ -5,6 +5,8 @@ next
   * Bots linking in must now have a matching host on their user to succeed linking.
     This was always requiring a valid host, but was not restricted to that bot.
   * Fix backwards compatibility with older 1.2/1.3 bots
+  * Fix leaf bots being able to initiate userfile transfer to hubs
+  * Protect binary updates so that only hubs can offer/send them
 
 maint
   * Default 'set promisc' to ignore since it's usually a false positive

src/mod/share.mod/share.c

@@ -952,7 +952,7 @@ share_userfileq(int idx, char *par)
   flush_tbuf(dcc[idx].nick);
 
   if (bot_aggressive_to(dcc[idx].user)) {
-    putlog(LOG_ERRORS, "*", "%s offered user transfer - I'm supposed to be aggressive to it", dcc[idx].nick);
+    putlog(LOG_ERRORS, "*", "%s offered user transfer - I'm supposed to be aggressive to it [likely a hack]", dcc[idx].nick);
     dprintf(idx, "s un I have you marked for Agressive sharing.\n");
     botunlink(-2, dcc[idx].nick, "I'm aggressive to you");
   } else {
@@ -1100,13 +1100,22 @@ share_end(int idx, char *par)
 }
 
 static void share_userfile_line(int idx, char *par) {
-  char *size = newsplit(&par);
+  if (stream_in && (dcc[idx].status & STAT_GETTING)) {
+    char *size = newsplit(&par);
 
-  (*stream_in) << bd::String(par, atoi(size));
-  (*stream_in) << '\n';
+    (*stream_in) << bd::String(par, atoi(size));
+    (*stream_in) << '\n';
+  }
 }
 
 static void share_userfile_start(int idx, char *par) {
+  if (bot_aggressive_to(dcc[idx].user)) {
+    putlog(LOG_ERRORS, "*", "%s attempted to initiate user transfer - I'm supposed to be aggressive to it [likely a hack]", dcc[idx].nick);
+    dprintf(idx, "s un I have you marked for Agressive sharing.\n");
+    botunlink(-2, dcc[idx].nick, "I'm aggressive to you");
+    return;
+  }
+
   dcc[idx].status |= STAT_GETTING;
   /* Start up a tbuf to queue outgoing changes for this bot until the
    * userlist is done transferring.
@@ -1116,6 +1125,13 @@ static void share_userfile_start(int idx, char *par) {
 }
 
 static void share_userfile_end(int idx, char *par) {
+  if (bot_aggressive_to(dcc[idx].user)) {
+    putlog(LOG_ERRORS, "*", "%s attempted to end user transfer - I'm supposed to be aggressive to it [likely a hack]", dcc[idx].nick);
+    dprintf(idx, "s un I have you marked for Agressive sharing.\n");
+    botunlink(-2, dcc[idx].nick, "I'm aggressive to you");
+    return;
+  }
+
   stream_in->seek(0, SEEK_SET);
   share_read_stream(idx, *stream_in);
   delete stream_in;
@@ -1291,6 +1307,13 @@ finish_share(int idx)
   if (j == -1)
     return;
 
+  if (bot_aggressive_to(dcc[idx].user)) {
+    putlog(LOG_ERRORS, "*", "%s attempted to end user transfer [compat] - I'm supposed to be aggressive to it [likely a hack]", dcc[idx].nick);
+    dprintf(idx, "s un I have you marked for Agressive sharing.\n");
+    botunlink(-2, dcc[idx].nick, "I'm aggressive to you");
+    return;
+  }
+
   const char salt1[] = SALT1;
   EncryptedStream stream(salt1);
   stream.loadFile(dcc[idx].u.xfer->filename);

src/mod/update.mod/update.c

@@ -25,6 +25,7 @@
 
 
 #include "src/common.h"
+#include "src/chanprog.h"
 #include "src/users.h"
 #include "src/dcc.h"
 #include "src/botnet.h"
@@ -164,12 +165,24 @@ static void update_stream_line(int idx, char *par) {
 }
 
 static void update_stream_start(int idx, char *par) {
+  if (!dcc[idx].hub) {
+    putlog(LOG_ERRORS, "*", "%s attempted to initiate binary transfer - they are not a hub [likely a hack]", dcc[idx].nick);
+    dprintf(idx, "s un You are not allowed to send me binaries.\n");
+    botunlink(-2, dcc[idx].nick, "You are not allowed to send me binaries.");
+    return;
+  }
   putlog(LOG_BOTS, "*", "Downloading updated binary from %s", dcc[idx].nick);
   dcc[idx].status |= STAT_GETTINGU;
   stream_in.clear();
 }
 
 static void update_stream_end(int idx, char *par) {
+  if (!dcc[idx].hub) {
+    putlog(LOG_ERRORS, "*", "%s attempted to end binary transfer - they are not a hub [likely a hack]", dcc[idx].nick);
+    dprintf(idx, "s un You are not allowed to send me binaries.\n");
+    botunlink(-2, dcc[idx].nick, "You are not allowed to send me binaries.");
+    return;
+  }
   stream_in.seek(0, SEEK_SET);
   finish_update_stream(idx, stream_in);
 }
@@ -191,6 +204,12 @@ static void got_nu(char *botnick, char *code, char *par)
 {
   if (!par || !*par || updated) 
     return;
+
+  if (!is_hub(botnick)) {
+    putlog(LOG_ERRORS, "*", "%s offered binary transfer - they are not a hub [likely a hack]", botnick);
+    return;
+  }
+
   if (!conf.bot->hub) {
     if (!conf.bot->localhub)
       return;
@@ -269,6 +288,13 @@ ulsend(int idx, const char* data, size_t datalen)
 }
 
 void finish_update(int idx) {
+  if (!dcc[idx].hub) {
+    putlog(LOG_ERRORS, "*", "%s attemped to finish binary transfer - they are not a hub [likely a hack]", dcc[idx].nick);
+    dprintf(idx, "s un You are not allowed to send me binaries.\n");
+    botunlink(-2, dcc[idx].nick, "You are not allowed to send me binaries.");
+    return;
+  }
+
   bd::Stream stream;
   stream.loadFile(dcc[idx].u.xfer->filename);
   unlink(dcc[idx].u.xfer->filename);