I set about trying to bulletproof the subscription process and I've ended
up rewriting large parts of do_subscribe and adding a bunch of checks to
valid_addr. I also cleaned up and expanded some of the informative
messages that get sent.
I'm not at all confident that this is in a working state, but I'd
appreciate it if you could bounce some nasty addresses off of
majordomo@hpc.uh.edu. (Yes, I'm brave/stupid enough to run this.) Try to
subscribe to test-list and check the validity of the messages returned when
you give bad addresses or a bad auth key.
But please, if you notice it breaking, don't push it. I won't get a chance
to even look at the machine until 4PM.
Also, please comment on whether or not an attempt to subscribe an
already-subscribed address to a +confirm list should immediately note the
duplicate or wait until the auth key is returned to make note of it
(current behavior). I like the former, but I identified one tiny security
niggle. (It's very, very tiny.)
--
Jason L. Tibbitts III - tibbs@uh.edu - 713/743-8684 - 221SR1
System Manager: University of Houston High Performance Computing Center
1994 PC800 "Kuroneko" DoD# 1723
|
|
