From fa5c9039a2ca5f67fd8b9ee2d9ee587ee3f61217 Mon Sep 17 00:00:00 2001
From: Bram Matthys <syzop@vulnscan.org>
Date: Thu, 2 Sep 2021 15:51:11 +0200
Subject: [PATCH] Put the same extban rule checks in extban_is_ok_nuh_extban()
 as they already were in extban_conv_param_nuh_or_extban(). The recursion
 check was already there, but not the "rule 2 violation" if ((extban->options
 & EXTBOPT_ACTMODIFIER) || (extban->options & EXTBOPT_NOSTACKCHILD))

This also backs out the temporary fix 5df1b1b889eb6403463f426b06db85d122e01703.
---
 src/api-extban.c             | 18 ++++++++++++++++--
 src/modules/chanmodes/link.c | 10 +---------
 2 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/src/api-extban.c b/src/api-extban.c
index 3e0b66f02..9e013daa2 100644
--- a/src/api-extban.c
+++ b/src/api-extban.c
@@ -188,8 +188,15 @@ int extban_is_ok_nuh_extban(BanContext *b)
 		char *nextbanstr;
 		Extban *extban = NULL;
 
+		/* We're dealing with a stacked extended ban.
+		 * Rules:
+		 * 1) You can only stack once, so: ~x:~y:something and not ~x:~y:~z...
+		 * 2) The second item may never be an action modifier, nor have the
+		 *    EXTBOPT_NOSTACKCHILD letter set (for things like a textban).
+		 */
+
 		if (extban_is_ok_recursion)
-			return 0; /* Fail: more than one stacked extban */
+			return 0; /* Rule #1 violation (more than one stacked extban) */
 
 		if ((b->is_ok_checktype == EXBCHK_PARAM) && RESTRICT_EXTENDEDBANS && !ValidatePermissionsForPath("immune:restrict-extendedbans",b->client,NULL,b->channel,NULL))
 		{
@@ -211,6 +218,13 @@ int extban_is_ok_nuh_extban(BanContext *b)
 			}
 			return 0; /* Don't add unknown extbans. */
 		}
+
+		if ((extban->options & EXTBOPT_ACTMODIFIER) || (extban->options & EXTBOPT_NOSTACKCHILD))
+		{
+			/* Rule #2 violation */
+			return 0;
+		}
+
 		/* Now we have to ask the stacked extban if it's ok. */
 		if (extban->is_ok)
 		{
@@ -306,7 +320,7 @@ char *extban_conv_param_nuh_or_extban(BanContext *b, Extban *self_extban)
 
 	if ((extban->options & EXTBOPT_ACTMODIFIER) || (extban->options & EXTBOPT_NOSTACKCHILD))
 	{
-		/* Rule #3 violation */
+		/* Rule #2 violation */
 		return NULL;
 	}
 
diff --git a/src/modules/chanmodes/link.c b/src/modules/chanmodes/link.c
index 23b31a31d..81bf8798d 100644
--- a/src/modules/chanmodes/link.c
+++ b/src/modules/chanmodes/link.c
@@ -226,15 +226,11 @@ int extban_link_is_ok(BanContext *b)
 	static char paramtmp[MAX_EB_LEN + 1];
 	char *matchby; // Matching method, such as 'n!u@h'
 	char *chan;
-	static int recurse = 0; /* prevent recursive calls - FIXME do it on higher level */
 
 	// Always permit deletion
 	if (b->what == MODE_DEL)
 		return 1;
 
-	if (recurse)
-		return 1;
-
 	if (b->what2 != EXBTYPE_BAN)
 	{
 		if (b->is_ok_checktype == EXBCHK_PARAM)
@@ -253,11 +249,7 @@ int extban_link_is_ok(BanContext *b)
 		return extban_link_syntax(b->client, b->is_ok_checktype, "Invalid channel");
 
 	b->banstr = matchby;
-
-	recurse = 1;
-	int isok = extban_is_ok_nuh_extban(b);
-	recurse = 0;
-	if (isok == 0)
+	if (extban_is_ok_nuh_extban(b) == 0)
 		return extban_link_syntax(b->client, b->is_ok_checktype, "Invalid matcher");
 
 	return 1; // Is ok