warrentyexpired/ModernUO
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor(network): move Firewall to UOContent; core keeps only the filter seam

Browse source 
Core now owns the question -- "should this socket be denied?" -- and none of the
answers. The firewall was the last implementation left in core, and the reasons
to keep it did not survive scrutiny: it is not extended downstream, and a shard
running bare core has no way to populate it anyway, since the admin gump and
the commands that mutate it are both content. Larger shards front the server
with an upstream proxy or edge scrubbing and never use it; it survives as the
fallback an admin reaches for over a single player, which is squarely content's
concern.

Nothing about the firewall changes for operators: same Server.Network namespace,
same Configuration/firewall.json, same gump and commands, same legacy .cfg
migration. It reaches the accept path through ConnectionFilters like any other
filter, and registers itself first because an empty set is the cheapest gate.

Untangling core from the firewall entry types first:

- NetworkUtilities built its reserved-network tables out of CidrFirewallEntry,
  which made core depend on the firewall for something with nothing to do with
  banning. Those are constant CIDR blocks answering "is this address in one of
  these ranges?", so they are now a SortedRangeIndex<UInt128> -- the same
  primitive the firewall and blocklist already share. Same semantics, same
  public API, one linear scan replaced by a binary search.
- The CIDR -> normalized range parse those tables needed is now
  IPAddressUtility.TryParseCidrRange, and CidrFirewallEntry drops its private
  copy of that logic in favor of it.

Core no longer references IFirewallEntry or Firewall anywhere. 1344 tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Kamron Batman 2026-07-25 01:18:42 -07:00
parent 2be79d054a
commit 50c8287c7e
No known key found for this signature in database
GPG key ID: 7D81DF26D9A5D94A
14 changed files with 98 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

19
dev-docs/networking-packets.md
View file

@ -504,14 +504,19 @@ Rules:
- Side effects a hit implies (reporting to `BanChannel`, promoting to an OS firewall, suppressing
duplicate reports) are the **filter's** business, not the accept path's.
- Filters are consulted in registration order and the first denial short-circuits, so register the
cheapest and most selective first. Core registers before content is swept.
cheapest and most selective first. Order affects only how quickly a denial is reached, never whether
one happens.
- A filter that throws is **unregistered** and the connection fails open. A filter that faults once
faults for every connection, so leaving it registered would mean an exception per accept.
Built-in filters: `firewall` (core, admin-curated, mutable at runtime) and `blocklist` (UOContent,
file-sourced, millions of entries, demand-pages hits to CrowdSec). Do **not** route this kind of check
through `EventSink.InvokeSocketConnect` -- that fires later and allocates a `SocketConnectEventArgs`
per connection, which is exactly what the accept path avoids for rejected traffic.
Core owns the question; **every implementation lives in UOContent**. The two that ship are `firewall`
(admin-curated, mutable at runtime, persisted to `Configuration/firewall.json`) and `blocklist`
(file-sourced, millions of entries, demand-pages hits to CrowdSec). A shard that fronts its server with
an upstream proxy or edge scrubbing can drop both and register nothing.
Do **not** route this kind of check through `EventSink.InvokeSocketConnect` -- that fires later and
allocates a `SocketConnectEventArgs` per connection, which is exactly what the accept path avoids for
rejected traffic.
### IP Address Normalization (`IPAddressUtility`)
@ -548,6 +553,6 @@ those, so the helpers check both.
| `Projects/Server/Network/PacketHandler.cs` | PacketHandler class |
| `Projects/Server/Network/IConnectionFilter.cs` | Accept-path gate contract |
| `Projects/Server/Network/ConnectionFilters.cs` | Filter registry + lifecycle |
| `Projects/Server/Network/Firewall/Firewall.cs` | Admin-curated firewall set |
| `Projects/Server/Utilities/IPAddressUtility.cs` | IPAddress <-> UInt128 normalization |
| `Projects/UOContent/Misc/Firewall/Firewall.cs` | Admin-curated firewall set |
| `Projects/Server/Utilities/IPAddressUtility.cs` | IPAddress <-> UInt128 normalization, CIDR parsing |
| `Projects/UOContent/Misc/Blocklist/BlocklistFilter.cs` | File-sourced blocklist filter |