warrentyexpired/ModernUO
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(network): wire ban channel + blocklist into the accept path; threading policy

Browse source 
Hook the accept gate (NetState) so a rate-limit trip and a blocklist hit each
report to the ban channel and a blocklisted IP is denied; start/stop the ban
channel and FileBlocklist with the server; contribute single-IP manual bans
from the Admin gump and [Firewall command. Rewrites CLAUDE.md rule #3 into a
three-part threading policy (paired with rule #10: background→loop handoff via
volatile snapshot / Core.LoopContext.Post), and stops tracking the local docs/
folder.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kamron Batman 2026-07-23 20:38:23 -07:00
parent de3cfa35b1
commit 74d34b9538
No known key found for this signature in database
GPG key ID: 7D81DF26D9A5D94A
9 changed files with 80 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

19
Projects/Server/Network/NetState/NetState.Network.cs
View file

@ -73,6 +73,7 @@ public partial class NetState
public static IPEndPoint[] ListeningAddresses { get; private set; }
private static IPRateLimiter _ipRateLimiter;
private static readonly Bans.Blocklist.PromotedGuard _blocklistGuard = new();
/// <summary>
/// Configures the IORingGroup and socket manager.
@ -224,11 +225,29 @@ public partial class NetState
if (_ipRateLimiter != null && !_ipRateLimiter.Verify(remoteIP, out var totalAttempts))
{
logger.Debug("{Address} Past IP limit threshold ({TotalAttempts})", remoteIP, totalAttempts);
if (Bans.BanConfiguration.Settings.ReportRateLimitTrips)
{
// Enqueue-only contribution; NOT added to the local firewall set (the limiter already
// gates it here and the OS bouncer drops it at the kernel).
Bans.BanChannel.Report(remoteIP, Bans.BanConfiguration.Settings.AutoBanDuration, "rate-limit");
}
}
else if (Firewall.IsBlocked(remoteIP))
{
logger.Debug("{Address} Firewalled", remoteIP);
}
else if (Bans.Blocklist.BlocklistGate.Evaluate(remoteIP, false, _blocklistGuard, Core.TickCount,
Bans.BanConfiguration.Settings.ReportBlocklistHits,
(long)Bans.BanConfiguration.Settings.BlocklistPromoteSuppression.TotalMilliseconds, out var promote))
{
logger.Debug("{Address} Blocklisted", remoteIP);
if (promote)
{
Bans.BanChannel.Report(remoteIP, Bans.BanConfiguration.Settings.BlocklistBanDuration, "blocklist");
}
}
else
{
// Allow event handlers to reject the connection