feat(network): pluggable connection filters; file blocklist + contribute-first CrowdSec (#2542)
Reshapes IP banning around one idea: **core owns the question, content owns every answer.**
Core gains a single accept-path seam — `IConnectionFilter` — and loses everything that used to implement one. The firewall moves to UOContent, a new file-backed blocklist joins it there, and CrowdSec is repositioned from an in-app enforcer to a contribute-first reporter.
## The seam
```csharp
public interface IConnectionFilter
{
string Name { get; }
void Configure();
void Start(CancellationToken token);
void Stop();
bool ShouldDeny(IPAddress address);
}
```
The accept path went from hardcoded branches to one question:
```csharp
else if (ConnectionFilters.ShouldDeny(remoteIP, out var deniedBy))
{
logger.Debug("{Address} denied by connection filter '{Filter}'", remoteIP, deniedBy);
}
```
Filters register during the Configure sweep. The registry is a plain array walked by an indexed loop — no enumerator, no closure, no allocation — and the first denial short-circuits. An interface dispatch is noise next to the `accept()` syscall, so pluggability costs nothing measurable on the path that has to survive a DDoS.
Whatever a hit implies — persisting, promoting to an OS bouncer, contributing to the ban channel — is the filter's business, not the accept path's.
A filter that throws is **unregistered and the connection fails open**. A filter that faults once faults for every subsequent connection, so leaving it registered means an exception and a log line per accept — exactly the amplification an attacker wants — and a broken filter must not be able to deny everyone either.
This deliberately does **not** reuse `EventSink.InvokeSocketConnect`: that fires later and allocates a `SocketConnectEventArgs` per connection, which is what the accept path avoids for rejected traffic.
## What ships behind it
**`firewall`** (UOContent) — the existing admin-curated set. Collapsed from `Firewall` + `AdminFirewall` + a threaded enforcer into one single-threaded store with **zero concurrency primitives**: the accept path, admin gump, TTL expiry and boot load all run on the game loop. Persists to `Configuration/firewall.json` with automatic migration from the legacy `firewall.cfg`. No behavior change for operators — same namespace, same gump, same commands.
**`blocklist`** (UOContent) — new. Holds a millions-strong list in-app and **demand-pages** hits up to CrowdSec, which promotes them to the OS firewall.
The motivation is concrete: CrowdSec's Windows bouncer cannot load the ~3.9M IPs that 91 community feeds produce, but it handles ~100k fine. So the millions live in-process behind a binary search, and only addresses that *actually connect* get promoted. A `PromotedGuard` suppresses re-reporting an address until the bouncer picks it up.
The list is parsed straight from UTF-8 file bytes with no per-line string allocation, off the game loop, and published as an immutable snapshot swapped through a single `volatile` reference. Reloads yield to world saves.
**`tools/Export-IpBlocklist.ps1`** — the producer. Requires PowerShell 7 and runs on Windows, Linux and macOS; Windows PowerShell 5.1 is refused up front via `#requires`. Merges a thin, non-overlapping feed set into one de-duplicated, bogon-filtered file. Parsing runs in a compiled `Add-Type` hot loop (~1s for ~4M lines instead of minutes). Written to a `.tmp` sibling and swapped with `File.Replace`, so the shard never reads a half-written list, and a total feed outage refuses to overwrite a good list with an empty one. Re-running is idempotent — it exits without downloading anything while the list on disk is younger than `-MinInterval` (default 2h, the anchor feed's own refresh period), so a misconfigured scheduler can't hammer upstream.
## CrowdSec: contribute-first
`IBanReporter` + `BanChannel` fan locally-decided bans out to external systems. `CrowdSecReporter` (UOContent) posts to LAPI `POST /v1/alerts` and retracts via `DELETE /v1/decisions`.
Reporting is **enqueue-only** on the accept path: a bounded, coalescing channel drained off-loop with bounded retry, counted drops on overflow, and a flush on shutdown. Under a DDoS the accept path never does synchronous or lock-contending per-IP work.
### Why not pull decisions from CrowdSec?
The original design streamed decisions into an in-app snapshot and enforced them at the accept gate. That's the wrong layer: by the time the shard sees the connection, the TCP handshake and socket setup are already paid for. `cs-firewall-bouncer` drops the same traffic **at the kernel**, and it's what CrowdSec is built to do. So the shard now contributes what it uniquely knows (rate-limit trips, blocklist hits from real connection attempts) and lets the OS enforce.
The one thing the OS can't do — hold millions of entries on Windows — is exactly what the in-app blocklist covers, and it feeds the same pipeline.
## Threading policy
`CLAUDE.md` rule #3 is rewritten as an explicit three-part policy, with rule #10 restated in tandem:
- Anything touching game state runs **only** on the main loop.
- Heavy work that *needs* game state must be **chunked** across ticks, never threaded.
- Heavy work that does *not* need game state (large-file parse, external I/O) **must** run off-loop **and must yield to world saves**.
Results come back via an immutable snapshot swapped through a single `volatile` reference, or `Core.LoopContext.Post` — never by letting the scheduler decide where heavy work runs. Both new subsystems follow it.
## Shared primitives
`SortedRangeIndex<T> where T : IBinaryInteger<T>` — coalesced disjoint interval arrays plus a binary search. The firewall, the blocklist, and (as of this PR) core's reserved-network tables all use it.
Coalescing is a correctness requirement, not an optimization: multi-feed lists nest CIDRs (`/24` containing a `/32`), and a search that inspects only the rightmost run whose minimum is ≤ the value is sound **only** over disjoint runs. That bug was caught in review and is covered by regression tests.
`IPAddressUtility` collects the allocation-free `IPAddress` ↔ `UInt128` conversions and CIDR parsing that were previously scattered or duplicated.
## Config
| File | Owner | Keys |
|---|---|---|
| `Configuration/bans.json` | core | `reportRateLimitTrips`, `autoBanDuration` |
| `Configuration/blocklist.json` | content | `file`, `reloadInterval`, `reportHits`, `banDuration`, `promoteSuppression` |
| `Configuration/crowdsec.json` | content | `lapiUrl`, `machineId`, `password`, `origin`, `manualBanDuration`, `flushInterval`, `maxQueue` |
| `Configuration/firewall.json` | content | persisted firewall entries (migrated from `firewall.cfg`) |
Everything is inert by default. CrowdSec self-disables without credentials; the blocklist self-disables until its file exists. A shard that changes nothing sees no behavior change.
## Notes for review
- **Core no longer references `Firewall` or `IFirewallEntry` anywhere.** `NetworkUtilities` used to build its reserved-network tables out of `CidrFirewallEntry`, which coupled core to the firewall for something unrelated to banning; those are now a `SortedRangeIndex<UInt128>`, same semantics and public API.
- **`BanChannel.Stop()` no longer persists the firewall** — a contribution coordinator has no business saving an enforcement store. That's the firewall filter's `Stop()`.
- **A dead `whitelisted` parameter was dropped** from the blocklist gate: it was hardcoded `false` at its only call site, and no whitelist concept exists in core.
- **The blocklist filter is an instance, not a static.** The static version forced its tests onto the sequential collection with a reset hook; they now run in parallel.
- `dev-docs/networking-packets.md` documents the seam for content authors, plus a known wart in the `IPAddress` ↔ `UInt128` normalization flagged for a follow-up PR.
- The generator was verified on Linux, macOS and Windows under a temporary CI matrix (since removed). It caught two portability bugs — a Windows-only path separator, and a culture-sensitive duration parse that read `2.5` as `25` on comma-decimal locales and *silently* turned a 2.5h cooldown into 25h — plus a third that made the script unparseable on Windows PowerShell 5.1. The source is ASCII-only for that last reason: `#requires` is only honored once a file parses, so non-ASCII in a BOM-less script produces parse errors instead of the version message.
## Tests
**1344 pass** (782 `Server.Tests`, 562 `UOContent.Tests`). New coverage: filter registry (registration, short-circuit, fault-disable), blocklist parsing/CIDR/coalescing, snapshot reload markers, promote-guard TTL, ban-channel fan-out, CrowdSec alert building/dedup/flush-on-stop, and the generator's output-format contract pinned against the reader.
This commit is contained in:
Kamron Batman
GitHub
parent
bec4cfa910
commit
c39454137e
52 changed files with 4655 additions and 547 deletions
|
|
@ -0,0 +1,65 @@
|
|||
/*************************************************************************
|
||||
* ModernUO *
|
||||
* Copyright 2019-2026 - ModernUO Development Team *
|
||||
* Email: hi@modernuo.com *
|
||||
* File: BlocklistConfigurationTests.cs *
|
||||
* *
|
||||
* This program is free software: you can redistribute it and/or modify *
|
||||
* it under the terms of the GNU General Public License as published by *
|
||||
* the Free Software Foundation, either version 3 of the License, or *
|
||||
* (at your option) any later version. *
|
||||
* *
|
||||
* You should have received a copy of the GNU General Public License *
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
|
||||
*************************************************************************/
|
||||
|
||||
using System;
|
||||
using System.Text.Json;
|
||||
using Server.Json;
|
||||
using Server.Network.Bans;
|
||||
using Xunit;
|
||||
|
||||
namespace Server.Tests.Network.Bans.Blocklist;
|
||||
|
||||
public class BlocklistConfigurationTests
|
||||
{
|
||||
// Locks the JsonConfig casing contract: JsonConfig's options are case-SENSITIVE, so every settings
|
||||
// member must carry an explicit [JsonPropertyName("camelCase")] or it silently binds nothing.
|
||||
[Fact]
|
||||
public void BlocklistSettings_RoundTripsThroughJsonConfig()
|
||||
{
|
||||
var original = new BlocklistSettings
|
||||
{
|
||||
File = "D:/shared/ip-blocklist.txt",
|
||||
ReloadInterval = TimeSpan.FromMinutes(5),
|
||||
ReportHits = false,
|
||||
BanDuration = TimeSpan.FromHours(2),
|
||||
PromoteSuppression = TimeSpan.FromSeconds(30)
|
||||
};
|
||||
|
||||
var json = JsonConfig.Serialize(original);
|
||||
|
||||
Assert.Contains("\"file\"", json);
|
||||
Assert.Contains("\"reloadInterval\"", json);
|
||||
Assert.Contains("\"reportHits\"", json);
|
||||
Assert.Contains("\"banDuration\"", json);
|
||||
Assert.Contains("\"promoteSuppression\"", json);
|
||||
|
||||
var restored = JsonSerializer.Deserialize<BlocklistSettings>(json, JsonConfig.DefaultOptions);
|
||||
|
||||
Assert.NotNull(restored);
|
||||
Assert.Equal(original.File, restored.File);
|
||||
Assert.Equal(original.ReloadInterval, restored.ReloadInterval);
|
||||
Assert.Equal(original.ReportHits, restored.ReportHits);
|
||||
Assert.Equal(original.BanDuration, restored.BanDuration);
|
||||
Assert.Equal(original.PromoteSuppression, restored.PromoteSuppression);
|
||||
}
|
||||
|
||||
// The generator (tools/Export-IpBlocklist.ps1) writes to this path by default; if one side moves
|
||||
// without the other, a shard silently enforces nothing.
|
||||
[Fact]
|
||||
public void Default_file_matches_the_generator_output_path()
|
||||
{
|
||||
Assert.Equal("Configuration/ip-blocklist.txt", new BlocklistSettings().File);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,85 @@
|
|||
/*************************************************************************
|
||||
* ModernUO *
|
||||
* Copyright 2019-2026 - ModernUO Development Team *
|
||||
* Email: hi@modernuo.com *
|
||||
* File: BlocklistFileTests.cs *
|
||||
* *
|
||||
* This program is free software: you can redistribute it and/or modify *
|
||||
* it under the terms of the GNU General Public License as published by *
|
||||
* the Free Software Foundation, either version 3 of the License, or *
|
||||
* (at your option) any later version. *
|
||||
* *
|
||||
* You should have received a copy of the GNU General Public License *
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
|
||||
*************************************************************************/
|
||||
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Net;
|
||||
using Server.Network.Bans;
|
||||
using Xunit;
|
||||
|
||||
namespace Server.Tests.Network.Bans.Blocklist;
|
||||
|
||||
public class BlocklistFileTests
|
||||
{
|
||||
private static string WriteTemp(string content)
|
||||
{
|
||||
var p = Path.Combine(Path.GetTempPath(), "bl-" + Guid.NewGuid().ToString("N") + ".txt");
|
||||
File.WriteAllText(p, content);
|
||||
return p;
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Reads_header_generated_and_count()
|
||||
{
|
||||
var p = WriteTemp("# modernuo-blocklist v1 generated=2026-07-21T09:24:23Z count=2\n1.2.3.4\n5.6.7.0/24\n");
|
||||
Assert.True(BlocklistFile.TryReadHeader(p, out var h));
|
||||
Assert.True(h.Present);
|
||||
Assert.Equal("2026-07-21T09:24:23Z", h.Generated);
|
||||
Assert.Equal(2, h.Count);
|
||||
File.Delete(p);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Missing_file_reports_absent_and_loads_empty()
|
||||
{
|
||||
var p = Path.Combine(Path.GetTempPath(), "does-not-exist-" + Guid.NewGuid().ToString("N"));
|
||||
Assert.False(BlocklistFile.TryReadHeader(p, out var h));
|
||||
Assert.False(h.Present);
|
||||
var snap = BlocklistFile.Load(p, out _, out _);
|
||||
Assert.False(snap.IsBanned(IPAddress.Parse("1.2.3.4")));
|
||||
}
|
||||
|
||||
// Pins the exact line tools/Export-IpBlocklist.ps1 emits: the producer adds informational tokens the
|
||||
// reader doesn't know about, and the reload detector breaks silently if generated= stops being read.
|
||||
[Fact]
|
||||
public void Reads_generator_header_with_extra_tokens()
|
||||
{
|
||||
var p = WriteTemp(
|
||||
"# modernuo-blocklist generated=2026-07-25T18:03:11Z count=12442 ipv4=7868 cidr=4574 feeds=2\n" +
|
||||
"2.181.183.77\n223.169.0.0/16\n"
|
||||
);
|
||||
|
||||
Assert.True(BlocklistFile.TryReadHeader(p, out var h));
|
||||
Assert.Equal("2026-07-25T18:03:11Z", h.Generated);
|
||||
Assert.Equal(12442, h.Count);
|
||||
|
||||
var snap = BlocklistFile.Load(p, out var parsed, out var skipped);
|
||||
Assert.Equal(2, parsed);
|
||||
Assert.Equal(0, skipped);
|
||||
Assert.True(snap.IsBanned(IPAddress.Parse("2.181.183.77")));
|
||||
Assert.True(snap.IsBanned(IPAddress.Parse("223.169.4.9")));
|
||||
File.Delete(p);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Load_parses_body()
|
||||
{
|
||||
var p = WriteTemp("# generated=x count=1\n8.8.8.0/24\n");
|
||||
var snap = BlocklistFile.Load(p, out var parsed, out _);
|
||||
Assert.Equal(1, parsed);
|
||||
Assert.True(snap.IsBanned(IPAddress.Parse("8.8.8.8")));
|
||||
File.Delete(p);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,94 @@
|
|||
/*************************************************************************
|
||||
* ModernUO *
|
||||
* Copyright 2019-2026 - ModernUO Development Team *
|
||||
* Email: hi@modernuo.com *
|
||||
* File: BlocklistFilterTests.cs *
|
||||
* *
|
||||
* This program is free software: you can redistribute it and/or modify *
|
||||
* it under the terms of the GNU General Public License as published by *
|
||||
* the Free Software Foundation, either version 3 of the License, or *
|
||||
* (at your option) any later version. *
|
||||
* *
|
||||
* You should have received a copy of the GNU General Public License *
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
|
||||
*************************************************************************/
|
||||
|
||||
using System.Net;
|
||||
using System.Text;
|
||||
using Server.Network.Bans;
|
||||
using Xunit;
|
||||
|
||||
namespace Server.Tests.Network.Bans.Blocklist;
|
||||
|
||||
// No [Collection] and no static reset hook: the filter is an instance, so each test owns its own
|
||||
// snapshot and promote-guard. That is the point of it no longer being a static class.
|
||||
public class BlocklistFilterTests
|
||||
{
|
||||
private static BlocklistFilter WithList(string list, bool reportHits = true, long suppressionMs = 5000)
|
||||
{
|
||||
var filter = new BlocklistFilter();
|
||||
filter.LoadForTesting(
|
||||
BlocklistSnapshot.Build(Encoding.ASCII.GetBytes(list), out _, out _),
|
||||
reportHits,
|
||||
suppressionMs
|
||||
);
|
||||
|
||||
return filter;
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Listed_address_is_denied_and_reported_once_per_window()
|
||||
{
|
||||
var filter = WithList("1.2.3.4");
|
||||
var ip = IPAddress.Parse("1.2.3.4");
|
||||
|
||||
var deny1 = filter.Evaluate(ip, 1000, out var report1);
|
||||
var deny2 = filter.Evaluate(ip, 1500, out var report2);
|
||||
var deny3 = filter.Evaluate(ip, 1000 + 5001, out var report3);
|
||||
|
||||
Assert.True(deny1);
|
||||
Assert.True(report1);
|
||||
|
||||
Assert.True(deny2);
|
||||
Assert.False(report2); // denied again, but promotion suppressed inside the window
|
||||
|
||||
Assert.True(deny3);
|
||||
Assert.True(report3); // window elapsed, promotion may be retried
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Unlisted_address_passes()
|
||||
{
|
||||
var filter = WithList("1.2.3.4");
|
||||
|
||||
Assert.False(filter.Evaluate(IPAddress.Parse("9.9.9.9"), 1, out var report));
|
||||
Assert.False(report);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Cidr_membership_is_honored()
|
||||
{
|
||||
var filter = WithList("10.20.30.0/24");
|
||||
|
||||
Assert.True(filter.Evaluate(IPAddress.Parse("10.20.30.255"), 1, out _));
|
||||
Assert.False(filter.Evaluate(IPAddress.Parse("10.20.31.0"), 1, out _));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ReportHits_disabled_still_denies_but_never_promotes()
|
||||
{
|
||||
var filter = WithList("1.2.3.4", reportHits: false);
|
||||
|
||||
Assert.True(filter.Evaluate(IPAddress.Parse("1.2.3.4"), 1, out var report));
|
||||
Assert.False(report);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Unconfigured_filter_denies_nothing()
|
||||
{
|
||||
var filter = new BlocklistFilter();
|
||||
|
||||
Assert.Equal(0, filter.Count);
|
||||
Assert.False(filter.ShouldDeny(IPAddress.Parse("8.8.8.8")));
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,98 @@
|
|||
/*************************************************************************
|
||||
* ModernUO *
|
||||
* Copyright 2019-2026 - ModernUO Development Team *
|
||||
* Email: hi@modernuo.com *
|
||||
* File: BlocklistSnapshotTests.cs *
|
||||
* *
|
||||
* This program is free software: you can redistribute it and/or modify *
|
||||
* it under the terms of the GNU General Public License as published by *
|
||||
* the Free Software Foundation, either version 3 of the License, or *
|
||||
* (at your option) any later version. *
|
||||
* *
|
||||
* You should have received a copy of the GNU General Public License *
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
|
||||
*************************************************************************/
|
||||
|
||||
using System.Net;
|
||||
using Server.Network.Bans;
|
||||
using Xunit;
|
||||
|
||||
namespace Server.Tests.Network.Bans.Blocklist;
|
||||
|
||||
public class BlocklistSnapshotTests
|
||||
{
|
||||
private static BlocklistSnapshot Build(params string[] lines) =>
|
||||
BlocklistSnapshot.Build(System.Text.Encoding.ASCII.GetBytes(string.Join('\n', lines)), out _, out _);
|
||||
|
||||
[Fact]
|
||||
public void Single_ip_is_matched()
|
||||
{
|
||||
var s = Build("1.2.3.4");
|
||||
Assert.True(s.IsBanned(IPAddress.Parse("1.2.3.4")));
|
||||
Assert.False(s.IsBanned(IPAddress.Parse("1.2.3.5")));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Cidr_contains_and_excludes_boundaries()
|
||||
{
|
||||
var s = Build("10.0.0.0/24");
|
||||
Assert.True(s.IsBanned(IPAddress.Parse("10.0.0.0")));
|
||||
Assert.True(s.IsBanned(IPAddress.Parse("10.0.0.255")));
|
||||
Assert.False(s.IsBanned(IPAddress.Parse("10.0.1.0")));
|
||||
Assert.False(s.IsBanned(IPAddress.Parse("9.255.255.255")));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Comments_blanks_and_garbage_are_skipped_not_thrown()
|
||||
{
|
||||
var s = BlocklistSnapshot.Build(
|
||||
System.Text.Encoding.ASCII.GetBytes(
|
||||
string.Join('\n', "# header generated=x", "", "not-an-ip", "1.2.3.4", "::1", "5.6.7.0/24")),
|
||||
out var parsed, out var skipped);
|
||||
Assert.Equal(3, parsed); // 1.2.3.4 + ::1 (valid loopback) + 5.6.7.0/24
|
||||
Assert.True(skipped >= 1); // "not-an-ip"; blank/comment lines are silently skipped, not counted
|
||||
Assert.True(s.IsBanned(IPAddress.Parse("5.6.7.200")));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Empty_snapshot_matches_nothing()
|
||||
{
|
||||
Assert.False(BlocklistSnapshot.Empty.IsBanned(IPAddress.Parse("1.2.3.4")));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Ipv6_single_and_cidr_are_matched()
|
||||
{
|
||||
var s = Build("2001:db8::1", "2001:db8:1::/48");
|
||||
Assert.True(s.IsBanned(IPAddress.Parse("2001:db8::1")));
|
||||
Assert.True(s.IsBanned(IPAddress.Parse("2001:db8:1::abcd")));
|
||||
Assert.False(s.IsBanned(IPAddress.Parse("2001:db8:2::1")));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Ipv4_mapped_ipv6_is_normalized_to_v4()
|
||||
{
|
||||
var s = Build("1.2.3.4");
|
||||
Assert.True(s.IsBanned(IPAddress.Parse("::ffff:1.2.3.4"))); // must not bypass the v4 set
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Nested_cidr_intervals_are_coalesced()
|
||||
{
|
||||
// A /32 nested inside a /24: InRange's binary search only inspects the
|
||||
// rightmost interval starting <= ip, so without coalescing an IP inside
|
||||
// the /24 but outside the /32 would land on the /32 and wrongly pass.
|
||||
var s = Build("10.0.0.0/24", "10.0.0.5/32");
|
||||
Assert.True(s.IsBanned(IPAddress.Parse("10.0.0.100"))); // inside /24, outside /32
|
||||
Assert.True(s.IsBanned(IPAddress.Parse("10.0.0.5"))); // the nested /32 itself
|
||||
Assert.False(s.IsBanned(IPAddress.Parse("10.0.1.0"))); // genuinely outside both
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Overlapping_cidr_intervals_are_coalesced()
|
||||
{
|
||||
var s = Build("10.0.0.0/25", "10.0.0.64/25");
|
||||
Assert.True(s.IsBanned(IPAddress.Parse("10.0.0.100"))); // covered by the second /25
|
||||
Assert.False(s.IsBanned(IPAddress.Parse("10.0.0.200"))); // outside both
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
/*************************************************************************
|
||||
* ModernUO *
|
||||
* Copyright 2019-2026 - ModernUO Development Team *
|
||||
* Email: hi@modernuo.com *
|
||||
* File: PromotedGuardTests.cs *
|
||||
* *
|
||||
* This program is free software: you can redistribute it and/or modify *
|
||||
* it under the terms of the GNU General Public License as published by *
|
||||
* the Free Software Foundation, either version 3 of the License, or *
|
||||
* (at your option) any later version. *
|
||||
* *
|
||||
* You should have received a copy of the GNU General Public License *
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
|
||||
*************************************************************************/
|
||||
|
||||
using System;
|
||||
using Server.Network.Bans;
|
||||
using Xunit;
|
||||
|
||||
namespace Server.Tests.Network.Bans.Blocklist;
|
||||
|
||||
public class PromotedGuardTests
|
||||
{
|
||||
[Fact]
|
||||
public void First_mark_true_then_suppressed_until_ttl()
|
||||
{
|
||||
var g = new PromotedGuard();
|
||||
Assert.True(g.TryMark((UInt128)42, 1000, 5000));
|
||||
Assert.False(g.TryMark((UInt128)42, 2000, 5000)); // within TTL
|
||||
Assert.True(g.TryMark((UInt128)42, 6001, 5000)); // expired → re-mark
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Sweep_removes_expired_entries_allowing_remark()
|
||||
{
|
||||
var g = new PromotedGuard();
|
||||
Assert.True(g.TryMark((UInt128)7, 0, 1000));
|
||||
Assert.False(g.TryMark((UInt128)7, 500, 1000)); // still within TTL
|
||||
|
||||
g.Sweep(500); // not yet expired, sweep should not remove it
|
||||
Assert.False(g.TryMark((UInt128)7, 999, 1000));
|
||||
|
||||
g.Sweep(1001); // now expired, sweep removes it
|
||||
Assert.True(g.TryMark((UInt128)7, 1002, 1000)); // fresh mark, not "still marked"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
/*************************************************************************
|
||||
* ModernUO *
|
||||
* Copyright 2019-2026 - ModernUO Development Team *
|
||||
* Email: hi@modernuo.com *
|
||||
* File: CrowdSecAlertClientTests.cs *
|
||||
* *
|
||||
* This program is free software: you can redistribute it and/or modify *
|
||||
* it under the terms of the GNU General Public License as published by *
|
||||
* the Free Software Foundation, either version 3 of the License, or *
|
||||
* (at your option) any later version. *
|
||||
* *
|
||||
* You should have received a copy of the GNU General Public License *
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
|
||||
*************************************************************************/
|
||||
|
||||
using System.Net;
|
||||
using Server.Network.Bans.CrowdSec;
|
||||
using Xunit;
|
||||
|
||||
namespace Server.Tests.Network.Bans;
|
||||
|
||||
public class CrowdSecAlertClientTests
|
||||
{
|
||||
[Fact]
|
||||
public void BuildDeleteQuery_EscapesOrigin()
|
||||
{
|
||||
// origin is operator-controlled config (crowdsec.json), so it must be treated as untrusted
|
||||
// input going into the URL, same as any other interpolated value.
|
||||
var query = CrowdSecAlertClient.BuildDeleteQuery("modern uo/test&x=1", IPAddress.Parse("1.2.3.4"));
|
||||
|
||||
Assert.Equal("/v1/decisions?origin=modern%20uo%2Ftest%26x%3D1&ip=1.2.3.4", query);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void BuildDeleteQuery_PlainOrigin_Ipv4()
|
||||
{
|
||||
var query = CrowdSecAlertClient.BuildDeleteQuery("modernuo", IPAddress.Parse("192.168.1.1"));
|
||||
|
||||
Assert.Equal("/v1/decisions?origin=modernuo&ip=192.168.1.1", query);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void BuildDeleteQuery_Ipv6_IsEscaped()
|
||||
{
|
||||
// IPv6 textual form contains ':', which Uri.EscapeDataString percent-encodes like any other
|
||||
// reserved character — confirms the escaping is applied uniformly, not just for IPv4.
|
||||
var query = CrowdSecAlertClient.BuildDeleteQuery("modernuo", IPAddress.Parse("2001:db8::1"));
|
||||
|
||||
Assert.Equal("/v1/decisions?origin=modernuo&ip=2001%3Adb8%3A%3A1", query);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,82 @@
|
|||
/*************************************************************************
|
||||
* ModernUO *
|
||||
* Copyright 2019-2026 - ModernUO Development Team *
|
||||
* Email: hi@modernuo.com *
|
||||
* File: CrowdSecConfigurationTests.cs *
|
||||
* *
|
||||
* This program is free software: you can redistribute it and/or modify *
|
||||
* it under the terms of the GNU General Public License as published by *
|
||||
* the Free Software Foundation, either version 3 of the License, or *
|
||||
* (at your option) any later version. *
|
||||
* *
|
||||
* You should have received a copy of the GNU General Public License *
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
|
||||
*************************************************************************/
|
||||
|
||||
using System;
|
||||
using System.Text.Json;
|
||||
using Server.Json;
|
||||
using Server.Network.Bans.CrowdSec;
|
||||
using Xunit;
|
||||
|
||||
namespace Server.Tests.Network.Bans;
|
||||
|
||||
public class CrowdSecConfigurationTests
|
||||
{
|
||||
// Locks the JsonConfig casing/converter contract: JsonConfig's options are case-SENSITIVE, so
|
||||
// every settings member must carry an explicit [JsonPropertyName("camelCase")] or it silently
|
||||
// binds nothing. These tests round-trip through the exact options the loader uses.
|
||||
|
||||
[Fact]
|
||||
public void CrowdSecSettings_RoundTripsThroughJsonConfig()
|
||||
{
|
||||
var original = new CrowdSecSettings
|
||||
{
|
||||
LapiUrl = "http://10.0.0.5:9090",
|
||||
MachineId = "shard",
|
||||
Password = "secret",
|
||||
Origin = "modernuo",
|
||||
ManualBanDuration = TimeSpan.FromHours(168),
|
||||
FlushInterval = TimeSpan.FromSeconds(1),
|
||||
MaxQueue = 10000
|
||||
};
|
||||
|
||||
var json = JsonConfig.Serialize(original);
|
||||
|
||||
// camelCase property names must be present (not PascalCase) or the case-sensitive reader binds nothing.
|
||||
Assert.Contains("\"lapiUrl\"", json);
|
||||
Assert.Contains("\"machineId\"", json);
|
||||
Assert.Contains("\"password\"", json);
|
||||
Assert.Contains("\"origin\"", json);
|
||||
Assert.Contains("\"manualBanDuration\"", json);
|
||||
Assert.Contains("\"flushInterval\"", json);
|
||||
Assert.Contains("\"maxQueue\"", json);
|
||||
|
||||
var restored = JsonSerializer.Deserialize<CrowdSecSettings>(json, JsonConfig.DefaultOptions);
|
||||
|
||||
Assert.NotNull(restored);
|
||||
Assert.Equal(original.LapiUrl, restored.LapiUrl);
|
||||
Assert.Equal(original.MachineId, restored.MachineId);
|
||||
Assert.Equal(original.Password, restored.Password);
|
||||
Assert.Equal(original.Origin, restored.Origin);
|
||||
Assert.Equal(original.ManualBanDuration, restored.ManualBanDuration); // TimeSpan survives
|
||||
Assert.Equal(original.FlushInterval, restored.FlushInterval); // TimeSpan survives
|
||||
Assert.Equal(original.MaxQueue, restored.MaxQueue);
|
||||
Assert.True(restored.ReportingEnabled);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void CrowdSecSettings_Defaults_AreReportingDisabledLocalLoopback()
|
||||
{
|
||||
var settings = new CrowdSecSettings();
|
||||
|
||||
Assert.Equal("http://127.0.0.1:8080", settings.LapiUrl);
|
||||
Assert.Equal("", settings.MachineId);
|
||||
Assert.Equal("", settings.Password);
|
||||
Assert.Equal("modernuo", settings.Origin);
|
||||
Assert.Equal(TimeSpan.FromHours(168), settings.ManualBanDuration);
|
||||
Assert.Equal(TimeSpan.FromSeconds(1), settings.FlushInterval);
|
||||
Assert.Equal(10000, settings.MaxQueue);
|
||||
Assert.False(settings.ReportingEnabled); // empty machineId/password => inert
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,229 @@
|
|||
/*************************************************************************
|
||||
* ModernUO *
|
||||
* Copyright 2019-2026 - ModernUO Development Team *
|
||||
* Email: hi@modernuo.com *
|
||||
* File: CrowdSecReporterTests.cs *
|
||||
* *
|
||||
* This program is free software: you can redistribute it and/or modify *
|
||||
* it under the terms of the GNU General Public License as published by *
|
||||
* the Free Software Foundation, either version 3 of the License, or *
|
||||
* (at your option) any later version. *
|
||||
* *
|
||||
* You should have received a copy of the GNU General Public License *
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
|
||||
*************************************************************************/
|
||||
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Net;
|
||||
using System.Threading;
|
||||
using System.Threading.Tasks;
|
||||
using Server.Network.Bans.CrowdSec;
|
||||
using Xunit;
|
||||
|
||||
namespace Server.Tests.Network.Bans;
|
||||
|
||||
public class CrowdSecReporterTests
|
||||
{
|
||||
private static CrowdSecSettings Settings() => new()
|
||||
{
|
||||
MachineId = "shard",
|
||||
Password = "secret",
|
||||
Origin = "modernuo",
|
||||
ManualBanDuration = TimeSpan.FromHours(168)
|
||||
};
|
||||
|
||||
[Fact]
|
||||
public void BuildAlerts_DedupsByIp()
|
||||
{
|
||||
var now = DateTime.UnixEpoch;
|
||||
var items = new List<CrowdSecReporter.ReportItem>
|
||||
{
|
||||
new(IPAddress.Parse("1.1.1.1"), TimeSpan.FromHours(1), "rate-limit", false),
|
||||
new(IPAddress.Parse("1.1.1.1"), TimeSpan.FromHours(1), "rate-limit", false),
|
||||
new(IPAddress.Parse("2.2.2.2"), TimeSpan.FromHours(1), "rate-limit", false)
|
||||
};
|
||||
|
||||
var alerts = CrowdSecReporter.BuildAlerts(items, Settings(), now);
|
||||
|
||||
Assert.Equal(2, alerts.Count);
|
||||
Assert.All(alerts, a => Assert.Single(a.Decisions));
|
||||
Assert.Contains(alerts, a => a.Source.Value == "1.1.1.1");
|
||||
Assert.Contains(alerts, a => a.Source.Value == "2.2.2.2");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void BuildAlerts_ScenarioFromReason_OriginFromSettings()
|
||||
{
|
||||
var alerts = CrowdSecReporter.BuildAlerts(
|
||||
[new(IPAddress.Parse("3.3.3.3"), TimeSpan.FromHours(1), "manual", false)],
|
||||
Settings(),
|
||||
DateTime.UnixEpoch);
|
||||
|
||||
var decision = Assert.Single(alerts).Decisions[0];
|
||||
Assert.Equal("modernuo/manual", alerts[0].Scenario);
|
||||
Assert.Equal("modernuo", decision.Origin);
|
||||
Assert.Equal("ban", decision.Type);
|
||||
Assert.Equal("Ip", decision.Scope);
|
||||
Assert.Equal("3.3.3.3", decision.Value);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void BuildAlerts_ScenarioFromReason_Blocklist()
|
||||
{
|
||||
var alerts = CrowdSecReporter.BuildAlerts(
|
||||
[new(IPAddress.Parse("5.5.5.5"), TimeSpan.FromHours(1), "blocklist", false)],
|
||||
Settings(),
|
||||
DateTime.UnixEpoch);
|
||||
|
||||
var decision = Assert.Single(alerts).Decisions[0];
|
||||
Assert.Equal("modernuo/blocklist", alerts[0].Scenario);
|
||||
Assert.Equal("modernuo/blocklist", decision.Scenario);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void FormatDuration_UsesSeconds_FloorsAtOne()
|
||||
{
|
||||
Assert.Equal("3600s", CrowdSecReporter.FormatDuration(TimeSpan.FromHours(1)));
|
||||
Assert.Equal("1s", CrowdSecReporter.FormatDuration(TimeSpan.Zero));
|
||||
Assert.Equal("1s", CrowdSecReporter.FormatDuration(TimeSpan.FromMilliseconds(10)));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Report_WhenQueueFull_DropsAndCounts()
|
||||
{
|
||||
var reporter = new CrowdSecReporter(new NullAlertClient(), new CrowdSecSettings
|
||||
{
|
||||
MachineId = "shard",
|
||||
Password = "secret",
|
||||
MaxQueue = 2
|
||||
});
|
||||
// Do NOT Start() the drain — so the queue fills and overflows deterministically.
|
||||
|
||||
for (var i = 0; i < 10; i++)
|
||||
{
|
||||
reporter.Report(IPAddress.Parse("4.4.4." + i), TimeSpan.FromHours(1), "rate-limit");
|
||||
}
|
||||
|
||||
Assert.True(reporter.DroppedCount >= 8);
|
||||
}
|
||||
|
||||
// Stop() without a prior Start() drives FlushRemainingOnStop() synchronously (no drain task, no
|
||||
// Task.Delay backoff involved), so this is deterministic — no wall-clock timing dependency.
|
||||
[Fact]
|
||||
public void Stop_FlushesQueuedReports_ViaClient()
|
||||
{
|
||||
var client = new RecordingAlertClient();
|
||||
var reporter = new CrowdSecReporter(client, Settings());
|
||||
|
||||
reporter.Report(IPAddress.Parse("6.6.6.6"), TimeSpan.FromHours(1), "rate-limit");
|
||||
reporter.Stop();
|
||||
|
||||
var posted = Assert.Single(client.Posted);
|
||||
Assert.Equal("6.6.6.6", Assert.Single(posted).Source.Value);
|
||||
Assert.Equal(0, reporter.SendFailureCount);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Stop_FlushesQueuedRetracts_ViaClient()
|
||||
{
|
||||
var client = new RecordingAlertClient();
|
||||
var reporter = new CrowdSecReporter(client, Settings());
|
||||
|
||||
reporter.Retract(IPAddress.Parse("8.8.8.8"));
|
||||
reporter.Stop();
|
||||
|
||||
Assert.Equal(IPAddress.Parse("8.8.8.8"), Assert.Single(client.Deleted));
|
||||
Assert.Equal(0, reporter.SendFailureCount);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Stop_WhenFlushSendFails_CountsSendFailure()
|
||||
{
|
||||
var reporter = new CrowdSecReporter(new ThrowingAlertClient(), Settings());
|
||||
|
||||
reporter.Report(IPAddress.Parse("7.7.7.7"), TimeSpan.FromHours(1), "rate-limit");
|
||||
reporter.Stop();
|
||||
|
||||
Assert.Equal(1, reporter.SendFailureCount);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Stop_WithEmptyQueue_DoesNotInvokeClientOrFail()
|
||||
{
|
||||
var client = new RecordingAlertClient();
|
||||
var reporter = new CrowdSecReporter(client, Settings());
|
||||
|
||||
reporter.Stop();
|
||||
|
||||
Assert.Empty(client.Posted);
|
||||
Assert.Equal(0, reporter.SendFailureCount);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The drain task must track the loop's lifetime, not just its first await — a ValueTask-returning
|
||||
/// drain loop passed to Task.Run yields a Task<ValueTask> that completes immediately, which makes
|
||||
/// Stop()'s drain-exited handshake a no-op. With an empty queue the loop parks on WaitToReadAsync,
|
||||
/// so a correctly unwrapped task cannot win this race; a slow pool only under-detects.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public async Task Start_DrainTaskSpansLoopLifetime_NotJustTheFirstAwait()
|
||||
{
|
||||
var reporter = new CrowdSecReporter(new NullAlertClient(), Settings());
|
||||
using var cts = new CancellationTokenSource();
|
||||
|
||||
reporter.Start(cts.Token);
|
||||
|
||||
var drain = reporter.DrainTaskForTesting;
|
||||
Assert.NotNull(drain);
|
||||
|
||||
var first = await Task.WhenAny(drain, Task.Delay(TimeSpan.FromMilliseconds(500)));
|
||||
Assert.False(ReferenceEquals(first, drain), "drain task completed while the loop was still running");
|
||||
|
||||
reporter.Stop();
|
||||
|
||||
Assert.True(drain.IsCompleted, "Stop() returned before the drain loop exited");
|
||||
}
|
||||
|
||||
private sealed class NullAlertClient : ICrowdSecAlertClient
|
||||
{
|
||||
public ValueTask PostAlertsAsync(IReadOnlyList<CrowdSecAlert> alerts, CancellationToken token) =>
|
||||
ValueTask.CompletedTask;
|
||||
|
||||
public ValueTask DeleteDecisionsAsync(string origin, IPAddress ip, CancellationToken token) =>
|
||||
ValueTask.CompletedTask;
|
||||
|
||||
public void Dispose() { }
|
||||
}
|
||||
|
||||
private sealed class RecordingAlertClient : ICrowdSecAlertClient
|
||||
{
|
||||
public List<IReadOnlyList<CrowdSecAlert>> Posted { get; } = [];
|
||||
public List<IPAddress> Deleted { get; } = [];
|
||||
|
||||
public ValueTask PostAlertsAsync(IReadOnlyList<CrowdSecAlert> alerts, CancellationToken token)
|
||||
{
|
||||
Posted.Add(alerts);
|
||||
return ValueTask.CompletedTask;
|
||||
}
|
||||
|
||||
public ValueTask DeleteDecisionsAsync(string origin, IPAddress ip, CancellationToken token)
|
||||
{
|
||||
Deleted.Add(ip);
|
||||
return ValueTask.CompletedTask;
|
||||
}
|
||||
|
||||
public void Dispose() { }
|
||||
}
|
||||
|
||||
private sealed class ThrowingAlertClient : ICrowdSecAlertClient
|
||||
{
|
||||
public ValueTask PostAlertsAsync(IReadOnlyList<CrowdSecAlert> alerts, CancellationToken token) =>
|
||||
throw new InvalidOperationException("simulated LAPI outage");
|
||||
|
||||
public ValueTask DeleteDecisionsAsync(string origin, IPAddress ip, CancellationToken token) =>
|
||||
ValueTask.CompletedTask;
|
||||
|
||||
public void Dispose() { }
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
using System.Net;
|
||||
using Server.Network;
|
||||
using Xunit;
|
||||
|
||||
namespace Server.Tests;
|
||||
|
||||
public class FirewallEntryTests
|
||||
{
|
||||
[Theory]
|
||||
[InlineData("192.168.1.1", "192.168.1.1")]
|
||||
[InlineData("::ffff:192.168.1.1", "192.168.1.1")]
|
||||
[InlineData("ae45:c5c7:9372:2d3a:413c:6490:017d:2c18", "ae45:c5c7:9372:2d3a:413c:6490:017d:2c18")]
|
||||
public void TestSingleIpFirewallEntry(string ip, string startAndEndIp)
|
||||
{
|
||||
var entry = new SingleIpFirewallEntry(ip);
|
||||
|
||||
Assert.Equal(entry.MaxIpAddress, entry.MinIpAddress);
|
||||
Assert.Equal(IPAddress.Parse(startAndEndIp), entry.MinIpAddress.ToIpAddress());
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("192.168.1.1/24", "192.168.1.0", "192.168.1.255")]
|
||||
[InlineData("::ffff:10.25.3.250/112", "10.25.0.0", "10.25.255.255")]
|
||||
[InlineData("::ffff:10.25.5.250/124", "10.25.5.240", "10.25.5.255")]
|
||||
[InlineData("::ffff:192.168.1.1/120", "192.168.1.0", "192.168.1.255")]
|
||||
[InlineData("d15e:d490:03cd:f9e1:95d8:8413:e6b8:e226/88", "D15E:D490:03CD:F9E1:95D8:8400::", "D15E:D490:03CD:F9E1:95D8:84FF:FFFF:FFFF")]
|
||||
[InlineData("2001:4860:4860::8888/32", "2001:4860:0000:0000:0000:0000:0000:0000", "2001:4860:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF")]
|
||||
public void TestCidrPatternIpFirewallEntry(string cidr, string startIp, string endIp)
|
||||
{
|
||||
var entry = new CidrFirewallEntry(cidr);
|
||||
|
||||
Assert.Equal(IPAddress.Parse(startIp), entry.MinIpAddress.ToIpAddress());
|
||||
Assert.Equal(IPAddress.Parse(endIp), entry.MaxIpAddress.ToIpAddress());
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,72 @@
|
|||
/*************************************************************************
|
||||
* ModernUO *
|
||||
* Copyright 2019-2026 - ModernUO Development Team *
|
||||
* Email: hi@modernuo.com *
|
||||
* File: FirewallPersistenceTests.cs *
|
||||
* *
|
||||
* This program is free software: you can redistribute it and/or modify *
|
||||
* it under the terms of the GNU General Public License as published by *
|
||||
* the Free Software Foundation, either version 3 of the License, or *
|
||||
* (at your option) any later version. *
|
||||
* *
|
||||
* You should have received a copy of the GNU General Public License *
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
|
||||
*************************************************************************/
|
||||
|
||||
using System;
|
||||
using System.Net;
|
||||
using Server.Network;
|
||||
using Xunit;
|
||||
|
||||
namespace Server.Tests.Network.Firewall;
|
||||
|
||||
[Collection("Sequential UOContent Tests")]
|
||||
public class FirewallPersistenceTests
|
||||
{
|
||||
[Fact]
|
||||
public void ToSettings_RoundTrips_PermanentAndTtl()
|
||||
{
|
||||
Server.Network.Firewall.ResetForTesting();
|
||||
Server.Network.Firewall.Add(new SingleIpFirewallEntry(IPAddress.Parse("1.2.3.4")));
|
||||
Server.Network.Firewall.Add(new SingleIpFirewallEntry(IPAddress.Parse("2.2.2.2")), TimeSpan.FromHours(1));
|
||||
|
||||
var settings = Server.Network.Firewall.ToSettings();
|
||||
|
||||
Server.Network.Firewall.ResetForTesting();
|
||||
Server.Network.Firewall.LoadFrom(settings);
|
||||
|
||||
Assert.True(Server.Network.Firewall.IsBlocked(IPAddress.Parse("1.2.3.4")));
|
||||
Assert.True(Server.Network.Firewall.IsBlocked(IPAddress.Parse("2.2.2.2")));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void LoadFrom_SkipsAlreadyExpired()
|
||||
{
|
||||
Server.Network.Firewall.ResetForTesting();
|
||||
var settings = new FirewallSettings
|
||||
{
|
||||
Entries =
|
||||
[
|
||||
// Core.Now, matching the clock LoadFrom compares against.
|
||||
new FirewallEntryRecord { Value = "9.9.9.9", Expires = Core.Now.AddHours(-1) }
|
||||
]
|
||||
};
|
||||
|
||||
Server.Network.Firewall.LoadFrom(settings);
|
||||
|
||||
Assert.False(Server.Network.Firewall.IsBlocked(IPAddress.Parse("9.9.9.9")));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ToSettings_OmitsExpiryForPermanent()
|
||||
{
|
||||
Server.Network.Firewall.ResetForTesting();
|
||||
Server.Network.Firewall.Add(new SingleIpFirewallEntry(IPAddress.Parse("1.2.3.4")));
|
||||
|
||||
var settings = Server.Network.Firewall.ToSettings();
|
||||
|
||||
Assert.Single(settings.Entries);
|
||||
Assert.Null(settings.Entries[0].Expires);
|
||||
Assert.Equal("1.2.3.4", settings.Entries[0].Value);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,89 @@
|
|||
/*************************************************************************
|
||||
* ModernUO *
|
||||
* Copyright 2019-2026 - ModernUO Development Team *
|
||||
* Email: hi@modernuo.com *
|
||||
* File: FirewallTests.cs *
|
||||
* *
|
||||
* This program is free software: you can redistribute it and/or modify *
|
||||
* it under the terms of the GNU General Public License as published by *
|
||||
* the Free Software Foundation, either version 3 of the License, or *
|
||||
* (at your option) any later version. *
|
||||
* *
|
||||
* You should have received a copy of the GNU General Public License *
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
|
||||
*************************************************************************/
|
||||
|
||||
using System;
|
||||
using System.Net;
|
||||
using Server.Network;
|
||||
using Xunit;
|
||||
|
||||
namespace Server.Tests.Network.Firewall;
|
||||
|
||||
[Collection("Sequential UOContent Tests")]
|
||||
public class FirewallTests
|
||||
{
|
||||
private static IPAddress Ip(string s) => IPAddress.Parse(s);
|
||||
|
||||
[Fact]
|
||||
public void Add_ThenIsBlocked_SingleIp()
|
||||
{
|
||||
Server.Network.Firewall.ResetForTesting();
|
||||
Assert.True(Server.Network.Firewall.Add(new SingleIpFirewallEntry(Ip("1.2.3.4"))));
|
||||
Assert.True(Server.Network.Firewall.IsBlocked(Ip("1.2.3.4")));
|
||||
Assert.False(Server.Network.Firewall.IsBlocked(Ip("1.2.3.5")));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Add_Range_BlocksInside_NotOutside()
|
||||
{
|
||||
Server.Network.Firewall.ResetForTesting();
|
||||
Server.Network.Firewall.Add(new CidrFirewallEntry(Ip("10.0.0.0"), Ip("10.0.0.255")));
|
||||
Assert.True(Server.Network.Firewall.IsBlocked(Ip("10.0.0.7")));
|
||||
Assert.False(Server.Network.Firewall.IsBlocked(Ip("10.0.1.0")));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Remove_Unblocks()
|
||||
{
|
||||
Server.Network.Firewall.ResetForTesting();
|
||||
var entry = new SingleIpFirewallEntry(Ip("1.2.3.4"));
|
||||
Server.Network.Firewall.Add(entry);
|
||||
Assert.True(Server.Network.Firewall.Remove(entry));
|
||||
Assert.False(Server.Network.Firewall.IsBlocked(Ip("1.2.3.4")));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ExpireEntries_RemovesExpired_KeepsPermanent()
|
||||
{
|
||||
Server.Network.Firewall.ResetForTesting();
|
||||
var permanent = new SingleIpFirewallEntry(Ip("1.1.1.1"));
|
||||
var temporary = new SingleIpFirewallEntry(Ip("2.2.2.2"));
|
||||
Server.Network.Firewall.Add(permanent); // no ttl
|
||||
Server.Network.Firewall.Add(temporary, TimeSpan.FromMilliseconds(50)); // ttl
|
||||
|
||||
Server.Network.Firewall.ExpireEntries(Core.TickCount + 100); // past the ttl
|
||||
|
||||
Assert.True(Server.Network.Firewall.IsBlocked(Ip("1.1.1.1")));
|
||||
Assert.False(Server.Network.Firewall.IsBlocked(Ip("2.2.2.2")));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ToFirewallEntry_ParsesForms()
|
||||
{
|
||||
Assert.IsType<SingleIpFirewallEntry>(Server.Network.Firewall.ToFirewallEntry("1.2.3.4"));
|
||||
Assert.IsType<CidrFirewallEntry>(Server.Network.Firewall.ToFirewallEntry("10.0.0.0/24"));
|
||||
Assert.IsType<CidrFirewallEntry>(Server.Network.Firewall.ToFirewallEntry("10.0.0.0-10.0.0.255"));
|
||||
Assert.Null(Server.Network.Firewall.ToFirewallEntry("not-an-ip"));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ReadFirewallSet_SurfacesAddedEntries()
|
||||
{
|
||||
Server.Network.Firewall.ResetForTesting();
|
||||
var entry = new SingleIpFirewallEntry(Ip("1.2.3.4"));
|
||||
Server.Network.Firewall.Add(entry);
|
||||
|
||||
Server.Network.Firewall.ReadFirewallSet(set => Assert.Contains(entry, set));
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue