warrentyexpired/ModernUO
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(bans): Windows blocklist gate with demand-paged promotion

Browse source 
Enforce a millions-strong external IP blocklist in-app so the OS firewall
never has to hold it (Windows BFE can't). FileBlocklist loads a versioned
file into an immutable SortedRangeIndex snapshot off the game loop (yields to
world saves) and swaps it atomically; the accept path gates against it after
the manual-ban check and, once per suppression window (PromotedGuard),
promotes the hit to CrowdSec (scenario modernuo/blocklist) so the OS bouncer
kernel-drops repeat traffic. The bulk list is produced entirely out-of-process.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kamron Batman 2026-07-23 20:38:04 -07:00
parent 6249a20f15
commit de3cfa35b1
No known key found for this signature in database
GPG key ID: 7D81DF26D9A5D94A
11 changed files with 857 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

42
Projects/Server/Network/Bans/Blocklist/BlocklistGate.cs Normal file
View file

@ -0,0 +1,42 @@
/*************************************************************************
* ModernUO *
* Copyright 2019-2026 - ModernUO Development Team *
* Email: hi@modernuo.com *
* File: BlocklistGate.cs *
* *
* This program is free software: you can redistribute it and/or modify *
* it under the terms of the GNU General Public License as published by *
* the Free Software Foundation, either version 3 of the License, or *
* (at your option) any later version. *
* *
* You should have received a copy of the GNU General Public License *
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
*************************************************************************/
using System.Net;
namespace Server.Network.Bans.Blocklist;
/// <summary>
/// Pure accept-gate decision, isolated for testability. Allocation-free: no closures on the accept
/// path. Returns true when the connection should be denied; <paramref name="shouldReport"/> indicates
/// whether this hit should be contributed to the ban channel (once per <see cref="PromotedGuard"/> TTL).
/// </summary>
public static class BlocklistGate
{
public static bool Evaluate(
IPAddress ip, bool whitelisted, PromotedGuard guard, long nowTicks,
bool reportHits, long ttlMs, out bool shouldReport)
{
shouldReport = false;
if (whitelisted || !FileBlocklist.IsBanned(ip))
{
return false; // pass
}
if (reportHits)
{
shouldReport = guard.TryMark(ip.ToUInt128(), nowTicks, ttlMs);
}
return true; // deny
}
}