710973a28b
Introduces IConnectionFilter and the ConnectionFilters registry: one seam the accept path consults per inbound socket, so core no longer has to know where a gate's data comes from. The registry is a plain array walked by an indexed loop, so the hot path has no enumerator, no closure and no allocation; an interface dispatch is noise next to the accept syscall. Filters register during the Configure sweep, cheapest first, and the first denial short-circuits. A filter that throws on the accept path is unregistered and the connection fails open. A filter that faults once faults for every subsequent connection, so leaving it registered would mean an exception and a log line per accept -- exactly the amplification an attacker wants -- and a broken filter must not be able to deny every connection either. With that seam in place the whole file blocklist moves to UOContent: it is policy (which feeds, when to promote, what to report) built on an external file format with an external producer, and core does not need any of it. Firewall stays in core -- it is long-standing public API, it is what an admin reaches for manually, and a shard running without UOContent still has to be able to block an address -- but it now reaches the accept path through the same registry via a small adapter, so the two remain separate implementations rather than one conflated store. Blocklist policy moves out of bans.json into a UOContent Configuration/ blocklist.json, next to crowdsec.json. bans.json keeps only what core decides: reportRateLimitTrips and autoBanDuration. Cleanups found while moving the code: - BanChannel.Stop() persisted the Firewall. A contribution coordinator has no business saving an enforcement store; that is now the firewall filter's Stop. - BlocklistGate.Evaluate took a `whitelisted` flag that was hardcoded false at its only call site, and no whitelist concept exists anywhere in core. Dropped. - FileBlocklist was a static holding a snapshot and a promote-guard, which forced its tests onto the sequential collection and a LoadForTesting reset hook. It is now an instance, so each test owns its own state and they run in parallel. BlocklistGate folds into it: the pure decision survives as an internal Evaluate, which is all the separate type ever provided. - The promote-guard sweep timer was registered from NetState.Configure, two files from the guard it swept, and ran even with the blocklist disabled. It now starts with the filter that owns it. Core sheds ~570 source and ~340 test lines for ~90 of seam. 1344 tests pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
55 lines
2.7 KiB
C#
55 lines
2.7 KiB
C#
/*************************************************************************
|
|
* ModernUO *
|
|
* Copyright 2019-2026 - ModernUO Development Team *
|
|
* Email: hi@modernuo.com *
|
|
* File: IBanReporter.cs *
|
|
* *
|
|
* This program is free software: you can redistribute it and/or modify *
|
|
* it under the terms of the GNU General Public License as published by *
|
|
* the Free Software Foundation, either version 3 of the License, or *
|
|
* (at your option) any later version. *
|
|
* *
|
|
* You should have received a copy of the GNU General Public License *
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
|
|
*************************************************************************/
|
|
|
|
using System;
|
|
using System.Net;
|
|
using System.Threading;
|
|
|
|
namespace Server.Network.Bans;
|
|
|
|
/// <summary>
|
|
/// A contribution sink behind <see cref="BanChannel"/>. Reporters receive locally-decided bans
|
|
/// (manual admin bans, rate-limit trips, blocklist promotions) and forward them to an external system
|
|
/// (e.g. CrowdSec), which distributes them to OS-level bouncers. Reporters never answer the accept-path
|
|
/// membership query — that is an <see cref="IConnectionFilter"/>'s job.
|
|
/// </summary>
|
|
public interface IBanReporter
|
|
{
|
|
/// <summary>Stable id for logging/config (e.g. <c>crowdsec</c>).</summary>
|
|
string Name { get; }
|
|
|
|
/// <summary>Reads configuration. No network or file I/O here.</summary>
|
|
void Configure();
|
|
|
|
/// <summary>Starts background delivery. The token is cancelled on shutdown.</summary>
|
|
void Start(CancellationToken token);
|
|
|
|
/// <summary>Flushes and tears down background delivery.</summary>
|
|
void Stop();
|
|
|
|
/// <summary>
|
|
/// Enqueues a ban contribution. MUST be non-blocking and safe on the accept path: it may only
|
|
/// enqueue (bounded, drop-on-overflow) and never perform synchronous I/O.
|
|
/// </summary>
|
|
/// <param name="ttl"><see cref="TimeSpan.Zero"/> or negative = use the reporter's default duration.</param>
|
|
/// <param name="reason">Short slug (<c>manual</c>, <c>rate-limit</c>) used as the scenario suffix.</param>
|
|
void Report(IPAddress address, TimeSpan ttl, string reason);
|
|
|
|
/// <summary>True if this reporter can retract a previously-reported ban.</summary>
|
|
bool CanRetract { get; }
|
|
|
|
/// <summary>Enqueues a retraction (e.g. a manual unban). No-op if unsupported.</summary>
|
|
void Retract(IPAddress address);
|
|
}
|