464d4b7f66
Adds tools/Export-IpBlocklist.ps1, the producer half of the in-app blocklist gate. It merges a thin, non-overlapping set of public IP threat feeds into one de-duplicated, bogon-filtered list and writes the plain-text file the shard reads via `blocklistFile`. Parsing is done in a compiled Add-Type hot loop because the anchor feed alone is ~4M lines; the output is streamed so millions of entries never become millions of strings. The file is written to a .tmp sibling and swapped with File.Replace, so the shard never observes a half-written list, and a total feed outage refuses to overwrite a good list with an empty one. Re-running is idempotent: the script exits without downloading anything while the list on disk is younger than -MinInterval (default 2h, the anchor feed's own refresh period), so a misconfigured scheduler cannot hammer the upstream feeds. Age comes from the `generated=` header the script writes, falling back to mtime, so no sidecar state file is needed. -Force overrides. `blocklistFile` now defaults to Configuration/ip-blocklist.txt instead of being empty. The gate stays inert while that file is absent, so this is a no-op for shards that never run the generator, and dropping the file in later is picked up by the existing poll with no restart. Two fixes this exposed: - FileBlocklist used the configured path verbatim despite documenting it as relative to Core.BaseDirectory, so a relative path resolved against the process working directory. Relative paths now resolve against BaseDirectory; absolute paths are honored so several shards can share one generated list. - A missing file is now the shipped default rather than a misconfiguration, so boot logs "inert: no blocklist at ..." instead of "loaded 0 entries". tools/ stays ignored except for this script. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
108 lines
4.7 KiB
C#
108 lines
4.7 KiB
C#
/*************************************************************************
|
|
* ModernUO *
|
|
* Copyright 2019-2026 - ModernUO Development Team *
|
|
* Email: hi@modernuo.com *
|
|
* File: BanConfiguration.cs *
|
|
* *
|
|
* This program is free software: you can redistribute it and/or modify *
|
|
* it under the terms of the GNU General Public License as published by *
|
|
* the Free Software Foundation, either version 3 of the License, or *
|
|
* (at your option) any later version. *
|
|
* *
|
|
* You should have received a copy of the GNU General Public License *
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
|
|
*************************************************************************/
|
|
|
|
using System;
|
|
using System.IO;
|
|
using System.Text.Json.Serialization;
|
|
using Server.Json;
|
|
|
|
namespace Server.Network.Bans;
|
|
|
|
/// <summary>
|
|
/// Loads the <see cref="BanSettings"/> from <c>Configuration/bans.json</c> (matching the per-feature
|
|
/// JSON config pattern used by <c>AssistantConfiguration</c>). Loaded once; a missing file writes a
|
|
/// local-only, fail-open template so operators have something to edit.
|
|
/// </summary>
|
|
public static class BanConfiguration
|
|
{
|
|
private const string _path = "Configuration/bans.json";
|
|
|
|
public static BanSettings Settings { get; private set; }
|
|
|
|
public static void Configure()
|
|
{
|
|
// Idempotent: this Configure() is auto-discovered and also called explicitly by BanChannel,
|
|
// so guard against a redundant second load.
|
|
if (Settings != null)
|
|
{
|
|
return;
|
|
}
|
|
|
|
var path = Path.Join(Core.BaseDirectory, _path);
|
|
|
|
if (File.Exists(path))
|
|
{
|
|
Settings = JsonConfig.Deserialize<BanSettings>(path);
|
|
}
|
|
else
|
|
{
|
|
Settings = new BanSettings
|
|
{
|
|
ReportRateLimitTrips = true,
|
|
AutoBanDuration = TimeSpan.FromHours(4)
|
|
};
|
|
|
|
Save();
|
|
}
|
|
}
|
|
|
|
private static void Save()
|
|
{
|
|
JsonConfig.Serialize(Path.Join(Core.BaseDirectory, _path), Settings);
|
|
}
|
|
}
|
|
|
|
/// <summary>Ban-channel policy: which reporters receive contributions, and how auto-detections are handled.</summary>
|
|
public record BanSettings
|
|
{
|
|
/// <summary>Whether IP rate-limiter trips are contributed to reporters. They never enter the local firewall set.</summary>
|
|
[JsonPropertyName("reportRateLimitTrips")]
|
|
public bool ReportRateLimitTrips { get; set; } = true;
|
|
|
|
/// <summary>Duration reported for an auto-detected (rate-limit) ban.</summary>
|
|
[JsonPropertyName("autoBanDuration")]
|
|
public TimeSpan AutoBanDuration { get; set; } = TimeSpan.FromHours(4);
|
|
|
|
/// <summary>
|
|
/// Path to the local blocklist file. A relative path resolves against <see cref="Core.BaseDirectory"/>;
|
|
/// an absolute path is used as-is (handy when several shards share one generated list). The gate is
|
|
/// inert while the file is absent, so the default is safe to ship — drop a list in and it takes effect
|
|
/// on the next poll. Set to <c>""</c> to disable the gate entirely. Produce the file with
|
|
/// <c>tools/Export-IpBlocklist.ps1</c>.
|
|
/// </summary>
|
|
[JsonPropertyName("blocklistFile")]
|
|
public string BlocklistFile { get; set; } = "Configuration/ip-blocklist.txt";
|
|
|
|
/// <summary>How often the blocklist file is re-read for changes.</summary>
|
|
[JsonPropertyName("blocklistReloadInterval")]
|
|
public TimeSpan BlocklistReloadInterval { get; set; } = TimeSpan.FromSeconds(60);
|
|
|
|
/// <summary>Whether blocklist hits are contributed to reporters.</summary>
|
|
[JsonPropertyName("reportBlocklistHits")]
|
|
public bool ReportBlocklistHits { get; set; } = true;
|
|
|
|
/// <summary>Duration reported for a blocklist-matched ban.</summary>
|
|
[JsonPropertyName("blocklistBanDuration")]
|
|
public TimeSpan BlocklistBanDuration { get; set; } = TimeSpan.FromHours(6);
|
|
|
|
/// <summary>
|
|
/// How long the accept-path guard suppresses re-reporting a promoted IP. This only needs to bridge
|
|
/// the gap until the OS bouncer picks up the promotion (seconds); after that the kernel drops repeat
|
|
/// traffic. Decoupled from <see cref="BlocklistBanDuration"/> so the guard doesn't remember hours of
|
|
/// distinct IPs.
|
|
/// </summary>
|
|
[JsonPropertyName("blocklistPromoteSuppression")]
|
|
public TimeSpan BlocklistPromoteSuppression { get; set; } = TimeSpan.FromSeconds(60);
|
|
}
|