a5d49894cd
A carve-out names a real network, and which ones a shard should exempt depends
on where its players actually are. Publishing one in ModernUO makes that policy
call for everybody and puts a specific provider's address space in the repo, so
the script now builds them on request instead:
.\Export-IpBlocklist.ps1 -AddCarveout starlink -Asn 14593
That drops the embedded prefix blob and the table listing it. What is left is the
mechanism: fetch an ASN's current announcements, collapse them, write
ip-allowlist-<name>.txt.
Carve-outs are discovered rather than configured. Every ip-allowlist*.txt beside
the output is subtracted, by the generator and by the shard, so a file an admin
adds needs no config edit and no code change -- blocklist.json's allowlistFiles
now accepts wildcards and defaults to one pattern. FileAllowlist expands per poll
rather than at startup, so a carve-out added later is picked up without a
restart, and skips anything that is not really .txt so the generator's .tmp
sibling can never be read mid-swap.
Each carve-out file carries an asn= marker in its header, which is how
-RefreshCarveouts finds what to rebuild without this script keeping a list of
anyone's networks. A hand-written allowlist has no marker and is never rewritten.
-AddCarveout validates -Asn before any download rather than after 60MB of feeds.
Only ip-allowlist.txt is still created unprompted; deleting a carve-out now drops
it for good instead of having it written back.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
103 lines
4.6 KiB
C#
103 lines
4.6 KiB
C#
/*************************************************************************
|
|
* ModernUO *
|
|
* Copyright 2019-2026 - ModernUO Development Team *
|
|
* Email: hi@modernuo.com *
|
|
* File: BlocklistConfiguration.cs *
|
|
* *
|
|
* This program is free software: you can redistribute it and/or modify *
|
|
* it under the terms of the GNU General Public License as published by *
|
|
* the Free Software Foundation, either version 3 of the License, or *
|
|
* (at your option) any later version. *
|
|
* *
|
|
* You should have received a copy of the GNU General Public License *
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
|
|
*************************************************************************/
|
|
|
|
using System;
|
|
using System.IO;
|
|
using System.Text.Json.Serialization;
|
|
using Server.Json;
|
|
|
|
namespace Server.Network.Bans;
|
|
|
|
/// <summary>
|
|
/// Loads the <see cref="BlocklistSettings"/> from <c>Configuration/blocklist.json</c> (matching the
|
|
/// per-feature JSON config pattern used by <c>AssistantConfiguration</c>). Loaded once; a missing file
|
|
/// writes a template so operators have something to edit.
|
|
/// </summary>
|
|
public static class BlocklistConfiguration
|
|
{
|
|
private const string _path = "Configuration/blocklist.json";
|
|
|
|
public static BlocklistSettings Settings { get; private set; }
|
|
|
|
public static void Load()
|
|
{
|
|
var path = Path.Join(Core.BaseDirectory, _path);
|
|
|
|
if (File.Exists(path))
|
|
{
|
|
Settings = JsonConfig.Deserialize<BlocklistSettings>(path);
|
|
}
|
|
else
|
|
{
|
|
Settings = new BlocklistSettings();
|
|
Save();
|
|
}
|
|
}
|
|
|
|
private static void Save()
|
|
{
|
|
JsonConfig.Serialize(Path.Join(Core.BaseDirectory, _path), Settings);
|
|
}
|
|
}
|
|
|
|
/// <summary>
|
|
/// Bound configuration for <see cref="BlocklistFilter"/>. The filter is inert unless <see cref="File"/>
|
|
/// points at a list that actually exists, so the shipped defaults are safe on a shard that never runs
|
|
/// the generator.
|
|
/// </summary>
|
|
public record BlocklistSettings
|
|
{
|
|
/// <summary>
|
|
/// Path to the blocklist. A relative path resolves against <see cref="Core.BaseDirectory"/>; an
|
|
/// absolute path is used as-is (handy when several shards share one generated list). Set to
|
|
/// <c>""</c> to disable the gate entirely. Produce the file with <c>tools/Export-IpBlocklist.ps1</c>.
|
|
/// </summary>
|
|
[JsonPropertyName("file")]
|
|
public string File { get; set; } = "Configuration/ip-blocklist.txt";
|
|
|
|
/// <summary>
|
|
/// Addresses that must never be blocked and never escalated, in the blocklist's own format. The same
|
|
/// files <c>tools/Export-IpBlocklist.ps1</c> subtracts at generation time; the shard reads them so an
|
|
/// entry also suppresses ban contributions, which the generator alone cannot do. See
|
|
/// <see cref="FileAllowlist"/>.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// The filename may contain wildcards, which is how the default picks up a carve-out an admin adds
|
|
/// without anyone editing this file.
|
|
/// </remarks>
|
|
[JsonPropertyName("allowlistFiles")]
|
|
public string[] AllowlistFiles { get; set; } = ["Configuration/ip-allowlist*.txt"];
|
|
|
|
/// <summary>How often the file is checked for changes. Reloads only happen when it actually changed.</summary>
|
|
[JsonPropertyName("reloadInterval")]
|
|
public TimeSpan ReloadInterval { get; set; } = TimeSpan.FromSeconds(60);
|
|
|
|
/// <summary>Whether blocklist hits are contributed to the ban channel (the demand-paging promotion).</summary>
|
|
[JsonPropertyName("reportHits")]
|
|
public bool ReportHits { get; set; } = true;
|
|
|
|
/// <summary>Duration reported for a blocklist-matched ban.</summary>
|
|
[JsonPropertyName("banDuration")]
|
|
public TimeSpan BanDuration { get; set; } = TimeSpan.FromHours(6);
|
|
|
|
/// <summary>
|
|
/// How long the accept-path guard suppresses re-reporting a promoted address. This only needs to
|
|
/// bridge the gap until the OS bouncer picks up the promotion (seconds); after that the kernel drops
|
|
/// repeat traffic. Decoupled from <see cref="BanDuration"/> so the guard doesn't have to remember
|
|
/// hours' worth of distinct addresses.
|
|
/// </summary>
|
|
[JsonPropertyName("promoteSuppression")]
|
|
public TimeSpan PromoteSuppression { get; set; } = TimeSpan.FromSeconds(60);
|
|
}
|