927c87702d
The shard owner, on a Starlink CGNAT address, was blocked by the imported reputation blocklist. The cause was not CrowdSec: the address was a literal line in ip-blocklist.txt, so BlocklistFilter denied it at accept and then promoted it. Clearing the CrowdSec decision could not fix it either, because the file entry re-reports within promoteSuppression of every reconnect. Reputation feeds list shared consumer address space constantly. On CGNAT one public address fronts many subscribers at the same time, so a single abusive customer gets the address listed and everyone else behind it is blocked with them; where leases rotate, a listing says little about whoever holds the address now. So exemptions go where they cost nothing, and escalation is driven by what a connection actually does. GENERATOR (tools/Export-IpBlocklist.ps1) - -AllowlistFile takes multiple paths, subtracted from the merged set before the output is written. Defaults to the operator's own ip-allowlist.txt (created once, never rewritten) plus one generated file per network carve-out. - Subtraction is range-correct: an allowlisted address inside a blocked CIDR splits that CIDR around the hole instead of being ignored. This also fixes -ExcludeAnonymizers, which parsed CIDR entries and then only subtracted singles. - Carve-outs are a table (name, ASN, reason, offline seed) rather than a hardcoded network, so covering another CGNAT provider is one row. -RefreshCarveouts re-fetches from the ASN's current routing announcements and collapses them; -Carveout '' subtracts none. Announcements rather than ownership records, because registry data disagrees with what is routed and caps its result sets. - Editing an allowlist bypasses -MinInterval, so a just-added exemption is not indistinguishable from the allowlist not working. - The shipped starlink carve-out costs ~0.1% of the list. ALLOWLISTS - FileAllowlist reads the same files the generator subtracts, so an operator entry means "leave this address alone" for real. Subtraction alone only covers being BLOCKED; behavioural detections never consult the blocklist, so without this a carve-out was quietly routed around and one scanner behind a shared address was enough to get everyone behind it firewalled. Reading the files also means an entry applies on the next reload rather than the next regeneration. - LoginAllowlist is earned by authenticating, with a 90 day TTL because an address that logged in years ago is a stranger. Its own store rather than Account.LoginIPs, which has no timestamps and cannot be backfilled. An entry is evidence rather than a licence: 10 suppressed contributions in an hour revokes it, and a fresh login forgives the tally. - Both are consulted only AFTER the blocklist has already matched, so a normal accept pays nothing for them and the accept gate stays allowlist-free. - BanExemptions combines them behind BanChannel.IsExempt. Suppresses escalation only; every local defence still applies. BEHAVIOURAL DETECTION - silent-connect (reaped having sent zero bytes) and invalid-seed (a zero seed) are contributed. Both were already disconnected. - ForeignProtocol positively identifies HTTP, TLS and SSH. Asking "is this a good UO client?" cannot work: LoginEncryption.ClientDecrypt is a byte-for-byte stream XOR, so a client with encryption on when the shard expects none sends a structurally perfect connection whose payload is noise. Nothing assumes arrival framing, since TCP has no message boundaries and a rule of the form "these bytes must arrive together" drops real players on poor links. - Keyed on bytes-received rather than elapsed time throughout. A connection that sent something and ran out of time is far more likely a slow link, and banning those makes the player retry, trip the rate limiter, and compound it. - AutoDenylist holds behavioural detections locally for 15 minutes, as an IConnectionFilter plus IBanReporter over one store so engine detection sites never reach into content. Closes the gap where a flood pays for a socket and a NetState per connection while waiting for an OS bouncer, and is the whole defence on a shard running none. Not persisted: a holding pen that survives restarts is a ban without a ban's review. - BanReasons centralises the slugs. IsBehavioral is an opt-in set, not "everything except manual", so a future reason escalates normally instead of silently inheriting an exemption. The first cut of the exemption swallowed manual admin bans; this is why. FIXES - BanConfiguration.Settings was null until Configure() ran while the reap path dereferences it every Slice(), so a harness driving NetState.Slice() directly hit an NRE that looked flaky because it depended on test ordering. - -AllowlistFile was typed [string] while documented and used as a list. LAYOUT AND DOCS Content network code moves out of Misc into UOContent/Network, one concern per folder. Namespaces are untouched, so these are pure file moves. dev-docs/ip-bans-and-allowlists.md documents the subsystem, leading with the operator process for unblocking a player -- including the three things that look sufficient and are not: deleting the CrowdSec decision alone, editing ip-blocklist.txt by hand, and cscli allowlists alone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
78 lines
4 KiB
C#
78 lines
4 KiB
C#
/*************************************************************************
|
|
* ModernUO *
|
|
* Copyright 2019-2026 - ModernUO Development Team *
|
|
* Email: hi@modernuo.com *
|
|
* File: CrowdSecAlert.cs *
|
|
* *
|
|
* This program is free software: you can redistribute it and/or modify *
|
|
* it under the terms of the GNU General Public License as published by *
|
|
* the Free Software Foundation, either version 3 of the License, or *
|
|
* (at your option) any later version. *
|
|
* *
|
|
* You should have received a copy of the GNU General Public License *
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
|
|
*************************************************************************/
|
|
|
|
using System.Text.Json.Serialization;
|
|
|
|
namespace Server.Network.Bans.CrowdSec;
|
|
|
|
/// <summary>One CrowdSec alert (<c>POST /v1/alerts</c> takes an array of these).</summary>
|
|
public sealed class CrowdSecAlert
|
|
{
|
|
[JsonPropertyName("scenario")] public string Scenario { get; set; }
|
|
|
|
/// <summary>
|
|
/// Required by LAPI. It dereferences the field unconditionally when persisting the alert, so
|
|
/// omitting it answers 500 rather than a validation error. Empty is the accepted value for a
|
|
/// watcher that isn't shipping a hub scenario.
|
|
/// </summary>
|
|
[JsonPropertyName("scenario_hash")] public string ScenarioHash { get; set; } = "";
|
|
|
|
/// <summary>Required alongside <see cref="ScenarioHash"/>; same 500-on-missing behavior.</summary>
|
|
[JsonPropertyName("scenario_version")] public string ScenarioVersion { get; set; } = "1.0";
|
|
|
|
[JsonPropertyName("message")] public string Message { get; set; }
|
|
[JsonPropertyName("events_count")] public int EventsCount { get; set; } = 1;
|
|
[JsonPropertyName("start_at")] public string StartAt { get; set; }
|
|
[JsonPropertyName("stop_at")] public string StopAt { get; set; }
|
|
|
|
/// <summary>Bucket capacity. One decision per alert, so 1 — a leaky-bucket capacity of 0 is nonsense.</summary>
|
|
[JsonPropertyName("capacity")] public int Capacity { get; set; } = 1;
|
|
[JsonPropertyName("leakspeed")] public string LeakSpeed { get; set; } = "0s";
|
|
[JsonPropertyName("simulated")] public bool Simulated { get; set; }
|
|
[JsonPropertyName("events")] public object[] Events { get; set; } = [];
|
|
[JsonPropertyName("remediation")] public bool Remediation { get; set; } = true;
|
|
[JsonPropertyName("source")] public CrowdSecSource Source { get; set; }
|
|
[JsonPropertyName("decisions")] public CrowdSecDecisionDto[] Decisions { get; set; }
|
|
}
|
|
|
|
public sealed class CrowdSecSource
|
|
{
|
|
[JsonPropertyName("scope")] public string Scope { get; set; } = "Ip";
|
|
[JsonPropertyName("value")] public string Value { get; set; }
|
|
}
|
|
|
|
public sealed class CrowdSecDecisionDto
|
|
{
|
|
[JsonPropertyName("origin")] public string Origin { get; set; }
|
|
[JsonPropertyName("type")] public string Type { get; set; } = "ban";
|
|
[JsonPropertyName("scope")] public string Scope { get; set; } = "Ip";
|
|
[JsonPropertyName("value")] public string Value { get; set; }
|
|
[JsonPropertyName("duration")] public string Duration { get; set; }
|
|
[JsonPropertyName("scenario")] public string Scenario { get; set; }
|
|
}
|
|
|
|
/// <summary>Watcher login request/response for <c>POST /v1/watchers/login</c>.</summary>
|
|
public sealed class CrowdSecLoginRequest
|
|
{
|
|
[JsonPropertyName("machine_id")] public string MachineId { get; set; }
|
|
[JsonPropertyName("password")] public string Password { get; set; }
|
|
}
|
|
|
|
public sealed class CrowdSecLoginResponse
|
|
{
|
|
[JsonPropertyName("code")] public int Code { get; set; }
|
|
[JsonPropertyName("token")] public string Token { get; set; }
|
|
[JsonPropertyName("expire")] public string Expire { get; set; }
|
|
}
|