The shard owner, on a Starlink CGNAT address, was blocked by the imported
reputation blocklist. The cause was not CrowdSec: the address was a literal line
in ip-blocklist.txt, so BlocklistFilter denied it at accept and then promoted it.
Clearing the CrowdSec decision could not fix it either, because the file entry
re-reports within promoteSuppression of every reconnect.
Reputation feeds list shared consumer address space constantly. On CGNAT one
public address fronts many subscribers at the same time, so a single abusive
customer gets the address listed and everyone else behind it is blocked with
them; where leases rotate, a listing says little about whoever holds the address
now. So exemptions go where they cost nothing, and escalation is driven by what a
connection actually does.
GENERATOR (tools/Export-IpBlocklist.ps1)
- -AllowlistFile takes multiple paths, subtracted from the merged set before the
output is written. Defaults to the operator's own ip-allowlist.txt (created
once, never rewritten) plus one generated file per network carve-out.
- Subtraction is range-correct: an allowlisted address inside a blocked CIDR
splits that CIDR around the hole instead of being ignored. This also fixes
-ExcludeAnonymizers, which parsed CIDR entries and then only subtracted
singles.
- Carve-outs are a table (name, ASN, reason, offline seed) rather than a
hardcoded network, so covering another CGNAT provider is one row.
-RefreshCarveouts re-fetches from the ASN's current routing announcements and
collapses them; -Carveout '' subtracts none. Announcements rather than
ownership records, because registry data disagrees with what is routed and caps
its result sets.
- Editing an allowlist bypasses -MinInterval, so a just-added exemption is not
indistinguishable from the allowlist not working.
- The shipped starlink carve-out costs ~0.1% of the list.
ALLOWLISTS
- FileAllowlist reads the same files the generator subtracts, so an operator
entry means "leave this address alone" for real. Subtraction alone only covers
being BLOCKED; behavioural detections never consult the blocklist, so without
this a carve-out was quietly routed around and one scanner behind a shared
address was enough to get everyone behind it firewalled. Reading the files also
means an entry applies on the next reload rather than the next regeneration.
- LoginAllowlist is earned by authenticating, with a 90 day TTL because an
address that logged in years ago is a stranger. Its own store rather than
Account.LoginIPs, which has no timestamps and cannot be backfilled. An entry is
evidence rather than a licence: 10 suppressed contributions in an hour revokes
it, and a fresh login forgives the tally.
- Both are consulted only AFTER the blocklist has already matched, so a normal
accept pays nothing for them and the accept gate stays allowlist-free.
- BanExemptions combines them behind BanChannel.IsExempt. Suppresses escalation
only; every local defence still applies.
BEHAVIOURAL DETECTION
- silent-connect (reaped having sent zero bytes) and invalid-seed (a zero seed)
are contributed. Both were already disconnected.
- ForeignProtocol positively identifies HTTP, TLS and SSH. Asking "is this a good
UO client?" cannot work: LoginEncryption.ClientDecrypt is a byte-for-byte
stream XOR, so a client with encryption on when the shard expects none sends a
structurally perfect connection whose payload is noise. Nothing assumes arrival
framing, since TCP has no message boundaries and a rule of the form "these
bytes must arrive together" drops real players on poor links.
- Keyed on bytes-received rather than elapsed time throughout. A connection that
sent something and ran out of time is far more likely a slow link, and banning
those makes the player retry, trip the rate limiter, and compound it.
- AutoDenylist holds behavioural detections locally for 15 minutes, as an
IConnectionFilter plus IBanReporter over one store so engine detection sites
never reach into content. Closes the gap where a flood pays for a socket and a
NetState per connection while waiting for an OS bouncer, and is the whole
defence on a shard running none. Not persisted: a holding pen that survives
restarts is a ban without a ban's review.
- BanReasons centralises the slugs. IsBehavioral is an opt-in set, not
"everything except manual", so a future reason escalates normally instead of
silently inheriting an exemption. The first cut of the exemption swallowed
manual admin bans; this is why.
FIXES
- BanConfiguration.Settings was null until Configure() ran while the reap path
dereferences it every Slice(), so a harness driving NetState.Slice() directly
hit an NRE that looked flaky because it depended on test ordering.
- -AllowlistFile was typed [string] while documented and used as a list.
LAYOUT AND DOCS
Content network code moves out of Misc into UOContent/Network, one concern per
folder. Namespaces are untouched, so these are pure file moves.
dev-docs/ip-bans-and-allowlists.md documents the subsystem, leading with the
operator process for unblocking a player -- including the three things that look
sufficient and are not: deleting the CrowdSec decision alone, editing
ip-blocklist.txt by hand, and cscli allowlists alone.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
927c87702d