Although few blacklists currently support IPv6 lookups, they will likely begin to do so in the near future as more net trash begins using IPv6.
* Word to the wise: Do not use blacklists like SPEWS for blocking IRC
* connections.
*
- * As of charybdis 2.1.3, you can do some keyword substitution on the rejection
+ * As of charybdis 2.2, you can do some keyword substitution on the rejection
* reason. The available keyword substitutions are:
*
* ${ip} - the user's IP
* ${nick} - the user's nickname
* ${network-name} - the name of the network
*
+ * As of charybdis 3.4, a type parameter is supported, which specifies the
+ * address families the blacklist supports. IPv4 and IPv6 are supported.
+ * IPv4 is currently the default as few blacklists support IPv6 operation
+ * as of this writing.
+ *
* Note: AHBL (the providers of the below *.ahbl.org BLs) request that they be
* contacted, via email, at admins@2mbit.com before using these BLs.
* See <http://www.ahbl.org/services.php> for more information.
*/
blacklist {
host = "rbl.efnetrbl.org";
+ type = ipv4;
reject_reason = "${nick}, your IP (${ip}) is listed in EFnet's RBL. For assistance, see http://efnetrbl.org/?i=${ip}";
# host = "ircbl.ahbl.org";
+# type = ipv4;
# reject_reason = "${nick}, your IP (${ip}) is listed in ${dnsbl-host} for having an open proxy. In order to protect ${network-name} from abuse, we are not allowing connections with open proxies to connect.";
#
# host = "tor.ahbl.org";
+# type = ipv4;
# reject_reason = "${nick}, your IP (${ip}) is listed as a TOR exit node. In order to protect ${network-name} from tor-based abuse, we are not allowing TOR exit nodes to connect to our network.";
+#
+ /* Example of a blacklist that supports both IPv4 and IPv6 */
+# host = "foobl.blacklist.invalid";
+# type = ipv4, ipv6;
+# reject_reason = "${nick}, your IP (${ip}) is listed in ${dnsbl-host} for some reason. In order to protect ${network-name} from abuse, we are not allowing connections listed in ${dnsbl-host} to connect";
};
alias "NickServ" {
* ${nick} - the user's nickname
* ${network-name} - the name of the network
*
+ * As of charybdis 3.4, a type parameter is supported, which specifies the
+ * address families the blacklist supports. IPv4 and IPv6 are supported.
+ * IPv4 is currently the default as few blacklists support IPv6 operation
+ * as of this writing.
+ *
* Note: AHBL (the providers of the below *.ahbl.org BLs) request that they be
* contacted, via email, at admins@2mbit.com before using these BLs.
* See <http://www.ahbl.org/services.php> for more information.
*/
blacklist {
host = "rbl.efnetrbl.org";
+ type = ipv4;
reject_reason = "${nick}, your IP (${ip}) is listed in EFnet's RBL. For assistance, see http://efnetrbl.org/?i=${ip}";
# host = "ircbl.ahbl.org";
+# type = ipv4;
# reject_reason = "${nick}, your IP (${ip}) is listed in ${dnsbl-host} for having an open proxy. In order to protect ${network-name} from abuse, we are not allowing connections with open proxies to connect.";
#
# host = "tor.ahbl.org";
+# type = ipv4;
# reject_reason = "${nick}, your IP (${ip}) is listed as a TOR exit node. In order to protect ${network-name} from tor-based abuse, we are not allowing TOR exit nodes to connect to our network.";
+#
+ /* Example of a blacklist that supports both IPv4 and IPv6 */
+# host = "foobl.blacklist.invalid";
+# type = ipv4, ipv6;
+# reject_reason = "${nick}, your IP (${ip}) is listed in ${dnsbl-host} for some reason. In order to protect ${network-name} from abuse, we are not allowing connections listed in ${dnsbl-host} to connect";
};
/*
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
* USA
*
- * $Id: blacklist.h 2023 2006-09-02 23:47:27Z jilles $
*/
#ifndef _BLACKLIST_H_
struct Blacklist {
unsigned int status; /* If CONF_ILLEGAL, delete when no clients */
int refcount;
+ int ipv4; /* Does this blacklist support IPv4 lookups? */
+ int ipv6; /* Does this blacklist support IPv6 lookups? */
char host[IRCD_RES_HOSTLEN + 1];
char reject_reason[IRCD_BUFSIZE];
unsigned int hits;
};
/* public interfaces */
-struct Blacklist *new_blacklist(char *host, char *reject_entry);
+struct Blacklist *new_blacklist(char *host, char *reject_reason, int ipv4, int ipv6);
void lookup_blacklists(struct Client *client_p);
void abort_blacklist_queries(struct Client *client_p);
void unref_blacklist(struct Blacklist *blptr);
* charybdis: A slightly useful ircd.
* blacklist.c: Manages DNS blacklist entries and lookups
*
- * Copyright (C) 2006-2008 charybdis development team
+ * Copyright (C) 2006-2011 charybdis development team
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
- * $Id: blacklist.c 2743 2006-11-10 15:15:00Z jilles $
*/
#include "stdinc.h"
rb_free(blcptr);
}
-/* XXX: no IPv6 implementation, not to concerned right now though. */
static void initiate_blacklist_dnsquery(struct Blacklist *blptr, struct Client *client_p)
{
struct BlacklistClient *blcptr = rb_malloc(sizeof(struct BlacklistClient));
blcptr->dns_query.ptr = blcptr;
blcptr->dns_query.callback = blacklist_dns_callback;
- ip = (uint8_t *)&((struct sockaddr_in *)&client_p->localClient->ip)->sin_addr.s_addr;
+ if ((client_p->localClient->ip.ss_family == AF_INET) && blptr->ipv4)
+ {
+ ip = (uint8_t *)&((struct sockaddr_in *)&client_p->localClient->ip)->sin_addr.s_addr;
+
+ /* becomes 2.0.0.127.torbl.ahbl.org or whatever */
+ rb_snprintf(buf, sizeof buf, "%d.%d.%d.%d.%s",
+ (unsigned int) ip[3],
+ (unsigned int) ip[2],
+ (unsigned int) ip[1],
+ (unsigned int) ip[0],
+ blptr->host);
+ }
+ /* IPv6 is supported now. --Elizabeth */
+ else if ((client_p->localClient->ip.ss_family == AF_INET6) && blptr->ipv6)
+ {
+ /* Breaks it into ip[0] = 0x00, ip[1] = 0x00... ip[16] = 0x01 for localhost
+ * I wish there was a uint4_t for C, this would make the below cleaner, but... */
+ ip = (uint8_t *)&((struct sockaddr_in6 *)&client_p->localClient->ip)->sin6_addr.s6_addr;
+ char *bufptr = buf;
+ int i;
+
+ /* The below will give us something like
+ * 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.foobl.invalid
+ */
+
+ /* Going backwards */
+ for (i = 15; i >= 0; i--)
+ {
+ /* Get upper and lower nibbles (yes this works fine on
+ * both big and little endian) */
+ uint8_t hi = (ip[i] >> 4) & 0x0F;
+ uint8_t lo = ip[i] & 0x0F;
+
+ /* One part... (why 5? rb_snprintf adds \0) */
+ rb_snprintf(bufptr, 5, "%1x.%1x.",
+ (unsigned int) lo, /* Remember, backwards */
+ (unsigned int) hi);
+
+ /* Lurch forward to next position */
+ bufptr += 4;
+ }
- /* becomes 2.0.0.127.torbl.ahbl.org or whatever */
- rb_snprintf(buf, sizeof buf, "%u.%u.%u.%u.%s",
- (unsigned int) ip[3],
- (unsigned int) ip[2],
- (unsigned int) ip[1],
- (unsigned int) ip[0],
- blptr->host);
+ /* Tack host on */
+ strcpy(bufptr, blptr->host);
+ }
+ /* This shouldn't happen... */
+ else
+ return;
gethost_byname_type(buf, &blcptr->dns_query, T_A);
}
/* public interfaces */
-struct Blacklist *new_blacklist(char *name, char *reject_reason)
+struct Blacklist *new_blacklist(char *name, char *reject_reason, int ipv4, int ipv6)
{
struct Blacklist *blptr;
blptr->status &= ~CONF_ILLEGAL;
rb_strlcpy(blptr->host, name, IRCD_RES_HOSTLEN + 1);
rb_strlcpy(blptr->reject_reason, reject_reason, IRCD_BUFSIZE);
+ blptr->ipv4 = ipv4;
+ blptr->ipv6 = ipv6;
blptr->lastwarning = 0;
return blptr;
{
rb_dlink_node *nptr;
- /* We don't do IPv6 right now, sorry! */
- if (client_p->localClient->ip.ss_family == AF_INET6)
- return;
-
RB_DLINK_FOREACH(nptr, blacklist_list.head)
{
struct Blacklist *blptr = (struct Blacklist *) nptr->data;
static char *yy_blacklist_host = NULL;
static char *yy_blacklist_reason = NULL;
+static int yy_blacklist_ipv4 = 1;
+static int yy_blacklist_ipv6 = 0;
+
static char *yy_privset_extends = NULL;
static const char *
yy_blacklist_host = rb_strdup(data);
}
+static void
+conf_set_blacklist_type(void *data)
+{
+ conf_parm_t *args = data;
+
+ /* Don't assume we have either if we got here */
+ yy_blacklist_ipv4 = 0;
+ yy_blacklist_ipv6 = 0;
+
+ for (; args; args = args->next)
+ {
+ if (!strcasecmp(args->v.string, "ipv4"))
+ yy_blacklist_ipv4 = 1;
+ else if (!strcasecmp(args->v.string, "ipv6"))
+ yy_blacklist_ipv6 = 1;
+ else
+ conf_report_error("blacklist::type has unknown address family %s",
+ args->v.string);
+ }
+
+ /* If we have neither, just default to IPv4 */
+ if (!yy_blacklist_ipv4 && !yy_blacklist_ipv6)
+ {
+ conf_report_error("blacklist::type has neither IPv4 nor IPv6 (defaulting to IPv4)");
+ yy_blacklist_ipv4 = 1;
+ }
+}
+
static void
conf_set_blacklist_reason(void *data)
{
if (yy_blacklist_host && yy_blacklist_reason)
{
- new_blacklist(yy_blacklist_host, yy_blacklist_reason);
+ if (yy_blacklist_ipv6)
+ {
+ /* Make sure things fit (64 = alnum count + dots) */
+ if ((64 + strlen(yy_blacklist_host)) > IRCD_RES_HOSTLEN)
+ {
+ conf_report_error("blacklist::host %s results in IPv6 queries that are too long",
+ yy_blacklist_host);
+ goto cleanup_bl;
+ }
+ }
+ /* Avoid doing redundant check, IPv6 is bigger than IPv4 --Elizabeth */
+ if (yy_blacklist_ipv4 && !yy_blacklist_ipv6)
+ {
+ /* Make sure things fit (16 = number of nums + dots) */
+ if ((16 + strlen(yy_blacklist_host)) > IRCD_RES_HOSTLEN)
+ {
+ conf_report_error("blacklist::host %s results in IPv4 queries that are too long",
+ yy_blacklist_host);
+ goto cleanup_bl;
+ }
+ }
+
+ new_blacklist(yy_blacklist_host, yy_blacklist_reason, yy_blacklist_ipv4, yy_blacklist_ipv6);
+
+cleanup_bl:
rb_free(yy_blacklist_host);
rb_free(yy_blacklist_reason);
yy_blacklist_host = NULL;
yy_blacklist_reason = NULL;
+ yy_blacklist_ipv4 = 1;
+ yy_blacklist_ipv6 = 0;
}
}
add_top_conf("blacklist", NULL, NULL, NULL);
add_conf_item("blacklist", "host", CF_QSTRING, conf_set_blacklist_host);
+ add_conf_item("blacklist", "type", CF_STRING | CF_FLIST, conf_set_blacklist_type);
add_conf_item("blacklist", "reject_reason", CF_QSTRING, conf_set_blacklist_reason);
}
projects / solanum.git / commitdiff
