-/* +------------------------------------+
\r * | Inspire Internet Relay Chat Daemon |
\r * +------------------------------------+
\r *
\r * InspIRCd: (C) 2002-2007 InspIRCd Development Team
\r * See: http://www.inspircd.org/wiki/index.php/Credits
\r *
\r * This program is free but copyrighted software; see
\r * the file COPYING for details.
\r *
\r * ---------------------------------------------------
\r */
\r\r#include "inspircd.h"
\r#include "xline.h"
\r#include "dns.h"
\r#include "users.h"
\r#include "channels.h"
\r#include "modules.h"
\r\r#ifndef WINDOWS
\r#include <sys/types.h>
\r#include <sys/socket.h>
\r#include <netinet/in.h>
\r#include <arpa/inet.h>
\r#endif
\r\r/* $ModDesc: Provides handling of DNS blacklists */
\r\r/* Class holding data for a single entry */
\rclass DNSBLConfEntry
\r{
\r public:
\r enum EnumBanaction { I_UNKNOWN, I_KILL, I_ZLINE, I_KLINE, I_GLINE };
\r std::string name, domain, reason;
\r EnumBanaction banaction;
\r long duration;
\r int bitmask;
\r unsigned long stats_hits, stats_misses;
\r DNSBLConfEntry(): duration(86400),bitmask(0),stats_hits(0), stats_misses(0) {}
\r ~DNSBLConfEntry() { }
\r};
\r\r\r/** Resolver for CGI:IRC hostnames encoded in ident/GECOS
\r */
\rclass DNSBLResolver : public Resolver
\r{
\r int theirfd;
\r userrec* them;
\r DNSBLConfEntry *ConfEntry;
\r\r public:
\r\r DNSBLResolver(Module *me, InspIRCd *ServerInstance, const std::string &hostname, userrec* u, int userfd, DNSBLConfEntry *conf, bool &cached)
\r : Resolver(ServerInstance, hostname, DNS_QUERY_A, cached, me)
\r {
\r theirfd = userfd;
\r them = u;
\r ConfEntry = conf;
\r }
\r\r virtual void OnLookupComplete(const std::string &result, unsigned int ttl, bool cached)
\r {
\r /* Check the user still exists */
\r if ((them) && (them == ServerInstance->SE->GetRef(theirfd)))
\r {
\r // Now we calculate the bitmask: 256*(256*(256*a+b)+c)+d
\r if(result.length())
\r {
\r unsigned int bitmask = 0;
\r bool show = false;
\r in_addr resultip;
\r\r /* Convert the result to an in_addr (we can gaurantee we got ipv4)
\r * Whoever did the loop that was here before, I AM CONFISCATING
\r * YOUR CRACKPIPE. you know who you are. -- Brain
\r */
\r inet_aton(result.c_str(), &resultip);
\r bitmask = resultip.s_addr >> 24; /* Last octet (network byte order */
\r\r bitmask &= ConfEntry->bitmask;
\r\r if (bitmask != 0)
\r {
\r std::string reason = ConfEntry->reason;
\r std::string::size_type x = reason.find("%ip%");
\r while (x != std::string::npos)
\r {
\r reason.erase(x, 4);
\r reason.insert(x, them->GetIPString());
\r x = reason.find("%ip%");
\r }
\r\r ConfEntry->stats_hits++;
\r\r switch (ConfEntry->banaction)
\r {
\r case DNSBLConfEntry::I_KILL:
\r {
\r userrec::QuitUser(ServerInstance, them, std::string("Killed (") + reason + ")");
\r break;
\r }
\r case DNSBLConfEntry::I_KLINE:
\r {
\r std::string ban = std::string("*@") + them->GetIPString();
\r if (show)
\r ServerInstance->XLines->apply_lines(APPLY_KLINES);
\r show = ServerInstance->XLines->add_kline(ConfEntry->duration, ServerInstance->Config->ServerName, reason.c_str(), ban.c_str());
\r FOREACH_MOD(I_OnAddKLine,OnAddKLine(ConfEntry->duration, NULL, reason, ban));
\r break;
\r }
\r case DNSBLConfEntry::I_GLINE:
\r {
\r std::string ban = std::string("*@") + them->GetIPString();
\r show = ServerInstance->XLines->add_gline(ConfEntry->duration, ServerInstance->Config->ServerName, reason.c_str(), ban.c_str());
\r if (show)
\r ServerInstance->XLines->apply_lines(APPLY_GLINES);
\r FOREACH_MOD(I_OnAddGLine,OnAddGLine(ConfEntry->duration, NULL, reason, ban));
\r break;
\r }
\r case DNSBLConfEntry::I_ZLINE:
\r {
\r show = ServerInstance->XLines->add_zline(ConfEntry->duration, ServerInstance->Config->ServerName, reason.c_str(), them->GetIPString());
\r if (show)
\r ServerInstance->XLines->apply_lines(APPLY_ZLINES);
\r FOREACH_MOD(I_OnAddZLine,OnAddZLine(ConfEntry->duration, NULL, reason, them->GetIPString()));
\r break;
\r }
\r case DNSBLConfEntry::I_UNKNOWN:
\r {
\r break;
\r }
\r break;
\r }
\r\r if (show)
\r {
\r ServerInstance->WriteOpers("*** Connecting user %s detected as being on a DNS blacklist (%s) with result %d", them->GetFullRealHost(), ConfEntry->name.c_str(), bitmask);
\r }
\r }
\r else
\r ConfEntry->stats_misses++;
\r }
\r else
\r ConfEntry->stats_misses++;
\r }
\r }
\r\r virtual void OnError(ResolverError e, const std::string &errormessage)
\r {
\r }
\r\r virtual ~DNSBLResolver()
\r {
\r }
\r};
\r\rclass ModuleDNSBL : public Module
\r{
\r private:
\r std::vector<DNSBLConfEntry *> DNSBLConfEntries;
\r\r /*
\r * Convert a string to EnumBanaction
\r */
\r DNSBLConfEntry::EnumBanaction str2banaction(const std::string &action)
\r {
\r if(action.compare("KILL")==0)
\r return DNSBLConfEntry::I_KILL;
\r if(action.compare("KLINE")==0)
\r return DNSBLConfEntry::I_KLINE;
\r if(action.compare("ZLINE")==0)
\r return DNSBLConfEntry::I_ZLINE;
\r if(action.compare("GLINE")==0)
\r return DNSBLConfEntry::I_GLINE;
\r\r return DNSBLConfEntry::I_UNKNOWN;
\r }
\r public:
\r ModuleDNSBL(InspIRCd *Me) : Module(Me)
\r {
\r ReadConf();
\r }
\r\r virtual ~ModuleDNSBL()
\r {
\r ClearEntries();
\r }
\r\r virtual Version GetVersion()
\r {
\r return Version(2, 0, 0, 1, VF_VENDOR, API_VERSION);
\r }
\r\r void Implements(char* List)
\r {
\r List[I_OnRehash] = List[I_OnUserRegister] = List[I_OnStats] = 1;
\r }
\r\r /** Clear entries and free the mem it was using
\r */
\r void ClearEntries()
\r {
\r std::vector<DNSBLConfEntry *>::iterator i;
\r for (std::vector<DNSBLConfEntry *>::iterator i = DNSBLConfEntries.begin(); i != DNSBLConfEntries.end(); i++)
\r delete *i;
\r DNSBLConfEntries.clear();
\r }
\r\r /** Fill our conf vector with data
\r */
\r virtual void ReadConf()
\r {
\r ConfigReader *MyConf = new ConfigReader(ServerInstance);
\r ClearEntries();
\r\r for (int i=0; i< MyConf->Enumerate("dnsbl"); i++)
\r {
\r DNSBLConfEntry *e = new DNSBLConfEntry();
\r\r e->name = MyConf->ReadValue("dnsbl", "name", i);
\r e->reason = MyConf->ReadValue("dnsbl", "reason", i);
\r e->domain = MyConf->ReadValue("dnsbl", "domain", i);
\r e->banaction = str2banaction(MyConf->ReadValue("dnsbl", "action", i));
\r e->duration = ServerInstance->Duration(MyConf->ReadValue("dnsbl", "duration", i));
\r e->bitmask = MyConf->ReadInteger("dnsbl", "bitmask", i, false);
\r\r /* yeah, logic here is a little messy */
\r if (e->bitmask <= 0)
\r {
\r ServerInstance->WriteOpers("*** DNSBL(#%d): invalid bitmask",i);
\r }
\r else if (e->name.empty())
\r {
\r ServerInstance->WriteOpers("*** DNSBL(#%d): Invalid name",i);
\r }
\r else if (e->domain.empty())
\r {
\r ServerInstance->WriteOpers("*** DNSBL(#%d): Invalid domain",i);
\r }
\r else if (e->banaction == DNSBLConfEntry::I_UNKNOWN)
\r {
\r ServerInstance->WriteOpers("*** DNSBL(#%d): Invalid banaction", i);
\r }
\r else
\r {
\r if (e->reason.empty())
\r {
\r ServerInstance->WriteOpers("*** DNSBL(#%d): empty reason, using defaults",i);
\r e->reason = "Your IP has been blacklisted.";
\r }
\r\r /* add it, all is ok */
\r DNSBLConfEntries.push_back(e);
\r continue;
\r }
\r\r /* delete and drop it, error somewhere */
\r delete e;
\r }
\r\r delete MyConf;
\r }
\r\r virtual void OnRehash(userrec* user, const std::string ¶meter)
\r {
\r ReadConf();
\r }
\r\r virtual int OnUserRegister(userrec* user)
\r {
\r /* only do lookups on local users */
\r if (IS_LOCAL(user))
\r {
\r /* following code taken from bopm, reverses an IP address. */
\r struct in_addr in;
\r unsigned char a, b, c, d;
\r char reversedipbuf[128];
\r std::string reversedip;
\r bool success = false;
\r\r if (!inet_aton(user->GetIPString(), &in))
\r {
\r#ifdef IPV6
\r /* We could have an ipv6 address here */
\r std::string x = user->GetIPString();
\r /* Is it a 4in6 address? (Compensate for this kernel kludge that people love) */
\r if (x.find("0::ffff:") == 0)
\r {
\r x.erase(x.begin(), x.begin() + 8);
\r if (inet_aton(x.c_str(), &in))
\r success = true;
\r }
\r#endif
\r }
\r else
\r {
\r success = true;
\r }
\r\r if (!success)
\r return 0;
\r\r d = (unsigned char) (in.s_addr >> 24) & 0xFF;
\r c = (unsigned char) (in.s_addr >> 16) & 0xFF;
\r b = (unsigned char) (in.s_addr >> 8) & 0xFF;
\r a = (unsigned char) in.s_addr & 0xFF;
\r\r snprintf(reversedipbuf, 128, "%d.%d.%d.%d", d, c, b, a);
\r reversedip = std::string(reversedipbuf);
\r\r // For each DNSBL, we will run through this lookup
\r for (std::vector<DNSBLConfEntry *>::iterator i = DNSBLConfEntries.begin(); i != DNSBLConfEntries.end(); i++)
\r {
\r // Fill hostname with a dnsbl style host (d.c.b.a.domain.tld)
\r std::string hostname = reversedip + "." + (*i)->domain;
\r\r /* now we'd need to fire off lookups for `hostname'. */
\r bool cached;
\r DNSBLResolver *r = new DNSBLResolver(this, ServerInstance, hostname, user, user->GetFd(), *i, cached);
\r ServerInstance->AddResolver(r, cached);
\r }
\r }
\r\r /* don't do anything with this hot potato */
\r return 0;
\r }
\r \r virtual int OnStats(char symbol, userrec* user, string_list &results)
\r {
\r if (symbol != 'd')
\r return 0;
\r \r unsigned long total_hits = 0, total_misses = 0;
\r\r for (std::vector<DNSBLConfEntry*>::iterator i = DNSBLConfEntries.begin(); i != DNSBLConfEntries.end(); i++)
\r {
\r total_hits += (*i)->stats_hits;
\r total_misses += (*i)->stats_misses;
\r \r results.push_back(std::string(ServerInstance->Config->ServerName) + " 304 " + user->nick + " :DNSBLSTATS DNSbl \"" + (*i)->name + "\" had " +
\r ConvToStr((*i)->stats_hits) + " hits and " + ConvToStr((*i)->stats_misses) + " misses");
\r }
\r \r results.push_back(std::string(ServerInstance->Config->ServerName) + " 304 " + user->nick + " :DNSBLSTATS Total hits: " + ConvToStr(total_hits));
\r results.push_back(std::string(ServerInstance->Config->ServerName) + " 304 " + user->nick + " :DNSBLSTATS Total misses: " + ConvToStr(total_misses));
\r \r return 0;
\r }
\r};
\r\rMODULE_INIT(ModuleDNSBL)
\r\ No newline at end of file
+/*
+ * InspIRCd -- Internet Relay Chat Daemon
+ *
+ * Copyright (C) 2018-2020 Matt Schatz <genius3000@g3k.solutions>
+ * Copyright (C) 2018-2019 linuxdaemon <linuxdaemon.irc@gmail.com>
+ * Copyright (C) 2013, 2016-2020 Sadie Powell <sadie@witchery.services>
+ * Copyright (C) 2013, 2015-2016 Adam <Adam@anope.org>
+ * Copyright (C) 2012-2016 Attila Molnar <attilamolnar@hush.com>
+ * Copyright (C) 2012, 2018 Robby <robby@chatbelgie.be>
+ * Copyright (C) 2009-2010 Daniel De Graaf <danieldg@inspircd.org>
+ * Copyright (C) 2007, 2010 Craig Edwards <brain@inspircd.org>
+ * Copyright (C) 2007 Dennis Friis <peavey@inspircd.org>
+ * Copyright (C) 2006-2009 Robin Burchell <robin+git@viroteck.net>
+ *
+ * This file is part of InspIRCd. InspIRCd is free software: you can
+ * redistribute it and/or modify it under the terms of the GNU General Public
+ * License as published by the Free Software Foundation, version 2.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+
+#include "inspircd.h"
+#include "xline.h"
+#include "modules/dns.h"
+#include "modules/stats.h"
+
+/* Class holding data for a single entry */
+class DNSBLConfEntry : public refcountbase
+{
+ public:
+ enum EnumBanaction { I_UNKNOWN, I_KILL, I_ZLINE, I_KLINE, I_GLINE, I_MARK };
+ enum EnumType { A_RECORD, A_BITMASK };
+ std::string name, ident, host, domain, reason;
+ EnumBanaction banaction;
+ EnumType type;
+ unsigned long duration;
+ unsigned int bitmask;
+ unsigned char records[256];
+ unsigned long stats_hits, stats_misses, stats_errors;
+ DNSBLConfEntry()
+ : type(A_BITMASK)
+ , duration(86400)
+ , bitmask(0)
+ , stats_hits(0)
+ , stats_misses(0)
+ , stats_errors(0)
+ {
+ }
+};
+
+
+/** Resolver for CGI:IRC hostnames encoded in ident/real name
+ */
+class DNSBLResolver : public DNS::Request
+{
+ private:
+ irc::sockets::sockaddrs theirsa;
+ std::string theiruid;
+ LocalStringExt& nameExt;
+ LocalIntExt& countExt;
+ reference<DNSBLConfEntry> ConfEntry;
+
+ public:
+ DNSBLResolver(DNS::Manager *mgr, Module *me, LocalStringExt& match, LocalIntExt& ctr, const std::string &hostname, LocalUser* u, reference<DNSBLConfEntry> conf)
+ : DNS::Request(mgr, me, hostname, DNS::QUERY_A, true)
+ , theirsa(u->client_sa)
+ , theiruid(u->uuid)
+ , nameExt(match)
+ , countExt(ctr)
+ , ConfEntry(conf)
+ {
+ }
+
+ /* Note: This may be called multiple times for multiple A record results */
+ void OnLookupComplete(const DNS::Query *r) CXX11_OVERRIDE
+ {
+ /* Check the user still exists */
+ LocalUser* them = IS_LOCAL(ServerInstance->FindUUID(theiruid));
+ if (!them || them->client_sa != theirsa)
+ return;
+
+ int i = countExt.get(them);
+ if (i)
+ countExt.set(them, i - 1);
+
+ // The DNSBL reply must contain an A result.
+ const DNS::ResourceRecord* const ans_record = r->FindAnswerOfType(DNS::QUERY_A);
+ if (!ans_record)
+ {
+ ConfEntry->stats_errors++;
+ ServerInstance->SNO->WriteGlobalSno('d', "%s returned an result with no IPv4 address.",
+ ConfEntry->name.c_str());
+ return;
+ }
+
+ // The DNSBL reply must be a valid IPv4 address.
+ in_addr resultip;
+ if (inet_pton(AF_INET, ans_record->rdata.c_str(), &resultip) != 1)
+ {
+ ConfEntry->stats_errors++;
+ ServerInstance->SNO->WriteGlobalSno('d', "%s returned an invalid IPv4 address: %s",
+ ConfEntry->name.c_str(), ans_record->rdata.c_str());
+ return;
+ }
+
+ // The DNSBL reply should be in the 127.0.0.0/8 range.
+ if ((resultip.s_addr & 0xFF) != 127)
+ {
+ ConfEntry->stats_errors++;
+ ServerInstance->SNO->WriteGlobalSno('d', "%s returned an IPv4 address which is outside of the 127.0.0.0/8 subnet: %s",
+ ConfEntry->name.c_str(), ans_record->rdata.c_str());
+ return;
+ }
+
+ bool match = false;
+ unsigned int result = 0;
+ switch (ConfEntry->type)
+ {
+ case DNSBLConfEntry::A_BITMASK:
+ {
+ result = (resultip.s_addr >> 24) & ConfEntry->bitmask;
+ match = (result != 0);
+ break;
+ }
+ case DNSBLConfEntry::A_RECORD:
+ {
+ result = resultip.s_addr >> 24;
+ match = (ConfEntry->records[result] == 1);
+ break;
+ }
+ }
+
+ if (match)
+ {
+ std::string reason = ConfEntry->reason;
+ std::string::size_type x = reason.find("%ip%");
+ while (x != std::string::npos)
+ {
+ reason.erase(x, 4);
+ reason.insert(x, them->GetIPString());
+ x = reason.find("%ip%");
+ }
+
+ ConfEntry->stats_hits++;
+
+ switch (ConfEntry->banaction)
+ {
+ case DNSBLConfEntry::I_KILL:
+ {
+ ServerInstance->Users->QuitUser(them, "Killed (" + reason + ")");
+ break;
+ }
+ case DNSBLConfEntry::I_MARK:
+ {
+ if (!ConfEntry->ident.empty())
+ {
+ them->WriteNotice("Your ident has been set to " + ConfEntry->ident + " because you matched " + reason);
+ them->ChangeIdent(ConfEntry->ident);
+ }
+
+ if (!ConfEntry->host.empty())
+ {
+ them->WriteNotice("Your host has been set to " + ConfEntry->host + " because you matched " + reason);
+ them->ChangeDisplayedHost(ConfEntry->host);
+ }
+
+ nameExt.set(them, ConfEntry->name);
+ break;
+ }
+ case DNSBLConfEntry::I_KLINE:
+ {
+ KLine* kl = new KLine(ServerInstance->Time(), ConfEntry->duration, ServerInstance->Config->ServerName.c_str(), reason.c_str(),
+ "*", them->GetIPString());
+ if (ServerInstance->XLines->AddLine(kl,NULL))
+ {
+ ServerInstance->SNO->WriteToSnoMask('x', "K-line added due to DNSBL match on *@%s to expire in %s (on %s): %s",
+ them->GetIPString().c_str(), InspIRCd::DurationString(kl->duration).c_str(),
+ InspIRCd::TimeString(kl->expiry).c_str(), reason.c_str());
+ ServerInstance->XLines->ApplyLines();
+ }
+ else
+ {
+ delete kl;
+ return;
+ }
+ break;
+ }
+ case DNSBLConfEntry::I_GLINE:
+ {
+ GLine* gl = new GLine(ServerInstance->Time(), ConfEntry->duration, ServerInstance->Config->ServerName.c_str(), reason.c_str(),
+ "*", them->GetIPString());
+ if (ServerInstance->XLines->AddLine(gl,NULL))
+ {
+ ServerInstance->SNO->WriteToSnoMask('x', "G-line added due to DNSBL match on *@%s to expire in %s (on %s): %s",
+ them->GetIPString().c_str(), InspIRCd::DurationString(gl->duration).c_str(),
+ InspIRCd::TimeString(gl->expiry).c_str(), reason.c_str());
+ ServerInstance->XLines->ApplyLines();
+ }
+ else
+ {
+ delete gl;
+ return;
+ }
+ break;
+ }
+ case DNSBLConfEntry::I_ZLINE:
+ {
+ ZLine* zl = new ZLine(ServerInstance->Time(), ConfEntry->duration, ServerInstance->Config->ServerName.c_str(), reason.c_str(),
+ them->GetIPString());
+ if (ServerInstance->XLines->AddLine(zl,NULL))
+ {
+ ServerInstance->SNO->WriteToSnoMask('x', "Z-line added due to DNSBL match on %s to expire in %s (on %s): %s",
+ them->GetIPString().c_str(), InspIRCd::DurationString(zl->duration).c_str(),
+ InspIRCd::TimeString(zl->expiry).c_str(), reason.c_str());
+ ServerInstance->XLines->ApplyLines();
+ }
+ else
+ {
+ delete zl;
+ return;
+ }
+ break;
+ }
+ case DNSBLConfEntry::I_UNKNOWN:
+ default:
+ break;
+ }
+
+ ServerInstance->SNO->WriteGlobalSno('d', "Connecting user %s (%s) detected as being on the '%s' DNS blacklist with result %d",
+ them->GetFullRealHost().c_str(), them->GetIPString().c_str(), ConfEntry->name.c_str(), result);
+ }
+ else
+ ConfEntry->stats_misses++;
+ }
+
+ void OnError(const DNS::Query *q) CXX11_OVERRIDE
+ {
+ LocalUser* them = IS_LOCAL(ServerInstance->FindUUID(theiruid));
+ if (!them || them->client_sa != theirsa)
+ return;
+
+ int i = countExt.get(them);
+ if (i)
+ countExt.set(them, i - 1);
+
+ if (q->error == DNS::ERROR_NO_RECORDS || q->error == DNS::ERROR_DOMAIN_NOT_FOUND)
+ {
+ ConfEntry->stats_misses++;
+ return;
+ }
+
+ ConfEntry->stats_errors++;
+ ServerInstance->SNO->WriteGlobalSno('d', "An error occurred whilst checking whether %s (%s) is on the '%s' DNS blacklist: %s",
+ them->GetFullRealHost().c_str(), them->GetIPString().c_str(), ConfEntry->name.c_str(), this->manager->GetErrorStr(q->error).c_str());
+ }
+};
+
+typedef std::vector<reference<DNSBLConfEntry> > DNSBLConfList;
+
+class ModuleDNSBL : public Module, public Stats::EventListener
+{
+ DNSBLConfList DNSBLConfEntries;
+ dynamic_reference<DNS::Manager> DNS;
+ LocalStringExt nameExt;
+ LocalIntExt countExt;
+
+ /*
+ * Convert a string to EnumBanaction
+ */
+ DNSBLConfEntry::EnumBanaction str2banaction(const std::string &action)
+ {
+ if (stdalgo::string::equalsci(action, "kill"))
+ return DNSBLConfEntry::I_KILL;
+ if (stdalgo::string::equalsci(action, "kline"))
+ return DNSBLConfEntry::I_KLINE;
+ if (stdalgo::string::equalsci(action, "zline"))
+ return DNSBLConfEntry::I_ZLINE;
+ if (stdalgo::string::equalsci(action, "gline"))
+ return DNSBLConfEntry::I_GLINE;
+ if (stdalgo::string::equalsci(action, "mark"))
+ return DNSBLConfEntry::I_MARK;
+ return DNSBLConfEntry::I_UNKNOWN;
+ }
+ public:
+ ModuleDNSBL()
+ : Stats::EventListener(this)
+ , DNS(this, "DNS")
+ , nameExt("dnsbl_match", ExtensionItem::EXT_USER, this)
+ , countExt("dnsbl_pending", ExtensionItem::EXT_USER, this)
+ {
+ }
+
+ void init() CXX11_OVERRIDE
+ {
+ ServerInstance->SNO->EnableSnomask('d', "DNSBL");
+ }
+
+ void Prioritize() CXX11_OVERRIDE
+ {
+ Module* corexline = ServerInstance->Modules->Find("core_xline");
+ ServerInstance->Modules->SetPriority(this, I_OnSetUserIP, PRIORITY_AFTER, corexline);
+ }
+
+ Version GetVersion() CXX11_OVERRIDE
+ {
+ return Version("Allows the server administrator to check the IP address of connecting users against a DNSBL.", VF_VENDOR);
+ }
+
+ /** Fill our conf vector with data
+ */
+ void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
+ {
+ DNSBLConfList newentries;
+
+ ConfigTagList dnsbls = ServerInstance->Config->ConfTags("dnsbl");
+ for(ConfigIter i = dnsbls.first; i != dnsbls.second; ++i)
+ {
+ ConfigTag* tag = i->second;
+ reference<DNSBLConfEntry> e = new DNSBLConfEntry();
+
+ e->name = tag->getString("name");
+ e->ident = tag->getString("ident");
+ e->host = tag->getString("host");
+ e->reason = tag->getString("reason", "Your IP has been blacklisted.", 1);
+ e->domain = tag->getString("domain");
+
+ if (stdalgo::string::equalsci(tag->getString("type"), "bitmask"))
+ {
+ e->type = DNSBLConfEntry::A_BITMASK;
+ e->bitmask = tag->getUInt("bitmask", 0, 0, UINT_MAX);
+ }
+ else
+ {
+ memset(e->records, 0, sizeof(e->records));
+ e->type = DNSBLConfEntry::A_RECORD;
+ irc::portparser portrange(tag->getString("records"), false);
+ long item = -1;
+ while ((item = portrange.GetToken()))
+ e->records[item] = 1;
+ }
+
+ e->banaction = str2banaction(tag->getString("action"));
+ e->duration = tag->getDuration("duration", 60, 1);
+
+ /* Use portparser for record replies */
+
+ /* yeah, logic here is a little messy */
+ if ((e->bitmask <= 0) && (DNSBLConfEntry::A_BITMASK == e->type))
+ {
+ throw ModuleException("Invalid <dnsbl:bitmask> at " + tag->getTagLocation());
+ }
+ else if (e->name.empty())
+ {
+ throw ModuleException("Empty <dnsbl:name> at " + tag->getTagLocation());
+ }
+ else if (e->domain.empty())
+ {
+ throw ModuleException("Empty <dnsbl:domain> at " + tag->getTagLocation());
+ }
+ else if (e->banaction == DNSBLConfEntry::I_UNKNOWN)
+ {
+ throw ModuleException("Unknown <dnsbl:action> at " + tag->getTagLocation());
+ }
+ else
+ {
+ /* add it, all is ok */
+ newentries.push_back(e);
+ }
+ }
+
+ DNSBLConfEntries.swap(newentries);
+ }
+
+ void OnSetUserIP(LocalUser* user) CXX11_OVERRIDE
+ {
+ if (user->exempt || user->quitting || !DNS)
+ return;
+
+ // Clients can't be in a DNSBL if they aren't connected via IPv4 or IPv6.
+ if (user->client_sa.family() != AF_INET && user->client_sa.family() != AF_INET6)
+ return;
+
+ if (user->MyClass)
+ {
+ if (!user->MyClass->config->getBool("usednsbl", true))
+ return;
+ }
+ else
+ {
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "User has no connect class in OnSetUserIP");
+ return;
+ }
+
+ std::string reversedip;
+ if (user->client_sa.family() == AF_INET)
+ {
+ unsigned int a, b, c, d;
+ d = (unsigned int) (user->client_sa.in4.sin_addr.s_addr >> 24) & 0xFF;
+ c = (unsigned int) (user->client_sa.in4.sin_addr.s_addr >> 16) & 0xFF;
+ b = (unsigned int) (user->client_sa.in4.sin_addr.s_addr >> 8) & 0xFF;
+ a = (unsigned int) user->client_sa.in4.sin_addr.s_addr & 0xFF;
+
+ reversedip = ConvToStr(d) + "." + ConvToStr(c) + "." + ConvToStr(b) + "." + ConvToStr(a);
+ }
+ else if (user->client_sa.family() == AF_INET6)
+ {
+ const unsigned char* ip = user->client_sa.in6.sin6_addr.s6_addr;
+
+ std::string buf = BinToHex(ip, 16);
+ for (std::string::const_reverse_iterator it = buf.rbegin(); it != buf.rend(); ++it)
+ {
+ reversedip.push_back(*it);
+ reversedip.push_back('.');
+ }
+ reversedip.erase(reversedip.length() - 1, 1);
+ }
+ else
+ return;
+
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Reversed IP %s -> %s", user->GetIPString().c_str(), reversedip.c_str());
+
+ countExt.set(user, DNSBLConfEntries.size());
+
+ // For each DNSBL, we will run through this lookup
+ for (unsigned i = 0; i < DNSBLConfEntries.size(); ++i)
+ {
+ // Fill hostname with a dnsbl style host (d.c.b.a.domain.tld)
+ std::string hostname = reversedip + "." + DNSBLConfEntries[i]->domain;
+
+ /* now we'd need to fire off lookups for `hostname'. */
+ DNSBLResolver *r = new DNSBLResolver(*this->DNS, this, nameExt, countExt, hostname, user, DNSBLConfEntries[i]);
+ try
+ {
+ this->DNS->Process(r);
+ }
+ catch (DNS::Exception &ex)
+ {
+ delete r;
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, ex.GetReason());
+ }
+
+ if (user->quitting)
+ break;
+ }
+ }
+
+ ModResult OnSetConnectClass(LocalUser* user, ConnectClass* myclass) CXX11_OVERRIDE
+ {
+ std::string dnsbl;
+ if (!myclass->config->readString("dnsbl", dnsbl))
+ return MOD_RES_PASSTHRU;
+
+ std::string* match = nameExt.get(user);
+ if (!match)
+ {
+ ServerInstance->Logs->Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is not suitable as it requires a DNSBL mark",
+ myclass->GetName().c_str());
+ return MOD_RES_DENY;
+ }
+
+ if (!InspIRCd::Match(*match, dnsbl))
+ {
+ ServerInstance->Logs->Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is not suitable as the DNSBL mark (%s) does not match %s",
+ myclass->GetName().c_str(), match->c_str(), dnsbl.c_str());
+ return MOD_RES_DENY;
+ }
+
+ return MOD_RES_PASSTHRU;
+ }
+
+ ModResult OnCheckReady(LocalUser *user) CXX11_OVERRIDE
+ {
+ if (countExt.get(user))
+ return MOD_RES_DENY;
+ return MOD_RES_PASSTHRU;
+ }
+
+ ModResult OnStats(Stats::Context& stats) CXX11_OVERRIDE
+ {
+ if (stats.GetSymbol() != 'd')
+ return MOD_RES_PASSTHRU;
+
+ unsigned long total_hits = 0;
+ unsigned long total_misses = 0;
+ unsigned long total_errors = 0;
+ for (std::vector<reference<DNSBLConfEntry> >::const_iterator i = DNSBLConfEntries.begin(); i != DNSBLConfEntries.end(); ++i)
+ {
+ total_hits += (*i)->stats_hits;
+ total_misses += (*i)->stats_misses;
+ total_errors += (*i)->stats_errors;
+
+ stats.AddRow(304, InspIRCd::Format("DNSBLSTATS \"%s\" had %lu hits, %lu misses, and %lu errors",
+ (*i)->name.c_str(), (*i)->stats_hits, (*i)->stats_misses, (*i)->stats_errors));
+ }
+
+ stats.AddRow(304, "DNSBLSTATS Total hits: " + ConvToStr(total_hits));
+ stats.AddRow(304, "DNSBLSTATS Total misses: " + ConvToStr(total_misses));
+ stats.AddRow(304, "DNSBLSTATS Total errors: " + ConvToStr(total_errors));
+ return MOD_RES_PASSTHRU;
+ }
+};
+
+MODULE_INIT(ModuleDNSBL)
projects / user / henk / code / inspircd.git / blobdiff