qcsrc/server/ipban.qc

   1 /*
   2  * Protocol of online ban list:
   3  *
   4  * - Reporting a ban:
   5  *     GET g_ban_sync_uri?action=ban&hostname=...&ip=xxx.xxx.xxx&duration=nnnn&reason=...................
   6  *     (IP 1, 2, 3, or 4 octets, 3 octets for example is a /24 mask)
   7  * - Removing a ban:
   8  *     GET g_ban_sync_uri?action=unban&hostname=...&ip=xxx.xxx.xxx
   9  * - Querying the ban list
  10  *     GET g_ban_sync_uri?action=list&hostname=...&servers=xxx.xxx.xxx.xxx;xxx.xxx.xxx.xxx;...
  11  *
  12  *     shows the bans from the listed servers, and possibly others.
  13  *     Format of a ban is ASCII plain text, four lines per ban, delimited by
  14  *     newline ONLY (no carriage return):
  15  *
  16  *     IP address (also 1, 2, 3, or 4 octets, delimited by dot)
  17  *     time left in seconds
  18  *     reason of the ban
  19  *     server IP that registered the ban
  20  */
  21
  22 #define MAX_IPBAN_URIS (URI_GET_IPBAN_END - URI_GET_IPBAN + 1)
  23
  24 float Ban_Insert(string ip, float bantime, string reason, float dosync);
  25
  26 void OnlineBanList_SendBan(string ip, float bantime, string reason)
  27 {
  28         string uri;
  29         float i, n;
  30
  31         uri = strcat(     "action=ban&hostname=", uri_escape(autocvar_hostname));
  32         uri = strcat(uri, "&ip=", uri_escape(ip));
  33         uri = strcat(uri, "&duration=", ftos(bantime));
  34         uri = strcat(uri, "&reason=", uri_escape(reason));
  35
  36         n = tokenize_console(autocvar_g_ban_sync_uri);
  37         if(n >= MAX_IPBAN_URIS)
  38                 n = MAX_IPBAN_URIS;
  39         for(i = 0; i < n; ++i)
  40         {
  41                 if(strstrofs(argv(i), "?", 0) >= 0)
  42                         uri_get(strcat(argv(i), "&", uri), URI_GET_DISCARD); // 0 = "discard" callback target
  43                 else
  44                         uri_get(strcat(argv(i), "?", uri), URI_GET_DISCARD); // 0 = "discard" callback target
  45         }
  46 }
  47
  48 void OnlineBanList_SendUnban(string ip)
  49 {
  50         string uri;
  51         float i, n;
  52
  53         uri = strcat(     "action=unban&hostname=", uri_escape(autocvar_hostname));
  54         uri = strcat(uri, "&ip=", uri_escape(ip));
  55
  56         n = tokenize_console(autocvar_g_ban_sync_uri);
  57         if(n >= MAX_IPBAN_URIS)
  58                 n = MAX_IPBAN_URIS;
  59         for(i = 0; i < n; ++i)
  60         {
  61                 if(strstrofs(argv(i), "?", 0) >= 0)
  62                         uri_get(strcat(argv(i), "&", uri), URI_GET_DISCARD); // 0 = "discard" callback target
  63                 else
  64                         uri_get(strcat(argv(i), "?", uri), URI_GET_DISCARD); // 0 = "discard" callback target
  65         }
  66 }
  67
  68 string OnlineBanList_Servers;
  69 float OnlineBanList_Timeout;
  70 float OnlineBanList_RequestWaiting[MAX_IPBAN_URIS];
  71
  72 void OnlineBanList_URI_Get_Callback(float id, float status, string data)
  73 {
  74         float n, i, j, l;
  75         string ip;
  76         float timeleft;
  77         string reason;
  78         string serverip;
  79         float syncinterval;
  80         string uri;
  81
  82         id -= URI_GET_IPBAN;
  83
  84         if(id >= MAX_IPBAN_URIS)
  85         {
  86                 print("Received ban list for invalid ID\n");
  87                 return;
  88         }
  89
  90         tokenize_console(autocvar_g_ban_sync_uri);
  91         uri = argv(id);
  92
  93         print("Received ban list from ", uri, ": ");
  94
  95         if(OnlineBanList_RequestWaiting[id] == 0)
  96         {
  97                 print("rejected (unexpected)\n");
  98                 return;
  99         }
 100
 101         OnlineBanList_RequestWaiting[id] = 0;
 102
 103         if(time > OnlineBanList_Timeout)
 104         {
 105                 print("rejected (too late)\n");
 106                 return;
 107         }
 108
 109         syncinterval = autocvar_g_ban_sync_interval;
 110         if(syncinterval == 0)
 111         {
 112                 print("rejected (syncing disabled)\n");
 113                 return;
 114         }
 115         if(syncinterval > 0)
 116                 syncinterval *= 60;
 117
 118         if(status != 0)
 119         {
 120                 print("error: status is ", ftos(status), "\n");
 121                 return;
 122         }
 123
 124         if(substring(data, 0, 1) == "<")
 125         {
 126                 print("error: received HTML instead of a ban list\n");
 127                 return;
 128         }
 129
 130         if(strstrofs(data, "\r", 0) != -1)
 131         {
 132                 print("error: received carriage returns\n");
 133                 return;
 134         }
 135
 136         if(data == "")
 137                 n = 0;
 138         else
 139                 n = tokenizebyseparator(data, "\n");
 140
 141         if(mod(n, 4) != 0)
 142         {
 143                 print("error: received invalid item count: ", ftos(n), "\n");
 144                 return;
 145         }
 146
 147         print("OK, ", ftos(n / 4), " items\n");
 148
 149         for(i = 0; i < n; i += 4)
 150         {
 151                 ip = argv(i);
 152                 timeleft = stof(argv(i + 1));
 153                 reason = argv(i + 2);
 154                 serverip = argv(i + 3);
 155
 156                 dprint("received ban list item ", ftos(i / 4), ": ip=", ip);
 157                 dprint(" timeleft=", ftos(timeleft), " reason=", reason);
 158                 dprint(" serverip=", serverip, "\n");
 159
 160                 timeleft -= 1.5 * autocvar_g_ban_sync_timeout;
 161                 if(timeleft < 0)
 162                         continue;
 163
 164                 l = strlen(ip);
 165                 if(l != 44) // length 44 is a cryptographic ID
 166                 {
 167                         for(j = 0; j < l; ++j)
 168                                 if(strstrofs("0123456789.", substring(ip, j, 1), 0) == -1)
 169                                 {
 170                                         print("Invalid character ", substring(ip, j, 1), " in IP address ", ip, ". Skipping this ban.\n");
 171                                         goto skip;
 172                                 }
 173                 }
 174
 175                 if(autocvar_g_ban_sync_trusted_servers_verify)
 176                         if((strstrofs(strcat(";", OnlineBanList_Servers, ";"), strcat(";", serverip, ";"), 0) == -1))
 177                                 continue;
 178
 179                 if(syncinterval > 0)
 180                         timeleft = min(syncinterval + (OnlineBanList_Timeout - time) + 5, timeleft);
 181                         // the ban will be prolonged on the next sync
 182                         // or expire 5 seconds after the next timeout
 183                 Ban_Insert(ip, timeleft, strcat("ban synced from ", serverip, " at ", uri), 0);
 184                 print("Ban list syncing: accepted ban of ", ip, " by ", serverip, " at ", uri, ": ");
 185                 print(reason, "\n");
 186
 187 :skip
 188         }
 189 }
 190
 191 void OnlineBanList_Think()
 192 {
 193         float argc;
 194         string uri;
 195         float i, n;
 196
 197         if(autocvar_g_ban_sync_uri == "")
 198                 goto killme;
 199         if(autocvar_g_ban_sync_interval == 0) // < 0 is okay, it means "sync on level start only"
 200                 goto killme;
 201         argc = tokenize_console(autocvar_g_ban_sync_trusted_servers);
 202         if(argc == 0)
 203                 goto killme;
 204
 205         if(OnlineBanList_Servers)
 206                 strunzone(OnlineBanList_Servers);
 207         OnlineBanList_Servers = argv(0);
 208         for(i = 1; i < argc; ++i)
 209                 OnlineBanList_Servers = strcat(OnlineBanList_Servers, ";", argv(i));
 210         OnlineBanList_Servers = strzone(OnlineBanList_Servers);
 211
 212         uri = strcat(     "action=list&hostname=", uri_escape(autocvar_hostname));
 213         uri = strcat(uri, "&servers=", uri_escape(OnlineBanList_Servers));
 214
 215         OnlineBanList_Timeout = time + autocvar_g_ban_sync_timeout;
 216
 217         n = tokenize_console(autocvar_g_ban_sync_uri);
 218         if(n >= MAX_IPBAN_URIS)
 219                 n = MAX_IPBAN_URIS;
 220         for(i = 0; i < n; ++i)
 221         {
 222                 if(OnlineBanList_RequestWaiting[i])
 223                         continue;
 224                 OnlineBanList_RequestWaiting[i] = 1;
 225                 if(strstrofs(argv(i), "?", 0) >= 0)
 226                         uri_get(strcat(argv(i), "&", uri), URI_GET_IPBAN + i); // 1000 = "banlist" callback target
 227                 else
 228                         uri_get(strcat(argv(i), "?", uri), URI_GET_IPBAN + i); // 1000 = "banlist" callback target
 229         }
 230
 231         if(autocvar_g_ban_sync_interval > 0)
 232                 self.nextthink = time + max(60, autocvar_g_ban_sync_interval * 60);
 233         else
 234                 goto killme;
 235         return;
 236
 237 :killme
 238         remove(self);
 239 }
 240
 241 #define BAN_MAX 256
 242 float ban_loaded;
 243 string ban_ip[BAN_MAX];
 244 float ban_expire[BAN_MAX];
 245 float ban_count;
 246
 247 string ban_ip1;
 248 string ban_ip2;
 249 string ban_ip3;
 250 string ban_ip4;
 251 string ban_idfp;
 252
 253 void Ban_SaveBans()
 254 {
 255         string out;
 256         float i;
 257
 258         if(!ban_loaded)
 259                 return;
 260
 261         // version of list
 262         out = "1";
 263         for(i = 0; i < ban_count; ++i)
 264         {
 265                 if(time > ban_expire[i])
 266                         continue;
 267                 out = strcat(out, " ", ban_ip[i]);
 268                 out = strcat(out, " ", ftos(ban_expire[i] - time));
 269         }
 270         if(strlen(out) <= 1) // no real entries
 271                 cvar_set("g_banned_list", "");
 272         else
 273                 cvar_set("g_banned_list", out);
 274 }
 275
 276 float Ban_Delete(float i)
 277 {
 278         if(i < 0)
 279                 return FALSE;
 280         if(i >= ban_count)
 281                 return FALSE;
 282         if(ban_expire[i] == 0)
 283                 return FALSE;
 284         if(ban_expire[i] > 0)
 285         {
 286                 OnlineBanList_SendUnban(ban_ip[i]);
 287                 strunzone(ban_ip[i]);
 288         }
 289         ban_expire[i] = 0;
 290         ban_ip[i] = "";
 291         Ban_SaveBans();
 292         return TRUE;
 293 }
 294
 295 void Ban_LoadBans()
 296 {
 297         float i, n;
 298         for(i = 0; i < ban_count; ++i)
 299                 Ban_Delete(i);
 300         ban_count = 0;
 301         ban_loaded = TRUE;
 302         n = tokenize_console(autocvar_g_banned_list);
 303         if(stof(argv(0)) == 1)
 304         {
 305                 ban_count = (n - 1) / 2;
 306                 for(i = 0; i < ban_count; ++i)
 307                 {
 308                         ban_ip[i] = strzone(argv(2*i+1));
 309                         ban_expire[i] = time + stof(argv(2*i+2));
 310                 }
 311         }
 312
 313         entity e;
 314         e = spawn();
 315         e.classname = "bansyncer";
 316         e.think = OnlineBanList_Think;
 317         e.nextthink = time + 1;
 318 }
 319
 320 void Ban_View()
 321 {
 322         float i, n;
 323         string msg;
 324
 325         print("^2Listing all existing active bans:\n");
 326
 327         for(i = 0; i < ban_count; ++i)
 328         {
 329                 if(time > ban_expire[i])
 330                         continue;
 331
 332                 ++n; // total number of existing bans
 333
 334                 msg = strcat("#", ftos(i), ": ");
 335                 msg = strcat(msg, ban_ip[i], " is still banned for ");
 336                 msg = strcat(msg, ftos(ban_expire[i] - time), " seconds");
 337
 338                 print("  ", msg, "\n");
 339         }
 340
 341         print("^2Done listing all active (", ftos(n), ") bans.\n");
 342 }
 343
 344 float Ban_GetClientIP(entity client)
 345 {
 346         // we can't use tokenizing here, as this is called during ban list parsing
 347         float i1, i2, i3, i4;
 348         string s;
 349
 350         if(client.crypto_keyfp)
 351                 ban_idfp = client.crypto_idfp;
 352         else
 353                 ban_idfp = string_null;
 354
 355         s = client.netaddress;
 356
 357         i1 = strstrofs(s, ".", 0);
 358         if(i1 < 0)
 359                 goto ipv6;
 360         i2 = strstrofs(s, ".", i1 + 1);
 361         if(i2 < 0)
 362                 return FALSE;
 363         i3 = strstrofs(s, ".", i2 + 1);
 364         if(i3 < 0)
 365                 return FALSE;
 366         i4 = strstrofs(s, ".", i3 + 1);
 367         if(i4 >= 0)
 368                 s = substring(s, 0, i4);
 369
 370         ban_ip1 = substring(s, 0, i1); // 8
 371         ban_ip2 = substring(s, 0, i2); // 16
 372         ban_ip3 = substring(s, 0, i3); // 24
 373         ban_ip4 = strcat1(s); // 32
 374         return TRUE;
 375
 376 :ipv6
 377         i1 = strstrofs(s, ":", 0);
 378         if(i1 < 0)
 379                 return FALSE;
 380         i1 = strstrofs(s, ":", i1 + 1);
 381         if(i1 < 0)
 382                 return FALSE;
 383         i2 = strstrofs(s, ":", i1 + 1);
 384         if(i2 < 0)
 385                 return FALSE;
 386         i3 = strstrofs(s, ":", i2 + 1);
 387         if(i3 < 0)
 388                 return FALSE;
 389
 390         ban_ip1 = strcat(substring(s, 0, i1), "::/32"); // 32
 391         ban_ip2 = strcat(substring(s, 0, i2), "::/48"); // 48
 392         ban_ip4 = strcat(substring(s, 0, i3), "::/64"); // 64
 393
 394         if(i3 - i2 > 3) // means there is more than 2 digits and a : in the range
 395                 ban_ip3 = strcat(substring(s, 0, i2), ":", substring(s, i2 + 1, i3 - i2 - 3), "00::/56");
 396         else
 397                 ban_ip3 = strcat(substring(s, 0, i2), ":0::/56");
 398
 399         return TRUE;
 400 }
 401
 402 float Ban_IsClientBanned(entity client, float idx)
 403 {
 404         float i, b, e, ipbanned;
 405         if(!ban_loaded)
 406                 Ban_LoadBans();
 407         if(!Ban_GetClientIP(client))
 408                 return FALSE;
 409         if(idx < 0)
 410         {
 411                 b = 0;
 412                 e = ban_count;
 413         }
 414         else
 415         {
 416                 b = idx;
 417                 e = idx + 1;
 418         }
 419         ipbanned = FALSE;
 420         for(i = b; i < e; ++i)
 421         {
 422                 string s;
 423                 if(time > ban_expire[i])
 424                         continue;
 425                 s = ban_ip[i];
 426                 if(ban_ip1 == s) ipbanned = TRUE;
 427                 if(ban_ip2 == s) ipbanned = TRUE;
 428                 if(ban_ip3 == s) ipbanned = TRUE;
 429                 if(ban_ip4 == s) ipbanned = TRUE;
 430                 if(ban_idfp == s) return TRUE;
 431         }
 432         if(ipbanned)
 433                 if(!autocvar_g_banned_list_idmode || !ban_idfp)
 434                         return TRUE;
 435         return FALSE;
 436 }
 437
 438 float Ban_MaybeEnforceBan(entity client)
 439 {
 440         if(Ban_IsClientBanned(client, -1))
 441         {
 442                 string s;
 443                 s = strcat("^1NOTE:^7 banned client ", client.netaddress, " just tried to enter\n");
 444                 dropclient(client);
 445                 bprint(s);
 446                 return TRUE;
 447         }
 448         return FALSE;
 449 }
 450
 451 .float ban_checked;
 452 float Ban_MaybeEnforceBanOnce(entity client)
 453 {
 454         if(client.ban_checked)
 455                 return FALSE;
 456         client.ban_checked = TRUE;
 457         return Ban_MaybeEnforceBan(self);
 458 }
 459
 460 string Ban_Enforce(float i, string reason)
 461 {
 462         string s;
 463         entity e;
 464
 465         // Enforce our new ban
 466         s = "";
 467         FOR_EACH_REALCLIENT(e)
 468                 if(Ban_IsClientBanned(e, i))
 469                 {
 470                         if(reason != "")
 471                         {
 472                                 if(s == "")
 473                                         reason = strcat(reason, ": affects ");
 474                                 else
 475                                         reason = strcat(reason, ", ");
 476                                 reason = strcat(reason, e.netname);
 477                         }
 478                         s = strcat(s, "^1NOTE:^7 banned client ", e.netaddress, "^7 has to go\n");
 479                         dropclient(e);
 480                 }
 481         bprint(s);
 482
 483         return reason;
 484 }
 485
 486 float Ban_Insert(string ip, float bantime, string reason, float dosync)
 487 {
 488         float i;
 489         float j;
 490         float bestscore;
 491
 492         // already banned?
 493         for(i = 0; i < ban_count; ++i)
 494                 if(ban_ip[i] == ip)
 495                 {
 496                         // prolong the ban
 497                         if(time + bantime > ban_expire[i])
 498                         {
 499                                 ban_expire[i] = time + bantime;
 500                                 dprint(ip, "'s ban has been prolonged to ", ftos(bantime), " seconds from now\n");
 501                         }
 502                         else
 503                                 dprint(ip, "'s ban is still active until ", ftos(ban_expire[i] - time), " seconds from now\n");
 504
 505                         // and enforce
 506                         reason = Ban_Enforce(i, reason);
 507
 508                         // and abort
 509                         if(dosync)
 510                                 if(reason != "")
 511                                         if(substring(reason, 0, 1) != "~") // like IRC: unauthenticated banner
 512                                                 OnlineBanList_SendBan(ip, bantime, reason);
 513
 514                         return FALSE;
 515                 }
 516
 517         // do we have a free slot?
 518         for(i = 0; i < ban_count; ++i)
 519                 if(time > ban_expire[i])
 520                         break;
 521         // no free slot? Then look for the one who would get unbanned next
 522         if(i >= BAN_MAX)
 523         {
 524                 i = 0;
 525                 bestscore = ban_expire[i];
 526                 for(j = 1; j < ban_count; ++j)
 527                 {
 528                         if(ban_expire[j] < bestscore)
 529                         {
 530                                 i = j;
 531                                 bestscore = ban_expire[i];
 532                         }
 533                 }
 534         }
 535         // if we replace someone, will we be banned longer than him (so long-term
 536         // bans never get overridden by short-term bans)
 537         if(i < ban_count)
 538         if(ban_expire[i] > time + bantime)
 539         {
 540                 print(ip, " could not get banned due to no free ban slot\n");
 541                 return FALSE;
 542         }
 543         // okay, insert our new victim as i
 544         Ban_Delete(i);
 545         dprint(ip, " has been banned for ", ftos(bantime), " seconds\n");
 546         ban_expire[i] = time + bantime;
 547         ban_ip[i] = strzone(ip);
 548         ban_count = max(ban_count, i + 1);
 549
 550         Ban_SaveBans();
 551
 552         reason = Ban_Enforce(i, reason);
 553
 554         // and abort
 555         if(dosync)
 556                 if(reason != "")
 557                         if(substring(reason, 0, 1) != "~") // like IRC: unauthenticated banner
 558                                 OnlineBanList_SendBan(ip, bantime, reason);
 559
 560         return TRUE;
 561 }
 562
 563 void Ban_KickBanClient(entity client, float bantime, float masksize, string reason)
 564 {
 565         string ip, id;
 566         if(!Ban_GetClientIP(client))
 567         {
 568                 sprint(client, strcat("Kickbanned: ", reason, "\n"));
 569                 dropclient(client);
 570                 return;
 571         }
 572
 573         // who to ban?
 574         switch(masksize)
 575         {
 576                 case 1:
 577                         ip = strcat1(ban_ip1);
 578                         break;
 579                 case 2:
 580                         ip = strcat1(ban_ip2);
 581                         break;
 582                 case 3:
 583                         ip = strcat1(ban_ip3);
 584                         break;
 585                 case 4:
 586                 default:
 587                         ip = strcat1(ban_ip4);
 588                         break;
 589         }
 590         if(ban_idfp)
 591                 id = strcat1(ban_idfp);
 592         else
 593                 id = string_null;
 594
 595         Ban_Insert(ip, bantime, reason, 1);
 596         if(id)
 597                 Ban_Insert(id, bantime, reason, 1);
 598         /*
 599          * not needed, as we enforce the ban in Ban_Insert anyway
 600         // and kick him
 601         sprint(client, strcat("Kickbanned: ", reason, "\n"));
 602         dropclient(client);
 603          */
 604 }