qcsrc/server/ipban.qc

   1 /*
   2  * Protocol of online ban list:
   3  *
   4  * - Reporting a ban:
   5  *     GET g_ban_sync_uri?action=ban&hostname=...&ip=xxx.xxx.xxx&duration=nnnn&reason=...................
   6  *     (IP 1, 2, 3, or 4 octets, 3 octets for example is a /24 mask)
   7  * - Removing a ban:
   8  *     GET g_ban_sync_uri?action=unban&hostname=...&ip=xxx.xxx.xxx
   9  * - Querying the ban list
  10  *     GET g_ban_sync_uri?action=list&hostname=...&servers=xxx.xxx.xxx.xxx;xxx.xxx.xxx.xxx;...
  11  *
  12  *     shows the bans from the listed servers, and possibly others.
  13  *     Format of a ban is ASCII plain text, four lines per ban, delimited by
  14  *     newline ONLY (no carriage return):
  15  *
  16  *     IP address (also 1, 2, 3, or 4 octets, delimited by dot)
  17  *     time left in seconds
  18  *     reason of the ban
  19  *     server IP that registered the ban
  20  */
  21
  22 #define MAX_IPBAN_URIS (URI_GET_IPBAN_END - URI_GET_IPBAN + 1)
  23
  24 float Ban_Insert(string ip, float bantime, string reason, float dosync);
  25
  26 void OnlineBanList_SendBan(string ip, float bantime, string reason)
  27 {
  28         string uri;
  29         float i, n;
  30
  31         uri = strcat(     "action=ban&hostname=", uri_escape(autocvar_hostname));
  32         uri = strcat(uri, "&ip=", uri_escape(ip));
  33         uri = strcat(uri, "&duration=", ftos(bantime));
  34         uri = strcat(uri, "&reason=", uri_escape(reason));
  35
  36         n = tokenize_console(autocvar_g_ban_sync_uri);
  37         if(n >= MAX_IPBAN_URIS)
  38                 n = MAX_IPBAN_URIS;
  39         for(i = 0; i < n; ++i)
  40         {
  41                 if(strstrofs(argv(i), "?", 0) >= 0)
  42                         uri_get(strcat(argv(i), "&", uri), URI_GET_DISCARD); // 0 = "discard" callback target
  43                 else
  44                         uri_get(strcat(argv(i), "?", uri), URI_GET_DISCARD); // 0 = "discard" callback target
  45         }
  46 }
  47
  48 void OnlineBanList_SendUnban(string ip)
  49 {
  50         string uri;
  51         float i, n;
  52
  53         uri = strcat(     "action=unban&hostname=", uri_escape(autocvar_hostname));
  54         uri = strcat(uri, "&ip=", uri_escape(ip));
  55
  56         n = tokenize_console(autocvar_g_ban_sync_uri);
  57         if(n >= MAX_IPBAN_URIS)
  58                 n = MAX_IPBAN_URIS;
  59         for(i = 0; i < n; ++i)
  60         {
  61                 if(strstrofs(argv(i), "?", 0) >= 0)
  62                         uri_get(strcat(argv(i), "&", uri), URI_GET_DISCARD); // 0 = "discard" callback target
  63                 else
  64                         uri_get(strcat(argv(i), "?", uri), URI_GET_DISCARD); // 0 = "discard" callback target
  65         }
  66 }
  67
  68 string OnlineBanList_Servers;
  69 float OnlineBanList_Timeout;
  70 float OnlineBanList_RequestWaiting[MAX_IPBAN_URIS];
  71
  72 void OnlineBanList_URI_Get_Callback(float id, float status, string data)
  73 {
  74         float n, i, j, l;
  75         string ip;
  76         float timeleft;
  77         string reason;
  78         string serverip;
  79         float syncinterval;
  80         string uri;
  81
  82         id -= URI_GET_IPBAN;
  83
  84         if(id >= MAX_IPBAN_URIS)
  85         {
  86                 print("Received ban list for invalid ID\n");
  87                 return;
  88         }
  89
  90         tokenize_console(autocvar_g_ban_sync_uri);
  91         uri = argv(id);
  92
  93         print("Received ban list from ", uri, ": ");
  94
  95         if(OnlineBanList_RequestWaiting[id] == 0)
  96         {
  97                 print("rejected (unexpected)\n");
  98                 return;
  99         }
 100
 101         OnlineBanList_RequestWaiting[id] = 0;
 102
 103         if(time > OnlineBanList_Timeout)
 104         {
 105                 print("rejected (too late)\n");
 106                 return;
 107         }
 108
 109         syncinterval = autocvar_g_ban_sync_interval;
 110         if(syncinterval == 0)
 111         {
 112                 print("rejected (syncing disabled)\n");
 113                 return;
 114         }
 115         if(syncinterval > 0)
 116                 syncinterval *= 60;
 117
 118         if(status != 0)
 119         {
 120                 print("error: status is ", ftos(status), "\n");
 121                 return;
 122         }
 123
 124         if(substring(data, 0, 1) == "<")
 125         {
 126                 print("error: received HTML instead of a ban list\n");
 127                 return;
 128         }
 129
 130         if(strstrofs(data, "\r", 0) != -1)
 131         {
 132                 print("error: received carriage returns\n");
 133                 return;
 134         }
 135
 136         if(data == "")
 137                 n = 0;
 138         else
 139                 n = tokenizebyseparator(data, "\n");
 140
 141         if(mod(n, 4) != 0)
 142         {
 143                 print("error: received invalid item count: ", ftos(n), "\n");
 144                 return;
 145         }
 146
 147         print("OK, ", ftos(n / 4), " items\n");
 148
 149         for(i = 0; i < n; i += 4)
 150         {
 151                 ip = argv(i);
 152                 timeleft = stof(argv(i + 1));
 153                 reason = argv(i + 2);
 154                 serverip = argv(i + 3);
 155
 156                 dprint("received ban list item ", ftos(i / 4), ": ip=", ip);
 157                 dprint(" timeleft=", ftos(timeleft), " reason=", reason);
 158                 dprint(" serverip=", serverip, "\n");
 159
 160                 timeleft -= 1.5 * autocvar_g_ban_sync_timeout;
 161                 if(timeleft < 0)
 162                         continue;
 163
 164                 l = strlen(ip);
 165                 if(l != 44) // length 44 is a cryptographic ID
 166                 {
 167                         for(j = 0; j < l; ++j)
 168                                 if(strstrofs("0123456789.", substring(ip, j, 1), 0) == -1)
 169                                 {
 170                                         print("Invalid character ", substring(ip, j, 1), " in IP address ", ip, ". Skipping this ban.\n");
 171                                         goto skip;
 172                                 }
 173                 }
 174
 175                 if(autocvar_g_ban_sync_trusted_servers_verify)
 176                         if((strstrofs(strcat(";", OnlineBanList_Servers, ";"), strcat(";", serverip, ";"), 0) == -1))
 177                                 continue;
 178
 179                 if(syncinterval > 0)
 180                         timeleft = min(syncinterval + (OnlineBanList_Timeout - time) + 5, timeleft);
 181                         // the ban will be prolonged on the next sync
 182                         // or expire 5 seconds after the next timeout
 183                 Ban_Insert(ip, timeleft, strcat("ban synced from ", serverip, " at ", uri), 0);
 184                 print("Ban list syncing: accepted ban of ", ip, " by ", serverip, " at ", uri, ": ");
 185                 print(reason, "\n");
 186
 187 :skip
 188         }
 189 }
 190
 191 void OnlineBanList_Think()
 192 {
 193         float argc;
 194         string uri;
 195         float i, n;
 196
 197         if(autocvar_g_ban_sync_uri == "")
 198                 goto killme;
 199         if(autocvar_g_ban_sync_interval == 0) // < 0 is okay, it means "sync on level start only"
 200                 goto killme;
 201         argc = tokenize_console(autocvar_g_ban_sync_trusted_servers);
 202         if(argc == 0)
 203                 goto killme;
 204
 205         if(OnlineBanList_Servers)
 206                 strunzone(OnlineBanList_Servers);
 207         OnlineBanList_Servers = argv(0);
 208         for(i = 1; i < argc; ++i)
 209                 OnlineBanList_Servers = strcat(OnlineBanList_Servers, ";", argv(i));
 210         OnlineBanList_Servers = strzone(OnlineBanList_Servers);
 211
 212         uri = strcat(     "action=list&hostname=", uri_escape(autocvar_hostname));
 213         uri = strcat(uri, "&servers=", uri_escape(OnlineBanList_Servers));
 214
 215         OnlineBanList_Timeout = time + autocvar_g_ban_sync_timeout;
 216
 217         n = tokenize_console(autocvar_g_ban_sync_uri);
 218         if(n >= MAX_IPBAN_URIS)
 219                 n = MAX_IPBAN_URIS;
 220         for(i = 0; i < n; ++i)
 221         {
 222                 if(OnlineBanList_RequestWaiting[i])
 223                         continue;
 224                 OnlineBanList_RequestWaiting[i] = 1;
 225                 if(strstrofs(argv(i), "?", 0) >= 0)
 226                         uri_get(strcat(argv(i), "&", uri), URI_GET_IPBAN + i); // 1000 = "banlist" callback target
 227                 else
 228                         uri_get(strcat(argv(i), "?", uri), URI_GET_IPBAN + i); // 1000 = "banlist" callback target
 229         }
 230
 231         if(autocvar_g_ban_sync_interval > 0)
 232                 self.nextthink = time + max(60, autocvar_g_ban_sync_interval * 60);
 233         else
 234                 goto killme;
 235         return;
 236
 237 :killme
 238         remove(self);
 239 }
 240
 241 #define BAN_MAX 256
 242 float ban_loaded;
 243 string ban_ip[BAN_MAX];
 244 float ban_expire[BAN_MAX];
 245 float ban_count;
 246
 247 string ban_ip1;
 248 string ban_ip2;
 249 string ban_ip3;
 250 string ban_ip4;
 251 string ban_idfp;
 252
 253 void Ban_SaveBans()
 254 {
 255         string out;
 256         float i;
 257
 258         if(!ban_loaded)
 259                 return;
 260
 261         // version of list
 262         out = "1";
 263         for(i = 0; i < ban_count; ++i)
 264         {
 265                 if(time > ban_expire[i])
 266                         continue;
 267                 out = strcat(out, " ", ban_ip[i]);
 268                 out = strcat(out, " ", ftos(ban_expire[i] - time));
 269         }
 270         if(strlen(out) <= 1) // no real entries
 271                 cvar_set("g_banned_list", "");
 272         else
 273                 cvar_set("g_banned_list", out);
 274 }
 275
 276 float Ban_Delete(float i)
 277 {
 278         if(i < 0)
 279                 return FALSE;
 280         if(i >= ban_count)
 281                 return FALSE;
 282         if(ban_expire[i] == 0)
 283                 return FALSE;
 284         if(ban_expire[i] > 0)
 285         {
 286                 OnlineBanList_SendUnban(ban_ip[i]);
 287                 strunzone(ban_ip[i]);
 288         }
 289         ban_expire[i] = 0;
 290         ban_ip[i] = "";
 291         Ban_SaveBans();
 292         return TRUE;
 293 }
 294
 295 void Ban_LoadBans()
 296 {
 297         float i, n;
 298         for(i = 0; i < ban_count; ++i)
 299                 Ban_Delete(i);
 300         ban_count = 0;
 301         ban_loaded = TRUE;
 302         n = tokenize_console(autocvar_g_banned_list);
 303         if(stof(argv(0)) == 1)
 304         {
 305                 ban_count = (n - 1) / 2;
 306                 for(i = 0; i < ban_count; ++i)
 307                 {
 308                         ban_ip[i] = strzone(argv(2*i+1));
 309                         ban_expire[i] = time + stof(argv(2*i+2));
 310                 }
 311         }
 312
 313         entity e;
 314         e = spawn();
 315         e.classname = "bansyncer";
 316         e.think = OnlineBanList_Think;
 317         e.nextthink = time + 1;
 318 }
 319
 320 void Ban_View()
 321 {
 322         float i, n;
 323         string msg;
 324
 325         print("^2Listing all existing active bans:\n");
 326
 327         n = 0;
 328         for(i = 0; i < ban_count; ++i)
 329         {
 330                 if(time > ban_expire[i])
 331                         continue;
 332
 333                 ++n; // total number of existing bans
 334
 335                 msg = strcat("#", ftos(i), ": ");
 336                 msg = strcat(msg, ban_ip[i], " is still banned for ");
 337                 msg = strcat(msg, ftos(ban_expire[i] - time), " seconds");
 338
 339                 print("  ", msg, "\n");
 340         }
 341
 342         print("^2Done listing all active (", ftos(n), ") bans.\n");
 343 }
 344
 345 float Ban_GetClientIP(entity client)
 346 {
 347         // we can't use tokenizing here, as this is called during ban list parsing
 348         float i1, i2, i3, i4;
 349         string s;
 350
 351         if(client.crypto_keyfp)
 352                 ban_idfp = client.crypto_idfp;
 353         else
 354                 ban_idfp = string_null;
 355
 356         s = client.netaddress;
 357
 358         i1 = strstrofs(s, ".", 0);
 359         if(i1 < 0)
 360                 goto ipv6;
 361         i2 = strstrofs(s, ".", i1 + 1);
 362         if(i2 < 0)
 363                 return FALSE;
 364         i3 = strstrofs(s, ".", i2 + 1);
 365         if(i3 < 0)
 366                 return FALSE;
 367         i4 = strstrofs(s, ".", i3 + 1);
 368         if(i4 >= 0)
 369                 s = substring(s, 0, i4);
 370
 371         ban_ip1 = substring(s, 0, i1); // 8
 372         ban_ip2 = substring(s, 0, i2); // 16
 373         ban_ip3 = substring(s, 0, i3); // 24
 374         ban_ip4 = strcat1(s); // 32
 375         return TRUE;
 376
 377 :ipv6
 378         i1 = strstrofs(s, ":", 0);
 379         if(i1 < 0)
 380                 return FALSE;
 381         i1 = strstrofs(s, ":", i1 + 1);
 382         if(i1 < 0)
 383                 return FALSE;
 384         i2 = strstrofs(s, ":", i1 + 1);
 385         if(i2 < 0)
 386                 return FALSE;
 387         i3 = strstrofs(s, ":", i2 + 1);
 388         if(i3 < 0)
 389                 return FALSE;
 390
 391         ban_ip1 = strcat(substring(s, 0, i1), "::/32"); // 32
 392         ban_ip2 = strcat(substring(s, 0, i2), "::/48"); // 48
 393         ban_ip4 = strcat(substring(s, 0, i3), "::/64"); // 64
 394
 395         if(i3 - i2 > 3) // means there is more than 2 digits and a : in the range
 396                 ban_ip3 = strcat(substring(s, 0, i2), ":", substring(s, i2 + 1, i3 - i2 - 3), "00::/56");
 397         else
 398                 ban_ip3 = strcat(substring(s, 0, i2), ":0::/56");
 399
 400         return TRUE;
 401 }
 402
 403 float Ban_IsClientBanned(entity client, float idx)
 404 {
 405         float i, b, e, ipbanned;
 406         if(!ban_loaded)
 407                 Ban_LoadBans();
 408         if(!Ban_GetClientIP(client))
 409                 return FALSE;
 410         if(idx < 0)
 411         {
 412                 b = 0;
 413                 e = ban_count;
 414         }
 415         else
 416         {
 417                 b = idx;
 418                 e = idx + 1;
 419         }
 420         ipbanned = FALSE;
 421         for(i = b; i < e; ++i)
 422         {
 423                 string s;
 424                 if(time > ban_expire[i])
 425                         continue;
 426                 s = ban_ip[i];
 427                 if(ban_ip1 == s) ipbanned = TRUE;
 428                 if(ban_ip2 == s) ipbanned = TRUE;
 429                 if(ban_ip3 == s) ipbanned = TRUE;
 430                 if(ban_ip4 == s) ipbanned = TRUE;
 431                 if(ban_idfp == s) return TRUE;
 432         }
 433         if(ipbanned)
 434         {
 435                 if(!autocvar_g_banned_list_idmode)
 436                         return TRUE;
 437                 if (!ban_idfp)
 438                         return TRUE;
 439         }
 440         return FALSE;
 441 }
 442
 443 float Ban_MaybeEnforceBan(entity client)
 444 {
 445         if(Ban_IsClientBanned(client, -1))
 446         {
 447                 string s;
 448                 s = strcat("^1NOTE:^7 banned client ", client.netaddress, " just tried to enter\n");
 449                 dropclient(client);
 450                 bprint(s);
 451                 return TRUE;
 452         }
 453         return FALSE;
 454 }
 455
 456 .float ban_checked;
 457 float Ban_MaybeEnforceBanOnce(entity client)
 458 {
 459         if(client.ban_checked)
 460                 return FALSE;
 461         client.ban_checked = TRUE;
 462         return Ban_MaybeEnforceBan(self);
 463 }
 464
 465 string Ban_Enforce(float i, string reason)
 466 {
 467         string s;
 468         entity e;
 469
 470         // Enforce our new ban
 471         s = "";
 472         FOR_EACH_REALCLIENT(e)
 473                 if(Ban_IsClientBanned(e, i))
 474                 {
 475                         if(reason != "")
 476                         {
 477                                 if(s == "")
 478                                         reason = strcat(reason, ": affects ");
 479                                 else
 480                                         reason = strcat(reason, ", ");
 481                                 reason = strcat(reason, e.netname);
 482                         }
 483                         s = strcat(s, "^1NOTE:^7 banned client ", e.netaddress, "^7 has to go\n");
 484                         dropclient(e);
 485                 }
 486         bprint(s);
 487
 488         return reason;
 489 }
 490
 491 float Ban_Insert(string ip, float bantime, string reason, float dosync)
 492 {
 493         float i;
 494         float j;
 495         float bestscore;
 496
 497         // already banned?
 498         for(i = 0; i < ban_count; ++i)
 499                 if(ban_ip[i] == ip)
 500                 {
 501                         // prolong the ban
 502                         if(time + bantime > ban_expire[i])
 503                         {
 504                                 ban_expire[i] = time + bantime;
 505                                 dprint(ip, "'s ban has been prolonged to ", ftos(bantime), " seconds from now\n");
 506                         }
 507                         else
 508                                 dprint(ip, "'s ban is still active until ", ftos(ban_expire[i] - time), " seconds from now\n");
 509
 510                         // and enforce
 511                         reason = Ban_Enforce(i, reason);
 512
 513                         // and abort
 514                         if(dosync)
 515                                 if(reason != "")
 516                                         if(substring(reason, 0, 1) != "~") // like IRC: unauthenticated banner
 517                                                 OnlineBanList_SendBan(ip, bantime, reason);
 518
 519                         return FALSE;
 520                 }
 521
 522         // do we have a free slot?
 523         for(i = 0; i < ban_count; ++i)
 524                 if(time > ban_expire[i])
 525                         break;
 526         // no free slot? Then look for the one who would get unbanned next
 527         if(i >= BAN_MAX)
 528         {
 529                 i = 0;
 530                 bestscore = ban_expire[i];
 531                 for(j = 1; j < ban_count; ++j)
 532                 {
 533                         if(ban_expire[j] < bestscore)
 534                         {
 535                                 i = j;
 536                                 bestscore = ban_expire[i];
 537                         }
 538                 }
 539         }
 540         // if we replace someone, will we be banned longer than him (so long-term
 541         // bans never get overridden by short-term bans)
 542         if(i < ban_count)
 543         if(ban_expire[i] > time + bantime)
 544         {
 545                 print(ip, " could not get banned due to no free ban slot\n");
 546                 return FALSE;
 547         }
 548         // okay, insert our new victim as i
 549         Ban_Delete(i);
 550         dprint(ip, " has been banned for ", ftos(bantime), " seconds\n");
 551         ban_expire[i] = time + bantime;
 552         ban_ip[i] = strzone(ip);
 553         ban_count = max(ban_count, i + 1);
 554
 555         Ban_SaveBans();
 556
 557         reason = Ban_Enforce(i, reason);
 558
 559         // and abort
 560         if(dosync)
 561                 if(reason != "")
 562                         if(substring(reason, 0, 1) != "~") // like IRC: unauthenticated banner
 563                                 OnlineBanList_SendBan(ip, bantime, reason);
 564
 565         return TRUE;
 566 }
 567
 568 void Ban_KickBanClient(entity client, float bantime, float masksize, string reason)
 569 {
 570         string ip, id;
 571         if(!Ban_GetClientIP(client))
 572         {
 573                 sprint(client, strcat("Kickbanned: ", reason, "\n"));
 574                 dropclient(client);
 575                 return;
 576         }
 577
 578         // who to ban?
 579         switch(masksize)
 580         {
 581                 case 1:
 582                         ip = strcat1(ban_ip1);
 583                         break;
 584                 case 2:
 585                         ip = strcat1(ban_ip2);
 586                         break;
 587                 case 3:
 588                         ip = strcat1(ban_ip3);
 589                         break;
 590                 case 4:
 591                 default:
 592                         ip = strcat1(ban_ip4);
 593                         break;
 594         }
 595         if(ban_idfp)
 596                 id = strcat1(ban_idfp);
 597         else
 598                 id = string_null;
 599
 600         Ban_Insert(ip, bantime, reason, 1);
 601         if(id)
 602                 Ban_Insert(id, bantime, reason, 1);
 603         /*
 604          * not needed, as we enforce the ban in Ban_Insert anyway
 605         // and kick him
 606         sprint(client, strcat("Kickbanned: ", reason, "\n"));
 607         dropclient(client);
 608          */
 609 }