Something went wrong. Try again.
[READ-ONLY] Mirror of https://github.com/VibeDevelopers/Comet.
Something went wrong. Try again.
16 kB · 588 lines
C
at dev
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589/* * ircd-ratbox: A slightly useful ircd. * filter.c: Drop messages we don't like * * Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center * Copyright (C) 1996-2002 Hybrid Development Team * Copyright (C) 2002-2005 ircd-ratbox development team * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 * USA * * $Id$ */
#include "stdinc.h"#include "channel.h"#include "client.h"#include "chmode.h"#include "match.h"#include "ircd.h"#include "numeric.h"#include "send.h"#include "s_newconf.h"#include "s_conf.h"#include "s_serv.h"#include "s_user.h"#include "msg.h"#include "parse.h"#include "modules.h"#include "operhash.h"#include "inline/stringops.h"#include "msgbuf.h"#include "newconf.h"#include "logger.h"
#include <hs_common.h>#include <hs_runtime.h>
#define FILTER_DEFAULT_EXIT_MSG "Connection closed"
static const char filter_desc[] = "Filter messages using a precompiled Hyperscan database";
static int modinit(void);static void moddeinit(void);static void filter_msg_user(void *data);static void filter_msg_channel(void *data);static void filter_client_quit(void *data);static void on_client_exit(void *data);static void filter_init_conf(void *data);static void filter_conf_info(void *data);static void filter_version_info(void *data);static void filter_conf_set_sees_user_info(void *data);static void filter_conf_set_bypass_all(void *data);static void filter_conf_set_exit_message(void *data);
static void mo_setfilter(struct MsgBuf *, struct Client *, struct Client *, int, const char **);static void me_setfilter(struct MsgBuf *, struct Client *, struct Client *, int, const char **);
static char *filter_data = NULL;static size_t filter_data_len = 0;static hs_database_t *filter_db;static hs_scratch_t *filter_scratch;
static int filter_enable = 1;static int filter_sees_user_info = 0;static int filter_bypass_all = 0;static char *filter_exit_message = NULL;
static const char *cmdname[MESSAGE_TYPE_COUNT] = { [MESSAGE_TYPE_PRIVMSG] = "PRIVMSG", [MESSAGE_TYPE_NOTICE] = "NOTICE", [MESSAGE_TYPE_PART] = "PART", [MESSAGE_TYPE_TAGMSG] = "TAGMSG",};
enum filter_state { FILTER_EMPTY, FILTER_FILLING, FILTER_LOADED};
struct match_context { unsigned int actions; bool require_bypass;};
#define ACT_DROP (1 << 0)#define ACT_KILL (1 << 1)#define ACT_ALARM (1 << 2)#define ACT_BYPASS (1 << 3)
static enum filter_state state = FILTER_EMPTY;static char check_str[21] = "";
static unsigned filter_chmode, filter_umode;
mapi_hfn_list_av1 filter_hfnlist[] = { { "privmsg_user", filter_msg_user }, { "privmsg_channel", filter_msg_channel }, { "client_quit", filter_client_quit }, { "client_exit", on_client_exit }, { "conf_read_start", filter_init_conf }, { "doing_info_conf", filter_conf_info }, { "doing_version_confopts", filter_version_info }, { NULL, NULL }};
struct Message setfilter_msgtab = { "SETFILTER", 0, 0, 0, 0, {mg_unreg, mg_not_oper, mg_ignore, mg_ignore, {me_setfilter, 2}, {mo_setfilter, 2}}};
mapi_clist_av1 filter_clist[] = { &setfilter_msgtab, NULL };
DECLARE_MODULE_AV2(filter, modinit, moddeinit, filter_clist, NULL, filter_hfnlist, NULL, "0.5", filter_desc);
static intmodinit(void){ filter_umode = find_umode_slot(); if (!filter_umode) { ierror("filter: unable to allocate umode slot for +u, unloading module"); return -1; }
filter_chmode = cflag_add('u', chm_simple); if (!filter_chmode) { ierror("filter: unable to allocate cmode slot for +u, unloading module"); return -1; }
user_modes['u'] = filter_umode; construct_umodebuf(); add_conf_item("general", "filter_sees_user_info", CF_YESNO, filter_conf_set_sees_user_info); add_conf_item("general", "filter_bypass_all", CF_YESNO, filter_conf_set_bypass_all); add_conf_item("general", "filter_exit_message", CF_QSTRING, filter_conf_set_exit_message); return 0;}
static voidmoddeinit(void){ user_modes['u'] = 0; construct_umodebuf(); cflag_orphan('u'); hs_free_scratch(filter_scratch); hs_free_database(filter_db); rb_free(filter_data); rb_free(filter_exit_message); remove_conf_item("general", "filter_sees_user_info"); remove_conf_item("general", "filter_bypass_all"); remove_conf_item("general", "filter_exit_message");}
static voidfilter_init_conf(void *data){ rb_free(filter_exit_message); filter_exit_message = NULL;}
static voidfilter_conf_info(void *data_){ hook_data *data = data_; sendto_one(data->client, ":%s %d %s :%-30s %-16s [%s]", get_id(&me, data->client), RPL_INFO, get_id(data->client, data->client), "filter_sees_user_info", filter_sees_user_info ? "YES" : "NO", "Let the spamfilter engine see the hostmasks of senders");
sendto_one(data->client, ":%s %d %s :%-30s %-16s [%s]", get_id(&me, data->client), RPL_INFO, get_id(data->client, data->client), "filter_bypass_all", filter_bypass_all ? "YES" : "NO", "Let the spamfilter BYPASS action work on KILL/ALARM in addition to DROP");
sendto_one(data->client, ":%s %d %s :%-30s %-16s [%s]", get_id(&me, data->client), RPL_INFO, get_id(data->client, data->client), "filter_exit_message", filter_exit_message != NULL ? filter_exit_message : FILTER_DEFAULT_EXIT_MSG, "Message to quit users with if they hit a filter KILL action");}
static voidfilter_version_info(void *data){ if (filter_sees_user_info || filter_bypass_all) ((char *)data)['F'] = 1;}
static voidfilter_conf_set_sees_user_info(void *data){ filter_sees_user_info = *(int *)data;}
static voidfilter_conf_set_bypass_all(void *data){ filter_bypass_all = *(int *)data;}
static voidfilter_conf_set_exit_message(void *data){ rb_free(filter_exit_message); filter_exit_message = rb_strdup(data);}
static intsetfilter(const char *check, const char *data, const char **error){ if (error) *error = "unknown";
if (!strcasecmp(data, "disable")) { filter_enable = 0; sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "Filtering disabled."); return 0; } if (!strcasecmp(data, "enable")) { filter_enable = 1; sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "Filtering enabled."); return 0; }
if (strlen(check) > sizeof check_str - 1) { if (error) *error = "check string too long"; return -1; }
if (!strcasecmp(data, "new")) { if (state == FILTER_FILLING) { rb_free(filter_data); filter_data = 0; filter_data_len = 0; } state = FILTER_FILLING; strcpy(check_str, check); return 0; }
if (!strcasecmp(data, "drop")) { if (!filter_db) { if (error) *error = "no database to drop"; return -1; } hs_free_database(filter_db); filter_db = 0; return 0; }
if (!strcasecmp(data, "abort")) { if (state != FILTER_FILLING) { if (error) *error = "not filling"; return -1; } state = filter_db ? FILTER_LOADED : FILTER_EMPTY; rb_free(filter_data); filter_data = 0; filter_data_len = 0; return 0; }
if (strcmp(check, check_str) != 0) { if (error) *error = "check strings don't match"; return -1; }
if (!strcasecmp(data, "apply")) { if (state != FILTER_FILLING) { if (error) *error = "not loading anything"; return -1; } hs_database_t *db; hs_error_t r = hs_deserialize_database(filter_data, filter_data_len, &db); if (r != HS_SUCCESS) { if (error) *error = "couldn't deserialize db"; return -1; } r = hs_alloc_scratch(db, &filter_scratch); if (r != HS_SUCCESS) { if (error) *error = "couldn't allocate scratch"; hs_free_database(db); return -1; } if (filter_db) { hs_free_database(filter_db); } state = FILTER_LOADED; filter_db = db; sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "New filters loaded."); rb_free(filter_data); filter_data = 0; filter_data_len = 0; return 0; }
if (*data != '+') { if (error) *error = "unknown command or data doesn't start with +"; return -1; }
data += 1;
if (state == FILTER_FILLING) { int dl; unsigned char *d = rb_base64_decode((unsigned char *)data, strlen(data), &dl); if (!d) { if (error) *error = "invalid data"; return -1; } if (filter_data_len + dl > 10000000ul) { if (error) *error = "data over size limit"; rb_free(d); return -1; } filter_data = rb_realloc(filter_data, filter_data_len + dl); memcpy(filter_data + filter_data_len, d, dl); rb_free(d); filter_data_len += dl; } else { if (error) *error = "send \"new\" first"; return -1; } return 0;}
/* /SETFILTER [server-mask] <check> { NEW | APPLY | <data> } * <check> must be the same for the entirety of a new...data...apply run, * and exists just to ensure runs don't mix * NEW prepares a buffer to receive a hyperscan database * <data> is base64 encoded chunks of hyperscan database, which are decoded * and appended to the buffer * APPLY deserialises the buffer and sets the resulting hyperscan database * as the one to use for filtering */static voidmo_setfilter(struct MsgBuf *msgbuf, struct Client *client_p, struct Client *source_p, int parc, const char **parv){ int for_me = 0; const char *check; const char *data; if (!IsOperAdmin(source_p)) { sendto_one(source_p, form_str(ERR_NOPRIVS), me.name, source_p->name, "admin"); return; } if (parc == 4) { check = parv[2]; data = parv[3]; if(match(parv[1], me.name)) { for_me = 1; } sendto_match_servs(source_p, parv[1], CAP_ENCAP, NOCAPS, "ENCAP %s SETFILTER %s :%s", parv[1], check, data); } else if (parc == 3) { check = parv[1]; data = parv[2]; for_me = 1; } else { sendto_one_notice(source_p, ":SETFILTER needs 2 or 3 params, have %d", parc - 1); return; } if (for_me) { const char *error; int r = setfilter(check, data, &error); if (r) { sendto_one_notice(source_p, ":SETFILTER failed: %s", error); } else { sendto_one_notice(source_p, ":SETFILTER ok"); } }}
static voidme_setfilter(struct MsgBuf *msgbuf, struct Client *client_p, struct Client *source_p, int parc, const char **parv){ if(!IsPerson(source_p)) return;
const char *error; int r = setfilter(parv[1], parv[2], &error); if (r) { sendto_one_notice(source_p, ":SETFILTER failed: %s", error); }}
/* will be called for every match * hyperscan provides us one piece of information about the expression * matched, an integer ID. we're co-opting the lowest 3 bits of this * as a flag set. conveniently, this means all we really need to do * here is or the IDs together. */int match_callback(unsigned id, unsigned long long from, unsigned long long to, unsigned flags, void *context_){ struct match_context *context = context_;
if (context->require_bypass) { unsigned int bypass_mask = filter_bypass_all ? UINT_MAX : ACT_DROP; if (id & ACT_BYPASS) context->actions |= id & bypass_mask; } else context->actions |= id;
return 0;}
static char check_buffer[2000];static char clean_buffer[BUFSIZE];
unsigned match_message(const char *prefix, struct Client *source, bool require_bypass, const char *command, const char *target, const char *msg){ struct match_context ctx = { 0, require_bypass };
if (!filter_enable) return 0; if (!filter_db) return 0; if (!command) return 0;
snprintf(check_buffer, sizeof check_buffer, "%s:%s!%s@%s#%c %s%s%s :%s", prefix, filter_sees_user_info ? source->name : "*", filter_sees_user_info ? source->username : "*", filter_sees_user_info ? source->host : "*", source->user && source->user->suser[0] != '\0' ? '1' : '0', command, target ? " " : "", target ? target : "", msg); hs_error_t r = hs_scan(filter_db, check_buffer, strlen(check_buffer), 0, filter_scratch, match_callback, &ctx); if (r != HS_SUCCESS && r != HS_SCAN_TERMINATED) return 0; return ctx.actions;}
voidfilter_msg_user(void *data_){ hook_data_privmsg_user *data = data_; struct Client *s = data->source_p;
/* we only need to filter once */ if (!MyClient(s)) { return; } /* opers are immune to checking, for obvious reasons * anything sent to an oper is also immune, because that should make it * less impossible to deal with reports. */ if (IsOper(s) || IsOper(data->target_p)) { return; }
bool require_bypass = (data->target_p->umodes & filter_umode) == filter_umode; char *text = strcpy(clean_buffer, data->text); strip_colour(text); strip_unprintable(text); unsigned r = match_message("0", s, require_bypass, cmdname[data->msgtype], "0", data->text) | match_message("1", s, require_bypass, cmdname[data->msgtype], "0", text);
if (r & ACT_DROP) { if (data->msgtype == MESSAGE_TYPE_PRIVMSG) { sendto_one_numeric(s, ERR_CANNOTSENDTOCHAN, form_str(ERR_CANNOTSENDTOCHAN), data->target_p->name); } data->approved = 1; } if (r & ACT_ALARM) { sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "FILTER: %s!%s@%s [%s]", s->name, s->username, s->host, s->sockhost); } if (r & ACT_KILL) { data->approved = 1; exit_client(NULL, s, s, filter_exit_message != NULL ? filter_exit_message : FILTER_DEFAULT_EXIT_MSG); }}
voidfilter_msg_channel(void *data_){ hook_data_privmsg_channel *data = data_; struct Client *s = data->source_p;
/* we only need to filter once */ if (!MyClient(s)) { return; } /* just normal oper immunity for channels. i'd like to have a mode that * disables the filter per-channel, but that's for the future */ if (IsOper(s)) { return; }
bool require_bypass = (data->chptr->mode.mode & filter_chmode) == filter_chmode; char *text = strcpy(clean_buffer, data->text); strip_colour(text); strip_unprintable(text); unsigned r = match_message("0", s, require_bypass, cmdname[data->msgtype], data->chptr->chname, data->text) | match_message("1", s, require_bypass, cmdname[data->msgtype], data->chptr->chname, text);
if (r & ACT_DROP) { if (data->msgtype == MESSAGE_TYPE_PRIVMSG) { sendto_one_numeric(s, ERR_CANNOTSENDTOCHAN, form_str(ERR_CANNOTSENDTOCHAN), data->chptr->chname); } data->approved = 1; } if (r & ACT_ALARM) { sendto_realops_snomask(SNO_GENERAL, L_NETWIDE, "FILTER: %s!%s@%s [%s]", s->name, s->username, s->host, s->sockhost); } if (r & ACT_KILL) { data->approved = 1; exit_client(NULL, s, s, filter_exit_message != NULL ? filter_exit_message : FILTER_DEFAULT_EXIT_MSG); }}
voidfilter_client_quit(void *data_){ hook_data_client_quit *data = data_; struct Client *s = data->client; if (IsOper(s)) { return; } char *text = strcpy(clean_buffer, data->orig_reason); strip_colour(text); strip_unprintable(text); unsigned r = match_message("0", s, false, "QUIT", NULL, data->orig_reason) | match_message("1", s, false, "QUIT", NULL, text); if (r & ACT_DROP) { data->reason = NULL; } if (r & ACT_ALARM) { sendto_realops_snomask(SNO_GENERAL, L_ALL | L_NETWIDE, "FILTER: %s!%s@%s [%s]", s->name, s->username, s->host, s->sockhost); } /* No point in doing anything with ACT_KILL */}
voidon_client_exit(void *data_){ /* If we see a netsplit, abort the current FILTER_FILLING attempt */ hook_data_client_exit *data = data_;
if (!IsServer(data->target)) return;
if (state == FILTER_FILLING) { state = filter_db ? FILTER_LOADED : FILTER_EMPTY; }}