Add the bootwait and splitwait options to connectban.

2 files changed, 53 insertions, 12 deletions

diff --git a/docs/conf/modules.conf.example b/docs/conf/modules.conf.example
index 87648a88f..837d51e6a 100644
--- a/docs/conf/modules.conf.example
+++ b/docs/conf/modules.conf.example
@@ -687,16 +687,34 @@
 # (configurable) duration, and their count resets to 0.
 #<module name="connectban">
 #
-# ipv4cidr and ipv6cidr allow you to turn the comparison from
-# individual IP addresses (32 and 128 bits) into CIDR masks, to allow
-# for throttling over whole ISPs/blocks of IPs, which may be needed to
-# prevent attacks.
+# threshold - The number of connections which are allowed before a user
+#             is connectbnaned. Defaults to 10.
 #
-# This allows for 10 connections in an hour with a 10 minute ban if
-# that is exceeded.
-#<connectban threshold="10" duration="10m" ipv4cidr="32" ipv6cidr="128"
-# A custom ban message may optionally be specified.
-# banmessage="Your IP range has been attempting to connect too many times in too short a duration. Wait a while, and you will be able to connect.">
+# banmessage - The message to give users when Z-lining them for connecting
+#              too much.
+#
+# duration - The time period to ban users who connect to much for. Defaults
+#            to 10 minutes.
+#
+# ipv4cidr - The IPv4 CIDR mask (1-32) to treat connecting users as coming
+#            from the same host. Defaults to 32.
+#
+# ipv6cidr - The IPv6 CIDR mask (1-128) to treat connecting users as coming
+#            from the same host. Defaults to 128.
+#
+# bootwait - The time period to wait after starting up before enforcing
+#            connection bans. Defaults to 2 minutes.
+#
+# splitwait - The time period to wait after a netsplit before enforcing
+#             connection bans. Defaults to 2 minutes.
+#
+#<connectban threshold="10"
+#            banmessage="Your IP range has been attempting to connect too many times in too short a duration. Wait a while, and you will be able to connect."
+#            duration="10m"
+#            ipv4cidr="32"
+#            ipv6cidr="128"
+#            bootwait="2m"
+#            splitwait="2m">
 
 #-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
 # Connection throttle module.
diff --git a/src/modules/m_connectban.cpp b/src/modules/m_connectban.cpp
index aa94adc2e..53aef6ca8 100644
--- a/src/modules/m_connectban.cpp
+++ b/src/modules/m_connectban.cpp
@@ -26,18 +26,25 @@
 
 #include "inspircd.h"
 #include "xline.h"
+#include "modules/server.h"
 #include "modules/webirc.h"
 
-class ModuleConnectBan
+class ModuleConnectBan CXX11_FINAL
 	: public Module
+	, public ServerProtocol::LinkEventListener
 	, public WebIRC::EventListener
 {
+ private:
 	typedef std::map<irc::sockets::cidr_mask, unsigned int> ConnectMap;
+
 	ConnectMap connects;
 	unsigned int threshold;
 	unsigned int banduration;
 	unsigned int ipv4_cidr;
 	unsigned int ipv6_cidr;
+	unsigned long bootwait;
+	unsigned long splitwait;
+	time_t ignoreuntil;
 	std::string banmessage;
 
 	unsigned char GetRange(LocalUser* user)
@@ -72,8 +79,13 @@ class ModuleConnectBan
 	}
 
  public:
+	// Stop GCC warnings about the deprecated OnServerSplit event.
+	using ServerProtocol::LinkEventListener::OnServerSplit;
+
 	ModuleConnectBan()
-		: WebIRC::EventListener(this)
+		: ServerProtocol::LinkEventListener(this)
+		, WebIRC::EventListener(this)
+		, ignoreuntil(0)
 	{
 	}
 
@@ -95,8 +107,13 @@ class ModuleConnectBan
 		ipv4_cidr = tag->getUInt("ipv4cidr", 32, 1, 32);
 		ipv6_cidr = tag->getUInt("ipv6cidr", 128, 1, 128);
 		threshold = tag->getUInt("threshold", 10, 1);
+		bootwait = tag->getDuration("bootwait", 60*2);
+		splitwait = tag->getDuration("splitwait", 60*2);
 		banduration = tag->getDuration("duration", 10*60, 1);
 		banmessage = tag->getString("banmessage", "Your IP range has been attempting to connect too many times in too short a duration. Wait a while, and you will be able to connect.");
+
+		if (status.initial)
+			ignoreuntil = std::max<time_t>(ignoreuntil, ServerInstance->Time() + splitwait);
 	}
 
 	void OnWebIRCAuth(LocalUser* user, const WebIRC::FlagMap* flags) CXX11_OVERRIDE
@@ -113,9 +130,15 @@ class ModuleConnectBan
 			iter->second--;
 	}
 
+	void OnServerSplit(const Server* server, bool error) CXX11_OVERRIDE
+	{
+		if (splitwait)
+			ignoreuntil = ServerInstance->Time() + splitwait;
+	}
+
 	void OnSetUserIP(LocalUser* u) CXX11_OVERRIDE
 	{
-		if (IsExempt(u))
+		if (IsExempt(u) || ignoreuntil > ServerInstance->Time())
 			return;
 
 		irc::sockets::cidr_mask mask(u->client_sa, GetRange(u));