Ban automatically Excess Flood hosts on #wikipedia-fr
ClosedPublic
Actions

Authored by dereckson on Jul 29 2015, 18:44.

Details

Reviewers: None
Maniphest Tasks: T515: Ban automatically Excess Flood hosts on #wikipedia-fr
Commits: rVIPER6d9fc047f06b: Ban automatically Excess Flood hosts on #wikipedia-fr
rVIPERSERV45e7c962a62d: Ban automatically Excess Flood hosts on #wikipedia-fr

Summary

If an unknown user from specified hosts quits in Excess flood,
with a 3-5 nick length, the bot will automatically put a ban.

New registry keys:

protection.botnet.hosts: the hosts to ban, * allowed
protection.botnet.banreason: the ban reason
protection.botnet.banduration: the ban duration in minutes

New helper procedures in core:

gethost: extracts the host part of a [nick!]user@host string
isipv4, isipv6, isip: determines if a string is an ip

Fixes T515.

Test Plan

Deploy on Daeghrefn
See how it behaves at the next attack

Diff Detail

Repository

rVIPERSERV ViperServ scripts [legacy Mercurial repo]

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

dereckson updated this revision to Diff 63.Jul 29 2015, 18:44

dereckson retitled this revision from to Ban automatically Excess Flood hosts on #wikipedia-fr.

dereckson updated this object.

dereckson edited the test plan for this revision. (Show Details)

dereckson added a task: T515: Ban automatically Excess Flood hosts on #wikipedia-fr.

dereckson added a subscriber: rama.

Fixed typo in variable name

[sign:excessflood]: can't read "hot": no such variable

The protection works, but ban duration is in minutes, not in seconds.

On the channel:

19:38:11 -!- kuqdu [~kuqdu@ARennes-656-1-288-2.w2-10.abo.wanadoo.fr] has quit [Excess Flood]
19:38:12 -!- mode/#wikipedia-fr [+b *!*@ARennes-656-1-288-2.w2-10.abo.wanadoo.fr] by Daeghrefn

On the partyline:

19:44:54 <Dereckson> .bans
19:44:54 <Daeghrefn> Bans globaux:
19:44:54 <Daeghrefn> Bans spécifiques au canal #wikipedia-fr:  (* = non placé par le bot)
19:44:54 <Daeghrefn>   [  1] *!*@ARennes-656-1-288-2.w2-10.abo.wanadoo.fr (expires in 59 days) (sticky)
19:44:54 <Daeghrefn>         Daeghrefn!surfboard@wikimedia/bo: Cette adresse semble compromise et appartenir à un botnet.
19:44:54 <Daeghrefn>         Créé 19:38
[...]

dereckson updated this object.Jul 29 2015, 19:49

dereckson added projects: Dæghrefn, Wikimedia.

Closed by commit rVIPERSERV45e7c962a62d: Ban automatically Excess Flood hosts on #wikipedia-fr (authored by dereckson). · Explain WhyJul 29 2015, 19:52

This revision was automatically updated to reflect the committed changes.