Network based new account ban #10
Conversation
create_account_ban.lua
Outdated
| local function kick_and_delete_player_account(name) | ||
| minetest.kick_player(name, MSG_BLOCKED) | ||
| local auth_handler = minetest.get_auth_handler() | ||
| if auth_handler.get_auth(name) then | ||
| minetest.log("action", "[beowulf] Removing player account: "..name) | ||
| auth_handler.delete_auth(name) | ||
| -- Temporary IP ban could be added here but probably not that useful, can be used to skip temp account creation | ||
| else | ||
| -- Should not happen, barrier is most probably leaking for some reason if this ever gets logged | ||
| minetest.log("error", "[beowulf] Player account should exist but not found: "..name) | ||
| end | ||
| end |
There was a problem hiding this comment.
@BuckarooBanzay / @OgelGames (or anyone else) Do you think this is safe enough or is there something that should be changed to make it better?
It is called when new accounts are blocked based on IP/ASN, this is workaround to allow enforcing new account ban with async geoip lookup.
Automated tests would be good (and I'll include some) to prevent account deletion because of some stupid mistake but besides that for actual implementation?
There was a problem hiding this comment.
@BuckarooBanzay / @OgelGames (or anyone else) Do you think this is safe enough or is there something that should be changed to make it better?
LGTM, the kick message should be clear enough i think 👍
Some little cleanup Cleanup new account ban
|
Cleaned up a bit and rebased to master, still no tests however. |
|
Readme changes:
|
There was a problem hiding this comment.
Pattern type selection and pattern matching are both broken, actually just reading code should easily make that clear as there's few very simple mistakes and also no pattern escaping making patterns way too complicated.
- IP match patterns to allow subset of Lua patterns, maybe just
[0-9](with any range) and*as[0-9]+./block 127.1.*.*for127.1.0.0/16./block 127.1.2.*for127.1.2.0/24./block 127.1.2.[12][2-9]*for approx127.1.2.128/25.- Could require first 16 bits to be static to not allow larger than /16 blocks per ban record? Or show warning if pattern covers over 16 bits.
- ASN should allow more than just single digit...
- ASN should probably check validity against root ASN chunk allocations (and either warning or error when private/test numbers given).
-
-loggingdoes not do anything, I don't even remember anymore what I was supposed to do with it... - TBD: chat command name, currently
/block <param>. Should that be changed to something else?
maybe prefix it like the other mods do with |
WIP, for visibility / comments.
Relies on geoip caching layer and prejoin hooks (to operate on incoming connections before creating new player accounts).
For simplicity uses pattern matching for IP checks.