Support IPv6 blacklists. Also add a conf file option allowing the use of IPv4, IPv6, or both for a blacklist.

Although few blacklists currently support IPv6 lookups, they will likely begin to do so in the near future as more net trash begins using IPv6.

doc/example.conf

@@ -361,7 +361,7 @@ serverhide {
  * Word to the wise: Do not use blacklists like SPEWS for blocking IRC
  * connections.
  *
- * As of charybdis 2.1.3, you can do some keyword substitution on the rejection
+ * As of charybdis 2.2, you can do some keyword substitution on the rejection
  * reason. The available keyword substitutions are:
  *
  *   ${ip}           - the user's IP
@@ -370,19 +370,32 @@ serverhide {
  *   ${nick}         - the user's nickname
  *   ${network-name} - the name of the network
  *
+ * As of charybdis 3.4, a type parameter is supported, which specifies the
+ * address families the blacklist supports. IPv4 and IPv6 are supported.
+ * IPv4 is currently the default as few blacklists support IPv6 operation
+ * as of this writing.
+ *
  * Note: AHBL (the providers of the below *.ahbl.org BLs) request that they be
  * contacted, via email, at admins@2mbit.com before using these BLs.
  * See <http://www.ahbl.org/services.php> for more information.
  */
 blacklist {
 	host = "rbl.efnetrbl.org";
+	type = ipv4;
 	reject_reason = "${nick}, your IP (${ip}) is listed in EFnet's RBL. For assistance, see http://efnetrbl.org/?i=${ip}";
 
 #	host = "ircbl.ahbl.org";
+#	type = ipv4;
 #	reject_reason = "${nick}, your IP (${ip}) is listed in ${dnsbl-host} for having an open proxy. In order to protect ${network-name} from abuse, we are not allowing connections with open proxies to connect.";
 #
 #	host = "tor.ahbl.org";
+#	type = ipv4;
 #	reject_reason = "${nick}, your IP (${ip}) is listed as a TOR exit node. In order to protect ${network-name} from tor-based abuse, we are not allowing TOR exit nodes to connect to our network.";
+#
+	/* Example of a blacklist that supports both IPv4 and IPv6 */
+#	host = "foobl.blacklist.invalid";
+#	type = ipv4, ipv6;
+#	reject_reason = "${nick}, your IP (${ip}) is listed in ${dnsbl-host} for some reason. In order to protect ${network-name} from abuse, we are not allowing connections listed in ${dnsbl-host} to connect";
 };
 
 alias "NickServ" {

doc/reference.conf

@@ -820,19 +820,32 @@ serverhide {
  *   ${nick}         - the user's nickname
  *   ${network-name} - the name of the network
  *
+ * As of charybdis 3.4, a type parameter is supported, which specifies the
+ * address families the blacklist supports. IPv4 and IPv6 are supported.
+ * IPv4 is currently the default as few blacklists support IPv6 operation
+ * as of this writing.
+ *
  * Note: AHBL (the providers of the below *.ahbl.org BLs) request that they be
  * contacted, via email, at admins@2mbit.com before using these BLs.
  * See <http://www.ahbl.org/services.php> for more information.
  */
 blacklist {
 	host = "rbl.efnetrbl.org";
+	type = ipv4;
 	reject_reason = "${nick}, your IP (${ip}) is listed in EFnet's RBL. For assistance, see http://efnetrbl.org/?i=${ip}";
 
 #	host = "ircbl.ahbl.org";
+#	type = ipv4;
 #	reject_reason = "${nick}, your IP (${ip}) is listed in ${dnsbl-host} for having an open proxy. In order to protect ${network-name} from abuse, we are not allowing connections with open proxies to connect.";
 #
 #	host = "tor.ahbl.org";
+#	type = ipv4;
 #	reject_reason = "${nick}, your IP (${ip}) is listed as a TOR exit node. In order to protect ${network-name} from tor-based abuse, we are not allowing TOR exit nodes to connect to our network.";
+#
+	/* Example of a blacklist that supports both IPv4 and IPv6 */
+#	host = "foobl.blacklist.invalid";
+#	type = ipv4, ipv6;
+#	reject_reason = "${nick}, your IP (${ip}) is listed in ${dnsbl-host} for some reason. In order to protect ${network-name} from abuse, we are not allowing connections listed in ${dnsbl-host} to connect";
 };
 
 /*

include/blacklist.h

@@ -19,7 +19,6 @@
  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
  *  USA
  *
- *  $Id: blacklist.h 2023 2006-09-02 23:47:27Z jilles $
  */
 
 #ifndef _BLACKLIST_H_
@@ -29,6 +28,8 @@
 struct Blacklist {
 	unsigned int status;	/* If CONF_ILLEGAL, delete when no clients */
 	int refcount;
+	int ipv4;	/* Does this blacklist support IPv4 lookups? */
+	int ipv6;	/* Does this blacklist support IPv6 lookups? */
 	char host[IRCD_RES_HOSTLEN + 1];
 	char reject_reason[IRCD_BUFSIZE];
 	unsigned int hits;
@@ -44,7 +45,7 @@ struct BlacklistClient {
 };
 
 /* public interfaces */
-struct Blacklist *new_blacklist(char *host, char *reject_entry);
+struct Blacklist *new_blacklist(char *host, char *reject_reason, int ipv4, int ipv6);
 void lookup_blacklists(struct Client *client_p);
 void abort_blacklist_queries(struct Client *client_p);
 void unref_blacklist(struct Blacklist *blptr);

src/blacklist.c

@@ -2,7 +2,7 @@
  * charybdis: A slightly useful ircd.
  * blacklist.c: Manages DNS blacklist entries and lookups
  *
- * Copyright (C) 2006-2008 charybdis development team
+ * Copyright (C) 2006-2011 charybdis development team
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -30,7 +30,6 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $Id: blacklist.c 2743 2006-11-10 15:15:00Z jilles $
  */
 
 #include "stdinc.h"
@@ -113,7 +112,6 @@ static void blacklist_dns_callback(void *vptr, struct DNSReply *reply)
 	rb_free(blcptr);
 }
 
-/* XXX: no IPv6 implementation, not to concerned right now though. */
 static void initiate_blacklist_dnsquery(struct Blacklist *blptr, struct Client *client_p)
 {
 	struct BlacklistClient *blcptr = rb_malloc(sizeof(struct BlacklistClient));
@@ -126,15 +124,54 @@ static void initiate_blacklist_dnsquery(struct Blacklist *blptr, struct Client *
 	blcptr->dns_query.ptr = blcptr;
 	blcptr->dns_query.callback = blacklist_dns_callback;
 
-	ip = (uint8_t *)&((struct sockaddr_in *)&client_p->localClient->ip)->sin_addr.s_addr;
+	if ((client_p->localClient->ip.ss_family == AF_INET) && blptr->ipv4)
+	{
+		ip = (uint8_t *)&((struct sockaddr_in *)&client_p->localClient->ip)->sin_addr.s_addr;
 
-	/* becomes 2.0.0.127.torbl.ahbl.org or whatever */
+		/* becomes 2.0.0.127.torbl.ahbl.org or whatever */
-	rb_snprintf(buf, sizeof buf, "%u.%u.%u.%u.%s",
+		rb_snprintf(buf, sizeof buf, "%d.%d.%d.%d.%s",
-		    (unsigned int) ip[3],
+			    (unsigned int) ip[3],
-		    (unsigned int) ip[2],
+			    (unsigned int) ip[2],
-		    (unsigned int) ip[1],
+			    (unsigned int) ip[1],
-		    (unsigned int) ip[0],
+			    (unsigned int) ip[0],
-		    blptr->host);
+			    blptr->host);
+	}
+	/* IPv6 is supported now. --Elizabeth */
+	else if ((client_p->localClient->ip.ss_family == AF_INET6) && blptr->ipv6)
+	{
+		/* Breaks it into ip[0] = 0x00, ip[1] = 0x00... ip[16] = 0x01 for localhost
+		 * I wish there was a uint4_t for C, this would make the below cleaner, but... */
+		ip = (uint8_t *)&((struct sockaddr_in6 *)&client_p->localClient->ip)->sin6_addr.s6_addr;
+		char *bufptr = buf;
+		int i;
+
+		/* The below will give us something like
+		 * 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.foobl.invalid
+		 */
+
+		/* Going backwards */
+		for (i = 15; i >= 0; i--)
+		{
+			/* Get upper and lower nibbles (yes this works fine on
+			 * both big and little endian) */
+			uint8_t hi = (ip[i] >> 4) & 0x0F;
+			uint8_t lo = ip[i] & 0x0F;
+
+			/* One part... (why 5? rb_snprintf adds \0) */
+			rb_snprintf(bufptr, 5, "%1x.%1x.",
+				    (unsigned int) lo, /* Remember, backwards */
+				    (unsigned int) hi);
+
+			/* Lurch forward to next position */
+			bufptr += 4;
+		}
+
+		/* Tack host on */
+		strcpy(bufptr, blptr->host);
+	}
+	/* This shouldn't happen... */
+	else
+		return;
 
 	gethost_byname_type(buf, &blcptr->dns_query, T_A);
 
@@ -143,7 +180,7 @@ static void initiate_blacklist_dnsquery(struct Blacklist *blptr, struct Client *
 }
 
 /* public interfaces */
-struct Blacklist *new_blacklist(char *name, char *reject_reason)
+struct Blacklist *new_blacklist(char *name, char *reject_reason, int ipv4, int ipv6)
 {
 	struct Blacklist *blptr;
 
@@ -160,6 +197,8 @@ struct Blacklist *new_blacklist(char *name, char *reject_reason)
 		blptr->status &= ~CONF_ILLEGAL;
 	rb_strlcpy(blptr->host, name, IRCD_RES_HOSTLEN + 1);
 	rb_strlcpy(blptr->reject_reason, reject_reason, IRCD_BUFSIZE);
+	blptr->ipv4 = ipv4;
+	blptr->ipv6 = ipv6;
 	blptr->lastwarning = 0;
 
 	return blptr;
@@ -179,10 +218,6 @@ void lookup_blacklists(struct Client *client_p)
 {
 	rb_dlink_node *nptr;
 
-	/* We don't do IPv6 right now, sorry! */
-	if (client_p->localClient->ip.ss_family == AF_INET6)
-		return;
-
 	RB_DLINK_FOREACH(nptr, blacklist_list.head)
 	{
 		struct Blacklist *blptr = (struct Blacklist *) nptr->data;

src/newconf.c

@@ -54,6 +54,9 @@ static struct alias_entry *yy_alias = NULL;
 
 static char *yy_blacklist_host = NULL;
 static char *yy_blacklist_reason = NULL;
+static int yy_blacklist_ipv4 = 1;
+static int yy_blacklist_ipv6 = 0;
+
 static char *yy_privset_extends = NULL;
 
 static const char *
@@ -1775,6 +1778,34 @@ conf_set_blacklist_host(void *data)
 	yy_blacklist_host = rb_strdup(data);
 }
 
+static void
+conf_set_blacklist_type(void *data)
+{
+	conf_parm_t *args = data;
+
+	/* Don't assume we have either if we got here */
+	yy_blacklist_ipv4 = 0;
+	yy_blacklist_ipv6 = 0;
+
+	for (; args; args = args->next)
+	{
+		if (!strcasecmp(args->v.string, "ipv4"))
+			yy_blacklist_ipv4 = 1;
+		else if (!strcasecmp(args->v.string, "ipv6"))
+			yy_blacklist_ipv6 = 1;
+		else
+			conf_report_error("blacklist::type has unknown address family %s",
+					  args->v.string);
+	}
+
+	/* If we have neither, just default to IPv4 */
+	if (!yy_blacklist_ipv4 && !yy_blacklist_ipv6)
+	{
+		conf_report_error("blacklist::type has neither IPv4 nor IPv6 (defaulting to IPv4)");
+		yy_blacklist_ipv4 = 1;
+	}
+}
+
 static void
 conf_set_blacklist_reason(void *data)
 {
@@ -1782,11 +1813,37 @@ conf_set_blacklist_reason(void *data)
 
 	if (yy_blacklist_host && yy_blacklist_reason)
 	{
-		new_blacklist(yy_blacklist_host, yy_blacklist_reason);
+		if (yy_blacklist_ipv6)
+		{
+			/* Make sure things fit (64 = alnum count + dots) */
+			if ((64 + strlen(yy_blacklist_host)) > IRCD_RES_HOSTLEN)
+			{
+				conf_report_error("blacklist::host %s results in IPv6 queries that are too long",
+						  yy_blacklist_host);
+				goto cleanup_bl;
+			}
+		}
+		/* Avoid doing redundant check, IPv6 is bigger than IPv4 --Elizabeth */
+		if (yy_blacklist_ipv4 && !yy_blacklist_ipv6)
+		{
+			/* Make sure things fit (16 = number of nums + dots) */
+			if ((16 + strlen(yy_blacklist_host)) > IRCD_RES_HOSTLEN)
+			{
+				conf_report_error("blacklist::host %s results in IPv4 queries that are too long",
+						  yy_blacklist_host);
+				goto cleanup_bl;
+			}
+		}
+
+		new_blacklist(yy_blacklist_host, yy_blacklist_reason, yy_blacklist_ipv4, yy_blacklist_ipv6);
+
+cleanup_bl:
 		rb_free(yy_blacklist_host);
 		rb_free(yy_blacklist_reason);
 		yy_blacklist_host = NULL;
 		yy_blacklist_reason = NULL;
+		yy_blacklist_ipv4 = 1;
+		yy_blacklist_ipv6 = 0;
 	}
 }
 
@@ -2279,5 +2336,6 @@ newconf_init()
 
 	add_top_conf("blacklist", NULL, NULL, NULL);
 	add_conf_item("blacklist", "host", CF_QSTRING, conf_set_blacklist_host);
+	add_conf_item("blacklist", "type", CF_STRING | CF_FLIST, conf_set_blacklist_type);
 	add_conf_item("blacklist", "reject_reason", CF_QSTRING, conf_set_blacklist_reason);
 }