anti repeat from multi host/ip

simo · Post by **simo** » Sun Mar 22, 2015 2:57 pm

i have an msl aliase in use wich can be called by events and bans anyone who keeps repeating the same sentence, works excellent
now i am a noob in tcl and was hoping someone could help me out with it i have
searched the web for it it doesnt excist most anti flood is per user and for botnet it only moderates channel i included the msl

code

Code: Select all

ON ^*:text:*:#:{ 
  if ($nick(#,$me,@&~%)) { 
    protect_check $1- 
  }
}

ON ^*:action:*:#:{ 
  if ($nick(#,$me,@&~%)) { 
    protect_check $1- 
  }
}

Alias protect_check {
  if ($nick($chan,$nick,@&~%)) return
  var %h = $hash($lower($strip($left($1-,400))),32)
  if (%protect.r. [ $+ [ $chan ] $+ . $+ [ %h ] ] < 70) inc -z %protect.r. $+ $chan $+ . $+ %h 20
  inc -z %protect.r. $+ $chan $+ . $+ $chan $+ . $+ %h %protect.r. [ $+ [ $chan ] $+ . $+ [ %h ] ]
  inc -z %protect.r. $+ $chan $+ . $+ $chan $+ . $+ %h %protect.j. [ $+ [ $chan ] $+ . $+ [ $chan ] ]
  if (%protect.r. [ $+ [ $chan ] $+ . $+ [ $chan ] $+ . $+ [ %h ] ] > 2) { 
    mode  $chan +b  $address($nick,2)
    kick $chan $nick   *** Don't Repeat  Please ***  
  }
}

simo · Post by **simo** » Mon Mar 23, 2015 6:28 am

i found this nice script but like most scripts it monitors repeated text per user
any help would be apreciated to make this monitor all repeated text like after 2nd repeated text start bankick no matter from wich IP it comes

cheers.

Code: Select all


# repeat.tcl v1.1 (9 April 1999) by slennox <slenny@ozemail.com.au>
# Latest versions can be found at www.ozemail.com.au/~slenny/eggdrop/
#
# This script detects people who repeat the same line of text on a channel
# multiple times, and kicks and/or bans them. It is a complete rewrite of
# the original repeat.tcl script by Tris.
#
# There are three repeat detectors in this script - one for small repeat
# floods, one for large repeat floods, and one for 'spam' type repeats
# (e.g. people who ask the same question multiple times in a channel). An
# additional mechanism detects whether multiple repeat floods are coming 
# from a particular host.
#
# Note that the script isn't perfect since it uses only three single,
# cycling utimers to prevent the bot becoming bogged down with separate
# utimers for each message sent to a channel. This means it won't always
# detect a repeat flood, but it will work most of the time (and aggressive
# repeat floods should always be detected).
#
# v1.0 - Initial release
# v1.1 - Reorganised main proc and fixed problem with multiple repeat flood
# ban triggering when it shouldn't, added detection of repeated notices,
# changed some other things

# Small repeat flood, kick on repeats:seconds
set rp_kflood 3:60
# Small repeat flood kick reason
set rp_kreason "stop repeating"

# Large repeat flood, kick-ban on repeats:seconds
set rp_bflood 5:60
# Large repeat flood kick-ban reason
set rp_breason "repeat flood"

# Spam repeat flood, kick on repeats:seconds
set rp_sflood 3:240
# Spam repeat flood kick reason
set rp_sreason "stop repeating"
# Set the string length for spam-type text (lines of text shorter than this
# will not be counted by the 'spam' type repeat detector)
set rp_slength 40

# Repeat offences, ban on two repeat floods from a particular host within
# how many seconds
set rp_mtime 240
# Repeat offences ban reason
set rp_mreason "multiple repeat floods"

# Length of time in minutes to ban large repeat flooders and repeat
# offenders
set rp_btime 60


# Don't edit anything below unless you know what you're doing

proc rp_pubmsg {nick uhost hand chan text} {
  global botnick rp_bcount rp_bflood rp_breason rp_btime rp_kcount rp_kflood rp_kreason rp_scount rp_sflood rp_slength rp_sreason
  set uhost [string tolower $uhost]
  set chan [string tolower $chan]
  set text [string tolower $text]
  if {$nick == $botnick} {return 0}
  if {[matchattr $hand f|f $chan]} {return 0}
  if {![info exists rp_bcount($uhost:$chan:$text)]} {
    set rp_bcount($uhost:$chan:$text) 0
  }
  incr rp_bcount($uhost:$chan:$text)
  if {![info exists rp_kcount($uhost:$chan:$text)]} {
    set rp_kcount($uhost:$chan:$text) 0
  }
  incr rp_kcount($uhost:$chan:$text)
  if {[string length $text] > $rp_slength} {
    if {![info exists rp_scount($uhost:$chan:$text)]} {
      set rp_scount($uhost:$chan:$text) 0
    }
    incr rp_scount($uhost:$chan:$text)
  }
  if {$rp_bcount($uhost:$chan:$text) == [lindex $rp_bflood 0]} {
    if {[botisop $chan] && [onchan $nick $chan]} {
      putserv "KICK $chan $nick :$rp_breason"
    }
    set bmask *!*[string tolower [string range $uhost [string first "@" $uhost] end]]
    newchanban $chan $bmask repeat $rp_breason $rp_btime
    return 0
  }
  if {$rp_kcount($uhost:$chan:$text) == [lindex $rp_kflood 0]} {
    rp_mhost $nick $uhost $chan
    if {[botisop $chan] && [onchan $nick $chan]} {
      putserv "KICK $chan $nick :$rp_kreason"
    }
    return 0
  }
  if {[info exists rp_scount($uhost:$chan:$text)]} {
    if {$rp_scount($uhost:$chan:$text) == [lindex $rp_sflood 0]} {
      rp_mhost $nick $uhost $chan
      if {[botisop $chan] && [onchan $nick $chan]} {
        putserv "KICK $chan $nick :$rp_sreason"
      }
      return 0
    }
  }
}

proc rp_pubact {nick uhost hand dest key arg} {
  rp_pubmsg $nick $uhost $hand $dest $arg
}

proc rp_pubnotc {from keyword arg} {
  set nick [lindex [split $from !] 0]
  set chan [string tolower [lindex [split $arg] 0]]
  if {![validchan $chan] || ![onchan $nick $chan]} {return 0}
  set uhost [getchanhost $nick $chan]
  set hand [nick2hand $nick $chan]
  set text [join [lrange [split $arg] 1 end]]
  rp_pubmsg $nick $uhost $hand $chan $text
}

proc rp_mhost {nick uhost chan} {
  global rp_btime rp_mhosts rp_mreason rp_mtime
  set mhost [lindex [split $uhost "@"] 1]
  if {![info exists rp_mhosts($chan)]} {
    set rp_mhosts($chan) ""
  }
  set mlist $rp_mhosts($chan)
  if {[lsearch -exact $mlist $mhost] != -1} {
    set bmask *!*[string tolower [string range $uhost [string first "@" $uhost] end]]
    newchanban $chan $bmask repeat $rp_mreason $rp_btime
  } else {
    lappend rp_mhosts($chan) $mhost
    utimer $rp_mtime "rp_mhostreset $chan"
  }
}

proc rp_mhostreset {chan} {
  global rp_mhosts
  set rp_mhosts($chan) [lrange rp_mhosts($chan) 1 end]
}

proc rp_kreset {} {
  global rp_kcount rp_kflood
  if {[info exists rp_kcount]} {
    unset rp_kcount
  }
  utimer [lindex $rp_kflood 1] rp_kreset
}

proc rp_breset {} {
  global rp_bcount rp_bflood
  if {[info exists rp_bcount]} {
    unset rp_bcount
  }
  utimer [lindex $rp_bflood 1] rp_breset
}

proc rp_sreset {} {
  global rp_scount rp_sflood
  if {[info exists rp_scount]} {
    unset rp_scount
  }
  utimer [lindex $rp_sflood 1] rp_sreset
}

if {![string match *rp_kreset* [utimers]]} {
  global rp_kflood
  utimer [lindex $rp_kflood 1] rp_kreset
}

if {![string match *rp_breset* [utimers]]} {
  global rp_bflood
  utimer [lindex $rp_bflood 1] rp_breset
}

if {![string match *rp_sreset* [utimers]]} {
  global rp_sflood
  utimer [lindex $rp_sflood 1] rp_sreset
}

set rp_kflood [split $rp_kflood :]
set rp_bflood [split $rp_bflood :]
set rp_sflood [split $rp_sflood :]

bind pubm - * rp_pubmsg
bind ctcp - ACTION rp_pubact
bind raw - NOTICE rp_pubnotc

putlog "Loaded repeat.tcl v1.1 by slennox"

Post by **caesar** » Mon Mar 23, 2015 11:07 am

From my understanding you seem to want to achieve some sort of protection against multiple bots that basically spam the same text in a short time frame. Correct?

The solution you are looking for would involve hashing the text lines (with md5 for instance) among with uhost (or whatever other info you want) and store, check and purge them in a given time frame.

Edit: I was bored and decided to tackle this challenge with dict.

Code: Select all

namespace eval hashCheck { 
	bind pubm * [namespace current]::check
	variable setup(limit) 3
	variable setup(time) 10
	
	proc check {nick uhost hand chan text} {
		variable setup
		variable md5hashes
		set hash [md5 [split $text]]
		if {[info exists md5hashes]} {
			if {[lsearch [dict keys [dict get $md5hashes $chan] $hash]] != -1} {
				set hosts [dict get $md5hashes $chan $hash]
				if {[llength $hosts] > $setup(limit)} {
					punish $chan $hosts
					dict unset md5hashes $chan $hash
				} else {
					dict set md5hashes $chan $hash [list [dict get $md5hashes $chan $hash] $uhost]
					utimer $setup(time) [list purge $chan $hash $uhost]
				}
			}
		} else {
			dict set md5hashes $chan $hash $uhost
		}
	}
	
	proc purge {chan hash uhost} {
		variable md5hashes
		set hosts [dict get $md5hashes $chan $hash]
		set pos [lsearch -nocase $hosts $uhost]
		if {$pos!=-1} {
			set hosts [lreplace $hosts $pos $pos]
			dict set md5hashes $chan $hash $hosts
		}
	}
	
	proc punish {chan hosts} {
		foreach uhost [split $hosts] {
			scan $uhost {%[^@]@%s} user host 
			newchanban $chan "*!*@$host" HashCheck "Repeating the same line!"
		}
	}
}

Haven't tested anything so load this on a test bot. Reply back if get any errors or is not working at all.

simo · Post by **simo** » Mon Mar 23, 2015 12:55 pm

tnx for the reply when i tried to load it it gave me this errorr

[12:39:34] Tcl error in file 'agraw.conf':
[12:39:34] can't define "setup(limit)": name refers to an element in an array
while executing
"variable setup(limit) 3"
(in namespace eval "::hashCheck" script line 3)
invoked from within
"namespace eval hashCheck {
bind pubm * [namespace current]::check
variable setup(limit) 3
variable setup(time) 10

proc check {nick uho..."
(file "scripts/antirepeat2015.tcl" line 1)
invoked from within
"source scripts/antirepeat2015.tcl"
(file "agraw.conf" line 298)

simo · Post by **simo** » Mon Mar 23, 2015 1:27 pm

From my understanding you seem to want to achieve some sort of protection against multiple bots that basically spam the same text in a short time frame. Correct?

it is indeed correct.

Post by **SpiKe^^** » Mon Mar 23, 2015 1:38 pm

Think these first few lines...

Code: Select all

namespace eval hashCheck { 
    bind pubm * [namespace current]::check 
    variable setup(limit) 3 
    variable setup(time) 10

need to be more like this (maybe:)...

Code: Select all

namespace eval hashCheck { 
    bind pubm * [namespace current]::check 
    variable setup
    array set setup {limit 3 time 10}

simo · Post by **simo** » Mon Mar 23, 2015 1:50 pm

i changed it and it doesnt trigger at all when i testflood on my own testnet
and no errors this time

Post by **SpiKe^^** » Mon Mar 23, 2015 1:59 pm

All I could do was try to clear the error keeping the script from loading.
Maybe Caesar will be able the find out why the code is not acting as expected.

simo · Post by **simo** » Mon Mar 23, 2015 2:02 pm

much apreciated sir i have been trying to get this tcl for a while cause most is out there and available just with this kind of floods i didnt see an existing tcl other then the kind that only moderate channel wich doesnt get rid of the bots themselves

simo · Post by **simo** » Mon Mar 23, 2015 2:04 pm

i try to make use of channel extended modes as well, only they too monitor per user and when monitoring channel wide channel with anti flood modes

just like unreals:
@ctcp Sets Mode on #qwerty to: +fj [7j#i1,10m#m1,2n#N1,7t#b]:3 1:30

it moderate only it doesnt kickban.

only if from same ip keeps repeating only then it starts kickban

heartbroken · Post by **heartbroken** » Mon Mar 23, 2015 2:23 pm

change :

Code: Select all

 if {[lsearch [dict keys [dict get $md5hashes $chan] $hash]] != -1} {

to

Code: Select all

 if {[lsearch [dict keys [dict get $md5hashes $chan]] $hash] != -1} {

simo · Post by **simo** » Mon Mar 23, 2015 2:33 pm

didnt seem to do it either for some reason

Post by **SpiKe^^** » Mon Mar 23, 2015 5:12 pm

Also, this bind line incorrect...

Code: Select all

   bind pubm * [namespace current]::check

It is missing the <flags>, sorry I didn't catch that earlier.
Example: bind pubm <flags> <mask> <proc>

Try fixing that line to look more like this...

Code: Select all

   bind pubm - * [namespace current]::check

simo · Post by **simo** » Mon Mar 23, 2015 5:59 pm

after doing that kept gettin this error in PL

22:58:09 <SeCuRiTy> [17:45:18] Tcl error in script for 'timer9872':
22:58:09 <SeCuRiTy> [17:45:18] invalid command name "purge"
22:58:09 <SeCuRiTy> [17:45:18] Tcl error in script for 'timer9873':
22:58:09 <SeCuRiTy> [17:45:18] invalid command name "purge"
22:58:09 <SeCuRiTy> [17:45:19] Tcl error in script for 'timer9874':
22:58:10 <SeCuRiTy> [17:45:19] invalid command name "purge"

Post by **SpiKe^^** » Mon Mar 23, 2015 6:37 pm

Try changing this line...

Code: Select all

               utimer $setup(time) [list purge $chan $hash $uhost]

to be more like this...

Code: Select all

               utimer $setup(time) [list [namespace current]::purge $chan $hash $uhost]