mass-join-protection by SpiKe^^- Netsplits Problems.

[Fahad]

Hello, I have problem here after NetSplit my bot and even users got kicked out?

Please Fix, After Netsplit problem.

Code: Select all

## mass-join-protection.tcl v1.6.1 (29Feb2016) by SpiKe^^ ## 
# Mass joins, kick-ban on joins:seconds # 
set mjp(flood) 3:2 

# Mass joins kick-ban reason # 
set mjp(reasn) "14Possible/Flooder/Spammer" 

# Max number of bans to stack in one mode command # 
set mjp(maxb) 6 

# Max number of kicks to stack in one kick command #          <- NEW SETTING <- 
# NOTE: many networks allow more than one nick to be kicked per command. # 
#       set this at or below the max for your network. 
set mjp(maxk) 3 

# Length of time in minutes to ban mass join flooders # 
# - set 0 to disable this script removing bans (ex. set mjp(btime) 0) # 
set mjp(btime) 30 

# After a valid mass join flood, script will continue # 
# to kick-ban offenders for an additional 'x' seconds # 
set mjp(xpire) 10 

# Set the type of ban masks to use # 
#  1 = use host/ip specific bans (ex. *!*@some.host.com) # 
#  2 = use wide masked host/ip bans (ex. *!*@*.host.com) # 
#      note: setting 2 requires eggdrop 1.6.20 or newer. # 
set mjp(btype) 2 

# Set protected host(s) that should not be wide masked # 
# - Example:  set mjp(phost) "*.undernet.org" 
#  Note: this setting only applies to ban type 2 above! # 
#  Note: set empty to not protect any hosts (ex. set mjp(phost) "") # 
#  Note: space separated if listing more than one protected host # 
set mjp(phost) "" 

# Set channel mode(s) on flood detected. # 
# - set empty to disable setting channel modes (ex. set mjp(mode) "") # 
set mjp(mode) "Rm" 

# Remove these channel modes after how many seconds? # 
set mjp(mrem) 60000

# END OF SETTINGS # Don't edit below unless you know what you're doing # 

bind join - * mjp_bindjoin 

proc mjp_bindjoin {nick uhost hand chan} { 
  global mjp mjpc mjpq 

  if {[isbotnick $nick]} { return 0 } 
  if {[matchattr $hand f|f $chan]} { return 0 } 

  set uhost [string tolower $nick!$uhost] 
  set chan [string tolower $chan] 
  set utnow [unixtime] 
  set target [lindex $mjp(flood) 0] 

  if {[info exists mjpc($chan)]} { 
    set uhlist [lassign $mjpc($chan) cnt ut] 
    set utend [expr {$ut + [lindex $mjp(flood) 1]}] 
    set expire [expr {$utend + $mjp(xpire)}] 
    if {$cnt < $target} { 
      if {$utnow > $utend} { unset mjpc($chan) } 
    } elseif {$utnow > $expire} { unset mjpc($chan) } 
  } 
  if {![info exists mjpc($chan)]} { 
    set mjpc($chan) [list 1 $utnow $uhost] 
    return 0 
  } 

  incr cnt 
  if {$cnt <= $target} { 
    if {[lsearch $uhlist $uhost] == -1} { lappend uhlist $uhost } 
    if {$cnt < $target} { 
      set mjpc($chan) [linsert $uhlist 0 $cnt $ut] 
    } else { 
      set mjpc($chan) [list $cnt $ut] 
      if {$mjp(mode) ne "" && [string is digit -strict $mjp(mrem)]} { 
        putquick "MODE $chan +$mjp(mode)" 
        utimer $mjp(mrem) [list putquick "MODE $chan -$mjp(mode)"] 
      } 
      mjp_dobans $chan $uhlist 
    } 
    return 0 
  } 

  if {![info exists mjpq($chan)]} { 
    utimer 2 [list mjp_bque $chan] 
    set mjpq($chan) [list $uhost] 
  } elseif {[lsearch $mjpq($chan) $uhost] == -1} { 
    lappend mjpq($chan) $uhost 
  } 

  if {[llength $mjpq($chan)] >= $mjp(maxb)} { 
    mjp_dobans $chan $mjpq($chan) 
    set mjpq($chan) "" 
  } 

  return 0 
} 

proc mjp_dobans {chan uhlist} { 
  global mjp 
  if {![botisop $chan]} return 
  set banList "" 
  set nickList "" 
  foreach ele $uhlist { 
    scan $ele {%[^!]!%[^@]@%s} nick user host 


    if {$mjp(btype) == 2} { 
      set type 4 

      foreach ph $mjp(phost) { 
        if {[string match -nocase $ph $host]} { 
          set type 2  ;  break 
        } 
      } 

      set bmask [maskhost $ele $type] 

    } else {  set bmask "*!*@$host"  } 


    if {[lsearch $banList $bmask] == -1} { lappend banList $bmask } 
    if {[lsearch $nickList $nick] == -1} { lappend nickList $nick } 
  } 
  stack_bans $chan $mjp(maxb) $banList 

  # begin new kick code # 
  foreach nk $nickList { 
    if {[onchan $nk $chan]} {  lappend nkls $nk  } else { continue } 
    if {[llength $nkls] == $mjp(maxk)} { 
      putquick "KICK $chan [join $nkls ,] :$mjp(reasn)" 
      unset nkls 
    } 
  } 
  if {[info exists nkls]} { 
    putquick "KICK $chan [join $nkls ,] :$mjp(reasn)" 
  } 
  # end new kick code # 

  if {$mjp(btime) > 0} { 
    set expire [expr {[unixtime] + $mjp(btime)}] 
    lappend mjp(rmls) [list $expire $chan $banList] 
  } 
} 

proc stack_bans {chan max banlist {opt +} } { 
  set len [llength $banlist] 
  while {$len > 0} { 
    if {$len > $max} { 
      set mode [string repeat "b" $max] 
      set masks [join [lrange $banlist 0 [expr {$max - 1}]]] 
      set banlist [lrange $banlist $max end] 
      incr len -$max 
    } else { 
      set mode [string repeat "b" $len] 
      set masks [join $banlist] 
      set len 0 
    } 
    putquick "MODE $chan ${opt}$mode $masks" 
  } 
} 

proc mjp_bque {chan} { 
  global mjpq 
  if {![info exists mjpq($chan)]} { return } 
  if {$mjpq($chan) eq ""} { unset mjpq($chan) ; return } 
  mjp_dobans $chan $mjpq($chan) 
  unset mjpq($chan) 
} 

proc mjp_breset {} { 
  global mjpc mjp 
  set utnow [unixtime] 
  set target [lindex $mjp(flood) 0] 
  foreach {key val} [array get mjpc] { 
    lassign $val cnt ut 
    set utend [expr {$ut + [lindex $mjp(flood) 1]}] 
    set expire [expr {$utend + $mjp(xpire)}] 
    if {$cnt < $target} { 
      if {$utnow > $utend} { unset mjpc($key) } 
    } elseif {$utnow > $expire} { unset mjpc($key) } 
  } 

  if {[info exists mjp(rmls)]} { 
    while {[llength $mjp(rmls)]} { 
      set next [lindex $mjp(rmls) 0] 
      lassign $next expire chan banList 
      if {$expire > $utnow} {  break  } 
      set mjp(rmls) [lreplace $mjp(rmls) 0 0] 
      if {![info exists rmAra($chan)]} {  set rmAra($chan) $banList 
      } else {  set rmAra($chan) [concat $rmAra($chan) $banList]  } 
    } 
    foreach {key val} [array get rmAra] { 
      set banList "" 
      foreach mask $val { 
        if {![ischanban $mask $key]} {  continue  } 
        lappend banList $mask 
      } 
      if {$banList eq ""} {  continue  } 
      if {![botisop $key]} { 
        set mjp(rmls) [linsert $mjp(rmls) 0 [list $utnow $key $banList]] 
      } else {  stack_bans $key $mjp(maxb) $banList -  } 
    } 
    if {![llength $mjp(rmls)]} {  unset mjp(rmls)  } 
  } 

  utimer 30 [list mjp_breset] 
} 

if {![info exists mjp_running]} { 
  utimer 20 [list mjp_breset] 
  set mjp_running 1 
} 

set mjp(flood) [split $mjp(flood) :] 
set mjp(btime) [expr {$mjp(btime) * 60}] 
set mjp(phost) [split [string trim $mjp(phost)]] 
if {$mjp(btime)==0 && [info exists mjp(rmls)]} {  unset mjp(rmls)  } 

proc rdsb_unlock {chan lock} { 
   if {![botisop $chan]} return 
   set cm [lindex [split [getchanmode $chan] +] 1] 
   foreach m [split $lock ""] { 
      if {[lsearch -exact $cm $m] != -1} { 
         pushmode $chan -$m 
      } 
   } 
} 


putlog "Loaded mass-join-protection.tcl v1.6.1 by SpiKe^^"

KICK BANNED

02:06:03 AM * ninja.hub.dal.net sets mode: +ovoooovov hax0r hax0r Fahad ChatWorld RuGaL MuteServ GodFather MafiaServ Alexandros

02:06:03 AM * SilentTwilight sets mode: +Rm

02:06:03 AM * SilentTwilight sets mode: +bbb *!*@*.xmirc.net *!*@*.irccloud.com *!*@sugarlounge.ph

02:06:03 AM * hax0r was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:03 AM * Quttub37 was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:03 AM * babesugar was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:03 AM * SilentTwilight sets mode: +mR

02:06:03 AM * Deadite sets mode: +mR-k join.flood

02:06:09 AM * SilentTwilight sets mode: +bbbbbb *!*@fahad.us *!*@*.cos.as *!*@rugal.us *!*@2604:180:1:151::* *!*@*.s4r4.com *!*@*.nexlinx.net.pk

02:06:10 AM * Deadite sets mode: -b *!*@fahad.us

02:06:10 AM * Fahad was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:10 AM * ChatWorld was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:10 AM * RuGaL was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:12 AM #chatworld url is www.dalnetchatworld.com

02:06:12 AM * MuteServ was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:12 AM * GodFather was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:12 AM * Married_Male was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:14 AM * SilentTwilight sets mode: +bbbbb *!*@*.irchaven.org *!*@*.singnet.com.sg *!*@*.aryup.eu *!*@*.fios.verizon.net *!*@*.fidsah.org

02:06:16 AM * MafiaServ was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:16 AM * vigilant` was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:16 AM * quine was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:19 AM * Yacono was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:19 AM * n33dy was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:19 AM * IanLong was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:26 AM * SilentTwilight sets mode: +bb *!*@*.home.otenet.gr *!*@185.108.129.*

02:06:28 AM * Alexandros was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:28 AM * Voigt was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:28 AM * Anand was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:30 AM * Viens was kicked by SilentTwilight (Possible/Flooder/Spammer)

02:06:52 AM * SilentTwilight sets mode: -b *!*@2604:180:1:151::*

02:07:02 AM * MafiaServ sets mode: -bb *!*@fahad.us *!*@2604:180:1:151::*

02:07:03 AM * Deadite sets mode: -mR

02:07:03 AM * SilentTwilight sets mode: -mR

[SpiKe^^]

My best advice is to not use any mass join script.

Eggdrop can't always tell the difference between a rejoining netsplit and a true mass join flood.

This will apply to any eggdrop script trying to tell the difference.

[Fahad]

But it will be a very less security this was atleast a best tcl for controlling flood there is only a netspilt problem otherwise works fine.

[Fahad]

My best advice is to not use any mass join script.

Eggdrop can't always tell the difference between a rejoining netsplit and a true mass join flood.

This will apply to any eggdrop script trying to tell the difference.

But it will be a very less security this was atleast a best tcl for controlling flood there is only a netspilt problem otherwise works fine.

[SpiKe^^]

Fahad:

I do agree with you completely that all mass join scripts do a fairly good job, up until eggdrop does not see a re-joining netsplit correctly, and empties your entire channel:)

I do not know how to fix that Eggdrop issue.

[Fahad]

Fahad:

I do agree with you completely that all mass join scripts do a fairly good job, up until eggdrop does not see a re-joining netsplit correctly, and empties your entire channel:)

I do not know how to fix that Eggdrop issue.

So there is no CURE That is disappointing, Other TCL's won't stop flood they all are useless. This one was way better, Well what can I say? disappointed

[caesar]

What about changing from bind join to bind flud join?

[Fahad]

What about changing from bind join to bind flud join?

Can you fix it?

[SpiKe^^]

Caesar,

Please explain any ideas you have to fix this longstanding rejoin issue:)

[caesar]

I meant that did you give a try to the flud join mechanism instead of relying on join one?

Another workaround, but not sure how much would help given the warning "be aware that this may be a false alarm (it's easy to fake a netsplit
signoff message on some networks", would be to make an array with people that are seen in a splt bind and when they return check if they are in that list and except them from further checks.

I don't have the means to test anything this scale so you guys have to do it.

[simo]

usually netsplits leave users quiting from delinked servers leaving a message in quit message about 2 servers delinked wich can be used to store in variable for a period of time mostly 1 or 2 min to have it unset and have anti mass join monitor for mass joins again after ignoring for the set period of time in the stored variable

This is what it would look like on msl

Code: Select all

on *:JOIN:#: {
  if (%Netsplit-Detected. [ $+ [ $chan ] $+ . $+ [ $network ] ]) { halt } 
  if ($nick(#,$me,@&~%)) { 
    if (!$regex($site,/(192[.]184[.]9[.]108|192[.]184[.]10[.]118|192[.]184[.]10[.]9|192[.]184[.]8[.]73|[.]pk|.*irccloud[.]com|.*mibbit.com|.*kiwiirc.com)/i)) { set -u5 %mjnicks. $+ $network $+ . $+ $chan $addtok($($+(%,mjnicks.,$network,.,$chan),2),$nick,44) | set -u5 $+(%,ipflood.,#) $addtok($($+(%,ipflood.,#),2),$mask($fulladdress,4),32)  }
     if ($floodchk(jflood, 2, $network $chan) > 3) { 
      if (!$Timer(#)) { .raw MODE $chan +RM-k  Mass.Join | .Timer $+ $chan 1 30 MODE $chan -RM  }
      .timersuper.kickz. [ $+ [ # ] ] -m 1 10 super.modez $safe2018($chan) 
      .timermjkick $+ $network $+ $chan -m 1 10 if ($($+(%,mjnicks.,$network,., $safe2018($chan) ),2)) $({,0) kick $safe2018($chan) $!($+(%,mjnicks.,$network,., $safe2018($chan) ) ,2) *** $+ Mass Joins Detected $+ ***  $(|) unset  $!+(%,mjnicks.,$network,., $safe2018($chan) ) $(},0) 
      if ($numtok($($+(%,mjnicks.,$network,.,$chan),2),44) == 4) { 
        kick $chan $($+(%,mjnicks.,$network,.,$chan),2) Mass Joins detected 
        .timermjkick $+ $network $+ $chan off      
        unset $eval($+(%,mjnicks.,$network,.,$chan),1)
      }
    }
  }
} 

ON *:QUIT: {
  var %netsplit2 1
  while ($comchan($nick,%netsplit2)) {
    var %netsplitchan $v1
    if (*.* *.*  iswm $1-2) && (!%Netsplit-Detected. [ $+ [ %netsplitchan ] $+ . $+ [ $network ] ])  { 
      echo  %netsplitchan  $timestamp  12,00 Netsplit Detected between 05,00 $1 14,00 <> 05,00 $2  
      set -z %Netsplit-Detected. [ $+ [ %netsplitchan ] $+ . $+ [ $network ] ]  120
    }
    inc %netsplit2
  }
  halt
}

alias super.modez {
  var %loop-a = 1
  while ($gettok($($+(%,ipflood.,$1),2),%loop-a,32)) {
    %bb = %bb $gettok($($+(%,ipflood.,$1),2),%loop-a,32)
    if ($modespl == $numtok(%bb,32)) { mode $1 $+(+,$str(b,$gettok(%bb,0,32))) %bb | %bb = "" }
    inc %loop-a
  }
  if (%bb) { mode $1 $+(+,$str(b,$gettok(%bb,0,32))) %bb | %bb = "" }
  $+(.timerx,$1) 1 0 unset $+(%,*,flood.,$1)
}

alias safe2018 return $!decode( $encode($1-, m) ,m)

Alias floodchk {
  var %h, %s = $$2, %ticksmax = $calc($ticks - %s * 1000)
  %h = $1. $+ $iif($replace($3-, $chr(32), .), $ifmatch, $cid)
  tokenize 32 $hget(floodchk, %h) $ticks
  while ($1 < %ticksmax) tokenize 32 $2-
  if ($0 > 70) tokenize 32 $gettok($1-, -70-, 32)
  hadd -mu $+ %s floodchk %h $1-
  return $numtok($1-, 32)
}

Alias floodchk.secs {
  var %h = $1. $+ $iif($replace($2-, $chr(32), .), $ifmatch, $cid), %t = $hget(floodchk, %h)
  return $calc($gettok(%t, -1, 32) - $gettok(%t, 1, 32))
}

an example of a netsplit on Dalnet:

18:10:20 18:10:20 Netsplit Detected between paradigm.hub.dal.net <> diamond.hub.dal.net
18:10:20 18:10:20   Quits :   Cruel-Summer   ~qwebirc@182.185.216.33 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   Ani26_   ~qwebirc@43.245.8.113 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   PinkFire__   ~uid167562@2001:67c1::2:8e8a (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   Meow_   ~uid131084@2001:67c7::2:c (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   ^^^Wolverine^^^   ~uid192191@2001:67c7::2:eebf (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   Guest16341   ~Dionysus@2001:470:36:2de::9 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   lam   ~iam@2001:470:36:2de::5 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   Zod   ~uid230265@2001:67c8::3:8379 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   Booter   ~|2|pac@2paclegacy.24-7.ro (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   vin   ~vin@2604:180:0:b64:720:21:1:2015 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   xOoB   ~uid299144@2001:67c8::4:9088 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   Uzma   ~sid154238@2001:67c1::2:5a7e (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   AndroUser2   ~androirc@152.179.3.150 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   company_owner_   uid257218@2001:67c4::3:ecc2 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   SalmanAkhter__   uid294417@2001:67c7::4:7e11 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   Nameless-Phoenix   uid270075@2001:67c3::4:1efb (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   la`pple   uid171241@2001:67c7::2:9ce9 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   vickyy   uid225090@2001:67c2::3:6f42 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   eXternal   eXternal@eXternaLs.tK (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   Faiza^   fiz@2a0066:1db::db1b (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   Hazel-   ~uni@ProdigY.dynv6.net (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   Guest21214   ~Pro@A-Beautiful-Disaster.dynv6.net (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:21 18:10:21   Quits :   Mufasa   Manager@2604:180:3:62d::5400 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:22 18:10:22   Quits :   _MaC`   Chimp0@Dr3aMzS.ml (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:22 18:10:22   Quits :   Profound   Profound@DALnet (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:22 18:10:22   Quits :   sCale   X@2602:fff6:f:b1e2::97d7 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:22 18:10:22   Quits :   jisperitoo   ~jisperito@host-210-net-97-160-119.mobilinkinfinity.net.pk (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:22 18:10:22   Quits :   Ahmad-40   ~Mibbit@119.153.102.122 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:22 18:10:22   Quits :   har`ek`shamma`jal`chuki   ~nugget@45.63.53.236 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:22 18:10:22   Quits :   zumar   uid235949@tooting.irccloud.com (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:22 18:10:22   Quits :   Delightfulz_   ~2728c36f@39.40.195.111 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:22 18:10:22   Quits :   AhmaR   AhmaR@you.cannot.resolvemyname.com (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:22 18:10:22   Quits :   HRM   E586@free.znc.bg (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:22 18:10:22   Quits :   Zeref   ~zeref@178.80.123.219 (paradigm.hub.dal.net diamond.hub.dal.net)
18:10:22 18:10:22   Quits :   Boisterous   dark@this.is.a.free.bnc-what.do.you.expect.elitebnc.org (paradigm.hub.dal.net diamond.hub.dal.net)

[caesar]

This 'Netsplit Detected between paradigm.hub.dal.net <> diamond.hub.dal.net' line is from your bot or dose the network services say that out into the channels?

[simo]

That's from my own client caeser

[caesar]

As this stands then it's possible to trick the bot into thinking that I left in a netsplit if would set my quit line like 'paradigm.hub.dal.net diamond.hub.dal.net' for example.

But this can be easily avoided by taking anyone that left with a message like that into consideration from further checks in a short time span if more than let's say 5 members leave with the same message.

If let's say the two servers that split take longer than the time you set in your msl script what happens then when a bunch of people join over the sudden? I bet they would be considered mass joining...

[simo]

i have been on dalnet for sometime now in all cases users rejoin within 1 to 2 min max 3