Ban version

Solutech · Post by **Solutech** » Mon Apr 19, 2004 9:05 am

right Ive had some troublewith idiots coming in on a warscript that readily ids itself on ctcp so I added a ban version to my .conf

Unreal is now scanning the scripts on connect yet it does nothing to the script when it connects. I got hold of the script myself and have checked the ctcp and this is how it comes up when it connects

-
[IRC VERSION]
-
Status Window (Version Request by;IRC)
-
-> -IRC- (InfecteD vÂ¹; Toxic by v0rt3x nd CryptikS)

my ban block is

};
ban version {
mask "(InfecteD vÂ¹; Toxic by v0rt3x nd CryptikS)";
reason "warscript"
action gzline
};

Im positive the ban block is correct but unreal does not seem to react to the script.

Ron2K · Post by **Ron2K** » Mon Apr 19, 2004 10:09 am

Probably something wrong with the mask. Try removing the brackets and replacing them with wildcard characters. I'm not sure whether or not it will work, but it's always worth a try.

Solutech · Post by **Solutech** » Mon Apr 19, 2004 10:53 am

tried diff masks from *infecte* until I made it specific . tried with n without brackets to no avail .

Solutech · Post by **Solutech** » Tue Apr 20, 2004 12:16 am

Ive looked at it and looked at it and tried diff ways of masking it yet it wont do jack . I really need to get this working . If you ctcp the script it replies so I presume the server isnt reading the reply or misinterprets it . Could this be because the reply has colours in it? . Any help appreciated guys . Im really confused as this should work ok.

codemastr · Post by **codemastr** » Tue Apr 20, 2004 1:01 am

If the reply has color codes in it, then you need to include the color codes in your match text. Unreal does not strip them out.

Solutech · Post by **Solutech** » Tue Apr 20, 2004 1:39 am

ok I put the codes in as well as below into the ban block an yet again nada

5(14Infecte4D14 4v14Â¹; 4T14oxic by 4v140rt34x14 nd 4C14ryptik4S5)

Thx for helpin me out with this guys . If we cant get it to do it this way . Does anyone know another way I can kill selected scripts off at connect . got to work on win32 tho .

codemastr · Post by **codemastr** » Tue Apr 20, 2004 4:57 am

You are /rehash'ing after adding it, right?

Ron2K · Post by **Ron2K** » Tue Apr 20, 2004 6:04 am

codemastr wrote:If the reply has color codes in it, then you need to include the color codes in your match text. Unreal does not strip them out.

Perhaps Unreal could have an option to strip out the colour codes in future releases?

/me goes to bug tracker and posts it as a feature suggestion...

Solutech · Post by **Solutech** » Wed Apr 21, 2004 1:32 pm

Yup I rehashed it , shut the whole shebang down and rebooted . Still no change . Im thinking maybe that the ctcp reply its looking at is the Mirc 6.x and not the infected reply . Will unreal check both or just the first? . If it checks one im off to put a new feature request in too lol .

Post by **Syzop** » Thu Apr 22, 2004 6:22 pm

*late*

It will take action regardless of which one is first or how much delay there is.

But does it actually send the text you are trying to block at as a CTCP REPLY? Or is it a notice or something else...

Solutech · Post by **Solutech** » Fri Apr 23, 2004 9:11 pm

Had a dig thru the script and its a notice . guess it wont do it on notice then . Any way this could be incorporated into a later version ?

aquanight · Post by **aquanight** » Fri Apr 23, 2004 9:54 pm

In that case, you should be able to...

Code: Select all

spamfilter {
    regex "(InfecteD vÂ¹; Toxic by v0rt3x nd CryptikS)";
    target { private-notice; channel-notice; };
    action gzline;
    reason "warscript";
    ban-time 3h; // Change this as appropriate.
};

NOTE: Since CTCPREPLY VERSION is sent as a private notice, this will have the (wanted) side-effect of GZ-Lining any script that sends the reply as a true-blue VERSION reply, instead of a notice.

Post by **Syzop** » Fri Apr 23, 2004 11:50 pm

Fun thing is that the ctcp version request caused by the ban version block is sent by the internal user 'IRC'. And msgs/notices to 'irc' (and 'ircd') are not catched by spamfilter :p [prolly wouldn't be a good idea anyway, since they are used for (raw) commands by webtv users].

codemastr · Post by **codemastr** » Sat Apr 24, 2004 4:13 am

No, the \ is not necessary.

aquanight · Post by **aquanight** » Sun Apr 25, 2004 7:25 pm

codemastr wrote:No, the \ is not necessary.

Okay.

(In .NET regex's they're used for grouping, and since Unreal's regex language was similar, I'd half-assumed they'd be necessary.) But hopefully it doesn't matter whether they're in there or not

.

Syzop wrote:And msgs/notices to 'irc' (and 'ircd') are not catched by spamfilter

Well, with that, they may get past the IRC version check, but if some ordinary user then later CTCP VERSION the script, it will get GZLine'd then.

It probably won't help this issue, but I think something can/should be added to put a tkl ban on users that don't send a version reply. Something like:

Code: Select all

ban version {
    timelimit 10s;
    action kill /* or tempshun/shun/kline/zline/gline/gzline */ ;
    reason "Network rules require your client to respond normally to a VERSION request.";
};

And that would make the CTCP VERSION exchange part of the user login (with the PING/PONG exchange, DNS lookup, and Ident check).