View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0000891 | unreal | ircd | public | 2003-04-14 12:38 | 2003-11-20 19:43 |
| Reporter | poisoner | Assigned To | |||
| Priority | normal | Severity | minor | Reproducibility | always |
| Status | closed | Resolution | fixed | ||
| Product Version | 3.2-beta15 | ||||
| Summary | 0000891: Ban version {} can be passed by on slowing down version replies | ||||
| Description | If chatter has multiple lines of ctcp version reply, mostly the second line seems to be ignored if the first reply did not match any ban line... Also it can be passed by if User tells his client to ignore a User called "IRC". What about using a username from host-cloaking routine, and checking all lines of the version reply? | ||||
| 3rd party modules | |||||
|
|
Well Unreal handles multi-line CTCP VERSION replies just fine: in mIRC: ctcp *:version*:*:{ ctcpreply $nick VERSION blah } in UnrealIRCd: ban version { mask "*blah*"; reason "test"; }; And when I connect, [12:09] Closing Link: codemastr[XXX.XXX.XXX.XXX] (test) So I'm not sure what you mean when you say it isn't working, because it works perfectly here. And I will consider the randomized nick for sending the version, but keep in mind that that won't solve anything either, if you ignore all ctcp requests, it will evade the system anyway... |
|
|
Yes... it works perfectly, if the first reply matches any ban version {} statement. But have a look at scripts like looksharp... And insert a reply line before the reply of the script... If the reply is like that: Apr 14 14:24:03 -_Iris__- VERSION mIRC32 v5.91 K.Mardam-Bey Apr 14 14:24:07 -_Iris__- L o o k s h a r p 3.1Æ by Amaz|ng^ - HighAce http://www.looksharp.com.ar - http://www.looksharp.at IRC/IRCX Futura Theme für mIRC Apr 14 14:24:07 -_Iris__- VERSION mIRC32 v5.91 K.Mardam-Bey It does not match... If the first line is not send, it matches... I think every line of a reply should be checked. But I know that there should be a timeout. Slowing down the connection ist not good. Another way may be to check every version reply which goes through the server. But that may result in a higher load of the server... |
|
|
Is the second line (from the three examples) a CTCP version reply? Because it isn't a standard one... |
|
|
This is the reply which was added by the mIRC Script "looksharp". Most Scripts for mIRC add a line to the original mIRC Version reply, or replace ist. (hennesscript, showdown, pnp. looksharp, german fun script etc.). Mostly to distribute the URL to download it from. btw. this is _ONE_ example... The original reply send first, sleep 4 secs, then send the normal scriptreply. |
|
|
AFAIK replies from most script are notices, not ctcpreply... no ? (using xchat since my first irc word... never had this kind of 'problem'... never even thinked more than 2sec about such a problem...) |
|
|
it should be a feature request that do "ban ctcp {}" not only "ban version{}" (which should be "ban ctcp version{}" |
|
|
Currently there is no support for multiple block values yet, so your example might be solved by an additional directive in ban block, dunno. However, I don't wholly agree with your suggestion. That "L o o k S h a r p" CTCP reply is pretty invalid, and should be ignored (Or even better: we should follow standards and make them stricter by banning clients sending such a bad CTCP reply?) |
|
|
Umm that makes no sense? Why would you ban for other replies? What possible reason would you have to ban someone because of a PING/TIME/FINGER reply? |
|
|
hrmm.... there is 2 step to check ctcp 1. send /CTCP VERSION request 2. wait for "/CTCPREPLY VERSION", and check we need not to change step 1 to do PING TIME FINGER but just modify the step 2, to check not only the "/CTCPREPLY VERSION" but all "/CTCPREPLY" from client, it shouldn't be hard it the client is non-standard, why should be standard to be spoof? and yes, all of us know it's just a reply from client, and not believable but what poisoner want to do is just to ban some bad bot which want to show off itself. e.g., in ctcpreply, use non-standard reply to show off and escape from the check in quit/part msgs, show off it's long dirty-colored URL |
|
|
hmm well not sure if I'll make it check for ALL ctcp replies, but I'll add CTCP SCRIPT checking. I've seen a couple of scripts that use that to show their added crap. |
|
|
Ok, as of .1784 it will also listen for CTCP SCRIPT messages. |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2003-04-14 12:38 | poisoner | New Issue | |
| 2003-04-14 16:14 |
|
Note Added: 0002317 | |
| 2003-04-15 09:15 | poisoner | Note Added: 0002333 | |
| 2003-04-15 12:37 | AngryWolf | Note Added: 0002335 | |
| 2003-04-15 13:00 | poisoner | Note Added: 0002337 | |
| 2003-04-16 07:59 | mister | Note Added: 0002352 | |
| 2003-05-06 05:19 | Xuefer | Note Added: 0002665 | |
| 2003-05-06 19:07 | AngryWolf | Note Added: 0002672 | |
| 2003-05-06 21:42 |
|
Note Added: 0002681 | |
| 2003-05-07 02:42 | Xuefer | Note Added: 0002686 | |
| 2003-05-07 03:34 |
|
Note Added: 0002687 | |
| 2003-05-08 19:09 |
|
Status | new => resolved |
| 2003-05-08 19:09 |
|
Resolution | open => fixed |
| 2003-05-08 19:09 |
|
Assigned To | => codemastr |
| 2003-05-08 19:09 |
|
Note Added: 0002720 | |
| 2003-11-20 19:43 | syzop | Status | resolved => closed |
