Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

connregex, IPv6 and UnrealIRCd #47

Open
TehPeGaSuS opened this issue Jan 29, 2023 · 0 comments
Open

connregex, IPv6 and UnrealIRCd #47

TehPeGaSuS opened this issue Jan 29, 2023 · 0 comments

Comments

@TehPeGaSuS
Copy link

TehPeGaSuS commented Jan 29, 2023

UnrealIRCd has a new way of displaying connect notices to opers, that looks like this:

  • Locally:
    connect.LOCAL_CLIENT_CONNECT [info] Client connecting: Guest-62142 (~vitor@67.228.26.34) [67.228.26.34] [vhost: C6C1711B.8056F8D2.AE032BD3.IP] [class: clients] [secure: TLSv1.3-TLS_CHACHA20_POLY1305_SHA256] [country: FR] [reputation: 10000] [security-groups: known-users,tls-and-known-users,tls-users]
  • Remotely:
    connect.REMOTE_CLIENT_CONNECT [info] Client connecting: Guest-62142 (~vitor@67.228.26.34) [67.228.26.34] [vhost: C6C1711B.8056F8D2.AE032BD3.IP] [secure: TLSv1.3-TLS_CHACHA20_POLY1305_SHA256] [country: FR] [reputation: 10000] [security-groups: known-users,tls-and-known-users,tls-users]

My current connregex is:
connregex = ".*Client connecting: ([^ ]+) \\(([^@]+)@([^\\)]+)\\) \\[([0-9a-f\\.:]+)\\].*";

When a user connects using IPv4, all seems to work properly:

[2023-01-29T13:15:24+0100] IRC READ -> :irc3.ptirc.org NOTICE HOPM :14connect.REMOTE_CLIENT_CONNECT 03[info] Client connecting: vitor (~vitor@67.228.26.34) [67.228.26.34] [vhost: C6C1711B.8056F8D2.AE032BD3.IP] [secure: TLSv1.3-TLS_CHACHA20_POLY1305_SHA256] [country: FR] [reputation: 10000] [security-groups: known-users,tls-and-known-users,tls-users]
[2023-01-29T13:15:24+0100] IRC REGEX -> Regular expression caught connection notice. Parsing.
[2023-01-29T13:15:24+0100] IRC REGEX -> Parsed vitor!~vitor@67.228.26.34 [67.228.26.34] from connection notice.
[2023-01-29T13:15:24+0100] IRC SEND -> NOTICE vitor :You are now being scanned for open proxies. If you have nothing to hide, you have nothing to fear.
[2023-01-29T13:15:24+0100] SCAN -> Passing vitor!~vitor@67.228.26.34 to scanner [default]
[2023-01-29T13:15:24+0100] SCAN -> Passing vitor!~vitor@67.228.26.34 to scanner [extended]
[2023-01-29T13:15:24+0100] SCAN -> Passing vitor!~vitor@67.228.26.34 to scanner [ssh]
[2023-01-29T13:15:24+0100] IRC READ -> :irc3.ptirc.org PRIVMSG #Control :03[info] Client connecting: vitor (~vitor@67.228.26.34) [67.228.26.34] [vhost: C6C1711B.8056F8D2.AE032BD3.IP] [secure: TLSv1.3-TLS_CHACHA20_POLY1305_SHA256] [country: FR] [reputation: 10000] [security-groups: known-users,tls-and-known-users,tls-users]
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:80 (HTTPPOST) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:23 (DREAMBOX) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:23 (WINGATE) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:23 (ROUTER) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:1080 (SOCKS5) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:1080 (SOCKS4) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:6588 (HTTP) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:3128 (HTTP) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8080 (HTTP) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:80 (HTTP) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Scan 67.228.26.34 [default] completed
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:31121 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:17771 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:18844 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:38884 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:29992 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:64101 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:10000 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:9578 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:9447 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:9186 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:9100 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8814 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8520 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8148 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8130 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:7810 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:7464 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:6561 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:6552 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:5634 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:5262 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:5113 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:5104 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:4438 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:9036 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:7366 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:7198 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:6826 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:4914 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8081 (HTTPPOST) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8080 (HTTPPOST) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8001 (HTTPPOST) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8000 (HTTPPOST) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:4480 (HTTPPOST) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:6588 (HTTPPOST) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:81 (HTTPPOST) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8081 (HTTP) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8001 (HTTP) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8000 (HTTP) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:81 (HTTP) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Scan 67.228.26.34 [extended] completed
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:22 (SSH) [ssh] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Scan 67.228.26.34 [ssh] completed
[2023-01-29T13:15:53+0100] SCAN -> All tests on vitor!~vitor@67.228.26.34 [67.228.26.34] complete.

But when a user connects via IPv6 (now, I'm unsure if the issue is related to revdns), HOPM just hangs after Passing ... to scanner ...:

[2023-01-29T13:13:55+0100] IRC READ -> :irc1.ptirc.org NOTICE HOPM :14connect.LOCAL_CLIENT_CONNECT 03[info] Client connecting: Raiden (James@user.rev.dns) [2a01:2a02:2a03:2a04:2a05:2a06:2a07:2a08] [vhost: 5ECFF1A:C50BABED:3432A6B5:IP] [class: clients] [secure: TLSv1.3-TLS_CHACHA20_POLY1305_SHA256] [account: Raiden] [country: DE] [reputation: 10000] [security-groups: known-users,tls-and-known-users,tls-users]
[2023-01-29T13:13:55+0100] IRC REGEX -> Regular expression caught connection notice. Parsing.
[2023-01-29T13:13:55+0100] IRC REGEX -> Parsed Raiden!James@user.rev.dns [2a01:2a02:2a03:2a04:2a05:2a06:2a07:2a08] from connection notice.
[2023-01-29T13:13:55+0100] IRC SEND -> NOTICE Raiden :You are now being scanned for open proxies. If you have nothing to hide, you have nothing to fear.
[2023-01-29T13:13:55+0100] SCAN -> Passing Raiden!James@user.rev.dns to scanner [default]
[2023-01-29T13:13:55+0100] SCAN -> Passing Raiden!James@user.rev.dns to scanner [extended]
[2023-01-29T13:13:55+0100] SCAN -> Passing Raiden!James@user.rev.dns to scanner [ssh]

Any help/ideas are greatly appreciatted.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

1 participant