Merge pull request 'server: add wildcard matching to blocked hosts' (#260) from wildcard-block-v2 into main

Reviewed-on: FoundKeyGang/FoundKey#260
This commit is contained in:
Norm 2022-12-01 20:12:18 +00:00
commit e10700a2be
5 changed files with 46 additions and 26 deletions

View file

@ -187,7 +187,7 @@ clearCachedFiles: "Clear cache"
clearCachedFilesConfirm: "Are you sure that you want to delete all cached remote files?" clearCachedFilesConfirm: "Are you sure that you want to delete all cached remote files?"
blockedInstances: "Blocked Instances" blockedInstances: "Blocked Instances"
blockedInstancesDescription: "List the hostnames of the instances that you want to\ blockedInstancesDescription: "List the hostnames of the instances that you want to\
\ block. Listed instances will no longer be able to communicate with this instance." \ block. Listed instances will no longer be able to communicate with this instance. Non-ASCII domain names must be encoded in punycode. You can use an asterisk (*) as a placeholder for zero or more character(s)."
muteAndBlock: "Mutes and Blocks" muteAndBlock: "Mutes and Blocks"
mutedUsers: "Muted users" mutedUsers: "Muted users"
blockedUsers: "Blocked users" blockedUsers: "Blocked users"

View file

@ -1,7 +1,5 @@
import { Brackets } from 'typeorm';
import { db } from '@/db/postgre.js'; import { db } from '@/db/postgre.js';
import { fetchMeta } from '@/misc/fetch-meta.js'; import { fetchMeta } from '@/misc/fetch-meta.js';
import { Instances } from '@/models/index.js';
import { Instance } from '@/models/entities/instance.js'; import { Instance } from '@/models/entities/instance.js';
import { DAY } from '@/const.js'; import { DAY } from '@/const.js';
@ -9,17 +7,40 @@ import { DAY } from '@/const.js';
// "dead" and should no longer get activities delivered to it. // "dead" and should no longer get activities delivered to it.
const deadThreshold = 7 * DAY; const deadThreshold = 7 * DAY;
/**
* Returns whether a given host matches a wildcard pattern.
* @param host punycoded instance host
* @param pattern wildcard pattern containing a punycoded instance host
* @returns whether the post matches the pattern
*/
function matchHost(host: Instance['host'], pattern: string): boolean {
// Escape all of the regex special characters. Pattern from:
// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#escaping
const escape = (str: string): string => str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
const re = new RegExp('^' + pattern.split('*').map(escape).join('.*') + '$');
return re.test(host);
}
/**
* Returns whether a specific host (punycoded) should be blocked.
*
* @param host punycoded instance host
* @returns whether the given host should be blocked
*/
export async function shouldBlockInstance(host: string): Promise<boolean> {
const { blockedHosts } = await fetchMeta();
return blockedHosts.some(blockedHost => matchHost(host, blockedHost));
}
/** /**
* Returns the subset of hosts which should be skipped. * Returns the subset of hosts which should be skipped.
* *
* @param hosts array of punycoded instance hosts * @param hosts array of punycoded instance hosts
* @returns array of punycoed instance hosts that should be skipped (subset of hosts parameter) * @returns array of punycoded instance hosts that should be skipped (subset of hosts parameter)
*/ */
export async function skippedInstances(hosts: Array<Instace['host']>): Array<Instance['host']> { export async function skippedInstances(hosts: Array<Instance['host']>): Promise<Array<Instance['host']>> {
// first check for blocked instances since that info may already be in memory const skipped = hosts.filter(host => shouldBlockInstance(host));
const { blockedHosts } = await fetchMeta();
const skipped = hosts.filter(host => blockedHosts.includes(host));
// if possible return early and skip accessing the database // if possible return early and skip accessing the database
if (skipped.length === hosts.length) return hosts; if (skipped.length === hosts.length) return hosts;
@ -35,7 +56,7 @@ export async function skippedInstances(hosts: Array<Instace['host']>): Array<Ins
hosts.filter(host => !skipped.includes(host) && !host.includes(',')).join(','), hosts.filter(host => !skipped.includes(host) && !host.includes(',')).join(','),
], ],
) )
.then(res => res.map(row => row.host)) .then(res => res.map(row => row.host)),
); );
} }
@ -47,7 +68,7 @@ export async function skippedInstances(hosts: Array<Instace['host']>): Array<Ins
* @param host punycoded instance host * @param host punycoded instance host
* @returns whether the given host should be skipped * @returns whether the given host should be skipped
*/ */
export async function shouldSkipInstance(host: Instance['host']): boolean { export async function shouldSkipInstance(host: Instance['host']): Promise<boolean> {
const skipped = await skippedInstances([host]); const skipped = await skippedInstances([host]);
return skipped.length > 0; return skipped.length > 0;
} }

View file

@ -6,7 +6,6 @@ import Logger from '@/services/logger.js';
import { registerOrFetchInstanceDoc } from '@/services/register-or-fetch-instance-doc.js'; import { registerOrFetchInstanceDoc } from '@/services/register-or-fetch-instance-doc.js';
import { Instances } from '@/models/index.js'; import { Instances } from '@/models/index.js';
import { apRequestChart, federationChart, instanceChart } from '@/services/chart/index.js'; import { apRequestChart, federationChart, instanceChart } from '@/services/chart/index.js';
import { fetchMeta } from '@/misc/fetch-meta.js';
import { toPuny, extractDbHost } from '@/misc/convert-host.js'; import { toPuny, extractDbHost } from '@/misc/convert-host.js';
import { getApId } from '@/remote/activitypub/type.js'; import { getApId } from '@/remote/activitypub/type.js';
import { fetchInstanceMetadata } from '@/services/fetch-instance-metadata.js'; import { fetchInstanceMetadata } from '@/services/fetch-instance-metadata.js';
@ -17,6 +16,7 @@ import { StatusError } from '@/misc/fetch.js';
import { CacheableRemoteUser } from '@/models/entities/user.js'; import { CacheableRemoteUser } from '@/models/entities/user.js';
import { UserPublickey } from '@/models/entities/user-publickey.js'; import { UserPublickey } from '@/models/entities/user-publickey.js';
import { InboxJobData } from '@/queue/types.js'; import { InboxJobData } from '@/queue/types.js';
import { shouldBlockInstance } from '@/misc/skipped-instances.js';
const logger = new Logger('inbox'); const logger = new Logger('inbox');
@ -33,9 +33,8 @@ export default async (job: Bull.Job<InboxJobData>): Promise<string> => {
const host = toPuny(new URL(signature.keyId).hostname); const host = toPuny(new URL(signature.keyId).hostname);
// ブロックしてたら中断 // Stop if the host is blocked.
const meta = await fetchMeta(); if (await shouldBlockInstance(host)) {
if (meta.blockedHosts.includes(host)) {
return `Blocked request: ${host}`; return `Blocked request: ${host}`;
} }
@ -117,9 +116,9 @@ export default async (job: Bull.Job<InboxJobData>): Promise<string> => {
return `skip: LD-Signature user(${authUser.user.uri}) !== activity.actor(${activity.actor})`; return `skip: LD-Signature user(${authUser.user.uri}) !== activity.actor(${activity.actor})`;
} }
// ブロックしてたら中断 // Stop if the host is blocked.
const ldHost = extractDbHost(authUser.user.uri); const ldHost = extractDbHost(authUser.user.uri);
if (meta.blockedHosts.includes(ldHost)) { if (await shouldBlockInstance(ldHost)) {
return `Blocked request: ${ldHost}`; return `Blocked request: ${ldHost}`;
} }
} else { } else {

View file

@ -2,7 +2,6 @@ import config from '@/config/index.js';
import { getJson } from '@/misc/fetch.js'; import { getJson } from '@/misc/fetch.js';
import { ILocalUser } from '@/models/entities/user.js'; import { ILocalUser } from '@/models/entities/user.js';
import { getInstanceActor } from '@/services/instance-actor.js'; import { getInstanceActor } from '@/services/instance-actor.js';
import { fetchMeta } from '@/misc/fetch-meta.js';
import { extractDbHost, isSelfHost } from '@/misc/convert-host.js'; import { extractDbHost, isSelfHost } from '@/misc/convert-host.js';
import { Notes, NoteReactions, Polls, Users } from '@/models/index.js'; import { Notes, NoteReactions, Polls, Users } from '@/models/index.js';
import renderNote from '@/remote/activitypub/renderer/note.js'; import renderNote from '@/remote/activitypub/renderer/note.js';
@ -12,6 +11,7 @@ import renderQuestion from '@/remote/activitypub/renderer/question.js';
import renderCreate from '@/remote/activitypub/renderer/create.js'; import renderCreate from '@/remote/activitypub/renderer/create.js';
import { renderActivity } from '@/remote/activitypub/renderer/index.js'; import { renderActivity } from '@/remote/activitypub/renderer/index.js';
import renderFollow from '@/remote/activitypub/renderer/follow.js'; import renderFollow from '@/remote/activitypub/renderer/follow.js';
import { shouldBlockInstance } from '@/misc/skipped-instances.js';
import { signedGet } from './request.js'; import { signedGet } from './request.js';
import { IObject, isCollectionOrOrderedCollection, ICollection, IOrderedCollection } from './type.js'; import { IObject, isCollectionOrOrderedCollection, ICollection, IOrderedCollection } from './type.js';
import { parseUri } from './db-resolver.js'; import { parseUri } from './db-resolver.js';
@ -71,8 +71,7 @@ export default class Resolver {
return await this.resolveLocal(value); return await this.resolveLocal(value);
} }
const meta = await fetchMeta(); if (await shouldBlockInstance(host)) {
if (meta.blockedHosts.includes(host)) {
throw new Error('Instance is blocked'); throw new Error('Instance is blocked');
} }

View file

@ -1,4 +1,3 @@
import config from '@/config/index.js';
import { createPerson } from '@/remote/activitypub/models/person.js'; import { createPerson } from '@/remote/activitypub/models/person.js';
import { createNote } from '@/remote/activitypub/models/note.js'; import { createNote } from '@/remote/activitypub/models/note.js';
import DbResolver from '@/remote/activitypub/db-resolver.js'; import DbResolver from '@/remote/activitypub/db-resolver.js';
@ -7,10 +6,10 @@ import { extractDbHost } from '@/misc/convert-host.js';
import { Users, Notes } from '@/models/index.js'; import { Users, Notes } from '@/models/index.js';
import { Note } from '@/models/entities/note.js'; import { Note } from '@/models/entities/note.js';
import { CacheableLocalUser, User } from '@/models/entities/user.js'; import { CacheableLocalUser, User } from '@/models/entities/user.js';
import { fetchMeta } from '@/misc/fetch-meta.js';
import { isActor, isPost, getApId } from '@/remote/activitypub/type.js'; import { isActor, isPost, getApId } from '@/remote/activitypub/type.js';
import { SchemaType } from '@/misc/schema.js'; import { SchemaType } from '@/misc/schema.js';
import { HOUR } from '@/const.js'; import { HOUR } from '@/const.js';
import { shouldBlockInstance } from '@/misc/skipped-instances.js';
import define from '../../define.js'; import define from '../../define.js';
import { ApiError } from '../../error.js'; import { ApiError } from '../../error.js';
@ -85,9 +84,11 @@ export default define(meta, paramDef, async (ps, me) => {
* URIからUserかNoteを解決する * URIからUserかNoteを解決する
*/ */
async function fetchAny(uri: string, me: CacheableLocalUser | null | undefined): Promise<SchemaType<typeof meta['res']> | null> { async function fetchAny(uri: string, me: CacheableLocalUser | null | undefined): Promise<SchemaType<typeof meta['res']> | null> {
// ブロックしてたら中断 // Stop if the host is blocked.
const fetchedMeta = await fetchMeta(); const host = extractDbHost(uri);
if (fetchedMeta.blockedHosts.includes(extractDbHost(uri))) return null; if (await shouldBlockInstance(host)) {
return null;
}
const dbResolver = new DbResolver(); const dbResolver = new DbResolver();