Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add IP-based rules #14963

Merged
merged 1 commit into from
Oct 12, 2020
Merged

Add IP-based rules #14963

merged 1 commit into from
Oct 12, 2020

Conversation

Gargron
Copy link
Member

@Gargron Gargron commented Oct 10, 2020 •
edited
Loading

Admins get the ability to add rules for IP addresses and CIDR ranges, such as blocking all access, or requiring sign-ups to go through the approval process even if they're otherwise open.

image

The CLI utility is extended with the following commands:

  • tootctl ip_blocks add 1.1.1.1 2.2.2.2 --severity=no_access --comment="These are bad" --duration=31557600
  • tootctl ip_blocks remove 2.2.2.2
  • tootctl ip_blocks export --format=nginx

@Gargron Gargron force-pushed the feature-ip-blocks branch 4 times, most recently from 1a70134 to 95f01a6 Compare October 10, 2020 22:17
@Gargron Gargron marked this pull request as ready for review October 10, 2020 22:22
@Gargron Gargron added the moderation Administration and moderation tooling label Oct 10, 2020
@Gargron Gargron force-pushed the feature-ip-blocks branch 2 times, most recently from b5d4945 to c595422 Compare October 10, 2020 22:35
@ClearlyClaire ClearlyClaire self-requested a review October 11, 2020 12:10
ClearlyClaire
ClearlyClaire requested changes Oct 11, 2020
View reviewed changes
Copy link
Contributor

@ClearlyClaire ClearlyClaire left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Requesting a few changes through inline comments.

Besides that, I'm a bit worried about how much this would scale: I have to admit I have no idea how many IP/subnets an instance would typically block, but I'm a bit concerned with the code loading the full list into RAM at once, as well as enumerating all subnet blocks to find a matching one. But maybe that's fine.

Gemfile Outdated Show resolved Hide resolved
Gemfile.lock Outdated Show resolved Hide resolved
Gemfile.lock Outdated Show resolved Hide resolved
lib/mastodon/ip_blocks_cli.rb Outdated Show resolved Hide resolved
app/models/user.rb
end

def sign_up_from_ip_requires_approval?
!sign_up_ip.nil? && IpBlock.where(severity: :sign_up_requires_approval).where('ip >>= ?', sign_up_ip.to_s).exists?
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That check is possibly quite slow.

@Gargron
Copy link
Member Author

Gargron commented Oct 11, 2020

Besides that, I'm a bit worried about how much this would scale: I have to admit I have no idea how many IP/subnets an instance would typically block, but I'm a bit concerned with the code loading the full list into RAM at once, as well as enumerating all subnet blocks to find a matching one. But maybe that's fine.

I have two pieces of data to offer. One, by comparing to e-mail domain blocks I've accumulated over 4 years: 64, and a list of IPs I've blocked on iptables level: 291. So the assumption I am working with is that we're dealing with three digit numbers here, which is also why I'm not quick to add indices to this table.

ClearlyClaire
ClearlyClaire approved these changes Oct 12, 2020
View reviewed changes
Copy link
Contributor

@ClearlyClaire ClearlyClaire left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

alright, looks good to me

still a bit worried about scaling, but based on your earlier comment, it should be fine

@Gargron Gargron merged commit 5e1364c into master Oct 12, 2020
@Gargron Gargron deleted the feature-ip-blocks branch October 12, 2020 14:33
@tribela
Copy link
Contributor

tribela commented Oct 13, 2020

How about allowlist for ip rules? it could be useful for school

mashirozx added a commit to mashirozx/mastodon that referenced this pull request Oct 16, 2020
@mashirozx @dependabot
@Gargron @ClearlyClaire @aquarla @dunn @noellabo @mayaeh
merge upstream & update theme (#234)
f9afbd0 
* Bump babel-jest from 26.3.0 to 26.5.2 (mastodon#14945)

Bumps [babel-jest](https://github.com/facebook/jest/tree/HEAD/packages/babel-jest) from 26.3.0 to 26.5.2.
- [Release notes](https://github.com/facebook/jest/releases)
- [Changelog](https://github.com/facebook/jest/blob/master/CHANGELOG.md)
- [Commits](https://github.com/facebook/jest/commits/v26.5.2/packages/babel-jest)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump @github/webauthn-json from 0.5.5 to 0.5.6 (mastodon#14946)

Bumps [@github/webauthn-json](https://github.com/github/webauthn-json) from 0.5.5 to 0.5.6.
- [Release notes](https://github.com/github/webauthn-json/releases)
- [Commits](github/webauthn-json@v0.5.5...v0.5.6)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump sass from 1.26.11 to 1.26.12 (mastodon#14947)

Bumps [sass](https://github.com/sass/dart-sass) from 1.26.11 to 1.26.12.
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/master/CHANGELOG.md)
- [Commits](sass/dart-sass@1.26.11...1.26.12)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump eslint-plugin-react from 7.21.2 to 7.21.3 (mastodon#14950)

Bumps [eslint-plugin-react](https://github.com/yannickcr/eslint-plugin-react) from 7.21.2 to 7.21.3.
- [Release notes](https://github.com/yannickcr/eslint-plugin-react/releases)
- [Changelog](https://github.com/yannickcr/eslint-plugin-react/blob/master/CHANGELOG.md)
- [Commits](jsx-eslint/eslint-plugin-react@v7.21.2...v7.21.3)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump mini-css-extract-plugin from 0.11.0 to 0.11.3 (mastodon#14949)

Bumps [mini-css-extract-plugin](https://github.com/webpack-contrib/mini-css-extract-plugin) from 0.11.0 to 0.11.3.
- [Release notes](https://github.com/webpack-contrib/mini-css-extract-plugin/releases)
- [Changelog](https://github.com/webpack-contrib/mini-css-extract-plugin/blob/master/CHANGELOG.md)
- [Commits](webpack-contrib/mini-css-extract-plugin@v0.11.0...v0.11.3)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump jest from 26.4.2 to 26.5.2 (mastodon#14951)

Bumps [jest](https://github.com/facebook/jest) from 26.4.2 to 26.5.2.
- [Release notes](https://github.com/facebook/jest/releases)
- [Changelog](https://github.com/facebook/jest/blob/master/CHANGELOG.md)
- [Commits](jestjs/jest@v26.4.2...v26.5.2)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump eslint from 7.6.0 to 7.10.0 (mastodon#14948)

Bumps [eslint](https://github.com/eslint/eslint) from 7.6.0 to 7.10.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](eslint/eslint@v7.6.0...v7.10.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* update themes

* Remove dependency on goldfinger gem (mastodon#14919)

There are edge cases where requests to certain hosts timeout when
using the vanilla HTTP.rb gem, which the goldfinger gem uses. Now
that we no longer need to support OStatus servers, webfinger logic
is so simple that there is no point encapsulating it in a gem, so
we can just use our own Request class. With that, we benefit from
more robust timeout code and IPv4/IPv6 resolution.

Fix mastodon#14091

* Fix unread notification marker not updating when mounting column (mastodon#14954)

* Fix issue checking for last unread notification when there are gaps (mastodon#14960)

* add & fix themes

* update theme

* fix theme

* fix theme

* Add IP-based rules (mastodon#14963)

* Fix browser notification permission request logic (mastodon#13543)

* Add notification permission handling code

* Request notification permission when enabling any notification setting

* Add badge to notification settings when permissions insufficient

* Disable alerts by default, requesting permission and enable them on onboarding

* Add duration parameter to muting. (mastodon#13831)

* Adding duration to muting.

* Remove useless checks

* helm: add optional cron job to run `tootctl remove media` (mastodon#14396)

* Change how CDN_HOST is passed down to make assets build reproducible (mastodon#14381)

* Change how CDN_HOST is passed down to make assets build reproducible

* Change webpacker/webpack configuration to dynamically load publicPath based on meta header

* Fix embedded layout missing the cdn-host meta header

* Bump compression-webpack-plugin from 6.0.2 to 6.0.3 (mastodon#14979)

Bumps [compression-webpack-plugin](https://github.com/webpack-contrib/compression-webpack-plugin) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/webpack-contrib/compression-webpack-plugin/releases)
- [Changelog](https://github.com/webpack-contrib/compression-webpack-plugin/blob/master/CHANGELOG.md)
- [Commits](webpack-contrib/compression-webpack-plugin@v6.0.2...v6.0.3)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump sass-loader from 10.0.2 to 10.0.3 (mastodon#14977)

Bumps [sass-loader](https://github.com/webpack-contrib/sass-loader) from 10.0.2 to 10.0.3.
- [Release notes](https://github.com/webpack-contrib/sass-loader/releases)
- [Changelog](https://github.com/webpack-contrib/sass-loader/blob/master/CHANGELOG.md)
- [Commits](webpack-contrib/sass-loader@v10.0.2...v10.0.3)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump imports-loader from 1.1.0 to 1.2.0 (mastodon#14976)

Bumps [imports-loader](https://github.com/webpack-contrib/imports-loader) from 1.1.0 to 1.2.0.
- [Release notes](https://github.com/webpack-contrib/imports-loader/releases)
- [Changelog](https://github.com/webpack-contrib/imports-loader/blob/master/CHANGELOG.md)
- [Commits](webpack-contrib/imports-loader@v1.1.0...v1.2.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump tzinfo-data from 1.2020.1 to 1.2020.2 (mastodon#14966)

Bumps [tzinfo-data](https://github.com/tzinfo/tzinfo-data) from 1.2020.1 to 1.2020.2.
- [Release notes](https://github.com/tzinfo/tzinfo-data/releases)
- [Commits](tzinfo/tzinfo-data@v1.2020.1...v1.2020.2)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump rubocop from 0.92.0 to 0.93.0 (mastodon#14967)

Bumps [rubocop](https://github.com/rubocop-hq/rubocop) from 0.92.0 to 0.93.0.
- [Release notes](https://github.com/rubocop-hq/rubocop/releases)
- [Changelog](https://github.com/rubocop-hq/rubocop/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop@v0.92.0...v0.93.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump file-loader from 6.1.0 to 6.1.1 (mastodon#14974)

Bumps [file-loader](https://github.com/webpack-contrib/file-loader) from 6.1.0 to 6.1.1.
- [Release notes](https://github.com/webpack-contrib/file-loader/releases)
- [Changelog](https://github.com/webpack-contrib/file-loader/blob/master/CHANGELOG.md)
- [Commits](webpack-contrib/file-loader@v6.1.0...v6.1.1)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump eslint-plugin-react from 7.21.3 to 7.21.4 (mastodon#14968)

Bumps [eslint-plugin-react](https://github.com/yannickcr/eslint-plugin-react) from 7.21.3 to 7.21.4.
- [Release notes](https://github.com/yannickcr/eslint-plugin-react/releases)
- [Changelog](https://github.com/yannickcr/eslint-plugin-react/blob/master/CHANGELOG.md)
- [Commits](jsx-eslint/eslint-plugin-react@v7.21.3...v7.21.4)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump terser-webpack-plugin from 4.2.2 to 4.2.3 (mastodon#14971)

Bumps [terser-webpack-plugin](https://github.com/webpack-contrib/terser-webpack-plugin) from 4.2.2 to 4.2.3.
- [Release notes](https://github.com/webpack-contrib/terser-webpack-plugin/releases)
- [Changelog](https://github.com/webpack-contrib/terser-webpack-plugin/blob/master/CHANGELOG.md)
- [Commits](webpack-contrib/terser-webpack-plugin@v4.2.2...v4.2.3)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump eslint from 7.10.0 to 7.11.0 (mastodon#14975)

Bumps [eslint](https://github.com/eslint/eslint) from 7.10.0 to 7.11.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](eslint/eslint@v7.10.0...v7.11.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump sass from 1.26.12 to 1.27.0 (mastodon#14973)

Bumps [sass](https://github.com/sass/dart-sass) from 1.26.12 to 1.27.0.
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/master/CHANGELOG.md)
- [Commits](sass/dart-sass@1.26.12...1.27.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump jest from 26.5.2 to 26.5.3 (mastodon#14969)

Bumps [jest](https://github.com/facebook/jest) from 26.5.2 to 26.5.3.
- [Release notes](https://github.com/facebook/jest/releases)
- [Changelog](https://github.com/facebook/jest/blob/master/CHANGELOG.md)
- [Commits](jestjs/jest@v26.5.2...v26.5.3)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Fix a bear check when the activity object is nil (mastodon#14981)

* Change how missing desktop notifications permission is displayed (mastodon#14985)

Add missing controls for new notification type

* Fix strings that could not be translated (mastodon#14980)

* Fix translation string (mastodon#14986)

* update theme

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Eugen Rochko <eugen@zeonfederated.com>
Co-authored-by: ThibG <thib@sitedethib.com>
Co-authored-by: OSAMU SATO <satosamu@gmail.com>
Co-authored-by: Alex Dunn <dunn.alex@gmail.com>
Co-authored-by: Takeshi Umeda <noel.yoshiba@gmail.com>
Co-authored-by: mayaeh <mayaeh@marimo-net.org>
@rodti
Copy link

rodti commented Nov 4, 2020

This is a great feature. A couple of nice-to-haves are to have the list sorted numerically, and to be able to edit existing IP rules (like the federation edit screen).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ClearlyClaire ClearlyClaire ClearlyClaire approved these changes

Assignees
No one assigned
Labels
moderation Administration and moderation tooling
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@Gargron @tribela @rodti @ClearlyClaire