connregex, IPv6 and UnrealIRCd #47
Description
UnrealIRCd has a new way of displaying connect notices to opers, that looks like this:
- Locally:
connect.LOCAL_CLIENT_CONNECT [info] Client connecting: Guest-62142 (~vitor@67.228.26.34) [67.228.26.34] [vhost: C6C1711B.8056F8D2.AE032BD3.IP] [class: clients] [secure: TLSv1.3-TLS_CHACHA20_POLY1305_SHA256] [country: FR] [reputation: 10000] [security-groups: known-users,tls-and-known-users,tls-users] - Remotely:
connect.REMOTE_CLIENT_CONNECT [info] Client connecting: Guest-62142 (~vitor@67.228.26.34) [67.228.26.34] [vhost: C6C1711B.8056F8D2.AE032BD3.IP] [secure: TLSv1.3-TLS_CHACHA20_POLY1305_SHA256] [country: FR] [reputation: 10000] [security-groups: known-users,tls-and-known-users,tls-users]
My current connregex is:
connregex = ".*Client connecting: ([^ ]+) \\(([^@]+)@([^\\)]+)\\) \\[([0-9a-f\\.:]+)\\].*";
When a user connects using IPv4, all seems to work properly:
[2023-01-29T13:15:24+0100] IRC READ -> :irc3.ptirc.org NOTICE HOPM :14connect.REMOTE_CLIENT_CONNECT 03[info] Client connecting: vitor (~vitor@67.228.26.34) [67.228.26.34] [vhost: C6C1711B.8056F8D2.AE032BD3.IP] [secure: TLSv1.3-TLS_CHACHA20_POLY1305_SHA256] [country: FR] [reputation: 10000] [security-groups: known-users,tls-and-known-users,tls-users]
[2023-01-29T13:15:24+0100] IRC REGEX -> Regular expression caught connection notice. Parsing.
[2023-01-29T13:15:24+0100] IRC REGEX -> Parsed vitor!~vitor@67.228.26.34 [67.228.26.34] from connection notice.
[2023-01-29T13:15:24+0100] IRC SEND -> NOTICE vitor :You are now being scanned for open proxies. If you have nothing to hide, you have nothing to fear.
[2023-01-29T13:15:24+0100] SCAN -> Passing vitor!~vitor@67.228.26.34 to scanner [default]
[2023-01-29T13:15:24+0100] SCAN -> Passing vitor!~vitor@67.228.26.34 to scanner [extended]
[2023-01-29T13:15:24+0100] SCAN -> Passing vitor!~vitor@67.228.26.34 to scanner [ssh]
[2023-01-29T13:15:24+0100] IRC READ -> :irc3.ptirc.org PRIVMSG #Control :03[info] Client connecting: vitor (~vitor@67.228.26.34) [67.228.26.34] [vhost: C6C1711B.8056F8D2.AE032BD3.IP] [secure: TLSv1.3-TLS_CHACHA20_POLY1305_SHA256] [country: FR] [reputation: 10000] [security-groups: known-users,tls-and-known-users,tls-users]
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:80 (HTTPPOST) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:23 (DREAMBOX) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:23 (WINGATE) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:23 (ROUTER) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:1080 (SOCKS5) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:1080 (SOCKS4) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:6588 (HTTP) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:3128 (HTTP) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8080 (HTTP) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:80 (HTTP) [default] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Scan 67.228.26.34 [default] completed
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:31121 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:17771 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:18844 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:38884 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:29992 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:64101 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:10000 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:9578 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:9447 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:9186 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:9100 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8814 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8520 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8148 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8130 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:7810 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:7464 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:6561 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:6552 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:5634 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:5262 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:5113 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:5104 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:4438 (SOCKS5) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:9036 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:7366 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:7198 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:6826 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:4914 (SOCKS4) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8081 (HTTPPOST) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8080 (HTTPPOST) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8001 (HTTPPOST) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8000 (HTTPPOST) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:4480 (HTTPPOST) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:6588 (HTTPPOST) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:81 (HTTPPOST) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8081 (HTTP) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8001 (HTTP) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:8000 (HTTP) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:81 (HTTP) [extended] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Scan 67.228.26.34 [extended] completed
[2023-01-29T13:15:53+0100] SCAN -> Negotiation timed out 67.228.26.34:22 (SSH) [ssh] (0 bytes read)
[2023-01-29T13:15:53+0100] SCAN -> Scan 67.228.26.34 [ssh] completed
[2023-01-29T13:15:53+0100] SCAN -> All tests on vitor!~vitor@67.228.26.34 [67.228.26.34] complete.
But when a user connects via IPv6 (now, I'm unsure if the issue is related to revdns), HOPM just hangs after Passing ... to scanner ...:
[2023-01-29T13:13:55+0100] IRC READ -> :irc1.ptirc.org NOTICE HOPM :14connect.LOCAL_CLIENT_CONNECT 03[info] Client connecting: Raiden (James@user.rev.dns) [2a01:2a02:2a03:2a04:2a05:2a06:2a07:2a08] [vhost: 5ECFF1A:C50BABED:3432A6B5:IP] [class: clients] [secure: TLSv1.3-TLS_CHACHA20_POLY1305_SHA256] [account: Raiden] [country: DE] [reputation: 10000] [security-groups: known-users,tls-and-known-users,tls-users]
[2023-01-29T13:13:55+0100] IRC REGEX -> Regular expression caught connection notice. Parsing.
[2023-01-29T13:13:55+0100] IRC REGEX -> Parsed Raiden!James@user.rev.dns [2a01:2a02:2a03:2a04:2a05:2a06:2a07:2a08] from connection notice.
[2023-01-29T13:13:55+0100] IRC SEND -> NOTICE Raiden :You are now being scanned for open proxies. If you have nothing to hide, you have nothing to fear.
[2023-01-29T13:13:55+0100] SCAN -> Passing Raiden!James@user.rev.dns to scanner [default]
[2023-01-29T13:13:55+0100] SCAN -> Passing Raiden!James@user.rev.dns to scanner [extended]
[2023-01-29T13:13:55+0100] SCAN -> Passing Raiden!James@user.rev.dns to scanner [ssh]
Any help/ideas are greatly appreciatted.