tiff

3.14 - Spamfilter

Spamfilter is a new system to fight spam, advertising, worms and other things. It works a bit like the badwords system but has several advantages.

Spamfilters are added via the /spamfilter command which uses the following syntax:
/spamfilter [add|del|remove|+|-] [type] [action] [tkltime] [reason] [regex]
[type]	specifies the target type:
Char:	Config item:	Description:
c	channel	Channel message
p	private	Private message (from user->user)
n	private-notice	Private notice
N	channel-notice	Channel notice
P	part	Part reason
q	quit	Quit reason
d	dcc	DCC filename
a	away	Away message
t	topic	Setting a topic
u	user	User ban, will be matched against nick!user@host:realname
You can specify multiple targets, like: cpNn
[action]	specifies the action to be taken (only 1 action can be specified)
kill	kills the user
tempshun	shuns the current session of the user (if [s]he reconnects the shun is gone)
shun	puts a shun on the host
kline	puts a kline on the host
gline	puts a gline on the host
zline	puts a zline on the host
gzline	puts a gzline (global zline) on the host
block	block the message only
dccblock	mark the user so (s)he's unable to send any DCCs
viruschan	part all channels, join set::spamfilter::virus-help-channel, disables all commands except PONG, ADMIN, and msg/notices to set::spamfilter::virus-help-channel
warn	send a notice to IRCOps (spamfilter snomask), and inform the user that the message has been intercepted. No further action is taken, the message is not blocked.
[tkltime]	The duration of the *line/shun added by the filter, use '-' to use the default or to skip (eg: if action = 'block')
[reason]	Block/*line/shun reason.. you CANNOT use spaces in this, but underscores ('_') will be translated into spaces at runtime. And double underscore ('__') gets an underscore ('_'). Again, use '-' to use the default reason.
[regex]	this is the actual regex or 'bad word' where we should block on and perform the action at

Here's an example: /spamfilter add pc gline - - Come watch me on my webcam
If the text come watch me on my webcam is found in either a private msg or a channel msg then the message will be blocked and a gline will be added immediately.
Another example: /spamfilter add pc block - - come to irc\..+\..+
This is a regex that will match on Hi, come to irc.blah.net etc....
And an example with specified time/reason:
/spamfilter add p gline 3h Please_go_to_www.viruscan.xx/nicepage/virus=blah Come watch me on my webcam
If come watch me on my webcam is found in a private msg then the user is glined for 3 hours with the reason Please go to www.viruscan.xx/nicepage/virus=blah.

Spamfilters added with /spamfilter are network-wide. They work regardless of whether the user/channel has mode +G set, only opers and ulines (services) are exempted from filtering.

You can also add spamfilters in the config file but these will be local spamfilters (not network-wide, though you could use remote includes for this). The syntax of these spamfilter { } blocks are explained here
Example:
spamfilter {
	regex "//write \$decode\(.+\|.+load -rs";
	target { private; channel; };
	reason "Generic $decode exploit";
	action block;
};
set::spamfilter::ban-time allows you to modify the default ban time for *lines/shuns added by spamfilter (default: 1 day)
set::spamfilter::ban-reason allows you to specify a default reason (default: 'Spam/advertising')
set::spamfilter::virus-help-channel allows you to specify the channel to join for action 'viruschan' (default: #help)
set::spamfilter::virus-help-channel-deny allows you to block any normal joins to virus-help-channel (default: no)
Slow Spamfilter Detection
A spamfilter regex can slow down the IRCd considerably. This really depends on the regex you use (and how the regex engine handles it), some are very fast and UnrealIRCd can execute thousands of them per second. Others can be extremely slow, take several seconds to execute, and could freeze the IRCd.
To help against this, Unreal comes with Slow Spamfilter Detection: For each spamfilter, Unreal checks, each time it executes, how long it takes to execute. Once a certain threshold is reached the IRCd will warn or even remove the spamfilter.
Warning is configured through set::spamfilter::slowdetect-warn (default: 250ms) and automatic deletion is configured by set::spamfilter::slowdetect-fatal (default: 500ms). You can set both settings to 0 (zero) to disable slow spamfilter detection.
This feature is currently not available on Windows.