sub checkForOpenProxy { my($self, $ip) = @_; # If we weren't passed an IP address, default to whatever # the current IP address is. if (!$ip && $ENV{GATEWAY_INTERFACE}) { my $r = Apache->request; $ip = $r->connection->remote_ip if $r; } # If we don't have an IP address, it can't be an open proxy. return 0 if !$ip; # Known secure IPs also don't count as open proxies. my $constants = getCurrentStatic(); my $gSkin = getCurrentSkin(); my $secure_ip_regex = $constants->{admin_secure_ip_regex}; return 0 if $secure_ip_regex && $ip =~ /$secure_ip_regex/; # If the IP address is already one we have listed, use the # existing listing. my $port = $self->getKnownOpenProxy($ip); if (defined $port) { #print STDERR scalar(localtime) . " cfop no need to check ip '$ip', port is '$port'\n"; return $port; } #print STDERR scalar(localtime) . " cfop ip '$ip' not known, checking\n"; # No known answer; probe the IP address and get an answer. my $ports = $constants->{comments_portscan_ports} || '80 8080 8000 3128'; my @ports = grep /^\d+$/, split / /, $ports; return 0 if !@ports; my $timeout = $constants->{comments_portscan_timeout} || 5; my $connect_timeout = int($timeout/scalar(@ports)+0.2); my $ok_url = "$gSkin->{absolutedir}/ok.txt"; my $pua = Slash::Custom::ParUserAgent->new(); $pua->redirect(1); $pua->max_redirect(3); $pua->max_hosts(scalar(@ports)); $pua->max_req(scalar(@ports)); $pua->timeout($connect_timeout); #use LWP::Debug; #use Data::Dumper; #LWP::Debug::level("+trace"); LWP::Debug::level("+debug"); my $start_time = Time::HiRes::time; local $_proxy_port = undef; sub _cfop_callback { my($data, $response, $protocol) = @_; #print STDERR scalar(localtime) . " _cfop_callback protocol '$protocol' port '$_proxy_port' succ '" . ($response->is_success()) . "' data '$data' content '" . ($response->is_success() ? $response->content() : "(fail)") . "'\n"; if ($response->is_success() && $data eq "ok\n") { # We got a success, so the IP is a proxy. # We should know the proxy's port at this # point; if not, that's remarkable, so # print an error. my $orig_req = $response->request(); $_proxy_port = $orig_req->{_slash_proxytest_port}; if (!$_proxy_port) { print STDERR scalar(localtime) . " _cfop_callback got data but no port, protocol '$protocol' port '$_proxy_port' succ '" . ($response->is_success()) . "' data '$data' content '" . $response->content() . "'\n"; } $_proxy_port ||= 1; # We can quit listening on any of the # other ports that may have connected, # returning immediately from the wait(). # So we want to return C_ENDALL. Except # C_ENDALL doesn't seem to _work_, it # crashes in _remove_current_connection. # Argh. So we use C_LASTCON. return LWP::Parallel::UserAgent::C_LASTCON; } #print STDERR scalar(localtime) . " _cfop_callback protocol '$protocol' succ '0'\n"; } #print STDERR scalar(localtime) . " cfop beginning registering\n"; for my $port (@ports) { # We switch to a new proxy every time thru. $pua->proxy('http', "http://$ip:$port/"); my $req = HTTP::Request->new(GET => $ok_url); $req->{_slash_proxytest_port} = $port; #print STDERR scalar(localtime) . " cfop registering for proxy '$pua->{proxy}{http}'\n"; $pua->register($req, \&_cfop_callback); } #print STDERR scalar(localtime) . "pua: " . Dumper($pua); my $elapsed = Time::HiRes::time - $start_time; my $wait_timeout = int($timeout - $elapsed + 0.5); $wait_timeout = 1 if $wait_timeout wait($wait_timeout); #print STDERR scalar(localtime) . " cfop done with wait, returning " . (defined $_proxy_port ? 'undef' : "'$port'") . "\n"; $_proxy_port = 0 if !$_proxy_port; $elapsed = Time::HiRes::time - $start_time; # Store this value so we don't keep probing the IP. $self->setKnownOpenProxy($ip, $_proxy_port, $elapsed); return $_proxy_port; }
(Score: 1) by gishzida on Wednesday April 09 2014, @08:09PM
yes but they seem to be knocking on more doors that the code posted does.
Also I note they are not knocking port 8000
the question is why?
(Score: 3, Informative) by xlefay on Wednesday April 09 2014, @08:13PM
From what I'm seeing in the code (note, perl ain't my thing):
my $ports = $constants->{comments_portscan_ports} || '80 8080 8000 3128';
So, it uses the 'comments_portscan_ports' or the default ports. So I'm guessing /. has set those other ports in that constant.
(Score: 3, Informative) by Hairyfeet on Wednesday April 09 2014, @08:32PM
Well that at least explains why Slash reacted differently when I switched DNS servers, some of the ones i use would have considered that suspect and blocked it. It does make you wonder WTF is going on behind the scenes over there and makes me glad I stopped going, just one more reason to use Soybeans over Slash.
ACs are never seen so don't bother. Always ready to show SJWs for the racists they are.
(Score: 4, Interesting) by edIII on Wednesday April 09 2014, @10:45PM
THIS.
I was at Slash for quite awhile too and feel much better off here. WTF indeed. I understand passive logging of user details accessing the system, but switching to active probing silently is egregious. It seems like we can blow this out of proportion since it's a simple port scan, but it could be more than that. I feel like going over there and submitting an article linking back to Soylent, but I don't want to start anything.
If you think about Slashdot and what happened over there with corporate interests gradually corrupting it, it does make you wonder what was going on. You go there today and it has 9 different 3rd parties blocked by Ghostery/DoNotTrackMe, one of which is an Internet market research corporation. The rest can be explained by advertising to a degree, but that last one is purely for exploitation.
Soylent should be tearing apart the rest of the code right now to see just what was done with the collected information and start documenting it in the wiki. The results must be logged somewhere unless this code is just orphaned and was never part of any other flow.
It may have been a response to user abuse, but even then, it should have been well documented and part of the sites privacy policy. I just went and read Slashdot's privacy policy on what information they collect. Nowhere do they distinguish between passive data from HTTP requests and headers, and actively sending packets to test for conditions. In fact, the word port is not even present in the entire document.
Yet, I still wonder with something like that in the code if they were violating their own privacy policy.
I hope Soylent figures this out because it makes no sense. Slash silently degraded for sure, but that's a pretty fair departure from where it started out.
Thankfully, we have declared from day one that we are a community first. I appreciate how Soylent has handled this.
Technically, lunchtime is at any moment. It's just a wave function.
(Score: 0) by Anonymous Coward on Thursday April 10 2014, @05:45AM
Using a proprietary extension for added privacy/security is... stupid.
(Score: 1) by canopic jug on Saturday April 12 2014, @05:20PM
SN should make sure it can function fully without javascript. While port scans can collect some information, vastly more can be collected once inside the browser. That has already been exploited unofficially [v3.co.uk] at the other site, and the potential for official exploitation is much higher. If javascript is allowed by the browser and required by the site then even if the javascript coming from the site is legit, it is possible to piggy back malicious code on top especially if HTTPS is not used.
All activities, browsing, commenting, moderating and metamoderating need to be fully operational without needing javascript. Much of the eye candy can be provided by CSS3 anyway. If javascript is somehow compelling, make it an option, not a requirement.
While an audit of the scripts might be entertaining and identify what the other site has been up to, it is not necessary. Just take them out.
Money is not free speech. Elections should not be auctions.
(Score: 2) by NCommander on Monday May 05 2014, @04:37AM
Sorry for the late reply to this, but we've done this. We've actually stripped out almost all the JS code from the current dev releases (admin's still get jquery loaded dynamically as the admin interface uses it extensively), but aside from new JS for dynamic coding (which silently falls back to the old (aka, "now") behavior), we're almost entirely JS free. Stripping it out of the admin interface will be a nightmare, and its honestly low priority.
Still always moving
(Score: 1) by canopic jug on Saturday May 10 2014, @09:04AM
Thanks. It is appreciated and makes the site better. The user code was the most problematic so that is enough to help protect users.
Money is not free speech. Elections should not be auctions.
(Score: 0) by Anonymous Coward on Thursday April 10 2014, @02:52PM
What in the world does your choice of DNS resolver have to do with a Slash server probing the workstation attempting to post to the server's comment database? That's as irrelevant as irrelevant gets.