net.i2p.router

## Class Blocklist

- java.lang.Object
- - net.i2p.router.Blocklist

-     public class Blocklist
      extends Object

  Manage blocking by IP address, in a manner similar to the Banlist, which blocks by router hash. We also try to keep the two lists in sync: if a router at a given IP is blocked, we will also banlist it "forever" (until the next reboot). While the reverse case (blocking the IP of a router banlisted forever) is not automatic, the transports will call add() below to block the IP, which allows the transports to terminate an inbound connection before the router ident handshake. And the on-disk blocklist can also contain router hashes to be banlisted. So, this class maintains three separate lists:

         1) The list of IP ranges, read in from a file at startup
         2) The list of hashes, read in from the same file
         3) A list of single IPs, initially empty, added to as needed

  Read in the IP blocklist from a file, store it in-memory as efficiently as we can, and perform tests against it as requested. When queried for a peer that is blocklisted but isn't banlisted, banlist it forever, then go back to the file to get the original entry so we can add the reason to the banlist text. On-disk blocklist supports IPv4 only. In-memory supports both IPv4 and IPv6.

- - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `static String` | `BLOCKLIST_COUNTRY_FILE` Country-based blocklist filename.
    `static String` | `BLOCKLIST_FILE_DEFAULT` Default blocklist filename in the installation directory.
    `static String` | `BLOCKLIST_FILE_TOR_EXITS` Tor exit nodes blocklist filename.
    `static String` | `ID_FEED` For Update Manager
    `static String` | `ID_SYBIL` Sybil attack blocklist ID
    `static String` | `ID_TOR` Tor exit nodes blocklist ID

  - ### Constructor Summary

    Constructors
    Constructor and Description
    `Blocklist(RouterContext context)` Constructor.

  - ### Method Summary

    All Methods Static Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `void` | `add(byte[] ip)` Maintain a simple in-memory single-IP blocklist This is used for new additions, NOT for the main list of IP ranges read in from the file.
    `void` | `add(byte[] ip, String source)` Maintain a simple in-memory single-IP blocklist This is used for new additions, NOT for the main list of IP ranges read in from the file.
    `void` | `add(String ip)` Maintain a simple in-memory single-IP blocklist This is used for new additions, NOT for the main list of IP ranges read in from the file.
    `void` | `add(String ip, String source)` Maintain a simple in-memory single-IP blocklist This is used for new additions, NOT for the main list of IP ranges read in from the file.
    `void` | `addCountryFile()` The blocklist-country.txt file was created or updated.
    `void` | `addTemporary(byte[] ip, long durationMs, String source)` Add a temporary IP block with expiration time.
    `void` | `disable()` Disable the blocklist and clear all entries.
    `int` | `getBlocklistSize()` Get the size of the permanent blocklist.
    `static int` | `getFrom(long entry)` Extract the starting IP from a compressed blocklist entry.
    `long[]` | `getPermanentBlocks(int max)` IP ranges blocked until restart.
    `static int` | `getTo(long entry)` Extract the ending IP from a compressed blocklist entry.
    `List<Integer>` | `getTransientIPv4Blocks()` Single IPs blocked until restart.
    `List<BigInteger>` | `getTransientIPv6Blocks()` Single IPs blocked until restart.
    `boolean` | `isBlocklisted(byte[] ip)` Check if an IP address is blocklisted.
    `boolean` | `isBlocklisted(Hash peer)` Check if a peer is blocklisted by IP address.
    `boolean` | `isBlocklisted(RouterInfo pinfo)` Check if a peer is blocklisted by IP address.
    `boolean` | `isBlocklisted(String ip)` Check if an IP address is blocklisted.
    `boolean` | `isPermanentlyBlocklisted(int ip)` Check if an IP is permanently blocklisted using binary search.
    `boolean` | `isTemporaryBlocklisted(byte[] ip)` Check if IP is temporarily blocked.
    `void` | `remove(byte[] ip)` Remove from the in-memory single-IP blocklist.
    `void` | `startup()` Loads the following files in-order: $I2P/blocklist.txt $I2P/blocklist_tor.txt ~/.i2p/blocklist.txt ~/.i2p/docs/feed/blocklist/blocklist.txt ~/.i2p/blocklist-countries.txt File if specified with router.blocklist.file
    `static String` | `toStr(int ip)` Convert an IPv4 address to a string representation.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Field Detail

    - #### BLOCKLIST_COUNTRY_FILE

          public static final String BLOCKLIST_COUNTRY_FILE

      Country-based blocklist filename.
      See Also:
        Constant Field Values

    - #### BLOCKLIST_FILE_DEFAULT

          public static final String BLOCKLIST_FILE_DEFAULT

      Default blocklist filename in the installation directory.
      See Also:
        Constant Field Values

    - #### BLOCKLIST_FILE_TOR_EXITS

          public static final String BLOCKLIST_FILE_TOR_EXITS

      Tor exit nodes blocklist filename.
      See Also:
        Constant Field Values

    - #### ID_FEED

          public static final String ID_FEED

      For Update Manager
      See Also:
        Constant Field Values

    - #### ID_SYBIL

          public static final String ID_SYBIL

      Sybil attack blocklist ID
      See Also:
        Constant Field Values

    - #### ID_TOR

          public static final String ID_TOR

      Tor exit nodes blocklist ID
      See Also:
        Constant Field Values

  - ### Constructor Detail

    - #### Blocklist

          public Blocklist(RouterContext context)

      Constructor. Router MUST call startup()
      Parameters:
        `context` - the router context

  - ### Method Detail

    - #### add

          public void add(byte[] ip)

      Maintain a simple in-memory single-IP blocklist This is used for new additions, NOT for the main list of IP ranges read in from the file.
      Parameters:
        `ip` - IPv4 or IPv6

    - #### add

          public void add(byte[] ip,
                          String source)

      Maintain a simple in-memory single-IP blocklist This is used for new additions, NOT for the main list of IP ranges read in from the file.
      Parameters:
        `ip` - IPv4 or IPv6
        `source` - for logging only, may be null

    - #### add

          public void add(String ip)

      Maintain a simple in-memory single-IP blocklist This is used for new additions, NOT for the main list of IP ranges read in from the file.
      Parameters:
        `ip` - IPv4 or IPv6

    - #### add

          public void add(String ip,
                          String source)

      Maintain a simple in-memory single-IP blocklist This is used for new additions, NOT for the main list of IP ranges read in from the file.
      Parameters:
        `ip` - IPv4 or IPv6
        `source` - for logging only, may be null

    - #### addCountryFile

          public void addCountryFile()

      The blocklist-country.txt file was created or updated. Read it in. Not required normally, as the country file is read by startup().

    - #### addTemporary

          public void addTemporary(byte[] ip,
                                   long durationMs,
                                   String source)

      Add a temporary IP block with expiration time. For use by transports to block abusive IPs.
      Parameters:
        `ip` - IPv4 address
        `durationMs` - duration in milliseconds (e.g. 8*60*60*1000 for 8 hours)
        `source` - for logging, may be null

    - #### disable

          public void disable()

      Disable the blocklist and clear all entries.

    - #### getBlocklistSize

          public int getBlocklistSize()

      Get the size of the permanent blocklist. Public for console only, not a public API.
      Returns:
        the number of entries in the permanent blocklist

    - #### getFrom

          public static int getFrom(long entry)

      Extract the starting IP from a compressed blocklist entry. Public for console only, not a public API.
      Parameters:
        `entry` - the compressed blocklist entry
      Returns:
        the starting IP as an integer

    - #### getPermanentBlocks

          public long[] getPermanentBlocks(int max)

      IP ranges blocked until restart. Sorted, but as signed longs, so 128-255 are first Public for console only, not a public API
      Parameters:
        `max` - maximum entries to return
      Returns:
        a copy, sorted

    - #### getTo

          public static int getTo(long entry)

      Extract the ending IP from a compressed blocklist entry. Public for console only, not a public API.
      Parameters:
        `entry` - the compressed blocklist entry
      Returns:
        the ending IP as an integer

    - #### getTransientIPv4Blocks

          public List<Integer> getTransientIPv4Blocks()

      Single IPs blocked until restart. Unsorted. Public for console only, not a public API As of 0.9.57, will not contain IPs permanently banned, except for ones banned permanently after being added to the transient list.
      Returns:
        a copy, unsorted

    - #### getTransientIPv6Blocks

          public List<BigInteger> getTransientIPv6Blocks()

      Single IPs blocked until restart. Unsorted. Public for console only, not a public API
      Returns:
        a copy, unsorted

    - #### isBlocklisted

          public boolean isBlocklisted(byte[] ip)

      Check if an IP address is blocklisted. Calling this externally won't banlist the peer, this is just an IP check.
      Parameters:
        `ip` - the IP address as a byte array (IPv4 or IPv6)
      Returns:
        true if the IP is blocklisted

    - #### isBlocklisted

          public boolean isBlocklisted(Hash peer)

      Check if a peer is blocklisted by IP address. If so, and it isn't banlisted, banlist it forever or for the configured override period.
      Parameters:
        `peer` - the router hash to check
      Returns:
        true if the peer's IP is in the blocklist

    - #### isBlocklisted

          public boolean isBlocklisted(RouterInfo pinfo)

      Check if a peer is blocklisted by IP address. If so, and it isn't banlisted, banlist it forever or for the configured override period.
      Parameters:
        `pinfo` - the router info to check
      Returns:
        true if the peer's IP is in the blocklist

    - #### isBlocklisted

          public boolean isBlocklisted(String ip)

      Check if an IP address is blocklisted. Calling this externally won't banlist the peer, this is just an IP check.
      Parameters:
        `ip` - the IP address as a string (IPv4 or IPv6)
      Returns:
        true if the IP is blocklisted

    - #### isPermanentlyBlocklisted

          public boolean isPermanentlyBlocklisted(int ip)

      Check if an IP is permanently blocklisted using binary search. Public for console only, not a public API.
      Parameters:
        `ip` - the IPv4 address as an integer
      Returns:
        true if the IP is in the permanent blocklist

    - #### isTemporaryBlocklisted

          public boolean isTemporaryBlocklisted(byte[] ip)

      Check if IP is temporarily blocked.
      Parameters:
        `ip` - IPv4 address
      Returns:
        true if blocked

    - #### remove

          public void remove(byte[] ip)

      Remove from the in-memory single-IP blocklist. This is only works to undo add()s, NOT for the main list of IP ranges read in from the file.
      Parameters:
        `ip` - IPv4 or IPv6

    - #### startup

          public void startup()

      Loads the following files in-order: $I2P/blocklist.txt $I2P/blocklist_tor.txt ~/.i2p/blocklist.txt ~/.i2p/docs/feed/blocklist/blocklist.txt ~/.i2p/blocklist-countries.txt File if specified with router.blocklist.file

    - #### toStr

          public static String toStr(int ip)

      Convert an IPv4 address to a string representation. Public for console only, not a public API.
      Parameters:
        `ip` - the IPv4 address as an integer
      Returns:
        the string representation (e.g., "192.168.1.1")