Menu

#14 enhanced resolver

open
nobody
None
5
2007-10-22
2007-10-22
wilk
No

I see in resolver some places open to enhance. First of all resolver now works on single bot, and only this one bot must sit on # and only it gathers ips. So:

1. Make resolved ips shared. Let the bot share ips of resolved vhosts via the botnet. I know, the problem arises with security when bot other than hub plays with .ul, but remember that idiots module works similar now (i know it only informs hub about abuse, info is not propagated to all of the botnet). Pros are that now any other bot can react on ip class/shell clones and it would be much more quicker to cleanup channel. Only cons is slighty lower security, but remember that now there is also option like telnet-owners which allows to choose between safety and easy to use and ip spamming if there are more resolvers. So it could be as an option.

2. Make resolving requests. Now resolving bot must sit on protected channel. This is a must to work it at all and use such functionality. Lets make resolving requests! Now we can move this task to some limbo slave and other bots will request for resolves. Pros are easy to understand. Cons are in requests spamming by whole botnet, but this can be workaround by use of myTurn and by ignoring requests for already resolved hosts by requesting bots and by resolver.

3. Resolver cache. Let the resolver (maybe all bots?) keep cache of resolved hosts. It would be similar to was-op cache or clone-cache. There would be a .set option with time-to-keep-ip. Default value could be like 6h. The risk is when one bot goes down, than he reconnects and requests for lost ips, so when dns entries had been changed so other bots will still have wrong values.

4. Finally. Lets make full use of CIDR entries! It could be only available when feature request #1817517 would be implemented. Pros are in lower size of .ul and memory requirements. Why? Let's say we have user who frequently changes his vhosts so we put for him let's say 2-3 different vhosts. Now for the sake we put also his resolved ips (well, unneeded, but i always do it for bots an my private sessions). Now we have 2-6 entries for one user and usually we have more such users (also to match, yes yes hash tables are quick, but why to keep unused entries all time in memory when we can resolve it once?)! With CIDR we can put only one entry.

Discussion


Log in to post a comment.