Help and Support
Ask a question, report a problem, request a feature...
<<  Back To Forum

2.24 IPV6 IP Filtering still not working properly

by shag00 on 2015/10/23 03:05:34 AM    
I have added a new IPV6 address to my IP filter which I saved, refreshed the IP filter, ignored the IP address then unignored it and it connected. Would be really good if we could get this basic functionality working properly.
by Guest on 2015/10/23 03:51:01 AM    
your mixing two things together... peer ignore (when you right-click a peer and ignore on the menu) and ip filter (that you load in the separate view with the little castle button at the top) are two completely separate features

you are saying ip filter does not work for ipv6 addresses at all?
by Guest on 2015/10/23 04:04:29 AM    
where are you getting your blocklist from?  are you just making a text file and pasting in IPs?

most blocklists look like:

badnetwork:1.2.3.4-1.2.10.20
anotherbad:2000:1234:abcd::567


make sure you put in a label and semicolon at the head of each line

If it still doesn't work, perhaps try pasting in here an example line from your blocklist file or at least post some more specific details... that will probably get you help quicker than just saying "Would be really good if we could get this basic functionality working properly." and leaving it for others to guess at what exactly you're talking about.
by cvbn on 2015/10/23 04:21:33 AM    
You know, it might help if you posted some actual non-working lines that you have tried in your IP filter.  Then maybe you would get help.

Coming in here and getting an attitude because you have some obscure problem that you feel isn't being fixed fast enough isn't going to work quite so good.
by Napsterbater on 2015/10/23 04:48:19 AM    
shag:

for completeness sake, What context is the filter set to apply to?
by shag00 on 2015/10/26 01:54:22 PM    
@ Guest 1.51.01

I am not mixing anything up, please read again and try it. IPV6 partially works and it does not work the same way as the IPV4 filter which I have no problems with and as far as I can tell works properly.

@ Guest 2.04.29

I have 2 block lists, one for IPV4 which works without problems and one for IPV6 addresses which is where the problem is. So from that the format of my text file list is correct, I would post it here but the forum moderators do not want IP addresses posted. Further some IPV6 addresses are blocked as expected and there is an additional issue of not being able to unblock an IPV6 address once blocked, however lets just leave that issue aside for the moment.

Also this is merely the latest in a string of posts I have made on this subject this year which is why I use "still not working" in the title although I perhaps would have been better served to rehash it all again in this post.

@Guest 2.21.33

A forum rules thing, don't post IP addresses to the forum...

IP filters are not really obscure.

@Guest 2.48.19

Hope I understand your comment/request:
Action = Drop Matches
Applies = Incoming peers, Outgoing peers, DHT


There has and continues to be an issue with the way Tixati handles IPV6 addresses which needs to be addressed. In this latest version (2.24) the IP filter issue remains outstanding as it has been for all 2015, in addition I am yet to connect with any IPV6 address for any length of time (that being more than about 15 seconds)using 2.24, though that may be due to having only used it for a few days.
by shag00 on 2015/10/26 02:39:23 PM    
I think I need to add some clarity to this topic.

1. Everything I say is based on my expectation that the IPV6 filter should work in exactly the same way the IPV4 filter works, in essence they are the same filter.
2. I have no issue with the list format.
3. I have no issue with IPV4 filtering, it works as expected.
4. It is not a problem where everything either works or does not work, it is a problem that affects some IPV6 addresses, an example being (fictitious addresses):
2804:7f5:d180:9d14::X and
2a04:1980:3100:1aab:290:faff:fe70:XXXX.

Tixati treats addresses with "::" differently than addresses without the double "::". Please note that this is one example only which is hard to prove without using actual addresses.
by KH on 2015/10/26 11:13:18 PM    
I did some code inspection and numerous tests on this today and unfortunately haven't come up with anything yet.

Here's a filter file you can try: (note these are all in the reserved documentation range 2001:db8::/32)

testrange1:2001:db8::5-2001:db8::9
testrange2:2001:db8::5:1234-2001:db8::9:1234
testrange3:2001:db8::5:1234:1234-2001:db8::9:1234:1234
testrange4:2001:db8::5:1234:1234:1234-2001:db8::9:1234:1234:1234
testrange5:2001:db8::5:1234:1234:1234:1234-2001:db8::9:1234:1234:1234:1234
testrange6:2001:db8:1234::5-2001:db8:1234::9
testrange7:2001:db8:1234:1234::5-2001:db8:1234:1234::9
testrange8:2001:db8:1234:1234:1234::5-2001:db8:1234:1234:1234::9
testrange9:2001:db8:1234:1234:1234:1234::5-2001:db8:1234:1234:1234:1234::9

Just save that to testfilter.txt on your desktop and load it into the Tixati filter.  It should say 13 /64s are touched.

Then, create a new channel (just name it randomly) and try to add some peers from the chat tab:


/addpeer 2001:db8::7:55555
/addpeer 2001:db8::7:1234:55555
/addpeer 2001:db8::7:1234:1234:55555
/addpeer 2001:db8::7:1234:1234:1234:55555
/addpeer 2001:db8::7:1234:1234:1234:1234:55555
/addpeer 2001:db8:1234::7:55555
/addpeer 2001:db8:1234:1234::7:55555
/addpeer 2001:db8:1234:1234:1234::7:55555
/addpeer 2001:db8:1234:1234:1234:1234::7:55555


They all come up in the connections tab as 'IP Filtered' for me, on Linux and Win7.

The IP filter parser trims the label, then takes what is on either side of the hyphen and puts it through the same generic IP parser routine that is used everywhere else in the program, which generally forwards those calls to WSAStringToAddress on Windows or inet_pton on Linux.

Perhaps in your case(s) there is something in the label or address that I am not catching with these tests.  If you can formulate a test case that fails, please don't hesitate to post the exact lines here.  Replies will now go into the mod queue first, so it will only be visible to you and us until a mod has a chance to clip out any real IPs and forward the original message to me.

If there is indeed a problem here, I'll probably be able to get a quick fix into the next release (soon).
by shag00 on 2015/10/28 01:23:53 AM    
I followed your examples and got the same results and this is where the issue really starts. Unfortunately, I cleaned up my block immediately before the new version came out so the following examples I have are somewhat less than I would like and are only from a handful of torrents:

(modnote: addresses removed and forward to devs)

This is the format of my block list, I only use individual addresses not ranges, and these addresses have been blocked at least twice and in some cases up to 6 times in the last 4-5 days.

So you understand my methodology:
1. an address is selected for blocking.
2. the address is copied to the block list
3. the address is ignored in Tixati (to avoid blocking the same address more than once)
4. the IPFilter is updated. (this may only be done every few hours but as the address is ignored it should not reconnect/reappear)

I discover the address has not been blocked in 2 ways:
1. I follow steps 1-4 above and find I am still connecting.
2. Each month or two I sort the block list and remove duplications.

So that is the blocking issue. The next part of the problem is reinstating (unblocking) a blocked IPV6 address. Now this is not tested on 2.24 but prior to 2.24 sometimes when I deleted an address from the block list it would still be blocked even though it was not on the list. I discovered this by turning the IP filter off altogether and then connecting to the address. When I subsequently activated the IPFilter the address was blocked.

Identifying these to you is particularly difficult as it requires an existing blocked address and a torrent that we are both downloading at the same time so I do not have an example. It is also a fairly rare occurrence.

Slightly to the side of the topic is the issue of IPV6 addresses generally. I have my connections set to prefer IPV6. I am able to handshake with IPV6 addresses but always get a message to the effect "connection timed out". This message is not unusual and occurs with IPV4 as well, the troubling thing is that with version 2.24 I have never been able to successfully connect with and exchange data with an IPV6 address. This would have happened at least 50 times in the last few days. Not impossible but surprising to not have successfully connected to one address.

I hope this sheds some more light on the issue and knowing I can post details is good. Thank you.
by shag00 on 2015/10/29 11:18:20 PM    
Downloaded 1 torrent yesterday with no blocking issues.
by KH on 2015/10/31 09:46:11 AM    
This was due to the missing labels.  IPv6 wasn't supported without labels previously.  In your case it was reading the first segment as the label, introducing completely erroneous ranges into the filter table.

It's all fixed up for v2.25, raw IPv6 addresses will work fine.  You can check out other accepted formats at http://support.tixati.com/ip%20filter%20format

Thanks for reporting this problem.
by shag00 on 2015/11/01 01:18:35 AM    
Thank you.




This web site is powered by Super Simple Server