chore: baseline snapshot before moderation-strictness feature
Repo .git was damaged (refs/ missing, index truncated, object store near-empty). Repaired via git init (rebuilt refs), stale index preserved as .git/index.corrupt-20260910.bak, then full worktree committed as a rollback baseline.
This commit is contained in:
tamakyi
@@ -0,0 +1,277 @@
|
||||
// Package autoban 提供 fail2ban 风格的自动临时封禁：检测批量扫描/探测特征后
|
||||
// 临时封禁来源 IP，并可回调发送告警。纯标准库实现，便于独立测试与复用。
|
||||
package autoban
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
)
|
||||
|
||||
// 探测事件类型
|
||||
const (
|
||||
KindNone = 0 // 无探测特征
|
||||
KindSensitive = 1 // 命中敏感路径
|
||||
KindNotFound = 2 // 404 响应（未命中敏感路径）
|
||||
)
|
||||
|
||||
// 默认阈值/窗口（Options 未配置或为 0 时兜底）。
|
||||
const (
|
||||
DefaultWindowSeconds = 60
|
||||
DefaultDurationMinutes = 15
|
||||
DefaultThresholdSensitive = 10
|
||||
DefaultThreshold404 = 20
|
||||
pathSampleMax = 6
|
||||
)
|
||||
|
||||
// Options 自动封禁配置。
|
||||
type Options struct {
|
||||
Enabled bool
|
||||
// TrackNotFound 是否把 KindNotFound（未注册路径的 404）计入封禁统计。
|
||||
// 默认 false：正常业务路径一律放行，仅敏感扫描特征路径参与计数封禁，
|
||||
// 避免共享出口下正常访问被 404 探测连坐误伤（详见 conf.Security.BanTrackNotFound）。
|
||||
TrackNotFound bool
|
||||
ThresholdSensitive int // 窗口内敏感路径命中次数
|
||||
Threshold404 int // 窗口内 404 次数
|
||||
Window time.Duration // 统计窗口
|
||||
Duration time.Duration // 封禁时长
|
||||
AlertEmail string // 告警收件人（留空不发送）
|
||||
SendAlert func(ip string, paths []string, durationMinutes int) error // 告警发送函数（nil 则不发送）
|
||||
}
|
||||
|
||||
// sensitivePaths 常见后台/配置/漏洞探测路径特征（忽略大小写，前缀匹配）。
|
||||
var sensitivePaths = []string{
|
||||
"/admin", "/wp-admin", "/wp-login.php", "/wp-content", "/wordpress",
|
||||
"/administrator", "/manager", "/cpanel", "/plesk",
|
||||
"/.env", "/.git", "/.aws", "/.ssh", "/.svn", "/.hg", "/.htaccess",
|
||||
"/config", "/configuration", "/backup", "/database", "/db",
|
||||
"/actuator", "/swagger", "/api-docs", "/openapi", "/v2/api-docs",
|
||||
"/phpmyadmin", "/pma", "/mysql", "/server-status", "/server-info",
|
||||
"/shell", "/webshell", "/cmd", "/eval", "/hack", "/shell.php",
|
||||
"/login.php", "/admin.php", "/index.php", "/console", "/vendor",
|
||||
}
|
||||
|
||||
type probeEvent struct {
|
||||
at time.Time
|
||||
kind int
|
||||
}
|
||||
|
||||
type probeStat struct {
|
||||
events []probeEvent
|
||||
sensitive int
|
||||
notFound int
|
||||
paths []string // 命中路径样本（告警用）
|
||||
}
|
||||
|
||||
// Banner 自动封禁器。方法并发安全。
|
||||
type Banner struct {
|
||||
mu sync.Mutex
|
||||
|
||||
probes map[string]*probeStat
|
||||
banned map[string]time.Time
|
||||
alerted map[string]bool
|
||||
|
||||
thresholdSensitive int
|
||||
threshold404 int
|
||||
trackNotFound bool
|
||||
window time.Duration
|
||||
duration time.Duration
|
||||
alertEmail string
|
||||
sendAlert func(ip string, paths []string, durationMinutes int) error
|
||||
enabled bool
|
||||
}
|
||||
|
||||
// New 按配置创建封禁器并注册全局清理。
|
||||
func New(opts Options) *Banner {
|
||||
window := opts.Window
|
||||
if window <= 0 {
|
||||
window = DefaultWindowSeconds * time.Second
|
||||
}
|
||||
duration := opts.Duration
|
||||
if duration <= 0 {
|
||||
duration = DefaultDurationMinutes * time.Minute
|
||||
}
|
||||
sensitive := opts.ThresholdSensitive
|
||||
if sensitive <= 0 {
|
||||
sensitive = DefaultThresholdSensitive
|
||||
}
|
||||
notFound := opts.Threshold404
|
||||
if notFound <= 0 {
|
||||
notFound = DefaultThreshold404
|
||||
}
|
||||
b := &Banner{
|
||||
probes: make(map[string]*probeStat),
|
||||
banned: make(map[string]time.Time),
|
||||
alerted: make(map[string]bool),
|
||||
thresholdSensitive: sensitive,
|
||||
threshold404: notFound,
|
||||
trackNotFound: opts.TrackNotFound,
|
||||
window: window,
|
||||
duration: duration,
|
||||
alertEmail: strings.TrimSpace(opts.AlertEmail),
|
||||
sendAlert: opts.SendAlert,
|
||||
enabled: opts.Enabled,
|
||||
}
|
||||
register(b)
|
||||
return b
|
||||
}
|
||||
|
||||
// Record 记录一次探测事件，达到阈值时封禁 IP 并触发一次告警。
|
||||
func (b *Banner) Record(ip, path string, kind int) {
|
||||
if !b.enabled || ip == "" || kind == KindNone {
|
||||
return
|
||||
}
|
||||
// 404 计数默认关闭（正常业务路径一律放行，仅敏感扫描特征参与封禁）：
|
||||
// 只有显式开启 TrackNotFound 时才把未注册路径的 404 计入统计。
|
||||
if kind == KindNotFound && !b.trackNotFound {
|
||||
return
|
||||
}
|
||||
b.mu.Lock()
|
||||
defer b.mu.Unlock()
|
||||
|
||||
now := time.Now()
|
||||
cutoff := now.Add(-b.window)
|
||||
|
||||
st := b.probes[ip]
|
||||
if st == nil {
|
||||
st = &probeStat{}
|
||||
b.probes[ip] = st
|
||||
}
|
||||
|
||||
// 滚动清理过期事件并重算计数
|
||||
valid := st.events[:0]
|
||||
sensitive, notFound := 0, 0
|
||||
for _, e := range st.events {
|
||||
if e.at.After(cutoff) {
|
||||
valid = append(valid, e)
|
||||
if e.kind == KindSensitive {
|
||||
sensitive++
|
||||
} else if e.kind == KindNotFound {
|
||||
notFound++
|
||||
}
|
||||
}
|
||||
}
|
||||
valid = append(valid, probeEvent{at: now, kind: kind})
|
||||
if kind == KindSensitive {
|
||||
sensitive++
|
||||
} else {
|
||||
notFound++
|
||||
}
|
||||
st.events = valid
|
||||
st.sensitive = sensitive
|
||||
st.notFound = notFound
|
||||
if len(st.paths) < pathSampleMax && path != "" {
|
||||
st.paths = append(st.paths, path)
|
||||
}
|
||||
|
||||
if sensitive < b.thresholdSensitive && notFound < b.threshold404 {
|
||||
return
|
||||
}
|
||||
|
||||
// 已达阈值：封禁（已在封禁中则跳过）
|
||||
if until, ok := b.banned[ip]; ok && until.After(now) {
|
||||
return
|
||||
}
|
||||
until := now.Add(b.duration)
|
||||
b.banned[ip] = until
|
||||
|
||||
// 告警（每 IP 仅一次）
|
||||
if b.alertEmail != "" && b.sendAlert != nil && !b.alerted[ip] {
|
||||
b.alerted[ip] = true
|
||||
sample := append([]string{}, st.paths...)
|
||||
dur := int(b.duration.Minutes())
|
||||
go func() {
|
||||
_ = b.sendAlert(ip, sample, dur)
|
||||
}()
|
||||
}
|
||||
}
|
||||
|
||||
// IsBanned 判断 IP 是否处于封禁期；到期自动解除。
|
||||
func (b *Banner) IsBanned(ip string) bool {
|
||||
if !b.enabled || ip == "" {
|
||||
return false
|
||||
}
|
||||
b.mu.Lock()
|
||||
defer b.mu.Unlock()
|
||||
if until, ok := b.banned[ip]; ok {
|
||||
if until.After(time.Now()) {
|
||||
return true
|
||||
}
|
||||
delete(b.banned, ip)
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// IsSensitivePath 判断路径是否命中敏感探测特征（忽略大小写，完整段前缀匹配）。
|
||||
func IsSensitivePath(p string) bool {
|
||||
lower := strings.ToLower(p)
|
||||
for _, s := range sensitivePaths {
|
||||
if lower == s || strings.HasPrefix(lower, s+"/") {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// ---------- 全局注册与清理 ----------
|
||||
|
||||
var (
|
||||
bannersMu sync.Mutex
|
||||
banners = make(map[*Banner]struct{})
|
||||
bannersOnce sync.Once
|
||||
)
|
||||
|
||||
func register(b *Banner) {
|
||||
bannersMu.Lock()
|
||||
banners[b] = struct{}{}
|
||||
bannersMu.Unlock()
|
||||
|
||||
bannersOnce.Do(func() {
|
||||
go func() {
|
||||
for {
|
||||
time.Sleep(2 * time.Minute)
|
||||
bannersMu.Lock()
|
||||
for b := range banners {
|
||||
b.cleanup()
|
||||
}
|
||||
bannersMu.Unlock()
|
||||
}
|
||||
}()
|
||||
})
|
||||
}
|
||||
|
||||
// cleanup 定期清理过期探测记录与已到期封禁（防止内存膨胀）。
|
||||
func (b *Banner) cleanup() {
|
||||
b.mu.Lock()
|
||||
defer b.mu.Unlock()
|
||||
|
||||
now := time.Now()
|
||||
cutoff := now.Add(-b.window)
|
||||
|
||||
for ip, st := range b.probes {
|
||||
if len(st.events) == 0 || st.events[len(st.events)-1].at.Before(cutoff) {
|
||||
delete(b.probes, ip)
|
||||
continue
|
||||
}
|
||||
valid := st.events[:0]
|
||||
sensitive, notFound := 0, 0
|
||||
for _, e := range st.events {
|
||||
if e.at.After(cutoff) {
|
||||
valid = append(valid, e)
|
||||
if e.kind == KindSensitive {
|
||||
sensitive++
|
||||
} else if e.kind == KindNotFound {
|
||||
notFound++
|
||||
}
|
||||
}
|
||||
}
|
||||
st.events = valid
|
||||
st.sensitive = sensitive
|
||||
st.notFound = notFound
|
||||
}
|
||||
for ip, until := range b.banned {
|
||||
if !until.After(now) {
|
||||
delete(b.banned, ip)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,143 @@
|
||||
package autoban
|
||||
|
||||
import (
|
||||
"sync/atomic"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func newTestBanner(thresholdSensitive, threshold404 int, window, duration time.Duration, alertEmail string, alertCalls *int64) *Banner {
|
||||
return New(Options{
|
||||
Enabled: true,
|
||||
TrackNotFound: true, // 测试 helper 显式开启 404 跟踪，覆盖两种计数的既有用例
|
||||
ThresholdSensitive: thresholdSensitive,
|
||||
Threshold404: threshold404,
|
||||
Window: window,
|
||||
Duration: duration,
|
||||
AlertEmail: alertEmail,
|
||||
SendAlert: func(ip string, paths []string, dur int) error {
|
||||
if alertCalls != nil {
|
||||
atomic.AddInt64(alertCalls, 1)
|
||||
}
|
||||
return nil
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
func TestSensitiveThreshold(t *testing.T) {
|
||||
b := newTestBanner(2, 5, time.Minute, time.Minute, "", nil)
|
||||
b.Record("1.2.3.4", "/admin", KindSensitive)
|
||||
if b.IsBanned("1.2.3.4") {
|
||||
t.Fatal("should not be banned before reaching threshold")
|
||||
}
|
||||
b.Record("1.2.3.4", "/.env", KindSensitive)
|
||||
if !b.IsBanned("1.2.3.4") {
|
||||
t.Fatal("expected ban after reaching sensitive threshold")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNotFoundThreshold(t *testing.T) {
|
||||
b := newTestBanner(10, 3, time.Minute, time.Minute, "", nil)
|
||||
for i := 0; i < 3; i++ {
|
||||
b.Record("5.6.7.8", "/random-"+string(rune('a'+i)), KindNotFound)
|
||||
}
|
||||
if !b.IsBanned("5.6.7.8") {
|
||||
t.Fatal("expected ban after reaching 404 threshold")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNotFoundTrackDisabledByDefault(t *testing.T) {
|
||||
// 默认（TrackNotFound=false）下 404 不参与统计：正常业务路径一律放行，
|
||||
// 仅敏感扫描路径仍计数封禁——防止共享出口下正常访问被 404 探测连坐误伤。
|
||||
b := New(Options{Enabled: true, ThresholdSensitive: 1, Threshold404: 1, Window: time.Minute, Duration: time.Minute})
|
||||
for i := 0; i < 5; i++ {
|
||||
b.Record("7.7.7.7", "/random-"+string(rune('a'+i)), KindNotFound)
|
||||
}
|
||||
if b.IsBanned("7.7.7.7") {
|
||||
t.Fatal("404 events must not accumulate when TrackNotFound is false")
|
||||
}
|
||||
b.Record("7.7.7.7", "/.env", KindSensitive)
|
||||
if !b.IsBanned("7.7.7.7") {
|
||||
t.Fatal("sensitive events must still ban even when 404 tracking is off")
|
||||
}
|
||||
}
|
||||
|
||||
func TestWindowExpiry(t *testing.T) {
|
||||
b := newTestBanner(2, 5, 50*time.Millisecond, time.Minute, "", nil)
|
||||
b.Record("1.1.1.1", "/admin", KindSensitive)
|
||||
time.Sleep(80 * time.Millisecond) // 事件滑出窗口
|
||||
b.Record("1.1.1.1", "/.env", KindSensitive)
|
||||
if b.IsBanned("1.1.1.1") {
|
||||
t.Fatal("events outside the window must not accumulate")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDurationExpiry(t *testing.T) {
|
||||
b := newTestBanner(1, 5, time.Minute, 60*time.Millisecond, "", nil)
|
||||
b.Record("2.2.2.2", "/admin", KindSensitive)
|
||||
if !b.IsBanned("2.2.2.2") {
|
||||
t.Fatal("expected ban")
|
||||
}
|
||||
time.Sleep(100 * time.Millisecond) // 封禁到期
|
||||
if b.IsBanned("2.2.2.2") {
|
||||
t.Fatal("ban should expire after duration")
|
||||
}
|
||||
}
|
||||
|
||||
func TestAlertOncePerIP(t *testing.T) {
|
||||
var calls int64
|
||||
b := newTestBanner(1, 5, time.Minute, time.Minute, "[email protected]", &calls)
|
||||
b.Record("9.9.9.9", "/wp-admin", KindSensitive)
|
||||
b.Record("9.9.9.9", "/.git", KindSensitive) // 已在封禁中，不应重复告警
|
||||
b.Record("9.9.9.9", "/config", KindSensitive)
|
||||
|
||||
// sendAlert 异步调用，轮询等待最多 500ms
|
||||
deadline := time.Now().Add(500 * time.Millisecond)
|
||||
for atomic.LoadInt64(&calls) == 0 && time.Now().Before(deadline) {
|
||||
time.Sleep(10 * time.Millisecond)
|
||||
}
|
||||
if got := atomic.LoadInt64(&calls); got != 1 {
|
||||
t.Fatalf("expected exactly 1 alert, got %d", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDisabled(t *testing.T) {
|
||||
b := New(Options{Enabled: false})
|
||||
b.Record("3.3.3.3", "/admin", KindSensitive)
|
||||
if b.IsBanned("3.3.3.3") {
|
||||
t.Fatal("disabled auto-ban must not ban")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDefaults(t *testing.T) {
|
||||
b := New(Options{Enabled: true}) // 全部走默认值
|
||||
if b.thresholdSensitive != DefaultThresholdSensitive || b.threshold404 != DefaultThreshold404 {
|
||||
t.Fatalf("default thresholds wrong: %d/%d", b.thresholdSensitive, b.threshold404)
|
||||
}
|
||||
if b.window != DefaultWindowSeconds*time.Second || b.duration != DefaultDurationMinutes*time.Minute {
|
||||
t.Fatalf("default window/duration wrong: %v/%v", b.window, b.duration)
|
||||
}
|
||||
if b.trackNotFound {
|
||||
t.Fatal("404 tracking must be disabled by default")
|
||||
}
|
||||
}
|
||||
|
||||
func TestIsSensitivePath(t *testing.T) {
|
||||
cases := []struct {
|
||||
path string
|
||||
want bool
|
||||
}{
|
||||
{"/admin", true},
|
||||
{"/admin/panel", true},
|
||||
{"/WP-ADMIN", true},
|
||||
{"/.env", true},
|
||||
{"/user/questions", false},
|
||||
{"/vote/abc123", false},
|
||||
{"/administratorx", false}, // 前缀必须完整段匹配，避免误伤
|
||||
}
|
||||
for _, c := range cases {
|
||||
if got := IsSensitivePath(c.path); got != c.want {
|
||||
t.Errorf("IsSensitivePath(%q) = %v, want %v", c.path, got, c.want)
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user