267 lines
6.7 KiB
Go
267 lines
6.7 KiB
Go
// Package autoban 提供 fail2ban 风格的自动临时封禁：检测批量扫描/探测特征后
|
|
// 临时封禁来源 IP，并可回调发送告警。纯标准库实现，便于独立测试与复用。
|
|
package autoban
|
|
|
|
import (
|
|
"strings"
|
|
"sync"
|
|
"time"
|
|
)
|
|
|
|
// 探测事件类型
|
|
const (
|
|
KindNone = 0 // 无探测特征
|
|
KindSensitive = 1 // 命中敏感路径
|
|
KindNotFound = 2 // 404 响应（未命中敏感路径）
|
|
)
|
|
|
|
// 默认阈值/窗口（Options 未配置或为 0 时兜底）。
|
|
const (
|
|
DefaultWindowSeconds = 60
|
|
DefaultDurationMinutes = 15
|
|
DefaultThresholdSensitive = 10
|
|
DefaultThreshold404 = 20
|
|
pathSampleMax = 6
|
|
)
|
|
|
|
// Options 自动封禁配置。
|
|
type Options struct {
|
|
Enabled bool
|
|
ThresholdSensitive int // 窗口内敏感路径命中次数
|
|
Threshold404 int // 窗口内 404 次数
|
|
Window time.Duration // 统计窗口
|
|
Duration time.Duration // 封禁时长
|
|
AlertEmail string // 告警收件人（留空不发送）
|
|
SendAlert func(ip string, paths []string, durationMinutes int) error // 告警发送函数（nil 则不发送）
|
|
}
|
|
|
|
// sensitivePaths 常见后台/配置/漏洞探测路径特征（忽略大小写，前缀匹配）。
|
|
var sensitivePaths = []string{
|
|
"/admin", "/wp-admin", "/wp-login.php", "/wp-content", "/wordpress",
|
|
"/administrator", "/manager", "/cpanel", "/plesk",
|
|
"/.env", "/.git", "/.aws", "/.ssh", "/.svn", "/.hg", "/.htaccess",
|
|
"/config", "/configuration", "/backup", "/database", "/db",
|
|
"/actuator", "/swagger", "/api-docs", "/openapi", "/v2/api-docs",
|
|
"/phpmyadmin", "/pma", "/mysql", "/server-status", "/server-info",
|
|
"/shell", "/webshell", "/cmd", "/eval", "/hack", "/shell.php",
|
|
"/login.php", "/admin.php", "/index.php", "/console", "/vendor",
|
|
}
|
|
|
|
type probeEvent struct {
|
|
at time.Time
|
|
kind int
|
|
}
|
|
|
|
type probeStat struct {
|
|
events []probeEvent
|
|
sensitive int
|
|
notFound int
|
|
paths []string // 命中路径样本（告警用）
|
|
}
|
|
|
|
// Banner 自动封禁器。方法并发安全。
|
|
type Banner struct {
|
|
mu sync.Mutex
|
|
|
|
probes map[string]*probeStat
|
|
banned map[string]time.Time
|
|
alerted map[string]bool
|
|
|
|
thresholdSensitive int
|
|
threshold404 int
|
|
window time.Duration
|
|
duration time.Duration
|
|
alertEmail string
|
|
sendAlert func(ip string, paths []string, durationMinutes int) error
|
|
enabled bool
|
|
}
|
|
|
|
// New 按配置创建封禁器并注册全局清理。
|
|
func New(opts Options) *Banner {
|
|
window := opts.Window
|
|
if window <= 0 {
|
|
window = DefaultWindowSeconds * time.Second
|
|
}
|
|
duration := opts.Duration
|
|
if duration <= 0 {
|
|
duration = DefaultDurationMinutes * time.Minute
|
|
}
|
|
sensitive := opts.ThresholdSensitive
|
|
if sensitive <= 0 {
|
|
sensitive = DefaultThresholdSensitive
|
|
}
|
|
notFound := opts.Threshold404
|
|
if notFound <= 0 {
|
|
notFound = DefaultThreshold404
|
|
}
|
|
b := &Banner{
|
|
probes: make(map[string]*probeStat),
|
|
banned: make(map[string]time.Time),
|
|
alerted: make(map[string]bool),
|
|
thresholdSensitive: sensitive,
|
|
threshold404: notFound,
|
|
window: window,
|
|
duration: duration,
|
|
alertEmail: strings.TrimSpace(opts.AlertEmail),
|
|
sendAlert: opts.SendAlert,
|
|
enabled: opts.Enabled,
|
|
}
|
|
register(b)
|
|
return b
|
|
}
|
|
|
|
// Record 记录一次探测事件，达到阈值时封禁 IP 并触发一次告警。
|
|
func (b *Banner) Record(ip, path string, kind int) {
|
|
if !b.enabled || ip == "" || kind == KindNone {
|
|
return
|
|
}
|
|
b.mu.Lock()
|
|
defer b.mu.Unlock()
|
|
|
|
now := time.Now()
|
|
cutoff := now.Add(-b.window)
|
|
|
|
st := b.probes[ip]
|
|
if st == nil {
|
|
st = &probeStat{}
|
|
b.probes[ip] = st
|
|
}
|
|
|
|
// 滚动清理过期事件并重算计数
|
|
valid := st.events[:0]
|
|
sensitive, notFound := 0, 0
|
|
for _, e := range st.events {
|
|
if e.at.After(cutoff) {
|
|
valid = append(valid, e)
|
|
if e.kind == KindSensitive {
|
|
sensitive++
|
|
} else if e.kind == KindNotFound {
|
|
notFound++
|
|
}
|
|
}
|
|
}
|
|
valid = append(valid, probeEvent{at: now, kind: kind})
|
|
if kind == KindSensitive {
|
|
sensitive++
|
|
} else {
|
|
notFound++
|
|
}
|
|
st.events = valid
|
|
st.sensitive = sensitive
|
|
st.notFound = notFound
|
|
if len(st.paths) < pathSampleMax && path != "" {
|
|
st.paths = append(st.paths, path)
|
|
}
|
|
|
|
if sensitive < b.thresholdSensitive && notFound < b.threshold404 {
|
|
return
|
|
}
|
|
|
|
// 已达阈值：封禁（已在封禁中则跳过）
|
|
if until, ok := b.banned[ip]; ok && until.After(now) {
|
|
return
|
|
}
|
|
until := now.Add(b.duration)
|
|
b.banned[ip] = until
|
|
|
|
// 告警（每 IP 仅一次）
|
|
if b.alertEmail != "" && b.sendAlert != nil && !b.alerted[ip] {
|
|
b.alerted[ip] = true
|
|
sample := append([]string{}, st.paths...)
|
|
dur := int(b.duration.Minutes())
|
|
go func() {
|
|
_ = b.sendAlert(ip, sample, dur)
|
|
}()
|
|
}
|
|
}
|
|
|
|
// IsBanned 判断 IP 是否处于封禁期；到期自动解除。
|
|
func (b *Banner) IsBanned(ip string) bool {
|
|
if !b.enabled || ip == "" {
|
|
return false
|
|
}
|
|
b.mu.Lock()
|
|
defer b.mu.Unlock()
|
|
if until, ok := b.banned[ip]; ok {
|
|
if until.After(time.Now()) {
|
|
return true
|
|
}
|
|
delete(b.banned, ip)
|
|
}
|
|
return false
|
|
}
|
|
|
|
// IsSensitivePath 判断路径是否命中敏感探测特征（忽略大小写，完整段前缀匹配）。
|
|
func IsSensitivePath(p string) bool {
|
|
lower := strings.ToLower(p)
|
|
for _, s := range sensitivePaths {
|
|
if lower == s || strings.HasPrefix(lower, s+"/") {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
// ---------- 全局注册与清理 ----------
|
|
|
|
var (
|
|
bannersMu sync.Mutex
|
|
banners = make(map[*Banner]struct{})
|
|
bannersOnce sync.Once
|
|
)
|
|
|
|
func register(b *Banner) {
|
|
bannersMu.Lock()
|
|
banners[b] = struct{}{}
|
|
bannersMu.Unlock()
|
|
|
|
bannersOnce.Do(func() {
|
|
go func() {
|
|
for {
|
|
time.Sleep(2 * time.Minute)
|
|
bannersMu.Lock()
|
|
for b := range banners {
|
|
b.cleanup()
|
|
}
|
|
bannersMu.Unlock()
|
|
}
|
|
}()
|
|
})
|
|
}
|
|
|
|
// cleanup 定期清理过期探测记录与已到期封禁（防止内存膨胀）。
|
|
func (b *Banner) cleanup() {
|
|
b.mu.Lock()
|
|
defer b.mu.Unlock()
|
|
|
|
now := time.Now()
|
|
cutoff := now.Add(-b.window)
|
|
|
|
for ip, st := range b.probes {
|
|
if len(st.events) == 0 || st.events[len(st.events)-1].at.Before(cutoff) {
|
|
delete(b.probes, ip)
|
|
continue
|
|
}
|
|
valid := st.events[:0]
|
|
sensitive, notFound := 0, 0
|
|
for _, e := range st.events {
|
|
if e.at.After(cutoff) {
|
|
valid = append(valid, e)
|
|
if e.kind == KindSensitive {
|
|
sensitive++
|
|
} else if e.kind == KindNotFound {
|
|
notFound++
|
|
}
|
|
}
|
|
}
|
|
st.events = valid
|
|
st.sensitive = sensitive
|
|
st.notFound = notFound
|
|
}
|
|
for ip, until := range b.banned {
|
|
if !until.After(now) {
|
|
delete(b.banned, ip)
|
|
}
|
|
}
|
|
}
|