pmb
946c2b9e01
Port 79 mostly attracts HTTP/SIP probes, TLS handshakes, and username guessers -- none of which resolve to a plan file. Treat any request that fails to read a plan as an "offense" and timestamp it against the source IP. Add BanTracker (ban.hpp/ban.cpp): a per-IP rolling-window offender list. When an IP has more than 3 offenses still inside a 24h window, its connections are dropped without being read or answered; timestamps older than the window are pruned so a blocked IP frees itself automatically. State is in-memory (single io_context thread, no locking); the clock is injected for testability. A periodic sweeper keeps the map bounded. Legitimate lookups that hit a real plan never count, which also frustrates username enumeration. Unit tests in test_ban.cpp.
90 lines
2.9 KiB
C++
90 lines
2.9 KiB
C++
#include "ban.hpp"
|
|
#include <gtest/gtest.h>
|
|
|
|
using namespace std::chrono_literals;
|
|
using clock_t_ = BanTracker::clock;
|
|
|
|
// Work well away from the steady_clock epoch so that subtracting the window
|
|
// never underflows and default-constructed time_points are unambiguous.
|
|
static const clock_t_::time_point kBase = clock_t_::time_point{} + 1000h;
|
|
|
|
TEST(BanTracker, UnknownIpIsNotBlocked) {
|
|
BanTracker bt;
|
|
EXPECT_FALSE(bt.is_blocked("1.2.3.4", kBase));
|
|
}
|
|
|
|
TEST(BanTracker, BlocksOnlyAfterMoreThanThreshold) {
|
|
BanTracker bt; // default threshold = 3, so block on the 4th failure
|
|
EXPECT_FALSE(bt.record_offense("1.2.3.4", kBase).blocked); // 1
|
|
EXPECT_FALSE(bt.record_offense("1.2.3.4", kBase).blocked); // 2
|
|
EXPECT_FALSE(bt.record_offense("1.2.3.4", kBase).blocked); // 3
|
|
EXPECT_FALSE(bt.is_blocked("1.2.3.4", kBase));
|
|
auto r = bt.record_offense("1.2.3.4", kBase); // 4
|
|
EXPECT_TRUE(r.blocked);
|
|
EXPECT_EQ(r.count, 4);
|
|
EXPECT_TRUE(bt.is_blocked("1.2.3.4", kBase));
|
|
}
|
|
|
|
TEST(BanTracker, TracksEachIpIndependently) {
|
|
BanTracker bt;
|
|
for (int i = 0; i < 4; ++i) {
|
|
bt.record_offense("1.1.1.1", kBase);
|
|
}
|
|
EXPECT_TRUE(bt.is_blocked("1.1.1.1", kBase));
|
|
EXPECT_FALSE(bt.is_blocked("2.2.2.2", kBase));
|
|
}
|
|
|
|
TEST(BanTracker, OffensesAgeOutOfRollingWindow) {
|
|
BanTracker bt;
|
|
// Four failures spread over a couple of hours -> blocked.
|
|
for (int i = 0; i < 4; ++i) {
|
|
bt.record_offense("1.2.3.4", kBase + i * 1h);
|
|
}
|
|
EXPECT_TRUE(bt.is_blocked("1.2.3.4", kBase + 3h));
|
|
|
|
// 24h after the first failure, that one drops out of the window: only 3
|
|
// remain, so the IP is no longer blocked.
|
|
EXPECT_FALSE(bt.is_blocked("1.2.3.4", kBase + 24h + 1min));
|
|
}
|
|
|
|
TEST(BanTracker, WindowBoundaryIsExclusiveAtCutoff) {
|
|
BanTracker bt;
|
|
// Exactly window-old timestamps are pruned (cutoff is inclusive of <=).
|
|
bt.record_offense("1.2.3.4", kBase);
|
|
auto r = bt.record_offense("1.2.3.4", kBase + 24h);
|
|
EXPECT_EQ(r.count, 1); // the kBase entry was pruned before appending
|
|
}
|
|
|
|
TEST(BanTracker, SweepRemovesFullyExpiredIp) {
|
|
BanTracker bt;
|
|
for (int i = 0; i < 4; ++i) {
|
|
bt.record_offense("1.2.3.4", kBase);
|
|
}
|
|
EXPECT_EQ(bt.tracked(), 1u);
|
|
bt.sweep(kBase + 24h + 1min); // all offenses aged out
|
|
EXPECT_EQ(bt.tracked(), 0u);
|
|
}
|
|
|
|
TEST(BanTracker, SweepKeepsStillActiveIp) {
|
|
BanTracker bt;
|
|
for (int i = 0; i < 4; ++i) {
|
|
bt.record_offense("1.2.3.4", kBase);
|
|
}
|
|
bt.sweep(kBase + 1h); // still inside the window
|
|
EXPECT_EQ(bt.tracked(), 1u);
|
|
EXPECT_TRUE(bt.is_blocked("1.2.3.4", kBase + 1h));
|
|
}
|
|
|
|
TEST(BanTracker, RespectsCustomConfig) {
|
|
BanTracker bt(BanTracker::Config{/*threshold=*/1, /*window=*/1h});
|
|
EXPECT_FALSE(bt.record_offense("9.9.9.9", kBase).blocked); // 1, not > 1
|
|
EXPECT_TRUE(bt.record_offense("9.9.9.9", kBase).blocked); // 2 > 1
|
|
EXPECT_TRUE(bt.is_blocked("9.9.9.9", kBase));
|
|
EXPECT_FALSE(bt.is_blocked("9.9.9.9", kBase + 1h + 1min)); // window elapsed
|
|
}
|
|
|
|
int main(int argc, char **argv) {
|
|
::testing::InitGoogleTest(&argc, argv);
|
|
return RUN_ALL_TESTS();
|
|
}
|