more

internal/honeypot/honeypot.go

@@ -135,7 +135,7 @@ func (t *Tracker) record(ip string) bool {
 	}
 	state.Count++
 	state.LastSeen = now
-	if state.Count > t.threshold {
+	if state.Count >= t.threshold {
 		state.PromotedUntil = now.Add(t.ttl)
 	}
 	t.clients[ip] = state
@@ -145,6 +145,19 @@ func (t *Tracker) record(ip string) bool {
 	return !state.PromotedUntil.IsZero() && now.Before(state.PromotedUntil)
 }
 
+// RecordTelemetry records a suspicious request observed in an OTLP span. This
+// is separate from Middleware because the request may have been handled by a
+// different application/ingress host while its telemetry is sent to this
+// collector. No decoy response is written here; this only updates the
+// promoted-IP feed.
+func (t *Tracker) RecordTelemetry(ip, path string) bool {
+	ip = strings.TrimSpace(strings.SplitN(ip, ",", 2)[0])
+	if ip == "" || !isSuspiciousPath(path) {
+		return false
+	}
+	return t.record(ip)
+}
+
 // PromotedIPs returns a snapshot suitable for an ingress synchronizer.
 func (t *Tracker) PromotedIPs() []IP {
 	now := time.Now()

internal/honeypot/honeypot_test.go

@@ -39,3 +39,20 @@ func TestHandleIPsRequiresToken(t *testing.T) {
 		t.Fatalf("got %d and %q", recorder.Code, recorder.Body.String())
 	}
 }
+
+func TestRecordTelemetryPromotesTheObservedSourceIP(t *testing.T) {
+	tracker := New(Config{Threshold: 2, TTL: time.Minute})
+	if tracker.RecordTelemetry("203.0.113.20", "/mail.php") {
+		t.Fatal("must not promote before threshold")
+	}
+	if !tracker.RecordTelemetry("203.0.113.20", "/settings.php") {
+		t.Fatal("must promote at threshold")
+	}
+	if tracker.RecordTelemetry("203.0.113.20", "/index.html") {
+		t.Fatal("normal paths must not be tracked")
+	}
+	ips := tracker.PromotedIPs()
+	if len(ips) != 1 || ips[0].Address != "203.0.113.20" {
+		t.Fatalf("unexpected promoted IPs: %+v", ips)
+	}
+}