111 lines
3.7 KiB
Go
111 lines
3.7 KiB
Go
package collector
|
|
|
|
import (
|
|
"encoding/json"
|
|
"log"
|
|
"net/http"
|
|
"net/netip"
|
|
"strings"
|
|
"time"
|
|
|
|
"git.tornberg.me/go-otel/internal/features"
|
|
"git.tornberg.me/go-otel/internal/storage"
|
|
"git.tornberg.me/go-otel/internal/triage"
|
|
"git.tornberg.me/go-otel/internal/uaclass"
|
|
)
|
|
|
|
// SetSourceIPQuerier enables the source address endpoints.
|
|
func (c *Collector) SetSourceIPQuerier(q storage.SourceIPQuerier) { c.sourceIPs = q }
|
|
|
|
func (c *Collector) sourceIPsEnabled(w http.ResponseWriter) bool {
|
|
if c.sourceIPs == nil {
|
|
statsNotEnabled(w)
|
|
return false
|
|
}
|
|
return true
|
|
}
|
|
|
|
// HandleSourceIPs lists every unique source address ever recorded.
|
|
// Query: q (substring), hours (only addresses seen within), limit.
|
|
func (c *Collector) HandleSourceIPs(w http.ResponseWriter, r *http.Request) {
|
|
if !c.sourceIPsEnabled(w) {
|
|
return
|
|
}
|
|
var since time.Time
|
|
if _, hours := parseStatsCommon(r); r.URL.Query().Get("hours") != "" {
|
|
since = time.Now().Add(-time.Duration(hours) * time.Hour)
|
|
}
|
|
ips, err := c.sourceIPs.SourceIPs(r.Context(), strings.TrimSpace(r.URL.Query().Get("q")), since, parseLimit(r, 200))
|
|
if err != nil {
|
|
log.Printf("failed to list source ips: %v", err)
|
|
http.Error(w, "failed to list source ips", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
// Judge scanning behaviour over the last week for the whole page in one
|
|
// query. A failure only drops the hints; the list itself is still useful.
|
|
addrs := make([]string, len(ips))
|
|
for i := range ips {
|
|
addrs[i] = ips[i].IP
|
|
}
|
|
if routes, err := c.sourceIPs.SourceIPRoutes(r.Context(), addrs, time.Now().Add(-7*24*time.Hour)); err != nil {
|
|
log.Printf("failed to assess source ips: %v", err)
|
|
} else {
|
|
for i := range ips {
|
|
ips[i].BadActor, ips[i].ProbePaths = assessSourceIP(ips[i].IP, routes[ips[i].IP])
|
|
}
|
|
}
|
|
w.Header().Set("Content-Type", "application/json")
|
|
_ = json.NewEncoder(w).Encode(map[string]any{"ips": ips})
|
|
}
|
|
|
|
// HandleSourceIPActivity lists the recent requests made from one address.
|
|
// Query: hours (default 168), limit.
|
|
func (c *Collector) HandleSourceIPActivity(w http.ResponseWriter, r *http.Request) {
|
|
if !c.sourceIPsEnabled(w) {
|
|
return
|
|
}
|
|
addr, err := netip.ParseAddr(r.PathValue("ip"))
|
|
if err != nil {
|
|
http.Error(w, "invalid ip", http.StatusBadRequest)
|
|
return
|
|
}
|
|
_, hours := parseStatsCommon(r)
|
|
if r.URL.Query().Get("hours") == "" {
|
|
hours = 24 * 7
|
|
}
|
|
events, err := c.sourceIPs.SourceIPActivity(r.Context(), addr.String(), time.Now().Add(-time.Duration(hours)*time.Hour), parseLimit(r, 200))
|
|
if err != nil {
|
|
log.Printf("failed to load source ip activity: %v", err)
|
|
http.Error(w, "failed to load source ip activity", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
reason, probes := assessSourceIP(addr.String(), events)
|
|
w.Header().Set("Content-Type", "application/json")
|
|
_ = json.NewEncoder(w).Encode(map[string]any{
|
|
"ip": addr.String(), "hours": hours, "events": events,
|
|
// badActor is the first matching features.MarkBadActors rule over the
|
|
// returned window; probePaths is how many distinct probe paths it hit.
|
|
"badActor": reason, "probePaths": probes,
|
|
})
|
|
}
|
|
|
|
// assessSourceIP applies the same bad-actor rules the detector uses to one
|
|
// address's requests, so the hint in the UI never disagrees with triage.
|
|
func assessSourceIP(ip string, events []storage.SourceIPEvent) (reason string, probePaths int) {
|
|
fe := make([]features.Event, len(events))
|
|
probes := map[string]struct{}{}
|
|
for i, e := range events {
|
|
fe[i] = features.Event{Route: e.Route, StatusCode: int(e.StatusCode), ClientIP: ip, UAClass: uaclass.Of(e.UserAgent)}
|
|
if triage.IsProbePath(e.Route) {
|
|
probes[e.Route] = struct{}{}
|
|
}
|
|
}
|
|
features.MarkBadActors(fe, features.BadActorConfig{})
|
|
for _, e := range fe {
|
|
if e.BadActor != "" {
|
|
return e.BadActor, len(probes)
|
|
}
|
|
}
|
|
return "", len(probes)
|
|
}
|