Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

重构防爆逻辑 #338

Merged
merged 5 commits into from
Oct 5, 2024
Merged

重构防爆逻辑 #338

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2fedb28
1.重构防爆逻辑，基于IP+UserName锁定（单位时间内，锁定相同IP下的相同用户，其它IP和用户不影响）
wsczx Oct 3, 2024
f195ae2
优化代码
wsczx Oct 3, 2024
59748fe
增加锁定状态记录生命周期配置项，优化清理内存的定时器
wsczx Oct 4, 2024
c8cb9c1
增加全局IP白名单功能
wsczx Oct 4, 2024
1c6fc44
修复无法自动解锁的Bug
wsczx Oct 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 16 additions & 4 deletions server/base/cfg.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,10 +85,22 @@ type ServerConfig struct {
DisplayError bool `json:"display_error"`
ExcludeExportIp bool `json:"exclude_export_ip"`

MaxBanCount int `json:"max_ban_score"`
BanResetTime int `json:"ban_reset_time"`
LockTime int `json:"lock_time"`
UserStateExpiration int `json:"user_state_expiration"`
AntiBruteForce bool `json:"anti_brute_force"`
IPWhitelist string `json:"ip_whitelist"`

MaxBanCount int `json:"max_ban_score"`
BanResetTime int `json:"ban_reset_time"`
LockTime int `json:"lock_time"`

MaxGlobalUserBanCount int `json:"max_global_user_ban_count"`
GlobalUserBanResetTime int `json:"global_user_ban_reset_time"`
GlobalUserLockTime int `json:"global_user_lock_time"`

MaxGlobalIPBanCount int `json:"max_global_ip_ban_count"`
GlobalIPBanResetTime int `json:"global_ip_ban_reset_time"`
GlobalIPLockTime int `json:"global_ip_lock_time"`

GlobalLockStateExpirationTime int `json:"global_lock_state_expiration_time"`
}

func initServerCfg() {
Expand Down
18 changes: 15 additions & 3 deletions server/base/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,10 +72,22 @@ var configs = []config{
{Typ: cfgBool, Name: "display_error", Usage: "客户端显示详细错误信息(线上环境慎开启)", ValBool: false},
{Typ: cfgBool, Name: "exclude_export_ip", Usage: "排除出口ip路由(出口ip不加密传输)", ValBool: true},

{Typ: cfgInt, Name: "max_ban_score", Usage: "单位时间内最大尝试次数，0为关闭防爆功能", ValInt: 5},
{Typ: cfgInt, Name: "ban_reset_time", Usage: "设置单位时间(秒)，超过则重置计数", ValInt: 1},
{Typ: cfgBool, Name: "anti_brute_force", Usage: "是否开启防爆功能", ValBool: true},
{Typ: cfgStr, Name: "ip_whitelist", Usage: "全局IP白名单,多个用逗号分隔，支持单IP和CIDR范围", ValStr: "192.168.90.1,172.16.0.0/24"},

{Typ: cfgInt, Name: "max_ban_score", Usage: "单位时间内最大尝试次数，0为关闭该功能", ValInt: 5},
{Typ: cfgInt, Name: "ban_reset_time", Usage: "设置单位时间(秒)，超过则重置计数", ValInt: 10},
{Typ: cfgInt, Name: "lock_time", Usage: "超过最大尝试次数后的锁定时长(秒)", ValInt: 300},
{Typ: cfgInt, Name: "user_state_expiration", Usage: "用户状态的保存周期(秒),超过则清空计数", ValInt: 900},

{Typ: cfgInt, Name: "max_global_user_ban_count", Usage: "全局用户单位时间内最大尝试次数，0为关闭该功能", ValInt: 20},
{Typ: cfgInt, Name: "global_user_ban_reset_time", Usage: "全局用户设置单位时间(秒)", ValInt: 600},
{Typ: cfgInt, Name: "global_user_lock_time", Usage: "全局用户锁定时间(秒)", ValInt: 300},

{Typ: cfgInt, Name: "max_global_ip_ban_count", Usage: "全局IP单位时间内最大尝试次数，0为关闭该功能", ValInt: 40},
{Typ: cfgInt, Name: "global_ip_ban_reset_time", Usage: "全局IP设置单位时间(秒)", ValInt: 1200},
{Typ: cfgInt, Name: "global_ip_lock_time", Usage: "全局IP锁定时间(秒)", ValInt: 300},

{Typ: cfgInt, Name: "global_lock_state_expiration_time", Usage: "全局锁定状态的保存生命周期(秒),超过则删除记录", ValInt: 3600},
}

var envs = map[string]string{}
29 changes: 25 additions & 4 deletions server/conf/server.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,14 +53,35 @@ ipv4_end = "192.168.90.200"
#是否自动添加nat
iptables_nat = true

#单位时间内最大尝试次数，0为关闭防爆功能
#防爆破全局开关
anti_brute_force = true
#全局IP白名单,多个用逗号分隔，支持单IP和CIDR范围
ip_whitelist = "192.168.90.1,172.16.0.0/24"

#锁定时间最好不要超过单位时间
#单位时间内最大尝试次数，0为关闭该功能
max_ban_score = 5
#设置单位时间(秒)，超过则重置计数
ban_reset_time = 10
ban_reset_time = 600
#超过最大尝试次数后的锁定时长(秒)
lock_time = 300
#用户状态的保存周期(秒),超过则清空计数
user_state_expiration = 900

#全局用户单位时间内最大尝试次数,0为关闭该功能
max_global_user_ban_count = 20
#全局用户设置单位时间(秒)
global_user_ban_reset_time = 600
#全局用户锁定时间(秒)
global_user_lock_time = 300

#全局IP单位时间内最大尝试次数，0为关闭该功能
max_global_ip_ban_count = 40
#全局IP设置单位时间(秒)
global_ip_ban_reset_time = 1200
#全局IP锁定时间(秒)
global_ip_lock_time = 300

#全局锁定状态的保存生命周期(秒),超过则删除记录
global_lock_state_expiration_time = 3600

#客户端显示详细错误信息(线上环境慎开启)
display_error = true
Loading
Loading