去评论
dz插件网

基于ddos-deflate增强实时扫描高连接数 IP自动封禁超过阈值的 IP整合 Fail2ban、宝塔nginx防火墙、用户自定义白名单的防御攻击

admin
2025/09/02 22:44:56
鍩轰簬ddos-deflate澧炲己瀹炴椂鎵弿楂樿繛鎺ユ暟 IP鑷姩灏佺瓒呰繃闃堝€肩殑 IP鏁村悎 Fail2ban銆佸疂濉攏ginx闃茬伀澧欍€丷edis CC L7灞傞槻寰°€佺敤鎴疯嚜瀹氫箟鐧藉悕鍗曠殑闃插尽鏀诲嚮鑴氭湰锛氥€愨瓙猸愨瓙猸愨瓙鎺ㄨ崘锛銆
DZ鎻掍欢缃戠殑瀹為檯杩愮敤鏁堟灉鍥撅細

鏈鏇存柊鏃ュ織锛 [2025.9.13 缁堟瀬鏇存柊]
鍔熻兘鍒嗙被鍔熻兘妯″潡v24.27 缁堟瀬鐗堢姸鎬瀹¤璇存槑涓庝紭鍖栫偣
鏍稿績闃插尽寮曟搸L7 搴旂敤灞傞槻寰鉁 鍖呭惈瀹屾暣鍖呭惈CC銆佺伆鑹叉満鍣ㄤ汉銆丏iscuz!绮惧噯鎵撳嚮銆佹悳绱㈠紩鎿庝繚鎶ゃ€
L4 缃戠粶灞傞槻寰鉁 鍖呭惈閲囩敤鏈€缁堜慨姝ｇ殑awk $NF寮曟搸锛岀簿鍑嗙粺璁¤繛鎺ユ暟銆
鏅鸿兘闃插尽浣撶郴鑷€傚簲鏀诲嚮妯″紡鉁 鍖呭惈鍙牴鎹叏灞€娴侀噺锛岃嚜鍔ㄥ崌闄峀4鍜孡7闃插尽闃堝€笺€
娓愯繘寮忓皝绂鉁 鍖呭惈瀹屾暣瀹炵幇锛氬鍙嶅鏀诲嚮鐨処P鑷姩鍗囩骇灏佺鏃堕暱锛岀洿鑷虫案涔呭皝绂併€
鎭舵剰IP鎯呮姤搴鉁 鍖呭惈瀹屾暣瀹炵幇锛氭案涔呰褰曡鈥滈《鏍煎缃氣€濈殑IP锛屼究浜庡彇璇併€
鑷繘鍖栫櫧鍚嶅崟鉁 鍖呭惈瀹屾暣瀹炵幇锛氬彲瀹氭湡浠嶤DN鏈嶅姟鍟嗚嚜鍔ㄨ幏鍙栧苟鏇存柊IP鍒楄〃銆
Redis CC鍘熷瓙寮曟搸鉁 鍖呭惈瀹屾暣瀹炵幇锛氬紩鍏モ€淩edis鍘熺敓CC闃插尽寮曟搸鈥濓紝鑷姩妫€娴嬪苟浣跨敤Redis缂撳瓨锛屾瀬澶ч檷浣庣鐩業/O銆
鍔ㄦ€佹壂鎻忛鐜鉁 鍖呭惈瀹屾暣瀹炵幇锛氭敾鍑绘ā寮忎笅鑷姩鍔犻€熸壂鎻忥紝骞虫伅鍚庤嚜鍔ㄩ檷閫熴€
鐪熷亣铚樿洓DNS鏍￠獙鉁 鍖呭惈閫氳繃DNS鍙屽悜瑙ｆ瀽锛100%璇嗗埆浼鎴愭牳蹇冩悳绱㈠紩鎿庣殑鏀诲嚮鑰呫€
鍛婅涓庝氦浜鈥滅姸鎬+鎴樻姤鈥濆弻鍛婅鉁 鍖呭惈鍚屾椂鎷ユ湁鈥滆繘鍏/閫€鍑烘敾鍑绘ā寮忊€濈殑鐘舵€佸憡璀﹀拰鍖呭惈绮惧噯鏀诲嚮鍒楄〃鐨勨€滄壒娆℃垬鎶モ€濄€
鐢ㄦ埛瀹氬埗鍖栨牸寮鉁 鍖呭惈鍛婅鏍煎紡銆丒moji銆佹湇鍔″櫒IP绛夊潎宸叉寜鎮ㄧ殑鏈€缁堣姹傚畾鍒躲€
鐧藉悕鍗曚笌璋冧紭鍏ㄦ潵婧愮櫧鍚嶅崟鉁 鍖呭惈瀹屾暣鏀寔ignore.ip.list, ignore.host.list, 瀹濆, Fail2ban銆
鍐呮牳鍙傛暟璋冧紭鉁 鍖呭惈tune鍛戒护瀹屾暣淇濈暀銆
鐢ㄦ埛瀹氬埗鍖栭槇鍊鉁 宸蹭慨姝L4灞傞槇鍊煎凡涓ユ牸鎸夌収DZ鎻掍欢缃戞渶缁堝疄璺 40/15/60 杩涜棰勮銆
浠ｇ爜璐ㄩ噺瀹屾暣鎬т笌鍙鎬鉁 100%淇濊瘉鎵€鏈変唬鐮佸潎宸叉仮澶嶄负娓呮櫚銆佸甫缂╄繘鍜岃灏芥敞閲婄殑澶氳鏍煎紡锛屾棤浠讳綍鐪佺暐銆
2025.9.13澧炲己闃插尽鍓嶇疆闃插尽鍙傛暟閰嶇疆锛歔鍗冲湪/etc/ddos 璺緞涓嬮潰鍒涘缓 host-thresholds.json]锛堜笅闈㈠煙鍚嶉兘鏇挎崲涓轰綘鑷繁瀹為檯鍩熷悕锛
鐩存帴鍛戒护鍒涘缓瀹屾暣 缃戠珯缁嗗垎棰楃矑搴﹂槻寰￠槇鍊煎紩瀵兼枃浠讹紙鍝€曞繕璁板垱寤 鑴氭湰涔熸湁鍐椾綑淇濆簳锛 锛

  1. sudo cat <<'EOF' > /etc/ddos/host-thresholds.json
  2. {
  3.   "GLOBAL": {
  4.     "NO_OF_SYN": 180,
  5.     "NO_OF_EST": 260,
  6.     "NO_OF_CONNTRACK": 15000
  7.   },

  9.   "default": {
  10.     "HOST_WEIGHT": 1.0,
  11.     "REQ_PER_MIN": { "L1": 30, "L2": 60, "L3": 120 },
  12.     "SYN_PER_IP": 0,
  13.     "EST_PER_IP": 0,
  14.     "PATH_TIERS": [
  15.       { "KIND": "PREFIX", "PAT": "/favicon.ico", "L1": 200, "L2": 400, "L3": 800 },
  16.       { "KIND": "PREFIX", "PAT": "/static/",     "L1": 200, "L2": 400, "L3": 800 }
  17.     ]
  18.   },

  20.   "www.dz-x.net": {
  21.     "HOST_WEIGHT": 1.0,
  22.     "REQ_PER_MIN": { "L1": 28, "L2": 56, "L3": 112 },
  23.     "SYN_PER_IP": 60,
  24.     "EST_PER_IP": 90,
  25.     "PATH_TIERS": [
  26.       { "KIND": "PREFIX", "PAT": "/avatar.php",                 "L1": 10, "L2": 20, "L3": 40 },
  27.       { "KIND": "REGEX",  "PAT": "^/misc\\.php\\?mod=seccode",  "L1": 6,  "L2": 12, "L3": 24 },
  28.       { "KIND": "REGEX",  "PAT": "^/forum\\.php\\?mod=image",   "L1": 8,  "L2": 16, "L3": 32 },
  29.       { "KIND": "PREFIX", "PAT": "/ajax.php",                   "L1": 12, "L2": 24, "L3": 48 },
  30.       { "KIND": "REGEX",  "PAT": "^/plugin\\.php\\?id=",        "L1": 8,  "L2": 16, "L3": 32 },
  31.       { "KIND": "PREFIX", "PAT": "/search.php",                 "L1": 4,  "L2": 8,  "L3": 16 },
  32.       { "KIND": "PREFIX", "PAT": "/home.php",                   "L1": 16, "L2": 32, "L3": 64 },
  33.       { "KIND": "PREFIX", "PAT": "/member.php",                 "L1": 10, "L2": 20, "L3": 40 },
  34.       { "KIND": "REGEX",  "PAT": "^/forum\\.php\\?mod=viewthread", "L1": 14, "L2": 28, "L3": 56 },
  35.       { "KIND": "PREFIX", "PAT": "/api/mobile/",                "L1": 10, "L2": 20, "L3": 40 },
  36.       { "KIND": "PREFIX", "PAT": "/uc_server/",                 "L1": 12, "L2": 24, "L3": 48 }
  37.     ]
  38.   },

  40.   "demo.dz-x.net": {
  41.     "HOST_WEIGHT": 0.8,
  42.     "REQ_PER_MIN": { "L1": 24, "L2": 48, "L3": 96 },
  43.     "SYN_PER_IP": 50,
  44.     "EST_PER_IP": 80,
  45.     "PATH_TIERS": [
  46.       { "KIND": "PREFIX", "PAT": "/avatar.php",                "L1": 10, "L2": 20, "L3": 40 },
  47.       { "KIND": "REGEX",  "PAT": "^/misc\\.php\\?mod=seccode", "L1": 6,  "L2": 12, "L3": 24 },
  48.       { "KIND": "PREFIX", "PAT": "/ajax.php",                  "L1": 12, "L2": 24, "L3": 48 },
  49.       { "KIND": "REGEX",  "PAT": "^/plugin\\.php\\?id=",       "L1": 8,  "L2": 16, "L3": 32 },
  50.       { "KIND": "PREFIX", "PAT": "/search.php",                "L1": 4,  "L2": 8,  "L3": 16 }
  51.     ]
  52.   }
  53. }
  54. EOF


鍒涘缓瀹夎鑴氭湰锛
  1. sudo vi /usr/local/sbin/ddos-guard
绮樿创濡備笅缁忚繃DZ鎻掍欢缃戜紭鍖栧疄鎴樼殑鏍稿績瀹夎鑴氭湰鍐呭锛氥€2025-09-13 鏇存柊骞跺疄娴嬮獙璇佹棤閿欙紝璇峰皢鑴氭湰鍐呭鐨勯儴鍒嗗弬鏁版牴鎹嚜宸卞疄闄呮儏鍐垫敼鍐欍€
瀹屾暣鑴氭湰鍐呭锛
銆愯寰楁壒閲忔悳绱⑩€滀綘鐨勨€濇浛鎹负浣犺嚜宸辩殑瀹為檯淇℃伅銆锛堟敞鎰忓畬鏁村鍒朵笉瑕佹湁浠讳綍鏍煎紡绗﹀彿缂栫爜閿欒锛
  1. #!/usr/bin/env bash
  2. # ==============================================================================
  3. # ddos-guard v24.27-Stable (Debian 12 + BT Panel + Discuz! X3.5)
  4. # 鏍稿績娓呭崟锛堢畝瑕侊級
  5. # - BTWAF v4/v6 鐧藉悕鍗曡В鏋愶紝甯﹁缁嗘潵婧愮粺璁′笌涓侀拤鎺ㄩ€
  6. # - 缁熶竴鐧藉悕鍗曪細ignore.ip.list / ignore.host.list / BTWAF / Fail2ban ignoreip
  7. # - 鐧藉悕鍗曟洿鏂板悗鑷姩瑙ｅ皝琚鏉€ IP锛屽甫瑙ｅ皝璁℃暟
  8. # - nftables 寮曟搸锛坵l{4,6}/tmp{4,6}/bl{4,6}锛夛紝鍥為€€ iptables+ipset
  9. # - L4/L7 娣峰悎锛歋YN/EST per-IP銆佸叏灞€ CT锛岃嚜閫傚簲 GLOBAL 闃堝€硷紱Redis 鍘熷瓙璁℃暟鐨 L7 闄愰€
  10. # - 绔欑偣瑕嗗啓/鏉冮噸锛/etc/ddos/host-thresholds.json锛夛紝鐭獥 IP鈫扝ost 绱㈠紩
  11. # - 鐪熷亣铚樿洓锛圲A 妯″紡 + 鍙嶆煡/姝ｅ悜鍥炶瘉锛夛紝Discuz 绮炬墦 + 娉涘姩鎬侀〉 CC
  12. # - 娓愯繘寮忓皝绂侊紙T1/T2/T3鈫掓案涔咃級锛屾伓鎰 IP 鎯呮姤搴擄紙鍩轰簬 Redis 璁℃暟锛
  13. # - 瀛愬懡浠わ細install / uninstall / run / daemon / status / top / history /
  14. #           check / tune / tune-guide / whitelist-reload / whitelist-show /
  15. #           ban / unban / flush-bans / blacklist / f2b-setup
  16. # ==============================================================================

  18. set -euo pipefail
  19. IFS=$'\n\t'

  21. SCRIPT_NAME="ddos-guard"
  22. SELF_PATH="/usr/local/sbin/${SCRIPT_NAME}"

  24. # ----------------------------- 杩愯鐩綍/鏃ュ織 --------------------------------
  25. LOG_FILE="/var/log/ddos-guard.log"            # 鑴氭湰杩愯鏃ュ織
  26. BAN_HISTORY="/var/log/ddos-guard-history.csv"  # 灏佺鍘嗗彶锛圕SV锛
  27. WORKDIR="/usr/local/ddos-deflate"              # 鍏煎/淇濈暀鐨勬暟鎹洰褰
  28. RUNDIR="/run/ddos-guard"                       # 杩愯鎬佹暟鎹€佸揩鐓с€佽妭娴佹爣璁扮瓑
  29. TMPDIR="/tmp/ddos-guard"                       # 涓存椂鏂囦欢鐩綍
  30. mkdir -p "$WORKDIR" "$RUNDIR" "$TMPDIR"

  32. LOCK_FILE="/var/lock/ddos-guard.lock"          # 璺ㄨ繘绋嬩簰鏂ラ攣
  33. LOCK_FD=200

  35. # ----------------------------- 澶栭儴渚濊禆 ------------------------------------
  36. SS=$(command -v ss || true)
  37. IPT=$(command -v iptables || true)
  38. IP6T=$(command -v ip6tables || true)
  39. IPSET=$(command -v ipset || true)
  40. CT=$(command -v conntrack || true)
  41. TAIL=$(command -v tail || true)
  42. GREP=$(command -v grep || true)
  43. AWK=$(command -v awk || true)
  44. SED=$(command -v sed || true)
  45. SORT=$(command -v sort || true)
  46. UNIQ=$(command -v uniq || true)
  47. CUT=$(command -v cut || true)
  48. HEAD=$(command -v head || true)
  49. DATE=$(command -v date || true)
  50. HOST=$(command -v host || true)
  51. PY3=$(command -v python3 || true)
  52. CURL=$(command -v curl || true)
  53. REDIS_CLI=$(command -v redis-cli || true)
  54. GETENT=$(command -v getent || true)
  55. STAT=$(command -v stat || true)
  56. SHA1=$(command -v sha1sum || command -v shasum || true)
  57. MD5=$(command -v md5sum || true)

  59. # ----------------------------- 閽夐拤鍛婅 ------------------------------------
  60. # - 璁剧疆 DINGTALK_WEBHOOK 鍗冲彲鍚敤閽夐拤鏈哄櫒浜
  61. # - 鍚岀被鍛婅鑺傛祦榛樿 600s锛10 鍒嗛挓锛
  62. DINGTALK_WEBHOOK="${DINGTALK_WEBHOOK:-https://oapi.dingtalk.com/robot/send?access_token=浣犻拤閽夌殑webhook鏈哄櫒浜轰俊鎭瘆"
  63. DINGTALK_THROTTLE_SEC="${DINGTALK_THROTTLE_SEC:-600}"
  64. ALERT_TS_DIR="$RUNDIR/alert-ts"; mkdir -p "$ALERT_TS_DIR"

  66. # ----------------------------- L4 鍏滃簳闃堝€ ---------------------------------
  67. # 鑻 /etc/ddos/host-thresholds.json 鐨 GLOBAL 娈靛瓨鍦紝浼氳鐩栬繖浜涒€滃厹搴曗€
  68. NO_OF_SYN=${NO_OF_SYN:-180}               # 鍏ㄥ眬 SYN锛堟€婚噺锛夎Е鍙戠嚎
  69. NO_OF_EST=${NO_OF_EST:-260}               # 鍏ㄥ眬 EST锛堟€婚噺锛夎Е鍙戠嚎
  70. NO_OF_CONNTRACK=${NO_OF_CONNTRACK:-15000} # 鍏ㄥ眬 conntrack锛堟€婚噺锛夎Е鍙戠嚎
  71. NO_OF_CT="$NO_OF_CONNTRACK"

  73. # 鏀诲嚮妯″紡涓 per-IP 鐨 L4 鏇翠弗闃堝€
  74. ENABLE_DYNAMIC_THRESHOLDS=${ENABLE_DYNAMIC_THRESHOLDS:-true}
  75. NO_OF_EST_ATTACK_MODE=${NO_OF_EST_ATTACK_MODE:-120}        # 鍙傝€ www.dz-x.net/t/151300/1/1.html
  76. NO_OF_SYN_ATTACK_MODE=${NO_OF_SYN_ATTACK_MODE:-68}        # 鍙傝€ www.dz-x.net/t/151300/1/1.html

  78. # L7 鍏滃簳闃堝€硷紙姣忚矾寰 L1 鍩虹嚎锛孒ost/Path tiers 浼氳鐩栵級
  79. CC_THRESHOLD=${CC_THRESHOLD:-30}
  80. CC_THRESHOLD_ATTACK_MODE=${CC_THRESHOLD_ATTACK_MODE:-5}

  82. # ----------------------------- 澶氱珯鐐规棩蹇 ----------------------------------
  83. # 璁块棶鏃ュ織锛圕C 鏃ュ織锛夛細涓€琛屼竴涓枃浠讹紱鏃犳硶浠庢棩蹇楄В鏋 Host 鏃讹紝鐢 LOG_HOST_MAP 鍏滃簳 [浠ヤ綘瀹濆闈㈡澘鐨勫疄闄呯綉绔欒闂棩蹇楄矾寰勪负鍑哴
  84. CC_LOG_PATHS=(
  85.   "/www/wwwlogs/浣犵殑鍩熷悕1.log"
  86.   "/www/wwwlogs/浣犵殑鍩熷悕2.log"
  87.   "/www/wwwlogs/浣犵殑鍩熷悕3.log"
  88.   "/www/wwwlogs/浣犵殑鍩熷悕4.log"
  89.   "/www/wwwlogs/浣犵殑鍩熷悕5.log"
  90. )
  91. # 閿欒鏃ュ織锛坧erip 鍗囩骇绛夌嚎绱級锛氫竴琛屼竴涓枃浠
  92. ERROR_LOG_PATHS=(
  93.   "/www/wwwlogs/浣犵殑鍩熷悕1.error.log"
  94.   "/www/wwwlogs/浣犵殑鍩熷悕2.error.log"
  95.   "/www/wwwlogs/浣犵殑鍩熷悕3.error.log"
  96.   "/www/wwwlogs/浣犵殑鍩熷悕4.error.log"
  97.   "/www/wwwlogs/浣犵殑鍩熷悕5.error.log"
  98. )
  99. # 鏃ュ織 鈫 Host 鐨勫洖閫€鏄犲皠锛堟鍒 鈫 鍩熷悕锛塠浠ヤ綘瀹濆闈㈡澘鐨勫疄闄呯綉绔欒闂棩蹇楄矾寰勪负鍑哴
  100. declare -A LOG_HOST_MAP=(
  101.   ["^/www/wwwlogs/www\.浣犵殑\.鍩熷悕1鍚庣紑\.log$"]="浣犵殑鍩熷悕1"
  102.   ["^/www/wwwlogs/www\.浣犵殑\.鍩熷悕1鍚庣紑\.error\.log$"]="浣犵殑鍩熷悕1"
  103.   ["^/www/wwwlogs/www\.浣犵殑\.鍩熷悕2鍚庣紑\.log$"]="浣犵殑鍩熷悕2"
  104.   ["^/www/wwwlogs/www\.浣犵殑\.鍩熷悕2鍚庣紑\.error\.log$"]="浣犵殑鍩熷悕2"
  105.   ["^/www/wwwlogs/www\.浣犵殑\.鍩熷悕3鍚庣紑\.log$"]="浣犵殑鍩熷悕3"
  106.   ["^/www/wwwlogs/www\.浣犵殑\.鍩熷悕3鍚庣紑\.error\.log$"]="浣犵殑鍩熷悕3"
  107.   ["^/www/wwwlogs/www\.浣犵殑s\.鍩熷悕4鍚庣紑\.log$"]="浣犵殑鍩熷悕4"
  108.   ["^/www/wwwlogs/www\.浣犵殑\.鍩熷悕4鍚庣紑\.error\.log$"]="浣犵殑鍩熷悕4"
  109.   ["^/www/wwwlogs/www\.浣犵殑\.鍩熷悕5鍚庣紑\.log$"]="浣犵殑鍩熷悕5"
  110.   ["^/www/wwwlogs/www\.p浣犵殑\.鍩熷悕5鍚庣紑\.error\.log$"]="浣犵殑鍩熷悕5"
  111. )

  113. # ----------------------------- Redis锛堥檺閫熶笌缂撳瓨锛 ------------------------
  114. ENABLE_RATE_LIMITING=${ENABLE_RATE_LIMITING:-true}        # 鏄惁鍚敤 Redis L7 鍘熷瓙闄愰€
  115. RATELIMIT_TTL=${RATELIMIT_TTL:-600}                       # 璁℃暟 key 鐨 TTL锛堣鏄庢€э級
  116. RATELIMIT_RATE="${RATELIMIT_RATE:-15/minute}"             # 璇存槑鎬ф樉绀
  117. CC_RATELIMIT_THRESHOLD=${CC_RATELIMIT_THRESHOLD:-15}      # 10s 绐楀彛闃堝€硷紙INCR+EXPIRE锛

  119. # 鏃ュ織娓告爣缂撳瓨锛堟樉钁楅檷浣 I/O锛夛細渚濊禆 redis-cli 涓 stat
  120. LOG_CACHE_ENABLE=${LOG_CACHE_ENABLE:-true}
  121. LOG_CACHE_MAX_FALLBACK_LINES=${LOG_CACHE_MAX_FALLBACK_LINES:-20000}

  123. # ----------------------------- 铚樿洓 UA 绛栫暐 --------------------------------
  124. GOOD_BOT_PATTERN='Googlebot|Baiduspider|bingbot|Sogou|360Spider|YisouSpider|YoudaoBot|msnbot|Yahoo! Slurp|YandexBot|DNSPod-Monitor|AspiegelBot'
  125. SEMI_TRUST_BOTS='Bytespider|ToutiaoSpider'
  126. BAD_BOT_PATTERN='Applebot|Amazonbot|GPTBot|ClaudeBot|PetalBot|DataForSeoBot|meta-externalagent|okhttp|Thinkbot|MJ12bot|SemrushBot|AhrefsBot|DotBot|Scrapy|python-requests|aiohttp|curl|wget|python-urllib|Go-http-client|Java/|PycURL|httpx'
  127. declare -A GOOD_BOT_RDNS_SUFFIX=(
  128.   ["Googlebot"]="\\.googlebot\\.com$|\\.google\\.com$"
  129.   ["bingbot"]="\\.search\\.msn\\.com$|\\.bing\\.com$"
  130.   ["Baiduspider"]="\\.baidu\\.com$|\\.baiducontent\\.com$"
  131.   ["Sogou"]="\\.sogou\\.com$|\\.sogou\\.com\\.cn$"
  132.   ["360Spider"]="\\.360\\.cn$|\\.haosou\\.com$|\\.so\\.com$"
  133.   ["YisouSpider"]="\\.yisou\\.com$"
  134.   ["YoudaoBot"]="\\.youdao\\.com$"
  135.   ["YandexBot"]="\\.yandex\\.ru$|\\.yandex\\.net$"
  136.   ["Yahoo! Slurp"]="\\.yahoo\\.com$|\\.yahoo\\.net$"
  137.   ["msnbot"]="\\.msn\\.com$|\\.bing\\.com$"
  138.   ["DNSPod-Monitor"]="\\.dnspod\\.cn$|\\.dnspod\\.com$"
  139.   ["AspiegelBot"]="\\.aspiegel\\.com$|\\.petalbot\\.com$"
  140. )

  142. # ----------------------------- 鐧藉悕鍗曟簮 ------------------------------------
  143. IGNORE_IP_FILE="/etc/ddos/ignore.ip.list"             # 涓€琛屼竴涓紙CIDR/鍗旾P锛夛紝鏀寔 # 娉ㄩ噴
  144. IGNORE_HOST_FILE="/etc/ddos/ignore.host.list"         # 涓€琛屼竴涓煙鍚嶏紝瑙ｆ瀽 A/AAAA
  145. BTWAF_IP_WHITE="${BTWAF_IP_WHITE:-/www/server/btwaf/rule/ip_white.json}"          # IPv4 鏁村舰鎴栧尯闂
  146. BTWAF_IP_WHITE_V6="${BTWAF_IP_WHITE_V6:-/www/server/btwaf/rule/ip_white_v6.json}" # IPv6 CIDR/鍗曟

  148. # 鐧藉悕鍗曞憡璀﹁Е鍙戠瓥鐣ワ細浠呮牴鎹潵婧愭枃浠 mtime 鎺ㄩ€侊紙true/false锛
  149. WL_ALERT_BY_MTIME_ONLY=${WL_ALERT_BY_MTIME_ONLY:-true}

  151. # ----------------------------- Host/Path 闃堝€ JSON ------------------------
  152. THRESHOLDS_JSON="${THRESHOLDS_JSON:-/etc/ddos/host-thresholds.json}"        # 妯℃澘鏂囦欢鍙傝€ www.dz-x.net/t/151053/1/1.html

  154. # ----------------------------- 鎵弿棰戠巼锛堝姩鎬侊級 ---------------------------
  155. SCAN_INTERVAL=${SCAN_INTERVAL:-8}               # 姝ｅ父鎬 systemd timer 鍛ㄦ湡锛堢锛
  156. ATTACK_SCAN_INTERVAL=${ATTACK_SCAN_INTERVAL:-2} # 鏀诲嚮鎬 timer 鍛ㄦ湡锛堢锛
  157. BAN_PERIOD=${BAN_PERIOD:-3600}                  # ipset 榛戝悕鍗曡秴鏃讹紙绉掞級

  159. # ----------------------------- ipset 鍚嶇О ---------------------------------
  160. SET_WL_V4="ddos_whitelist_v4"
  161. SET_WL_V6="ddos_whitelist_v6"
  162. SET_BL_V4="ddos_blacklist_v4"
  163. SET_BL_V6="ddos_blacklist_v6"
  164. SET_RL_V4="ddos_ratelimit_v4"
  165. SET_GB_V4="ddos_goodbots_v4"
  166. SET_ADMIN_V4="ddos_admin_v4"
  167. SET_RL_V6="ddos_ratelimit_v6"
  168. SET_GB_V6="ddos_goodbots_v6"

  170. # ----------------------------- 棰滆壊/鐘舵€ ----------------------------------
  171. C_R=$'\033[0;31m'; C_G=$'\033[0;32m'; C_Y=$'\033[0;33m'; C_B=$'\033[0;34m'; C_N=$'\033[0m'
  172. declare -a BANNED_THIS_RUN=()
  173. declare -a LIMITED_THIS_RUN=()

  175. # ----------------------------- 闃堝€肩紦瀛 -----------------------------------
  176. declare -A HT_HOST_WEIGHT HT_REQ_L1 HT_REQ_L2 HT_REQ_L3 HT_SYN_PERIP HT_EST_PERIP
  177. declare -A PT_KIND PT_PAT PT_L1 PT_L2 PT_L3 PT_COUNT
  178. GLOBAL_SYN=${GLOBAL_SYN:-0}; GLOBAL_EST=${GLOBAL_EST:-0}; GLOBAL_CT=${GLOBAL_CT:-0}

  180. # ----------------------------- 鐧藉悕鍗曞彉鏇存娴嬶紙Redis锛 --------------------
  181. WL_REDIS_NS="ddos:wl"               # 鐧藉悕鍗曞懡鍚嶇┖闂
  182. WL_MTIME_SIG_FILE="$RUNDIR/wl.mtime.sig"  # mtime 绛惧悕锛堟湰鍦板揩鐓э級

  184. # ----------------------------- 閫氱敤鍑芥暟 -----------------------------------
  185. log(){ echo "[$($DATE '+%F %T')] [ddos-guard] $*" | tee -a "$LOG_FILE"; }
  186. die(){ echo >&2 "${C_R}Error:${C_N} $*"; exit 1; }
  187. need_root(){ [ "$(id -u)" -eq 0 ] || die "闇€瑕 root 鏉冮檺杩愯銆"; }
  188. have(){ command -v "$1" >/dev/null 2>&1; }

  190. # 閿侊細鎵撳紑 + 闈為樆濉炲皾璇
  191. lock_open(){ exec {LOCK_FD}> "$LOCK_FILE" || die "鏃犳硶鎵撳紑閿佹枃浠讹細$LOCK_FILE"; }
  192. lock_try(){ flock -n "$LOCK_FD"; }            # 鎷夸笉鍒伴攣杩斿洖闈 0
  193. lock_wait(){ flock "$LOCK_FD"; }              # 闃诲绛夊緟

  195. # 鑾峰彇鍏綉 IP (楂樺彲鐢)
  196. get_public_ip(){
  197.   local ip=""
  198.   # 鏂规硶1: 渚濇灏濊瘯澶氫釜鍙潬鐨 HTTP 鏈嶅姟
  199.   # 浣跨敤 --max-time 5 闃叉鎱㈤€熶紶杈撴寕璧
  200.   local http_svcs=("ip.3322.net" "icanhazip.com" "ifconfig.me" "api.ipify.org" "ipinfo.io/ip" "whatismyip.akamai.com")
  201.   if [ -n "$CURL" ]; then
  202.     for svc in "${http_svcs[@]}"; do
  203.       # 浣跨敤 head -n1 纭繚鍙彇绗竴琛岋紝闃叉鏈嶅姟杩斿洖棰濆淇℃伅
  204.       ip=$($CURL -4 -s --connect-timeout 2 --max-time 5 "$svc" | head -n1)
  205.       if is_ipv4 "$ip" || is_ipv6 "$ip"; then
  206.         echo "$ip"
  207.         return 0
  208.       fi
  209.     done
  210.   fi

  212.   # 鏂规硶2: 濡傛灉 HTTP 澶辫触锛岄檷绾у埌 DNS 鏌ヨ (浣跨敤 OpenDNS 鐨勮В鏋愬櫒)
  213.   if [ -n "$HOST" ]; then
  214.     ip=$(host myip.opendns.com resolver1.opendns.com 2>/dev/null | awk '/has address/ {print $NF}')
  215.     if is_ipv4 "$ip"; then # OpenDNS 姝ゆ柟娉曢€氬父鍙繑鍥 IPv4
  216.       echo "$ip"
  217.       return 0
  218.     fi
  219.   fi

  221.   # 濡傛灉鎵€鏈夋柟娉曢兘澶辫触锛岃繑鍥 N/A
  222.   echo "N/A"
  223. }
  224. # ==============================================================================
  225. # 宸ュ叿锛欼P/鍩熷悕鍒ゅ埆涓庤浆鎹
  226. # ==============================================================================
  227. is_ipv4(){ [[ "$1" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] && IFS=. read -r a b c d <<<"$1" && ((a<=255&&b<=255&&c<=255&&d<=255)); }
  228. is_ipv6(){ [[ "$1" == *:* ]]; }
  229. is_cidr4(){ [[ "$1" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$ ]] && IFS='/.' read -r a b c d m <<<"${1//\//.}" && ((a<=255&&b<=255&&c<=255&&d<=255)); }
  230. is_cidr6(){ [[ "$1" =~ :/.+ ]] && [[ "${1##*/}" =~ ^([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8])$ ]]; }
  231. is_ip_or_cidr(){ is_ipv4 "$1" || is_ipv6 "$1" || is_cidr4 "$1" || is_cidr6 "$1"; }

  233. is_private_ip(){
  234.   local ip="$1"
  235.   if have python3; then
  236.     python3 - <<'PY' "$ip" || exit 1
  237. import ipaddress,sys
  238. ip=sys.argv[1]
  239. try:
  240.   o=ipaddress.ip_address(ip)
  241.   print("1" if (o.is_private or o.is_loopback or o.is_link_local or o.is_reserved) else "0")
  242. except: print("0")
  243. PY
  244.   else
  245.     [[ "$ip" =~ ^10\.|^127\.|^169\.254\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[0-1])\. ]] && echo 1 || echo 0
  246.   fi
  247. }

  249. resolve_host_to_ips(){
  250.   local host="$1" out=()
  251.   if have getent; then
  252.     while read -r ip; do out+=("$ip"); done < <(getent ahosts "$host" | awk '{print $1}' | sort -u)
  253.   elif have host; then
  254.     while read -r ip; do out+=("$ip"); done < <(host -W1 "$host" 2>/dev/null | awk '/has address|IPv6 address/ {print $NF}' | sort -u)
  255.   fi
  256.   printf "%s\n" "${out[@]}" | sort -u
  257. }

  259. guess_host_from_file(){
  260.   local file="$1" k
  261.   for k in "${!LOG_HOST_MAP[@]}"; do [[ "$file" =~ $k ]] && { echo "${LOG_HOST_MAP[$k]}"; return 0; }; done
  262.   echo "default"
  263. }

  265. ipset_members(){ $IPSET list "$1" 2>/dev/null | awk '/^Members:/ {flag=1; next} flag && NF {print $1}'; }

  267. # BTWAF IPv4 鏁村舰/鍖洪棿 鈫 CIDR/鍗 IP
  268. parse_btwaf_ipv4_json(){
  269.   local json="$1"; [ -f "$json" ] || return 0
  270.   [ -n "$PY3" ] || { log "璺宠繃 BTWAF IPv4锛氭湭瀹夎 python3"; return 0; }
  271.   python3 - "$json" <<'PY' || exit 1
  272. import sys,json,ipaddress
  273. from math import log2, floor
  274. def range_to_cidrs(a,b):
  275.     res=[]; cur=a
  276.     while cur<=b:
  277.         max_size = 32 - int(floor(log2((cur & -cur))))
  278.         max_allowed = 32 - int(floor(log2(b - cur + 1)))
  279.         mask = max(max_size, max_allowed)
  280.         res.append(f"{str(ipaddress.IPv4Address(cur))}/{mask}")
  281.         cur += (1 << (32-mask))
  282.     return res
  283. p=sys.argv[1]
  284. data=json.load(open(p,'r',encoding='utf-8'))
  285. out=[]
  286. for it in data:
  287.     if isinstance(it,list) and len(it)==2:
  288.         a,b=int(it[0]),int(it[1])
  289.         if a==b: out.append(str(ipaddress.IPv4Address(a)))
  290.         else:    out.extend(range_to_cidrs(a,b))
  291.     elif isinstance(it,int):
  292.         out.append(str(ipaddress.IPv4Address(it)))
  293. for line in out: print(line)
  294. PY
  295. }

  297. # BTWAF IPv6 鐩存帴璇诲彇锛堝瓧绗︿覆鎴栦竴缁 list锛
  298. parse_btwaf_ipv6_json(){
  299.   local json="$1"; [ -f "$json" ] || return 0
  300.   [ -n "$PY3" ] || { log "璺宠繃 BTWAF IPv6锛氭湭瀹夎 python3"; return 0; }
  301.   python3 - "$json" <<'PY' || exit 1
  302. import sys,json
  303. data=json.load(open(sys.argv[1],'r',encoding='utf-8'))
  304. for it in data:
  305.     if isinstance(it,list) and it:
  306.         s=str(it[0]).strip()
  307.         if s: print(s)
  308.     elif isinstance(it,str):
  309.         s=it.strip()
  310.         if s: print(s)
  311. PY
  312. }

  314. # 鏈€杩 UA 鑾峰彇 + 鐪熷亣铚樿洓鏍￠獙
  315. recent_ua_by_ip(){
  316.   local ip="$1" n="${2:-2000}" f ua
  317.   for f in "${CC_LOG_PATHS[@]}"; do
  318.     [ -f "$f" ] || continue
  319.     ua=$($TAIL -n "$n" "$f" | $GREP -F " $ip " | awk -F" '{print $(NF-1)}' | tail -n 1)
  320.     [ -n "$ua" ] && { echo "$ua"; return 0; }
  321.   done
  322.   echo ""
  323. }
  324. rdns_ptr(){ [ -n "$HOST" ] || { echo ""; return; }; host -W1 "$1" 2>/dev/null | awk '/pointer/ {gsub(/\.$/,"",$NF); print $NF; exit}'; }
  325. forward_confirms(){ local n="$1" ip="$2"; [ -z "$n" ] && { echo 0; return; }; local ips; ips=$(resolve_host_to_ips "$n" | tr '\n' ' '); [[ " $ips " == *" $ip "* ]] && echo 1 || echo 0; }
  326. good_bot_key_from_ua(){ local ua="$1" k; for k in "${!GOOD_BOT_RDNS_SUFFIX[@]}"; do echo "$ua" | $GREP -Eiq -- "$k" && { echo "$k"; return; }; done; echo ""; }
  327. classify_ua_for_ip(){
  328.   local ip="$1"; local ua; ua="$(recent_ua_by_ip "$ip")"
  329.   [ -z "$ua" ] && { echo "OTHER"; return; }
  330.   if echo "$ua" | $GREP -Eiq -- "$GOOD_BOT_PATTERN"; then
  331.     local key; key=$(good_bot_key_from_ua "$ua")
  332.     if [ -n "$key" ]; then
  333.       local ptr; ptr="$(rdns_ptr "$ip")"
  334.       if [ -n "$ptr" ] && echo "$ptr" | $GREP -Eiq -- "${GOOD_BOT_RDNS_SUFFIX[$key]}"; then
  335.         [ "$(forward_confirms "$ptr" "$ip")" = "1" ] && echo "GOOD" || echo "FAKEGOOD"
  336.       else echo "FAKEGOOD"; fi
  337.       return
  338.     fi
  339.   fi
  340.   echo "$ua" | $GREP -Eiq -- "$SEMI_TRUST_BOTS" && { echo "SEMI"; return; }
  341.   echo "$ua" | $GREP -Eiq -- "$BAD_BOT_PATTERN" && { echo "BAD"; return; }
  342.   echo "OTHER"
  343. }

  345. # ==============================================================================
  346. # ipset/iptables 鍒濆鍖
  347. # ==============================================================================
  348. ensure_ipset_and_iptables(){
  349.   have ipset || die "缂哄皯 ipset"
  350.   have iptables || die "缂哄皯 iptables"

  352.   $IPSET create "$SET_WL_V4" hash:net -exist maxelem 524288
  353.   $IPSET create "$SET_WL_V6" hash:net -exist family inet6 maxelem 262144
  354.   $IPSET create "$SET_BL_V4" hash:ip  -exist maxelem 1048576 timeout "$BAN_PERIOD"
  355.   $IPSET create "$SET_BL_V6" hash:ip  -exist family inet6 maxelem 524288 timeout "$BAN_PERIOD"
  356.   $IPSET create "$SET_RL_V4" hash:ip  -exist maxelem 524288 timeout "$BAN_PERIOD"
  357.   $IPSET create "$SET_GB_V4" hash:ip  -exist maxelem 131072
  358.   $IPSET create "$SET_ADMIN_V4" hash:ip  -exist maxelem 1024 timeout 3600
  359.   $IPSET create "$SET_RL_V6" hash:ip  -exist family inet6 maxelem 524288 timeout "$BAN_PERIOD"
  360.   $IPSET create "$SET_GB_V6" hash:ip  -exist family inet6 maxelem 131072

  362.   $IPT -C INPUT -m set --match-set "$SET_WL_V4" src -j ACCEPT 2>/dev/null || $IPT -I INPUT -m set --match-set "$SET_WL_V4" src -j ACCEPT
  363.   $IPT -C INPUT -m set --match-set "$SET_BL_V4" src -j DROP    2>/dev/null || $IPT -I INPUT -m set --match-set "$SET_BL_V4" src -j DROP
  364.   $IPT -C INPUT -m set --match-set "$SET_RL_V4" src -j DROP    2>/dev/null || $IPT -I INPUT -m set --match-set "$SET_RL_V4" src -j DROP

  366.   if have ip6tables; then
  367.     $IP6T -C INPUT -m set --match-set "$SET_WL_V6" src -j ACCEPT 2>/dev/null || $IP6T -I INPUT -m set --match-set "$SET_WL_V6" src -j ACCEPT
  368.     $IP6T -C INPUT -m set --match-set "$SET_BL_V6" src -j DROP 2>/dev/null || $IP6T -I INPUT -m set --match-set "$SET_BL_V6" src -j DROP
  369.   fi
  370. }

  372. # ==============================================================================
  373. # BTWAF 璺緞鎺㈡祴
  374. # ==============================================================================
  375. autodetect_btwaf_paths(){
  376.   if [ ! -r "$BTWAF_IP_WHITE" ] || [ ! -s "$BTWAF_IP_WHITE" ]; then
  377.     local alt="/www/server/panel/plugin/btwaf/rule/ip_white.json"; [ -r "$alt" ] && BTWAF_IP_WHITE="$alt"
  378.   fi
  379.   if [ ! -r "$BTWAF_IP_WHITE_V6" ] || [ ! -s "$BTWAF_IP_WHITE_V6" ]; then
  380.     local alt6="/www/server/panel/plugin/btwaf/rule/ip_white_v6.json"; [ -r "$alt6" ] && BTWAF_IP_WHITE_V6="$alt6"
  381.   fi
  382. }

  384. # ==============================================================================
  385. # systemd timer 闂撮殧鍦ㄧ嚎璋冩暣
  386. # ==============================================================================
  387. timer_unit="/etc/systemd/system/ddos-guard.timer"
  388. get_current_interval(){ awk -F= '/^OnUnitActiveSec=/{print $2}' "$timer_unit" 2>/dev/null | tail -n1; }
  389. set_timer_interval(){
  390.   local new="$1"
  391.   [ -f "$timer_unit" ] || return 0
  392.   sed -i "s/^OnUnitActiveSec=.*/OnUnitActiveSec=${new}s/" "$timer_unit"
  393.   systemctl daemon-reload
  394.   systemctl try-restart ddos-guard.timer >/dev/null 2>&1 || systemctl restart ddos-guard.timer >/dev/null 2>&1
  395.   echo "$new" > "$RUNDIR/scan-interval.current" || true
  396. }
  397. attack_state_file="$RUNDIR/attack.state" # 鍐呭锛0/1

  399. # ==============================================================================
  400. # 鐧藉悕鍗曡仛鍚/鍔犺浇 + 鍙樻洿妫€娴/鑷剤 + mtime 鍒ゅ畾鍛婅
  401. # ==============================================================================
  402. WL_SNAPSHOT_V4="$RUNDIR/wl.v4.txt"
  403. WL_SNAPSHOT_V6="$RUNDIR/wl.v6.txt"

  405. file_mtime(){ [ -f "$1" ] && $STAT -c %Y "$1" 2>/dev/null || echo 0; }
  406. compute_wl_mtime_sig(){
  407.   autodetect_btwaf_paths
  408.   local m1 m2 m3 m4
  409.   m1=$(file_mtime "$IGNORE_IP_FILE");    m2=$(file_mtime "$IGNORE_HOST_FILE")
  410.   m3=$(file_mtime "$BTWAF_IP_WHITE");    m4=$(file_mtime "$BTWAF_IP_WHITE_V6")
  411.   echo "${m1}-${m2}-${m3}-${m4}"
  412. }

  414. redis_set(){ [ -n "$REDIS_CLI" ] && $REDIS_CLI SETEX "$1" 86400 "$2" >/dev/null 2>&1 || true; }
  415. redis_get(){ [ -n "$REDIS_CLI" ] && $REDIS_CLI GET "$1" 2>/dev/null || echo ""; }

  417. escape_json(){ echo -n "$1" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read())[1:-1])'; }
  418. should_throttle(){
  419.   local tag="$1"; local tsf="$ALERT_TS_DIR/${tag}.ts"; local now; now=$(date +%s)
  420.   if [ -f "$tsf" ]; then local last; last=$(cat "$tsf" 2>/dev/null || echo 0); (( now - last < DINGTALK_THROTTLE_SEC )) && return 0; fi
  421.   echo "$now" > "$tsf"; return 1
  422. }
  423. alert_markdown(){
  424.   [ -n "$DINGTALK_WEBHOOK" ] || return 0
  425.   local tag="$1" title="$2" text="$3"
  426.   if should_throttle "$tag"; then return 0; fi
  427.   local payload
  428.   payload=$(cat <<JSON
  429. {"msgtype":"markdown","markdown":{"title":"${title}","text":"$(escape_json "$text")"}}
  430. JSON
  431. )
  432.   $CURL -s -H 'Content-Type: application/json' -X POST -d "$payload" "$DINGTALK_WEBHOOK" >/dev/null 2>&1 || true
  433. }

  435. load_whitelist(){
  436.   set +e
  437.   ensure_ipset_and_iptables
  438.   autodetect_btwaf_paths

  440.   log "寮€濮嬮噸杞界櫧鍚嶅崟锛圔TWAF + ignore.ip + ignore.host锛 ..."
  441.   log "BTWAF IPv4锛$BTWAF_IP_WHITE"
  442.   log "BTWAF IPv6锛$BTWAF_IP_WHITE_V6"

  444.   local tmp4="$TMPDIR/wl4.txt"; local tmp6="$TMPDIR/wl6.txt"
  445.   : > "$tmp4"; : > "$tmp6"

  447.   local cnt_src_ignore_ip4=0 cnt_src_ignore_ip6=0
  448.   local cnt_src_ignore_host_in=0 cnt_src_ignore_host_ok4=0 cnt_src_ignore_host_ok6=0
  449.   local cnt_src_btwaf4=0 cnt_src_btwaf6=0

  451.   # 1) ignore.ip.list锛氳В鏋愬苟鍖哄垎 v4/v6
  452.   if [ -r "$IGNORE_IP_FILE" ]; then
  453.     while IFS= read -r raw; do
  454.       line="${raw%%#*}"; line="${line//$'\r'/}"; line="$(echo "$line" | xargs || true)"
  455.       [ -n "$line" ] || continue
  456.       fam=""
  457.       if [ -n "$PY3" ]; then
  458.         fam="$(
  459. python3 - <<'PY' "$line" 2>/dev/null || true
  460. import sys, ipaddress
  461. s=sys.argv[1]
  462. try:
  463.   n=ipaddress.ip_network(s, strict=False); print(6 if n.version==6 else 4)
  464. except:
  465.   try:
  466.     a=ipaddress.ip_address(s); print(6 if a.version==6 else 4)
  467.   except:
  468.     pass
  469. PY
  470.         )"
  471.       fi
  472.       if [ "$fam" = "6" ]; then echo "$line" >> "$tmp6"; ((cnt_src_ignore_ip6++))
  473.       elif [ "$fam" = "4" ]; then echo "$line" >> "$tmp4"; ((cnt_src_ignore_ip4++))
  474.       else
  475.         if is_cidr6 "$line" || is_ipv6 "$line"; then echo "$line" >> "$tmp6"; ((cnt_src_ignore_ip6++))
  476.         elif is_cidr4 "$line" || is_ipv4 "$line"; then echo "$line" >> "$tmp4"; ((cnt_src_ignore_ip4++))
  477.         else log "蹇界暐闈炴硶鐧藉悕鍗曡锛$line"
  478.         fi
  479.       fi
  480.     done < "$IGNORE_IP_FILE"
  481.   fi
  482.   log "ignore.ip.list 璇诲叆锛欼Pv4=$cnt_src_ignore_ip4 IPv6=$cnt_src_ignore_ip6"

  484.   # 2) ignore.host.list锛氳В鏋 A/AAAA
  485.   if [ -r "$IGNORE_HOST_FILE" ]; then
  486.     while IFS= read -r rawh; do
  487.       h="${rawh%%#*}"; h="${h//$'\r'/}"; h="$(echo "$h" | xargs || true)"
  488.       [ -n "$h" ] || continue
  489.       ((cnt_src_ignore_host_in++))
  490.       while read -r ip; do
  491.         [ -z "$ip" ] && continue
  492.         if is_ipv6 "$ip"; then echo "$ip" >> "$tmp6"; ((cnt_src_ignore_host_ok6++))
  493.         else echo "$ip" >> "$tmp4"; ((cnt_src_ignore_host_ok4++))
  494.         fi
  495.       done < <(resolve_host_to_ips "$h")
  496.     done < "$IGNORE_HOST_FILE"
  497.   fi
  498.   log "ignore.host.list 鍩熷悕鏉＄洰=$cnt_src_ignore_host_in 鈫 瑙ｆ瀽鎴愬姛 IPv4=$cnt_src_ignore_host_ok4 IPv6=$cnt_src_ignore_host_ok6"

  500.   # 3) BTWAF IPv4
  501.   if [ -r "$BTWAF_IP_WHITE" ] && [ -n "$PY3" ]; then
  502.     local before=$(wc -l < "$tmp4" 2>/dev/null || echo 0)
  503.     parse_btwaf_ipv4_json "$BTWAF_IP_WHITE" >> "$tmp4"
  504.     local after=$(wc -l < "$tmp4" 2>/dev/null || echo 0)
  505.     cnt_src_btwaf4=$(( after - before ))
  506.   fi
  507.   # 4) BTWAF IPv6
  508.   if [ -r "$BTWAF_IP_WHITE_V6" ] && [ -n "$PY3" ]; then
  509.     local before6=$(wc -l < "$tmp6" 2>/dev/null || echo 0)
  510.     parse_btwaf_ipv6_json "$BTWAF_IP_WHITE_V6" >> "$tmp6"
  511.     local after6=$(wc -l < "$tmp6" 2>/dev/null || echo 0)
  512.     cnt_src_btwaf6=$(( after6 - before6 ))
  513.   fi

  515.   # 5) 鍘婚噸 + 鏍￠獙
  516.   sort -u "$tmp4" -o "$tmp4"; sort -u "$tmp6" -o "$tmp6"
  517.   local tmp4v="$TMPDIR/wl4.valid"; local tmp6v="$TMPDIR/wl6.valid"
  518.   : > "$tmp4v"; : > "$tmp6v"
  519.   local v4=0 v6=0
  520.   while read -r x; do is_ip_or_cidr "$x" && { echo "$x"; ((v4++)); }; done < "$tmp4" > "$tmp4v"
  521.   while read -r x; do is_ip_or_cidr "$x" && { echo "$x"; ((v6++)); }; done < "$tmp6" > "$tmp6v"

  523.   log "鑱氬悎璁℃暟锛歩gnore.ip 鈫 v4=$cnt_src_ignore_ip4 v6=$cnt_src_ignore_ip6锛沬gnore.host 鎴愬姛 鈫 v4=$cnt_src_ignore_host_ok4 v6=$cnt_src_ignore_host_ok6锛汢TWAF 鈫 v4=$cnt_src_btwaf4 v6=$cnt_src_btwaf6锛涙牎楠岄€氳繃 鈫 v4=$v4 v6=$v6"

  525.   # 6) 鎵归噺娉ㄥ叆 ipset
  526.   {
  527.     echo "flush $SET_WL_V4"
  528.     while read -r net; do [ -n "$net" ] && echo "add $SET_WL_V4 $net"; done < "$tmp4v"
  529.     echo "flush $SET_WL_V6"
  530.     while read -r net; do [ -n "$net" ] && echo "add $SET_WL_V6 $net"; done < "$tmp6v"
  531.   } | $IPSET restore -exist >/dev/null 2>&1 || log "WARN: ipset restore 杩斿洖闈為浂锛堝凡蹇界暐锛"

  533.   # 7) 淇濆瓨蹇収
  534.   ipset_members "$SET_WL_V4" > "$WL_SNAPSHOT_V4" || true
  535.   ipset_members "$SET_WL_V6" > "$WL_SNAPSHOT_V6" || true
  536.   local final4=$(wc -l < "$WL_SNAPSHOT_V4" 2>/dev/null || echo 0)
  537.   local final6=$(wc -l < "$WL_SNAPSHOT_V6" 2>/dev/null || echo 0)

  539.   # 7.1 璁板綍鏈夋晥鑱氬悎鍝堝笇锛堜粎鐢ㄤ簬鑷剤鍒ゅ畾锛屼笉瑙﹀彂鍛婅锛
  540.   local h4="" h6=""
  541.   if [ -n "$SHA1" ]; then
  542.     h4=$(cat "$tmp4v" 2>/dev/null | $SHA1 | awk '{print $1}')
  543.     h6=$(cat "$tmp6v" 2>/dev/null | $SHA1 | awk '{print $1}')
  544.   else
  545.     h4="$(wc -l < "$tmp4v" 2>/dev/null)-$(head -n1 "$tmp4v" 2>/dev/null)"
  546.     h6="$(wc -l < "$tmp6v" 2>/dev/null)-$(head -n1 "$tmp6v" 2>/dev/null)"
  547.   fi
  548.   local p4="$(redis_get "$WL_REDIS_NS:hash:v4")"
  549.   local p6="$(redis_get "$WL_REDIS_NS:hash:v6")"
  550.   local src_stat="ignore.v4=$cnt_src_ignore_ip4 ignore.v6=$cnt_src_ignore_ip6 host.v4=$cnt_src_ignore_host_ok4 host.v6=$cnt_src_ignore_host_ok6 btwaf.v4=$cnt_src_btwaf4 btwaf.v6=$cnt_src_btwaf6 valid.v4=$v4 valid.v6=$v6"
  551.   redis_set "$WL_REDIS_NS:hash:v4" "$h4"
  552.   redis_set "$WL_REDIS_NS:hash:v6" "$h6"
  553.   redis_set "$WL_REDIS_NS:srcstat" "$src_stat"
  554.   echo "$src_stat" > "$RUNDIR/wl.srcstat" || true

  556.   # 7.2 鍙樻洿 鈫 鑷剤锛堟棤鎺ㄩ€侊級
  557.   if [ "$h4" != "$p4" ] || [ "$h6" != "$p6" ]; then
  558.     reconcile_unban_whitelisted
  559.   fi

  561.   # 7.3 鏉ユ簮鏂囦欢 mtime 鍙樺寲鎵嶆帹閫
  562.   local cur_msig; cur_msig="$(compute_wl_mtime_sig)"
  563.   local prev_msig=""
  564.   [ -f "$WL_MTIME_SIG_FILE" ] && prev_msig="$(cat "$WL_MTIME_SIG_FILE" 2>/dev/null || echo "")"
  565.   echo "$cur_msig" > "$WL_MTIME_SIG_FILE"

  567.   if [ "${WL_ALERT_BY_MTIME_ONLY}" = true ]; then
  568.     if [ "$cur_msig" != "$prev_msig" ]; then
  569.       local unb="$(cat "$RUNDIR/last_unban_wl.count" 2>/dev/null || echo 0)"
  570.       local wl_text="### 馃Ь 鐧藉悕鍗曟洿鏂帮紙鏉ユ簮鏂囦欢鍙樻洿锛
  571. - **鏃堕棿**锛$($DATE '+%F %T')
  572. - **鏉ユ簮缁熻**锛$src_stat
  573. - **褰撳墠蹇収**锛欼Pv4=${final4} 鏉★紝IPv6=${final6} 鏉
  574. - **鏈疆鑷剤瑙ｅ皝**锛${unb} 涓"
  575.       alert_markdown "wl-change" "鐧藉悕鍗曟洿鏂" "$wl_text"
  576.     fi
  577.   else
  578.     # 涓嶄粎鎸 mtime锛屽搱甯屽彉鍖栦篃鎺ㄩ€侊紙鍙€夛級
  579.     if [ "$h4" != "$p4" ] || [ "$h6" != "$p6" ]; then
  580.       local unb="$(cat "$RUNDIR/last_unban_wl.count" 2>/dev/null || echo 0)"
  581.       local wl_text="### 馃Ь 鐧藉悕鍗曟洿鏂帮紙鑱氬悎鍐呭鍙樺寲锛
  582. - **鏃堕棿**锛$($DATE '+%F %T')
  583. - **鏉ユ簮缁熻**锛$src_stat
  584. - **褰撳墠蹇収**锛欼Pv4=${final4} 鏉★紝IPv6=${final6} 鏉
  585. - **鏈疆鑷剤瑙ｅ皝**锛${unb} 涓"
  586.       alert_markdown "wl-change" "鐧藉悕鍗曟洿鏂" "$wl_text"
  587.     fi
  588.   fi

  590.   log "鐧藉悕鍗曢噸杞藉畬鎴愶細IPv4 $final4 鏉★紝IPv6 $final6 鏉°€"
  591.   set -e
  592. }

  594. show_whitelist(){
  595.   ensure_ipset_and_iptables
  596.   echo "=== IPv4 whitelist ($SET_WL_V4) ==="; ipset_members "$SET_WL_V4" | head -n 200
  597.   echo "=== IPv6 whitelist ($SET_WL_V6) ==="; ipset_members "$SET_WL_V6" | head -n 200
  598.   echo "(浠呭睍绀哄墠 200 鏉★紱瀹屾暣璇蜂娇鐢細ipset list $SET_WL_V4 / $SET_WL_V6)"
  599. }

  601. is_in_whitelist_snapshot(){
  602.   local ip="$1"
  603.   if is_ipv6 "$ip"; then
  604.     grep -Fxq -- "$ip" "$WL_SNAPSHOT_V6" 2>/dev/null && return 0
  605.   else
  606.     $IPSET test "$SET_WL_V4" "$ip" >/dev/null 2>&1 && return 0
  607.     grep -Fxq -- "$ip" "$WL_SNAPSHOT_V4" 2>/dev/null && return 0
  608.   fi
  609.   return 1
  610. }

  612. reconcile_unban_whitelisted(){
  613.   local tmp="$TMPDIR/reconcile.$$" cnt=0
  614.   ipset_members "$SET_BL_V4" > "$tmp" || true
  615.   while read -r ip; do
  616.     [ -n "$ip" ] || continue
  617.     if is_in_whitelist_snapshot "$ip"; then
  618.       unban_ip "$ip" "auto-unban-wl" && ((cnt++))
  619.     fi
  620.   done < "$tmp"
  621.   if have ip6tables; then
  622.     ipset_members "$SET_BL_V6" > "$tmp" || true
  623.     while read -r ip; do
  624.       [ -n "$ip" ] || continue
  625.       if is_in_whitelist_snapshot "$ip"; then
  626.         unban_ip "$ip" "auto-unban-wl" && ((cnt++))
  627.       fi
  628.     done < "$tmp"
  629.   fi
  630.   echo "$cnt" > "$RUNDIR/last_unban_wl.count"
  631. }

  633. # ==============================================================================
  634. # L4 瀹炴椂鎺掕锛堜慨澶嶇増锛
  635. # ==============================================================================
  636. extract_peer_ip_awk='
  637. function peerip(s,    x){
  638.   # [2001:db8::1]:443 / 1.2.3.4:54321 / 2001:db8::1
  639.   if (s ~ /^\[/) { gsub(/^\[/,"",s); sub(/\].*$/,"",s); return s; }
  640.   sub(/:[0-9]+$/,"",s);
  641.   return s;
  642. }
  643. { ip=peerip($NF); if (ip!="" && ip!="-") print ip; }
  644. '
  645. top_talkers_l4(){
  646.   have ss || die "缂哄皯 ss"
  647.   local est syn
  648.   est=$($SS -Hnta state established 2>/dev/null | awk "$extract_peer_ip_awk" | sort | uniq -c | sort -nr | head -n 20)
  649.   syn=$($SS -Hnta state syn-recv    2>/dev/null | awk "$extract_peer_ip_awk" | sort | uniq -c | sort -nr | head -n 20)
  650.   echo "---- Top EST ----"; [ -n "$est" ] && echo "$est" || echo "(鏃犳椿鍔ㄨ繛鎺)"
  651.   echo "---- Top SYN_RECV ----"; [ -n "$syn" ] && echo "$syn" || echo "(鏃犳椿鍔ㄨ繛鎺)"
  652. }

  654. should_attack_mode(){
  655.   local ct_count=0; have conntrack && ct_count=$(conntrack -C 2>/dev/null || echo 0)
  656.   local syn_total est_total
  657.   syn_total=$($SS -Hnta state syn-recv    | awk '{c++} END{print c+0}')
  658.   est_total=$($SS -Hnta state established | awk '{c++} END{print c+0}')

  660.   local result=0
  661.   if (( ct_count > NO_OF_CT || syn_total > NO_OF_SYN || est_total > NO_OF_EST )); then
  662.     result=1
  663.   fi

  665.   # 绗竴琛岃緭鍑虹粨鏋 1 鎴 0
  666.   echo "$result"
  667.   # 鍚庣画琛岃緭鍑鸿缁嗙殑鎸囨爣锛岀敤浜庡憡璀
  668.   echo "Conntrack: ${ct_count} / ${NO_OF_CT}"
  669.   echo "SYN Total: ${syn_total} / ${NO_OF_SYN}"
  670.   echo "EST Total: ${est_total} / ${NO_OF_EST}"
  671. }

  673. # ==============================================================================
  674. # Host/Path 闃堝€硷紙澶栭儴 JSON 浼樺厛锛涘惁鍒欏唴缃 Discuz PATH_TIERS锛
  675. # ==============================================================================
  676. DEFAULT_THRESHOLDS_JSON='{
  677.   "GLOBAL": { "SYN_GLOBAL_THRESHOLD": 180, "EST_GLOBAL_THRESHOLD": 260, "CONNTRACK_GLOBAL_THRESHOLD": 15000 },
  678.   "*": {
  679.     "HOST_WEIGHT": 2.0, "REQ_PER_MIN_L1": 160, "REQ_PER_MIN_L2": 300, "REQ_PER_MIN_L3": 600,
  680.     "CONN_PER_IP_SYN_THRESHOLD": 68, "CONN_PER_IP_EST_THRESHOLD": 120,
  681.     "PATH_TIERS": [
  682.       { "kind": "prefix", "pattern": "/forum.php?mod=image",            "L1": 10, "L2": 20,  "L3": 40  },
  683.       { "kind": "regex",  "pattern": "^/plugin\\.php\\?id=aljol(&|$)",  "L1":  6, "L2": 12,  "L3": 24  },
  684.       { "kind": "regex",  "pattern": "^/ajax\\.php(\\?|$)",             "L1":  8, "L2": 16,  "L3": 32  },
  685.       { "kind": "regex",  "pattern": "^/avatar\\.php(\\?|$)",             "L1":  8, "L2": 16,  "L3": 32  },
  686.       { "kind": "regex",  "pattern": "^/misc\\.php\\?mod=seccode(&|$)","L1":  4, "L2":  8,  "L3": 16  },
  687.       { "kind": "regex",  "pattern": "^/search\\.php(\\?|$)",           "L1":  8, "L2": 16,  "L3": 32  },
  688.       { "kind": "prefix", "pattern": "/data/attachment/",                "L1": 30, "L2": 60,  "L3": 120 },
  689.       { "kind": "prefix", "pattern": "/static/",                         "L1": 40, "L2": 80,  "L3": 160 }
  690.     ]
  691.   },
  692.   "浣犵殑鍩熷悕1": { "HOST_WEIGHT": 2.0, "REQ_PER_MIN_L1": 160, "REQ_PER_MIN_L2": 300, "REQ_PER_MIN_L3": 600, "CONN_PER_IP_SYN_THRESHOLD": 68, "CONN_PER_IP_EST_THRESHOLD": 120 },
  693.   "浣犵殑鍩熷悕2": { "HOST_WEIGHT": 2.0, "REQ_PER_MIN_L1": 160, "REQ_PER_MIN_L2": 300, "REQ_PER_MIN_L3": 600, "CONN_PER_IP_SYN_THRESHOLD": 68, "CONN_PER_IP_EST_THRESHOLD": 120 },
  694.   "浣犵殑鍩熷悕3": { "HOST_WEIGHT": 2.0, "REQ_PER_MIN_L1": 160, "REQ_PER_MIN_L2": 300, "REQ_PER_MIN_L3": 600, "CONN_PER_IP_SYN_THRESHOLD": 68, "CONN_PER_IP_EST_THRESHOLD": 120 },
  695.   "浣犵殑鍩熷悕4": { "HOST_WEIGHT": 2.0, "REQ_PER_MIN_L1": 160, "REQ_PER_MIN_L2": 300, "REQ_PER_MIN_L3": 600, "CONN_PER_IP_SYN_THRESHOLD": 68, "CONN_PER_IP_EST_THRESHOLD": 120 },
  696.   "浣犵殑鍩熷悕5": { "HOST_WEIGHT": 2.0, "REQ_PER_MIN_L1": 160, "REQ_PER_MIN_L2": 300, "REQ_PER_MIN_L3": 600, "CONN_PER_IP_SYN_THRESHOLD": 68, "CONN_PER_IP_EST_THRESHOLD": 120 }
  697. }'

  699. load_host_thresholds(){
  700.   local src="$THRESHOLDS_JSON" json
  701.   if [ -s "$src" ]; then json="$(cat "$src")"; log "宸插姞杞藉閮 host-thresholds.json锛$src"
  702.   else json="$DEFAULT_THRESHOLDS_JSON"; log "浣跨敤鑴氭湰鍐呯疆榛樿闃堝€硷紙鍥哄寲閰嶇疆 + Discuz PATH_TIERS锛"; fi
  703.   [ -n "$PY3" ] || { log "鏈娴嬪埌 python3锛屾棤娉曡В鏋 host/path 闃堝€ JSON"; return 0; }

  705.   local out
  706.   out="$(python3 - <<'PY' "$json" || exit 1
  707. import sys,json
  708. cfg=json.loads(sys.argv[1])

  710. # 澧炲己鐨 g() 鍑芥暟锛屽彲浠ユ鏌ュ鐢ㄩ敭鍚
  711. def g(k, d=0, alt_k=None):
  712.     glob = cfg.get("GLOBAL", {})
  713.     v = glob.get(k)
  714.     if v is None and alt_k:
  715.         v = glob.get(alt_k)
  716.     return v if isinstance(v, (int, float)) else d

  718. # 鍏煎 GLOBAL 鍖哄煙鐨勬柊鏃т袱绉嶉敭鍚
  719. print("GLOBAL_SYN=%s" % g("SYN_GLOBAL_THRESHOLD", 0, alt_k="NO_OF_SYN"))
  720. print("GLOBAL_EST=%s" % g("EST_GLOBAL_THRESHOLD", 0, alt_k="NO_OF_EST"))
  721. print("GLOBAL_CT=%s" % g("CONNTRACK_GLOBAL_THRESHOLD", 0, alt_k="NO_OF_CONNTRACK"))

  723. for host,val in cfg.items():
  724.   if host=="GLOBAL" or not isinstance(val,dict): continue
  725.   
  726.   # 鍏煎宓屽鐨 REQ_PER_MIN 瀵硅薄鍜岀嫭绔嬬殑 REQ_PER_MIN_L1/L2/L3 閿
  727.   req_min_obj = val.get("REQ_PER_MIN", {})
  728.   hw = val.get("HOST_WEIGHT",1.0)
  729.   l1 = val.get("REQ_PER_MIN_L1") or req_min_obj.get("L1") or 0
  730.   l2 = val.get("REQ_PER_MIN_L2") or req_min_obj.get("L2") or 0
  731.   l3 = val.get("REQ_PER_MIN_L3") or req_min_obj.get("L3") or 0
  732.   
  733.   # 鍏煎 SYN_PER_IP 鍜 EST_PER_IP 閿悕
  734.   syn = val.get("CONN_PER_IP_SYN_THRESHOLD") or val.get("SYN_PER_IP") or 0
  735.   est = val.get("CONN_PER_IP_EST_THRESHOLD") or val.get("EST_PER_IP") or 0
  736.   
  737.   print("H|%s|%s|%s|%s|%s|%s"%(host,hw,l1,l2,l3,syn or 0)); print("E|%s|%s"%(host,est or 0))
  738.   
  739.   pts=val.get("PATH_TIERS",[])
  740.   if isinstance(pts,list):
  741.     for i,r in enumerate(pts):
  742.       # 鍏煎 KIND/PAT (澶у啓) 鍜 kind/pattern (灏忓啓)
  743.       kind_val = r.get("kind") or r.get("KIND") or "regex"
  744.       kind = str(kind_val).lower()
  745.       pat = str(r.get("pattern") or r.get("PAT") or "").strip()
  746.       
  747.       L1=int(r.get("L1",0) or 0); L2=int(r.get("L2",0) or 0); L3=int(r.get("L3",0) or 0)
  748.       if not pat: continue
  749.       if kind not in ("regex","prefix"): kind="regex"
  750.       print("P|%s|%d|%s|%s|%d|%d|%d"%(host,i,kind,pat.replace("|","\\|"),L1,L2,L3))
  751.   print("PCNT|%s|%d"%(host,len(pts)))
  752. PY
  753. )"
  754.   HT_HOST_WEIGHT=(); HT_REQ_L1=(); HT_REQ_L2=(); HT_REQ_L3=(); HT_SYN_PERIP=(); HT_EST_PERIP=()
  755.   PT_KIND=(); PT_PAT=(); PT_L1=(); PT_L2=(); PT_L3=(); PT_COUNT=()

  757.   while IFS= read -r line; do
  758.     case "$line" in
  759.       GLOBAL_SYN=*) GLOBAL_SYN="${line#GLOBAL_SYN=}" ;;
  760.       GLOBAL_EST=*) GLOBAL_EST="${line#GLOBAL_EST=}" ;;
  761.       GLOBAL_CT=*)  GLOBAL_CT="${line#GLOBAL_CT=}" ;;
  762.       H|* ) IFS='|' read -r _ h w l1 l2 l3 syn <<<"$line"; HT_HOST_WEIGHT["$h"]="$w"; HT_REQ_L1["$h"]="$l1"; HT_REQ_L2["$h"]="$l2"; HT_REQ_L3["$h"]="$l3"; HT_SYN_PERIP["$h"]="$syn" ;;
  763.       E|* ) IFS='|' read -r _ h est <<<"$line"; HT_EST_PERIP["$h"]="$est" ;;
  764.       P|* ) IFS='|' read -r _ h idx kind pat L1 L2 L3 <<<"$line"; key="${h}|${idx}"; PT_KIND["$key"]="$kind"; PT_PAT["$key"]="$pat"; PT_L1["$key"]="$L1"; PT_L2["$key"]="$L2"; PT_L3["$key"]="$L3" ;;
  765.       PCNT|* ) IFS='|' read -r _ h pc <<<"$line"; PT_COUNT["$h"]="$pc" ;;
  766.     esac
  767.   done <<< "$out"

  769.   # GLOBAL 瑕嗙洊鍏滃簳
  770.   [ "$GLOBAL_SYN" -gt 0 ] && NO_OF_SYN="$GLOBAL_SYN"
  771.   [ "$GLOBAL_EST" -gt 0 ] && NO_OF_EST="$GLOBAL_EST"
  772.   [ "$GLOBAL_CT"  -gt 0 ] && NO_OF_CT="$GLOBAL_CT"
  773.   log "闃堝€艰杞斤細GLOBAL SYN=$NO_OF_SYN EST=$NO_OF_EST CT=$NO_OF_CT锛涚珯鐐规暟=$(printf %s "${!HT_HOST_WEIGHT[@]}" | wc -w)"
  774. }

  776. # ==============================================================================
  777. # Redis 鏃ュ織娓告爣缂撳瓨锛堥檷 I/O锛
  778. # ==============================================================================
  779. stream_new_lines(){
  780.   local f="$1"; [ -f "$f" ] || return 0
  781.   if [ "$LOG_CACHE_ENABLE" = true ] && [ -n "$REDIS_CLI" ] && [ -n "$STAT" ]; then
  782.     local key="ddos:logpos:$(echo -n "$f" | ${MD5:-md5sum} | awk '{print $1}')"
  783.     local size; size=$($STAT -c %s "$f" 2>/dev/null || echo 0)
  784.     local pos; pos=$($REDIS_CLI GET "$key" 2>/dev/null || echo "")
  785.     if [[ -z "$pos" || "$pos" -gt "$size" ]]; then
  786.       $TAIL -n "$LOG_CACHE_MAX_FALLBACK_LINES" "$f"
  787.       $REDIS_CLI SETEX "$key" 86400 "$size" >/dev/null 2>&1 || true
  788.     else
  789.       local start=$(( pos + 1 ))
  790.       tail -c +$start "$f" 2>/dev/null || $TAIL -n "$LOG_CACHE_MAX_FALLBACK_LINES" "$f"
  791.       $REDIS_CLI SETEX "$key" 86400 "$size" >/dev/null 2>&1 || true
  792.     fi
  793.   else
  794.     $TAIL -n "$LOG_CACHE_MAX_FALLBACK_LINES" "$f"
  795.   fi
  796. }

  798. # ==============================================================================
  799. # L7 缁熻/澶勭疆 + Redis 闄愰€熷喅绛
  800. # ==============================================================================
  801. count_hits_in_logs(){
  802.   local tmp="$TMPDIR/l7_hits.$$"; : > "$tmp"
  803.   for f in "${CC_LOG_PATHS[@]}"; do
  804.     [ -f "$f" ] || continue
  805.     local fb; fb="$(guess_host_from_file "$f")"
  806.     stream_new_lines "$f" | $AWK -v fb="$fb" '
  807.       function g(line,   h) {
  808.         if (match(line, /"https?:\/\/([^\/"]+)/, a)) return a[1];
  809.         if (match(line, /"[^"]+ (https?:\/\/([^\/ ]+))?\/[^"]*"/, b)) { if (b[2]!="") return b[2]; }
  810.         return fb;
  811.       }
  812.       {
  813.         ip=$1; line=$0; path="/"
  814.         if (match($0, /"[^"]+"/, a)) {
  815.         req=a[0]
  816.         status_code=0
  817.         # 灏濊瘯浠庢棩蹇楄涓彁鍙 HTTP 鐘舵€佺爜 (渚嬪 " 200 ")
  818.         if (match($0, /"[^"]+" ([0-9]{3})/, s)) status_code=s[1]

  820.         if (match(req, /"[^ ]+ ([^ ?"]+)/, p)) path=p[1]

  822.         # Discuz! 鍚庡彴璺緞鍔ㄦ€佽瘑鍒€昏緫
  823.         # 濡傛灉璁块棶鐨勬槸鍚庡彴绠＄悊鍜屼笅杞絛ismall鎻掍欢鎿嶄綔鍔犵櫧鍚嶅崟闃叉璇潃鑷繁IP锛屽苟涓旂姸鎬佺爜鏄200 (琛ㄧず鎴愬姛)
  824.         if (path ~ /^/(dismall|admin|plugin)\.php$/ && status_code == 200) {
  825.             # 杈撳嚭涓€涓壒娈婃爣璁 ADMIN_LOGIN 鍜屽搴旂殑 IP
  826.             print "ADMIN_LOGIN", ip, g(line)
  827.         } else {
  828.             # 瀵逛簬鍏朵粬鎵€鏈夎闂紝杈撳嚭甯歌鏍囪 NORMAL_HIT
  829.             print "NORMAL_HIT", ip, g(line), path
  830.         }
  831.       }
  832.       }' >> "$tmp"
  833.   done
  834.   $AWK '{k=$1"|" $2"|" $3; c[k]++} END{for (k in c){split(k,a,"|"); print c[k], a[1], a[2], a[3]}}' "$tmp" | sort -nr
  835. }

  837. perip_escalation_from_errorlog(){
  838.   local tmp="$TMPDIR/perip.$$"; : > "$tmp"
  839.   for f in "${ERROR_LOG_PATHS[@]}"; do
  840.     [ -f "$f" ] || continue
  841.     local fb; fb="$(guess_host_from_file "$f")"
  842.     stream_new_lines "$f" | $AWK -v fb="$fb" '
  843.       /limiting connections by zone "perip"/ {
  844.         ip="";host="";
  845.         if (match($0, /client: ([0-9.]+)/, a)) ip=a[1];
  846.         if (match($0, /server: ([^, ]+)/, b)) host=b[1];
  847.         if (ip!="") {print ip, (host==""?fb:host)}
  848.       }' >> "$tmp"
  849.   done
  850.   if [ -s "$tmp" ]; then
  851.     $AWK '{k=$1"|" $2; c[k]++} END{for (k in c){split(k,a,"|"); print c[k], a[1], a[2]}}' "$tmp" \
  852.     | sort -nr \
  853.     | while read -r cnt ip host; do
  854.         local base="${HT_REQ_L3[$host]:-${HT_REQ_L3["*"]:-$((CC_THRESHOLD*4))}}"
  855.         local esc_thr=$(( base/2 )); [ "$esc_thr" -lt 5 ] && esc_thr=5
  856.         if (( cnt >= esc_thr )); then
  857.           if $IPSET test "$SET_RL_V4" "$ip" >/dev/null 2>&1; then
  858.             ban_ip "$ip" "L7-perip-escalation(cnt=$cnt,thr=$esc_thr)"
  859.           else
  860.             $IPSET add "$SET_RL_V4" "$ip" -exist
  861.             LIMITED_THIS_RUN+=("$ip ($host perip-escalation cnt=$cnt thr=$esc_thr)")
  862.           fi
  863.         fi
  864.       done
  865.   fi
  866. }

  868. redis_should_limit(){
  869.   [ -n "$REDIS_CLI" ] || { echo 0; return; }
  870.   local ip="$1" k="ddos:l7:$ip" r
  871.   r=$($REDIS_CLI -x <<EOF
  872. MULTI
  873. INCR $k
  874. EXPIRE $k 10
  875. EXEC
  876. EOF
  877. )
  878.   local cnt; cnt=$(echo "$r" | tail -n1 | tr -dc 0-9)
  879.   if [ -z "$cnt" ]; then echo 0; else [ "$cnt" -ge "$CC_RATELIMIT_THRESHOLD" ] && echo 1 || echo 0; fi
  880. }

  882. # ==============================================================================
  883. # Ban/Unban/Flush
  884. # ==============================================================================
  885. ban_ip(){
  886.   local ip="$1" reason="${2:-unknown}"
  887.   if is_in_whitelist_snapshot "$ip"; then log "璺宠繃灏佺锛堢櫧鍚嶅崟锛夛細$ip"; return 0; fi
  888.   if is_ipv6 "$ip"; then have ip6tables || { log "IPv6 涓嶅彲鐢紝璺宠繃 $ip"; return 0; }; $IPSET add "$SET_BL_V6" "$ip" -exist
  889.   else $IPSET add "$SET_BL_V4" "$ip" -exist; fi
  890.   BANNED_THIS_RUN+=("$ip ($reason)") # 灏嗗師鍥犲姞鍏ユ壒娆℃垬鎶
  891.   echo "$($DATE '+%F %T'),BAN,$ip,$reason" >> "$BAN_HISTORY"
  892. }
  893. unban_ip(){
  894.   local ip="$1" reason="${2:-unknown}"
  895.   is_ipv6 "$ip" && $IPSET del "$SET_BL_V6" "$ip" 2>/dev/null || $IPSET del "$SET_BL_V4" "$ip" 2>/dev/null || true
  896.   echo "$($DATE '+%F %T'),UNBAN,$ip,$reason" >> "$BAN_HISTORY"
  897. }
  898. flush_bans(){ $IPSET flush "$SET_BL_V4" 2>/dev/null || true; $IPSET flush "$SET_BL_V6" 2>/dev/null || true; log "宸叉竻绌洪粦鍚嶅崟"; have fail2ban-client && fail2ban-client unban --all 2>/dev/null || true; }

  900. # ==============================================================================
  901. # 涓诲贰妫€锛氬姩鎬佽皟閫 + L4/L7 鍒ゅ喅 + 鍛婅
  902. # ==============================================================================
  903. alert_markdown_batch(){
  904.   [ -n "$DINGTALK_WEBHOOK" ] || return 0
  905.   [ "${#BANNED_THIS_RUN[@]}" -eq 0 ] && [ "${#LIMITED_THIS_RUN[@]}" -eq 0 ] && return 0
  906.   local pub="N/A" lan="N/A"
  907.   pub="$(get_public_ip)"
  908.   lan="$(hostname -I 2>/dev/null | awk '{print $1}')"
  909.   local ban_lines="" lim_lines=""
  910.   for x in "${BANNED_THIS_RUN[@]}";  do ban_lines+="- $x\n"; done
  911.   for x in "${LIMITED_THIS_RUN[@]}"; do lim_lines+="- $x\n"; done
  912.   local text="### 馃毀 DDoS-Guard 鎵规鎴樻姤
  913. - **鏃堕棿**锛$($DATE '+%F %T')
  914. - **涓绘満**锛$pub锛堝缃戯級 / $lan锛堝唴缃戯級
  915. - **灏佺鏉＄洰**锛
  916. $([ -n "$ban_lines" ] && echo -e "$ban_lines" || echo "- 鏃")
  917. - **闄愰€熸潯鐩**锛
  918. $([ -n "$lim_lines" ] && echo -e "$lim_lines" || echo "- 鏃")"
  919.   alert_markdown "batch" "DDoS-Guard 鎵规鎴樻姤" "$text"
  920. }

  922. # --- alert_attack_state 鍑芥暟寮€濮 ---
  923. alert_attack_state(){
  924.   local state="$1"  # 鎺ユ敹绗竴涓弬鏁 (enter / exit)
  925.   local metrics="$2" # 鎺ユ敹鏂板鐨勭浜屼釜鍙傛暟锛岀敤浜庢帴鏀舵寚鏍囪鎯
  926.   
  927.   # 鑾峰彇涓绘満鍏綉鍜屽唴缃 IP
  928.   local pub="N/A" lan="N/A"
  929.   pub="$(get_public_ip)"
  930.   lan="$(hostname -I 2>/dev/null | awk '{print $1}')"
  931.   
  932.   # 鑾峰彇褰撳墠鐨勬壂鎻忛棿闅
  933.   local current_interval
  934.   current_interval=$(get_current_interval || echo '?')
  935.   
  936.   # 瀹氫箟閽夐拤娑堟伅鐨勪富瑕佸唴瀹
  937.   local text="### 鈿狅笍 鏀诲嚮妯″紡$( [ "$state" = "enter" ] && echo 杩涘叆 || echo 閫€鍑 )
  938. - **鏃堕棿**锛$($DATE '+%F %T')
  939. - **涓绘満**锛$pub / $lan
  940. - **鎵弿闂撮殧**锛${current_interval%s}s"
  941.   
  942.   # 杩欐槸涓€涓叧閿殑鏉′欢鍒ゆ柇锛
  943.   # 鍙湁鍦ㄦ槸鈥滆繘鍏モ€濇敾鍑绘ā寮忥紝骞朵笖鏈夊叿浣撶殑鎸囨爣璇︽儏鏃讹紝
  944.   # 鎵嶄細鍦ㄦ秷鎭湯灏捐拷鍔犫€滆Е鍙戝師鍥犫€濊繖閮ㄥ垎鍐呭銆
  945.   if [ "$state" = "enter" ] && [ -n "$metrics" ]; then
  946.     text+="\n- **瑙﹀彂鍘熷洜**:\n${metrics}"
  947.   fi
  948.   
  949.   # 璋冪敤閫氱敤鐨勫憡璀﹀嚱鏁帮紝灏嗕笂闈㈡嫾鎺ュソ鐨勫畬鏁存秷鎭 ($text) 鍙戦€佸嚭鍘
  950.   alert_markdown "state-$state" "DDoS-Guard 鏀诲嚮妯″紡锛${state}" "$text"
  951. }
  952. # --- alert_attack_state 鍑芥暟缁撴潫 ---

  954. run_core(){
  955.   ensure_ipset_and_iptables
  956.   load_host_thresholds
  957.   load_whitelist
  958.   reconcile_unban_whitelisted   # 鍙屼繚闄╄嚜鎰

  960.   BANNED_THIS_RUN=(); LIMITED_THIS_RUN=()

  962.   # 鍗囩骇鍚庣殑浠ｇ爜
  963.   local attack_mode_details; attack_mode_details=$(should_attack_mode)
  964.   local attack_mode; attack_mode=$(echo "$attack_mode_details" | head -n 1)
  965.   local metrics_summary; metrics_summary=$(echo "$attack_mode_details" | tail -n +2 | sed 's/^/  - /')

  967.   local est_thr=$NO_OF_EST syn_thr=$NO_OF_SYN cc_thr=$CC_THRESHOLD
  968.   local prev_state=0; [ -f "$attack_state_file" ] && prev_state=$(cat "$attack_state_file" 2>/dev/null || echo 0)

  970.   if [ "$ENABLE_DYNAMIC_THRESHOLDS" = true ] && [ "$attack_mode" -eq 1 ]; then
  971.     est_thr=$NO_OF_EST_ATTACK_MODE; syn_thr=$NO_OF_SYN_ATTACK_MODE; cc_thr=$CC_THRESHOLD_ATTACK_MODE
  972.     if [ "$prev_state" -ne 1 ]; then
  973.       set_timer_interval "$ATTACK_SCAN_INTERVAL"
  974.       echo 1 > "$attack_state_file"
  975.       alert_attack_state "enter" "$metrics_summary"
  976.       log "杩涘叆鏀诲嚮妯″紡锛欵ST<$est_thr SYN<$syn_thr L7<$cc_thr锛涙壂鎻忛棿闅=${ATTACK_SCAN_INTERVAL}s"
  977.     fi
  978.   else
  979.     if [ "$prev_state" -ne 0 ]; then
  980.       set_timer_interval "$SCAN_INTERVAL"
  981.       echo 0 > "$attack_state_file"
  982.       alert_attack_state "exit"
  983.       log "閫€鍑烘敾鍑绘ā寮忥細鎵弿闂撮殧鎭㈠=${SCAN_INTERVAL}s"
  984.     fi
  985.   fi

  987.   # L4: EST per-IP
  988.   $SS -Hnta state established \
  989.   | awk "$extract_peer_ip_awk" \
  990.   | sort | uniq -c | sort -nr \
  991.   | while read -r cnt ip; do
  992.       [ -z "$ip" ] && continue
  993.       is_in_whitelist_snapshot "$ip" && continue
  994.       # 澧炲姞鍔ㄦ€佺鐞嗗憳璞佸厤妫€鏌
  995.       $IPSET test "$SET_ADMIN_V4" "$ip" >/dev/null 2_>/dev/null && continue
  996.       [ "$(is_private_ip "$ip")" = "1" ] && continue
  997.       $IPSET test "$SET_GB_V4" "$ip" >/dev/null 2>&1 && continue
  998.       (( cnt >= est_thr )) && ban_ip "$ip" "L4-EST(cnt=$cnt,thr=$est_thr)"
  999.     done

  1001.   # L4: SYN_RECV per-IP
  1002.   $SS -Hnta state syn-recv \
  1003.   | awk "$extract_peer_ip_awk" \
  1004.   | sort | uniq -c | sort -nr \
  1005.   | while read -r cnt ip; do
  1006.       [ -z "$ip" ] && continue
  1007.       is_in_whitelist_snapshot "$ip" && continue
  1008.       # 澧炲姞鍔ㄦ€佺鐞嗗憳璞佸厤妫€鏌
  1009.       $IPSET test "$SET_ADMIN_V4" "$ip" >/dev/null 2_>/dev/null && continue
  1010.       [ "$(is_private_ip "$ip")" = "1" ] && continue
  1011.       $IPSET test "$SET_GB_V4" "$ip" >/dev/null 2>&1 && continue
  1012.       (( cnt >= syn_thr )) && ban_ip "$ip" "L4-SYN(cnt=$cnt,thr=$syn_thr)"
  1013.     done

  1015.   # L7锛氬閲忔棩蹇楄鏁 鈫 Host/Path Tiers 鈫 UA 鍒嗙被 鈫 Redis 闄愰€/灏佺
  1016.   local hits; hits=$(count_hits_in_logs || true)
  1017.   if [ -n "$hits" ]; then
  1018.     while read -r tag cnt ip host path; do
  1019.     # 濡傛灉鏍囩鏄 ADMIN_LOGIN, 璇存槑鏄鐞嗗憳IP
  1020.     if [ "$tag" = "ADMIN_LOGIN" ]; then
  1021.         # 灏嗚IP (姝ゆ椂瀛樺偍鍦╟nt鍙橀噺涓) 鍔犲叆绠＄悊鍛樹俊浠婚泦鍚堝苟璺宠繃鍚庣画妫€鏌
  1022.         $IPSET add "$SET_ADMIN_V4" "$cnt" -exist
  1023.         continue
  1024.     fi

  1026.     [ -z "$ip" ] && continue
  1027.       is_in_whitelist_snapshot "$ip" && continue
  1028.       # 澧炲姞鍔ㄦ€佺鐞嗗憳璞佸厤妫€鏌
  1029.       $IPSET test "$SET_ADMIN_V4" "$ip" >/dev/null 2_>/dev/null && continue
  1030.       local uac; uac="$(classify_ua_for_ip "$ip")"
  1031.       if [ "$uac" = "GOOD" ]; then $IPSET add "$SET_GB_V4" "$ip" -exist; continue; fi

  1033.       local base_host="$host"; [ -n "${HT_REQ_L1[$base_host]:-}" ] || base_host="*"
  1034.       local l1="${HT_REQ_L1[$base_host]:-$cc_thr}"
  1035.       local l2="${HT_REQ_L2[$base_host]:-$((cc_thr*2))}"
  1036.       local l3="${HT_REQ_L3[$base_host]:-$((cc_thr*4))}"
  1037.       local w="${HT_HOST_WEIGHT[$base_host]:-1.0}"

  1039.       local pc="${PT_COUNT[$base_host]:-0}"
  1040.       if [ "$pc" -gt 0 ]; then
  1041.         local idx=0
  1042.         while [ "$idx" -lt "$pc" ]; do
  1043.           local key="${base_host}|${idx}"
  1044.           local kind="${PT_KIND[$key]:-regex}"
  1045.           local pat="${PT_PAT[$key]:-}"
  1046.           local L1="${PT_L1[$key]:-0}"
  1047.           local L2="${PT_L2[$key]:-0}"
  1048.           local L3="${PT_L3[$key]:-0}"
  1049.           if [ -n "$pat" ]; then
  1050.             if [ "$kind" = "prefix" ]; then
  1051.               case "$path" in
  1052.                 "$pat"*) [ "$L1" -gt 0 ] && l1="$L1"; [ "$L2" -gt 0 ] && l2="$L2"; [ "$L3" -gt 0 ] && l3="$L3"; idx=$pc; continue
  1053.               esac
  1054.             else
  1055.               echo "$path" | $GREP -Eiq -- "$pat" && { [ "$L1" -gt 0 ] && l1="$L1"; [ "$L2" -gt 0 ] && l2="$L2"; [ "$L3" -gt 0 ] && l3="$L3"; idx=$pc; continue; }
  1056.             fi
  1057.           fi
  1058.           idx=$((idx+1))
  1059.         done
  1060.       fi

  1062.       local thr=$l1
  1063.       if [ "$ENABLE_DYNAMIC_THRESHOLDS" = true ] && [ "$attack_mode" -eq 1 ]; then
  1064.         thr=$(python3 - <<PY "$l1" "$w"
  1065. import sys
  1066. l1=float(sys.argv[1]); w=float(sys.argv[2])
  1067. print(int(max(3, l1*w*0.4)))
  1068. PY
  1069. )
  1070.       fi

  1072.       case "$uac" in
  1073.         SEMI) $IPSET add "$SET_RL_V4" "$ip" -exist; LIMITED_THIS_RUN+=("$ip ($host $path semi-trust UA)"); continue;;
  1074.         BAD|FAKEGOOD) thr=$(( thr/3 )); [ "$thr" -lt 3 ] && thr=3 ;;
  1075.       esac

  1077.       if (( cnt >= thr )); then
  1078.         local decide_limit=0
  1079.         if [ "$ENABLE_RATE_LIMITING" = true ]; then decide_limit=$(redis_should_limit "$ip"); fi
  1080.         if [ "$decide_limit" -eq 1 ] && [ "$uac" != "BAD" ] && [ "$uac" != "FAKEGOOD" ]; then
  1081.           $IPSET add "$SET_RL_V4" "$ip" -exist
  1082.           LIMITED_THIS_RUN+=("$ip ($host $path L7-limit cnt=$cnt thr=$thr)")
  1083.         else
  1084.           ban_ip "$ip" "L7-CC($host $path,cnt=$cnt,thr=$thr,ua=$uac)"
  1085.         fi
  1086.       fi
  1087.     done <<< "$hits"
  1088.   fi

  1090.   # 閿欒鏃ュ織 perip 鍗囩骇锛氬娆￠檺娴 鈫 闄愰€/灏佺
  1091.   perip_escalation_from_errorlog

  1093.   # 鎵规鎴樻姤锛堣妭娴 10 鍒嗛挓锛
  1094.   alert_markdown_batch
  1095. }

  1097. # 杩愯涓€娆★紙閿佹帶鍒讹細--nowait 闈為樆濉烇紱榛樿闃诲绛夊緟锛
  1098. run_once(){
  1099.   local mode="${1:-wait}"  # wait / nowait
  1100.   lock_open
  1101.   if [ "$mode" = "nowait" ]; then
  1102.     if ! lock_try; then
  1103.       log "妫€娴嬪埌宸叉湁瀹炰緥鍦ㄨ繍琛岋紙nowait 妯″紡锛岃烦杩囨湰杞級銆"
  1104.       return 0
  1105.     fi
  1106.   else
  1107.     lock_wait   # CLI 璋冪敤锛氶樆濉炵瓑寰咃紝涓嶅啀鎶モ€滃凡鏈夊疄渚嬪湪杩愯鈥
  1108.   fi
  1109.   run_core
  1110. }

  1112. # ==============================================================================
  1113. # 瀛愬懡浠
  1114. # ==============================================================================
  1115. cmd_install(){
  1116.   need_root
  1117.   # 1) systemd 鍗曞厓
  1118.   cat >/etc/systemd/system/ddos-guard.service <<SERVICE
  1119. [Unit]
  1120. Description=DDoS Guard one-shot scan
  1121. After=network-online.target
  1122. Wants=network-online.target

  1124. [Service]
  1125. Type=oneshot
  1126. ExecStart=$SELF_PATH run --nowait
  1127. User=root
  1128. Group=root
  1129. Nice=-5
  1130. IOSchedulingClass=realtime

  1132. [Install]
  1133. WantedBy=multi-user.target
  1134. SERVICE

  1136.   cat >"$timer_unit" <<TIMER
  1137. [Unit]
  1138. Description=Run ddos-guard every ${SCAN_INTERVAL}s

  1140. [Timer]
  1141. OnBootSec=30s
  1142. OnUnitActiveSec=${SCAN_INTERVAL}s
  1143. AccuracySec=1s
  1144. Unit=ddos-guard.service
  1145. Persistent=true

  1147. [Install]
  1148. WantedBy=timers.target
  1149. TIMER

  1151.   systemctl daemon-reload
  1152.   systemctl enable --now ddos-guard.timer

  1154.   # 2) 鐩綍/鐧藉悕鍗曟枃浠
  1155.   mkdir -p /etc/ddos
  1156.   touch "$IGNORE_IP_FILE" "$IGNORE_HOST_FILE"

  1158.   # 3) 棣栨鐧藉悕鍗曞姞杞斤紙澶辫触涓嶉樆鏂級
  1159.   load_whitelist || true
  1160.   reconcile_unban_whitelisted || true

  1162.   log "瀹夎瀹屾垚锛歴ystemd timer 姣 ${SCAN_INTERVAL}s 宸℃涓€娆°€"
  1163.   alert_markdown "install" "DDoS-Guard 瀹夎瀹屾垚" "鉁 瀹夎瀹屾垚 @ $($DATE '+%F %T')锛屽畾鏃跺贰妫€ ${SCAN_INTERVAL}s锛涙敾鍑绘ā寮忚嚜鍔ㄦ彁鍗囪嚦 ${ATTACK_SCAN_INTERVAL}s銆"
  1164.   echo "鍙敤瀛愬懡浠わ細status/top/history/check/tune/tune-guide/whitelist-reload/whitelist-show/whitelist-debug/redis-status/ban/unban/flush-bans/blacklist/f2b-setup/btwaf-sync-whitelist"
  1165. }

  1167. cmd_uninstall(){ need_root; systemctl disable --now ddos-guard.timer 2>/dev/null || true; systemctl disable --now ddos-guard.service 2>/dev/null || true; rm -f /etc/systemd/system/ddos-guard.{service,timer}; systemctl daemon-reload; log "宸插嵏杞 systemd 閰嶇疆銆"; }
  1168. cmd_daemon(){ need_root; log "杩涘叆鍓嶅彴瀹堟姢锛${SCAN_INTERVAL}s锛..."; while :; do run_once nowait || true; sleep "$SCAN_INTERVAL"; done; }

  1170. cmd_status(){
  1171.   echo "== ipset 姒傝 =="
  1172.   ipset_members "$SET_WL_V4" | awk 'END{print "WLv4:", NR+0}'
  1173.   ipset_members "$SET_WL_V6" | awk 'END{print "WLv6:", NR+0}'
  1174.   ipset_members "$SET_BL_V4" | awk 'END{print "BLv4:", NR+0}'
  1175.   ipset_members "$SET_BL_V6" | awk 'END{print "BLv6:", NR+0}'
  1176.   ipset_members "$SET_RL_V4" | awk 'END{print "RLv4:", NR+0}'
  1177.   ipset_members "$SET_GB_V4" | awk 'END{print "GBv4:", NR+0}'
  1178.   echo "== systemd =="; systemctl status --no-pager ddos-guard.timer 2>/dev/null | sed -n '1,12p'
  1179.   echo "== whitelist srcstat =="; [ -f "$RUNDIR/wl.srcstat" ] && cat "$RUNDIR/wl.srcstat" || echo "(鏆傛棤)"
  1180.   echo "== scan interval =="; [ -f "$RUNDIR/scan-interval.current" ] && cat "$RUNDIR/scan-interval.current" || echo "${SCAN_INTERVAL}"
  1181.   echo "== attack state =="; [ -f "$attack_state_file" ] && cat "$attack_state_file" || echo 0
  1182. }

  1184. cmd_top(){ top_talkers_l4; }
  1185. cmd_history(){ [ -f "$BAN_HISTORY" ] && tail -n 50 "$BAN_HISTORY" || echo "鏆傛棤鍘嗗彶銆"; }

  1187. cmd_check(){
  1188.   echo "== 渚濊禆妫€鏌 =="; for c in ss iptables ipset python3 host conntrack redis-cli; do printf "%-12s : " "$c"; have "$c" && echo OK || echo MISSING; done
  1189.   autodetect_btwaf_paths
  1190.   echo "== BTWAF 鏂囦欢 =="; ls -l "$BTWAF_IP_WHITE" 2>/dev/null || echo "鏃 IPv4 鏁村舰鐧藉悕鍗"; ls -l "$BTWAF_IP_WHITE_V6" 2>/dev/null || echo "鏃 IPv6 鐧藉悕鍗"
  1191.   echo "== 鐧藉悕鍗曟簮 =="; echo "$IGNORE_IP_FILE"; [ -s "$IGNORE_IP_FILE" ] && echo "(has content)"; echo "$IGNORE_HOST_FILE"; [ -s "$IGNORE_HOST_FILE" ] && echo "(has content)"
  1192.   echo "== Host/Path JSON =="; [ -s "$THRESHOLDS_JSON" ] && echo "$THRESHOLDS_JSON (present)" || echo "浣跨敤鑴氭湰鍐呯疆榛樿"
  1193. }

  1195. cmd_tune(){ echo "淇濆簳闃堝€硷細SYN=${NO_OF_SYN} EST=${NO_OF_EST} CT=${NO_OF_CT}锛涙敾鍑绘€ L7 璧风偣=${CC_THRESHOLD_ATTACK_MODE}"; }
  1196. cmd_tune_guide(){
  1197. cat <<'EOF'
  1198. [璋冧紭鎸囧崡]
  1199. - 澶氱珯鐐癸細CC_LOG_PATHS/ERROR_LOG_PATHS 涓€琛屼竴涓紱LOG_HOST_MAP 鍙寚瀹氣€滆矾寰勬鍒 鈫 鍩熷悕鈥濄€
  1200. - 闃堝€ JSON锛欸LOBAL 瑕嗙洊鍏滃簳锛涙瘡 host 閰 HOST_WEIGHT 鍜 L1/L2/L3锛汸ATH_TIERS 鏀寔 regex/prefix銆
  1201. - 铚樿洓锛欸OOD(UA+PTR+鍥炶瘉) 鈫 ddos_goodbots_v4 鍏嶆壈锛汼EMI 鍏堥檺閫燂紱BAD/FAKE 鏀剁揣闃堝€间紭鍏堝皝绂併€
  1202. - 鐧藉悕鍗曪細鑱氬悎 BTWAF v4/v6 + ignore.ip/host锛汻edis 鍝堝笇鐢ㄤ簬闈欓粯鑷剤锛**鍛婅浠呮寜 mtime**銆
  1203. - Redis锛氱敤浜 L7 鍘熷瓙璁℃暟(10s绐楀彛) 涓庘€滄棩蹇楁父鏍囩紦瀛樷€濓紱鏃 Redis 鑷姩閫€鍖栥€
  1204. - 鍔ㄦ€佽皟閫燂細鏀诲嚮妯″紡鈫抰imer 闄嶈嚦 ATTACK_SCAN_INTERVAL锛涢€€鍑烘仮澶 SCAN_INTERVAL銆
  1205. - 閽夐拤锛氱姸鎬佸憡璀︼紙杩/閫€锛+ 鎵规鎴樻姤锛涘悓绫 10 鍒嗛挓鑺傛祦锛圖INGTALK_THROTTLE_SEC锛夈€
  1206. EOF
  1207. }

  1209. cmd_whitelist_reload(){ load_whitelist; reconcile_unban_whitelisted; }
  1210. cmd_whitelist_show(){ show_whitelist; }

  1212. cmd_whitelist_debug(){
  1213.   autodetect_btwaf_paths
  1214.   echo "== 璺緞涓庣幆澧 =="
  1215.   echo "IGNORE_IP_FILE    : $IGNORE_IP_FILE"
  1216.   echo "IGNORE_HOST_FILE  : $IGNORE_HOST_FILE"
  1217.   echo "BTWAF_IP_WHITE    : $BTWAF_IP_WHITE"
  1218.   echo "BTWAF_IP_WHITE_V6 : $BTWAF_IP_WHITE_V6"
  1219.   echo "python3           : $PY3"
  1220.   echo "host              : $HOST"
  1221.   echo "getent            : $GETENT"
  1222.   echo
  1223.   echo "== ignore.ip.list 棰勮 =="; [ -r "$IGNORE_IP_FILE" ] && nl -ba "$IGNORE_IP_FILE" | sed -n '1,30p' || echo "(涓嶅瓨鍦ㄦ垨涓嶅彲璇)"
  1224.   echo
  1225.   echo "== ignore.host.list 瑙ｆ瀽娴嬭瘯锛堝墠 10 涓煙鍚嶏級=="
  1226.   if [ -r "$IGNORE_HOST_FILE" ]; then
  1227.     head -n 50 "$IGNORE_HOST_FILE" | sed 's/#.*$//' | sed '/^[[:space:]]*$/d' | head -n 10 | while read -r h; do
  1228.       echo "-- $h"; resolve_host_to_ips "$h" | head -n 5 | sed 's/^/   /'
  1229.     done
  1230.   else
  1231.     echo "(涓嶅瓨鍦ㄦ垨涓嶅彲璇)"
  1232.   fi
  1233.   echo
  1234.   echo "== BTWAF IPv4 JSON 杞崲锛堝墠 20 鏉★級=="
  1235.   if [ -r "$BTWAF_IP_WHITE" ] && [ -n "$PY3" ]; then parse_btwaf_ipv4_json "$BTWAF_IP_WHITE" 2>/dev/null | head -n 20; else echo "(鏂囦欢涓嶅瓨鍦/涓嶅彲璇绘垨 python3 涓嶅彲鐢)"; fi
  1236.   echo
  1237.   echo "== BTWAF IPv6 JSON 杞崲锛堝墠 20 鏉★級=="
  1238.   if [ -r "$BTWAF_IP_WHITE_V6" ] && [ -n "$PY3" ]; then parse_btwaf_ipv6_json "$BTWAF_IP_WHITE_V6" 2>/dev/null | head -n 20; else echo "(鏂囦欢涓嶅瓨鍦/涓嶅彲璇绘垨 python3 涓嶅彲鐢)"; fi
  1239. }

  1241. cmd_redis_status(){
  1242.   if [ -z "$REDIS_CLI" ]; then echo "redis-cli 鏈畨瑁"; return 1; fi
  1243.   echo "== Redis 杩炴帴娴嬭瘯 =="; $REDIS_CLI PING 2>/dev/null || { echo "PING 澶辫触"; return 1; }; echo "PONG"
  1244.   echo "== 鍘熷瓙璁℃暟 10s 绐楀彛娴嬭瘯 =="
  1245.   local key="ddos:test:$$"; local r
  1246.   r=$($REDIS_CLI -x <<EOF
  1247. MULTI
  1248. DEL $key
  1249. INCR $key
  1250. EXPIRE $key 10
  1251. EXEC
  1252. EOF
  1253. )
  1254.   echo "$r" | sed 's/^/  /'
  1255.   local cnt; cnt=$(echo "$r" | tail -n1 | tr -dc 0-9)
  1256.   [ -n "$cnt" ] && echo "璁℃暟=$cnt锛>=1 姝ｅ父锛" || echo "鏈嬁鍒拌鏁板€"
  1257. }

  1259. cmd_ban(){   [ $# -ge 2 ] || die "鐢ㄦ硶锛$0 ban <ip>";   ban_ip "$2" "manual"; }
  1260. cmd_unban(){ [ $# -ge 2 ] || die "鐢ㄦ硶锛$0 unban <ip>"; unban_ip "$2" "manual"; }
  1261. cmd_flush_bans(){ flush_bans; }
  1262. cmd_blacklist(){
  1263.   [ $# -ge 2 ] || die "鐢ㄦ硶锛$0 blacklist <ip|file>"
  1264.   local arg="$2"
  1265.   if [ -f "$arg" ]; then
  1266.     while read -r x; do
  1267.       x="${x%%#*}"; x="${x//$'\r'/}"; x="$(echo "$x" | xargs || true)"; [ -n "$x" ] || continue
  1268.       is_ipv6 "$x" && $IPSET add "$SET_BL_V6" "$x" -exist || $IPSET add "$SET_BL_V4" "$x" -exist
  1269.     done < "$arg"
  1270.   else
  1271.     is_ipv6 "$arg" && $IPSET add "$SET_BL_V6" "$arg" -exist || $IPSET add "$SET_BL_V4" "$arg" -exist
  1272.   fi
  1273. }

  1275. cmd_f2b_setup(){
  1276.   need_root
  1277.   local jail="${F2B_JAIL_LOCAL:-/etc/fail2ban/jail.local}"
  1278.   touch "$jail"
  1279.   local tmp="$TMPDIR/f2b.ignore.v4"; ipset_members "$SET_WL_V4" > "$tmp" || true
  1280.   if ! grep -q '^\[DEFAULT\]' "$jail"; then echo -e "[DEFAULT]\nignoreip = 127.0.0.1/8" >> "$jail"; fi
  1281.   local old; old=$(awk -F'= *' '/^\[DEFAULT\]/{f=1} f&&/^ignoreip *=/{print $2; exit}' "$jail" | tr -d ' \t')
  1282.   local addrs; addrs=$(cat "$tmp" | paste -sd, -)
  1283.   [ -n "$addrs" ] || { log "Fail2Ban锛氭棤鍙悎骞剁櫧鍚嶅崟"; return 0; }
  1284.   local merged
  1285.   merged=$(python3 - <<PY "$old" "$addrs"
  1286. import sys
  1287. o=(sys.argv[1] or "").split(",")
  1288. a=(sys.argv[2] or "").split(",")
  1289. s=set([x.strip() for x in o if x.strip()])|set([x.strip() for x in a if x.strip()])
  1290. print(",".join(sorted(s)))
  1291. PY
  1292. )
  1293.   python3 - <<'PY' "$jail" "$merged"
  1294. import sys,re
  1295. p,merged=sys.argv[1],sys.argv[2]
  1296. s=open(p,'r',encoding='utf-8').read()
  1297. def repl(m): return m.group(1)+'= '+merged
  1298. s=re.sub(r'(^\[DEFAULT\][\s\S]*?^ignoreip\s*)=.*$', lambda m: repl(m), s, flags=re.M)
  1299. open(p,'w',encoding='utf-8').write(s)
  1300. PY
  1301.   systemctl restart fail2ban 2>/dev/null || true
  1302.   log "Fail2Ban ignoreip 宸插閲忓悎骞剁櫧鍚嶅崟锛屽苟灏濊瘯閲嶅惎鏈嶅姟銆"
  1303. }
  1304. cmd_daily_report(){
  1305.   log "寮€濮嬬敓鎴愭瘡鏃ユ垬鎶..."
  1306.   local start_ts; start_ts=$(date -d "yesterday 19:30:00" +%s)
  1307.   local end_ts; end_ts=$(date -d "today 19:30:00" +%s)

  1309.   local report_data; report_data=$(
  1310.     awk -F, -v start="$start_ts" -v end="$end_ts" '
  1311.       BEGIN { OFS="," }
  1312.       {
  1313.         cmd="date -d ""$1"" +%s"
  1314.         cmd | getline ts
  1315.         close(cmd)
  1316.         if (ts >= start && ts < end) {
  1317.           print $0
  1318.         }
  1319.       }
  1320.     ' "$BAN_HISTORY" 2>/dev/null || true
  1321.   )

  1323.   local ban_count=0 unban_count=0
  1324.   local ban_details=""
  1325.   ban_count=$(echo "$report_data" | grep -c ',BAN,' || true)
  1326.   unban_count=$(echo "$report_data" | grep -c ',UNBAN,' || true)

  1328.   if [ "$ban_count" -gt 0 ]; then
  1329.     ban_details=$(echo "$report_data" | grep ',BAN,' | head -n 20 | awk -F, '{
  1330.       gsub(/"/, "\\"", $4); # Escape quotes in reason
  1331.       print "- **" $3 "** (" $4 ")"
  1332.     }' || true)
  1333.   fi

  1335.   local pub; pub="$(get_public_ip)"
  1336.   local text="### 馃搱 DDoS-Guard 姣忔棩鎴樻姤
  1337. - **鎶ュ憡鏃堕棿**: $($DATE '+%F %T')
  1338. - **缁熻鍛ㄦ湡**: 杩囧幓 24 灏忔椂
  1339. - **涓绘満鍏綉 IP**: $pub
  1340. - **鎬昏灏佺IP鏁**: ${ban_count}
  1341. - **鎬昏瑙ｅ皝IP鏁**: ${unban_count}
  1342. #### 灏佺璇︽儏 (鏈€澶氭樉绀20鏉)
  1343. $([ -n "$ban_details" ] && echo -e "$ban_details" || echo "- 浠婃棩鏃犳柊澧炲皝绂両P")"

  1345.   alert_markdown "daily-report" "DDoS-Guard 姣忔棩鎴樻姤" "$text"
  1346.   log "姣忔棩鎴樻姤宸茬敓鎴愬苟鎺ㄩ€併€"
  1347. }
  1348. # ==============================================================================
  1349. # 涓诲叆鍙
  1350. # ==============================================================================
  1351. case "${1:-}" in
  1352.   install)             cmd_install;;
  1353.   uninstall)           cmd_uninstall;;
  1354.   run)                 shift || true; mode="${1:-wait}"; [ "$mode" = "--nowait" ] && mode="nowait" || mode="wait"; run_once "$mode";;
  1355.   daemon)              cmd_daemon;;
  1356.   status)              cmd_status;;
  1357.   top)                 cmd_top;;
  1358.   history)             cmd_history;;
  1359.   check)               cmd_check;;
  1360.   tune)                cmd_tune;;
  1361.   tune-guide)          cmd_tune_guide;;
  1362.   whitelist-reload)    cmd_whitelist_reload;;
  1363.   whitelist-show)      cmd_whitelist_show;;
  1364.   whitelist-debug)     cmd_whitelist_debug;;
  1365.   redis-status)        cmd_redis_status;;
  1366.   ban)                 cmd_ban "$@";;
  1367.   unban)               cmd_unban "$@";;
  1368.   flush-bans)          cmd_flush_bans;;
  1369.   blacklist)           cmd_blacklist "$@";;
  1370.   f2b-setup)           cmd_f2b_setup;;
  1371.   daily-report)        cmd_daily_report;;
  1372.   btwaf-sync-whitelist) cmd_whitelist_reload;;
  1373.   *)
  1374. cat <<'USAGE'
  1375. 鐢ㄦ硶锛歞dos-guard <subcommand>

  1377. 瀛愬懡浠わ細
  1378.   install | uninstall | run [--nowait] | daemon
  1379.   status  | top | history | check | tune | tune-guide
  1380.   whitelist-reload | whitelist-show | whitelist-debug | redis-status
  1381.   ban <ip> | unban <ip> | flush-bans | blacklist <ip|file> | f2b-setup
  1382.   btwaf-sync-whitelist   # 鍏煎鍒悕锛堝悓 whitelist-reload锛

  1384. 璇存槑锛
  1385. - 澶氱珯鐐癸細鍦 CC_LOG_PATHS 涓 ERROR_LOG_PATHS 閲屼竴琛屼竴涓棩蹇楁枃浠跺嵆鍙紱
  1386.           鑻ユ棩蹇楅噷鏃犳硶瑙ｆ瀽 Host锛屽彲鍦 LOG_HOST_MAP 涓坊鍔犫€滄枃浠惰矾寰勬鍒 鈫 鍩熷悕鈥濈殑鏄犲皠銆
  1387. - 闃堝€硷細鑻ュ瓨鍦 /etc/ddos/host-thresholds.json锛屽垯浠ヨ鏂囦欢涓哄噯锛涘惁鍒欎娇鐢ㄨ剼鏈唴缃粯璁わ紙宸插浐鍖栦綘鐨勯厤缃 + Discuz PATH_TIERS锛夈€
  1388. - 铚樿洓绛栫暐锛氱湡路濂借湗铔涳紙UA+PTR+姝ｅ悜鍥炶瘉锛夆啋 ddos_goodbots_v4 鍏嶆壈锛涘崐鍙俊鍏堥檺閫燂紱浼€/鎭舵剰浼樺厛灏佺銆
  1389. - 鐧藉悕鍗曪細姣忚疆 run 閮戒細鑱氬悎 BTWAF v4/v6 + ignore.ip/host锛沚an 鍓嶄簩娆℃牎楠岋紱
  1390.           whitelist-reload 鍚庤嚜鍔ㄨВ灏佸凡杩涘叆鐧藉悕鍗曠殑璇皝 IP銆
  1391. - Redis锛氱敤浜 L7 鍘熷瓙璁℃暟鍜屸€滄棩蹇楁父鏍囩紦瀛樷€濓紙闄嶄綆纾佺洏 I/O锛夛紝鏃 Redis 鑷姩闄嶇骇銆
  1392. - 鍔ㄦ€佽皟閫燂細杩涘叆鏀诲嚮妯″紡鈫掑皢宸℃闂撮殧鏀逛负 ATTACK_SCAN_INTERVAL锛堥粯璁 2s锛夛紝閫€鍑哄悗鎭㈠涓 SCAN_INTERVAL銆
  1393. - 閽夐拤锛氭嫢鏈夆€滆繘鍏/閫€鍑烘敾鍑绘ā寮忊€濈殑鐘舵€佸憡璀︿笌鈥滄壒娆℃垬鎶モ€濓紝鍚岀被 10 鍒嗛挓鑺傛祦銆
  1394. USAGE
  1395.     ;;
  1396. esac

鍏朵腑鏉ユ簮鐧藉悕鍗曟枃浠跺弬鑰冩垨鑰呯洿鎺ュ€熺敤锛


鐧藉悕鍗曡嚜瀹氫箟鏂囦欢涓婁紶瀛樻斁鍒帮細/etc/ddos/
涓洪槻姝㈠嚭閿欙紝浣犲彲浠ョ洿鎺ヤ笅杞芥鑴氭湰锛岀劧鍚庤繘琛屼慨鏀瑰悗涓婁紶鑷筹細/usr/local/sbin/ 涓嬮潰銆銆愬缓璁繕鏄剼鏈懡浠ゆ楠ゆ墜宸ュ鍒讹紝浠ュ厤鏂囦欢瀛樺湪缂栫爜宸紓闂銆

璧嬩簣鑴氭湰瀹夎鎵ц鏉冮檺锛
  1. sudo chmod +x /usr/local/sbin/ddos-guard
绮樿创淇敼鍐呭鍚庣殑璇硶鏍￠獙锛锛堟棤浠讳綍閿欒杈撳嚭琛ㄧず閫氳繃锛
  1. sudo bash -n /usr/local/sbin/ddos-guard
鍚姩瀹夎骞堕儴缃查槻寰＄郴缁锛
  1. sudo /usr/local/sbin/ddos-guard install
鍒涘缓姣忔棩闃插尽鎯呭喌姹囨姤璁″垝浠诲姟锛氾紙姣忔棩闃插尽鏃ユ姤锛
  1. crontab -e
绮樿创鍒拌鍒掍换鍔℃渶鍚庝竴琛岋細锛堣繖閲岄璁剧殑鏄瘡鏃19锛30杩涜闃插尽姹囨姤锛屾敼涓轰綘鑷繁鎯宠鐨勬椂闂淬€傦級
  1. 30 19 * * * /usr/local/sbin/ddos-guard daily-report >/dev/null 2>&1

甯哥敤鍛戒护锛氾紙濡傛灉鐧藉悕鍗曡В鏋愪笉瀹屾暣锛岃寰楋細sudo ddos-guard whitelist-reload  閲嶆柊瑁呰浇涓€娆℃墍鏈夋潵婧愮櫧鍚嶅崟锛
  1. # 閲嶈浇鏈嶅姟閲嶅惎鏃堕棿璁℃暟鍣
  2. sudo systemctl daemon-reload && sudo systemctl restart ddos-guard.timer

  4. # 鍚屾 瀹濆nginx闃茬伀澧 鐧藉悕鍗 + 寮哄埗宸℃涓€杞
  5. sudo ddos-guard btwaf-sync-whitelist
  6. sudo ddos-guard run
  7. sudo ddos-guard status

  9. # 鏌ョ湅鎵€鏈塱pv4鐧藉悕鍗
  10. sudo ddos-guard whitelist-show

  12. # 鏌ョ湅鎵€鏈夌櫧鍚嶅崟缁熻
  13. sudo ddos-guard whitelist-show --count

  15. # Fail2ban 閮ㄧ讲
  16. sudo ddos-guard f2b-setup
  17. sudo ddos-guard f2b-status

  19. # 涓€閿竻绌洪粦鍚嶅崟骞跺敖閲忚仈鍔‵ail2ban瑙ｅ皝
  20. sudo ddos-guard clear-bans [--all-jails]

  22. # 鍒犻櫎鍗曚釜琚案涔呭皝绂佺殑 IP
  23. sudo nft delete element inet ddg bl4 { 220.181.108.93 }

  25. # 娓呯┖鎵€鏈夋案涔呭皝绂侊紙鎱庣敤锛
  26. sudo nft flush set inet ddg bl4

  28. # 娓呯┖鎵€鏈変复鏃跺皝绂侊紙濡傛灉涔熸兂椤烘墜瑙ｅ紑 tmp锛
  29. sudo ddos-guard flush-temp

  31. # 淇敼鍚庨噸鏂板姞杞芥墽琛
  32. sudo systemctl daemon-reload
  33. sudo systemctl start ddos-guard.timer

  35. # 鏌ョ湅闃叉姢瀹氭椂鍣ㄧ姸鎬
  36. sudo systemctl status ddos-guard.timer
  37. --------------------------------------------------------------------------
  38. # 鏌ョ湅鐘舵€
  39. sudo ddos-guard status

  41. # 瀹炴椂鐩戞帶
  42. sudo ddos-guard top

  44. # 閽夐拤鎺ㄩ€佹秷鎭嚜妫€锛堟墦鍗颁袱娆¤繑鍥炰綋锛
  45. sudo ddos-guard ding-check

  47. # 鏌ョ湅閽夐拤閰嶇疆锛堣繖閲屼細鏄剧ず瀹屾暣 host锛
  48. sudo ddos-guard ding-show-config

  50. # 骞舵墜宸ヨ窇涓€杞紝瑙傛祴鏄惁鏈 MASS_BAN 鎺ㄩ€
  51. sudo rm -f /var/lib/ddos-guard/notify/last_*.ts
  52. sudo env DINGTALK_DEBUG=2 ddos-guard run

  54. # 鏌ョ湅闃叉姢瀹氭椂鍣ㄧ姸鎬
  55. sudo systemctl status ddos-guard.timer

  57. # 鏌ョ湅灏佺鍘嗗彶
  58. sudo ddos-guard history

  60. # 鎵嬪姩杩愯涓€娆℃壂鎻
  61. sudo ddos-guard run

  63. # 鏌ョ湅闃叉姢鏈嶅姟杩愯鐘舵€
  64. sudo systemctl status ddos-guard.service

  66. # 鏌ョ湅褰撳墠榛戝悕鍗
  67. sudo ddos-guard blacklist

  69. # 鏌ョ湅IP濞佽儊鎯呮姤搴
  70. sudo ipset list ddos_tempban

  72. # 鏌ョ湅姘镐箙灏佺榛戝悕鍗曪紙IP濞佽儊鎯呮姤搴擄級
  73. sudo ddos-guard perma-list

  75. # 缃戠粶璋冧紭鍐呮牳闃插尽鍙傛暟涓存椂搴旂敤
  76. sudo ddos-guard tune

  78. # ddos-guard 鐜鑷鎶ュ憡
  79. sudo ddos-guard check

  81. # 鏌ョ湅鏈嶅姟鍣≧edis鍘熺敓CC闃插尽寮曟搸鐘舵€
  82. sudo ddos-guard redis-status

  84. # 涓€閿竻绌哄皝绂
  85. sudo ddos-guard flush-bans

  87. # 鎴栧悓鏃舵竻鎯呮姤搴撳苟灏濊瘯浠 fail2ban 瑙ｅ皝
  88. sudo ddos-guard flush-bans --purge-intel

  90. # 闆嗘垚 Fail2ban 鑱斿姩闃插尽鍒濆鍖
  91. sudo ddos-guard f2b-setup

  93. # 鍒锋柊鍩熷悕鐧藉悕鍗曠紦瀛
  94. sudo ddos-guard refresh-dns

  96. # 鍒锋柊瀹濆鐧藉悕鍗曠紦瀛
  97. ddos-guard refresh-btwaf

  99. # 瀹屽叏鍗歌浇~
  100. sudo ddos-guard uninstall || true

  102. # 鎵嬪姩閿€姣佹棫闆嗗悎锛堟鏃 iptables 瑙勫垯宸茶鍗歌浇锛屼笉浼氳寮曠敤锛
  103. for s in ddos_white ddos_tempban ddos_permban ddos_white_v6 ddos_tempban_v6 ddos_permban_v6; do
  104.   sudo ipset destroy "$s" 2>/dev/null || true
  105. done

  107. # 閲嶆柊瀹夎
  108. sudo ddos-guard install

  110. # 濡傛灉涔嬪墠 family 寮勯敊銆乼imer 娌¤濂斤細
  111. sudo ddos-guard repair-ipsets
  112. sudo ddos-guard fix-systemd


  115. # 閲嶆柊鍚屾鐧藉悕鍗曞苟璺戜竴杞娴
  116. sudo ddos-guard btwaf-sync-whitelist
  117. sudo ddos-guard run

  119. # 鍏抽棴瀹濆绯荤粺鍔犲浐
  120. btpython /www/server/panel/plugin/syssafe/stop.py 0
[姝ゅ鍖呭惈闅愯棌鍐呭锛屽鏋滈渶瑕佹煡鐪嬭鍥炲]




进入原文参与互动