botguard

type BatchSignal struct {
	IP      string   `json:"ip"`      // IP address
	Score   int      `json:"score"`   // Behavioral score (0-100)
	Reasons []string `json:"reasons"` // Why flagged (e.g., "404_flood", "wp_probe")
	Action  string   `json:"action"`  // "ban", "grey", "allow_demote", "allow_extend"
	TS      int64    `json:"ts"`      // Unix timestamp
}

type BotConfig struct {
	Name       string   // e.g. "GOOGLEBOT"
	Domains    []string // Suffix match domains (e.g. ["googlebot.com", "google.com"])
	VerifyMode string   // Verification method: "fcrdns"
	MaxConn    int      // Max concurrent connections allowed
	MaxRate    string   // nft rate string (e.g. "80/second")
	Burst      int      // nft burst value
}

type Classifier struct {
	// contains filtered or unexported fields
}

type ClassifyResult struct {
	State   IPState      // Target state (allow, ban, grey, pending)
	Reason  string       // Why this decision was made
	BotName string       // Identified bot name (if any)
	Verify  VerifyStatus // FCrDNS verification result
}

type Config struct {
	// Module control
	Enabled bool

	// Classification loop intervals
	LoopInterval         time.Duration // Normal: 60s
	LoopPressureInterval time.Duration // Under pressure: 40s

	// Hysteresis thresholds (per IP connection count)
	TripConn      int // Start analyzing (default 200)
	ClearConn     int // Stop analyzing (default 150)
	EmergencyConn int // Immediate block (default 500)

	// Kernel suspect marking config (informational — actual values in nft rules)
	SuspectRate    string        // e.g. "30/second"
	SuspectBurst   int           // e.g. 60
	SuspectTimeout time.Duration // e.g. 5m

	// TTLs for classification sets
	AllowTTL     time.Duration // 24h initial
	BanTTL       time.Duration // 96h
	GreyTTL      time.Duration // 30m
	EmergencyTTL time.Duration // 30m
	PendingTTL   time.Duration // 60s

	// Auto-tuning
	AutoTune bool

	// Batch integration
	BatchSignalFile string
	BatchInterval   time.Duration

	// FCrDNS verification
	VerifyWorkers   int           // Max concurrent DNS workers (default 8)
	VerifyRateLimit int           // Max new lookups per second (default 10)
	VerifyTimeout   time.Duration // Timeout per DNS lookup (default 3s)
	VerifyCacheTTL  time.Duration // Positive cache TTL (default 24h)
	VerifyNegTTL    time.Duration // Negative cache TTL (default 1h)

	// Crawler config files
	AllowedCrawlersFile string
	DeniedCrawlersFile  string

	// Logging
	LogLevel     string
	LogDecisions bool
}

type Enforcer struct {
	// contains filtered or unexported fields
}

type FCrDNSVerifier struct {
	// contains filtered or unexported fields
}

type GuardStats struct {
	TickCount             int64         // Total classification ticks
	SuspectsFound         int64         // Total unique IPs found in suspect set
	Classified            int64         // Total IPs classified
	AllowCount            int64         // IPs classified as allow
	GreyCount             int64         // IPs classified as grey
	BanCount              int64         // IPs classified as ban
	EmergencyCount        int64         // IPs classified as emergency
	PendingCount          int64         // IPs currently pending
	TrackedIPs            int64         // Currently tracked IPs in state map
	LastTickDuration      time.Duration // Duration of last tick
	LastTickTime          time.Time     // When last tick completed
	PressureMode          bool          // Whether currently in pressure mode
	VerifyEnqueued        int64         // IPs enqueued for FCrDNS verification
	VerifyCompleted       int64         // FCrDNS verifications completed
	VerifyVerified        int64         // IPs that passed FCrDNS
	VerifyFailed          int64         // IPs that failed FCrDNS
	BatchSignalsProcessed int64         // Batch signals consumed from Clock 3
}

type IPRecord struct {
	IP           netip.Addr   // Parsed IP address (IPv4 or IPv6)
	State        IPState      // Current classification
	Score        int32        // Accumulated threat score
	FirstSeen    time.Time    // When first detected as suspect
	LastSeen     time.Time    // Last time seen in suspect set
	ExpiresAt    time.Time    // When current state expires
	HitCount     int64        // Number of times seen in suspect set
	Reasons      []string     // Why this IP was flagged (for logging)
	BotName      string       // Identified bot name (empty if unknown)
	VerifiedAt   time.Time    // When FCrDNS verification completed (zero if not verified)
	VerifyStatus VerifyStatus // Result of FCrDNS verification
}

type IPState int

type Logger struct {
	// contains filtered or unexported fields
}

type Module struct {
	// contains filtered or unexported fields
}

type SuspectReader struct {
	// contains filtered or unexported fields
}

type VerifyResult struct {
	IP       netip.Addr   // The IP that was verified
	Status   VerifyStatus // Verification outcome
	BotName  string       // Matched bot name (empty if not matched)
	Hostname string       // Reverse DNS hostname (empty if lookup failed)
}

type VerifyStatus int