Documentation
¶
Index ¶
Constants ¶
const ( ModuleName = "portscan" ModuleVersion = "1.0.0" // Check interval DefaultCheckInterval = constants.PortscanCheckInterval )
Variables ¶
This section is empty.
Functions ¶
func Descriptor ¶
func Descriptor() module.Descriptor
Descriptor returns the module descriptor NO FALLBACK - path must come from /etc/nftban/nftban.conf
Types ¶
type Event ¶ added in v1.204.0
Event is one observed connection attempt (one parsed kernel nft-log line), already extracted by the root log reader. Port is the destination port; Target is the destination IP (the protected host, usually one); TS is the event's unix timestamp (seconds).
type Input ¶ added in v1.204.0
type Input struct {
IP string
Family string
Events []Event
KnownOpenPorts []int
// Thresholds (from portscan/classic.conf). A threshold <= 0 disables that rule.
BlockRange int // PORTSCAN_CLASSIC_BLOCK_RANGE
VerticalPorts int // PORTSCAN_CLASSIC_VERTICAL_PORTS
HorizontalTargets int // PORTSCAN_CLASSIC_HORIZONTAL_TARGETS
StrobePorts int // PORTSCAN_CLASSIC_STROBE_PORTS
StrobeWindowSec int64 // strobe window (default 10s if <= 0)
}
Input is the per-source-IP classification request. KnownOpenPorts is the configured open-service set (tcp_ports_in / udp_ports_in) — these ports are allowed CONTEXT and never accrue scan score. Family is "ipv4"/"ipv6"; the scoring is identical for both (known-open exclusion is by port number).
type Module ¶
type Module struct {
// contains filtered or unexported fields
}
Module implements the portscan detection module
type PortscanStatusExtra ¶ added in v1.110.0
type PortscanStatusExtra struct {
Mode string `json:"mode"`
SuricataAvailable bool `json:"suricata_available"`
ScansDetected int64 `json:"scans_detected"`
}
PortscanStatusExtra is the typed status payload for the Portscan module's Status().Extra field. Field names map to legacy map[string]any keys via JSON tags byte-for-byte; R-12 introduces type-safety without an API change.
func (PortscanStatusExtra) ToExtraInfo ¶ added in v1.110.0
func (e PortscanStatusExtra) ToExtraInfo() module.ExtraInfo
ToExtraInfo serializes the typed struct into the module.ExtraInfo map[string]any contract expected by module.Status.Extra.
type Verdict ¶ added in v1.204.0
type Verdict struct {
ScanType string `json:"scan_type"` // "" | block | vertical | horizontal | strobe
KnownOpenCount int `json:"known_open_count"`
UnexpectedCount int `json:"unexpected_count"`
TargetCount int `json:"target_count"`
Action string `json:"action"` // allow | ban
Family string `json:"family"`
IP string `json:"src_ip"`
}
Verdict is the classification result. Action is "allow" or "ban". KnownOpenCount/UnexpectedCount are the distinct-port tallies used for the old-vs-new shadow comparison.
func Classify ¶ added in v1.204.0
Classify scores ONLY unexpected (non-known-open) destination ports. Known-open service ports are tallied (for visibility) but never drive a scan verdict, so a legitimate client touching only known-open services yields UnexpectedCount==0 → allow. Genuine diversity across unexpected/closed ports remains ban-capable. IPv4 and IPv6 are treated identically.
Source Files