Guard: watch logs, ban misbehaving addresses in Housecarl

Files and the journal, patterns with one <IP>, bounties within a window,
bans in a Housecarl ban list with repeat offenders' bans growing; presets
for sshd, jarl, housecarl, steward, bind-xfr, postfix-sasl, dovecot,
nginx-auth and housecarl-drops; guard run/check/test/status/bans/ban/unban;
a Debian package with a sandboxed unit; an end-to-end test with Housecarl.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/bounty/bounty.go

@@ -0,0 +1,120 @@
+// Package bounty keeps each address's bounty in a watch: its matches
+// within the watch's window. An address whose bounty reaches the watch's
+// hits is banned, and starts again from nothing.
+package bounty
+
+import (
+	"net/netip"
+	"sort"
+	"sync"
+	"time"
+)
+
+// MaxTracked is the most addresses a watch keeps a bounty for; past it,
+// the ones seen longest ago are forgotten.
+const MaxTracked = 100000
+
+// Tracker counts one watch's matches per address (or IPv6 prefix).
+type Tracker struct {
+	Hits   int
+	Within time.Duration
+
+	mu   sync.Mutex
+	seen map[netip.Prefix][]time.Time
+}
+
+// New makes a Tracker.
+func New(hits int, within time.Duration) *Tracker {
+	return &Tracker{Hits: hits, Within: within, seen: map[netip.Prefix][]time.Time{}}
+}
+
+// Add counts a match of p at a time. It returns p's bounty, and whether
+// it reached the hits (p's bounty is then cleared).
+func (t *Tracker) Add(p netip.Prefix, at time.Time) (int, bool) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	ts := keep(t.seen[p], at.Add(-t.Within))
+	ts = append(ts, at)
+	if len(ts) >= t.Hits {
+		delete(t.seen, p)
+		return len(ts), true
+	}
+	t.seen[p] = ts
+	if len(t.seen) > MaxTracked {
+		t.prune(at)
+	}
+	return len(ts), false
+}
+
+// keep drops the times before from (times are in order).
+func keep(ts []time.Time, from time.Time) []time.Time {
+	i := 0
+	for i < len(ts) && ts[i].Before(from) {
+		i++
+	}
+	return ts[i:]
+}
+
+// prune forgets what is out of the window, then, if still too many, the
+// addresses seen longest ago.
+func (t *Tracker) prune(now time.Time) {
+	for p, ts := range t.seen {
+		if ts = keep(ts, now.Add(-t.Within)); len(ts) == 0 {
+			delete(t.seen, p)
+		} else {
+			t.seen[p] = ts
+		}
+	}
+	if len(t.seen) <= MaxTracked {
+		return
+	}
+	type last struct {
+		p netip.Prefix
+		t time.Time
+	}
+	all := make([]last, 0, len(t.seen))
+	for p, ts := range t.seen {
+		all = append(all, last{p, ts[len(ts)-1]})
+	}
+	sort.Slice(all, func(i, j int) bool { return all[i].t.Before(all[j].t) })
+	for _, x := range all[:len(all)-MaxTracked*9/10] {
+		delete(t.seen, x.p)
+	}
+}
+
+// Bounty is an address's bounty.
+type Bounty struct {
+	Address string    `json:"address"`
+	Bounty  int       `json:"bounty"`
+	Last    time.Time `json:"last"`
+}
+
+// Top returns the n highest bounties now (within the window), highest
+// first.
+func (t *Tracker) Top(n int, now time.Time) []Bounty {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	var out []Bounty
+	for p, ts := range t.seen {
+		if ts = keep(ts, now.Add(-t.Within)); len(ts) > 0 {
+			out = append(out, Bounty{Address: address(p), Bounty: len(ts), Last: ts[len(ts)-1]})
+		}
+	}
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].Bounty != out[j].Bounty {
+			return out[i].Bounty > out[j].Bounty
+		}
+		return out[i].Last.After(out[j].Last)
+	})
+	if len(out) > n {
+		out = out[:n]
+	}
+	return out
+}
+
+func address(p netip.Prefix) string {
+	if p.IsSingleIP() {
+		return p.Addr().String()
+	}
+	return p.String()
+}

internal/bounty/bounty_test.go

@@ -0,0 +1,30 @@
+package bounty
+
+import (
+	"net/netip"
+	"testing"
+	"time"
+)
+
+func TestTracker(t *testing.T) {
+	tr := New(3, time.Minute)
+	p := netip.MustParsePrefix("203.0.113.9/32")
+	t0 := time.Now()
+	if n, r := tr.Add(p, t0); n != 1 || r {
+		t.Errorf("first: %d %v", n, r)
+	}
+	// Two minutes later the first is out of the window.
+	tr.Add(p, t0.Add(2*time.Minute))
+	if n, r := tr.Add(p, t0.Add(2*time.Minute+time.Second)); n != 2 || r {
+		t.Errorf("window: %d %v", n, r)
+	}
+	if top := tr.Top(5, t0.Add(2*time.Minute+time.Second)); len(top) != 1 || top[0].Bounty != 2 || top[0].Address != "203.0.113.9" {
+		t.Errorf("top %+v", top)
+	}
+	if n, r := tr.Add(p, t0.Add(2*time.Minute+2*time.Second)); n != 3 || !r {
+		t.Errorf("reached: %d %v", n, r)
+	}
+	if top := tr.Top(5, t0.Add(3*time.Minute)); len(top) != 0 {
+		t.Errorf("after the ban the bounty starts again: %+v", top)
+	}
+}