bd40a44980
feat(xdp): auto-ban from ringbuf events; fix feature gating, exit path, pow flake
...
CI / Rust — check & clippy (push) Waiting to run
CI / Rust — test (push) Waiting to run
CI / Repo — module size & default secrets (push) Waiting to run
CI / Rust — cargo-deny (push) Waiting to run
CI / Docker — build edge image (push) Blocked by required conditions
- xdp: real 24-byte xdp_event parsing (fixes LE byte-swap of src IP),
opt-in [xdp] auto_ban (RATE_LIMIT always, CONN_DROP at fails>=threshold;
EVENT_BAN/POLICY_DROP excluded by design), rampart_xdp_autobans_total;
wired in app before load(); 10 tests in tests/xdp_events.rs
- build: --no-default-features compiles — redis paths cfg-gated behind
store-redis, manager fail-fasts without it; CI gates the config now
- app: RunExit enum replaces process::exit in lib; single exit site in main
- tests: seed PoW roundtrip token (was ~1/16 flaky; 50 pre-fix fails -> 0)
- docs: TODO statuses refreshed (round 2)
2026-09-16 00:49:41 +02:00
564613b82d
feat: rampart-tui — live metrics terminal dashboard
...
- ratatui + crossterm; separate bin reading Prometheus exposition format
- counter table (xdp stats, auto-bans, intel), pps/drops history chart,
status panel with error banner, q/quit r/refresh
- prometheus text parser (labels, escapes, NaN/Inf), Fetcher trait for tests
- 152 tests green
2026-08-24 12:35:09 +02:00
6863249ad4
feat: HTTP protocol plugin + XDP globals patching from config
...
protocol-http (compile-time feature):
- HttpHandler: incremental HTTP/1.1 request parse (fragment-safe),
header size/timeout limits, method whitelist, Host required,
blocked_paths, optional User-Agent requirement
- [protocol.http] config section; registry wiring behind feature
XDP globals:
- src/xdp/globals.rs: XdpGlobals + build_rodata_image() mirroring
xdp/core/config.h layout; set via OpenMapMut::set_initial_value()
before load ([xdp] section: ports, udp policy, throttle, challenge)
- wire set_globals into rampart binary startup
fix: gate preflight() behind xdp feature (dead code without it)
2026-08-24 12:18:22 +02:00
aa787a558c
feat: traffic intel hot path, SYN RST-challenge, XDP environment diagnostics
...
Traffic Intel (was dead code, now wired):
- TrafficHook in listener accept path: cps/pps windows -> AttackDetector
- auto-ban IPs below reputation threshold under attack ([detect.autoban])
- AlertDispatcher: webhook on attack state transition only (dedup), metrics
AUTO_BANS_TOTAL / INTEL_* ; [detect.alert].webhook_url
XDP SYN RST-challenge (Oubliette pattern, off by default):
- G_SYN_CHALLENGE_ENABLED=0: kernel replies bad-ACK SYN-ACK via XDP_TX,
spoofed sources stay silent, live clients answer RST with secret echo ->
challenge_verified (LRU, sliding TTL); brute-force of marker impossible
- maps challenge_verified/challenge_pending, STAT_CHALLENGE_*, all logic
in xdp/core/syn_challenge.h (221 lines)
XDP diagnostics (src/xdp/diagnostics.rs):
- EnvironmentReport: kernel version/BTF/driver->AttachMode verdict,
fail-fast before load on unsupported kernels; wired into CLI
- SystemProbe trait for kernel-less testing
fix: .gitignore 'bin/' matched src/bin/ — rampart.rs was never committed
cargo build/clippy(-D warnings, --features xdp)/test green: 107 tests
2026-08-24 10:11:10 +02:00
40bfe956e2
feat: subnet-level attack detection (prefix_stats)
...
- XDP: prefix_stats LRU map, per-/24 (v4) and /64 (v6) SYN/packet counters,
incremented post-blacklist/throttle (xdp/core/prefix_stats.h)
- userspace: SubnetDetector escalation ladder Monitor->StrictLimit->Challenge->Block
with spoof-gate (Block requires >= min_unique_sources, CGNAT-safe)
- config: [detect.prefix] section (enabled=false by default)
- fallback without XDP: engine SubnetTracker aggregates connections per-prefix
- fix: PrefixStatsVal::from_bytes for xdp feature build; prefix_len 24 vs 64
cargo build/clippy(-D warnings, all features)/test green: 83 tests
2026-08-24 09:47:21 +02:00
15f474486a
feat!: universal redesign — drop Minecraft stack, single-crate architecture
...
- remove Java plugins (velocity/paper), dashboard, all MC-specific code
(handshake, death_code, varint, hostname-HMAC); available in history pre-v0.2
- merge crates/* into one package with src/bin/{rampart,rampart-manager,rampart-cli}
- ProtocolHandler trait + registry (no implementations yet), universal PoW kept
- XDP: universal L3/L4 filter (xdp/core/) + pluggable hook API (xdp/hooks/),
fix IPv6 saddr bug; clang build verified
- docs: bilingual knowledge base (docs/kb/: attacks x4, defense-levels,
practice x3), rewrite README/architecture for universal concept
- TODO.md v4.0: <=300-line module limit, competitor benchmark section (ref/)
- deploy/CI/docs cleanup: no MC references, new binary names
cargo build/clippy(-D warnings)/test green (55 tests)
2026-08-24 01:50:22 +02:00
