GO实现基于命令行的简单IPS程序代码

package main

import (
    "fmt"
    "net"
)

func main() {
    addrs, err := net.InterfaceAddrs()
    if err!= nil {
        fmt.Printf("获取网络接口地址失败: %v\n", err)
        return
    }

    for _, addr := range addrs {
        ipNet, ok := addr.(*net.IPNet)
        if ok &&!ipNet.IP.IsLoopback() && ipNet.IP.To4()!= nil {
            fmt.Println("IP地址:", ipNet.IP.String())
        }
    }
}

go build ips.go

package main

import (
    "fmt"
    "net"
    "os"
    "sync"
    "time"
)

func PingIP(ip string, wg *sync.WaitGroup, result chan<- string) {
    defer wg.Done()
    conn, err := net.DialTimeout("ip4:icmp", ip, time.Second*2)
    if err == nil {
        conn.Close()
        result <- ip
    }
}

func main() {
    if len(os.Args)!= 2 {
        fmt.Println("请输入要扫描的网段，例如 192.168.1.0/24")
        return
    }
    _, ipnet, err := net.ParseCIDR(os.Args[1])
    if err!= nil {
        fmt.Printf("解析网段失败: %v\n", err)
        return
    }

    var wg sync.WaitGroup
    result := make(chan string)

    for ip := ipnet.IP.Mask(ipnet.Mask); ipnet.Contains(ip); inc(ip) {
        wg.Add(1)
        go PingIP(ip.String(), &wg, result)
    }

    go func() {
        wg.Wait()
        close(result)
    }()

    for aliveIP := range result {
        fmt.Println("存活IP:", aliveIP)
    }
}

func inc(ip net.IP) {
    for j := len(ip) - 1; j >= 0; j-- {
        ip[j]++
        if ip[j] > 0 {
            break
        }
    }
}

./ips 192.168.1.0/24

[
    {
        "id": "1001",
        "description": "SSH暴力破解检测",
        "protocol": "tcp",
        "dst_port": 22,
        "action": "block",
        "threshold": 5,
        "time_window": 60
    },
    {
        "id": "1002",
        "description": "RDP暴力破解检测",
        "protocol": "tcp",
        "dst_port": 3389,
        "action": "block",
        "threshold": 5,
        "time_window": 60
    },
    {
        "id": "1003",
        "description": "MySQL暴力破解检测",
        "protocol": "tcp",
        "dst_port": 3306,
        "action": "block",
        "threshold": 5,
        "time_window": 60
    }
]

package main

import (
    "encoding/json"
    "fmt"
    "io/ioutil"
    "net"
    "os"
    "path/filepath"
    "sync"
    "time"
)

// Rule结构体表示一条安全规则
type Rule struct {
    ID          string  `json:"id"`
    Description string  `json:"description"`
    Protocol    string  `json:"protocol"`
    DstPort     int     `json:"dst_port"`
    Action      string  `json:"action"`
    Threshold   int     `json:"threshold"`
    TimeWindow  int     `json:"time_window"`
}

// LoadRules从文件加载安全规则
func LoadRules(filePath string) ([]*Rule, error) {
    content, err := ioutil.ReadFile(filePath)
    if err!= nil {
        return nil, fmt.Errorf("读取规则文件失败: %v", err)
    }
    var rules []*Rule
    err = json.Unmarshal(content, &rules)
    if err!= nil {
        return nil, fmt.Errorf("解析规则文件失败: %v", err)
    }
    return rules, nil
}

// ConnectionRecord记录IP的连接记录（简化示例，仅记录次数）
type ConnectionRecord struct {
    mu         sync.Mutex
    connections map[string]int
}

func NewConnectionRecord() *ConnectionRecord {
    return &ConnectionRecord{
        connections: make(map[string]int),
    }
}

func (cr *ConnectionRecord) Record(ip net.IP, port int) {
    cr.mu.Lock()
    key := fmt.Sprintf("%s:%d", ip.String(), port)
    cr.connections[key]++
    cr.mu.Unlock()
}

func (cr *ConnectionRecord) CheckViolation(rules []*Rule) []*Rule {
    var violatedRules []*Rule
    cr.mu.Lock()
    now := time.Now()
    for _, rule := range rules {
        for key, count := range cr.connections {
            parts := strings.Split(key, ":")
            ip := net.ParseIP(parts[0])
            port := atoi(parts[1])
            if port == rule.DstPort && count >= rule.Threshold {
                // 这里简单判断次数达到阈值就算违规，实际可能需考虑时间窗口等更复杂逻辑细化
                violatedRules = append(violatedRules, rule)
            }
        }
    }
    cr.mu.Unlock()
    return violatedRules
}

func atoi(s string) int {
    n, _ := fmt.Sscanf(s, "%d", &n)
    return n
}

func main() {
    // 获取当前目录下的rules.json作为配置文件路径（可根据实际调整）
    currentDir, err := os.Getwd()
    if err!= nil {
        fmt.Printf("获取当前目录失败: %v\n", err)
        return
    }
    configFilePath := filepath.Join(currentDir, "rules.json")

    rules, err := LoadRules(configFilePath)
    if err!= nil {
        fmt.Printf("加载规则失败: %v\n", err)
        return
    }

    targetIPNet := &net.IPNet{}
    _, targetIPNet, err = net.ParseCIDR("192.168.1.0/24")
    if err!= nil {
        fmt.Printf("解析目标IP网段失败: %v\n", err)
        return
    }

    record := NewConnectionRecord()

    // 模拟IP对内网端口的连接访问（这里简单循环增加连接次数示例）
    for i := 0; i < 10; i++ {
        for ip := targetIPNet.IP.Mask(targetIPNet.Mask); targetIPNet.Contains(ip); inc(ip) {
            // 简单模拟多次访问各规则关注的端口，实际场景会根据真实网络连接情况记录
            for _, rule := range rules {
                record.Record(ip, rule.DstPort)
            }
        }
    }

    violatedRules := record.CheckViolation(rules)
    for _, violatedRule := range violatedRules {
        fmt.Printf("IP段内存在疑似违反规则 %s 的情况，规则描述：%s\n", violatedRule.ID, violatedRule.Description)
    }
}

func inc(ip net.IP) {
    for j := len(ip) - 1; j >= 0; j-- {
        ip[j]++
        if ip[j] > 0 {
            break
        }
    }
}