fix(security): don't ban IPs for repeated 404s on the same path

The listener 404 path was calling recordScanAttempt() for every unknown
mount request, counting raw hits. A user opening the web player while
their stream was offline (or a browser doing favicon/manifest prefetch
before any mount was registered) could easily rack up 10 hits from the
same IP in a few seconds and get a 15-minute TCP-level ban.

- Skip recordScanAttempt entirely for mounts that match any configured
  stream (Mounts, AdvancedMounts, VisibleMounts, FallbackMounts, or a
  user's per-mount password) — those paths are legitimate even when no
  source is currently connected.
- Skip it for obvious browser prefetch paths: /.well-known/*, *.ico,
  *.png, *.jpg, *.css, *.js, *.xml, *.json, *.webmanifest, fonts …
- Gate the lockout on *distinct* path count (>=25) rather than raw hit
  count. Real scanners touch many paths; a flapping listener hits one.
- Update the test to reflect the new intent.

Author: DatanoiseTV

server/auth.go

@@ -140,14 +140,19 @@ func (s *Server) recordScanAttempt(ip, path string) {
 	attempt.Paths[path] = true
 	attempt.Count++
 
-	if attempt.Count >= 10 {
+	// Require a large spread of distinct 404 paths before locking an IP
+	// out: real vuln scanners probe dozens of unrelated paths, whereas a
+	// legitimate listener reconnecting to an offline mount hits the same
+	// path repeatedly. Counting distinct paths rather than raw hits stops
+	// well-behaved clients from tripping the lockout.
+	if len(attempt.Paths) >= 25 {
 		attempt.LockoutBy = time.Now().Add(15 * time.Minute)
-		logger.L.Warnf("IP %s locked out for 15 minutes due to 10 scanning attempts (404s)", ip)
+		logger.L.Warnf("IP %s locked out for 15 minutes after %d distinct 404 paths (likely scanner)", ip, len(attempt.Paths))
 		s.dispatchWebhook("security_lockout", map[string]interface{}{
 			"ip":      ip,
 			"reason":  "connection_scanning",
 			"until":   attempt.LockoutBy.Format(time.RFC3339),
-			"details": "10 connection scanning attempts (404s)",
+			"details": fmt.Sprintf("%d distinct 404 paths", len(attempt.Paths)),
 		})
 	}
 }

server/auth_test.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"fmt"
 	"testing"
 
 	"github.com/DatanoiseTV/tinyice/config"
@@ -45,29 +46,35 @@ func TestIPWhitelistAndBanning(t *testing.T) {
 		t.Errorf("::1 should be always whitelisted")
 	}
 
-	// Verify scan attempt lockout behavior
+	// Verify scan attempt lockout behavior: a legit listener hammering a
+	// single offline mount path should *never* trigger the ban — only a
+	// scanner touching many distinct paths should.
 	ip := "8.8.8.8"
-	path := "/wp-admin"
 
-	// Record 9 attempts on SAME path
-	for i := 0; i < 9; i++ {
-		s.recordScanAttempt(ip, path)
+	for i := 0; i < 200; i++ {
+		s.recordScanAttempt(ip, "/live")
 	}
-
 	if s.isBanned(ip) {
-		t.Errorf("IP %s should not be banned yet after 9 attempts", ip)
+		t.Errorf("IP %s should NOT be banned for repeated 404s on the same path", ip)
 	}
 
-	// 10th attempt should ban it
-	s.recordScanAttempt(ip, path)
-	if !s.isBanned(ip) {
-		t.Errorf("IP %s should be banned after 10 attempts on SAME path (due to fix)", ip)
+	// 25 distinct paths is the scanner threshold.
+	scanner := "8.8.4.4"
+	for i := 0; i < 24; i++ {
+		s.recordScanAttempt(scanner, fmt.Sprintf("/probe-%d", i))
+	}
+	if s.isBanned(scanner) {
+		t.Errorf("IP %s should not be banned yet after 24 distinct paths", scanner)
+	}
+	s.recordScanAttempt(scanner, "/probe-24")
+	if !s.isBanned(scanner) {
+		t.Errorf("IP %s should be banned after 25 distinct paths", scanner)
 	}
 
 	// Verify whitelisted IP is NOT banned even after many attempts
 	wip := "192.168.1.1"
-	for i := 0; i < 20; i++ {
-		s.recordScanAttempt(wip, path)
+	for i := 0; i < 50; i++ {
+		s.recordScanAttempt(wip, fmt.Sprintf("/wp-%d", i))
 	}
 	if s.isBanned(wip) {
 		t.Errorf("Whitelisted IP %s should NOT be banned even after many attempts", wip)

server/handlers_stream.go

@@ -212,6 +212,47 @@ func (s *Server) handleSource(w http.ResponseWriter, r *http.Request) {
 	s.Relay.RemoveStream(mount)
 }
 
+// looksLikeUnknownMount reports whether a 404 for this path should count
+// toward the vuln-scanner lockout. Anything that is configured as a stream
+// (even if no source is currently connected) is a legitimate listener URL;
+// browser prefetch paths with static file extensions are also ignored.
+func (s *Server) looksLikeUnknownMount(mount string) bool {
+	// Known configured mount — always legitimate.
+	if _, ok := s.Config.Mounts[mount]; ok {
+		return false
+	}
+	if _, ok := s.Config.AdvancedMounts[mount]; ok {
+		return false
+	}
+	if _, ok := s.Config.VisibleMounts[mount]; ok {
+		return false
+	}
+	if _, ok := s.Config.FallbackMounts[mount]; ok {
+		return false
+	}
+	for _, u := range s.Config.Users {
+		if _, ok := u.Mounts[mount]; ok {
+			return false
+		}
+	}
+	// Browser prefetch paths — not a stream attempt.
+	lower := strings.ToLower(mount)
+	if strings.HasPrefix(lower, "/.well-known/") {
+		return false
+	}
+	staticSuffixes := []string{
+		".ico", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp",
+		".css", ".js", ".map", ".json", ".xml", ".txt", ".webmanifest",
+		".woff", ".woff2", ".ttf",
+	}
+	for _, ext := range staticSuffixes {
+		if strings.HasSuffix(lower, ext) {
+			return false
+		}
+	}
+	return true
+}
+
 // isOggContentType returns true if the given HTTP Content-Type indicates an
 // Ogg-container stream (Vorbis, Opus, FLAC-in-Ogg, etc.).
 func isOggContentType(ct string) bool {
@@ -329,8 +370,15 @@ func (s *Server) handleListener(w http.ResponseWriter, r *http.Request) {
 				time.Sleep(1 * time.Second)
 				continue
 			}
-			host, _, _ := net.SplitHostPort(r.RemoteAddr)
-			s.recordScanAttempt(host, mount)
+			// Only count as a scan attempt when the mount is something
+			// we've never known — a configured mount that's currently
+			// offline is a legitimate listener, not an attacker probing
+			// paths. Similarly, obvious non-stream prefetch paths
+			// (favicon.ico, manifest.json, *.png …) don't deserve a ban.
+			if s.looksLikeUnknownMount(mount) {
+				host, _, _ := net.SplitHostPort(r.RemoteAddr)
+				s.recordScanAttempt(host, mount)
+			}
 			http.NotFound(w, r)
 			return
 		}