fix: remove scan guard causing self-ban

Author: vhscom

main.go

@@ -227,11 +227,8 @@ func runServe() {
 	mux.Handle("GET /ops/events/stats", requireAgentKey(http.HandlerFunc(handleOpsEventStats)))
 	mux.Handle("GET /ops/nodes", requireAgentKey(http.HandlerFunc(handleOpsNodeList)))
 
-	// Catch-all: any unmatched path is a scan probe
-	mux.HandleFunc("/", scanNotFound)
-
-	// Global middleware: scan guard → access log → security headers → body limit → routes
-	handler := scanGuard(accessLog(securityHeaders(maxBody(mux))))
+	// Global middleware: access log → security headers → body limit → routes
+	handler := accessLog(securityHeaders(maxBody(mux)))
 
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()

middleware.go

@@ -141,96 +141,6 @@ func requireAgentKey(next http.Handler) http.Handler {
 	})
 }
 
-// --- Scan detection (ban IPs that generate excessive 404s) ---
-
-const (
-	scanWindow    = 1 * time.Minute
-	scanThreshold = 5
-	scanBanDur    = 5 * time.Minute
-	maxScanKeys   = 10_000
-)
-
-var scanner = struct {
-	mu      sync.Mutex
-	hits    map[string]*window
-	banned  map[string]time.Time
-}{
-	hits:   make(map[string]*window),
-	banned: make(map[string]time.Time),
-}
-
-func init() {
-	go func() {
-		for range time.Tick(1 * time.Minute) {
-			scanner.mu.Lock()
-			now := timeNow()
-			for k, w := range scanner.hits {
-				if now.After(w.resetAt) {
-					delete(scanner.hits, k)
-				}
-			}
-			for k, exp := range scanner.banned {
-				if now.After(exp) {
-					delete(scanner.banned, k)
-				}
-			}
-			scanner.mu.Unlock()
-		}
-	}()
-}
-
-func scanGuard(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		ip := clientIP(r)
-
-		scanner.mu.Lock()
-		if exp, ok := scanner.banned[ip]; ok && timeNow().Before(exp) {
-			scanner.mu.Unlock()
-			slog.Warn("banned IP dropped", "ip", ip, "path", r.URL.Path, "remaining", time.Until(exp).Round(time.Second))
-			// Silent drop — no response body, no headers
-			hj, ok := w.(http.Hijacker)
-			if ok {
-				conn, _, err := hj.Hijack()
-				if err == nil {
-					conn.Close()
-					return
-				}
-			}
-			// Fallback if hijack unavailable
-			w.WriteHeader(http.StatusForbidden)
-			return
-		}
-		scanner.mu.Unlock()
-
-		next.ServeHTTP(w, r)
-	})
-}
-
-func scanNotFound(w http.ResponseWriter, r *http.Request) {
-	ip := clientIP(r)
-	scanner.mu.Lock()
-	now := timeNow()
-	hit, ok := scanner.hits[ip]
-	if !ok || now.After(hit.resetAt) {
-		if !ok && len(scanner.hits) >= maxScanKeys {
-			scanner.mu.Unlock()
-			http.NotFound(w, r)
-			return
-		}
-		hit = &window{count: 0, resetAt: now.Add(scanWindow)}
-		scanner.hits[ip] = hit
-	}
-	hit.count++
-	if hit.count >= scanThreshold {
-		scanner.banned[ip] = now.Add(scanBanDur)
-		delete(scanner.hits, ip)
-		slog.Warn("scan detected, IP banned", "ip", ip, "path", r.URL.Path, "ua", r.UserAgent(), "duration", scanBanDur)
-		emitEvent("scan.banned", ip, 0, r.UserAgent(), 403, map[string]any{"path": r.URL.Path})
-	}
-	scanner.mu.Unlock()
-	http.NotFound(w, r)
-}
-
 // --- Access logging ---
 
 type statusRecorder struct {

middleware_test.go

@@ -307,76 +307,3 @@ func TestRateLimit(t *testing.T) {
 	}
 }
 
-func resetScanner() {
-	scanner.mu.Lock()
-	scanner.hits = make(map[string]*window)
-	scanner.banned = make(map[string]time.Time)
-	scanner.mu.Unlock()
-}
-
-func TestScanGuard_BansAfterThreshold(t *testing.T) {
-	initDB(":memory:")
-	cfg = &Config{
-		AccessSecret:  "test-access-secret-that-is-32-chars!!",
-		RefreshSecret: "test-refresh-secret-that-is-32-chars!",
-	}
-	resetScanner()
-
-	inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.NotFound(w, r)
-	})
-	handler := scanGuard(inner)
-	ts := httptest.NewServer(handler)
-	defer ts.Close()
-
-	// First scanThreshold requests should get 404
-	for i := 0; i < scanThreshold; i++ {
-		resp, err := http.Get(ts.URL + "/probe.php")
-		if err != nil {
-			t.Fatalf("request %d: %v", i, err)
-		}
-		resp.Body.Close()
-		if resp.StatusCode != http.StatusNotFound {
-			t.Errorf("request %d: status = %d, want %d", i, resp.StatusCode, http.StatusNotFound)
-		}
-	}
-
-	// Next request should be banned (403 or connection closed)
-	resp, err := http.Get(ts.URL + "/another.php")
-	if err != nil {
-		// Connection closed is acceptable (hijack)
-		return
-	}
-	resp.Body.Close()
-	if resp.StatusCode == http.StatusNotFound {
-		t.Errorf("post-ban request got 404, expected ban (403 or connection close)")
-	}
-}
-
-func TestScanGuard_AllowsNormalTraffic(t *testing.T) {
-	initDB(":memory:")
-	cfg = &Config{
-		AccessSecret:  "test-access-secret-that-is-32-chars!!",
-		RefreshSecret: "test-refresh-secret-that-is-32-chars!",
-	}
-	resetScanner()
-
-	inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	})
-	handler := scanGuard(inner)
-	ts := httptest.NewServer(handler)
-	defer ts.Close()
-
-	// 200 responses should never trigger a ban
-	for i := 0; i < 20; i++ {
-		resp, err := http.Get(ts.URL + "/")
-		if err != nil {
-			t.Fatalf("request %d: %v", i, err)
-		}
-		resp.Body.Close()
-		if resp.StatusCode != http.StatusOK {
-			t.Errorf("request %d: status = %d, want %d", i, resp.StatusCode, http.StatusOK)
-		}
-	}
-}