Analyzer service: fix window-prune flush-at-cap, stream keying, penalty-metadata trust - #74
Closed
Tumult1337 wants to merge 2 commits into
Closed
Analyzer service: fix window-prune flush-at-cap, stream keying, penalty-metadata trust#74Tumult1337 wants to merge 2 commits into
Tumult1337 wants to merge 2 commits into
Conversation
The prune loops in updatePathEntropy and trackHTTPErrors break on "len(events) <= maxEvents", but the slice is only re-sliced after the loop, so len is constant per call. Once a window exceeds the cap the break condition can never hold and every event is pruned, zeroing the accumulated path-entropy counts and 404/403 tallies. A scanner sustaining more than maxEvents in-window periodically resets its own tracking. Compare the remaining count (len(events)-i) instead, and add boundary tests for both windows.
…ttern feed
- Key each collector stream by peer address plus a monotonic sequence
instead of the never-set ctx.Value("collector-id") constant, so
Broadcast reaches every connected collector and a disconnect no longer
evicts a still-live sibling's stream.
- Hoist the per-IP block-command dedup out of the per-collector send so a
broadcast is deduped once per block decision, not suppressed for every
collector after the first.
- Stop honoring penalty_key/penalty_type from wire metadata: the signal
plane is unauthenticated gRPC, so an arbitrary target let any peer
poison a third party's reputation. Penalty requests now only penalize
the signal's own source IP and are dropped (fail closed) when the
signal carries no source IP.
- Feed IsIncompleteHandshake to the pattern tracker from
SIGNAL_INCOMPLETE_HANDSHAKE and document (SIMPLIFIED) which pattern
detectors remain inert because TCPContext lacks the proto fields.
awlx
added a commit
that referenced
this pull request
Aug 8, 2026
Owner
|
Superseded by and merged through #77, which preserves this contribution and includes the follow-up fixes. Thanks for the contribution! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Analyzer service-layer fixes.
Commits
Merge note:
pr/http-server-timeoutsalso touchespkg/analyzer/service.goand should merge after this.Validation:
go build ./...clean;go test ./pkg/analyzerpasses.