feat: add Fail2ban security detection console

gateway/internal/inbound/authentication.go

@@ -37,10 +37,12 @@ func (s Server) handleLogin(response *cmpp.Response, packet *cmpp.Packet, logger
 	}
 	account := strings.TrimRight(req.SrcAddr, "\x00")
 	if account == "" {
+		go s.reportSecurityEvent("cmpp_protocol_abuse", remoteIP(packet.Conn.Conn.RemoteAddr()), "EMPTY_SOURCE_ADDRESS", cmppVersionName(req.Version))
 		setInboundConnectResponse(response.Packer, cmpp.ErrnoConnInvalidSrcAddr, req.AuthSrc, "", req.Version)
 		return false, cmpp.ConnRspStatusErrMap[cmpp.ErrnoConnInvalidSrcAddr]
 	}
 	if req.Version != cmpp.V20 && req.Version != cmpp.V21 && req.Version != cmpp.V30 {
+		go s.reportSecurityEvent("cmpp_protocol_abuse", remoteIP(packet.Conn.Conn.RemoteAddr()), "UNSUPPORTED_VERSION", cmppVersionName(req.Version))
 		setInboundConnectResponse(response.Packer, cmpp.ErrnoConnVerTooHigh, req.AuthSrc, "", cmpp.V30)
 		return false, cmpp.ConnRspStatusErrMap[cmpp.ErrnoConnVerTooHigh]
 	}
@@ -129,3 +131,18 @@ func (s Server) authenticate(remote net.Addr, account string, authSource string,
 	err := s.post(context.Background(), "/gateway/events/inbound/authenticate", payload, &result)
 	return result, err
 }
+
+func (s Server) reportSecurityEvent(ruleCode, sourceIP, resultCode, protocol string) {
+	if net.ParseIP(sourceIP) == nil {
+		return
+	}
+	payload := map[string]any{
+		"ruleCode": ruleCode, "sourceIp": sourceIP, "resultCode": resultCode, "protocol": protocol,
+	}
+	var result struct {
+		Accepted bool `json:"accepted"`
+	}
+	if err := s.post(context.Background(), "/gateway/events/security-detection", payload, &result); err != nil {
+		log.Printf("security event report failed rule=%s remote=%s err=%v", ruleCode, sourceIP, err)
+	}
+}

gateway/internal/inbound/server.go

@@ -13,6 +13,7 @@ const defaultHTTPTimeout = 10 * time.Second
 type Server struct {
 	Addr                 string
 	APIBaseURL           string
+	SecurityEventToken   string
 	HTTPClient           *http.Client
 	LogWriter            io.Writer
 	PendingFlushInterval time.Duration

gateway/internal/inbound/transport.go

@@ -28,6 +28,9 @@ func (s Server) post(ctx context.Context, path string, payload any, result any)
 		return err
 	}
 	req.Header.Set("Content-Type", "application/json")
+	if strings.HasSuffix(path, "/security-detection") && s.SecurityEventToken != "" {
+		req.Header.Set("X-Security-Event-Token", s.SecurityEventToken)
+	}
 	resp, err := client.Do(req)
 	if err != nil {
 		return err