优化代码，为后续手动管理锁定状态做准备

server/admin/lockmanager.go

@@ -0,0 +1,391 @@
+package admin
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/bjdgyc/anylink/base"
+)
+
+type LockInfo struct {
+	Description string     `json:"description"` // 锁定原因
+	Username    string     `json:"username"`    // 用户名
+	IP          string     `json:"ip"`          // IP 地址
+	State       *LockState `json:"state"`       // 锁定状态信息
+}
+type LockState struct {
+	Locked       bool      `json:"locked"`      // 是否锁定
+	FailureCount int       `json:"attempts"`    // 失败次数
+	LockTime     time.Time `json:"lock_time"`   // 锁定截止时间
+	LastAttempt  time.Time `json:"lastAttempt"` // 最后一次尝试的时间
+}
+type IPWhitelists struct {
+	IP   net.IP
+	CIDR *net.IPNet
+}
+
+type LockManager struct {
+	mu            sync.Mutex
+	LoginStatus   sync.Map                         // 登录状态
+	ipLocks       map[string]*LockState            // 全局IP锁定状态
+	userLocks     map[string]*LockState            // 全局用户锁定状态
+	ipUserLocks   map[string]map[string]*LockState // 单用户IP锁定状态
+	ipWhitelists  []IPWhitelists                   // 全局IP白名单，包含IP地址和CIDR范围
+	cleanupTicker *time.Ticker
+}
+
+var lockmanager *LockManager
+var once sync.Once
+
+func GetLockManager() *LockManager {
+	once.Do(func() {
+		lockmanager = &LockManager{
+			LoginStatus:  sync.Map{},
+			ipLocks:      make(map[string]*LockState),
+			userLocks:    make(map[string]*LockState),
+			ipUserLocks:  make(map[string]map[string]*LockState),
+			ipWhitelists: make([]IPWhitelists, 0),
+		}
+	})
+	return lockmanager
+}
+
+const defaultGlobalLockStateExpirationTime = 3600
+
+func InitLockManager() {
+	lm := GetLockManager()
+	if base.Cfg.AntiBruteForce {
+		if base.Cfg.GlobalLockStateExpirationTime <= 0 {
+			base.Cfg.GlobalLockStateExpirationTime = defaultGlobalLockStateExpirationTime
+		}
+		lm.StartCleanupTicker()
+		lm.InitIPWhitelist()
+	}
+}
+
+func GetLocksInfo(w http.ResponseWriter, r *http.Request) {
+	lm := GetLockManager()
+	locksInfo := lm.GetLocksInfo()
+
+	RespSucess(w, locksInfo)
+}
+
+func UnlockUser(w http.ResponseWriter, r *http.Request) {
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	lockinfo := LockInfo{}
+	if err := json.Unmarshal(body, &lockinfo); err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+
+	if lockinfo.State == nil {
+		RespError(w, RespInternalErr, fmt.Errorf("未找到锁定用户！"))
+		return
+	}
+	lm := GetLockManager()
+
+	lm.mu.Lock()
+	defer lm.mu.Unlock()
+
+	lm.Unlock(lockinfo.State)
+	base.Info("解锁成功:", lockinfo.Description, lockinfo.Username, lockinfo.IP)
+
+	RespSucess(w, "解锁成功！")
+}
+
+func (lm *LockManager) GetLocksInfo() []LockInfo {
+	var locksInfo []LockInfo
+
+	lm.mu.Lock()
+	defer lm.mu.Unlock()
+
+	for ip, state := range lm.ipLocks {
+		if state.Locked {
+			info := LockInfo{
+				Description: "全局 IP 锁定",
+				Username:    "",
+				IP:          ip,
+				State: &LockState{
+					Locked:       state.Locked,
+					FailureCount: state.FailureCount,
+					LockTime:     state.LockTime,
+					LastAttempt:  state.LastAttempt,
+				},
+			}
+			locksInfo = append(locksInfo, info)
+		}
+	}
+
+	for username, state := range lm.userLocks {
+		if state.Locked {
+			info := LockInfo{
+				Description: "全局用户锁定",
+				Username:    username,
+				IP:          "",
+				State: &LockState{
+					Locked:       state.Locked,
+					FailureCount: state.FailureCount,
+					LockTime:     state.LockTime,
+					LastAttempt:  state.LastAttempt,
+				},
+			}
+			locksInfo = append(locksInfo, info)
+		}
+	}
+
+	for username, ipStates := range lm.ipUserLocks {
+		for ip, state := range ipStates {
+			if state.Locked {
+				info := LockInfo{
+					Description: "单用户 IP 锁定",
+					Username:    username,
+					IP:          ip,
+					State: &LockState{
+						Locked:       state.Locked,
+						FailureCount: state.FailureCount,
+						LockTime:     state.LockTime,
+						LastAttempt:  state.LastAttempt,
+					},
+				}
+				locksInfo = append(locksInfo, info)
+			}
+		}
+	}
+	return locksInfo
+}
+
+// 初始化IP白名单
+func (lm *LockManager) InitIPWhitelist() {
+	ipWhitelist := strings.Split(base.Cfg.IPWhitelist, ",")
+	for _, ipWhitelist := range ipWhitelist {
+		ipWhitelist = strings.TrimSpace(ipWhitelist)
+		if ipWhitelist == "" {
+			continue
+		}
+
+		_, ipNet, err := net.ParseCIDR(ipWhitelist)
+		if err == nil {
+			lm.ipWhitelists = append(lm.ipWhitelists, IPWhitelists{CIDR: ipNet})
+			continue
+		}
+
+		ip := net.ParseIP(ipWhitelist)
+		if ip != nil {
+			lm.ipWhitelists = append(lm.ipWhitelists, IPWhitelists{IP: ip})
+			continue
+		}
+	}
+}
+
+// 检查 IP 是否在白名单中
+func (lm *LockManager) IsWhitelisted(ip string) bool {
+	clientIP := net.ParseIP(ip)
+	if clientIP == nil {
+		return false
+	}
+	for _, ipWhitelist := range lm.ipWhitelists {
+		if ipWhitelist.CIDR != nil && ipWhitelist.CIDR.Contains(clientIP) {
+			return true
+		}
+		if ipWhitelist.IP != nil && ipWhitelist.IP.Equal(clientIP) {
+			return true
+		}
+	}
+	return false
+}
+
+func (lm *LockManager) StartCleanupTicker() {
+	lm.cleanupTicker = time.NewTicker(5 * time.Minute)
+	go func() {
+		for range lm.cleanupTicker.C {
+			lm.CleanupExpiredLocks()
+		}
+	}()
+}
+
+// 定期清理过期的锁定
+func (lm *LockManager) CleanupExpiredLocks() {
+	now := time.Now()
+	lm.mu.Lock()
+	defer lm.mu.Unlock()
+
+	for ip, state := range lm.ipLocks {
+		if now.Sub(state.LastAttempt) > time.Duration(base.Cfg.GlobalLockStateExpirationTime)*time.Second {
+			delete(lm.ipLocks, ip)
+		}
+	}
+
+	for user, state := range lm.userLocks {
+		if now.Sub(state.LastAttempt) > time.Duration(base.Cfg.GlobalLockStateExpirationTime)*time.Second {
+			delete(lm.userLocks, user)
+		}
+	}
+
+	for user, ipMap := range lm.ipUserLocks {
+		for ip, state := range ipMap {
+			if now.Sub(state.LastAttempt) > time.Duration(base.Cfg.GlobalLockStateExpirationTime)*time.Second {
+				delete(ipMap, ip)
+				if len(ipMap) == 0 {
+					delete(lm.ipUserLocks, user)
+				}
+			}
+		}
+	}
+}
+
+// 检查全局 IP 锁定
+func (lm *LockManager) CheckGlobalIPLock(ip string, now time.Time) bool {
+	lm.mu.Lock()
+	defer lm.mu.Unlock()
+
+	state, exists := lm.ipLocks[ip]
+	if !exists {
+		return false
+	}
+
+	return lm.CheckLockState(state, now, base.Cfg.GlobalIPBanResetTime)
+}
+
+// 检查全局用户锁定
+func (lm *LockManager) CheckGlobalUserLock(username string, now time.Time) bool {
+	// 我也不知道为什么cisco anyconnect每次连接会先传一个空用户请求····
+	if username == "" {
+		return false
+	}
+	lm.mu.Lock()
+	defer lm.mu.Unlock()
+
+	state, exists := lm.userLocks[username]
+	if !exists {
+		return false
+	}
+	return lm.CheckLockState(state, now, base.Cfg.GlobalUserBanResetTime)
+}
+
+// 检查单个用户的 IP 锁定
+func (lm *LockManager) CheckUserIPLock(username, ip string, now time.Time) bool {
+	// 我也不知道为什么cisco anyconnect每次连接会先传一个空用户请求····
+	if username == "" {
+		return false
+	}
+	lm.mu.Lock()
+	defer lm.mu.Unlock()
+
+	userIPMap, userExists := lm.ipUserLocks[username]
+	if !userExists {
+		return false
+	}
+
+	state, ipExists := userIPMap[ip]
+	if !ipExists {
+		return false
+	}
+
+	return lm.CheckLockState(state, now, base.Cfg.BanResetTime)
+}
+
+// 更新全局 IP 锁定状态
+func (lm *LockManager) UpdateGlobalIPLock(ip string, now time.Time, success bool) {
+	lm.mu.Lock()
+	defer lm.mu.Unlock()
+
+	state, exists := lm.ipLocks[ip]
+	if !exists {
+		state = &LockState{}
+		lm.ipLocks[ip] = state
+	}
+
+	lm.UpdateLockState(state, now, success, base.Cfg.MaxGlobalIPBanCount, base.Cfg.GlobalIPLockTime)
+}
+
+// 更新全局用户锁定状态
+func (lm *LockManager) UpdateGlobalUserLock(username string, now time.Time, success bool) {
+	// 我也不知道为什么cisco anyconnect每次连接会先传一个空用户请求····
+	if username == "" {
+		return
+	}
+	lm.mu.Lock()
+	defer lm.mu.Unlock()
+
+	state, exists := lm.userLocks[username]
+	if !exists {
+		state = &LockState{}
+		lm.userLocks[username] = state
+	}
+
+	lm.UpdateLockState(state, now, success, base.Cfg.MaxGlobalUserBanCount, base.Cfg.GlobalUserLockTime)
+}
+
+// 更新单个用户的 IP 锁定状态
+func (lm *LockManager) UpdateUserIPLock(username, ip string, now time.Time, success bool) {
+	// 我也不知道为什么cisco anyconnect每次连接会先传一个空用户请求····
+	if username == "" {
+		return
+	}
+	lm.mu.Lock()
+	defer lm.mu.Unlock()
+
+	userIPMap, userExists := lm.ipUserLocks[username]
+	if !userExists {
+		userIPMap = make(map[string]*LockState)
+		lm.ipUserLocks[username] = userIPMap
+	}
+
+	state, ipExists := userIPMap[ip]
+	if !ipExists {
+		state = &LockState{}
+		userIPMap[ip] = state
+	}
+
+	lm.UpdateLockState(state, now, success, base.Cfg.MaxBanCount, base.Cfg.LockTime)
+}
+
+// 更新锁定状态
+func (lm *LockManager) UpdateLockState(state *LockState, now time.Time, success bool, maxBanCount, lockTime int) {
+	if success {
+		lm.Unlock(state) // 成功登录后解锁
+	} else {
+		state.FailureCount++
+		if state.FailureCount >= maxBanCount {
+			state.LockTime = now.Add(time.Duration(lockTime) * time.Second)
+			state.Locked = true // 超过阈值时锁定
+		}
+	}
+	state.LastAttempt = now
+}
+
+// 检查锁定状态
+func (lm *LockManager) CheckLockState(state *LockState, now time.Time, resetTime int) bool {
+	if state == nil || state.LastAttempt.IsZero() {
+		return false
+	}
+
+	// 如果超过锁定时间，重置锁定状态
+	if !state.LockTime.IsZero() && now.After(state.LockTime) {
+		lm.Unlock(state) // 锁定期过后解锁
+		return false
+	}
+	// 如果超过窗口时间，重置失败计数
+	if now.Sub(state.LastAttempt) > time.Duration(resetTime)*time.Second {
+		state.FailureCount = 0
+		return false
+	}
+	return state.Locked
+}
+
+// 解锁
+func (lm *LockManager) Unlock(state *LockState) {
+	state.FailureCount = 0
+	state.LockTime = time.Time{}
+	state.Locked = false
+}

server/admin/server.go

@@ -87,6 +87,7 @@ func StartAdmin() {
 	r.HandleFunc("/group/auth_login", GroupAuthLogin)
 
 	r.HandleFunc("/statsinfo/list", StatsInfoList)
+	r.HandleFunc("/locksinfo/list", GetLocksInfo)
 
 	// pprof
 	if base.Cfg.Pprof {

server/handler/antiBruteForce.go

@@ -6,24 +6,15 @@ import (
 	"net"
 	"net/http"
 	"strings"
-	"sync"
 	"time"
 
+	"github.com/bjdgyc/anylink/admin"
 	"github.com/bjdgyc/anylink/base"
 )
 
-const loginStatusKey = "login_status"
+var lockManager = admin.GetLockManager()
-const defaultGlobalLockStateExpirationTime = 3600
 
-func initAntiBruteForce() {
+const loginStatusKey = "login_status"
-	if base.Cfg.AntiBruteForce {
-		if base.Cfg.GlobalLockStateExpirationTime <= 0 {
-			base.Cfg.GlobalLockStateExpirationTime = defaultGlobalLockStateExpirationTime
-		}
-		lockManager.startCleanupTicker()
-		lockManager.initIPWhitelist()
-	}
-}
 
 // 防爆破中间件
 func antiBruteForce(next http.Handler) http.Handler {
@@ -71,43 +62,28 @@ func antiBruteForce(next http.Handler) http.Handler {
 
 		now := time.Now()
 		// 检查IP是否在白名单中
-		if lockManager.isWhitelisted(ip) {
+		if lockManager.IsWhitelisted(ip) {
 			r.Body = io.NopCloser(strings.NewReader(string(body)))
 			next.ServeHTTP(w, r)
 			return
 		}
 
-		// // 速率限制
-		// lockManager.mu.RLock()
-		// limiter, exists := lockManager.rateLimiter[ip]
-		// if !exists {
-		// 	limiter = rate.NewLimiter(rate.Limit(base.Cfg.RateLimit), base.Cfg.Burst)
-		// 	lockManager.rateLimiter[ip] = limiter
-		// }
-		// lockManager.mu.RUnlock()
-
-		// if !limiter.Allow() {
-		// 	log.Printf("Rate limit exceeded for IP %s. Try again later.", ip)
-		// 	http.Error(w, "Rate limit exceeded. Try again later.", http.StatusTooManyRequests)
-		// 	return
-		// }
-
 		// 检查全局 IP 锁定
-		if base.Cfg.MaxGlobalIPBanCount > 0 && lockManager.checkGlobalIPLock(ip, now) {
+		if base.Cfg.MaxGlobalIPBanCount > 0 && lockManager.CheckGlobalIPLock(ip, now) {
 			base.Warn("IP", ip, "is globally locked. Try again later.")
 			http.Error(w, "Account globally locked due to too many failed attempts. Try again later.", http.StatusTooManyRequests)
 			return
 		}
 
 		// 检查全局用户锁定
-		if base.Cfg.MaxGlobalUserBanCount > 0 && lockManager.checkGlobalUserLock(username, now) {
+		if base.Cfg.MaxGlobalUserBanCount > 0 && lockManager.CheckGlobalUserLock(username, now) {
 			base.Warn("User", username, "is globally locked. Try again later.")
 			http.Error(w, "Account globally locked due to too many failed attempts. Try again later.", http.StatusTooManyRequests)
 			return
 		}
 
 		// 检查单个用户的 IP 锁定
-		if base.Cfg.MaxBanCount > 0 && lockManager.checkUserIPLock(username, ip, now) {
+		if base.Cfg.MaxBanCount > 0 && lockManager.CheckUserIPLock(username, ip, now) {
 			base.Warn("IP", ip, "is locked for user", username, "Try again later.")
 			http.Error(w, "Account locked due to too many failed attempts. Try again later.", http.StatusTooManyRequests)
 			return
@@ -120,285 +96,15 @@ func antiBruteForce(next http.Handler) http.Handler {
 		next.ServeHTTP(w, r)
 
 		// 检查登录状态
-		Status, _ := lockManager.loginStatus.Load(loginStatusKey)
+		Status, _ := lockManager.LoginStatus.Load(loginStatusKey)
 		loginStatus, _ := Status.(bool)
 
 		// 更新用户登录状态
-		lockManager.updateGlobalIPLock(ip, now, loginStatus)
+		lockManager.UpdateGlobalIPLock(ip, now, loginStatus)
-		lockManager.updateGlobalUserLock(username, now, loginStatus)
+		lockManager.UpdateGlobalUserLock(username, now, loginStatus)
-		lockManager.updateUserIPLock(username, ip, now, loginStatus)
+		lockManager.UpdateUserIPLock(username, ip, now, loginStatus)
 
 		// 清除登录状态
-		lockManager.loginStatus.Delete(loginStatusKey)
+		lockManager.LoginStatus.Delete(loginStatusKey)
 	})
 }
-
-type LockState struct {
-	FailureCount int
-	LockTime     time.Time
-	LastAttempt  time.Time
-}
-type IPWhitelists struct {
-	IP   net.IP
-	CIDR *net.IPNet
-}
-
-type LockManager struct {
-	mu           sync.Mutex
-	loginStatus  sync.Map                         // 登录状态
-	ipLocks      map[string]*LockState            // 全局IP锁定状态
-	userLocks    map[string]*LockState            // 全局用户锁定状态
-	ipUserLocks  map[string]map[string]*LockState // 单用户IP锁定状态
-	ipWhitelists []IPWhitelists                   // 全局IP白名单，包含IP地址和CIDR范围
-	// rateLimiter   map[string]*rate.Limiter         // 速率限制器
-	cleanupTicker *time.Ticker
-}
-
-var lockManager = &LockManager{
-	loginStatus:  sync.Map{},
-	ipLocks:      make(map[string]*LockState),
-	userLocks:    make(map[string]*LockState),
-	ipUserLocks:  make(map[string]map[string]*LockState),
-	ipWhitelists: make([]IPWhitelists, 0),
-	// rateLimiter: make(map[string]*rate.Limiter),
-}
-
-// 初始化IP白名单
-func (lm *LockManager) initIPWhitelist() {
-	ipWhitelist := strings.Split(base.Cfg.IPWhitelist, ",")
-	for _, ipWhitelist := range ipWhitelist {
-		ipWhitelist = strings.TrimSpace(ipWhitelist)
-		if ipWhitelist == "" {
-			continue
-		}
-
-		_, ipNet, err := net.ParseCIDR(ipWhitelist)
-		if err == nil {
-			lm.ipWhitelists = append(lm.ipWhitelists, IPWhitelists{CIDR: ipNet})
-			continue
-		}
-
-		ip := net.ParseIP(ipWhitelist)
-		if ip != nil {
-			lm.ipWhitelists = append(lm.ipWhitelists, IPWhitelists{IP: ip})
-			continue
-		}
-	}
-}
-
-// 检查 IP 是否在白名单中
-func (lm *LockManager) isWhitelisted(ip string) bool {
-	clientIP := net.ParseIP(ip)
-	if clientIP == nil {
-		return false
-	}
-	for _, ipWhitelist := range lm.ipWhitelists {
-		if ipWhitelist.CIDR != nil && ipWhitelist.CIDR.Contains(clientIP) {
-			return true
-		}
-		if ipWhitelist.IP != nil && ipWhitelist.IP.Equal(clientIP) {
-			return true
-		}
-	}
-	return false
-}
-
-func (lm *LockManager) startCleanupTicker() {
-	lm.cleanupTicker = time.NewTicker(5 * time.Minute)
-	go func() {
-		for range lm.cleanupTicker.C {
-			lm.cleanupExpiredLocks()
-		}
-	}()
-}
-
-// 定期清理过期的锁定
-func (lm *LockManager) cleanupExpiredLocks() {
-	now := time.Now()
-
-	var ipKeys, userKeys []string
-	var IPuserKeys []struct{ user, ip string }
-
-	lm.mu.Lock()
-	for ip, state := range lm.ipLocks {
-		if now.Sub(state.LastAttempt) > time.Duration(base.Cfg.GlobalLockStateExpirationTime)*time.Second {
-			ipKeys = append(ipKeys, ip)
-		}
-	}
-
-	for user, state := range lm.userLocks {
-		if now.Sub(state.LastAttempt) > time.Duration(base.Cfg.GlobalLockStateExpirationTime)*time.Second {
-			userKeys = append(userKeys, user)
-		}
-	}
-
-	for user, ipMap := range lm.ipUserLocks {
-		for ip, state := range ipMap {
-			if now.Sub(state.LastAttempt) > time.Duration(base.Cfg.GlobalLockStateExpirationTime)*time.Second {
-				IPuserKeys = append(IPuserKeys, struct{ user, ip string }{user, ip})
-			}
-		}
-	}
-	lm.mu.Unlock()
-
-	lm.mu.Lock()
-	for _, ip := range ipKeys {
-		delete(lm.ipLocks, ip)
-	}
-	for _, user := range userKeys {
-		delete(lm.userLocks, user)
-	}
-	for _, key := range IPuserKeys {
-		delete(lm.ipUserLocks[key.user], key.ip)
-		if len(lm.ipUserLocks[key.user]) == 0 {
-			delete(lm.ipUserLocks, key.user)
-		}
-	}
-	lm.mu.Unlock()
-}
-
-// 检查全局 IP 锁定
-func (lm *LockManager) checkGlobalIPLock(ip string, now time.Time) bool {
-	lm.mu.Lock()
-	defer lm.mu.Unlock()
-
-	state, exists := lm.ipLocks[ip]
-	if !exists {
-		return false
-	}
-
-	return lm.checkLockState(state, now, base.Cfg.GlobalIPBanResetTime)
-}
-
-// 检查全局用户锁定
-func (lm *LockManager) checkGlobalUserLock(username string, now time.Time) bool {
-	// 我也不知道为什么cisco anyconnect每次连接会先传一个空用户请求····
-	if username == "" {
-		return false
-	}
-	lm.mu.Lock()
-	defer lm.mu.Unlock()
-
-	state, exists := lm.userLocks[username]
-	if !exists {
-		return false
-	}
-	return lm.checkLockState(state, now, base.Cfg.GlobalUserBanResetTime)
-}
-
-// 检查单个用户的 IP 锁定
-func (lm *LockManager) checkUserIPLock(username, ip string, now time.Time) bool {
-	// 我也不知道为什么cisco anyconnect每次连接会先传一个空用户请求····
-	if username == "" {
-		return false
-	}
-	lm.mu.Lock()
-	defer lm.mu.Unlock()
-
-	userIPMap, userExists := lm.ipUserLocks[username]
-	if !userExists {
-		return false
-	}
-
-	state, ipExists := userIPMap[ip]
-	if !ipExists {
-		return false
-	}
-
-	return lm.checkLockState(state, now, base.Cfg.BanResetTime)
-}
-
-// 更新全局 IP 锁定状态
-func (lm *LockManager) updateGlobalIPLock(ip string, now time.Time, success bool) {
-	lm.mu.Lock()
-	defer lm.mu.Unlock()
-
-	state, exists := lm.ipLocks[ip]
-	if !exists {
-		state = &LockState{}
-		lm.ipLocks[ip] = state
-	}
-
-	lm.updateLockState(state, now, success, base.Cfg.MaxGlobalIPBanCount, base.Cfg.GlobalIPLockTime)
-}
-
-// 更新全局用户锁定状态
-func (lm *LockManager) updateGlobalUserLock(username string, now time.Time, success bool) {
-	// 我也不知道为什么cisco anyconnect每次连接会先传一个空用户请求····
-	if username == "" {
-		return
-	}
-	lm.mu.Lock()
-	defer lm.mu.Unlock()
-
-	state, exists := lm.userLocks[username]
-	if !exists {
-		state = &LockState{}
-		lm.userLocks[username] = state
-	}
-
-	lm.updateLockState(state, now, success, base.Cfg.MaxGlobalUserBanCount, base.Cfg.GlobalUserLockTime)
-}
-
-// 更新单个用户的 IP 锁定状态
-func (lm *LockManager) updateUserIPLock(username, ip string, now time.Time, success bool) {
-	// 我也不知道为什么cisco anyconnect每次连接会先传一个空用户请求····
-	if username == "" {
-		return
-	}
-	lm.mu.Lock()
-	defer lm.mu.Unlock()
-
-	userIPMap, userExists := lm.ipUserLocks[username]
-	if !userExists {
-		userIPMap = make(map[string]*LockState)
-		lm.ipUserLocks[username] = userIPMap
-	}
-
-	state, ipExists := userIPMap[ip]
-	if !ipExists {
-		state = &LockState{}
-		userIPMap[ip] = state
-	}
-
-	lm.updateLockState(state, now, success, base.Cfg.MaxBanCount, base.Cfg.LockTime)
-}
-
-// 更新锁定状态
-func (lm *LockManager) updateLockState(state *LockState, now time.Time, success bool, maxBanCount, lockTime int) {
-	if success {
-		state.FailureCount = 0
-		state.LockTime = time.Time{}
-	} else {
-		state.FailureCount++
-		if state.FailureCount >= maxBanCount {
-			state.LockTime = now.Add(time.Duration(lockTime) * time.Second)
-		}
-	}
-	state.LastAttempt = now
-}
-
-// 检查锁定状态
-func (lm *LockManager) checkLockState(state *LockState, now time.Time, resetTime int) bool {
-	if state == nil || state.LastAttempt.IsZero() {
-		return false
-	}
-
-	// 如果超过锁定时间，重置锁定状态
-	if !state.LockTime.IsZero() && now.After(state.LockTime) {
-		state.FailureCount = 0
-		state.LockTime = time.Time{}
-		return false
-	}
-	// 如果超过窗口时间，重置失败计数
-	if now.Sub(state.LastAttempt) > time.Duration(resetTime)*time.Second {
-		state.FailureCount = 0
-		state.LockTime = time.Time{}
-		return false
-	}
-	// 如果锁定时间还在有效期内，继续锁定
-	if !state.LockTime.IsZero() && now.Before(state.LockTime) {
-		return true
-	}
-	return false
-}

server/handler/link_auth.go

@@ -94,7 +94,7 @@ func LinkAuth(w http.ResponseWriter, r *http.Request) {
 	// TODO 用户密码校验
 	err = dbdata.CheckUser(cr.Auth.Username, cr.Auth.Password, cr.GroupSelect)
 	if err != nil {
-		lockManager.loginStatus.Store(loginStatusKey, false) // 记录登录失败状态
+		lockManager.LoginStatus.Store(loginStatusKey, false) // 记录登录失败状态
 		base.Warn(err, r.RemoteAddr)
 		ua.Info = err.Error()
 		ua.Status = dbdata.UserAuthFail
@@ -119,7 +119,7 @@ func LinkAuth(w http.ResponseWriter, r *http.Request) {
 	}
 	// 用户otp验证
 	if !v.DisableOtp {
-		lockManager.loginStatus.Store(loginStatusKey, true) // 重置OTP验证计数
+		lockManager.LoginStatus.Store(loginStatusKey, true) // 重置OTP验证计数
 		sessionID, err := GenerateSessionID()
 		if err != nil {
 			base.Error("Failed to generate session ID: ", err)

server/handler/link_auth_otp.go

@@ -110,7 +110,7 @@ func DeleteCookie(w http.ResponseWriter, name string) {
 	http.SetCookie(w, cookie)
 }
 func CreateSession(w http.ResponseWriter, r *http.Request, authSession *AuthSession) {
-	lockManager.loginStatus.Store(loginStatusKey, true) // 更新登录成功状态
+	lockManager.LoginStatus.Store(loginStatusKey, true) // 更新登录成功状态
 
 	cr := authSession.ClientRequest
 	ua := authSession.UserActLog
@@ -202,7 +202,7 @@ func LinkAuth_otp(w http.ResponseWriter, r *http.Request) {
 			http.Error(w, "TooManyError, please login again", http.StatusBadRequest)
 			return
 		}
-		lockManager.loginStatus.Store(loginStatusKey, false) // 记录登录失败状态
+		lockManager.LoginStatus.Store(loginStatusKey, false) // 记录登录失败状态
 
 		base.Warn("OTP 动态码错误", username, r.RemoteAddr)
 		ua.Info = "OTP 动态码错误"

server/handler/start.go

@@ -17,7 +17,7 @@ func Start() {
 	sessdata.Start()
 	cron.Start()
 
-	initAntiBruteForce() //初始化防爆破定时器和IP白名单
+	admin.InitLockManager() //初始化防爆破定时器和IP白名单
 
 	// 开启服务器转发
 	err := execCmd([]string{"sysctl -w net.ipv4.ip_forward=1"})