feat: MeshSafe 文件摆渡安全卫士 v1.0 初始提交
核心功能: - 6 层检测管线: L0 结构分析 → L1 ClamAV → L2 文档深度检测 → L3 关键词匹配 → L4 YARA → L5 PE/二进制 - FastAPI + PostgreSQL + Redis + Docker Compose 架构 - 客户端 HMAC-SHA256 签名鉴权 + 限流 + 幂等性 - 控制台 UI (登录/Dashboard/诊断中心/策略管理/任务列表/测试中心/产品介绍页) - 三层诊断定时器 (error_scan 30s / db_aggregate 30s / container_check 5min) 并发与稳定性修复: - 诊断定时器 Redis 时间槽位锁 (多 worker 同一槽位只有一个执行) - JSONL 存储 fcntl 跨进程排他锁 + 容错解码 + 原子重写 - 移除 SQLite fallback, 统一 PostgreSQL - API_CLIENTS 脱敏为环境变量, .env 已 .gitignore
This commit is contained in:
58
config/diagnostics.yaml
Normal file
58
config/diagnostics.yaml
Normal file
@@ -0,0 +1,58 @@
|
||||
# =============================================================================
|
||||
# MeshSafe Diagnostics Kit v1.0 配置
|
||||
# =============================================================================
|
||||
# 环境变量可覆盖（优先级更高）：
|
||||
# MESHSAFE_DIAG_ENABLED=true|false
|
||||
# MESHSAFE_DIAG_DOCKER=auto|true|false
|
||||
# MESHSAFE_DIAG_ERROR_INTERVAL=30
|
||||
# MESHSAFE_DIAG_CONTAINER_INTERVAL=300
|
||||
# MESHSAFE_DIAG_DB_INTERVAL=60
|
||||
# MESHSAFE_DIAG_STORAGE_ENABLED=true|false
|
||||
# =============================================================================
|
||||
|
||||
diagnostics:
|
||||
# ---------- 总开关 ----------
|
||||
# true = 启动定时器、检测 Docker、运行规则引擎
|
||||
# false = 只保留手动导出功能，所有自动诊断关闭
|
||||
enabled: true
|
||||
|
||||
# ---------- Docker 日志/容器状态能力 ----------
|
||||
# auto = 启动时自动检测 docker.sock 挂载
|
||||
# true = 强制启用，连不上启动报错
|
||||
# false = 强制关闭
|
||||
docker:
|
||||
enabled: auto
|
||||
|
||||
# ---------- 后台定时器周期（秒，0 = 不跑）----------
|
||||
timers:
|
||||
error_scan_interval: 30 # 错误/拦截类日志（R001/R005/R009-R014）
|
||||
container_check_interval: 300 # 容器/引擎类（R002/R003/R004/R015）
|
||||
db_aggregate_interval: 60 # DB 聚合类（R006/R007/R008）
|
||||
|
||||
# ---------- 日志行数控制 ----------
|
||||
docker_log_tail: 500 # 定时器 grep 最近多少行
|
||||
export_log_tail: 2000 # 导出时完整抓多少行
|
||||
|
||||
# ---------- 导出包数据范围 ----------
|
||||
# 所有 DB 查询都按"过去 N 天"过滤，避免导出全库
|
||||
export:
|
||||
db_span_days: 7 # DB 查询时间范围（scan_tasks / findings / errors）
|
||||
scan_tasks_max: 10000 # scan_tasks.json 上限条数（防极端大数据量爆包）
|
||||
scan_findings_max: 50000 # scan_findings.json 上限条数
|
||||
engine_errors_max: 5000 # engine_errors.json 上限条数
|
||||
|
||||
# ---------- 规则阈值 ----------
|
||||
rules:
|
||||
error_ratio_threshold: 0.05 # R001: error > 5% 告警
|
||||
clamav_db_stale_days: 7 # R002: 病毒库 > 7 天告警
|
||||
reject_ratio_threshold: 0.20 # R007: reject > 20% 告警
|
||||
suspicious_exceeds_malicious: true # R006 开关
|
||||
|
||||
# ---------- 持久化存储 ----------
|
||||
# 关闭后回退纯内存模式（定时器结果重启就丢）
|
||||
storage:
|
||||
enabled: true
|
||||
dir: /app/data/diagnostics
|
||||
history_retention_days: 7 # 规则历史保留天数
|
||||
log_snapshot_on_timer: true # 定时器跑完是否也存日志快照
|
||||
log_snapshot_tail: 500 # 定时存的日志行数（节省磁盘）
|
||||
302
config/policy.yaml
Normal file
302
config/policy.yaml
Normal file
@@ -0,0 +1,302 @@
|
||||
# ============================================================
|
||||
# MeshSafe 全局检测策略
|
||||
# 说明：所有裁决逻辑集中在此文件，调整策略无需改动代码。
|
||||
# 修改后调用 POST /api/v1/policies/reload 或重启服务生效。
|
||||
# ============================================================
|
||||
|
||||
version: "2026.10.2"
|
||||
description: "MeshSafe 默认全局策略（麒麟桌面/UOS x86 + WPS 目标终端）"
|
||||
|
||||
# ---------- 全局阈值 ----------
|
||||
global:
|
||||
# 风险分 ≥ 该值直接拒绝
|
||||
block_score: 70
|
||||
# 风险分落在该区间转人工复核
|
||||
review_score: [30, 70]
|
||||
# 引擎不可用时的降级策略：fail_closed（拒绝）/ fail_open（放行）
|
||||
# 生产环境应为 fail_closed，满足等保"安全优先"要求
|
||||
engine_failure_mode: fail_closed
|
||||
# 单文件大小上限（字节）—— 与 ClamAV MaxFileSize=1G 对齐，留余量给其他 5 引擎
|
||||
max_file_size: 1610612736 # 1.5 GB
|
||||
# 同步模式的最大文件大小，超过转异步
|
||||
sync_max_size: 536870912 # 512 MB（超过转异步扫描，避免请求超时）
|
||||
# 是否允许加密压缩包
|
||||
allow_encrypted_archive: false
|
||||
# 是否允许加密文档（Office 加密）
|
||||
allow_encrypted_document: false
|
||||
|
||||
# ================================================================
|
||||
# 零容忍规则集（独立于评分模型，优先级最高）
|
||||
# 命中即 reject，不走评分累加。与 §7.2 步骤 0 对应。
|
||||
# ================================================================
|
||||
|
||||
zero_tolerance_rules:
|
||||
# ---- 跨平台通用载体 ----
|
||||
- PdfJavaScript # PDF 打开即执行脚本
|
||||
- PdfLaunchAction # PDF 打开即启动程序
|
||||
- PdfOpenAction # PDF 打开即执行动作
|
||||
- PathTraversal # 解包路径穿越
|
||||
- IsoWithExecutable # ISO 挂载后内部含可执行
|
||||
- MacroObfuscated # 宏代码混淆/加密（意图不可知）
|
||||
- AttachedTemplate # Office 外部模板注入
|
||||
|
||||
# ---- 宏相关（WPS on Linux 生效）----
|
||||
- VBAAutoExec # VBA 宏 AutoOpen 自动执行入口
|
||||
- VBAAutoExecShell # VBA 宏自动执行 + Shell/CreateObject 调用
|
||||
- MRaptorAutoExec # mraptor 判定为自动执行宏
|
||||
- MRaptorAutoExecSuspicious # mraptor 判定为可疑自动执行宏
|
||||
- DDEAutoExecution # DDE/DDEAUTO 自动执行字段
|
||||
- EmbeddedExecutable # 文档内嵌可执行对象
|
||||
|
||||
# ---- Linux 专属载体 ----
|
||||
- LinuxExecutable # ELF 原生二进制
|
||||
- DesktopFileAutoExec # .desktop 文件 Exec= 字段含危险命令
|
||||
- ShellScriptDangerous # Shell/Python/Perl/Ruby 脚本含危险函数
|
||||
- LinuxPortableExecutable # AppImage/Flatpak/Snap 便携包
|
||||
- ArchiveContainsLinuxExec # 压缩包内混有 .sh/.deb/.run/.bin
|
||||
|
||||
# ---- Windows 专属载体（纵深防御）----
|
||||
- LnkWithAutoExec # LNK 快捷方式（Linux 不识别，保持检测）
|
||||
- ChmWithScript # CHM 帮助文件（Linux 默认不自动执行）
|
||||
|
||||
# ---------- 文件类型白名单 ----------
|
||||
# 只允许这些类型通过。空列表表示不限制（不推荐生产使用）。
|
||||
allowed_extensions:
|
||||
# --- Office 文档 ---
|
||||
- .doc
|
||||
- .docx
|
||||
- .docm
|
||||
- .xls
|
||||
- .xlsx
|
||||
- .xlsm
|
||||
- .ppt
|
||||
- .pptx
|
||||
- .pptm
|
||||
- .rtf
|
||||
- .pdf
|
||||
- .wps # WPS 文字
|
||||
- .et # WPS 表格
|
||||
- .dps # WPS 演示
|
||||
|
||||
# --- 文本与图像 ---
|
||||
- .txt
|
||||
- .csv
|
||||
- .json
|
||||
- .xml
|
||||
- .yaml
|
||||
- .yml
|
||||
- .html
|
||||
- .htm
|
||||
- .md # Markdown（飞书/Notion 导出）
|
||||
- .markdown
|
||||
- .jpg
|
||||
- .jpeg
|
||||
- .png
|
||||
- .gif
|
||||
- .bmp
|
||||
- .tiff
|
||||
- .svg
|
||||
- .webp
|
||||
|
||||
# --- 音视频 ---
|
||||
- .mp4
|
||||
- .mov
|
||||
- .avi
|
||||
- .mkv
|
||||
- .wmv
|
||||
- .flv
|
||||
- .webm
|
||||
- .mp3
|
||||
- .wav
|
||||
- .flac
|
||||
- .m4a
|
||||
|
||||
# --- 脑图/设计 ---
|
||||
- .xmind
|
||||
- .drawio
|
||||
- .vsdx
|
||||
- .bpmn
|
||||
- .epub
|
||||
|
||||
# --- 邮件 ---
|
||||
- .eml
|
||||
- .msg
|
||||
|
||||
# --- 归档（允许进入后递归扫描）---
|
||||
- .zip
|
||||
- .rar
|
||||
- .7z
|
||||
- .tar
|
||||
- .gz
|
||||
- .bz2
|
||||
- .xz
|
||||
- .iso
|
||||
|
||||
# --- 可执行与脚本（零容忍规则拦截，此处允许进入裁决流程）---
|
||||
# 两层防御：零容忍（步骤 0）先拦截，扩展名白名单（步骤 3）作为兜底
|
||||
# 这样策略中临时禁用某个零容忍规则时，文件仍可进入评分裁决
|
||||
- .exe
|
||||
- .dll
|
||||
- .msi
|
||||
- .scr
|
||||
- .com
|
||||
- .elf
|
||||
- .so
|
||||
- .desktop
|
||||
- .appimage
|
||||
- .deb
|
||||
- .rpm
|
||||
- .run
|
||||
- .bin
|
||||
- .snap
|
||||
- .sh
|
||||
- .bash
|
||||
- .zsh
|
||||
- .py
|
||||
- .pl
|
||||
- .rb
|
||||
- .js
|
||||
- .vbs
|
||||
- .bat
|
||||
- .cmd
|
||||
- .ps1
|
||||
- .hta
|
||||
- .lnk
|
||||
- .chm
|
||||
|
||||
# ---------- 需要强制深检的类型 ----------
|
||||
# 一期无沙箱，此配置预留。命中这些类型自动转异步。
|
||||
sandbox_required_extensions:
|
||||
- .exe
|
||||
- .msi
|
||||
- .iso
|
||||
|
||||
# ---------- 特定规则的处置覆盖 ----------
|
||||
# 仅针对未进入零容忍集的规则。零容忍规则已在上方处理，此处不再覆盖。
|
||||
# rule_name: [action, reason_override]
|
||||
# action 取值：pass / pass_with_flag / manual_review / reject / reject_and_notify
|
||||
rule_overrides:
|
||||
VBAShellInvocation:
|
||||
action: manual_review
|
||||
reason: "宏调用 Shell 但无自动执行入口，需人工复核"
|
||||
ArchiveContainsExecutable:
|
||||
action: manual_review
|
||||
reason: "压缩包内含 Windows 可执行文件，转人工确认（Linux 不识别）"
|
||||
ArchiveBombSuspect:
|
||||
action: reject
|
||||
reason: "压缩比异常，疑似压缩炸弹"
|
||||
ExtensionMismatch:
|
||||
action: reject
|
||||
reason: "声明扩展名与真实类型不一致，疑似伪装"
|
||||
DoubleExtension:
|
||||
action: reject
|
||||
reason: "双扩展名伪装，高风险"
|
||||
# ---- 邮件相关 ----
|
||||
EmailAttachmentDangerous:
|
||||
action: manual_review
|
||||
reason: "邮件附件为高风险类型，需人工确认是否为钓鱼/恶意附件"
|
||||
EmailAttachmentDisguised:
|
||||
action: reject
|
||||
reason: "邮件附件存在双扩展名伪装，高风险钓鱼特征"
|
||||
EmailPhishingKeyword:
|
||||
action: manual_review
|
||||
reason: "邮件正文/Subject 命中钓鱼特征，需人工确认"
|
||||
# ---- 加密 ----
|
||||
OfficeEncrypted:
|
||||
action: reject
|
||||
reason: "Office 文档已加密，策略禁止加密文档进入内网"
|
||||
|
||||
# ---------- 通知设置 ----------
|
||||
notification:
|
||||
# 拒绝时是否返回详细原因给调用方（便于摆渡系统向用户提示）
|
||||
include_reason: true
|
||||
# 拒绝原因的最大长度
|
||||
max_reason_length: 500
|
||||
|
||||
# ---------- YARA 规则权重映射 ----------
|
||||
# 按规则名精细设定权重（0-100），覆盖 binary.py 里的默认 weight=50
|
||||
# 命中但不在下列名单中的规则 weight 保持默认值 50
|
||||
# 严重度分档由规则内 meta.risk_level 决定（critical/high/medium/low）
|
||||
yara_rule_weights:
|
||||
critical: # weight=85
|
||||
- C3_PHP_Webshell_Oneliner
|
||||
- C3_JSP_Webshell_RuntimeExec
|
||||
- C3_Webshell_Behinder
|
||||
- C1_PE_ProcessInjection
|
||||
- C8_Ransomware_Encryption
|
||||
- C8_Ransomware_LockBit
|
||||
- C8_Ransomware_BlackCat
|
||||
- C8_Ransomware_Conti
|
||||
- C7_Linux_ReverseShell_Bash
|
||||
- C7_Linux_ReverseShell_NC
|
||||
- C7_Linux_Rootkit_KernelModule
|
||||
high: # weight=65
|
||||
- C3_PHP_Webshell_Obfuscated
|
||||
- C3_PHP_Webshell_VariableDeformation
|
||||
- C3_Webshell_CommandExecutionEcho
|
||||
- C3_Webshell_Godzilla
|
||||
- C1_PE_Downloader_Loader
|
||||
- C1_PE_RAT_CommandControl
|
||||
- C1_PE_LOLBin_Usage
|
||||
- C1_PE_Mutex_Persistence
|
||||
- C7_Linux_ReverseShell_Python
|
||||
- C7_Linux_ReverseShell_Perl
|
||||
- C7_Linux_ReverseShell_Socat
|
||||
- C7_Linux_Persistence_Crontab
|
||||
- C7_Linux_Persistence_SystemD
|
||||
- C7_Linux_Persistence_AuthorizedKeys
|
||||
- C7_Linux_Persistence_LD_PRELOAD
|
||||
- C8_Ransomware_VolumeShadow
|
||||
- C8_Ransomware_Note_Filename
|
||||
- C8_Ransomware_Ryuk_Pseudo
|
||||
medium: # weight=45
|
||||
- C9_Packer_UPX
|
||||
- C9_Packer_Themida_VMP
|
||||
- C1_PE_DLLHijacking
|
||||
- C1_PE_EntropyHighNetwork
|
||||
- C7_Linux_Miner_Generic
|
||||
- C7_Misc_Ruby_Lua_ReverseShell
|
||||
- C7_Network_Tools_Malicious
|
||||
- C3_Webshell_AntSword
|
||||
- C3_Webshell_ASPNET
|
||||
- C3_Webshell_ASP_Classic
|
||||
- C3_JSP_Webshell_Deserialization
|
||||
- C3_JSP_Webshell_MemoryShell
|
||||
- C3_Webshell_CommandExecutionEcho
|
||||
- C8_Ransomware_Extension_Blacklist
|
||||
low: # weight=25
|
||||
- C7_Linux_ReverseShell_Misc
|
||||
|
||||
|
||||
# ---------- 内网特征词表引擎（P1）----------
|
||||
# 规则为数据驱动：在 policy.yaml 中声明，引擎从 PolicyStore 加载。
|
||||
# 控制台 P2 可实时修改并热重载。
|
||||
# 每条规则字段：
|
||||
# name: 规则名（Finding.rule）
|
||||
# match: contains | regex | any_of
|
||||
# pattern: contains/regex 模式的匹配串
|
||||
# keywords: any_of 模式的关键词列表
|
||||
# weight: 评分权重（默认 30）
|
||||
# severity: low | medium | high | critical（默认 medium）
|
||||
# ignore_case: 正则模式是否忽略大小写
|
||||
keyword_rules:
|
||||
# ---- 内网合规特征（辅助判断，不进零容忍）----
|
||||
- name: ClassifiedLevelMarkers
|
||||
match: any_of
|
||||
keywords: ["绝密", "机密", "秘密", "内部文件", "内部资料", "禁止外传"]
|
||||
weight: 25
|
||||
severity: low
|
||||
|
||||
- name: InternalDocumentPatterns
|
||||
match: regex
|
||||
pattern: "(?:国家机密|涉密|密级[：:]\\s*[一二三四五])"
|
||||
ignore_case: true
|
||||
weight: 30
|
||||
severity: medium
|
||||
|
||||
# ---------- 审计 ----------
|
||||
audit:
|
||||
# 记录扫描结果明细到审计日志
|
||||
log_findings: true
|
||||
# 是否记录提取到的子文件路径
|
||||
log_extracted_paths: true
|
||||
Reference in New Issue
Block a user