migrate

Wavelet/internal/apps/openflare/waf/ip_group_sync.go

@@ -0,0 +1,475 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package waf
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/netip"
+	"strings"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/apps/openflare/agent"
+	"github.com/Rain-kl/Wavelet/internal/apps/openflare/websocket"
+	"github.com/Rain-kl/Wavelet/internal/model"
+
+	exprlang "github.com/expr-lang/expr"
+	"github.com/expr-lang/expr/vm"
+)
+
+const maxWAFIPGroupSubscriptionBytes = 2 * 1024 * 1024
+
+type ipGroupAutoRuleEnv struct {
+	IP               string  `expr:"ip"`
+	RequestCount     int     `expr:"request_count"`
+	Status404Count   int     `expr:"status_404_count"`
+	Status404Ratio   float64 `expr:"status_404_ratio"`
+	IPHostCount      int     `expr:"ip_host_count"`
+	IPHostRatio      float64 `expr:"ip_host_ratio"`
+	ClientErrorCount int     `expr:"client_error_count"`
+	ServerErrorCount int     `expr:"server_error_count"`
+	LastSeenUnix     int64   `expr:"last_seen_unix"`
+	statusCounts     map[int]int
+}
+
+func (env ipGroupAutoRuleEnv) StatusCount(code int) int {
+	if env.statusCounts == nil {
+		return 0
+	}
+	return env.statusCounts[code]
+}
+
+func (env ipGroupAutoRuleEnv) StatusRatio(code int) float64 {
+	if env.RequestCount <= 0 || env.statusCounts == nil {
+		return 0.0
+	}
+	return float64(env.statusCounts[code]) / float64(env.RequestCount)
+}
+
+type ipGroupAutoAccumulator struct {
+	ip               string
+	requestCount     int
+	status404Count   int
+	ipHostCount      int
+	clientErrorCount int
+	serverErrorCount int
+	lastSeen         time.Time
+	statusCounts     map[int]int
+}
+
+// SyncDueWAFIPGroups syncs all enabled automatic/subscription IP groups that are due.
+func SyncDueWAFIPGroups(ctx context.Context) error {
+	now := time.Now().UTC()
+	groups, err := model.ListDueOpenFlareWAFIPGroups(ctx, now)
+	if err != nil {
+		return err
+	}
+	for _, group := range groups {
+		if _, err := syncOpenFlareWAFIPGroup(ctx, group, now); err != nil {
+			continue
+		}
+	}
+	return nil
+}
+
+func syncOpenFlareWAFIPGroup(ctx context.Context, group *model.OpenFlareWAFIPGroup, now time.Time) (*IPGroupSyncResult, error) {
+	if group == nil {
+		return nil, errors.New("IP 组不存在")
+	}
+	switch group.Type {
+	case wafIPGroupTypeSubscription:
+		return syncIPGroupSubscription(ctx, group, now)
+	case wafIPGroupTypeAutomatic:
+		return syncIPGroupAutomatic(ctx, group, now)
+	default:
+		return nil, errors.New("只有自动和订阅类型 IP 组支持同步")
+	}
+}
+
+func syncIPGroupSubscription(ctx context.Context, group *model.OpenFlareWAFIPGroup, now time.Time) (*IPGroupSyncResult, error) {
+	content, err := downloadIPGroupSubscription(group.SubscriptionURL)
+	if err != nil {
+		recordIPGroupSyncFailure(ctx, group, now, err)
+		return nil, err
+	}
+	ips, err := parseIPGroupSubscription(content, group.SubscriptionFormat, group.SubscriptionMappingRule)
+	if err != nil {
+		recordIPGroupSyncFailure(ctx, group, now, err)
+		return nil, err
+	}
+	ipListJSON, _ := json.Marshal(ips)
+	nextSyncAt := now.Add(time.Duration(group.SyncIntervalMinutes) * time.Minute)
+	group.IPList = string(ipListJSON)
+	group.LastSyncedAt = &now
+	group.NextSyncAt = &nextSyncAt
+	group.LastSyncStatus = "success"
+	group.LastSyncMessage = fmt.Sprintf("同步成功，共 %d 条 IP/IP 段", len(ips))
+	if err := model.UpdateOpenFlareWAFIPGroupSyncResult(ctx, group); err != nil {
+		return nil, err
+	}
+	broadcastIPGroupToAgents(ctx, group.ID)
+	view, err := GetIPGroup(ctx, group.ID)
+	if err != nil {
+		return nil, err
+	}
+	return &IPGroupSyncResult{
+		Group:      *view,
+		IPCount:    len(ips),
+		SyncedAt:   now.Format(time.RFC3339),
+		NextSyncAt: nextSyncAt.Format(time.RFC3339),
+		Status:     group.LastSyncStatus,
+		Message:    group.LastSyncMessage,
+	}, nil
+}
+
+func syncIPGroupAutomatic(ctx context.Context, group *model.OpenFlareWAFIPGroup, now time.Time) (*IPGroupSyncResult, error) {
+	config, err := parseIPGroupAutoConfig(json.RawMessage(group.AutoConfig))
+	if err != nil {
+		recordIPGroupSyncFailure(ctx, group, now, err)
+		return nil, err
+	}
+
+	var existingExtIPs []ipGroupExtIP
+	if group.ExtIPs != "" && group.ExtIPs != "[]" {
+		_ = json.Unmarshal([]byte(group.ExtIPs), &existingExtIPs)
+	}
+
+	activeExtIPs := make([]ipGroupExtIP, 0, len(existingExtIPs))
+	for _, extIP := range existingExtIPs {
+		if config.TTL > 0 {
+			expirationTime := extIP.CapturedAt.Add(time.Duration(config.TTL) * time.Second)
+			if expirationTime.Before(now) {
+				continue
+			}
+		}
+		activeExtIPs = append(activeExtIPs, extIP)
+	}
+
+	ips, err := evaluateParsedIPGroupAutoConfig(ctx, config, now)
+	if err != nil {
+		recordIPGroupSyncFailure(ctx, group, now, err)
+		return nil, err
+	}
+
+	extIPMap := make(map[string]int)
+	for idx, extIP := range activeExtIPs {
+		extIPMap[extIP.IP] = idx
+	}
+
+	for _, ip := range ips {
+		if idx, ok := extIPMap[ip]; ok {
+			activeExtIPs[idx].CapturedAt = now
+		} else {
+			activeExtIPs = append(activeExtIPs, ipGroupExtIP{
+				IP:         ip,
+				CapturedAt: now,
+			})
+		}
+	}
+
+	finalIPs := make([]string, 0, len(activeExtIPs))
+	for _, extIP := range activeExtIPs {
+		finalIPs = append(finalIPs, extIP.IP)
+	}
+	finalIPs, err = normalizeIPList(finalIPs)
+	if err != nil {
+		recordIPGroupSyncFailure(ctx, group, now, err)
+		return nil, err
+	}
+
+	extIPsJSON, _ := json.Marshal(activeExtIPs)
+	ipListJSON, _ := json.Marshal(finalIPs)
+
+	nextSyncAt := now.Add(time.Duration(normalizeIPGroupSyncInterval(group.SyncIntervalMinutes)) * time.Minute)
+	group.IPList = string(ipListJSON)
+	group.ExtIPs = string(extIPsJSON)
+	group.LastSyncedAt = &now
+	group.NextSyncAt = &nextSyncAt
+	group.LastSyncStatus = "success"
+	group.LastSyncMessage = fmt.Sprintf("自动规则执行成功，共命中 %d 个 IP，当前生效 %d 个 IP", len(ips), len(finalIPs))
+	if err := model.UpdateOpenFlareWAFIPGroupSyncResult(ctx, group); err != nil {
+		return nil, err
+	}
+	broadcastIPGroupToAgents(ctx, group.ID)
+	view, err := GetIPGroup(ctx, group.ID)
+	if err != nil {
+		return nil, err
+	}
+	return &IPGroupSyncResult{
+		Group:      *view,
+		IPCount:    len(finalIPs),
+		SyncedAt:   now.Format(time.RFC3339),
+		NextSyncAt: nextSyncAt.Format(time.RFC3339),
+		Status:     group.LastSyncStatus,
+		Message:    group.LastSyncMessage,
+	}, nil
+}
+
+func recordIPGroupSyncFailure(ctx context.Context, group *model.OpenFlareWAFIPGroup, now time.Time, syncErr error) {
+	nextSyncAt := now.Add(time.Duration(normalizeIPGroupSyncInterval(group.SyncIntervalMinutes)) * time.Minute)
+	group.LastSyncedAt = &now
+	group.NextSyncAt = &nextSyncAt
+	group.LastSyncStatus = "failed"
+	group.LastSyncMessage = syncErr.Error()
+	_ = model.UpdateOpenFlareWAFIPGroupSyncResult(ctx, group)
+}
+
+func evaluateParsedIPGroupAutoConfig(ctx context.Context, config ipGroupAutoConfig, now time.Time) ([]string, error) {
+	if len(config.Rules) == 0 {
+		return []string{}, nil
+	}
+	programs := make([]*vm.Program, 0, len(config.Rules))
+	for i, rule := range config.Rules {
+		program, err := exprlang.Compile(rule.Expr, exprlang.Env(ipGroupAutoRuleEnv{}), exprlang.AsBool())
+		if err != nil {
+			return nil, fmt.Errorf("自动规则 %s Expr 无效: %w", displayIPGroupAutoRuleName(rule, i), err)
+		}
+		programs = append(programs, program)
+	}
+	logs, err := model.ListOpenFlareAccessLogsForWAFIPGroup(ctx, model.OpenFlareAccessLogQuery{
+		Since: now.Add(-time.Duration(config.LookbackMinutes) * time.Minute),
+		Until: now,
+	})
+	if err != nil {
+		return nil, err
+	}
+	accumulators := make(map[string]*ipGroupAutoAccumulator)
+	for _, item := range logs {
+		if item == nil {
+			continue
+		}
+		ip, ok := normalizeIPLiteral(item.RemoteAddr)
+		if !ok {
+			continue
+		}
+		acc := accumulators[ip]
+		if acc == nil {
+			acc = &ipGroupAutoAccumulator{
+				ip:           ip,
+				statusCounts: make(map[int]int),
+			}
+			accumulators[ip] = acc
+		}
+		acc.requestCount++
+		acc.statusCounts[item.StatusCode]++
+		if item.StatusCode == http.StatusNotFound {
+			acc.status404Count++
+		}
+		if item.StatusCode >= 400 && item.StatusCode < 500 {
+			acc.clientErrorCount++
+		}
+		if item.StatusCode >= 500 {
+			acc.serverErrorCount++
+		}
+		if hostIsIPLiteral(item.Host) {
+			acc.ipHostCount++
+		}
+		if item.LoggedAt.After(acc.lastSeen) {
+			acc.lastSeen = item.LoggedAt
+		}
+	}
+	matched := make([]string, 0)
+	for _, acc := range accumulators {
+		env := acc.toExprEnv()
+		for _, program := range programs {
+			output, err := exprlang.Run(program, env)
+			if err != nil {
+				return nil, fmt.Errorf("执行自动规则失败: %w", err)
+			}
+			if matchedRule, ok := output.(bool); ok && matchedRule {
+				matched = append(matched, acc.ip)
+				break
+			}
+		}
+	}
+	return normalizeIPList(matched)
+}
+
+func (acc *ipGroupAutoAccumulator) toExprEnv() ipGroupAutoRuleEnv {
+	env := ipGroupAutoRuleEnv{
+		IP:               acc.ip,
+		RequestCount:     acc.requestCount,
+		Status404Count:   acc.status404Count,
+		IPHostCount:      acc.ipHostCount,
+		ClientErrorCount: acc.clientErrorCount,
+		ServerErrorCount: acc.serverErrorCount,
+		statusCounts:     acc.statusCounts,
+	}
+	if acc.requestCount > 0 {
+		env.Status404Ratio = float64(acc.status404Count) / float64(acc.requestCount)
+		env.IPHostRatio = float64(acc.ipHostCount) / float64(acc.requestCount)
+	}
+	if !acc.lastSeen.IsZero() {
+		env.LastSeenUnix = acc.lastSeen.Unix()
+	}
+	return env
+}
+
+func displayIPGroupAutoRuleName(rule ipGroupAutoRule, index int) string {
+	if rule.Name != "" {
+		return rule.Name
+	}
+	return fmt.Sprintf("#%d", index+1)
+}
+
+func normalizeIPLiteral(value string) (string, bool) {
+	host := strings.TrimSpace(value)
+	if host == "" {
+		return "", false
+	}
+	if parsedHost, _, err := net.SplitHostPort(host); err == nil {
+		host = parsedHost
+	}
+	host = strings.Trim(host, "[]")
+	addr, err := netip.ParseAddr(host)
+	if err != nil {
+		return "", false
+	}
+	return addr.String(), true
+}
+
+func hostIsIPLiteral(value string) bool {
+	_, ok := normalizeIPLiteral(value)
+	return ok
+}
+
+func downloadIPGroupSubscription(rawURL string) ([]byte, error) {
+	if err := validateSubscriptionURL(rawURL); err != nil {
+		return nil, err
+	}
+	client := http.Client{Timeout: 15 * time.Second}
+	resp, err := client.Get(rawURL)
+	if err != nil {
+		return nil, fmt.Errorf("下载订阅失败: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("订阅返回状态码 %d", resp.StatusCode)
+	}
+	var buffer bytes.Buffer
+	reader := io.LimitReader(resp.Body, maxWAFIPGroupSubscriptionBytes+1)
+	if _, err := buffer.ReadFrom(reader); err != nil {
+		return nil, fmt.Errorf("读取订阅内容失败: %w", err)
+	}
+	if buffer.Len() > maxWAFIPGroupSubscriptionBytes {
+		return nil, fmt.Errorf("订阅内容不能超过 %d 字节", maxWAFIPGroupSubscriptionBytes)
+	}
+	return buffer.Bytes(), nil
+}
+
+func parseIPGroupSubscription(content []byte, format string, mappingRule string) ([]string, error) {
+	switch normalizeIPGroupSubscriptionFormat(format) {
+	case wafIPGroupSubscriptionFormatJSON:
+		items, err := parseIPGroupJSONSubscription(content, mappingRule)
+		if err != nil {
+			return nil, err
+		}
+		return normalizeIPList(items)
+	default:
+		return normalizeIPList(parseIPGroupTextSubscription(string(content)))
+	}
+}
+
+func parseIPGroupTextSubscription(text string) []string {
+	lines := strings.Split(text, "\n")
+	items := make([]string, 0, len(lines))
+	for _, line := range lines {
+		item := strings.TrimSpace(line)
+		if item == "" || strings.HasPrefix(item, "#") {
+			continue
+		}
+		items = append(items, item)
+	}
+	return items
+}
+
+func parseIPGroupJSONSubscription(content []byte, mappingRule string) ([]string, error) {
+	var payload any
+	if err := json.Unmarshal(content, &payload); err != nil {
+		return nil, fmt.Errorf("JSON 订阅解析失败: %w", err)
+	}
+	nodes, err := selectJSONMappingNodes(payload, mappingRule)
+	if err != nil {
+		return nil, err
+	}
+	items := make([]string, 0, len(nodes))
+	for _, node := range nodes {
+		collectJSONStrings(node, &items)
+	}
+	if len(items) == 0 {
+		return nil, errors.New("JSON 订阅没有解析到 IP/IP 段")
+	}
+	return items, nil
+}
+
+func selectJSONMappingNodes(payload any, mappingRule string) ([]any, error) {
+	rule := strings.TrimSpace(mappingRule)
+	if rule == "" || rule == "$" {
+		return []any{payload}, nil
+	}
+	rule = strings.TrimPrefix(rule, "$.")
+	nodes := []any{payload}
+	for _, rawSegment := range strings.Split(rule, ".") {
+		segment := strings.TrimSpace(rawSegment)
+		if segment == "" {
+			continue
+		}
+		expandArray := strings.HasSuffix(segment, "[]")
+		segment = strings.TrimSuffix(segment, "[]")
+		next := make([]any, 0)
+		for _, node := range nodes {
+			object, ok := node.(map[string]any)
+			if !ok {
+				continue
+			}
+			value, ok := object[segment]
+			if !ok {
+				continue
+			}
+			if expandArray {
+				array, ok := value.([]any)
+				if !ok {
+					continue
+				}
+				next = append(next, array...)
+			} else {
+				next = append(next, value)
+			}
+		}
+		nodes = next
+	}
+	if len(nodes) == 0 {
+		return nil, fmt.Errorf("JSON 映射规则 %q 未匹配到内容", mappingRule)
+	}
+	return nodes, nil
+}
+
+func collectJSONStrings(node any, items *[]string) {
+	switch value := node.(type) {
+	case string:
+		*items = append(*items, value)
+	case []any:
+		for _, item := range value {
+			collectJSONStrings(item, items)
+		}
+	}
+}
+
+func broadcastIPGroupToAgents(ctx context.Context, id uint) {
+	groups, err := agent.WAFIPGroupsForAgent(ctx, []uint{id})
+	if err != nil || len(groups) == 0 {
+		if err != nil {
+			slog.Debug("build waf ip group broadcast payload failed", "id", id, "error", err)
+		}
+		return
+	}
+	websocket.BroadcastWAFIPGroups(groups)
+}

Wavelet/internal/apps/openflare/waf/ip_group_sync_test.go

@@ -0,0 +1,208 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package waf
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+	"github.com/Rain-kl/Wavelet/internal/model"
+	"github.com/glebarez/sqlite"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+)
+
+func setupIPGroupSyncTestDB(t *testing.T) func() {
+	t.Helper()
+
+	sqliteDB, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{
+		DisableForeignKeyConstraintWhenMigrating: true,
+	})
+	require.NoError(t, err)
+	require.NoError(t, sqliteDB.AutoMigrate(
+		&model.OpenFlareWAFRuleGroup{},
+		&model.OpenFlareWAFIPGroup{},
+		&model.OpenFlareAccessLog{},
+	))
+
+	db.SetDB(sqliteDB)
+	return func() {
+		db.SetDB(nil)
+	}
+}
+
+func TestParseIPGroupSubscriptionParsers(t *testing.T) {
+	textItems, err := parseIPGroupSubscription([]byte("# comment\n203.0.113.10\n\n198.51.100.0/24\n"), "text", "")
+	require.NoError(t, err)
+	require.Len(t, textItems, 2)
+	assert.Equal(t, "198.51.100.0/24", textItems[0])
+	assert.Equal(t, "203.0.113.10", textItems[1])
+
+	jsonItems, err := parseIPGroupSubscription([]byte(`{"data":{"items":[{"ip":"203.0.113.11"},{"ip":"203.0.113.12"}]}}`), "json", "data.items[].ip")
+	require.NoError(t, err)
+	require.Len(t, jsonItems, 2)
+	assert.Equal(t, "203.0.113.11", jsonItems[0])
+	assert.Equal(t, "203.0.113.12", jsonItems[1])
+}
+
+func TestSyncIPGroupDownloadsSubscription(t *testing.T) {
+	cleanup := setupIPGroupSyncTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("203.0.113.20\n"))
+	}))
+	defer server.Close()
+
+	group, err := CreateIPGroup(ctx, IPGroupInput{
+		Name:                "subscription",
+		Type:                wafIPGroupTypeSubscription,
+		Enabled:             true,
+		SubscriptionURL:     server.URL,
+		SubscriptionFormat:  wafIPGroupSubscriptionFormatText,
+		SyncIntervalMinutes: 10,
+	})
+	require.NoError(t, err)
+
+	result, err := SyncIPGroup(ctx, group.ID)
+	require.NoError(t, err)
+	require.Equal(t, 1, result.IPCount)
+	assert.Equal(t, "203.0.113.20", result.Group.IPList[0])
+	assert.Equal(t, "success", result.Status)
+}
+
+func TestSyncIPGroupAutomaticExprRules(t *testing.T) {
+	cleanup := setupIPGroupSyncTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	now := time.Now().UTC()
+	seedWAFAccessLogs(t, ctx, now, "203.0.113.10", "app.example.com", 101, 81)
+	seedWAFAccessLogs(t, ctx, now, "203.0.113.11", "198.51.100.10", 60, 0)
+	seedWAFAccessLogs(t, ctx, now, "203.0.113.12", "app.example.com", 120, 10)
+
+	group, err := CreateIPGroup(ctx, IPGroupInput{
+		Name:    "auto blacklist",
+		Type:    wafIPGroupTypeAutomatic,
+		Enabled: true,
+		AutoConfig: json.RawMessage(`{
+			"lookback_minutes": 60,
+			"rules": [
+				{"name":"单 IP 404 高频扫描","expr":"request_count > 100 && StatusRatio(404) >= 0.8"},
+				{"name":"单 IP 直连访问异常","expr":"ip_host_count > 50 && ip_host_ratio > 0.5"}
+			]
+		}`),
+	})
+	require.NoError(t, err)
+
+	result, err := SyncIPGroup(ctx, group.ID)
+	require.NoError(t, err)
+	require.Equal(t, 2, result.IPCount)
+
+	want := map[string]bool{"203.0.113.10": true, "203.0.113.11": true}
+	for _, item := range result.Group.IPList {
+		assert.True(t, want[item], "unexpected matched IP %s", item)
+		delete(want, item)
+	}
+	assert.Empty(t, want)
+}
+
+func TestTestIPGroupAutoConfigReturnsMatchedIPs(t *testing.T) {
+	cleanup := setupIPGroupSyncTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	now := time.Now().UTC()
+	seedWAFAccessLogs(t, ctx, now, "203.0.113.10", "app.example.com", 101, 81)
+	seedWAFAccessLogs(t, ctx, now, "203.0.113.11", "198.51.100.10", 60, 0)
+	seedWAFAccessLogs(t, ctx, now, "203.0.113.12", "app.example.com", 120, 10)
+
+	result, err := TestIPGroupAutoConfig(ctx, IPGroupAutoTestInput{
+		AutoConfig: json.RawMessage(`{
+			"lookback_minutes": 60,
+			"rules": [
+				{"name":"单 IP 404 高频扫描","expr":"request_count > 100 && StatusRatio(404) >= 0.8"},
+				{"name":"单 IP 直连访问异常","expr":"ip_host_count > 50 && ip_host_ratio > 0.5"}
+			]
+		}`),
+	})
+	require.NoError(t, err)
+	assert.Equal(t, 2, result.MatchedCount)
+	assert.Equal(t, 2, result.RuleCount)
+	assert.Equal(t, 60, result.LookbackMinutes)
+
+	want := map[string]bool{"203.0.113.10": true, "203.0.113.11": true}
+	for _, item := range result.MatchedIPs {
+		assert.True(t, want[item], "unexpected matched IP %s", item)
+		delete(want, item)
+	}
+	assert.Empty(t, want)
+}
+
+func TestListDueOpenFlareWAFIPGroups(t *testing.T) {
+	cleanup := setupIPGroupSyncTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	past := time.Now().UTC().Add(-time.Hour)
+	future := time.Now().UTC().Add(time.Hour)
+
+	dueAuto := &model.OpenFlareWAFIPGroup{
+		Name: "due auto", Type: wafIPGroupTypeAutomatic, Enabled: true,
+		IPList: "[]", AutoConfig: "{}", ExtIPs: "[]", NextSyncAt: &past,
+	}
+	require.NoError(t, model.CreateOpenFlareWAFIPGroup(ctx, dueAuto))
+
+	futureAuto := &model.OpenFlareWAFIPGroup{
+		Name: "future auto", Type: wafIPGroupTypeAutomatic, Enabled: true,
+		IPList: "[]", AutoConfig: "{}", ExtIPs: "[]", NextSyncAt: &future,
+	}
+	require.NoError(t, model.CreateOpenFlareWAFIPGroup(ctx, futureAuto))
+
+	dueSub := &model.OpenFlareWAFIPGroup{
+		Name: "due sub", Type: wafIPGroupTypeSubscription, Enabled: true,
+		IPList: "[]", AutoConfig: "{}", ExtIPs: "[]",
+		SubscriptionURL: "https://example.com/list", NextSyncAt: &past,
+	}
+	require.NoError(t, model.CreateOpenFlareWAFIPGroup(ctx, dueSub))
+
+	manual := &model.OpenFlareWAFIPGroup{
+		Name: "manual", Type: wafIPGroupTypeManual, Enabled: true,
+		IPList: "[]", AutoConfig: "{}", ExtIPs: "[]", NextSyncAt: &past,
+	}
+	require.NoError(t, model.CreateOpenFlareWAFIPGroup(ctx, manual))
+
+	groups, err := model.ListDueOpenFlareWAFIPGroups(ctx, time.Now().UTC())
+	require.NoError(t, err)
+	require.Len(t, groups, 2)
+	ids := []uint{groups[0].ID, groups[1].ID}
+	assert.Contains(t, ids, dueAuto.ID)
+	assert.Contains(t, ids, dueSub.ID)
+}
+
+func seedWAFAccessLogs(t *testing.T, ctx context.Context, loggedAt time.Time, remoteAddr string, host string, total int, notFound int) {
+	t.Helper()
+	for i := 0; i < total; i++ {
+		statusCode := http.StatusOK
+		if i < notFound {
+			statusCode = http.StatusNotFound
+		}
+		require.NoError(t, db.DB(ctx).Create(&model.OpenFlareAccessLog{
+			NodeID:     "node-waf-auto",
+			LoggedAt:   loggedAt.Add(-time.Duration(i%30) * time.Second),
+			RemoteAddr: remoteAddr,
+			Host:       host,
+			Path:       "/probe",
+			StatusCode: statusCode,
+		}).Error)
+	}
+}

Wavelet/internal/apps/openflare/waf/logics.go

@@ -18,6 +18,8 @@ import (
 	"unicode"
 
 	"github.com/Rain-kl/Wavelet/internal/model"
+
+	exprlang "github.com/expr-lang/expr"
 	"gorm.io/gorm"
 )
 
@@ -486,39 +488,29 @@ func DeleteIPGroup(ctx context.Context, id uint) error {
 	return model.DeleteOpenFlareWAFIPGroup(ctx, group.ID)
 }
 
-// SyncIPGroup is a stub that returns a successful sync result.
+// SyncIPGroup synchronizes a subscription or automatic WAF IP group.
 func SyncIPGroup(ctx context.Context, id uint) (*IPGroupSyncResult, error) {
 	group, err := model.GetOpenFlareWAFIPGroupByID(ctx, id)
 	if err != nil {
 		return nil, err
 	}
-	now := time.Now().UTC()
-	view, err := GetIPGroup(ctx, id)
-	if err != nil {
-		return nil, err
-	}
-	nextSyncAt := now.Add(time.Duration(normalizeIPGroupSyncInterval(group.SyncIntervalMinutes)) * time.Minute)
-	return &IPGroupSyncResult{
-		Group:      *view,
-		IPCount:    len(view.IPList),
-		SyncedAt:   now.Format(time.RFC3339),
-		NextSyncAt: nextSyncAt.Format(time.RFC3339),
-		Status:     "success",
-		Message:    "同步成功",
-	}, nil
+	return syncOpenFlareWAFIPGroup(ctx, group, time.Now().UTC())
 }
 
-// TestIPGroupAutoConfig is a stub that validates config and returns an empty match set.
+// TestIPGroupAutoConfig evaluates automatic IP group rules against recent access logs.
 func TestIPGroupAutoConfig(ctx context.Context, input IPGroupAutoTestInput) (*IPGroupAutoTestResult, error) {
-	_ = ctx
 	config, err := parseIPGroupAutoConfig(input.AutoConfig)
 	if err != nil {
 		return nil, err
 	}
 	now := time.Now().UTC()
+	ips, err := evaluateParsedIPGroupAutoConfig(ctx, config, now)
+	if err != nil {
+		return nil, err
+	}
 	return &IPGroupAutoTestResult{
-		MatchedIPs:      []string{},
-		MatchedCount:    0,
+		MatchedIPs:      ips,
+		MatchedCount:    len(ips),
 		LookbackMinutes: config.LookbackMinutes,
 		RuleCount:       len(config.Rules),
 		TestedAt:        now.Format(time.RFC3339),
@@ -1104,6 +1096,9 @@ func parseIPGroupAutoConfig(raw json.RawMessage) (ipGroupAutoConfig, error) {
 		if rule.Expr == "" {
 			return ipGroupAutoConfig{}, fmt.Errorf("自动规则 %d 的 Expr 表达式不能为空", i+1)
 		}
+		if _, err := exprlang.Compile(rule.Expr, exprlang.Env(ipGroupAutoRuleEnv{}), exprlang.AsBool()); err != nil {
+			return ipGroupAutoConfig{}, fmt.Errorf("自动规则 %s Expr 无效: %w", displayIPGroupAutoRuleName(rule, i), err)
+		}
 		config.Rules[i] = rule
 	}
 	return config, nil

Wavelet/internal/apps/openflare/waf/register_tasks.go

@@ -0,0 +1,12 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package waf
+
+import (
+	oftasks "github.com/Rain-kl/Wavelet/internal/apps/openflare/tasks"
+)
+
+func init() {
+	oftasks.RegisterWAFIPGroupSync(SyncDueWAFIPGroups)
+}