Merge pull request #214 from shizunge/dependabot/github_actions/actions/checkout-7

Bump actions/checkout from 6 to 7

.github/workflows/docker-hub-description.yml

@@ -12,9 +12,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Update Docker Hub description
-        uses: peter-evans/dockerhub-description@v3
+        uses: peter-evans/dockerhub-description@v5
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}

.github/workflows/on-pull-request.yml

@@ -0,0 +1,66 @@
+name: On pull request
+
+on:
+  pull_request:
+    branches:
+      - 'main'
+    paths-ignore:
+      - 'dashboard/*'
+      - 'examples/*'
+      - 'README.md'
+      - 'LICENSE'
+  workflow_dispatch:
+
+env:
+  PLATFORMS: "linux/amd64,linux/arm64,linux/arm/v7"
+  
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.26.1'
+          cache: true
+
+      - name: Install dependencies
+        run: go mod download
+
+      - name: Run Tests
+        run: go test -v ./...
+
+  build_container_image:
+    name: Build Docker image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4.1.0
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            ghcr.io/${{ github.repository }}-development
+          tags: |
+            type=raw,value=dev-{{date 'X'}}
+            type=raw,value=latest
+            type=ref,event=branch
+            type=edge,branch=main
+      - name: Build 
+        uses: docker/build-push-action@v7.2.0
+        with:
+          platforms: ${{ env.PLATFORMS }}
+          push: false
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          provenance: false
+
+

.github/workflows/on-push-main.yml

@@ -1,80 +0,0 @@
-name: On push to main
-
-on:
-  push:
-    branches:
-      - main
-
-env:
-  PLATFORMS: "linux/amd64,linux/arm64,linux/arm/v7"
-  
-jobs:
-  build_and_push:
-    name: Build and push Docker image
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-      - name: Login to docker hub
-        uses: docker/login-action@v3.0.0
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_PASSWORD }}
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3.0.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ github.token }}
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            ${{ github.repository }}
-            ghcr.io/${{ github.repository }}
-          tags: |
-            type=raw,value=dev-{{date 'X'}}
-            type=raw,value=development
-            type=ref,event=branch
-            type=edge,branch=main
-      - name: Build and push ${{ github.repository }}:${{ steps.git.outputs.image_tag }}
-        uses: docker/build-push-action@v5.1.0
-        with:
-          platforms: ${{ env.PLATFORMS }}
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          provenance: false
-
-  clean-ghcr:
-    name: Delete old dev container images
-    runs-on: ubuntu-latest
-    steps:
-      - name: Delete old dev images
-        uses: snok/container-retention-policy@v2
-        with:
-          image-names: endlessh-go
-          cut-off: One day ago UTC
-          account-type: personal
-          token: ${{ secrets.TOKEN_DELETE_GHCR_IMAGES }}
-          keep-at-least: 5
-          skip-tags: latest, development
-          filter-tags: "dev-*"
-          dry-run: False
-      - name: Delete untagged images
-        uses: snok/container-retention-policy@v2
-        with:
-          image-names: endlessh-go
-          cut-off: One hour ago UTC
-          account-type: personal
-          token: ${{ secrets.TOKEN_DELETE_GHCR_IMAGES }}
-          keep-at-least: 0
-          untagged-only: True
-          skip-tags: latest, development
-          dry-run: False
-

.github/workflows/on-push.yml

@@ -0,0 +1,79 @@
+name: On push
+
+on:
+  push:
+    branches-ignore:
+      - 'release'
+      - 'dependabot/**'
+    paths-ignore:
+      - 'dashboard/*'
+      - 'examples/*'
+      - 'README.md'
+      - 'LICENSE'
+  workflow_dispatch:
+
+env:
+  PLATFORMS: "linux/amd64,linux/arm64,linux/arm/v7"
+  
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.26.1'
+          cache: true
+
+      - name: Install dependencies
+        run: go mod download
+
+      - name: Run Tests
+        run: go test -v ./...
+  build_and_push:
+    name: Build and push Docker image
+    runs-on: ubuntu-latest
+    if: ${{ github.actor != 'dependabot[bot]' }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4.1.0
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4.2.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v4.2.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ github.token }}
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            ${{ github.repository }}-development
+            ghcr.io/${{ github.repository }}-development
+          tags: |
+            type=raw,value=dev-{{date 'X'}}
+            type=raw,value=latest
+            type=ref,event=branch
+            type=edge,branch=main
+      - name: Build and push ${{ github.repository }}:${{ steps.git.outputs.image_tag }}
+        uses: docker/build-push-action@v7.2.0
+        with:
+          platforms: ${{ env.PLATFORMS }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          provenance: false
+
+

.github/workflows/on-release.yml

@@ -13,25 +13,25 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
+        uses: docker/setup-buildx-action@v4.1.0
       - name: Login to docker hub
-        uses: docker/login-action@v3.0.0
+        uses: docker/login-action@v4.2.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3.0.0
+        uses: docker/login-action@v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ github.token }}
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             ${{ github.repository }}
@@ -40,7 +40,7 @@ jobs:
             type=ref,event=branch
             type=ref,event=tag
       - name: Build and push
-        uses: docker/build-push-action@v5.1.0
+        uses: docker/build-push-action@v7.2.0
         with:
           platforms: ${{ env.PLATFORMS }}
           push: true

.gitignore

@@ -0,0 +1 @@
+endlessh-go

README.md

@@ -1,5 +1,12 @@
 # endlessh-go
 
+[![Release](https://img.shields.io/github/release/shizunge/endlessh-go.svg?label=Release)](https://github.com/shizunge/endlessh-go/releases/latest)
+[![License](https://img.shields.io/badge/License-GPLv3-blue)](https://github.com/shizunge/endlessh-go/blob/main/LICENSE)
+[![Image Size](https://img.shields.io/docker/image-size/shizunge/endlessh-go/latest.svg?label=Image%20Size)](https://hub.docker.com/r/shizunge/endlessh-go)
+[![Docker Pulls](https://img.shields.io/docker/pulls/shizunge/endlessh-go.svg?label=Docker%20Pulls&logo=Docker)](https://hub.docker.com/r/shizunge/endlessh-go)
+[![Build](https://img.shields.io/github/actions/workflow/status/shizunge/endlessh-go/on-push.yml?label=Build&branch=main&logo=GitHub)](https://github.com/shizunge/endlessh-go/actions/workflows/on-push.yml)
+[![CodeFactor Grade](https://img.shields.io/codefactor/grade/github/shizunge/endlessh-go?label=CodeFactor&logo=CodeFactor)](https://www.codefactor.io/repository/github/shizunge/endlessh-go)
+
 A golang implementation of [endlessh](https://nullprogram.com/blog/2019/03/22/) exporting Prometheus metrics, visualized by a Grafana dashboard.
 
 ![screenshot](https://github.com/shizunge/endlessh-go/raw/main/dashboard/screenshot.png)
@@ -22,7 +29,7 @@ go build .
 Alternatively, you can use the [docker image](https://hub.docker.com/r/shizunge/endlessh-go):
 
 ```
-sudo docker run -d -p 2222:2222 shizunge/endlessh-go -logtostderr -v=1
+docker run -d -p 2222:2222 shizunge/endlessh-go -logtostderr -v=1
 ```
 
 It listens to port `2222` by default.
@@ -61,22 +68,32 @@ Usage of ./endlessh-go
         when logging hits line file:N, emit a stack trace
   -log_dir string
         If non-empty, write log files in this directory
+  -log_link string
+        If non-empty, add symbolic links in this directory to the log files
+  -logbuflevel int
+        Buffer log messages logged at this level or lower (-1 means don't buffer; 0 means buffer INFO only; ...). Has limited applicability on non-prod platforms.
   -logtostderr
         log to standard error instead of files
   -max_clients int
         Maximum number of clients (default 4096)
   -max_mind_db string
         Path to the MaxMind DB file.
-  -port string
-        SSH listening port (default "2222")
+  -port value
+        SSH listening port. You may provide multiple -port flags to listen to multiple ports. (default "2222")
+  -prometheus_clean_unseen_seconds int
+        Remove series if the IP is not seen for the given time. Set to 0 to disable. (default 0)
   -prometheus_entry string
         Entry point for prometheus (default "metrics")
   -prometheus_host string
         The address for prometheus (default "0.0.0.0")
   -prometheus_port string
         The port for prometheus (default "2112")
+  -proxy_protocol_enabled
+        Enable PROXY protocol support. This causes the server to expect PROXY protocol headers on incoming connections.
+  -proxy_protocol_read_header_timeout_ms int
+        Timeout for reading the PROXY protocol header in milliseconds. If the connection does not send a valid PROXY protocol header in this time, the header is ignored. (default 200)
   -stderrthreshold value
-        logs at or above this threshold go to stderr
+        logs at or above this threshold go to stderr (default 2)
   -v value
         log level for V logs
   -vmodule value
@@ -93,8 +110,8 @@ Endlessh-go exports the following Prometheus metrics.
 | endlessh_client_closed_count_total   | count | Total number of clients that stopped connecting to this host. |
 | endlessh_sent_bytes_total            | count | Total bytes sent to clients that tried to connect to this host. |
 | endlessh_trapped_time_seconds_total  | count | Total seconds clients spent on endlessh. |
-| endlessh_client_open_count           | count | Number of connections of clients. <br> Labels: <br> <ul><li> `ip`: IP of the client </li> <li>  `country`: Country of the IP </li> <li>  `location`: Country, Region, and City </li> <li>  `geohash`: Geohash of the location </li></ul> |
-| endlessh_client_trapped_time_seconds | count | Seconds a client spends on endlessh. <br> Labels: <br> <ul><li>  `ip`: IP of the client </li></ul> |
+| endlessh_client_open_count           | count | Number of connections of clients. <br> Labels: <br> <ul><li> `ip`: Remote IP of the client </li> <li> `local_port`: Local port the program listens to </li> <li> `country`: Country of the IP </li> <li> `location`: Country, Region, and City </li> <li> `geohash`: Geohash of the location </li></ul> |
+| endlessh_client_trapped_time_seconds | count | Seconds a client spends on endlessh. <br> Labels: <br> <ul><li> `ip`: Remote IP of the client </li> <li> `local_port`: Local port the program listens to </li></ul> |
 
 The metrics is off by default, you can turn it via the CLI argument `-enable_prometheus`.
 

client.go

@@ -1,111 +0,0 @@
-// Copyright (C) 2021 Shizun Ge
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License
-// along with this program.  If not, see <https://www.gnu.org/licenses/>.
-//
-
-package main
-
-import (
-	"math/rand"
-	"net"
-	"sync/atomic"
-	"time"
-
-	"github.com/golang/glog"
-	"github.com/prometheus/client_golang/prometheus"
-)
-
-var letterBytes = []byte(" abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890!@#$%^&*()-=_+[]{}|;:',./<>?")
-
-func randStringBytes(n int64) []byte {
-	b := make([]byte, n+1)
-	for i := range b {
-		b[i] = letterBytes[rand.Intn(len(letterBytes))]
-	}
-	b[n] = '\n'
-	return b
-}
-
-type client struct {
-	conn              net.Conn
-	last              time.Time
-	next              time.Time
-	start             time.Time
-	interval          time.Duration
-	geoipSupplier     string
-	geohash           string
-	country           string
-	location          string
-	bytesSent         int
-	prometheusEnabled bool
-}
-
-func NewClient(conn net.Conn, interval time.Duration, maxClient int64, geoipSupplier string, prometheusEnabled bool) *client {
-	addr := conn.RemoteAddr().(*net.TCPAddr)
-	atomic.AddInt64(&numCurrentClients, 1)
-	atomic.AddInt64(&numTotalClients, 1)
-	geohash, country, location, err := geohashAndLocation(addr.IP.String(), geoipSupplier)
-	if err != nil {
-		glog.Warningf("Failed to obatin the geohash of %v: %v.", addr.IP, err)
-	}
-	if prometheusEnabled {
-		clientIP.With(prometheus.Labels{
-			"ip":       addr.IP.String(),
-			"geohash":  geohash,
-			"country":  country,
-			"location": location}).Inc()
-	}
-	glog.V(1).Infof("ACCEPT host=%v port=%v n=%v/%v\n", addr.IP, addr.Port, numCurrentClients, maxClient)
-	return &client{
-		conn:              conn,
-		last:              time.Now(),
-		next:              time.Now().Add(interval),
-		start:             time.Now(),
-		interval:          interval,
-		geohash:           geohash,
-		country:           country,
-		location:          location,
-		bytesSent:         0,
-		prometheusEnabled: prometheusEnabled,
-	}
-}
-
-func (c *client) Send(bannerMaxLength int64) error {
-	defer func(c *client) {
-		addr := c.conn.RemoteAddr().(*net.TCPAddr)
-		millisecondsSpent := time.Now().Sub(c.last).Milliseconds()
-		c.last = time.Now()
-		c.next = time.Now().Add(c.interval)
-		atomic.AddInt64(&numTotalMilliseconds, millisecondsSpent)
-		if c.prometheusEnabled {
-			clientSeconds.With(prometheus.Labels{"ip": addr.IP.String()}).Add(float64(millisecondsSpent) / 1000)
-		}
-	}(c)
-	length := rand.Int63n(bannerMaxLength)
-	bytesSent, err := c.conn.Write(randStringBytes(length))
-	if err != nil {
-		return err
-	}
-	c.bytesSent += bytesSent
-	atomic.AddInt64(&numTotalBytes, int64(bytesSent))
-	return nil
-}
-
-func (c *client) Close() {
-	addr := c.conn.RemoteAddr().(*net.TCPAddr)
-	atomic.AddInt64(&numCurrentClients, -1)
-	atomic.AddInt64(&numTotalClientsClosed, 1)
-	glog.V(1).Infof("CLOSE host=%v port=%v time=%v bytes=%v\n", addr.IP, addr.Port, time.Now().Sub(c.start).Seconds(), c.bytesSent)
-	c.conn.Close()
-}

client/client.go

@@ -0,0 +1,123 @@
+// Copyright (C) 2021-2026 Shizun Ge
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+//
+
+package client
+
+import (
+	"math/rand"
+	"net"
+	"strconv"
+	"sync/atomic"
+	"time"
+
+	"github.com/golang/glog"
+)
+
+var (
+	numCurrentClients int64
+	letterBytes       = []byte(" abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890!@#$%^&*()-=_+[]{}|;:',./<>?")
+)
+
+func randStringBytes(n int64) []byte {
+	b := make([]byte, n+1)
+	for i := range b {
+		b[i] = letterBytes[rand.Intn(len(letterBytes))]
+	}
+	b[n] = '\n'
+	return b
+}
+
+type Client struct {
+	conn      net.Conn
+	next      time.Time
+	start     time.Time
+	last      time.Time
+	interval  time.Duration
+	bytesSent int
+}
+
+func NewClient(conn net.Conn, interval time.Duration, maxClients int64) *Client {
+	for numCurrentClients >= maxClients {
+		time.Sleep(interval)
+	}
+	atomic.AddInt64(&numCurrentClients, 1)
+	// Enable TCP keepalive to detect dead peers at the kernel level.
+	// This is a safety net for long intervals where the write deadline
+	// alone would be too slow to detect dead connections. For example,
+	// with interval=10min, without keepalive a ghost connection would
+	// go undetected for 10+ minutes.
+	// Keepalive cannot detect peers that are alive at the TCP level
+	// (kernel still responds to probes) but stalled at the application
+	// level — the write deadline in Send() covers that case.
+	// Detection time: ~idle + 9 probes (e.g. 10s + 9×10s ≈ 100s on Linux).
+	if tcpConn, ok := conn.(*net.TCPConn); ok {
+		tcpConn.SetKeepAlive(true)
+		keepalive := interval
+		if keepalive > 30*time.Second {
+			keepalive = 30 * time.Second
+		}
+		tcpConn.SetKeepAlivePeriod(keepalive)
+	}
+	addr := conn.RemoteAddr().(*net.TCPAddr)
+	glog.V(1).Infof("ACCEPT host=%v port=%v n=%v/%v\n", addr.IP, addr.Port, numCurrentClients, maxClients)
+	return &Client{
+		conn:      conn,
+		next:      time.Now().Add(interval),
+		start:     time.Now(),
+		last:      time.Now(),
+		interval:  interval,
+		bytesSent: 0,
+	}
+}
+
+func (c *Client) RemoteIpAddr() string {
+	return c.conn.RemoteAddr().(*net.TCPAddr).IP.String()
+}
+
+func (c *Client) LocalPort() string {
+	return strconv.Itoa(c.conn.LocalAddr().(*net.TCPAddr).Port)
+}
+
+func (c *Client) Send(bannerMaxLength int64) (int, error) {
+	if time.Now().Before(c.next) {
+		time.Sleep(c.next.Sub(time.Now()))
+	}
+	c.next = time.Now().Add(c.interval)
+	length := rand.Int63n(bannerMaxLength)
+	// Set a write deadline to detect dead connections where the kernel
+	// buffers data but the remote peer is gone. Without this, Write()
+	// can succeed indefinitely on dead connections, causing goroutine leaks.
+	c.conn.SetWriteDeadline(time.Now().Add(c.interval))
+	bytesSent, err := c.conn.Write(randStringBytes(length))
+	if err != nil {
+		return 0, err
+	}
+	c.bytesSent += bytesSent
+	return bytesSent, nil
+}
+
+func (c *Client) MillisecondsSinceLast() int64 {
+	millisecondsSpent := time.Now().Sub(c.last).Milliseconds()
+	c.last = time.Now()
+	return millisecondsSpent
+}
+
+func (c *Client) Close() {
+	addr := c.conn.RemoteAddr().(*net.TCPAddr)
+	glog.V(1).Infof("CLOSE host=%v port=%v time=%v bytes=%v\n", addr.IP, addr.Port, time.Now().Sub(c.start).Seconds(), c.bytesSent)
+	c.conn.Close()
+	atomic.AddInt64(&numCurrentClients, -1)
+}

dashboard/endlessh.json

@@ -21,7 +21,7 @@
       "type": "grafana",
       "id": "grafana",
       "name": "Grafana",
-      "version": "10.3.0-64399"
+      "version": "12.3.0-18356121373.patch9"
     },
     {
       "type": "panel",
@@ -76,10 +76,9 @@
       }
     ]
   },
-  "description": "Dashboard for endlessh (Load metrics at the first panel instead of the last panel)",
+  "description": "Dashboard for endlessh (Add ports selection)",
   "editable": false,
   "fiscalYearStartMonth": 0,
-  "gnetId": 15156,
   "graphTooltip": 0,
   "id": null,
   "links": [
@@ -108,7 +107,6 @@
       "url": "https://grafana.com/grafana/dashboards/15156"
     }
   ],
-  "liveNow": false,
   "panels": [
     {
       "datasource": {
@@ -126,7 +124,7 @@
             "steps": [
               {
                 "color": "green",
-                "value": null
+                "value": 0
               }
             ]
           }
@@ -147,6 +145,7 @@
         "graphMode": "none",
         "justifyMode": "auto",
         "orientation": "auto",
+        "percentChangeColorMode": "standard",
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
@@ -154,11 +153,12 @@
           "fields": "/^Total number connections that endlessh trapped$/",
           "values": false
         },
+        "showPercentChange": false,
         "text": {},
         "textMode": "auto",
         "wideLayout": true
       },
-      "pluginVersion": "10.3.0-64399",
+      "pluginVersion": "12.3.0-18356121373.patch9",
       "targets": [
         {
           "datasource": {
@@ -166,7 +166,7 @@
             "uid": "${DS_PROMETHEUS}"
           },
           "editorMode": "code",
-          "expr": "(endlessh_client_open_count{instance=~\"$host\",job=~\"$job\"} - endlessh_client_open_count{instance=~\"$host\",job=~\"$job\"} offset $__interval) > 0 or (endlessh_client_open_count{instance=~\"$host\",job=~\"$job\"}!=0 unless endlessh_client_open_count{instance=~\"$host\",job=~\"$job\"} offset $__interval)",
+          "expr": "(endlessh_client_open_count{instance=~\"$host\", local_port=~\"$port\",job=~\"$job\"} - endlessh_client_open_count{instance=~\"$host\",local_port=~\"$port\",job=~\"$job\"} offset $__interval) > 0 or (endlessh_client_open_count{instance=~\"$host\",local_port=~\"$port\",job=~\"$job\"}!=0 unless endlessh_client_open_count{instance=~\"$host\",local_port=~\"$port\",job=~\"$job\"} offset $__interval)",
           "format": "table",
           "instant": false,
           "legendFormat": "Seen {{ip}}",
@@ -179,7 +179,7 @@
             "uid": "${DS_PROMETHEUS}"
           },
           "editorMode": "code",
-          "expr": "(endlessh_client_trapped_time_seconds{instance=~\"$host\",job=~\"$job\"} - endlessh_client_trapped_time_seconds{instance=~\"$host\",job=~\"$job\"} offset $__interval) > 0 or (endlessh_client_trapped_time_seconds{instance=~\"$host\",job=~\"$job\"}!=0 unless endlessh_client_trapped_time_seconds{instance=~\"$host\",job=~\"$job\"} offset $__interval)",
+          "expr": "(endlessh_client_trapped_time_seconds{instance=~\"$host\",local_port=~\"$port\",job=~\"$job\"} - endlessh_client_trapped_time_seconds{instance=~\"$host\",local_port=~\"$port\",job=~\"$job\"} offset $__interval) > 0 or (endlessh_client_trapped_time_seconds{instance=~\"$host\",local_port=~\"$port\",job=~\"$job\"}!=0 unless endlessh_client_trapped_time_seconds{instance=~\"$host\",local_port=~\"$port\",job=~\"$job\"} offset $__interval)",
           "format": "table",
           "hide": false,
           "instant": false,
@@ -271,7 +271,7 @@
             "steps": [
               {
                 "color": "green",
-                "value": null
+                "value": 0
               }
             ]
           },
@@ -291,6 +291,7 @@
         "graphMode": "none",
         "justifyMode": "auto",
         "orientation": "auto",
+        "percentChangeColorMode": "standard",
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
@@ -298,11 +299,12 @@
           "fields": "/^Time spent on endlessh$/",
           "values": false
         },
+        "showPercentChange": false,
         "text": {},
         "textMode": "auto",
         "wideLayout": true
       },
-      "pluginVersion": "10.3.0-64399",
+      "pluginVersion": "12.3.0-18356121373.patch9",
       "targets": [
         {
           "datasource": {
@@ -397,7 +399,7 @@
             "steps": [
               {
                 "color": "green",
-                "value": null
+                "value": 0
               }
             ]
           },
@@ -417,6 +419,7 @@
         "graphMode": "none",
         "justifyMode": "auto",
         "orientation": "auto",
+        "percentChangeColorMode": "standard",
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
@@ -424,22 +427,25 @@
           "fields": "",
           "values": false
         },
+        "showPercentChange": false,
         "text": {},
         "textMode": "auto",
         "wideLayout": true
       },
-      "pluginVersion": "10.3.0-64399",
+      "pluginVersion": "12.3.0-18356121373.patch9",
       "targets": [
         {
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
+          "editorMode": "code",
           "exemplar": true,
-          "expr": "sum(increase(endlessh_sent_bytes_total{instance=~\"$host\",job=~\"$job\"}[$__range]))",
+          "expr": "sum(increase(endlessh_sent_bytes_total{instance=~\"$host\",local_port=~\"$port\",job=~\"$job\"}[$__range]))",
           "hide": false,
           "interval": "",
           "legendFormat": "Bytes sent by endlessh",
+          "range": true,
           "refId": "sent_bytes"
         }
       ],
@@ -462,7 +468,7 @@
             "steps": [
               {
                 "color": "green",
-                "value": null
+                "value": 0
               }
             ]
           }
@@ -481,6 +487,7 @@
         "graphMode": "none",
         "justifyMode": "auto",
         "orientation": "auto",
+        "percentChangeColorMode": "standard",
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
@@ -488,11 +495,12 @@
           "fields": "/^Unique IPs connected$/",
           "values": false
         },
+        "showPercentChange": false,
         "text": {},
         "textMode": "auto",
         "wideLayout": true
       },
-      "pluginVersion": "10.3.0-64399",
+      "pluginVersion": "12.3.0-18356121373.patch9",
       "targets": [
         {
           "datasource": {
@@ -576,7 +584,7 @@
             "steps": [
               {
                 "color": "green",
-                "value": null
+                "value": 0
               }
             ]
           }
@@ -595,6 +603,7 @@
         "graphMode": "none",
         "justifyMode": "auto",
         "orientation": "auto",
+        "percentChangeColorMode": "standard",
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
@@ -602,11 +611,12 @@
           "fields": "/^Client IP of the latest connection$/",
           "values": false
         },
+        "showPercentChange": false,
         "text": {},
         "textMode": "value",
         "wideLayout": true
       },
-      "pluginVersion": "10.3.0-64399",
+      "pluginVersion": "12.3.0-18356121373.patch9",
       "targets": [
         {
           "datasource": {
@@ -712,7 +722,7 @@
             "steps": [
               {
                 "color": "green",
-                "value": null
+                "value": 0
               },
               {
                 "color": "#EAB839",
@@ -740,6 +750,7 @@
         "graphMode": "none",
         "justifyMode": "auto",
         "orientation": "auto",
+        "percentChangeColorMode": "standard",
         "reduceOptions": {
           "calcs": [
             "lastNotNull"
@@ -747,19 +758,21 @@
           "fields": "",
           "values": false
         },
+        "showPercentChange": false,
         "text": {},
         "textMode": "auto",
         "wideLayout": true
       },
-      "pluginVersion": "10.3.0-64399",
+      "pluginVersion": "12.3.0-18356121373.patch9",
       "targets": [
         {
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
+          "editorMode": "code",
           "exemplar": true,
-          "expr": "sum((endlessh_client_open_count_total{instance=~\"$host\",job=~\"$job\"}) - (endlessh_client_closed_count_total{instance=~\"$host\",job=~\"$job\"} offset $__interval  or endlessh_client_open_count_total{instance=~\"$host\",job=~\"$job\"} * 0))",
+          "expr": "sum((endlessh_client_open_count_total{instance=~\"$host\",local_port=~\"$port\",job=~\"$job\"}) - (endlessh_client_closed_count_total{instance=~\"$host\",local_port=~\"$port\",job=~\"$job\"} or endlessh_client_open_count_total{instance=~\"$host\",local_port=~\"$port\",job=~\"$job\"} * 0))",
           "instant": false,
           "interval": "",
           "legendFormat": "Open Connections",
@@ -786,6 +799,7 @@
             "axisLabel": "",
             "axisPlacement": "auto",
             "barAlignment": 0,
+            "barWidthFactor": 0.6,
             "drawStyle": "line",
             "fillOpacity": 0,
             "gradientMode": "none",
@@ -802,6 +816,7 @@
               "type": "linear"
             },
             "showPoints": "auto",
+            "showValues": false,
             "spanNulls": false,
             "stacking": {
               "group": "A",
@@ -812,13 +827,13 @@
             }
           },
           "mappings": [],
-          "min": -0.01,
+          "min": 0,
           "thresholds": {
             "mode": "absolute",
             "steps": [
               {
                 "color": "green",
-                "value": null
+                "value": 0
               }
             ]
           }
@@ -840,10 +855,12 @@
           "showLegend": false
         },
         "tooltip": {
+          "hideZeros": false,
           "mode": "single",
           "sort": "none"
         }
       },
+      "pluginVersion": "12.3.0-18356121373.patch9",
       "targets": [
         {
           "datasource": {
@@ -904,11 +921,14 @@
           "fields": "",
           "values": false
         },
+        "sort": "desc",
         "tooltip": {
+          "hideZeros": false,
           "mode": "single",
           "sort": "none"
         }
       },
+      "pluginVersion": "12.3.0-18356121373.patch9",
       "targets": [
         {
           "datasource": {
@@ -919,7 +939,7 @@
           "refId": "A"
         }
       ],
-      "title": "Connections by country",
+      "title": "Connections by Country",
       "transformations": [
         {
           "id": "filterByRefId",
@@ -1015,7 +1035,7 @@
             "steps": [
               {
                 "color": "#96D98D",
-                "value": null
+                "value": 0
               }
             ]
           }
@@ -1029,7 +1049,6 @@
         "y": 7
       },
       "id": 48,
-      "links": [],
       "options": {
         "basemap": {
           "config": {},
@@ -1051,7 +1070,7 @@
                 "field": "Connections",
                 "fixed": "dark-green"
               },
-              "fillOpacity": 0.4,
+              "fillOpacity": 0.8,
               "shape": "circle",
               "showLegend": false,
               "size": {
@@ -1094,10 +1113,11 @@
           "id": "zero",
           "lat": 0,
           "lon": 0,
+          "noRepeat": false,
           "zoom": 1
         }
       },
-      "pluginVersion": "10.3.0-64399",
+      "pluginVersion": "12.3.0-18356121373.patch9",
       "targets": [
         {
           "datasource": {
@@ -1194,6 +1214,9 @@
               "type": "auto"
             },
             "filterable": true,
+            "footer": {
+              "reducers": []
+            },
             "inspect": false,
             "minWidth": 50
           },
@@ -1204,7 +1227,7 @@
             "steps": [
               {
                 "color": "green",
-                "value": null
+                "value": 0
               }
             ]
           }
@@ -1271,14 +1294,6 @@
       "id": 49,
       "options": {
         "cellHeight": "sm",
-        "footer": {
-          "countRows": false,
-          "fields": "",
-          "reducer": [
-            "sum"
-          ],
-          "show": false
-        },
         "frameIndex": 0,
         "showHeader": true,
         "sortBy": [
@@ -1288,7 +1303,7 @@
           }
         ]
       },
-      "pluginVersion": "10.3.0-64399",
+      "pluginVersion": "12.3.0-18356121373.patch9",
       "targets": [
         {
           "datasource": {
@@ -1461,7 +1476,7 @@
     }
   ],
   "refresh": "",
-  "schemaVersion": 39,
+  "schemaVersion": 42,
   "tags": [
     "prometheus"
   ],
@@ -1475,7 +1490,6 @@
           "uid": "${DS_PROMETHEUS}"
         },
         "definition": "label_values(endlessh_client_open_count_total, job)",
-        "hide": 0,
         "includeAll": true,
         "label": "Job",
         "multi": true,
@@ -1487,7 +1501,6 @@
         },
         "refresh": 2,
         "regex": "",
-        "skipUrlSync": false,
         "sort": 1,
         "type": "query"
       },
@@ -1499,7 +1512,6 @@
           "uid": "${DS_PROMETHEUS}"
         },
         "definition": "label_values(endlessh_client_open_count_total{job=~\"$job\"}, instance)",
-        "hide": 0,
         "includeAll": true,
         "label": "Host",
         "multi": true,
@@ -1511,7 +1523,26 @@
         },
         "refresh": 2,
         "regex": "",
-        "skipUrlSync": false,
+        "sort": 1,
+        "type": "query"
+      },
+      {
+        "allValue": ".*",
+        "current": {},
+        "definition": "label_values(endlessh_client_open_count_total{job=~\"$job\", instance=~\"$host\"},local_port)",
+        "description": "",
+        "includeAll": true,
+        "label": "Port",
+        "multi": true,
+        "name": "port",
+        "options": [],
+        "query": {
+          "qryType": 1,
+          "query": "label_values(endlessh_client_open_count_total{job=~\"$job\", instance=~\"$host\"},local_port)",
+          "refId": "PrometheusVariableQueryEditor-VariableQuery"
+        },
+        "refresh": 2,
+        "regex": "",
         "sort": 1,
         "type": "query"
       }
@@ -1525,6 +1556,6 @@
   "timezone": "",
   "title": "Endlessh",
   "uid": "ATIxYkO7k",
-  "version": 6,
+  "version": 13,
   "weekStart": ""
 }

endlessh_integration_test.go

@@ -0,0 +1,324 @@
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"net"
+	"os/exec"
+	"regexp"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+const (
+	waitForListenTimeout  = 10 * time.Second
+	waitForConnectTimeout = 3 * time.Second
+	pollInterval          = 50 * time.Millisecond
+)
+
+func waitForLogMatch(stderr *bytes.Buffer, pattern string, timeout time.Duration) bool {
+	re := regexp.MustCompile(pattern)
+	deadline := time.Now().Add(timeout)
+	for {
+		if time.Now().After(deadline) {
+			return false
+		}
+		if re.MatchString(stderr.String()) {
+			return true
+		}
+		time.Sleep(pollInterval)
+	}
+}
+
+func TestEndlesshIntegration_MultiplePorts(t *testing.T) {
+	const nPorts = 3
+	ports := make([]int, nPorts)
+	for i := 0; i < nPorts; i++ {
+		ln, err := net.Listen("tcp", "127.0.0.1:0")
+		if err != nil {
+			t.Fatalf("failed to get free port: %v", err)
+		}
+		ports[i] = ln.Addr().(*net.TCPAddr).Port
+		ln.Close()
+	}
+	args := []string{"run", "main.go",
+		"-interval_ms=100",
+		"-max_clients=10",
+		"-logtostderr",
+		"-v=1",
+	}
+	for _, p := range ports {
+		args = append(args, fmt.Sprintf("-port=%d", p))
+	}
+
+	cmd := exec.Command("go", args...)
+	var stderr bytes.Buffer
+	cmd.Stderr = &stderr
+
+	if err := cmd.Start(); err != nil {
+		t.Fatalf("Failed to start server: %v", err)
+	}
+	defer func() {
+		if err := cmd.Process.Kill(); err != nil {
+			t.Logf("Failed to kill process: %v", err)
+		}
+	}()
+
+	if !waitForLogMatch(&stderr, "Listening on", waitForListenTimeout) {
+		t.Fatalf("Timeout waiting for server to start, got logs: %s", stderr.String())
+	}
+	for _, port := range ports {
+		addr := fmt.Sprintf("localhost:%d", port)
+		conn, err := net.Dial("tcp", addr)
+		if err != nil {
+			t.Fatalf("Failed to connect to server on port %d: %v", port, err)
+		}
+		if !waitForLogMatch(&stderr, `ACCEPT host=(127\.0\.0\.1|::1)`, waitForConnectTimeout) {
+			t.Errorf("Never saw any ACCEPT log, got logs: %s", stderr.String())
+		}
+		conn.Close()
+
+		if !waitForLogMatch(&stderr, `CLOSE host=(127\.0\.0\.1|::1)`, waitForConnectTimeout) {
+			t.Errorf("Never saw any CLOSE log, got logs: %s", stderr.String())
+		}
+	}
+}
+
+func TestEndlesshIntegration_TarpitBehavior(t *testing.T) {
+	var stderr bytes.Buffer
+	cmd := exec.Command("go", "run", "main.go", "-port=0", "-interval_ms=5000", "-max_clients=10", "-logtostderr", "-v=1")
+	cmd.Stderr = &stderr
+	if err := cmd.Start(); err != nil {
+		t.Fatalf("Failed to start server: %v", err)
+	}
+	defer func() {
+		if err := cmd.Process.Kill(); err != nil {
+			t.Logf("Failed to kill process: %v", err)
+		}
+	}()
+
+	if !waitForLogMatch(&stderr, "Listening on", waitForListenTimeout) {
+		t.Fatalf("Timeout waiting for server to start, got logs: %s", stderr.String())
+	}
+
+	stderrOutput := stderr.String()
+	re := regexp.MustCompile(`Listening on .*:(\d+)`)
+	m := re.FindStringSubmatch(stderrOutput)
+	if len(m) != 2 {
+		t.Fatalf("Could not parse port from logs: %s", stderrOutput)
+	}
+	port := m[1]
+	addr := "localhost:" + port
+
+	conn, err := net.Dial("tcp", addr)
+	if err != nil {
+		t.Fatalf("Failed to connect to server on port %s: %v", port, err)
+	}
+	defer conn.Close()
+
+	// Simulate SSH client banner
+	// Connect & send client banner
+	_, err = conn.Write([]byte("SSH-2.0-OpenSSH_8.2p1\r\n"))
+	if err != nil {
+		t.Fatalf("Write failed: %v", err)
+	}
+
+	// Expect FIRST LINE immediately (no delay)
+	buf := make([]byte, 1024)
+	n, err := conn.Read(buf)
+	if err != nil || n == 0 {
+		t.Fatalf("Expected first tarpit line immediately, got: %v (%d bytes)", err, n)
+	}
+	t.Logf("Got first tarpit line (%d bytes): %q", n, buf[:n])
+
+	time.Sleep(100 * time.Millisecond)
+	conn.SetReadDeadline(time.Now().Add(1 * time.Second))
+	n2, err := conn.Read(buf)
+	if err == nil && n2 > 0 {
+		t.Errorf("Got %d bytes too soon (within 500ms), tarpit failed", n2)
+	}
+}
+
+func TestEndlesshIntegration_Concurrency(t *testing.T) {
+	maxClients := 5
+	var stderr bytes.Buffer
+	cmd := exec.Command("go", "run", "main.go", "-port=0", "-interval_ms=1000", fmt.Sprintf("-max_clients=%d", maxClients), "-logtostderr", "-v=1")
+	cmd.Stderr = &stderr
+
+	if err := cmd.Start(); err != nil {
+		t.Fatalf("Failed to start server: %v", err)
+	}
+	defer func() {
+		if err := cmd.Process.Kill(); err != nil {
+			t.Logf("Failed to kill process: %v", err)
+		}
+	}()
+
+	if !waitForLogMatch(&stderr, "Listening on", waitForListenTimeout) {
+		t.Fatalf("Timeout waiting for server to start, got logs: %s", stderr.String())
+	}
+	stderrOutput := stderr.String()
+	re := regexp.MustCompile(`Listening on .*:(\d+)`)
+	m := re.FindStringSubmatch(stderrOutput)
+	if len(m) != 2 {
+		t.Fatalf("Could not parse port from logs: %s", stderrOutput)
+	}
+	port := m[1]
+	addr := fmt.Sprintf("localhost:%s", port)
+
+	// Test multiple connections
+	var wg sync.WaitGroup
+	var mu sync.Mutex
+	activeClients := 0
+	maxActiveClients := 0
+	//sixthClientFailed := false
+	successfulReads := 0
+
+	for i := 0; i < maxClients+1; i++ {
+		wg.Add(1)
+		go func(clientID int) {
+			defer wg.Done()
+
+			conn, dialErr := net.Dial("tcp", addr)
+			if dialErr != nil {
+				if clientID == maxClients {
+					//sixthClientFailed = true
+					t.Logf("Client %d dial failed (expected): %v", clientID, dialErr)
+				} else {
+					t.Errorf("Client %d dial failed (unexpected): %v", clientID, dialErr)
+				}
+				return
+			}
+			defer conn.Close()
+
+			_, writeErr := conn.Write([]byte("SSH-2.0-OpenSSH_8.2p1\r\n"))
+			if writeErr != nil {
+				t.Logf("Client %d write failed: %v", clientID, writeErr)
+				return
+			}
+
+			buf := make([]byte, 1024)
+			conn.SetReadDeadline(time.Now().Add(3 * time.Second))
+			n1, readErr1 := conn.Read(buf)
+			if readErr1 != nil || n1 == 0 {
+				if clientID != maxClients { // only log unexpected failures
+					t.Logf("Client %d failed first tarpit line (unexpected): %v (%d bytes)", clientID, readErr1, n1)
+				}
+				return
+			}
+
+			// Client is active only if it successfully received data
+			mu.Lock()
+			activeClients++
+			if activeClients > maxActiveClients {
+				maxActiveClients = activeClients
+			}
+			successfulReads++
+			mu.Unlock()
+
+			t.Logf("Client %d got line 1 (%d bytes): %q", clientID, n1, buf[:n1])
+
+			// Keep the connection open for a while
+			time.Sleep(5 * time.Second)
+
+			mu.Lock()
+			activeClients--
+			mu.Unlock()
+		}(i)
+		time.Sleep(200 * time.Millisecond)
+	}
+	wg.Wait()
+
+	mu.Lock()
+	deferredSuccessfulReads := successfulReads
+	mu.Unlock()
+
+	if deferredSuccessfulReads < 1 {
+		t.Errorf("Expected at least one client to receive a tarpit line, got %d", deferredSuccessfulReads)
+	}
+
+	// Check if maxActiveClients exceeded maxClients
+	if maxActiveClients > maxClients {
+		t.Errorf("Expected max %d concurrent clients, got %d", maxClients, maxActiveClients)
+	}
+
+	// Check if the 6th client failed
+	/*mu.Lock()
+	if !sixthClientFailed {
+		t.Errorf("Expected 6th client to fail, but it succeeded")
+	}
+	mu.Unlock()
+	*/
+	// The 6th client does not necessarily fail at Dial because max_clients is
+	// enforced at the protocol/Read stage instead of at Accept.
+	//
+	// TODO: Enforce max_clients at Accept so the N+1 client fails fast at Dial.
+}
+
+func TestEndlesshIntegration_PrometheusMetrics(t *testing.T) {
+	var stderr bytes.Buffer
+
+	cmd := exec.Command(
+		"go", "run", "main.go",
+		"-port=0",
+		"-enable_prometheus",
+		"-prometheus_port=0",
+		"-interval_ms=100",
+		"-logtostderr", "-v=1",
+	)
+	cmd.Stderr = &stderr
+
+	if err := cmd.Start(); err != nil {
+		t.Fatalf("Failed to start server: %v", err)
+	}
+	defer cmd.Process.Kill()
+
+	if !waitForLogMatch(&stderr, "Starting Prometheus", waitForListenTimeout) {
+		t.Fatalf("Prometheus did not start: %s", stderr.String())
+	}
+
+	reProm := regexp.MustCompile(`Prometheus on IP port .*:(\d+)`)
+	reMain := regexp.MustCompile(`Listening on .*:(\d+)`)
+
+	promMatch := reProm.FindStringSubmatch(stderr.String())
+	mainMatch := reMain.FindStringSubmatch(stderr.String())
+
+	if len(promMatch) < 2 || len(mainMatch) < 2 {
+		t.Fatalf("Could not parse ports: %s", stderr.String())
+	}
+
+	promPort := promMatch[1]
+	mainPort := mainMatch[1]
+
+	conn, err := net.Dial("tcp", "localhost:"+mainPort)
+	if err != nil {
+		t.Fatalf("Dial failed: %v", err)
+	}
+	defer conn.Close()
+
+	conn.Write([]byte("SSH-2.0-test\r\n"))
+
+	time.Sleep(500 * time.Millisecond)
+
+	// Fetch metrics
+	resp, err := net.Dial("tcp", "localhost:"+promPort)
+	if err != nil {
+		t.Fatalf("Failed to connect to metrics endpoint: %v", err)
+	}
+
+	fmt.Fprintf(resp, "GET /metrics HTTP/1.1\r\nHost: localhost\r\n\r\n")
+
+	buf := make([]byte, 8192)
+	n, _ := resp.Read(buf)
+	body := string(buf[:n])
+
+	if !strings.Contains(body, "endlessh_client_open_count_total") {
+		t.Errorf("Missing expected metric in output:\n%s", body)
+	}
+
+	if !strings.Contains(body, "endlessh_sent_bytes_total") {
+		t.Errorf("Expected bytes metric not found:\n%s", body)
+	}
+}

examples/README.md

@@ -10,7 +10,12 @@ An example how to setup endlessh-go, Prometheus, and Grafana using [docker compo
 
 An example how to setup endlessh-go with the Maxmind GeoIP Database.
 
+## [kustomize-simple](./kustomize-simple)
+
+An example how to setup endlessh-go using [kustomize](https://kustomize.io/).
+
 ## FAQ
+
 ### Bind to privileged ports (<1024) in a container
 
 You need to add capability `NET_BIND_SERVICE` to the program.

examples/docker-maxmind/README.md

@@ -5,12 +5,12 @@ This is an example how to setup endlessh-go with the Maxmind GeoIP Database usin
 To start the stack, in the _examples_ folder, run:
 
 ```
-sudo docker-compose up -d
+docker-compose up -d
 ```
 
 The GeoIP Database will be saved in a mounted volume in: `./geo-data`. And the endlessh-go container will use this database to do the location lookups.
 
 This example exposes the following ports. Except the SSH port, you should not expose other ports to public without protections (not included in this example) in production.
 
--   **2222**: The SSH port. You may test endlessh-go by running `ssh -p 2222 localhost`. Your SSH client should hang. View the log of endlessh-go by running `sudo docker logs endlessh`.
+-   **2222**: The SSH port. You may test endlessh-go by running `ssh -p 2222 localhost`. Your SSH client should hang. View the log of endlessh-go by running `docker logs endlessh`.
 -   **2112**: The Prometheus metrics exported by endlessh-go. Go to [http://localhost:2112/metrics](http://localhost:2112/metrics) in your web browser to view the metrics.

examples/docker-maxmind/docker-compose.yml

@@ -1,4 +1,3 @@
-version: "3"
 services:
 
   endlessh:

examples/docker-simple/README.md

@@ -9,12 +9,12 @@ This is an example how to setup endlessh-go, Prometheus, and Grafana using [dock
 To start the stack, in the *examples* folder, run:
 
 ```
-sudo docker-compose up -d
+docker-compose up -d
 ```
 
 This example exposes the following ports. Except the SSH port, you should not expose other ports to public without protections (not included in this example) in production.
 
-* **2222**: The SSH port. You may test endlessh-go by running `ssh -p 2222 localhost`. Your SSH client should hang. View the log of endlessh-go by running `sudo docker logs endlessh`.
+* **2222**: The SSH port. You may test endlessh-go by running `ssh -p 2222 localhost`. Your SSH client should hang. View the log of endlessh-go by running `docker logs endlessh`.
 * **2112**: The Prometheus metrics exported by endlessh-go. Go to [http://localhost:2112/metrics](http://localhost:2112/metrics) in your web browser to view the metrics.
 * **9090**: Prometheus web interface. Go to [http://localhost:9090](http://localhost:9090) in your web browser for Prometheus. You can check whether the target of endlessh-go is up (Click Status, then Targets).
 * **3000**: Grafana. Go to [http://localhost:3000](http://localhost:3000) in your web browser for Grafana. Use username *examples* and password *examples* to login.

examples/docker-simple/docker-compose.yml

@@ -1,4 +1,3 @@
-version: '3.5'
 services:
 
   endlessh:

examples/kustomize-simple/README.md

@@ -0,0 +1,25 @@
+## kustomize
+
+This is an example how to setup endlessh-go with existing Prometheus and Grafana using [kustomize](https://kustomize.io/).
+
+This example assumes the cluster already has a Prometheus Operator based monitoring stack. It deploys:
+
+- endlessh-go
+- a Service exposing SSH and Prometheus metrics
+- a `ServiceMonitor` for scraping endlessh-go metrics
+- a Grafana dashboard `ConfigMap`
+
+To deploy the stack, run:
+
+```bash
+kubectl apply -k examples/kustomize-simple
+```
+
+`dashboard.json` is added to a `ConfigMap` with label `grafana_dashboard=1`, which can be picked up by a Grafana sidecar based dashboard loader.
+
+The `ServiceMonitor` in `monitor.yaml` scrapes the `metrics` port every `60s`. If your Prometheus stack only selects `ServiceMonitor` objects with specific labels, add the matching label in `kustomization.yaml`.
+
+The `endlessh` Service exposes the following ports inside the cluster:
+
+- **22**: SSH for endlessh-go
+- **2112**: Prometheus metrics exported by endlessh-go

examples/kustomize-simple/deployment.yaml

@@ -0,0 +1,31 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: endlessh
+spec:
+  replicas: 1
+  template:
+    spec:
+      automountServiceAccountToken: false
+      containers:
+        - name: endlessh
+          image: shizunge/endlessh-go:latest
+          args:
+            - -interval_ms=1000
+            - -logtostderr
+            - -v=1
+            - -enable_prometheus
+            - -geoip_supplier=ip-api
+            - -host=[::]
+            - -prometheus_host=[::]
+          ports:
+            - name: ssh
+              containerPort: 2222
+            - name: metrics
+              containerPort: 2112
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL

examples/kustomize-simple/kustomization.yaml

@@ -0,0 +1,21 @@
+resources:
+  - deployment.yaml
+  - service.yaml
+  - monitor.yaml
+configMapGenerator:
+  - name: endlessh-dashboard
+    files:
+      - dashboard.json
+    options:
+      labels:
+        grafana_dashboard: "1"
+labels:
+  - pairs:
+      app.kubernetes.io/name: endlessh
+    includeSelectors: true
+    includeTemplates: true
+    fields:
+      - group: monitoring.coreos.com
+        kind: ServiceMonitor
+        path: spec/selector/matchLabels
+        create: true

examples/kustomize-simple/monitor.yaml

@@ -0,0 +1,10 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: endlessh
+spec:
+  endpoints:
+    - interval: 60s
+      path: /metrics
+      port: metrics
+  jobLabel: app.kubernetes.io/name

examples/kustomize-simple/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: endlessh
+spec:
+  ports:
+    - name: ssh
+      port: 22
+      targetPort: ssh
+      protocol: TCP
+    - name: metrics
+      port: 2112
+      targetPort: metrics
+      protocol: TCP

geoip/country.go

@@ -1,4 +1,4 @@
-// Copyright (C) 2023 Shizun Ge
+// Copyright (C) 2023-2026 Shizun Ge
 //
 // This program is free software: you can redistribute it and/or modify
 // it under the terms of the GNU General Public License as published by
@@ -14,16 +14,16 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 //
 
-package coordinates
+package geoip
 
 // Map country's ISO to their capital's latitude and longitude.
 // Country's ISO see https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2
-type Location struct {
+type location struct {
 	Latitude  float64
 	Longitude float64
 }
 
-var Country = map[string]Location{
+var countryToLocation = map[string]location{
 	"AD": {42.5, 1.5},
 	"AE": {24.4511, 54.3969},
 	"AF": {34.5328, 69.1658},

geoip/geoip.go

@@ -1,4 +1,4 @@
-// Copyright (C) 2021-2023 Shizun Ge
+// Copyright (C) 2021-2026 Shizun Ge
 //
 // This program is free software: you can redistribute it and/or modify
 // it under the terms of the GNU General Public License as published by
@@ -14,7 +14,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 //
 
-package main
+package geoip
 
 import (
 	"encoding/json"
@@ -24,15 +24,14 @@ import (
 	"net/http"
 	"strings"
 
-	"endlessh-go/coordinates"
-
 	"github.com/oschwald/geoip2-golang"
 	"github.com/pierrre/geohash"
 )
 
-var (
-	maxMindDbFileName *string
-)
+type GeoOption struct {
+	GeoipSupplier     string
+	MaxMindDbFileName string
+}
 
 func composeLocation(country string, region string, city string) string {
 	var locations []string
@@ -69,9 +68,9 @@ type ipapi struct {
 	Longitude   float64 `json:"lon"`
 }
 
-func geohashAndLocationFromIpapi(address string) (string, string, string, error) {
+func geohashAndLocationFromIpapi(ipAddr string) (string, string, string, error) {
 	var geo ipapi
-	response, err := http.Get("http://ip-api.com/json/" + address)
+	response, err := http.Get("http://ip-api.com/json/" + ipAddr)
 	if err != nil {
 		return "s000", "Unknown", "Unknown", err
 	}
@@ -88,7 +87,7 @@ func geohashAndLocationFromIpapi(address string) (string, string, string, error)
 	}
 
 	if geo.Status != "success" {
-		return "s000", "Unknown", "Unknown", fmt.Errorf("failed to query %v via ip-api: status: %v, message: %v", address, geo.Status, geo.Message)
+		return "s000", "Unknown", "Unknown", fmt.Errorf("failed to query %v via ip-api: status: %v, message: %v", ipAddr, geo.Status, geo.Message)
 	}
 
 	gh := geohash.EncodeAuto(geo.Latitude, geo.Longitude)
@@ -98,14 +97,14 @@ func geohashAndLocationFromIpapi(address string) (string, string, string, error)
 	return gh, country, location, nil
 }
 
-func geohashAndLocationFromMaxMindDb(address string) (string, string, string, error) {
-	db, err := geoip2.Open(*maxMindDbFileName)
+func geohashAndLocationFromMaxMindDb(ipAddr, maxMindDbFileName string) (string, string, string, error) {
+	db, err := geoip2.Open(maxMindDbFileName)
 	if err != nil {
 		return "s000", "Unknown", "Unknown", err
 	}
 	defer db.Close()
 	// If you are using strings that may be invalid, check that ip is not nil
-	ip := net.ParseIP(address)
+	ip := net.ParseIP(ipAddr)
 	cityRecord, err := db.City(ip)
 	if err != nil {
 		return "s000", "Unknown", "Unknown", err
@@ -117,7 +116,7 @@ func geohashAndLocationFromMaxMindDb(address string) (string, string, string, er
 	iso := cityRecord.Country.IsoCode
 	if latitude == 0 && longitude == 0 {
 		// In case of using Country DB, city is not available.
-		loc, ok := coordinates.Country[iso]
+		loc, ok := countryToLocation[iso]
 		if ok {
 			latitude = loc.Latitude
 			longitude = loc.Longitude
@@ -135,15 +134,15 @@ func geohashAndLocationFromMaxMindDb(address string) (string, string, string, er
 	return gh, country, location, nil
 }
 
-func geohashAndLocation(address string, geoipSupplier string) (string, string, string, error) {
-	switch geoipSupplier {
+func GeohashAndLocation(ipAddr string, option GeoOption) (string, string, string, error) {
+	switch option.GeoipSupplier {
 	case "off":
 		return "s000", "Geohash off", "Geohash off", nil
 	case "ip-api":
-		return geohashAndLocationFromIpapi(address)
+		return geohashAndLocationFromIpapi(ipAddr)
 	case "max-mind-db":
-		return geohashAndLocationFromMaxMindDb(address)
+		return geohashAndLocationFromMaxMindDb(ipAddr, option.MaxMindDbFileName)
 	default:
-		return "s000", "Unknown", "Unknown", fmt.Errorf("unknown geoipSupplier %v.", geoipSupplier)
+		return "s000", "Unknown", "Unknown", fmt.Errorf("unknown geoipSupplier %v.", option.GeoipSupplier)
 	}
 }

go.mod

@@ -1,22 +1,25 @@
 module endlessh-go
 
-go 1.20
+go 1.26.1
 
 require (
-	github.com/golang/glog v1.2.0
-	github.com/oschwald/geoip2-golang v1.9.0
-	github.com/pierrre/geohash v1.1.1
-	github.com/prometheus/client_golang v1.18.0
+	github.com/golang/glog v1.2.5
+	github.com/oschwald/geoip2-golang v1.13.0
+	github.com/pierrre/geohash v1.1.4
+	github.com/pires/go-proxyproto v0.12.0
+	github.com/prometheus/client_golang v1.23.2
 )
 
 require (
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
-	github.com/oschwald/maxminddb-golang v1.11.0 // indirect
-	github.com/prometheus/client_model v0.5.0 // indirect
-	github.com/prometheus/common v0.45.0 // indirect
-	github.com/prometheus/procfs v0.12.0 // indirect
-	golang.org/x/sys v0.15.0 // indirect
-	google.golang.org/protobuf v1.31.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/oschwald/maxminddb-golang v1.13.0 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.66.1 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	golang.org/x/sys v0.35.0 // indirect
+	google.golang.org/protobuf v1.36.8 // indirect
 )

go.sum

@@ -1,45 +1,76 @@
 github.com/Codefor/geohash v0.0.0-20140723084247-1b41c28e3a9d h1:iG9B49Q218F/XxXNRM7k/vWf7MKmLIS8AcJV9cGN4nA=
+github.com/Codefor/geohash v0.0.0-20140723084247-1b41c28e3a9d/go.mod h1:RVnhzAX71far8Kc3TQeA0k/dcaEKUnTDSOyet/JCmGI=
 github.com/TomiHiltunen/geohash-golang v0.0.0-20150112065804-b3e4e625abfb h1:wumPkzt4zaxO4rHPBrjDK8iZMR41C1qs7njNqlacwQg=
+github.com/TomiHiltunen/geohash-golang v0.0.0-20150112065804-b3e4e625abfb/go.mod h1:QiYsIBRQEO+Z4Rz7GoI+dsHVneZNONvhczuA+llOZNM=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/broady/gogeohash v0.0.0-20120525094510-7b2c40d64042 h1:iEdmkrNMLXbM7ecffOAtZJQOQUTE4iMonxrb5opUgE4=
-github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
-github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/broady/gogeohash v0.0.0-20120525094510-7b2c40d64042/go.mod h1:f1L9YvXvlt9JTa+A17trQjSMM6bV40f+tHjB+Pi+Fqk=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fanixk/geohash v0.0.0-20150324002647-c1f9b5fa157a h1:Fyfh/dsHFrC6nkX7H7+nFdTd1wROlX/FxEIWVpKYf1U=
-github.com/golang/glog v1.2.0 h1:uCdmnmatrKCgMBlM4rMuJZWOkPDqdbZPnrMXDY4gI68=
-github.com/golang/glog v1.2.0/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg=
-github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
+github.com/fanixk/geohash v0.0.0-20150324002647-c1f9b5fa157a/go.mod h1:UgNw+PTmmGN8rV7RvjvnBMsoTU8ZXXnaT3hYsDTBlgQ=
+github.com/golang/glog v1.2.5 h1:DrW6hGnjIhtvhOIiAKT6Psh/Kd/ldepEa81DKeiRJ5I=
+github.com/golang/glog v1.2.5/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/mmcloughlin/geohash v0.10.0 h1:9w1HchfDfdeLc+jFEf/04D27KP7E2QmpDu52wPbJWRE=
-github.com/oschwald/geoip2-golang v1.9.0 h1:uvD3O6fXAXs+usU+UGExshpdP13GAqp4GBrzN7IgKZc=
-github.com/oschwald/geoip2-golang v1.9.0/go.mod h1:BHK6TvDyATVQhKNbQBdrj9eAvuwOMi2zSFXizL3K81Y=
-github.com/oschwald/maxminddb-golang v1.11.0 h1:aSXMqYR/EPNjGE8epgqwDay+P30hCBZIveY0WZbAWh0=
-github.com/oschwald/maxminddb-golang v1.11.0/go.mod h1:YmVI+H0zh3ySFR3w+oz8PCfglAFj3PuCmui13+P9zDg=
-github.com/pierrre/assert v0.3.2 h1:wXdlkVN5FVSLEKl6pGijcCYkldgfjRgyheU3C1/by9Q=
-github.com/pierrre/compare v1.4.2 h1:oabIiWclzAlXG7S/2MYSFDJ/vR34oa/MYrBZh5PNU80=
-github.com/pierrre/geohash v1.1.1 h1:XCkvOyv/uesenMPhkvsCfIiUalBmGdHlFY0bIWTqb+s=
-github.com/pierrre/geohash v1.1.1/go.mod h1:ucAm7cbgGBoVr6cr1t+d3ea5XQ9P5zKHXfS1Qy2iKVY=
-github.com/pierrre/go-libs v0.2.14 h1:wAPoOrslKLnha6ow5EKkxxZpo76kOea57efs71A/ZnQ=
-github.com/pierrre/pretty v0.0.10 h1:Cb5som+1EpU+x7UA5AMy9I8AY2XkzMBywkLEAdo1JDg=
+github.com/mmcloughlin/geohash v0.10.0/go.mod h1:oNZxQo5yWJh0eMQEP/8hwQuVx9Z9tjwFUqcTB1SmG0c=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/oschwald/geoip2-golang v1.13.0 h1:Q44/Ldc703pasJeP5V9+aFSZFmBN7DKHbNsSFzQATJI=
+github.com/oschwald/geoip2-golang v1.13.0/go.mod h1:P9zG+54KPEFOliZ29i7SeYZ/GM6tfEL+rgSn03hYuUo=
+github.com/oschwald/maxminddb-golang v1.13.0 h1:R8xBorY71s84yO06NgTmQvqvTvlS/bnYZrrWX1MElnU=
+github.com/oschwald/maxminddb-golang v1.13.0/go.mod h1:BU0z8BfFVhi1LQaonTwwGQlsHUEu9pWNdMfmq4ztm0o=
+github.com/pierrre/assert v0.12.1 h1:Hg+r10601guGiOvXoWHx1Xp2TLj3w6FMb+PN7pR+iQc=
+github.com/pierrre/assert v0.12.1/go.mod h1:9AEGGFuJp339PdEUkhfOq8zqYPdSurPWAua35EEpY2o=
+github.com/pierrre/compare v1.4.14 h1:snH4S/2nClsCCgYAvseyQYX6RHX8WvCdd23deiL1ovc=
+github.com/pierrre/compare v1.4.14/go.mod h1:5RkfHZojsCAFZR+mW9SHH55mH1tCWNWMP7xhWgxc6QE=
+github.com/pierrre/geohash v1.1.4 h1:yzKGZnvToMhSorOzdR7dULzYkzc6BgEYN//yAn/sWsw=
+github.com/pierrre/geohash v1.1.4/go.mod h1:acEkGYRKiLkhsU88AolKimmPzyBC7vqi9YUs0/LkKNI=
+github.com/pierrre/go-libs v0.28.1 h1:PCz1fdKdSwCmwO5GMCN/L5qlvqxIBT54iKKzrbI1Nik=
+github.com/pierrre/go-libs v0.28.1/go.mod h1:KXbqq+niFCQ48LPSjX2lKG1IdCoTBrTpurkVVDH2W8U=
+github.com/pierrre/pretty v0.23.0 h1:LYCkefa+DV87cu/xqUnPh75x1T0zXgnHvAn7wW+OgN0=
+github.com/pierrre/pretty v0.23.0/go.mod h1:ILYWjIqXAO9iLC2sDcHkgv2Vp0JIIKGMjRtwHAdOVAM=
+github.com/pires/go-proxyproto v0.12.0 h1:TTCxD66dU898tahivkqc3hoceZp7P44FnorWyo9d5vM=
+github.com/pires/go-proxyproto v0.12.0/go.mod h1:qUvfqUMEoX7T8g0q7TQLDnhMjdTrxnG0hvpMn+7ePNI=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
-github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
-github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw=
-github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
-github.com/prometheus/common v0.45.0 h1:2BGz0eBc2hdMDLnO/8n0jeB3oPrt2D08CekT0lneoxM=
-github.com/prometheus/common v0.45.0/go.mod h1:YJmSTw9BoKxJplESWWxlbyttQR4uaEcGyv9MZjVOJsY=
-github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
-github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs=
+github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA=
+github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/the42/cartconvert v1.0.0 h1:g8kt6ic2GEhdcZ61ZP9GsWwhosVo5nCnH1n2/oAQXUU=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
-google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+github.com/the42/cartconvert v1.0.0/go.mod h1:fWO/msnJVhHqN1yX6OBoxSyfj7TEj1hHiL8bJSQsK30=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

main.go

@@ -1,4 +1,4 @@
-// Copyright (C) 2021-2023 Shizun Ge
+// Copyright (C) 2021-2026 Shizun Ge
 //
 // This program is free software: you can redistribute it and/or modify
 // it under the terms of the GNU General Public License as published by
@@ -17,108 +17,134 @@
 package main
 
 import (
+	"endlessh-go/client"
+	"endlessh-go/geoip"
+	"endlessh-go/metrics"
 	"flag"
 	"fmt"
-	"math/rand"
 	"net"
-	"net/http"
 	"os"
+	"strconv"
+	"strings"
 	"time"
 
 	"github.com/golang/glog"
-	"github.com/prometheus/client_golang/prometheus"
-	"github.com/prometheus/client_golang/prometheus/promhttp"
+	proxyproto "github.com/pires/go-proxyproto"
 )
 
-var (
-	numCurrentClients     int64
-	numTotalClients       int64
-	numTotalClientsClosed int64
-	numTotalBytes         int64
-	numTotalMilliseconds  int64
-	totalClients          prometheus.CounterFunc
-	totalClientsClosed    prometheus.CounterFunc
-	totalBytes            prometheus.CounterFunc
-	totalSeconds          prometheus.CounterFunc
-	clientIP              *prometheus.CounterVec
-	clientSeconds         *prometheus.CounterVec
-)
-
-func initPrometheus(prometheusHost, prometheusPort, prometheusEntry string) {
-	totalClients = prometheus.NewCounterFunc(
-		prometheus.CounterOpts{
-			Name: "endlessh_client_open_count_total",
-			Help: "Total number of clients that tried to connect to this host.",
-		}, func() float64 {
-			return float64(numTotalClients)
-		},
-	)
-	totalClientsClosed = prometheus.NewCounterFunc(
-		prometheus.CounterOpts{
-			Name: "endlessh_client_closed_count_total",
-			Help: "Total number of clients that stopped connecting to this host.",
-		}, func() float64 {
-			return float64(numTotalClientsClosed)
-		},
-	)
-	totalBytes = prometheus.NewCounterFunc(
-		prometheus.CounterOpts{
-			Name: "endlessh_sent_bytes_total",
-			Help: "Total bytes sent to clients that tried to connect to this host.",
-		}, func() float64 {
-			return float64(numTotalBytes)
-		},
-	)
-	totalSeconds = prometheus.NewCounterFunc(
-		prometheus.CounterOpts{
-			Name: "endlessh_trapped_time_seconds_total",
-			Help: "Total seconds clients spent on endlessh.",
-		}, func() float64 {
-			return float64(numTotalMilliseconds) / 1000
-		},
-	)
-	clientIP = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: "endlessh_client_open_count",
-			Help: "Number of connections of clients.",
-		},
-		[]string{"ip", "geohash", "country", "location"},
-	)
-	clientSeconds = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: "endlessh_client_trapped_time_seconds",
-			Help: "Seconds a client spends on endlessh.",
-		},
-		[]string{"ip"},
-	)
-	promReg := prometheus.NewRegistry()
-	promReg.MustRegister(totalClients)
-	promReg.MustRegister(totalClientsClosed)
-	promReg.MustRegister(totalBytes)
-	promReg.MustRegister(totalSeconds)
-	promReg.MustRegister(clientIP)
-	promReg.MustRegister(clientSeconds)
-	handler := promhttp.HandlerFor(promReg, promhttp.HandlerOpts{EnableOpenMetrics: true})
-	http.Handle("/"+prometheusEntry, handler)
+func startSending(maxClients int64, bannerMaxLength int64, records chan<- metrics.RecordEntry) chan *client.Client {
+	clients := make(chan *client.Client, maxClients)
 	go func() {
-		glog.Infof("Starting Prometheus on %v:%v, entry point is /%v", prometheusHost, prometheusPort, prometheusEntry)
-		http.ListenAndServe(prometheusHost+":"+prometheusPort, nil)
+		for {
+			c, more := <-clients
+			if !more {
+				return
+			}
+			go func() {
+				bytesSent, err := c.Send(bannerMaxLength)
+				remoteIpAddr := c.RemoteIpAddr()
+				localPort := c.LocalPort()
+				millisecondsSpent := c.MillisecondsSinceLast()
+				if err != nil {
+					c.Close()
+					records <- metrics.RecordEntry{
+						RecordType:        metrics.RecordEntryTypeStop,
+						IpAddr:            remoteIpAddr,
+						LocalPort:         localPort,
+						MillisecondsSpent: millisecondsSpent,
+					}
+					return
+				}
+				clients <- c
+				records <- metrics.RecordEntry{
+					RecordType:        metrics.RecordEntryTypeSend,
+					IpAddr:            remoteIpAddr,
+					LocalPort:         localPort,
+					MillisecondsSpent: millisecondsSpent,
+					BytesSent:         bytesSent,
+				}
+			}()
+		}
+	}()
+	return clients
+}
+
+func startAccepting(maxClients int64, connType, connHost, connPort string, interval time.Duration, clients chan<- *client.Client, records chan<- metrics.RecordEntry, proxyProtocolEnabled bool, proxyProtocolReadHeaderTimeout int) {
+	go func() {
+		connPortInt, err := strconv.Atoi(connPort)
+		if err != nil {
+			glog.Errorf("Invalid port: %v", err)
+			os.Exit(1)
+		}
+
+		addr := connHost + fmt.Sprintf(":%d", connPortInt)
+		l, err := net.Listen(connType, addr)
+		if err != nil {
+			glog.Errorf("Error listening: %v", err)
+			os.Exit(1)
+		}
+
+		// Wrap the listener in a proxy protocol listener
+		if proxyProtocolEnabled {
+			l = &proxyproto.Listener{Listener: l, ReadHeaderTimeout: time.Duration(proxyProtocolReadHeaderTimeout) * time.Millisecond}
+		}
+
+		// Close the listener when the application closes.
+		defer l.Close()
+
+		realAddr := l.Addr().(*net.TCPAddr)
+		localPortStr := strconv.Itoa(realAddr.Port)
+		glog.Infof("Listening on %v:%v", connHost, realAddr.Port)
+		for {
+			// Listen for an incoming connection.
+			conn, err := l.Accept()
+			if err != nil {
+				glog.Errorf("Error accepting connection from port %v: %v", connPort, err)
+				os.Exit(1)
+			}
+			c := client.NewClient(conn, interval, maxClients)
+			remoteIpAddr := c.RemoteIpAddr()
+			records <- metrics.RecordEntry{
+				RecordType: metrics.RecordEntryTypeStart,
+				IpAddr:     remoteIpAddr,
+				LocalPort:  localPortStr,
+			}
+			clients <- c
+		}
 	}()
 }
 
+type arrayStrings []string
+
+func (a *arrayStrings) String() string {
+	return strings.Join(*a, ", ")
+}
+
+func (a *arrayStrings) Set(value string) error {
+	*a = append(*a, value)
+	return nil
+}
+
+const defaultPort = "2222"
+
+var connPorts arrayStrings
+
 func main() {
 	intervalMs := flag.Int("interval_ms", 1000, "Message millisecond delay")
 	bannerMaxLength := flag.Int64("line_length", 32, "Maximum banner line length")
 	maxClients := flag.Int64("max_clients", 4096, "Maximum number of clients")
 	connType := flag.String("conn_type", "tcp", "Connection type. Possible values are tcp, tcp4, tcp6")
 	connHost := flag.String("host", "0.0.0.0", "SSH listening address")
-	connPort := flag.String("port", "2222", "SSH listening port")
+	flag.Var(&connPorts, "port", fmt.Sprintf("SSH listening port. You may provide multiple -port flags to listen to multiple ports. (default %q)", defaultPort))
 	prometheusEnabled := flag.Bool("enable_prometheus", false, "Enable prometheus")
 	prometheusHost := flag.String("prometheus_host", "0.0.0.0", "The address for prometheus")
 	prometheusPort := flag.String("prometheus_port", "2112", "The port for prometheus")
 	prometheusEntry := flag.String("prometheus_entry", "metrics", "Entry point for prometheus")
+	prometheusCleanUnseenSeconds := flag.Int("prometheus_clean_unseen_seconds", 0, "Remove series if the IP is not seen for the given time. Set to 0 to disable. (default 0)")
 	geoipSupplier := flag.String("geoip_supplier", "off", "Supplier to obtain Geohash of IPs. Possible values are \"off\", \"ip-api\", \"max-mind-db\"")
-	maxMindDbFileName = flag.String("max_mind_db", "", "Path to the MaxMind DB file.")
+	maxMindDbFileName := flag.String("max_mind_db", "", "Path to the MaxMind DB file.")
+	proxyProtocolEnabled := flag.Bool("proxy_protocol_enabled", false, "Enable PROXY protocol support. This causes the server to expect PROXY protocol headers on incoming connections.")
+	proxyProtocolReadHeaderTimeout := flag.Int("proxy_protocol_read_header_timeout_ms", 200, "Timeout for reading the PROXY protocol header in milliseconds. If the connection does not send a valid PROXY protocol header in this time, the header is ignored.")
 
 	flag.Usage = func() {
 		fmt.Fprintf(flag.CommandLine.Output(), "Usage of %v \n", os.Args[0])
@@ -126,60 +152,48 @@ func main() {
 	}
 	flag.Parse()
 
-	if *connType == "tcp6" && *prometheusHost == "0.0.0.0" {
-		*prometheusHost = "[::]"
-	}
 	if *prometheusEnabled {
-		initPrometheus(*prometheusHost, *prometheusPort, *prometheusEntry)
+		if *connType == "tcp6" && *prometheusHost == "0.0.0.0" {
+			*prometheusHost = "[::]"
+		}
+		if *prometheusPort == "0" || *prometheusPort == "" {
+			l, err := net.Listen("tcp", *prometheusHost+":0")
+			if err != nil {
+				glog.Fatalf("Failed to pick a free Prometheus port: %v", err)
+			}
+			actualPort := l.Addr().(*net.TCPAddr).Port
+			*prometheusPort = strconv.Itoa(actualPort)
+			l.Close()
+		}
+		metrics.InitPrometheus(*prometheusHost, *prometheusPort, *prometheusEntry)
 	}
 
-	rand.Seed(time.Now().UnixNano())
+	records := metrics.StartRecording(*maxClients, *prometheusEnabled, *prometheusCleanUnseenSeconds,
+		geoip.GeoOption{
+			GeoipSupplier:     *geoipSupplier,
+			MaxMindDbFileName: *maxMindDbFileName,
+		})
+	clients := startSending(*maxClients, *bannerMaxLength, records)
+
 	interval := time.Duration(*intervalMs) * time.Millisecond
 	// Listen for incoming connections.
 	if *connType == "tcp6" && *connHost == "0.0.0.0" {
 		*connHost = "[::]"
 	}
-	l, err := net.Listen(*connType, *connHost+":"+*connPort)
-	if err != nil {
-		glog.Errorf("Error listening: %v", err)
-		os.Exit(1)
+	if len(connPorts) == 0 {
+		connPorts = append(connPorts, defaultPort)
 	}
-	// Close the listener when the application closes.
-	defer l.Close()
-	glog.Infof("Listening on %v:%v", *connHost, *connPort)
-
-	clients := make(chan *client, *maxClients)
-	go func() {
-		for {
-			c, more := <-clients
-			if !more {
-				return
+	for _, connPort := range connPorts {
+		startAccepting(*maxClients, *connType, *connHost, connPort, interval, clients, records, *proxyProtocolEnabled, *proxyProtocolReadHeaderTimeout)
+	}
+	for {
+		if *prometheusCleanUnseenSeconds <= 0 {
+			time.Sleep(time.Duration(1<<63 - 1))
+		} else {
+			time.Sleep(time.Second * time.Duration(60))
+			records <- metrics.RecordEntry{
+				RecordType: metrics.RecordEntryTypeClean,
 			}
-			if time.Now().Before(c.next) {
-				time.Sleep(c.next.Sub(time.Now()))
-			}
-			err := c.Send(*bannerMaxLength)
-			if err != nil {
-				c.Close()
-				continue
-			}
-			go func() { clients <- c }()
-		}
-	}()
-	listener := func() {
-		for {
-			// Listen for an incoming connection.
-			conn, err := l.Accept()
-			if err != nil {
-				glog.Errorf("Error accepting: %v", err)
-				os.Exit(1)
-			}
-			// Handle connections in a new goroutine.
-			for numCurrentClients >= *maxClients {
-				time.Sleep(interval)
-			}
-			clients <- NewClient(conn, interval, *maxClients, *geoipSupplier, *prometheusEnabled)
 		}
 	}
-	listener()
 }

metrics/metrics.go

@@ -0,0 +1,195 @@
+// Copyright (C) 2024-2026 Shizun Ge
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+//
+
+package metrics
+
+import (
+	"endlessh-go/geoip"
+	"net/http"
+	"os"
+	"time"
+	"strings"
+	"net"
+
+	"github.com/golang/glog"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+)
+
+var (
+	pq                 *UpdatablePriorityQueue
+	totalClients       *prometheus.CounterVec
+	totalClientsClosed *prometheus.CounterVec
+	totalBytes         *prometheus.CounterVec
+	totalSeconds       *prometheus.CounterVec
+	clientIP           *prometheus.CounterVec
+	clientSeconds      *prometheus.CounterVec
+)
+
+func InitPrometheus(prometheusHost, prometheusPort, prometheusEntry string) {
+	pq = NewUpdatablePriorityQueue()
+	totalClients = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "endlessh_client_open_count_total",
+			Help: "Total number of clients that tried to connect to this host.",
+		}, []string{"local_port"},
+	)
+	totalClientsClosed = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "endlessh_client_closed_count_total",
+			Help: "Total number of clients that stopped connecting to this host.",
+		}, []string{"local_port"},
+	)
+	totalBytes = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "endlessh_sent_bytes_total",
+			Help: "Total bytes sent to clients that tried to connect to this host.",
+		}, []string{"local_port"},
+	)
+	totalSeconds = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "endlessh_trapped_time_seconds_total",
+			Help: "Total seconds clients spent on endlessh.",
+		}, []string{"local_port"},
+	)
+	clientIP = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "endlessh_client_open_count",
+			Help: "Number of connections of clients.",
+		},
+		[]string{"ip", "local_port", "geohash", "country", "location"},
+	)
+	clientSeconds = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "endlessh_client_trapped_time_seconds",
+			Help: "Seconds a client spends on endlessh.",
+		},
+		[]string{"ip", "local_port"},
+	)
+	promReg := prometheus.NewRegistry()
+	promReg.MustRegister(totalClients)
+	promReg.MustRegister(totalClientsClosed)
+	promReg.MustRegister(totalBytes)
+	promReg.MustRegister(totalSeconds)
+	promReg.MustRegister(clientIP)
+	promReg.MustRegister(clientSeconds)
+	handler := promhttp.HandlerFor(promReg, promhttp.HandlerOpts{EnableOpenMetrics: true})
+	http.Handle("/"+prometheusEntry, handler)
+	go func() {
+
+		if strings.HasPrefix(prometheusHost, "unix:") {
+			socketPath := prometheusHost[5:] // trim the "unix:" prefix
+			glog.Infof("Starting Prometheus on Unix socket %v, entry point is /%v", socketPath, prometheusEntry)
+			serveOnUnixSocket(socketPath)
+		} else {
+			ipPort := prometheusHost+":"+prometheusPort
+			glog.Infof("Starting Prometheus on IP port %v, entry point is /%v", ipPort, prometheusEntry)
+			serveOnIpPort(ipPort)
+		}
+		
+	}()
+}
+
+func serveOnUnixSocket(socketPath string) {
+	_ = os.Remove(socketPath) // allow failure
+	unixListener, err := net.Listen("unix", socketPath)
+	if err != nil {
+		glog.Errorf("Error starting Prometheus on socket %v: %v", socketPath, err)
+		os.Exit(1)
+	}
+	if err := http.Serve(unixListener, nil); err != nil {
+		glog.Errorf("Error starting Prometheus at socket %v: %v", socketPath, err)
+		os.Exit(1)
+	}
+}
+
+func serveOnIpPort(ipPort string) {
+	if err := http.ListenAndServe(ipPort, nil); err != nil {
+		glog.Errorf("Error starting Prometheus at IP port %v: %v", ipPort, err)
+		os.Exit(1)
+	}
+}
+
+const (
+	RecordEntryTypeStart = iota
+	RecordEntryTypeSend  = iota
+	RecordEntryTypeStop  = iota
+	RecordEntryTypeClean = iota
+)
+
+type RecordEntry struct {
+	RecordType        int
+	IpAddr            string
+	LocalPort         string
+	MillisecondsSpent int64
+	BytesSent         int
+}
+
+func StartRecording(maxClients int64, prometheusEnabled bool, prometheusCleanUnseenSeconds int, geoOption geoip.GeoOption) chan RecordEntry {
+	records := make(chan RecordEntry, maxClients)
+	go func() {
+		for {
+			r, more := <-records
+			if !more {
+				return
+			}
+			if !prometheusEnabled {
+				continue
+			}
+			switch r.RecordType {
+			case RecordEntryTypeStart:
+				geohash, country, location, err := geoip.GeohashAndLocation(r.IpAddr, geoOption)
+				if err != nil {
+					glog.Warningf("Failed to obtain the geohash of %v: %v.", r.IpAddr, err)
+				}
+				clientIP.With(prometheus.Labels{
+					"ip":         r.IpAddr,
+					"local_port": r.LocalPort,
+					"geohash":    geohash,
+					"country":    country,
+					"location":   location}).Inc()
+				totalClients.With(prometheus.Labels{"local_port": r.LocalPort}).Inc()
+				pq.Update(r.IpAddr, time.Now())
+			case RecordEntryTypeSend:
+				secondsSpent := float64(r.MillisecondsSpent) / 1000
+				clientSeconds.With(prometheus.Labels{
+					"ip":         r.IpAddr,
+					"local_port": r.LocalPort}).Add(secondsSpent)
+				totalSeconds.With(prometheus.Labels{"local_port": r.LocalPort}).Add(secondsSpent)
+				totalBytes.With(prometheus.Labels{"local_port": r.LocalPort}).Add(float64(r.BytesSent))
+				pq.Update(r.IpAddr, time.Now())
+			case RecordEntryTypeStop:
+				secondsSpent := float64(r.MillisecondsSpent) / 1000
+				clientSeconds.With(prometheus.Labels{
+					"ip":         r.IpAddr,
+					"local_port": r.LocalPort}).Add(secondsSpent)
+				totalSeconds.With(prometheus.Labels{"local_port": r.LocalPort}).Add(secondsSpent)
+				totalClientsClosed.With(prometheus.Labels{"local_port": r.LocalPort}).Inc()
+				pq.Update(r.IpAddr, time.Now())
+			case RecordEntryTypeClean:
+				top := pq.Peek()
+				deadline := time.Now().Add(-time.Second * time.Duration(prometheusCleanUnseenSeconds))
+				for top != nil && top.Value.Before(deadline) {
+					clientIP.DeletePartialMatch(prometheus.Labels{"ip": top.Key})
+					clientSeconds.DeletePartialMatch(prometheus.Labels{"ip": top.Key})
+					pq.Pop()
+					top = pq.Peek()
+				}
+			}
+		}
+	}()
+	return records
+}

metrics/priority_queue.go

@@ -0,0 +1,94 @@
+package metrics
+
+import (
+	"container/heap"
+	"time"
+)
+
+// Pair represents a key-value pair with a timestamp
+type Pair struct {
+	Key     string
+	Value   time.Time
+	HeapIdx int // Index in the heap for efficient updates
+}
+
+// PriorityQueue is a min-heap implementation for Pairs
+type PriorityQueue []*Pair
+
+// Len returns the length of the priority queue
+func (pq PriorityQueue) Len() int { return len(pq) }
+
+// Less compares two pairs based on their values (timestamps)
+func (pq PriorityQueue) Less(i, j int) bool {
+	return pq[i].Value.Before(pq[j].Value)
+}
+
+// Swap swaps two pairs in the priority queue
+func (pq PriorityQueue) Swap(i, j int) {
+	pq[i], pq[j] = pq[j], pq[i]
+	pq[i].HeapIdx = i
+	pq[j].HeapIdx = j
+}
+
+// Push adds a pair to the priority queue
+func (pq *PriorityQueue) Push(x interface{}) {
+	pair := x.(*Pair)
+	pair.HeapIdx = len(*pq)
+	*pq = append(*pq, pair)
+}
+
+// Pop removes the pair with the minimum value (timestamp) from the priority queue
+func (pq *PriorityQueue) Pop() interface{} {
+	old := *pq
+	n := len(old)
+	pair := old[n-1]
+	pair.HeapIdx = -1 // for safety
+	*pq = old[0 : n-1]
+	return pair
+}
+
+// UpdatablePriorityQueue represents the data structure with the priority queue
+type UpdatablePriorityQueue struct {
+	pq     PriorityQueue
+	keyMap map[string]*Pair
+}
+
+// NewUpdatablePriorityQueue initializes a new UpdatablePriorityQueue
+func NewUpdatablePriorityQueue() *UpdatablePriorityQueue {
+	return &UpdatablePriorityQueue{
+		pq:     make(PriorityQueue, 0),
+		keyMap: make(map[string]*Pair),
+	}
+}
+
+// Update adds or updates a key-value pair in the data structure
+func (ds *UpdatablePriorityQueue) Update(key string, value time.Time) {
+	if pair, ok := ds.keyMap[key]; ok {
+		// Key exists, update the time
+		pair.Value = value
+		heap.Fix(&ds.pq, pair.HeapIdx)
+	} else {
+		// Key does not exist, create a new entry
+		pair := &Pair{Key: key, Value: value}
+		heap.Push(&ds.pq, pair)
+		ds.keyMap[key] = pair
+	}
+}
+
+// Peek returns the entry with the minimal time
+func (ds *UpdatablePriorityQueue) Peek() *Pair {
+	if ds.pq.Len() == 0 {
+		return nil
+	}
+	return ds.pq[0]
+}
+
+// Pop removes the entry with the minimal time
+func (ds *UpdatablePriorityQueue) Pop() *Pair {
+	if ds.pq.Len() == 0 {
+		return nil
+	}
+	pair := heap.Pop(&ds.pq).(*Pair)
+	delete(ds.keyMap, pair.Key)
+	return pair
+}