跳至主要内容Skip to content
私有化部署 · 企业软件授权 · 主控与节点均运行在您的基础设施中 Self-hosted · licensed enterprise software · control plane and nodes run on your own infrastructure 系统架构Architecture FAQ
查看定价View pricing
高级防御Advanced defense

在 TLS 握手之前，就把打你的连接挡在网卡上 Drop the attack at the NIC, before the TLS handshake

有一类 CC 永远走不到应用层：连接建起来了，TLS 握手挂住不动，或者干脆把连接占着。它们不产生任何一条 HTTP 请求，因此限速和 WAF 都看不见它们。高级防御在既有安全策略之外补上 TLS 前的一层：节点在连接层判定异常来源，由 cdn-agent 管理的 eBPF 引擎在内核里丢包，并复用现有的跨节点联防链路把结论同步到全网。 Some CC traffic never reaches the application layer: the connection opens, the TLS handshake stalls, or the connection is simply held. It produces no HTTP request at all, so rate limiting and WAF never see it. Advanced defense adds a pre-TLS layer alongside your existing security policies: nodes judge abnormal sources at the connection layer, an eBPF engine managed by cdn-agent drops packets in the kernel, and the result propagates fleet-wide over the cross-node chain you already run.

增强版 · 定制版Enhanced · Custom 统一 eBPF 引擎 · XDP 优先，自动回退 tcOne eBPF engine · XDP first, automatic tc fallback 复用现有联防链路，不另建控制面Reuses the existing chain, no second control plane
功能与版本对比Compare editions 查看基础安全能力Baseline security
分层防御Layered defense

两层职责分开，判定顺序固定Two layers, separate jobs, one fixed order

WAF、JS 挑战和访问限速判定的是请求，要等 TLS 握手完成、HTTP 解析出来才有输入。TLS 前清洗判定的是连接和数据包，位置在握手之前。两者不是同一层，也不互相替代：下面是一条连接自下而上要穿过的全部关卡，顺序是固定的。WAF, JS Challenge and rate limiting judge requests: they need a completed TLS handshake and a parsed HTTP message before they have any input at all. Pre-TLS scrubbing judges connections and packets, before the handshake. They are not the same layer and do not substitute for each other. Below is every gate a connection passes through, in the order it passes them.

TLS 之前 · 网卡与内核（eBPF 数据面）Before TLS · NIC and kernel (eBPF data plane)

  1. 保底放行名单Allowlist

    环回与链路本地地址内置，运维可再追加 IP 或 CIDR。它排在所有判定之前，因此「封禁把自己关在门外」不可能发生；连接层判定与内核证据两处都尊重同一份名单。Loopback and link-local are built in; operators can append IPs or CIDRs. It is evaluated before everything else, so a ban can never lock the platform out of its own nodes. Both the connection-layer logic and the kernel evidence path honour the same list.

    直接放行Pass
  2. 封禁表命中Ban table hit

    本机快路表与全局封禁表分开两张，任一命中即丢弃。分开是刻意的：本机条目随本机 TTL 自然消失，全局条目由 Edge KV 真源驱动并支持全量对账，合成一张会让一次全局对账抹掉本机刚写进去的条目。Local fast-path bans and global bans live in two separate tables; a hit in either drops the packet. Keeping them apart is deliberate: local entries expire on their own TTL, global entries are driven by the Edge KV source of truth and support full reconciliation. Merging them would let one reconcile pass erase what the local path just wrote.

    内核丢包Kernel drop
  3. SYN 令牌桶SYN token bucket

    每来源桶与整机桶两级，只作用于 CDN 入口端口。端口过滤放在封禁判定之后，是为了不误伤 SSH 与管理链路。整机桶只在最紧的两档（高强度清洗 / SYN 洪泛应急）打开，它是「整机被打穿」时的最后一道，不是日常限速。A per-source bucket plus a whole-node bucket, applied only to CDN ingress ports. Port filtering sits after the ban check, so SSH and management traffic are never caught. The whole-node bucket opens only in the two tightest presets (strict scrubbing and SYN flood emergency): it is the last resort when the machine is being flooded, not everyday rate limiting.

    超限丢包Drop over limit

TLS 握手期间 · 节点连接层During the TLS handshake · node connection layer

  1. 连接层异常观察Connection-anomaly watch

    四类发生在 accept() 之后的异常计入固定观察窗口：TLS 握手超时、握手失败、单 IP 连接被拒、连接任务超时。同一来源在窗口内累计达到触发次数，且异常数压过它自己正常收尾的连接数达到设定倍数，两个条件同时成立才本机临时封禁。完成过三次握手是硬前提。Four anomaly types occurring after accept() feed a fixed observation window: TLS handshake timeout, handshake failure, per-IP connection refusal and connection-task timeout. A source is temp-banned locally only when it reaches the trigger count within the window and its anomalies outweigh its own cleanly-closed connections by the configured ratio. Having completed a TCP handshake is a hard prerequisite.

    本机临时封禁Local temp ban

TLS 之后 · 应用层安全策略After TLS · application-layer policy

  1. 站点安全策略Site security policy

    IP 黑白名单、访问限速、WAF 规则、JS Challenge、地域访问控制、慢速攻击防护。它们按站点生效，输出的是对这次请求的处置；其中限速规则命中 temp_ban 时才会产生一条本机临时封禁，进而进入下面的联防链路。IP allow/deny lists, rate limiting, WAF rules, JS Challenge, geo access control and slow-attack protection. They apply per site and decide what happens to this request. Only a rate-limit rule whose action is temp_ban produces a local temporary ban, which then enters the cross-node chain below.

    403 / 429 / 挑战页403 / 429 / challenge
内核执行层Kernel enforcement

一套 eBPF 引擎，两种挂载方式One eBPF engine, two attach points

判定逻辑只有一份，编译出 XDP 与 tc 两个入口，共享同一组 Map 与同一条判定顺序，语义完全一致。执行层由 cdn-agent 独占管理：它是唯一的特权执行器，cdn-node 只通过本机 Unix socket 把结论交给它，不新增任何网络监听面。There is a single copy of the decision logic, compiled into two entry points, XDP and tc, which share the same maps and the same evaluation order, with identical semantics. cdn-agent owns the enforcement layer as the only privileged executor; cdn-node hands it conclusions over a local Unix socket and opens no new network listener.

  1. native XDP
    首选：驱动层丢包First choice: drop in the driver

    只以驱动模式挂载。挂不上就整档放弃，不退到 generic XDP：generic 在 skb 分配之后才跑，没有值得一提的性能优势，却会让面板上出现「XDP」字样，让运维按驱动层的量级做容量规划。Attached in driver mode only. If that fails the whole tier is abandoned rather than falling back to generic XDP: generic runs after skb allocation, offers no meaningful performance gain, and would still print "XDP" on the dashboard, so operators would plan capacity for a layer they are not actually running on.

  2. tc ingress
    回退：clsact ingressFallback: clsact ingress

    网卡驱动不支持 native XDP 时自动降级到 tc ingress，判定顺序与丢包行为不变，只是位置更靠后一点。面板会明确显示为「降级」，不会伪装成 XDP。When the NIC driver has no native XDP support, the engine automatically falls back to tc ingress. The evaluation order and the drop behaviour are unchanged, only the attach point is slightly later. The dashboard reports this as "degraded" and never disguises it as XDP.

  3. unsupported
    都挂不上：如实报不支持Neither attaches: reported unsupported

    能力探测全部是真实的 BPF 系统调用，并会真的把探测程序挂上目标网卡再立刻卸下。网卡驱动支不支持 XDP，无法从内核版本或发行版名称推断。探测失败只降级或判不支持，绝不阻断节点代理与 agent 升级通道。Capability probing uses real BPF syscalls and genuinely attaches a probe program to the target interface before detaching it immediately. Whether a NIC driver supports XDP cannot be inferred from a kernel version or a distro name. A failed probe only degrades or reports unsupported; it never blocks the node proxy or the agent upgrade channel.

面板上的绿灯代表什么What the green light means 逐节点Per node

「看起来在防护、实际上什么都没做」比没有面板更危险，运维会据此关掉别的防护手段。所以状态取值是硬约定，未知取值一律按不支持处理，绝不乐观解释。A dashboard that looks protected while doing nothing is worse than no dashboard: operators will switch off other defenses because of it. The state values are therefore a hard contract, and any unrecognised value is treated as unsupported rather than given the benefit of the doubt.

高级防御逐节点生效状态与内核是否真的在丢包Advanced defense per-node state and whether the kernel is really dropping packets
状态State 含义Meaning 内核在丢包Dropping
active native XDP 已生效Native XDP in effect 是Yes
degraded 已生效，用的是 tc ingress 后端In effect via the tc ingress backend 是Yes
disabled 策略未下发，或总开关关闭No policy pushed, or the master switch is off 否No
unsupported agent 不在、IPC 不通或内核能力探测未过Agent absent, IPC unreachable, or kernel probe failed 否No
error 探测通过，但加载 / 挂载 / 写表失败，带原因Probe passed, but load, attach or map write failed; the reason is shown 否No
✓三层版本对照：主控下发的策略版本 / 节点确认收到 / agent 已应用，一眼看出「节点收到了但内核没落地」还是「节点根本没收到」Three version columns: what the control plane pushed, what the node acknowledged and what the agent applied, so "the node got it but the kernel did not" is distinguishable from "the node never got it" ✓「实际参数」是节点规范化之后真正交给 agent 的那一份，可能与主控算出来的不同"Effective parameters" shows what the node actually handed the agent after sanitising, which may differ from what the control plane computed ✓TLS 前判定每项都带来源：主控接管 / 节点环境变量 / 出厂默认；旧节点没上报的项显示「—」，不兜默认值Every pre-TLS parameter carries its source: control plane, node environment variable, or factory default. Items an older node never reported show "—" rather than a guessed default
跨节点联防Cross-node chain

从一台节点的判定，到全网的执行From one node's judgement to fleet-wide enforcement

高级防御不新建任何跨节点封禁流。它复用你已经在跑的那一条：本机封禁随心跳上报、主控聚合、Edge KV 广播、节点镜像、内核执行。新增的只是最后一段的下沉，以及把参数从环境变量抬到后台。Advanced defense creates no new cross-node ban flow. It reuses the one already running: local bans ride the heartbeat, the control plane aggregates, Edge KV broadcasts, nodes mirror, the kernel enforces. What is new is the final hop into the kernel, plus moving the parameters out of environment variables and into the console.

上行 · 证据Upstream · evidence 节点 → 主控node → control plane
本机临时封禁Local temp ban连接层判定 或 限速规则 temp_banconnection-layer verdict or a temp_ban rule
心跳上报Heartbeat report随健康上报低频带出被封 IPbanned IPs ride the health report
主控聚合Control-plane aggregation按窗口统计「同一 IP 被几个不同节点上报」counts distinct nodes reporting the same IP
下行 · 执行Downstream · enforcement 主控 → 全部节点control plane → all nodes
系统 Edge KV 广播System Edge KV broadcast系统保留键 · 带 TTL · 全局封禁唯一真源system-reserved key · TTL · single source of truth
节点 KV 同步Node KV sync快照 + 增量事件，镜像到进程内判定snapshot + incremental events, mirrored in-process
内核执行层Kernel enforcementagent 幂等写入全局封禁表agent writes the global ban table idempotently
证据门槛Evidence bar

默认要两个不同节点各自说了算Two independent nodes, by default

出厂默认是：统计窗口内同一个 IP 被至少 2 个不同节点各自本机封禁，才提升为全网封禁。门槛 2 的存在是为了挡住两件事：共享出口（CGNAT、企业网关）带来的单节点误判，以及单台被攻陷的节点把任意 IP 放大成全网封禁。The factory default: a fleet-wide ban is only promoted when at least two distinct nodes have each banned the same IP locally within the aggregation window. That two-node bar exists to stop two things: a single node misjudging a shared egress (CGNAT, corporate gateways), and one compromised node amplifying an arbitrary IP into a fleet-wide ban.

节点数门槛、统计窗口、聚合周期与全局封禁时长这四项，是独立于清洗参数的后台设置：可在面板显式填写，也可清空交回环境变量或出厂默认。Node threshold, aggregation window, aggregation interval and global ban TTL are console settings independent of the scrubbing parameters: fill them in explicitly, or clear them to hand control back to the environment variable or the factory default.

内核证据Kernel evidence

只能加权，不能单独触发封禁Adds weight; it cannot trigger a ban on its own

被每来源 SYN 桶持续拒绝的来源会进入一张定容候选表，由 agent 增量取走，经受控的本机 Unix socket 交给同一台机器上的节点。节点只给已经存在可验证连接层异常的来源加权；对从未完成过握手的来源直接丢弃并计数。Sources repeatedly rejected by the per-source SYN bucket land in a bounded candidate table, are drained incrementally by the agent and handed to the node on the same machine over a controlled local Unix socket. The node only adds weight to sources that already show verifiable connection-layer anomalies; candidates that never completed a handshake are discarded and counted.

判定与封禁都不在 agent 里做，候选也不经过任何网络监听面。No judgement or banning happens inside the agent, and candidates never traverse a network listener.

安全边界Safety boundary

裸 SYN 不能独立封人A bare SYN never bans anyone

裸 SYN 的源地址是可以伪造的。如果允许单一 SYN 证据自动封 IP，攻击者只要以受害者地址为源打几千个伪造包，就能点名封禁任意 IP，还会经跨节点聚合放大到全网。所以纯 SYN 洪泛的处置始终只是限速丢包，不产生封禁条目。The source address of a bare SYN can be forged. If a single SYN observation could ban an IP, an attacker would only need to spray a few thousand spoofed packets carrying a victim's address to have that victim banned by name, and the ban amplified fleet-wide by the aggregator. A pure SYN flood is therefore always handled by rate-limited dropping and never produces a ban entry.

状态恢复Recovery

Edge KV 是唯一真源Edge KV is the only source of truth

内核封禁表与节点进程内的判定缓存都只是执行缓存。agent 重启、节点重启或内核程序重挂之后，下一次 KV 快照重放会把状态补回来，不需要人工干预，也不会因此漏封。The kernel ban tables and the node's in-process lookup are execution caches only. After an agent restart, a node restart or a kernel program reload, the next KV snapshot replay restores the state without manual intervention, so nothing quietly stops being blocked.

防御预设Defense presets

六套预设，每一套都写明代价Six presets, each with its cost written down

清洗参数彼此耦合：单独调高整机 SYN 上限而不动每来源桶，等于没调。所以面板给的是预设，不是七八个孤立的数字框。预设按由松到紧排列，每一套都标注适用场景、强度和误伤风险：没有「无风险」这一档，把代价说清楚才是这一栏存在的理由。The scrubbing parameters are coupled: raising the whole-node SYN ceiling without touching the per-source bucket changes nothing. So the console offers presets rather than eight isolated number fields. They are ordered from loosest to tightest, and each states its scenario, its strength and its false-positive risk. There is no zero-risk tier, and naming the cost is the entire point of that column.

兼容优先Compatibility first

强度 最低Strength: lowest

新装、灰度，或对误伤零容忍的站点。只丢已确认的恶意 IP，不引入任何新的速率判定。New installs, gradual rollout, or sites with zero tolerance for false positives. Drops confirmed malicious IPs only, adding no new rate judgement.

误伤风险 · 极低Risk · very low对正常流量的行为与「完全没开」一致；代价是纯 TLS 前的攻击要攒更久才判得出来。Behaves identically to having it switched off; the cost is that a pure pre-TLS attack takes longer to accumulate enough evidence.

均衡防护Balanced

强度 中 · 出厂默认Strength: medium · default

日常常开档：一层温和的每来源 SYN 令牌桶，加上出厂默认的 TLS 前判定。选它等于回到默认。The everyday tier: a gentle per-source SYN token bucket plus the factory-default pre-TLS thresholds. Choosing it is the same as returning to defaults.

误伤风险 · 低Risk · low每来源桶对正常浏览器与移动网络的 NAT 出口都留有充足余量。The per-source bucket leaves ample headroom for normal browsers and mobile-network NAT egresses.

高强度清洗Strict scrubbing

强度 高Strength: high

正在被打，且已确认攻击来源集中。收紧每来源速率，并打开整机 SYN 保护。Under attack, with the sources confirmed to be concentrated. Tightens the per-source rate and opens the whole-node SYN guard.

误伤风险 · 中Risk · medium会影响大出口后面的重度用户；封禁时长翻倍，误封的恢复也更慢。Heavy users behind a large shared egress will feel it; ban durations double, so recovering from a false positive is slower too.

分布式慢连接Distributed slow connections

强度 高 · 偏 TLS 前判定Strength: high · pre-TLS weighted

海量来源、每个来源都很慢：握手挂住不动、连接占着不走，单看任何一分钟都不异常，只有把观察窗口拉长才看得出来。SYN 桶保持不变：慢连接每一条都完成了三次握手，收紧 SYN 桶只会误伤正常访客。Many sources, each of them slow: handshakes stall, connections are held open, and no single minute looks abnormal. Only a longer observation window reveals it. The SYN bucket is left unchanged: every slow connection completes its handshake, so tightening it would only hurt legitimate visitors.

误伤风险 · 中高Risk · medium-high长观察窗口配低触发门槛，意味着长期弱网的真实用户也可能攒够次数；比例闸同时放宽。A long window paired with a low trigger count means genuine users on persistently poor networks can accumulate enough events; the ratio gate is loosened at the same time.

SYN 洪泛应急SYN flood emergency

强度 最高Strength: highest

整机被 SYN 打穿时使用：内核那一层收到最紧，本机判定同步跟上。这一档是拿一部分可用性换机器不倒。For when the machine itself is being flooded: the kernel layer clamps down hardest and the local judgement follows. This tier trades some availability to keep the node standing.

误伤风险 · 高Risk · high每来源 10 个 SYN/秒会明显误伤 CGNAT 与企业出口后面的真实用户，攻击结束后应尽快切回。Ten SYNs per second per source will visibly affect real users behind CGNAT and corporate egresses; switch back as soon as the attack subsides.

自定义Custom

强度 由你决定Strength: yours to set

以上五档都不合适时，逐项自己填。切到这一档不会改动任何现有值。When none of the five fit, fill each field yourself. Switching to this tier changes none of your existing values.

误伤风险 · 取决于所填数值Risk · whatever you type每来源 SYN 速率设得过低会让全站访客进不来，而应用日志上完全看不出来。A per-source SYN rate set too low locks every visitor out, and the application logs show nothing at all.

草稿、保存、下发Draft, save, push 后台管理Console-managed
✓选预设是零请求的：只把一批参数填进表单。点「保存并下发」才写库并广播一次，避免半套参数先生效。Selecting a preset sends no request. It just fills in the form; only "Save and push" writes to the database and broadcasts once, so half a policy never takes effect on its own. ✓每一项都是三态：没动 = 不改；清空 = 交回节点本机配置或恢复跟随默认；填值 = 显式接管。保存时只提交动过的字段，保存条会如实列出这次将提交哪几项。Every field is tri-state: untouched means unchanged, cleared hands control back to the node or the default, and a value means an explicit takeover. Only touched fields are submitted, and the save bar lists exactly which ones. ✓优先级是固定的：面板设置 > 环境变量 > 出厂默认。环境变量只作兜底，升级后不填任何东西，行为与升级前一致。The precedence is fixed: console setting > environment variable > factory default. Environment variables act only as a fallback, so after an upgrade, changing nothing leaves behaviour exactly as it was. ✓时间按分钟填写，支持小数（0.5 = 30 秒），输入框不带步进按钮。Durations are entered in minutes, decimals allowed (0.5 = 30 seconds), with no spinner buttons on the inputs.
热更新与收敛Hot reload and convergence 无需重启节点No node restart
✓节点热更新：改一个参数不需要逐台改环境变量再重启。重启会把正在累计的候选账本一起清空，而攻击进行中恰恰最不该清空它。Nodes reload in place: changing a parameter no longer means editing environment variables machine by machine and restarting. A restart wipes the candidate ledger being accumulated, which is the last thing you want mid-attack. ✓逐节点确认与漂移检测：主控下发的版本、节点确认收到的版本、agent 已应用的版本三层对照，哪一台没跟上一眼看得出来。Per-node acknowledgement and drift detection: the version pushed, the version the node acknowledged and the version the agent applied are shown side by side, so a machine that has fallen behind is immediately visible. ✓改动只影响之后：已生效封禁的到期时刻不追溯修改，正在累计的候选账本原样保留；调小跟踪上限不会清空已跟踪的来源，只是之后不再接纳新来源。Changes apply going forward only: existing bans keep their expiry, the accumulating ledger is preserved, and lowering the tracking cap does not clear tracked sources; it only stops accepting new ones. ✓控制面关不掉 TLS 前判定：下发的触发次数下界是 1，只能调松。一次误配不该让全网静默失去这一层；真要应急关闭，走节点本机那条旁路。The control plane cannot switch pre-TLS judgement off: the pushed trigger count has a lower bound of 1, so it can only be loosened. One misconfiguration should never silently remove this layer fleet-wide; the emergency off switch lives on the node itself.
授权边界：Licensing scope: 高级防御的控制面接管与内核执行层仅面向增强版和定制版开放，授权不足时管理接口读写一律拒绝，面板展示升级引导。版本门禁关掉的是「主控下发清洗策略」和「内核数据面」这两件事；节点本机的 TLS 前判定链路照常运行，仍按本机配置判定异常、本机临时封禁并走既有的上报与聚合链路。授权降级时主控会主动广播一次停用配置并留下审计，不会静默消失。Control-plane takeover and the kernel enforcement layer are available in the Enhanced and Custom editions only; without the licence the management API refuses both reads and writes and the console shows an upgrade prompt. The gate turns off two things: pushing scrubbing policy, and the kernel data plane. The node's own pre-TLS judgement keeps running, still detecting anomalies from local configuration, still banning locally, still feeding the existing report-and-aggregate chain. On a licence downgrade the control plane actively broadcasts a stop configuration and records an audit entry rather than letting it lapse silently.
适用场景When to use it

什么时候该开这一层When to turn this on

高级防御是既有安全策略的补充，不是替代。下面三类情况是它真正解决的问题；其余场景用站点安全策略通常就够。Advanced defense supplements your existing security policies rather than replacing them. These are the three situations it genuinely solves; for anything else, site security policy is usually enough.

01

应用层看不见的连接型 CCConnection-level CC the app never sees

节点日志里握手超时刷屏，内核 SYN 丢包持续上涨，全局黑名单却一直是空的：这些来源从来没产生过一条 HTTP 请求，限速判定收不到任何输入。开启 TLS 前判定后，这类来源才第一次有票可投。Handshake timeouts fill the node logs, kernel SYN drops keep climbing, yet the global blocklist stays empty. These sources never emit a single HTTP request, so rate limiting has nothing to judge. Turning on pre-TLS judgement is what finally gives them a vote.

分布式慢连接档Slow-connection preset 握手超时Handshake timeout
02

整机被 SYN 打穿The node itself is being flooded

流量还没走到 TLS 就把机器压住了。内核层的每来源与整机令牌桶在驱动层就丢掉超限的 SYN，代价是明确写在预设里的误伤风险。开之前先确认保底放行名单已含主控出口、监控系统与可用性探针，它们的连接行为与异常特征天然相近。The machine is saturated before traffic even reaches TLS. The per-source and whole-node token buckets drop excess SYNs in the driver, at a false-positive cost the preset states outright. Before enabling it, confirm the allowlist already covers your control plane, monitoring system and availability probes, whose connection patterns naturally resemble the anomaly signature.

SYN 洪泛应急档SYN flood preset 保底放行Allowlist
03

多节点部署要收敛结论Multi-node deployments need one conclusion

同一个来源在两台节点上各自被判定为异常之后，结论经聚合提升为全网封禁并下沉到每台机器的内核，其余节点不必再各自挨一遍。单节点实例本地封禁已经够用，无需提升。Once the same source has been judged abnormal independently on two nodes, the conclusion is promoted to a fleet-wide ban and sunk into every machine's kernel, so the remaining nodes never have to take the hit themselves. A single-node deployment needs no promotion at all; its local ban already covers it.

跨节点聚合Cross-node aggregation Edge KV
在功能对比中查看版本差异 →See how the editions differ → 高可用功能High availability 仅增强版和定制版可用。本页不承诺任何缓解量级、攻击峰值或切换耗时数字。部署与选档问题见 常见问题。Enhanced and Custom editions only. This page does not put a figure on mitigation capacity, attack peaks or switching time. For deployment and tier-selection questions, see the FAQ.

按需要选择授权版本和档位Choose the edition and tier you need

按节点数和授权站点数（以根域名 Zone 计）透明计费。选哪一档看实际部署规模，选哪个版本看您需要哪些高级功能与服务。Transparent pricing, based on licensed node count and licensed sites counted per root-domain Zone. The tier follows your deployment size; the edition follows which advanced capabilities and services you need.

查看授权定价View pricing 功能与版本对比Compare editions