[功能] 添加 origin_host 字段以覆盖回源请求的 Host 头

2026-10-07 16:16:37 +08:00 · 2026-03-16 12:19:39 +08:00
parent ce08099de1
commit 4daf681eff
14 changed files with 152 additions and 27 deletions
@@ -54,6 +54,7 @@ type ConfigOptionDiffItem struct {
 type snapshotRoute struct {
 	Domain        string                        `json:"domain"`
 	OriginURL     string                        `json:"origin_url"`
+	OriginHost    string                        `json:"origin_host,omitempty"`
 	Enabled       bool                          `json:"enabled"`
 	EnableHTTPS   bool                          `json:"enable_https"`
 	CertID        *uint                         `json:"cert_id,omitempty"`
@@ -379,6 +380,7 @@ func buildSnapshotRoutes(routes []*model.ProxyRoute) ([]snapshotRoute, error) {
 		items = append(items, snapshotRoute{
 			Domain:        route.Domain,
 			OriginURL:     route.OriginURL,
+			OriginHost:    route.OriginHost,
 			Enabled:       route.Enabled,
 			EnableHTTPS:   route.EnableHTTPS,
 			CertID:        route.CertID,
@@ -424,7 +426,7 @@ func normalizeSnapshotRoutes(routes []snapshotRoute) []snapshotRoute {
 }

 func snapshotRouteConfigEqual(left snapshotRoute, right snapshotRoute) bool {
-	if left.Domain != right.Domain || left.OriginURL != right.OriginURL || left.EnableHTTPS != right.EnableHTTPS || left.RedirectHTTP != right.RedirectHTTP || !uintPointerEqual(left.CertID, right.CertID) {
+	if left.Domain != right.Domain || left.OriginURL != right.OriginURL || left.OriginHost != right.OriginHost || left.EnableHTTPS != right.EnableHTTPS || left.RedirectHTTP != right.RedirectHTTP || !uintPointerEqual(left.CertID, right.CertID) {
 		return false
 	}
 	if len(left.CustomHeaders) != len(right.CustomHeaders) {
@@ -593,7 +595,7 @@ func renderRouteConfig(routes []*model.ProxyRoute) (string, []SupportFile, error
 			return "", nil, fmt.Errorf("路由 %s 自定义请求头无效", route.Domain)
 		}
 		if !route.EnableHTTPS {
-			builder.WriteString(renderHTTPProxyServer(route.Domain, route.OriginURL, customHeaders))
+			builder.WriteString(renderHTTPProxyServer(route.Domain, route.OriginURL, route.OriginHost, customHeaders))
 			continue
 		}
 		if route.CertID == nil || *route.CertID == 0 {
@@ -610,9 +612,9 @@ func renderRouteConfig(routes []*model.ProxyRoute) (string, []SupportFile, error
 		if route.RedirectHTTP {
 			builder.WriteString(renderHTTPRedirectServer(route.Domain))
 		} else {
-			builder.WriteString(renderHTTPProxyServer(route.Domain, route.OriginURL, customHeaders))
+			builder.WriteString(renderHTTPProxyServer(route.Domain, route.OriginURL, route.OriginHost, customHeaders))
 		}
-		builder.WriteString(renderHTTPSServer(route.Domain, route.OriginURL, certificate.ID, customHeaders))
+		builder.WriteString(renderHTTPSServer(route.Domain, route.OriginURL, route.OriginHost, certificate.ID, customHeaders))
 	}
 	return builder.String(), dedupeSupportFiles(supportFiles), nil
 }
@@ -746,27 +748,31 @@ func nextVersionNumber(now time.Time) (string, error) {
 	return fmt.Sprintf("%s-%03d", prefix, count+1), nil
 }

-func renderHTTPProxyServer(domain string, originURL string, customHeaders []ProxyRouteCustomHeaderInput) string {
-	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n%s\n    location / {\n%s        proxy_pass %s;\n    }\n}\n\n", domain, renderExactHostGuard(domain), renderProxyHeaderBlock(customHeaders), originURL)
+func renderHTTPProxyServer(domain string, originURL string, originHost string, customHeaders []ProxyRouteCustomHeaderInput) string {
+	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n%s\n    location / {\n%s        proxy_pass %s;\n    }\n}\n\n", domain, renderExactHostGuard(domain), renderProxyHeaderBlock(originHost, customHeaders), originURL)
 }

 func renderHTTPRedirectServer(domain string) string {
 	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n%s\n    return 301 https://$host$request_uri;\n}\n\n", domain, renderExactHostGuard(domain))
 }

-func renderHTTPSServer(domain string, originURL string, certificateID uint, customHeaders []ProxyRouteCustomHeaderInput) string {
+func renderHTTPSServer(domain string, originURL string, originHost string, certificateID uint, customHeaders []ProxyRouteCustomHeaderInput) string {
 	certPath := fmt.Sprintf("%s/%s", nginxCertDirPlaceholder, certificateCertFileName(certificateID))
 	keyPath := fmt.Sprintf("%s/%s", nginxCertDirPlaceholder, certificateKeyFileName(certificateID))
-	return fmt.Sprintf("server {\n    listen 443 ssl;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n%s\n    location / {\n%s        proxy_pass %s;\n    }\n}\n\n", domain, certPath, keyPath, renderExactHostGuard(domain), renderProxyHeaderBlock(customHeaders), originURL)
+	return fmt.Sprintf("server {\n    listen 443 ssl;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n%s\n    location / {\n%s        proxy_pass %s;\n    }\n}\n\n", domain, certPath, keyPath, renderExactHostGuard(domain), renderProxyHeaderBlock(originHost, customHeaders), originURL)
 }

 func renderExactHostGuard(domain string) string {
 	return fmt.Sprintf("    if ($host != %q) {\n        return 404;\n    }\n", domain)
 }

-func renderProxyHeaderBlock(customHeaders []ProxyRouteCustomHeaderInput) string {
+func renderProxyHeaderBlock(originHost string, customHeaders []ProxyRouteCustomHeaderInput) string {
 	var builder strings.Builder
-	builder.WriteString("        proxy_set_header Host $host;\n")
+	if strings.TrimSpace(originHost) != "" {
+		builder.WriteString(fmt.Sprintf("        proxy_set_header Host %s;\n", quoteNginxHeaderValue(originHost)))
+	} else {
+		builder.WriteString("        proxy_set_header Host $host;\n")
+	}
 	builder.WriteString("        proxy_set_header X-Real-IP $remote_addr;\n")
 	builder.WriteString("        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n")
 	builder.WriteString("        proxy_set_header X-Forwarded-Proto $scheme;\n")
@@ -140,6 +140,31 @@ func TestPublishConfigVersionRendersCustomHeaders(t *testing.T) {
 	}
 }

+func TestPublishConfigVersionOverridesOriginHostHeader(t *testing.T) {
+	setupServiceTestDB(t)
+
+	_, err := CreateProxyRoute(ProxyRouteInput{
+		Domain:     "git.arctel.de",
+		OriginURL:  "https://git.arctel.net",
+		OriginHost: "git.arctel.net",
+		Enabled:    true,
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+
+	result, err := PublishConfigVersion("root")
+	if err != nil {
+		t.Fatalf("PublishConfigVersion failed: %v", err)
+	}
+	if !strings.Contains(result.Version.RenderedConfig, `proxy_set_header Host "git.arctel.net";`) {
+		t.Fatal("expected rendered config to override host header for origin routing")
+	}
+	if !strings.Contains(result.Version.SnapshotJSON, `"origin_host":"git.arctel.net"`) {
+		t.Fatal("expected snapshot to include origin_host override")
+	}
+}
+
 func TestPreviewConfigVersionCanDisableWebsocketHeaders(t *testing.T) {
 	setupServiceTestDB(t)

@@ -19,6 +19,7 @@ type ProxyRouteCustomHeaderInput struct {
 type ProxyRouteInput struct {
 	Domain        string                        `json:"domain"`
 	OriginURL     string                        `json:"origin_url"`
+	OriginHost    string                        `json:"origin_host"`
 	Enabled       bool                          `json:"enabled"`
 	EnableHTTPS   bool                          `json:"enable_https"`
 	CertID        *uint                         `json:"cert_id"`
@@ -74,6 +75,7 @@ func DeleteProxyRoute(id uint) error {
 func buildProxyRoute(route *model.ProxyRoute, input ProxyRouteInput) (*model.ProxyRoute, error) {
 	domain := strings.ToLower(strings.TrimSpace(input.Domain))
 	originURL := strings.TrimSpace(input.OriginURL)
+	originHost := strings.TrimSpace(input.OriginHost)
 	remark := strings.TrimSpace(input.Remark)
 	customHeaders, err := normalizeCustomHeaders(input.CustomHeaders)
 	if err != nil {
@@ -92,6 +94,9 @@ func buildProxyRoute(route *model.ProxyRoute, input ProxyRouteInput) (*model.Pro
 	if err := validateOriginURL(originURL); err != nil {
 		return nil, err
 	}
+	if err := validateOriginHost(originHost); err != nil {
+		return nil, err
+	}
 	if !input.EnableHTTPS {
 		input.RedirectHTTP = false
 		input.CertID = nil
@@ -112,6 +117,7 @@ func buildProxyRoute(route *model.ProxyRoute, input ProxyRouteInput) (*model.Pro
 	}
 	route.Domain = domain
 	route.OriginURL = originURL
+	route.OriginHost = originHost
 	route.Enabled = input.Enabled
 	route.EnableHTTPS = input.EnableHTTPS
 	route.CertID = input.CertID
@@ -178,6 +184,23 @@ func validateOriginURL(raw string) error {
 	return nil
 }

+func validateOriginHost(raw string) error {
+	if raw == "" {
+		return nil
+	}
+	if strings.ContainsAny(raw, "/\\ \t\r\n") || strings.Contains(raw, "://") {
+		return errors.New("回源主机名格式不合法")
+	}
+	parsed, err := url.Parse("//" + raw)
+	if err != nil || parsed.Host == "" || parsed.Host != raw {
+		return errors.New("回源主机名格式不合法")
+	}
+	if parsed.Hostname() == "" {
+		return errors.New("回源主机名格式不合法")
+	}
+	return nil
+}
+
 func isUniqueConstraintError(err error) bool {
 	return err != nil && strings.Contains(strings.ToLower(err.Error()), "unique")
 }