From 9bf7e3cd1b0095a36ab04a7ec4d3e6beff1b3ef8 Mon Sep 17 00:00:00 2001 From: ryan Date: Sat, 20 Jun 2026 20:47:38 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=20WAF=20=E8=A7=84?= =?UTF-8?q?=E5=88=99=E7=BB=84=20PoW=20=E7=AD=96=E7=95=A5=E5=8F=91=E5=B8=83?= =?UTF-8?q?=E5=90=8E=E8=BE=B9=E7=BC=98=E4=B8=8D=E7=94=9F=E6=95=88?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/changelog/index.md | 2 + .../openflare/config_version/logics_test.go | 61 +++++++++++++++++++ .../apps/openflare/config_version/snapshot.go | 19 +++--- pkg/render/openresty/render_test.go | 58 ++++++++++++++++++ 4 files changed, 131 insertions(+), 9 deletions(-) diff --git a/docs/changelog/index.md b/docs/changelog/index.md index 8790772b..682fcc0b 100644 --- a/docs/changelog/index.md +++ b/docs/changelog/index.md @@ -18,6 +18,8 @@ sidebar: false ### 修复 +- 修复 WAF 规则组 PoW 策略发布后边缘不生效：统一 WAF 绑定站点名与 OpenResty 路由 `site_name` 解析逻辑，并为所有已启用网站生成 `site_rule_groups` 条目（含仅依赖全局规则组的站点）。 + - 修复全球态势板在仅有 `geo_name`（如 mmdb 的 Germany）而无经纬度时误用美国 fallback 坐标的问题；按国家名/ISO 匹配地图质心。 - 修复 Agent 心跳上报公网 IP 后节点地理位置未自动更新：进程启动时按 `GeoIPProvider` 初始化 `pkg/geoip`，`mmdb` 模式从内置 GeoLite2 种子到 `data/`，并在 Relay 心跳同步地理位置。 diff --git a/internal/apps/openflare/config_version/logics_test.go b/internal/apps/openflare/config_version/logics_test.go index 6ab93049..f938a50c 100644 --- a/internal/apps/openflare/config_version/logics_test.go +++ b/internal/apps/openflare/config_version/logics_test.go @@ -8,6 +8,7 @@ import ( "encoding/json" "testing" + "github.com/Rain-kl/Wavelet/internal/apps/openflare/waf" "github.com/Rain-kl/Wavelet/internal/db" "github.com/Rain-kl/Wavelet/internal/model" "github.com/glebarez/sqlite" @@ -81,3 +82,63 @@ func TestPublishConfigVersionCreatesVersion(t *testing.T) { require.NoError(t, err) assert.NotEqual(t, version.ID, forced.ID) } + +func TestBuildSnapshotWAFDocumentUsesNormalizedSiteNames(t *testing.T) { + cleanup := setupConfigVersionTestDB(t) + defer cleanup() + ctx := context.Background() + + route := &model.ProxyRoute{ + Domain: "Example.COM", + Domains: `["example.com","www.example.com"]`, + OriginURL: "http://origin.example.com:8080", + Upstreams: `["http://origin.example.com:8080"]`, + Enabled: true, + } + require.NoError(t, model.CreateProxyRouteRecord(ctx, route)) + + require.NoError(t, waf.EnsureDefaultRuleGroup(ctx)) + globalGroup, err := model.GetGlobalOpenFlareWAFRuleGroup(ctx) + require.NoError(t, err) + + customGroup := &model.OpenFlareWAFRuleGroup{ + Name: "pow-group", + Enabled: true, + PoWEnabled: true, + PoWConfig: `{"difficulty":4,"algorithm":"fast","session_ttl":600,"challenge_ttl":300}`, + } + require.NoError(t, model.CreateOpenFlareWAFRuleGroup(ctx, customGroup)) + require.NoError(t, model.ReplaceOpenFlareWAFRuleGroupBindings(ctx, customGroup.ID, []uint{route.ID})) + + bundle, err := buildCurrentConfigBundle(ctx, true) + require.NoError(t, err) + require.Len(t, bundle.SnapshotRoutes, 1) + assert.Equal(t, "example.com", bundle.SnapshotRoutes[0].SiteName) + + require.NotEmpty(t, bundle.WAFSnapshot.Bindings) + found := false + for _, binding := range bundle.WAFSnapshot.Bindings { + if binding.RouteID != route.ID { + continue + } + found = true + assert.Equal(t, "example.com", binding.SiteName) + assert.Contains(t, binding.RuleGroupIDs, customGroup.ID) + } + assert.True(t, found, "expected WAF binding for enabled route") + + var wafRuntime struct { + SiteRuleGroups map[string][]uint `json:"site_rule_groups"` + } + for _, file := range bundle.SupportFiles { + if file.Path != "waf_config.json" { + continue + } + require.NoError(t, json.Unmarshal([]byte(file.Content), &wafRuntime)) + } + require.Contains(t, wafRuntime.SiteRuleGroups, "example.com") + require.Contains(t, wafRuntime.SiteRuleGroups["example.com"], customGroup.ID) + require.Contains(t, wafRuntime.SiteRuleGroups["example.com"], globalGroup.ID) + assert.Contains(t, bundle.RouteConfig, `set $openflare_waf_site "example.com"`) + assert.Contains(t, bundle.RouteConfig, `require("pow.runtime").check()`) +} diff --git a/internal/apps/openflare/config_version/snapshot.go b/internal/apps/openflare/config_version/snapshot.go index bc1878d7..53d503bc 100644 --- a/internal/apps/openflare/config_version/snapshot.go +++ b/internal/apps/openflare/config_version/snapshot.go @@ -314,16 +314,16 @@ func buildSnapshotWAFDocument(ctx context.Context, routes []*model.ProxyRoute) ( if err != nil { return snapshotWAFDocument{}, err } - enabledRouteIDs := make(map[uint]string, len(routes)) + enabledRouteSiteNames := make(map[uint]string, len(routes)) for _, route := range routes { if route == nil { continue } - siteName := strings.TrimSpace(route.SiteName) - if siteName == "" { - siteName = route.Domain + domains, domainErr := decodeStoredDomains(route.Domains, route.Domain) + if domainErr != nil { + return snapshotWAFDocument{}, fmt.Errorf("route %s domains are invalid", route.Domain) } - enabledRouteIDs[route.ID] = siteName + enabledRouteSiteNames[route.ID] = normalizeProxyRouteSiteName(route, route.SiteName, domains[0]) } rawBindings, err := model.ListOpenFlareWAFRuleGroupBindings(ctx) if err != nil { @@ -331,17 +331,18 @@ func buildSnapshotWAFDocument(ctx context.Context, routes []*model.ProxyRoute) ( } groupIDsByRoute := make(map[uint][]uint, len(rawBindings)) for _, binding := range rawBindings { - if _, ok := enabledRouteIDs[binding.ProxyRouteID]; !ok { + if _, ok := enabledRouteSiteNames[binding.ProxyRouteID]; !ok { continue } groupIDsByRoute[binding.ProxyRouteID] = append(groupIDsByRoute[binding.ProxyRouteID], binding.RuleGroupID) } - bindings := make([]snapshotWAFBinding, 0, len(groupIDsByRoute)) - for routeID, groupIDs := range groupIDsByRoute { + bindings := make([]snapshotWAFBinding, 0, len(enabledRouteSiteNames)) + for routeID, siteName := range enabledRouteSiteNames { + groupIDs := groupIDsByRoute[routeID] sort.Slice(groupIDs, func(i, j int) bool { return groupIDs[i] < groupIDs[j] }) bindings = append(bindings, snapshotWAFBinding{ RouteID: routeID, - SiteName: enabledRouteIDs[routeID], + SiteName: siteName, RuleGroupIDs: groupIDs, }) } diff --git a/pkg/render/openresty/render_test.go b/pkg/render/openresty/render_test.go index 8083f2c6..843820a9 100644 --- a/pkg/render/openresty/render_test.go +++ b/pkg/render/openresty/render_test.go @@ -1,10 +1,68 @@ package openresty import ( + "encoding/json" "strings" "testing" ) +func TestRenderWAFConfigIncludesAllRouteSiteNames(t *testing.T) { + doc := Document{ + Routes: []Route{ + {ID: 1, SiteName: "", Domain: "Example.COM", Domains: []string{"example.com", "www.example.com"}}, + {ID: 2, SiteName: "named-site", Domain: "other.example.com"}, + }, + WAF: WAFDocument{ + RuleGroups: []WAFRuleGroup{ + { + ID: 1, + Name: "pow-group", + Enabled: true, + PoWEnabled: true, + PoWConfig: &PoWConfig{Difficulty: 4, Algorithm: "fast", SessionTTL: 600, ChallengeTTL: 300}, + }, + }, + Bindings: []WAFBinding{ + {RouteID: 1, SiteName: "example.com", RuleGroupIDs: []uint{1}}, + {RouteID: 2, SiteName: "named-site", RuleGroupIDs: []uint{1}}, + }, + }, + } + + wafConfig, err := RenderWAFConfig(doc.WAF) + if err != nil { + t.Fatalf("RenderWAFConfig() error = %v", err) + } + + var decoded struct { + SiteRuleGroups map[string][]uint `json:"site_rule_groups"` + } + if err := json.Unmarshal([]byte(wafConfig), &decoded); err != nil { + t.Fatalf("json.Unmarshal() error = %v", err) + } + + for _, route := range doc.Routes { + siteName := strings.TrimSpace(route.SiteName) + if siteName == "" { + siteName = normalizedRouteDomains(route)[0] + } + if _, ok := decoded.SiteRuleGroups[siteName]; !ok { + t.Fatalf("site_rule_groups missing site %q, got %#v", siteName, decoded.SiteRuleGroups) + } + } + + routeConfig, err := RenderRouteConfig(doc, nil) + if err != nil { + t.Fatalf("RenderRouteConfig() error = %v", err) + } + if !strings.Contains(routeConfig, `set $openflare_waf_site "example.com"`) { + t.Fatalf("expected route config to use normalized site name example.com, got:\n%s", routeConfig) + } + if !strings.Contains(routeConfig, `require("pow.runtime").check()`) { + t.Fatalf("expected route config to enable pow runtime, got:\n%s", routeConfig) + } +} + func TestRenderPagesAPIProxyLocationBlock(t *testing.T) { tests := []struct { name string