refactor(backend): rename OpenFlare directory to lowercase openflare

2026-10-09 00:56:37 +08:00 · 2026-08-30 17:43:23 +08:00
parent 06d5fedbfc
commit c93ff6674f
543 changed files with 819 additions and 819 deletions
@@ -0,0 +1,458 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package waf
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/netip"
+	"regexp"
+	"slices"
+	"strings"
+)
+
+const (
+	maxRuleGraphNodes       = 128
+	maxRuleGraphEdges       = 256
+	maxRuleGraphBytes       = 256 * 1024
+	maxUACustomPatterns     = 32
+	maxUACustomPatternBytes = 256
+)
+
+var (
+	countryCodePattern = regexp.MustCompile(`^[A-Z]{2}$`)
+	regionCodePattern  = regexp.MustCompile(`^[A-Z]{2}-[A-Z0-9]{1,3}$`)
+)
+
+// ValidateRuleGraph validates graph structure, node configuration, references,
+// reachability, and termination before compilation.
+func ValidateRuleGraph(ctx context.Context, graph RuleGraph, ipGroupExists func(context.Context, uint) (bool, error)) error {
+	if err := validateRuleGraphLimits(graph); err != nil {
+		return err
+	}
+	nodes, startID, err := validateRuleGraphNodes(ctx, graph.Nodes, ipGroupExists)
+	if err != nil {
+		return err
+	}
+	outgoing, incoming, handleTargets, err := validateRuleGraphEdges(nodes, graph.Edges)
+	if err != nil {
+		return err
+	}
+	if hasRuleGraphCycle(nodes, outgoing, incoming) {
+		return errors.New("规则图不能包含循环")
+	}
+	if err := validateRequiredHandles(graph.Nodes, handleTargets); err != nil {
+		return err
+	}
+	if err := validateRuleGraphConnectivity(graph.Nodes, startID, outgoing, incoming); err != nil {
+		return err
+	}
+	return validateTerminalPaths(graph.Nodes, outgoing)
+}
+
+func validateRuleGraphLimits(graph RuleGraph) error {
+	if graph.SchemaVersion != RuleGraphSchemaVersion {
+		return fmt.Errorf("规则图 schema_version 必须为 %d", RuleGraphSchemaVersion)
+	}
+	if len(graph.Nodes) > maxRuleGraphNodes {
+		return fmt.Errorf("规则图节点数不能超过 %d", maxRuleGraphNodes)
+	}
+	if len(graph.Edges) > maxRuleGraphEdges {
+		return fmt.Errorf("规则图边数不能超过 %d", maxRuleGraphEdges)
+	}
+	if raw, err := json.Marshal(graph); err != nil {
+		return fmt.Errorf("规则图无法序列化: %w", err)
+	} else if len(raw) > maxRuleGraphBytes {
+		return errors.New("规则图大小不能超过 256 KiB")
+	}
+	return nil
+}
+
+func validateRuleGraphNodes(ctx context.Context, graphNodes []RuleNode, ipGroupExists func(context.Context, uint) (bool, error)) (map[string]RuleNode, string, error) {
+	nodes := make(map[string]RuleNode, len(graphNodes))
+	startCount, allowCount, startID := 0, 0, ""
+	for _, node := range graphNodes {
+		if strings.TrimSpace(node.ID) == "" {
+			return nil, "", errors.New("节点 ID 不能为空")
+		}
+		if _, exists := nodes[node.ID]; exists {
+			return nil, "", fmt.Errorf("节点 ID %s 重复", node.ID)
+		}
+		nodes[node.ID] = node
+		switch node.Type {
+		case RuleNodeStart:
+			startCount++
+			startID = node.ID
+		case RuleNodeAllow:
+			allowCount++
+		case RuleNodeBlock, RuleNodeIPMatch, RuleNodeGeoMatch, RuleNodePoW, RuleNodeUACheck, RuleNodeSecurityCheck:
+		default:
+			return nil, "", fmt.Errorf("节点 %s 的类型 %s 未知", node.ID, node.Type)
+		}
+		if err := validateRuleNodeConfig(ctx, node, ipGroupExists); err != nil {
+			return nil, "", err
+		}
+	}
+	if startCount != 1 {
+		return nil, "", errors.New("规则图必须恰好包含一个开始节点")
+	}
+	if allowCount != 1 {
+		return nil, "", errors.New("规则图必须恰好包含一个通过节点")
+	}
+	return nodes, startID, nil
+}
+
+func validateRuleGraphEdges(nodes map[string]RuleNode, graphEdges []RuleEdge) (map[string][]RuleEdge, map[string]int, map[string]int, error) {
+	edgeIDs := make(map[string]struct{}, len(graphEdges))
+	outgoing := make(map[string][]RuleEdge)
+	incoming := make(map[string]int)
+	handleTargets := make(map[string]int)
+	for _, edge := range graphEdges {
+		if strings.TrimSpace(edge.ID) == "" {
+			return nil, nil, nil, errors.New("边 ID 不能为空")
+		}
+		if _, exists := edgeIDs[edge.ID]; exists {
+			return nil, nil, nil, fmt.Errorf("边 ID %s 重复", edge.ID)
+		}
+		edgeIDs[edge.ID] = struct{}{}
+		source, ok := nodes[edge.Source]
+		if !ok {
+			return nil, nil, nil, fmt.Errorf("边 %s 的源节点 %s 不存在", edge.ID, edge.Source)
+		}
+		if _, ok := nodes[edge.Target]; !ok {
+			return nil, nil, nil, fmt.Errorf("边 %s 的目标节点 %s 不存在", edge.ID, edge.Target)
+		}
+		if !validSourceHandle(source.Type, edge.SourceHandle) {
+			return nil, nil, nil, fmt.Errorf("边 %s 的源端口 %s 不适用于节点 %s", edge.ID, edge.SourceHandle, edge.Source)
+		}
+		key := edge.Source + "\x00" + edge.SourceHandle
+		handleTargets[key]++
+		if handleTargets[key] > 1 {
+			return nil, nil, nil, fmt.Errorf("节点 %s 的 %s 出口连接了多个目标", edge.Source, edge.SourceHandle)
+		}
+		outgoing[edge.Source] = append(outgoing[edge.Source], edge)
+		incoming[edge.Target]++
+	}
+	return outgoing, incoming, handleTargets, nil
+}
+
+func validateRequiredHandles(nodes []RuleNode, handleTargets map[string]int) error {
+	for _, node := range nodes {
+		for _, handle := range requiredHandles(node.Type) {
+			if handleTargets[node.ID+"\x00"+handle] == 0 {
+				return fmt.Errorf("节点 %s 的 %s 出口未连接", node.ID, handle)
+			}
+		}
+	}
+	return nil
+}
+
+func validateRuleGraphConnectivity(nodes []RuleNode, startID string, outgoing map[string][]RuleEdge, incoming map[string]int) error {
+	reachable := walkRuleGraph(startID, outgoing)
+	for _, node := range nodes {
+		if !reachable[node.ID] {
+			return fmt.Errorf("节点 %s 无法从开始节点到达", node.ID)
+		}
+	}
+	for _, node := range nodes {
+		if node.Type == RuleNodeStart && incoming[node.ID] != 0 {
+			return fmt.Errorf("开始节点 %s 不能有入边", node.ID)
+		}
+		if node.Type != RuleNodeStart && incoming[node.ID] == 0 {
+			return fmt.Errorf("节点 %s 必须至少有一条入边", node.ID)
+		}
+		if (node.Type == RuleNodeAllow || node.Type == RuleNodeBlock) && len(outgoing[node.ID]) != 0 {
+			return fmt.Errorf("终止节点 %s 不能有出口", node.ID)
+		}
+	}
+	return nil
+}
+
+func validateRuleNodeConfig(ctx context.Context, node RuleNode, exists func(context.Context, uint) (bool, error)) error {
+	switch node.Type {
+	case RuleNodeStart, RuleNodeAllow:
+		return validateEmptyNodeConfig(node)
+	case RuleNodeIPMatch:
+		return validateIPMatchNodeConfig(ctx, node, exists)
+	case RuleNodeGeoMatch:
+		return validateGeoMatchNodeConfig(node)
+	case RuleNodePoW:
+		return validatePoWNodeConfig(node)
+	case RuleNodeUACheck:
+		return validateUACheckNodeConfig(node)
+	case RuleNodeSecurityCheck:
+		return validateSecurityCheckNodeConfig(node)
+	case RuleNodeBlock:
+		return validateBlockNodeConfig(node)
+	}
+	return nil
+}
+
+func validateEmptyNodeConfig(node RuleNode) error {
+	var cfg struct{}
+	return decodeNodeConfig(node, &cfg)
+}
+
+func validateIPMatchNodeConfig(ctx context.Context, node RuleNode, exists func(context.Context, uint) (bool, error)) error {
+	var cfg IPMatchConfig
+	if err := decodeNodeConfig(node, &cfg); err != nil {
+		return err
+	}
+	for _, raw := range cfg.IPs {
+		if _, err := netip.ParseAddr(raw); err != nil {
+			return fmt.Errorf("节点 %s 的 IP %s 无效", node.ID, raw)
+		}
+	}
+	for _, raw := range cfg.CIDRs {
+		if _, err := netip.ParsePrefix(raw); err != nil {
+			return fmt.Errorf("节点 %s 的 CIDR %s 无效", node.ID, raw)
+		}
+	}
+	for _, id := range cfg.IPGroupIDs {
+		if err := validateIPGroupReference(ctx, node.ID, id, exists); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateIPGroupReference(ctx context.Context, nodeID string, id uint, exists func(context.Context, uint) (bool, error)) error {
+	if id == 0 {
+		return fmt.Errorf("节点 %s 引用的 IP 组 ID 无效", nodeID)
+	}
+	if exists == nil {
+		return fmt.Errorf("节点 %s 无法校验 IP 组 %d", nodeID, id)
+	}
+	ok, err := exists(ctx, id)
+	if err != nil {
+		return fmt.Errorf("节点 %s 校验 IP 组 %d 失败: %w", nodeID, id, err)
+	}
+	if !ok {
+		return fmt.Errorf("节点 %s 引用的 IP 组 %d 不存在", nodeID, id)
+	}
+	return nil
+}
+
+func validateGeoMatchNodeConfig(node RuleNode) error {
+	var cfg GeoMatchConfig
+	if err := decodeNodeConfig(node, &cfg); err != nil {
+		return err
+	}
+	for _, code := range cfg.Countries {
+		if !countryCodePattern.MatchString(code) {
+			return fmt.Errorf("节点 %s 的国家代码 %s 无效", node.ID, code)
+		}
+	}
+	for _, code := range cfg.Regions {
+		if !regionCodePattern.MatchString(code) {
+			return fmt.Errorf("节点 %s 的地区代码 %s 无效", node.ID, code)
+		}
+	}
+	return nil
+}
+
+func validatePoWNodeConfig(node RuleNode) error {
+	var cfg PoWNodeConfig
+	if err := decodeNodeConfig(node, &cfg); err != nil {
+		return err
+	}
+	if cfg.Difficulty < 1 || cfg.Difficulty > 16 {
+		return fmt.Errorf("节点 %s 的 PoW 难度必须在 1-16 之间", node.ID)
+	}
+	if cfg.Algorithm != powAlgorithmFast && cfg.Algorithm != powAlgorithmSlow {
+		return fmt.Errorf("节点 %s 的 PoW 算法必须为 fast 或 slow", node.ID)
+	}
+	if cfg.SessionTTL < minPoWSessionTTLSeconds {
+		return fmt.Errorf("节点 %s 的 PoW 会话 TTL 不能小于 60 秒", node.ID)
+	}
+	if cfg.ChallengeTTL < minPoWChallengeTTLSeconds {
+		return fmt.Errorf("节点 %s 的 PoW 挑战 TTL 不能小于 30 秒", node.ID)
+	}
+	return nil
+}
+
+func validateBlockNodeConfig(node RuleNode) error {
+	var cfg BlockNodeConfig
+	if err := decodeNodeConfig(node, &cfg); err != nil {
+		return err
+	}
+	if cfg.StatusCode < 400 || cfg.StatusCode > 599 {
+		return fmt.Errorf("节点 %s 的阻止状态码必须在 400-599 之间", node.ID)
+	}
+	if len([]byte(cfg.ResponseBody)) > maxWAFBlockBodyBytes {
+		return fmt.Errorf("节点 %s 的阻止响应体不能超过 %d 字节", node.ID, maxWAFBlockBodyBytes)
+	}
+	return nil
+}
+
+func validateUACheckNodeConfig(node RuleNode) error {
+	var cfg UACheckConfig
+	if err := decodeNodeConfig(node, &cfg); err != nil {
+		return err
+	}
+	mode := cfg.MatchMode
+	if mode == "" {
+		mode = UACheckMatchModeOr
+	}
+	if mode != UACheckMatchModeAnd && mode != UACheckMatchModeOr {
+		return fmt.Errorf("节点 %s 的匹配模式必须为 and 或 or", node.ID)
+	}
+	for _, label := range cfg.Browsers {
+		if !uaBrowserLabels[label] {
+			return fmt.Errorf("节点 %s 的浏览器标签 %s 无效", node.ID, label)
+		}
+	}
+	for _, label := range cfg.OperatingSystems {
+		if !uaOSLabels[label] {
+			return fmt.Errorf("节点 %s 的操作系统标签 %s 无效", node.ID, label)
+		}
+	}
+	if len(cfg.CustomUAPatterns) > maxUACustomPatterns {
+		return fmt.Errorf("节点 %s 的自定义 UA 正则不能超过 %d 条", node.ID, maxUACustomPatterns)
+	}
+	for _, pattern := range cfg.CustomUAPatterns {
+		if strings.TrimSpace(pattern) == "" {
+			return fmt.Errorf("节点 %s 的自定义 UA 正则不能为空", node.ID)
+		}
+		if len(pattern) > maxUACustomPatternBytes {
+			return fmt.Errorf("节点 %s 的自定义 UA 正则不能超过 %d 字节", node.ID, maxUACustomPatternBytes)
+		}
+		if _, err := regexp.Compile(pattern); err != nil {
+			return fmt.Errorf("节点 %s 的自定义 UA 正则无效: %s", node.ID, pattern)
+		}
+	}
+	if cfg.BlockCustomUA && len(cfg.CustomUAPatterns) == 0 {
+		return fmt.Errorf("节点 %s 开启屏蔽自定义 UA 时至少需要一条正则", node.ID)
+	}
+	return nil
+}
+
+func validateSecurityCheckNodeConfig(node RuleNode) error {
+	var cfg SecurityCheckConfig
+	return decodeNodeConfig(node, &cfg)
+}
+
+var uaBrowserLabels = map[string]bool{
+	"Chrome": true, "Safari": true, "Firefox": true, "Edge": true, "Opera": true,
+	"Chromium": true, "WeChat": true, "Postman": true, "CLI": true, "Bot": true,
+	"Unknown": true, "Other": true,
+}
+
+var uaOSLabels = map[string]bool{
+	"Android": true, "iOS": true, "Windows": true, "macOS": true, "Chrome OS": true,
+	"Linux": true, "Bot": true, "Unknown": true, "Other": true,
+}
+
+func decodeNodeConfig(node RuleNode, dst any) error {
+	if err := decodeStrictConfig(node.Config, dst); err != nil {
+		return fmt.Errorf("节点 %s 的配置无效: %w", node.ID, err)
+	}
+	return nil
+}
+
+func decodeStrictConfig(raw json.RawMessage, dst any) error {
+	trimmed := bytes.TrimSpace(raw)
+	if bytes.Equal(trimmed, []byte("null")) {
+		return errors.New("配置不能为 null")
+	}
+	if len(trimmed) == 0 {
+		raw = json.RawMessage(`{}`)
+	}
+	decoder := json.NewDecoder(bytes.NewReader(raw))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(dst); err != nil {
+		return err
+	}
+	if err := decoder.Decode(&struct{}{}); !errors.Is(err, io.EOF) {
+		return errors.New("配置包含额外 JSON 值")
+	}
+	return nil
+}
+
+func validSourceHandle(t RuleNodeType, handle string) bool {
+	return slices.Contains(requiredHandles(t), handle)
+}
+func requiredHandles(t RuleNodeType) []string {
+	switch t {
+	case RuleNodeStart, RuleNodePoW:
+		return []string{"next"}
+	case RuleNodeIPMatch, RuleNodeGeoMatch, RuleNodeUACheck, RuleNodeSecurityCheck:
+		return []string{"true", "false"}
+	case RuleNodeAllow, RuleNodeBlock:
+		return nil
+	default:
+		return nil
+	}
+}
+func walkRuleGraph(start string, outgoing map[string][]RuleEdge) map[string]bool {
+	seen := map[string]bool{}
+	stack := []string{start}
+	for len(stack) > 0 {
+		id := stack[len(stack)-1]
+		stack = stack[:len(stack)-1]
+		if seen[id] {
+			continue
+		}
+		seen[id] = true
+		for _, edge := range outgoing[id] {
+			stack = append(stack, edge.Target)
+		}
+	}
+	return seen
+}
+func hasRuleGraphCycle(nodes map[string]RuleNode, outgoing map[string][]RuleEdge, incoming map[string]int) bool {
+	degree := make(map[string]int, len(nodes))
+	queue := []string{}
+	for id := range nodes {
+		degree[id] = incoming[id]
+		if degree[id] == 0 {
+			queue = append(queue, id)
+		}
+	}
+	visited := 0
+	for len(queue) > 0 {
+		id := queue[0]
+		queue = queue[1:]
+		visited++
+		for _, edge := range outgoing[id] {
+			degree[edge.Target]--
+			if degree[edge.Target] == 0 {
+				queue = append(queue, edge.Target)
+			}
+		}
+	}
+	return visited != len(nodes)
+}
+func validateTerminalPaths(nodes []RuleNode, outgoing map[string][]RuleEdge) error {
+	reverse := map[string][]string{}
+	stack := []string{}
+	for _, node := range nodes {
+		if node.Type == RuleNodeAllow || node.Type == RuleNodeBlock {
+			stack = append(stack, node.ID)
+		}
+		for _, edge := range outgoing[node.ID] {
+			reverse[edge.Target] = append(reverse[edge.Target], node.ID)
+		}
+	}
+	terminating := map[string]bool{}
+	for len(stack) > 0 {
+		id := stack[len(stack)-1]
+		stack = stack[:len(stack)-1]
+		if terminating[id] {
+			continue
+		}
+		terminating[id] = true
+		stack = append(stack, reverse[id]...)
+	}
+	for _, node := range nodes {
+		if !terminating[node.ID] {
+			return fmt.Errorf("节点 %s 不存在通往终止节点的路径", node.ID)
+		}
+	}
+	return nil
+}