From d425e34f71f2b8606c99fc1203d43cd2b47fcec6 Mon Sep 17 00:00:00 2001 From: ryan Date: Wed, 1 Apr 2026 10:02:40 +0800 Subject: [PATCH] =?UTF-8?q?[=E4=BC=98=E5=8C=96]=20=E6=9B=B4=E6=96=B0?= =?UTF-8?q?=E9=BB=98=E8=AE=A4=E6=9C=8D=E5=8A=A1=E5=99=A8=E5=9D=97=EF=BC=8C?= =?UTF-8?q?=E6=B7=BB=E5=8A=A0=20HTTPS=20=E6=94=AF=E6=8C=81=E5=B9=B6?= =?UTF-8?q?=E5=90=AF=E7=94=A8=20SSL=20=E6=8F=A1=E6=89=8B=E6=8B=92=E7=BB=9D?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- openflare_server/service/config_version.go | 17 ++++++++++++++++- openflare_server/service/https_phase1_test.go | 12 ++++++++++++ 2 files changed, 28 insertions(+), 1 deletion(-) diff --git a/openflare_server/service/config_version.go b/openflare_server/service/config_version.go index 356e9cd0..6f3d5ed2 100644 --- a/openflare_server/service/config_version.go +++ b/openflare_server/service/config_version.go @@ -1222,7 +1222,22 @@ func renderConnectionUpgradeMap() string { } func renderDefaultServerBlock() string { - return " server {\n listen 80 default_server;\n server_name _;\n\n return 404;\n }\n\n" + return strings.Join([]string{ + " server {", + " listen 80 default_server;", + " server_name _;", + "", + " return 404;", + " }", + "", + " server {", + " listen 443 ssl default_server;", + " server_name _;", + "", + " ssl_reject_handshake on;", + " }", + "", + }, "\n") } func renderProxyHeaderBlock(originURL string, originHost string, customHeaders []ProxyRouteCustomHeaderInput, upstreamConfig routeUpstreamConfig) string { diff --git a/openflare_server/service/https_phase1_test.go b/openflare_server/service/https_phase1_test.go index d63809fc..fd99ee2b 100644 --- a/openflare_server/service/https_phase1_test.go +++ b/openflare_server/service/https_phase1_test.go @@ -949,12 +949,18 @@ func TestRenderConfigUsesDefaultServerFallback(t *testing.T) { if !strings.Contains(preview.MainConfig, "listen 80 default_server;") { t.Fatal("expected preview main config to include default http server") } + if !strings.Contains(preview.MainConfig, "listen 443 ssl default_server;") { + t.Fatal("expected preview main config to include default https server") + } if !strings.Contains(preview.MainConfig, "server_name _;") { t.Fatal("expected preview main config to include default server_name") } if !strings.Contains(preview.MainConfig, "return 404;") { t.Fatal("expected preview main config to return 404 for unmatched hosts") } + if !strings.Contains(preview.MainConfig, "ssl_reject_handshake on;") { + t.Fatal("expected preview main config to reject unmatched https handshakes") + } } func TestCreateTLSCertificateRejectsInvalidPEM(t *testing.T) { @@ -1007,6 +1013,12 @@ func TestOpenRestyMainConfigTemplateRenderAndValidate(t *testing.T) { if !strings.Contains(preview.MainConfig, "listen 80 default_server;") { t.Fatal("expected preview main config to preserve managed default server block") } + if !strings.Contains(preview.MainConfig, "listen 443 ssl default_server;") { + t.Fatal("expected preview main config to preserve managed default https server block") + } + if !strings.Contains(preview.MainConfig, "ssl_reject_handshake on;") { + t.Fatal("expected preview main config to preserve managed https handshake rejection") + } invalidTemplate := strings.ReplaceAll( common.OpenRestyMainConfigTemplate,