fix: protect shared rules across delivery and recovery (#560)

go-gost/x/api/api.go

@@ -52,7 +52,7 @@ func Register(r *gin.Engine, opts *Options) {
 	router.StaticFS("/docs", http.FS(swaggerDoc))
 
 	config := router.Group("/config")
-	config.Use(mwBasicAuth(opts.Auther))
+	config.Use(mwBasicAuth(opts.Auther), configTransaction())
 
 	config.GET("", getConfig)
 	config.POST("", saveConfig)

go-gost/x/api/config_reload.go

@@ -37,9 +37,12 @@ func reloadConfig(ctx *gin.Context) {
 		return
 	}
 
-	config.Set(cfg)
-
-	if err := loader.Load(cfg); err != nil {
+	if err := loader.Reload(cfg, func(*config.Config) error {
+		for _, svc := range registry.ServiceRegistry().GetAll() {
+			go svc.Serve()
+		}
+		return nil
+	}); err != nil {
 		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, err.Error()))
 		return
 	}
@@ -51,13 +54,6 @@ func reloadConfig(ctx *gin.Context) {
 	}
 	xservice.GetGlobalTrafficManager().RetainServices(activeServices)
 
-	for _, svc := range registry.ServiceRegistry().GetAll() {
-		svc := svc
-		go func() {
-			svc.Serve()
-		}()
-	}
-
 	ctx.JSON(http.StatusOK, Response{
 		Msg: "OK",
 	})

go-gost/x/api/config_transaction.go

@@ -0,0 +1,90 @@
+package api
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/x/config"
+)
+
+const maxConfigRequestBody = 16 << 20
+
+// Read the complete bounded request before acquiring the runtime transaction
+// lock. Buffer the response until after it is released: neither a slow upload
+// nor a client that stops reading may block panel commands, reload or shutdown.
+func configTransaction() gin.HandlerFunc {
+	return func(ctx *gin.Context) {
+		if ctx.Request.Body != nil {
+			body := http.MaxBytesReader(ctx.Writer, ctx.Request.Body, maxConfigRequestBody)
+			data, err := io.ReadAll(body)
+			body.Close()
+			if err != nil {
+				status := http.StatusBadRequest
+				var tooLarge *http.MaxBytesError
+				if errors.As(err, &tooLarge) {
+					status = http.StatusRequestEntityTooLarge
+				}
+				ctx.AbortWithStatusJSON(status, Response{Code: status, Msg: "Unable to read configuration request"})
+				return
+			}
+			ctx.Request.Body = io.NopCloser(bytes.NewReader(data))
+		}
+
+		writer := ctx.Writer
+		buffered := &configResponseWriter{ResponseWriter: writer, header: writer.Header().Clone(), status: http.StatusOK, size: -1}
+		ctx.Writer = buffered
+		defer func() { ctx.Writer = writer }()
+		func() {
+			unlock := config.LockMutation()
+			defer unlock()
+			// A request waiting behind reload may have been closed during shutdown.
+			if ctx.Request.Context().Err() != nil {
+				ctx.Abort()
+				return
+			}
+			ctx.Next()
+		}()
+		ctx.Writer = writer
+		for key, values := range buffered.header {
+			writer.Header()[key] = values
+		}
+		writer.WriteHeader(buffered.status)
+		writer.Write(buffered.body.Bytes())
+	}
+}
+
+// Config endpoints return JSON rather than streaming. Preserve Gin's response
+// bookkeeping while delaying all network writes until the transaction ends.
+type configResponseWriter struct {
+	gin.ResponseWriter
+	header http.Header
+	body   bytes.Buffer
+	status int
+	size   int
+}
+
+func (w *configResponseWriter) Header() http.Header { return w.header }
+func (w *configResponseWriter) WriteHeader(status int) {
+	if !w.Written() && status > 0 {
+		w.status = status
+	}
+}
+func (w *configResponseWriter) WriteHeaderNow() {
+	if !w.Written() {
+		w.size = 0
+	}
+}
+func (w *configResponseWriter) Write(p []byte) (int, error) {
+	w.WriteHeaderNow()
+	n, err := w.body.Write(p)
+	w.size += n
+	return n, err
+}
+func (w *configResponseWriter) WriteString(s string) (int, error) { return w.Write([]byte(s)) }
+func (w *configResponseWriter) Status() int                       { return w.status }
+func (w *configResponseWriter) Size() int                         { return w.size }
+func (w *configResponseWriter) Written() bool                     { return w.size >= 0 }
+func (w *configResponseWriter) Flush()                            { w.WriteHeaderNow() }

go-gost/x/api/config_transaction_test.go

@@ -0,0 +1,76 @@
+package api
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/x/config"
+)
+
+func assertMutationAvailable(t *testing.T) {
+	t.Helper()
+	done := make(chan struct{})
+	go func() { unlock := config.LockMutation(); unlock(); close(done) }()
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("network I/O holds runtime mutation lock")
+	}
+}
+
+func TestConfigTransactionDoesNotLockWhileReadingBody(t *testing.T) {
+	router := gin.New()
+	router.Use(configTransaction())
+	router.POST("/config", func(c *gin.Context) { c.JSON(http.StatusOK, Response{Msg: "OK"}) })
+	reader, writer := io.Pipe()
+	defer reader.Close()
+	defer writer.Close()
+	request := httptest.NewRequest(http.MethodPost, "/config", reader)
+	done := make(chan struct{})
+	go func() { defer close(done); router.ServeHTTP(httptest.NewRecorder(), request) }()
+	if _, err := writer.Write([]byte("{")); err != nil {
+		t.Fatal(err)
+	}
+	assertMutationAvailable(t)
+	writer.Close()
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("handler did not finish")
+	}
+}
+
+type blockedResponse struct {
+	header  http.Header
+	started chan struct{}
+	release chan struct{}
+}
+
+func (w *blockedResponse) Header() http.Header { return w.header }
+func (w *blockedResponse) WriteHeader(int)     {}
+func (w *blockedResponse) Write(p []byte) (int, error) {
+	close(w.started)
+	<-w.release
+	return len(p), nil
+}
+
+func TestConfigTransactionReleasesLockBeforeSendingResponse(t *testing.T) {
+	router := gin.New()
+	router.Use(configTransaction())
+	router.POST("/config", func(c *gin.Context) { c.JSON(http.StatusOK, Response{Msg: "OK"}) })
+	writer := &blockedResponse{header: make(http.Header), started: make(chan struct{}), release: make(chan struct{})}
+	defer close(writer.release)
+	request := httptest.NewRequest(http.MethodPost, "/config", strings.NewReader("{}"))
+	go router.ServeHTTP(writer, request)
+	select {
+	case <-writer.started:
+	case <-time.After(time.Second):
+		t.Fatal("response did not start")
+	}
+	assertMutationAvailable(t)
+}

go-gost/x/api/service/service.go

@@ -3,6 +3,7 @@ package service
 import (
 	"net"
 	"net/http"
+	"time"
 
 	"github.com/gin-gonic/gin"
 	"github.com/go-gost/core/auth"
@@ -67,7 +68,11 @@ func NewService(network, addr string, opts ...Option) (service.Service, error) {
 
 	return &server{
 		s: &http.Server{
-			Handler: r,
+			Handler:           r,
+			ReadHeaderTimeout: 5 * time.Second,
+			ReadTimeout:       15 * time.Second,
+			WriteTimeout:      30 * time.Second,
+			IdleTimeout:       60 * time.Second,
 		},
 		ln:     ln,
 		cclose: make(chan struct{}),
@@ -83,7 +88,11 @@ func (s *server) Addr() net.Addr {
 }
 
 func (s *server) Close() error {
-	return s.s.Close()
+	// Close can race the goroutine entering Serve during a failed startup.
+	// http.Server.Close alone does not own the listener until Serve starts.
+	err := s.s.Close()
+	s.ln.Close()
+	return err
 }
 
 func (s *server) IsClosed() bool {

go-gost/x/config/config.go

@@ -23,10 +23,20 @@ func init() {
 }
 
 var (
-	global    = &Config{}
-	globalMux sync.RWMutex
+	global      = &Config{}
+	globalMux   sync.RWMutex
+	mutationMux sync.Mutex
 )
 
+// LockMutation serializes complete runtime/config transactions across panel
+// commands, management API requests, startup and reload. It is separate from
+// globalMux so callers may safely use Global, Set and OnUpdate while holding it.
+// Lock before reading/parsing the config and hold through persistence/rollback.
+func LockMutation() func() {
+	mutationMux.Lock()
+	return mutationMux.Unlock
+}
+
 func Global() *Config {
 	globalMux.RLock()
 	defer globalMux.RUnlock()

go-gost/x/config/loader/loader.go

@@ -1,6 +1,8 @@
 package loader
 
 import (
+	"fmt"
+
 	"github.com/go-gost/core/logger"
 	"github.com/go-gost/x/config"
 	"github.com/go-gost/x/config/parsing"
@@ -30,6 +32,34 @@ func Load(cfg *config.Config) error {
 	return defaultLoader.Load(cfg)
 }
 
+// Reload replaces the runtime and commits the config only after it starts.
+// The caller must hold config.LockMutation, including while parsing cfg, so the
+// rollback snapshot includes every previously acknowledged runtime command.
+// Failed loads can partially replace registries and bind listeners; always
+// rebuild the last successful snapshot before returning an error.
+func Reload(cfg *config.Config, run func(*config.Config) error) error {
+	previous := config.Global()
+	if err := apply(cfg, run); err != nil {
+		// A failed partial load may have left both old and new listeners behind.
+		for name := range registry.ServiceRegistry().GetAll() {
+			registry.ServiceRegistry().Unregister(name)
+		}
+		if rollbackErr := apply(previous, run); rollbackErr != nil {
+			return fmt.Errorf("reload failed: %w; restore previous config failed: %v", err, rollbackErr)
+		}
+		return fmt.Errorf("reload failed (previous config restored): %w", err)
+	}
+	config.Set(cfg)
+	return nil
+}
+
+func apply(cfg *config.Config, run func(*config.Config) error) error {
+	if err := Load(cfg); err != nil {
+		return err
+	}
+	return run(cfg)
+}
+
 type loader struct{}
 
 func (l *loader) Load(cfg *config.Config) error {
@@ -217,12 +247,19 @@ func register(cfg *config.Config) error {
 		registry.ServiceRegistry().Unregister(name)
 	}
 	for _, svcCfg := range cfg.Services {
+		if svcCfg == nil {
+			return fmt.Errorf("service config is nil")
+		}
+		if paused, _ := svcCfg.Metadata["paused"].(bool); paused {
+			continue
+		}
 		svc, err := service_parser.ParseService(svcCfg)
 		if err != nil {
 			return err
 		}
 		if svc != nil {
 			if err := registry.ServiceRegistry().Register(svcCfg.Name, svc); err != nil {
+				svc.Close()
 				return err
 			}
 		}

go-gost/x/config/loader/reload_test.go

@@ -0,0 +1,84 @@
+package loader_test
+
+import (
+	"net"
+	"testing"
+	"time"
+
+	"github.com/go-gost/x/config"
+	"github.com/go-gost/x/config/loader"
+	_ "github.com/go-gost/x/handler/auto"
+	_ "github.com/go-gost/x/listener/tcp"
+	"github.com/go-gost/x/registry"
+)
+
+func TestReloadRestoresPreviousRuntime(t *testing.T) {
+	for _, failure := range []string{"listener", "handler", "partial", "run"} {
+		t.Run(failure, func(t *testing.T) {
+			unlock := config.LockMutation()
+			defer unlock()
+			original := config.Global()
+			defer config.Set(original)
+			defer func() {
+				for name := range registry.ServiceRegistry().GetAll() {
+					registry.ServiceRegistry().Unregister(name)
+				}
+			}()
+			old := &config.Config{Services: []*config.ServiceConfig{
+				{Name: "shared-rule", Addr: "127.0.0.1:0", Handler: &config.HandlerConfig{Type: "auto"}, Listener: &config.ListenerConfig{Type: "tcp"}},
+				{Name: "paused-rule", Addr: "127.0.0.1:0", Metadata: map[string]any{"paused": true}},
+			}}
+			if err := loader.Load(old); err != nil {
+				t.Fatal(err)
+			}
+			addr := registry.ServiceRegistry().Get("shared-rule").Addr().String()
+			old.Services[0].Addr = addr
+			config.Set(old)
+			serve := func(*config.Config) error {
+				for _, svc := range registry.ServiceRegistry().GetAll() {
+					go svc.Serve()
+				}
+				return nil
+			}
+			serve(old)
+			replacement := config.Global()
+			replacement.Services = replacement.Services[:1]
+			switch failure {
+			case "listener":
+				replacement.Services[0].Listener.Type = "invalid-listener"
+			case "handler":
+				replacement.Services[0].Handler.Type = "invalid-handler"
+			case "partial":
+				replacement.Services = append(replacement.Services, &config.ServiceConfig{Name: "broken", Listener: &config.ListenerConfig{Type: "invalid-listener"}})
+			}
+			run := serve
+			if failure == "run" {
+				run = func(cfg *config.Config) error {
+					if cfg == replacement {
+						return &net.AddrError{Err: "auxiliary listener failed", Addr: "test"}
+					}
+					return serve(cfg)
+				}
+			}
+			if err := loader.Reload(replacement, run); err == nil {
+				t.Fatal("expected reload failure")
+			}
+			restored := registry.ServiceRegistry().Get("shared-rule")
+			if restored == nil || restored.Addr().String() != addr {
+				t.Fatal("previous service was not restored on its original port")
+			}
+			if registry.ServiceRegistry().Get("paused-rule") != nil {
+				t.Fatal("rollback resumed a paused service")
+			}
+			conn, err := net.DialTimeout("tcp", addr, time.Second)
+			if err != nil {
+				t.Fatalf("restored listener unavailable: %v", err)
+			}
+			conn.Close()
+			got := config.Global()
+			if len(got.Services) != 2 || got.Services[0].Listener.Type != "tcp" || got.Services[0].Handler.Type != "auto" {
+				t.Fatalf("failed config was committed: %+v", got.Services)
+			}
+		})
+	}
+}

go-gost/x/config/parsing/service/parse.go

@@ -255,6 +255,15 @@ func ParseService(cfg *config.ServiceConfig) (service.Service, error) {
 		return nil, err
 	}
 
+	// Listener initialization binds the port. If handler/TLS/forwarder parsing
+	// fails, release it so a reload rollback can restore the previous listener.
+	configured := false
+	defer func() {
+		if !configured {
+			ln.Close()
+		}
+	}()
+
 	handlerLogger := serviceLogger.WithFields(map[string]any{
 		"kind": "handler",
 	})
@@ -379,6 +388,7 @@ func ParseService(cfg *config.ServiceConfig) (service.Service, error) {
 	)
 
 	serviceLogger.Infof("listening on %s/%s", s.Addr().String(), s.Addr().Network())
+	configured = true
 	return s, nil
 }
 

go-gost/x/metrics/service/service.go

@@ -84,7 +84,9 @@ func (s *metricService) Addr() net.Addr {
 }
 
 func (s *metricService) Close() error {
-	return s.s.Close()
+	err := s.s.Close()
+	s.ln.Close()
+	return err
 }
 
 func (s *metricService) IsClosed() bool {

go-gost/x/service/traffic_reporter.go

@@ -370,43 +370,43 @@ type getConfigResponse struct {
 
 // getConfigData 获取配置数据（避免循环依赖）
 func getConfigData() ([]byte, error) {
-	config.OnUpdate(func(c *config.Config) error {
-		for _, svc := range c.Services {
-			if svc == nil {
-				continue
+	// Reporting is read-only: enriching a detached snapshot must not persist
+	// stale state over a config currently being reloaded or acknowledged.
+	cfg := config.Global()
+	for _, svc := range cfg.Services {
+		if svc == nil {
+			continue
+		}
+		s := registry.ServiceRegistry().Get(svc.Name)
+		ss, ok := s.(serviceStatus)
+		if ok && ss != nil {
+			status := ss.Status()
+			svc.Status = &config.ServiceStatus{
+				CreateTime: status.CreateTime().Unix(),
+				State:      string(status.State()),
 			}
-			s := registry.ServiceRegistry().Get(svc.Name)
-			ss, ok := s.(serviceStatus)
-			if ok && ss != nil {
-				status := ss.Status()
-				svc.Status = &config.ServiceStatus{
-					CreateTime: status.CreateTime().Unix(),
-					State:      string(status.State()),
+			if st := status.Stats(); st != nil {
+				svc.Status.Stats = &config.ServiceStats{
+					TotalConns:   st.Get(stats.KindTotalConns),
+					CurrentConns: st.Get(stats.KindCurrentConns),
+					TotalErrs:    st.Get(stats.KindTotalErrs),
+					InputBytes:   st.Get(stats.KindInputBytes),
+					OutputBytes:  st.Get(stats.KindOutputBytes),
 				}
-				if st := status.Stats(); st != nil {
-					svc.Status.Stats = &config.ServiceStats{
-						TotalConns:   st.Get(stats.KindTotalConns),
-						CurrentConns: st.Get(stats.KindCurrentConns),
-						TotalErrs:    st.Get(stats.KindTotalErrs),
-						InputBytes:   st.Get(stats.KindInputBytes),
-						OutputBytes:  st.Get(stats.KindOutputBytes),
-					}
-				}
-				for _, ev := range status.Events() {
-					if !ev.Time.IsZero() {
-						svc.Status.Events = append(svc.Status.Events, config.ServiceEvent{
-							Time: ev.Time.Unix(),
-							Msg:  ev.Message,
-						})
-					}
+			}
+			for _, ev := range status.Events() {
+				if !ev.Time.IsZero() {
+					svc.Status.Events = append(svc.Status.Events, config.ServiceEvent{
+						Time: ev.Time.Unix(),
+						Msg:  ev.Message,
+					})
 				}
 			}
 		}
-		return nil
-	})
+	}
 
 	var resp getConfigResponse
-	resp.Config = config.Global()
+	resp.Config = cfg
 
 	buf := &bytes.Buffer{}
 	resp.Config.Write(buf, "json")

go-gost/x/service/traffic_reporter_test.go

@@ -1,10 +1,14 @@
 package service
 
 import (
+	"bytes"
 	"context"
 	"errors"
+	"github.com/go-gost/x/config"
 	"io"
 	"net/http"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -148,3 +152,31 @@ func TestPostJSONWithFallbackRemembersDetectedURL(t *testing.T) {
 		t.Fatalf("expected remembered http url first, got %s", calls[0])
 	}
 }
+
+func TestConfigReportDoesNotPersistStaleRuntime(t *testing.T) {
+	previous, path := config.Global(), config.PersistPath()
+	defer config.Set(previous)
+	defer config.SetPersistPath(path)
+	config.Set(&config.Config{Services: []*config.ServiceConfig{{Name: "old-runtime"}}})
+	filename := filepath.Join(t.TempDir(), "gost.json")
+	candidate := []byte(`{"services":[{"name":"new-on-disk"}]}`)
+	if err := os.WriteFile(filename, candidate, 0600); err != nil {
+		t.Fatal(err)
+	}
+	config.SetPersistPath(filename)
+	config.EnablePersist()
+	report, err := getConfigData()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Contains(report, []byte("old-runtime")) {
+		t.Fatalf("unexpected report: %s", report)
+	}
+	saved, err := os.ReadFile(filename)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(saved, candidate) {
+		t.Fatalf("report overwrote candidate config: %s", saved)
+	}
+}

go-gost/x/socket/command_dispatch_test.go

@@ -115,3 +115,39 @@ func TestMutationQueueExecutesCommandsInArrivalOrder(t *testing.T) {
 	}
 	close(second.release)
 }
+
+func TestMutationCommandWaitsForRuntimeTransaction(t *testing.T) {
+	original := config.Global()
+	defer config.Set(original)
+	name := "reload_transaction_service"
+	svc := &blockingCommandService{started: make(chan struct{}), release: make(chan struct{})}
+	close(svc.release)
+	if err := registry.ServiceRegistry().Register(name, svc); err != nil {
+		t.Fatal(err)
+	}
+	defer registry.ServiceRegistry().Unregister(name)
+	config.Set(&config.Config{Services: []*config.ServiceConfig{{Name: name}}})
+	reporter := NewWebSocketReporter("", "transaction-test-secret")
+	defer reporter.Stop()
+	unlock := config.LockMutation()
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		reporter.routeCommand(CommandMessage{Type: "DeleteService", Data: map[string]any{"services": []string{name}}})
+	}()
+	select {
+	case <-svc.started:
+		unlock()
+		t.Fatal("command interleaved with runtime transaction")
+	case <-time.After(50 * time.Millisecond):
+	}
+	unlock()
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("command did not resume after transaction")
+	}
+	if registry.ServiceRegistry().Get(name) != nil {
+		t.Fatal("service was not removed")
+	}
+}

go-gost/x/socket/websocket_reporter.go

@@ -179,6 +179,7 @@ type WebSocketReporter struct {
 	tcpPingSem        chan struct{}     // 限制诊断探测并发，避免离线目标耗尽连接
 	readCommandSem    chan struct{}     // 限制只读命令并发，避免诊断请求耗尽资源
 	mutationQueue     chan CommandMessage
+	workers           sync.WaitGroup
 }
 
 var wsDial = func(dialer *websocket.Dialer, rawURL string) (*websocket.Conn, *http.Response, error) {
@@ -238,8 +239,15 @@ func (w *WebSocketReporter) releaseTCPPingSlot() {
 
 // Start 启动WebSocket报告器
 func (w *WebSocketReporter) Start() {
-	go w.runMutationCommands()
-	go w.run()
+	w.workers.Add(2)
+	go func() {
+		defer w.workers.Done()
+		w.runMutationCommands()
+	}()
+	go func() {
+		defer w.workers.Done()
+		w.run()
+	}()
 }
 
 // Stop 停止WebSocket报告器
@@ -250,6 +258,7 @@ func (w *WebSocketReporter) Stop() {
 		w.conn.Close()
 	}
 	w.connMutex.Unlock()
+	w.workers.Wait()
 }
 
 // backoffWithJitter 返回带随机抖动的退避时间（±25%）
@@ -339,10 +348,10 @@ func (w *WebSocketReporter) connect() error {
 
 	candidates := buildWebSocketCandidates(w.addr, w.secret, w.version, cfg.Http, cfg.Tls, cfg.Socks, w.preferredWSScheme)
 
-	dialer := websocket.DefaultDialer
+	dialer := *websocket.DefaultDialer
 	dialer.HandshakeTimeout = 10 * time.Second
 
-	conn, usedURL, err := dialWebSocketWithFallback(dialer, candidates)
+	conn, usedURL, err := dialWebSocketWithFallback(&dialer, candidates)
 	if err != nil {
 		return err
 	}
@@ -528,7 +537,11 @@ func (w *WebSocketReporter) handleConnection() {
 	}()
 
 	// 启动消息接收goroutine
-	go w.receiveMessages()
+	w.workers.Add(1)
+	go func() {
+		defer w.workers.Done()
+		w.receiveMessages()
+	}()
 
 	// 指标上报 ticker
 	metricTicker := time.NewTicker(w.pingInterval)
@@ -887,6 +900,14 @@ func isMutationCommand(commandType string) bool {
 
 // routeCommand 路由命令到对应的处理函数
 func (w *WebSocketReporter) routeCommand(cmd CommandMessage) {
+	if isMutationCommand(cmd.Type) {
+		unlock := config.LockMutation()
+		defer unlock()
+		if w.ctx.Err() != nil {
+			w.sendCommandFailure(cmd, "Agent is shutting down")
+			return
+		}
+	}
 	jsonBytes, errs := json.Marshal(cmd)
 	if errs != nil {
 		fmt.Println("Error marshaling JSON:", errs)