920 lines
24 KiB
Go
920 lines
24 KiB
Go
package proxy
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"sort"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/havline/havline/internal/validate"
|
|
)
|
|
|
|
const (
|
|
ExitLocal = "local"
|
|
ExitCloudflare = "cloudflare"
|
|
)
|
|
|
|
type Host struct {
|
|
ID int64 `json:"id"`
|
|
Hostname string `json:"hostname"`
|
|
ListenPort *int `json:"listen_port,omitempty"`
|
|
}
|
|
|
|
type Rule struct {
|
|
ID int64 `json:"id"`
|
|
Domain string `json:"domain"`
|
|
Upstream string `json:"upstream"`
|
|
ListenPort int `json:"listen_port"`
|
|
ListenIPv4 bool `json:"listen_ipv4"`
|
|
ListenIPv6 bool `json:"listen_ipv6"`
|
|
Hosts []Host `json:"hosts"`
|
|
HTTPSEnabled bool `json:"https_enabled"`
|
|
HTTPRedirect bool `json:"http_redirect"`
|
|
Enabled bool `json:"enabled"`
|
|
NginxMode string `json:"nginx_mode"`
|
|
Name string `json:"name"`
|
|
SortOrder int `json:"sort_order"`
|
|
Security SecurityConfig `json:"security"`
|
|
Exits []string `json:"exits"`
|
|
CFTunnelID int64 `json:"cf_tunnel_id"`
|
|
SyncWarning string `json:"sync_warning,omitempty"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
UpdatedAt time.Time `json:"updated_at"`
|
|
}
|
|
|
|
type PortGroup struct {
|
|
Port int
|
|
Hostnames []string
|
|
}
|
|
|
|
func (r Rule) PrimaryHost() string {
|
|
if len(r.Hosts) > 0 {
|
|
return r.Hosts[0].Hostname
|
|
}
|
|
return ""
|
|
}
|
|
|
|
type Endpoint struct {
|
|
Hostname string
|
|
Port int
|
|
}
|
|
|
|
func (r Rule) Endpoints() []Endpoint {
|
|
seen := make(map[string]bool)
|
|
var out []Endpoint
|
|
for _, host := range r.Hosts {
|
|
name := strings.ToLower(strings.TrimSpace(host.Hostname))
|
|
if name == "" {
|
|
continue
|
|
}
|
|
port := hostEffectivePort(host, r.ListenPort)
|
|
key := fmt.Sprintf("%s:%d", name, port)
|
|
if seen[key] {
|
|
continue
|
|
}
|
|
seen[key] = true
|
|
out = append(out, Endpoint{Hostname: name, Port: port})
|
|
}
|
|
if len(out) == 0 {
|
|
domain := strings.ToLower(strings.TrimSpace(r.Domain))
|
|
if domain != "" {
|
|
out = append(out, Endpoint{Hostname: domain, Port: r.ListenPort})
|
|
}
|
|
}
|
|
return out
|
|
}
|
|
|
|
func (r Rule) Hostnames() []string {
|
|
seen := make(map[string]bool)
|
|
var names []string
|
|
for _, host := range r.Hosts {
|
|
name := strings.ToLower(strings.TrimSpace(host.Hostname))
|
|
if name == "" || seen[name] {
|
|
continue
|
|
}
|
|
seen[name] = true
|
|
names = append(names, name)
|
|
}
|
|
if len(names) == 0 {
|
|
domain := strings.ToLower(strings.TrimSpace(r.Domain))
|
|
if domain != "" {
|
|
names = append(names, domain)
|
|
}
|
|
}
|
|
return names
|
|
}
|
|
|
|
// UsesExit 判断规则是否启用了指定出口；空值按旧数据兼容为本机出口。
|
|
func (r Rule) UsesExit(exit string) bool {
|
|
if len(r.Exits) == 0 {
|
|
return exit == ExitLocal
|
|
}
|
|
for _, item := range r.Exits {
|
|
if item == exit {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
// HasExit 判断出口列表是否包含指定出口；空值按旧数据兼容为本机出口。
|
|
func HasExit(exits []string, exit string) bool {
|
|
return Rule{Exits: exits}.UsesExit(exit)
|
|
}
|
|
|
|
// LocalEnabled 判断规则当前是否需要生成本机 Nginx 配置。
|
|
func (r Rule) LocalEnabled() bool {
|
|
return r.Enabled && r.UsesExit(ExitLocal)
|
|
}
|
|
|
|
// CloudflareEnabled 判断规则当前是否需要同步到 Cloudflare 隧道。
|
|
func (r Rule) CloudflareEnabled() bool {
|
|
return r.Enabled && r.UsesExit(ExitCloudflare) && r.CFTunnelID > 0
|
|
}
|
|
|
|
func (r Rule) PortGroups() []PortGroup {
|
|
groups := map[int][]string{}
|
|
ports := make([]int, 0)
|
|
for _, host := range r.Hosts {
|
|
port := r.ListenPort
|
|
if host.ListenPort != nil && *host.ListenPort > 0 {
|
|
port = *host.ListenPort
|
|
}
|
|
if _, ok := groups[port]; !ok {
|
|
ports = append(ports, port)
|
|
}
|
|
groups[port] = append(groups[port], host.Hostname)
|
|
}
|
|
|
|
out := make([]PortGroup, 0, len(ports))
|
|
for _, port := range ports {
|
|
out = append(out, PortGroup{Port: port, Hostnames: groups[port]})
|
|
}
|
|
return out
|
|
}
|
|
|
|
type CreateInput struct {
|
|
Upstream string
|
|
ListenPort int
|
|
ListenIPv4 bool
|
|
ListenIPv6 bool
|
|
Hosts []string
|
|
HTTPSEnabled bool
|
|
HTTPRedirect bool
|
|
Enabled bool
|
|
Name string
|
|
Security SecurityInput
|
|
Exits []string
|
|
CFTunnelID int64
|
|
}
|
|
|
|
type UpdateInput struct {
|
|
Upstream *string
|
|
ListenPort *int
|
|
ListenIPv4 *bool
|
|
ListenIPv6 *bool
|
|
Hosts *[]string
|
|
HTTPSEnabled *bool
|
|
HTTPRedirect *bool
|
|
Enabled *bool
|
|
Name *string
|
|
Security *SecurityInput
|
|
Exits *[]string
|
|
CFTunnelID *int64
|
|
}
|
|
|
|
type Store struct {
|
|
db *sql.DB
|
|
tx *sql.Tx
|
|
}
|
|
|
|
func NewStore(db *sql.DB) *Store {
|
|
return &Store{db: db}
|
|
}
|
|
|
|
func NewStoreWithTx(tx *sql.Tx) *Store {
|
|
return &Store{tx: tx}
|
|
}
|
|
|
|
func (s *Store) querier() interface {
|
|
QueryContext(context.Context, string, ...any) (*sql.Rows, error)
|
|
QueryRowContext(context.Context, string, ...any) *sql.Row
|
|
ExecContext(context.Context, string, ...any) (sql.Result, error)
|
|
} {
|
|
if s.tx != nil {
|
|
return s.tx
|
|
}
|
|
return s.db
|
|
}
|
|
|
|
func (s *Store) List(ctx context.Context) ([]Rule, error) {
|
|
if err := s.cleanupOrphanRules(ctx); err != nil {
|
|
return nil, err
|
|
}
|
|
q := s.querier()
|
|
rows, err := q.QueryContext(ctx, `
|
|
SELECT id, upstream, listen_port, listen_ipv4, listen_ipv6, https_enabled, http_redirect, enabled, nginx_mode, name, sort_order, security_json, COALESCE(exits_json, '["local"]'), COALESCE(cf_tunnel_id, 0), created_at, updated_at
|
|
FROM proxy_rules
|
|
ORDER BY sort_order ASC, id ASC
|
|
`)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
|
|
var rules []Rule
|
|
for rows.Next() {
|
|
rule, err := scanRule(rows)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
rules = append(rules, rule)
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return nil, err
|
|
}
|
|
return s.attachHosts(ctx, rules)
|
|
}
|
|
|
|
func (s *Store) Get(ctx context.Context, id int64) (Rule, error) {
|
|
row := s.querier().QueryRowContext(ctx, `
|
|
SELECT id, upstream, listen_port, listen_ipv4, listen_ipv6, https_enabled, http_redirect, enabled, nginx_mode, name, sort_order, security_json, COALESCE(exits_json, '["local"]'), COALESCE(cf_tunnel_id, 0), created_at, updated_at
|
|
FROM proxy_rules WHERE id = ?
|
|
`, id)
|
|
rule, err := scanRule(row)
|
|
if errors.Is(err, sql.ErrNoRows) {
|
|
return Rule{}, fmt.Errorf("规则不存在")
|
|
}
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
rules, err := s.attachHosts(ctx, []Rule{rule})
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
return rules[0], nil
|
|
}
|
|
|
|
func (s *Store) Create(ctx context.Context, in CreateInput) (Rule, error) {
|
|
upstream, hosts, err := validateCreateInput(in)
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
if err := s.ensureHostsAvailable(ctx, hosts, in.ListenPort, 0); err != nil {
|
|
return Rule{}, err
|
|
}
|
|
|
|
name, err := normalizeName(in.Name)
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
sortOrder, err := s.nextSortOrder(ctx)
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
|
|
security, err := MergeSecurity(DefaultSecurityConfig(), in.Security)
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
securityJSON, err := security.ToJSON()
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
exits, cfTunnelID, err := normalizeExits(in.Exits, in.CFTunnelID)
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
exitsJSON, err := marshalExits(exits)
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
|
|
res, err := s.querier().ExecContext(ctx, `
|
|
INSERT INTO proxy_rules(upstream, listen_port, listen_ipv4, listen_ipv6, https_enabled, http_redirect, enabled, name, sort_order, security_json, exits_json, cf_tunnel_id, updated_at)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, datetime('now'))
|
|
`, upstream, in.ListenPort, boolInt(in.ListenIPv4), boolInt(in.ListenIPv6), boolInt(in.HTTPSEnabled), boolInt(in.HTTPRedirect), boolInt(in.Enabled), name, sortOrder, securityJSON, exitsJSON, cfTunnelID)
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
id, err := res.LastInsertId()
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
if err := s.replaceHosts(ctx, id, in.ListenPort, hosts); err != nil {
|
|
_, _ = s.querier().ExecContext(ctx, `DELETE FROM proxy_rules WHERE id = ?`, id)
|
|
return Rule{}, err
|
|
}
|
|
return s.Get(ctx, id)
|
|
}
|
|
|
|
func (s *Store) Update(ctx context.Context, id int64, in UpdateInput) (Rule, error) {
|
|
current, err := s.Get(ctx, id)
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
|
|
oldListenPort := current.ListenPort
|
|
upstream := current.Upstream
|
|
listenPort := current.ListenPort
|
|
listenIPv4 := current.ListenIPv4
|
|
listenIPv6 := current.ListenIPv6
|
|
httpsEnabled := current.HTTPSEnabled
|
|
httpRedirect := current.HTTPRedirect
|
|
enabled := current.Enabled
|
|
name := current.Name
|
|
hosts := current.Hosts
|
|
exits := current.Exits
|
|
cfTunnelID := current.CFTunnelID
|
|
|
|
if in.Upstream != nil {
|
|
upstream, err = validate.Upstream(*in.Upstream)
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
}
|
|
if in.ListenPort != nil {
|
|
if err := validate.ListenPort(*in.ListenPort); err != nil {
|
|
return Rule{}, err
|
|
}
|
|
listenPort = *in.ListenPort
|
|
}
|
|
if in.ListenIPv4 != nil {
|
|
listenIPv4 = *in.ListenIPv4
|
|
}
|
|
if in.ListenIPv6 != nil {
|
|
listenIPv6 = *in.ListenIPv6
|
|
}
|
|
if !listenIPv4 && !listenIPv6 {
|
|
return Rule{}, fmt.Errorf("至少需要启用 IPv4 或 IPv6 监听")
|
|
}
|
|
if in.HTTPSEnabled != nil {
|
|
httpsEnabled = *in.HTTPSEnabled
|
|
}
|
|
if in.HTTPRedirect != nil {
|
|
httpRedirect = *in.HTTPRedirect
|
|
}
|
|
if in.Enabled != nil {
|
|
enabled = *in.Enabled
|
|
}
|
|
if in.Name != nil {
|
|
name, err = normalizeName(*in.Name)
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
}
|
|
if in.Exits != nil || in.CFTunnelID != nil {
|
|
rawExits := exits
|
|
if in.Exits != nil {
|
|
rawExits = *in.Exits
|
|
}
|
|
rawTunnelID := cfTunnelID
|
|
if in.CFTunnelID != nil {
|
|
rawTunnelID = *in.CFTunnelID
|
|
}
|
|
exits, cfTunnelID, err = normalizeExits(rawExits, rawTunnelID)
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
}
|
|
if in.Hosts != nil {
|
|
hosts, err = parseHosts(*in.Hosts, listenPort)
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
if len(hosts) == 0 {
|
|
return Rule{}, fmt.Errorf("至少需要一个前端域名")
|
|
}
|
|
}
|
|
|
|
security := current.Security
|
|
if in.Security != nil {
|
|
security, err = MergeSecurity(current.Security, *in.Security)
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
}
|
|
securityJSON, err := security.ToJSON()
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
exitsJSON, err := marshalExits(exits)
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
|
|
if in.ListenPort != nil && *in.ListenPort != oldListenPort && in.Hosts == nil {
|
|
for _, host := range current.Hosts {
|
|
if hostEffectivePort(host, oldListenPort) != oldListenPort {
|
|
continue
|
|
}
|
|
if err := s.ensureHostAvailable(ctx, host.Hostname, listenPort, id); err != nil {
|
|
return Rule{}, err
|
|
}
|
|
}
|
|
}
|
|
|
|
_, err = s.querier().ExecContext(ctx, `
|
|
UPDATE proxy_rules
|
|
SET upstream = ?, listen_port = ?, listen_ipv4 = ?, listen_ipv6 = ?, https_enabled = ?, http_redirect = ?, enabled = ?, name = ?, security_json = ?, exits_json = ?, cf_tunnel_id = ?, updated_at = datetime('now')
|
|
WHERE id = ?
|
|
`, upstream, listenPort, boolInt(listenIPv4), boolInt(listenIPv6), boolInt(httpsEnabled), boolInt(httpRedirect), boolInt(enabled), name, securityJSON, exitsJSON, cfTunnelID, id)
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
if in.ListenPort != nil && *in.ListenPort != oldListenPort && in.Hosts == nil {
|
|
if _, err := s.querier().ExecContext(ctx, `
|
|
UPDATE proxy_hosts SET listen_port = ? WHERE rule_id = ? AND listen_port = ?
|
|
`, listenPort, id, oldListenPort); err != nil {
|
|
if isUniqueViolation(err) {
|
|
// 保存前校验与写入之间存在窗口，被并发规则抢占时按域名复检并给出带规则名的原因
|
|
for _, host := range current.Hosts {
|
|
if hostEffectivePort(host, oldListenPort) != oldListenPort {
|
|
continue
|
|
}
|
|
if ownerErr := s.ensureHostAvailable(ctx, host.Hostname, listenPort, id); ownerErr != nil {
|
|
return Rule{}, ownerErr
|
|
}
|
|
}
|
|
}
|
|
return Rule{}, err
|
|
}
|
|
}
|
|
if in.Hosts != nil {
|
|
if err := s.ensureHostsAvailable(ctx, hosts, listenPort, id); err != nil {
|
|
return Rule{}, err
|
|
}
|
|
if err := s.replaceHosts(ctx, id, listenPort, hosts); err != nil {
|
|
return Rule{}, err
|
|
}
|
|
}
|
|
return s.Get(ctx, id)
|
|
}
|
|
|
|
func (s *Store) SetNginxMode(ctx context.Context, id int64, mode string) error {
|
|
mode = strings.TrimSpace(mode)
|
|
if mode != "auto" && mode != "custom" {
|
|
return fmt.Errorf("无效的 nginx 模式")
|
|
}
|
|
res, err := s.querier().ExecContext(ctx, `
|
|
UPDATE proxy_rules SET nginx_mode = ?, updated_at = datetime('now') WHERE id = ?
|
|
`, mode, id)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
n, err := res.RowsAffected()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if n == 0 {
|
|
return fmt.Errorf("规则不存在")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (s *Store) Delete(ctx context.Context, id int64) error {
|
|
res, err := s.querier().ExecContext(ctx, `DELETE FROM proxy_rules WHERE id = ?`, id)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
n, err := res.RowsAffected()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if n == 0 {
|
|
return fmt.Errorf("规则不存在")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (s *Store) ListEnabled(ctx context.Context) ([]Rule, error) {
|
|
rows, err := s.querier().QueryContext(ctx, `
|
|
SELECT id, upstream, listen_port, listen_ipv4, listen_ipv6, https_enabled, http_redirect, enabled, nginx_mode, name, sort_order, security_json, COALESCE(exits_json, '["local"]'), COALESCE(cf_tunnel_id, 0), created_at, updated_at
|
|
FROM proxy_rules WHERE enabled = 1 ORDER BY sort_order ASC, id ASC
|
|
`)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
|
|
var rules []Rule
|
|
for rows.Next() {
|
|
rule, err := scanRule(rows)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
rules = append(rules, rule)
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return nil, err
|
|
}
|
|
return s.attachHosts(ctx, rules)
|
|
}
|
|
|
|
// ListEnabledLocal 只返回需要生成本机 Nginx 配置的启用规则。
|
|
func (s *Store) ListEnabledLocal(ctx context.Context) ([]Rule, error) {
|
|
rules, err := s.ListEnabled(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
out := make([]Rule, 0, len(rules))
|
|
for _, rule := range rules {
|
|
if rule.UsesExit(ExitLocal) {
|
|
out = append(out, rule)
|
|
}
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
func validateCreateInput(in CreateInput) (string, []Host, error) {
|
|
upstream, err := validate.Upstream(in.Upstream)
|
|
if err != nil {
|
|
return "", nil, err
|
|
}
|
|
if err := validate.ListenPort(in.ListenPort); err != nil {
|
|
return "", nil, err
|
|
}
|
|
if !in.ListenIPv4 && !in.ListenIPv6 {
|
|
return "", nil, fmt.Errorf("至少需要启用 IPv4 或 IPv6 监听")
|
|
}
|
|
hosts, err := parseHosts(in.Hosts, in.ListenPort)
|
|
if err != nil {
|
|
return "", nil, err
|
|
}
|
|
if len(hosts) == 0 {
|
|
return "", nil, fmt.Errorf("至少需要一个前端域名")
|
|
}
|
|
return upstream, hosts, nil
|
|
}
|
|
|
|
func (s *Store) cleanupOrphanRules(ctx context.Context) error {
|
|
_, err := s.querier().ExecContext(ctx, `
|
|
DELETE FROM proxy_rules
|
|
WHERE id NOT IN (SELECT rule_id FROM proxy_hosts)
|
|
`)
|
|
return err
|
|
}
|
|
|
|
// isUniqueViolation 判断是否为 SQLite 唯一约束冲突（hostname + listen_port 撞车）
|
|
func isUniqueViolation(err error) bool {
|
|
return err != nil && strings.Contains(strings.ToUpper(err.Error()), "UNIQUE")
|
|
}
|
|
|
|
func hostEffectivePort(host Host, ruleListenPort int) int {
|
|
if host.ListenPort != nil && *host.ListenPort > 0 {
|
|
return *host.ListenPort
|
|
}
|
|
return ruleListenPort
|
|
}
|
|
|
|
func parseHosts(raw []string, ruleListenPort int) ([]Host, error) {
|
|
seen := make(map[string]struct{})
|
|
hosts := make([]Host, 0, len(raw))
|
|
for _, item := range raw {
|
|
hostname, port, err := validate.FrontendAddress(item)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
effectivePort := ruleListenPort
|
|
if port > 0 {
|
|
effectivePort = port
|
|
}
|
|
key := fmt.Sprintf("%s:%d", strings.ToLower(hostname), effectivePort)
|
|
if _, ok := seen[key]; ok {
|
|
return nil, fmt.Errorf("前端域名 %s:%d 重复", hostname, effectivePort)
|
|
}
|
|
seen[key] = struct{}{}
|
|
host := Host{Hostname: hostname}
|
|
if port > 0 {
|
|
host.ListenPort = &port
|
|
}
|
|
hosts = append(hosts, host)
|
|
}
|
|
return hosts, nil
|
|
}
|
|
|
|
func (s *Store) ensureHostAvailable(ctx context.Context, hostname string, port int, excludeRuleID int64) error {
|
|
owner, err := s.endpointOwner(ctx, "proxy_hosts", hostname, port, excludeRuleID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if owner != "" {
|
|
return fmt.Errorf("域名 %s:%d 已被%s使用，请编辑现有规则或更换域名/端口", hostname, port, owner)
|
|
}
|
|
// 手动（custom）Nginx 规则的占用单独存表，其域名/端口不在 proxy_hosts 里，需一并检查
|
|
owner, err = s.endpointOwner(ctx, "proxy_custom_endpoints", hostname, port, excludeRuleID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if owner != "" {
|
|
return fmt.Errorf("域名 %s:%d 已被%s使用（该规则使用手动 Nginx 配置），请编辑现有规则或更换域名/端口", hostname, port, owner)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// endpointOwner 返回占用该 (域名, 端口) 的规则描述（如 规则「名称」）；空闲时返回空串。
|
|
// table 只传入本包内两张固定表名（proxy_hosts / proxy_custom_endpoints），不接受外部输入。
|
|
// 规则描述优先用备注名，其次用该规则的首个域名，最后回落为规则 ID。
|
|
func (s *Store) endpointOwner(ctx context.Context, table, hostname string, port int, excludeRuleID int64) (string, error) {
|
|
var (
|
|
ownerID int64
|
|
ownerDesc string
|
|
)
|
|
query := `SELECT h.rule_id,
|
|
COALESCE(NULLIF(TRIM(r.name), ''),
|
|
(SELECT hostname FROM proxy_hosts WHERE rule_id = h.rule_id ORDER BY id LIMIT 1), '')
|
|
FROM ` + table + ` h
|
|
LEFT JOIN proxy_rules r ON r.id = h.rule_id
|
|
WHERE h.hostname = ? COLLATE NOCASE AND h.listen_port = ? AND h.rule_id != ?
|
|
LIMIT 1`
|
|
err := s.querier().QueryRowContext(ctx, query, hostname, port, excludeRuleID).Scan(&ownerID, &ownerDesc)
|
|
if errors.Is(err, sql.ErrNoRows) {
|
|
return "", nil
|
|
}
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
if desc := strings.TrimSpace(ownerDesc); desc != "" {
|
|
return fmt.Sprintf("规则「%s」", desc), nil
|
|
}
|
|
return fmt.Sprintf("规则 #%d", ownerID), nil
|
|
}
|
|
|
|
func (s *Store) ensureHostsAvailable(ctx context.Context, hosts []Host, ruleListenPort int, excludeRuleID int64) error {
|
|
for _, host := range hosts {
|
|
port := hostEffectivePort(host, ruleListenPort)
|
|
if err := s.ensureHostAvailable(ctx, host.Hostname, port, excludeRuleID); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (s *Store) replaceHosts(ctx context.Context, ruleID int64, ruleListenPort int, hosts []Host) error {
|
|
if _, err := s.querier().ExecContext(ctx, `DELETE FROM proxy_hosts WHERE rule_id = ?`, ruleID); err != nil {
|
|
return err
|
|
}
|
|
for _, host := range hosts {
|
|
port := hostEffectivePort(host, ruleListenPort)
|
|
_, err := s.querier().ExecContext(ctx, `
|
|
INSERT INTO proxy_hosts(rule_id, hostname, listen_port)
|
|
VALUES (?, ?, ?)
|
|
`, ruleID, host.Hostname, port)
|
|
if err != nil {
|
|
if isUniqueViolation(err) {
|
|
// 并发下可能绕过保存前校验：复检一次以给出带规则名的原因
|
|
if ownerErr := s.ensureHostAvailable(ctx, host.Hostname, port, ruleID); ownerErr != nil {
|
|
return ownerErr
|
|
}
|
|
return fmt.Errorf("域名 %s:%d 已被其它规则占用", host.Hostname, port)
|
|
}
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (s *Store) attachHosts(ctx context.Context, rules []Rule) ([]Rule, error) {
|
|
if len(rules) == 0 {
|
|
return rules, nil
|
|
}
|
|
ids := make([]string, len(rules))
|
|
args := make([]any, len(rules))
|
|
for i, rule := range rules {
|
|
ids[i] = "?"
|
|
args[i] = rule.ID
|
|
}
|
|
|
|
query := `
|
|
SELECT id, rule_id, hostname, listen_port
|
|
FROM proxy_hosts
|
|
WHERE rule_id IN (` + strings.Join(ids, ",") + `)
|
|
ORDER BY id ASC
|
|
`
|
|
rows, err := s.querier().QueryContext(ctx, query, args...)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
|
|
byRule := make(map[int64][]Host)
|
|
for rows.Next() {
|
|
var host Host
|
|
var ruleID int64
|
|
var listenPort sql.NullInt64
|
|
if err := rows.Scan(&host.ID, &ruleID, &host.Hostname, &listenPort); err != nil {
|
|
return nil, err
|
|
}
|
|
if listenPort.Valid {
|
|
port := int(listenPort.Int64)
|
|
host.ListenPort = &port
|
|
}
|
|
byRule[ruleID] = append(byRule[ruleID], host)
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
for i := range rules {
|
|
rules[i].Hosts = byRule[rules[i].ID]
|
|
rules[i].Domain = rules[i].PrimaryHost()
|
|
}
|
|
return rules, nil
|
|
}
|
|
|
|
type rowScanner interface {
|
|
Scan(dest ...any) error
|
|
}
|
|
|
|
func scanRule(row rowScanner) (Rule, error) {
|
|
var rule Rule
|
|
var listenIPv4 int
|
|
var listenIPv6 int
|
|
var httpsEnabled int
|
|
var httpRedirect int
|
|
var enabled int
|
|
var nginxMode string
|
|
var securityJSON string
|
|
var exitsJSON string
|
|
var cfTunnelID int64
|
|
var createdAt string
|
|
var updatedAt string
|
|
if err := row.Scan(
|
|
&rule.ID,
|
|
&rule.Upstream,
|
|
&rule.ListenPort,
|
|
&listenIPv4,
|
|
&listenIPv6,
|
|
&httpsEnabled,
|
|
&httpRedirect,
|
|
&enabled,
|
|
&nginxMode,
|
|
&rule.Name,
|
|
&rule.SortOrder,
|
|
&securityJSON,
|
|
&exitsJSON,
|
|
&cfTunnelID,
|
|
&createdAt,
|
|
&updatedAt,
|
|
); err != nil {
|
|
return Rule{}, err
|
|
}
|
|
rule.ListenIPv4 = listenIPv4 == 1
|
|
rule.ListenIPv6 = listenIPv6 == 1
|
|
rule.HTTPSEnabled = httpsEnabled == 1
|
|
rule.HTTPRedirect = httpRedirect == 1
|
|
rule.Enabled = enabled == 1
|
|
if nginxMode == "" {
|
|
nginxMode = "auto"
|
|
}
|
|
rule.NginxMode = nginxMode
|
|
security, err := ParseSecurityJSON(securityJSON)
|
|
if err != nil {
|
|
return Rule{}, err
|
|
}
|
|
rule.Security = security
|
|
rule.Exits = parseExits(exitsJSON)
|
|
rule.CFTunnelID = cfTunnelID
|
|
rule.CreatedAt = parseTime(createdAt)
|
|
rule.UpdatedAt = parseTime(updatedAt)
|
|
return rule, nil
|
|
}
|
|
|
|
func normalizeExits(raw []string, cfTunnelID int64) ([]string, int64, error) {
|
|
if len(raw) == 0 {
|
|
raw = []string{ExitLocal}
|
|
}
|
|
seen := make(map[string]struct{}, len(raw))
|
|
out := make([]string, 0, len(raw))
|
|
for _, item := range raw {
|
|
exit := strings.ToLower(strings.TrimSpace(item))
|
|
switch exit {
|
|
case ExitLocal, ExitCloudflare:
|
|
default:
|
|
return nil, 0, fmt.Errorf("不支持的出口: %s", item)
|
|
}
|
|
if _, ok := seen[exit]; ok {
|
|
continue
|
|
}
|
|
seen[exit] = struct{}{}
|
|
out = append(out, exit)
|
|
}
|
|
sort.Strings(out)
|
|
_, usesCloudflare := seen[ExitCloudflare]
|
|
if usesCloudflare && cfTunnelID <= 0 {
|
|
return nil, 0, fmt.Errorf("选择 Cloudflare 出口时需要指定隧道")
|
|
}
|
|
if !usesCloudflare {
|
|
cfTunnelID = 0
|
|
}
|
|
return out, cfTunnelID, nil
|
|
}
|
|
|
|
func marshalExits(exits []string) (string, error) {
|
|
normalized, _, err := normalizeExits(exits, 1)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
data, err := json.Marshal(normalized)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return string(data), nil
|
|
}
|
|
|
|
func parseExits(raw string) []string {
|
|
var exits []string
|
|
if err := json.Unmarshal([]byte(raw), &exits); err != nil {
|
|
return []string{ExitLocal}
|
|
}
|
|
normalized, _, err := normalizeExits(exits, 1)
|
|
if err != nil {
|
|
return []string{ExitLocal}
|
|
}
|
|
return normalized
|
|
}
|
|
|
|
func parseTime(v string) time.Time {
|
|
t, err := time.Parse("2006-01-02 15:04:05", v)
|
|
if err != nil {
|
|
t, _ = time.Parse(time.RFC3339, v)
|
|
}
|
|
return t.UTC()
|
|
}
|
|
|
|
func boolInt(v bool) int {
|
|
if v {
|
|
return 1
|
|
}
|
|
return 0
|
|
}
|
|
|
|
func normalizeName(raw string) (string, error) {
|
|
name := strings.TrimSpace(raw)
|
|
if len(name) > 100 {
|
|
return "", fmt.Errorf("名称不能超过 100 个字符")
|
|
}
|
|
return name, nil
|
|
}
|
|
|
|
func (s *Store) nextSortOrder(ctx context.Context) (int, error) {
|
|
var maxOrder sql.NullInt64
|
|
err := s.querier().QueryRowContext(ctx, `SELECT MAX(sort_order) FROM proxy_rules`).Scan(&maxOrder)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
if !maxOrder.Valid {
|
|
return 0, nil
|
|
}
|
|
return int(maxOrder.Int64) + 1, nil
|
|
}
|
|
|
|
func (s *Store) Reorder(ctx context.Context, ids []int64) error {
|
|
if len(ids) == 0 {
|
|
return nil
|
|
}
|
|
seen := make(map[int64]struct{}, len(ids))
|
|
for _, id := range ids {
|
|
if id <= 0 {
|
|
return fmt.Errorf("无效的规则 ID")
|
|
}
|
|
if _, ok := seen[id]; ok {
|
|
return fmt.Errorf("排序列表包含重复的规则 ID")
|
|
}
|
|
seen[id] = struct{}{}
|
|
}
|
|
|
|
var total int
|
|
if err := s.querier().QueryRowContext(ctx, `SELECT COUNT(*) FROM proxy_rules`).Scan(&total); err != nil {
|
|
return err
|
|
}
|
|
if len(ids) != total {
|
|
return fmt.Errorf("排序列表必须包含全部规则")
|
|
}
|
|
|
|
tx, err := s.db.BeginTx(ctx, nil)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer tx.Rollback()
|
|
|
|
for index, id := range ids {
|
|
res, err := tx.ExecContext(ctx, `UPDATE proxy_rules SET sort_order = ?, updated_at = datetime('now') WHERE id = ?`, index, id)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
n, err := res.RowsAffected()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if n == 0 {
|
|
return fmt.Errorf("规则不存在")
|
|
}
|
|
}
|
|
return tx.Commit()
|
|
}
|