mirror of
https://github.com/WJQSERVER-STUDIO/ghproxy.git
synced 2026-02-03 00:01:10 +08:00
Merge pull request #65 from WJQSERVER-STUDIO/dev
Rewrite path matcher (v2.4.1)
This commit is contained in:
WJQSERVER
GitHub
commit
5c54ae788c
8 changed files with 212 additions and 179 deletions
11
CHANGELOG.md
11
CHANGELOG.md
|
|
@ -1,5 +1,16 @@
|
||||||
# 更新日志
|
# 更新日志
|
||||||
|
|
||||||
|
2.4.1 - 2025-03-12
|
||||||
|
---
|
||||||
|
- CHANGE: 重构路由匹配
|
||||||
|
- CHANGE: 更新相关依赖以修复错误
|
||||||
|
|
||||||
|
25w17a - 2025-03-12
|
||||||
|
---
|
||||||
|
- PRE-RELEASE: 此版本是v2.4.1的预发布版本,请勿在生产环境中使用;
|
||||||
|
- CHANGE: 重构路由匹配
|
||||||
|
- CHANGE: 更新相关依赖以修复错误
|
||||||
|
|
||||||
2.4.0 - 2025-03-12
|
2.4.0 - 2025-03-12
|
||||||
---
|
---
|
||||||
- ADD: 支持通过[Smart-Git](https://github.com/WJQSERVER-STUDIO/smart-git)实现Git Clone缓存
|
- ADD: 支持通过[Smart-Git](https://github.com/WJQSERVER-STUDIO/smart-git)实现Git Clone缓存
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
25w16d
|
25w17a
|
||||||
2
VERSION
2
VERSION
|
|
@ -1 +1 @@
|
||||||
2.4.0
|
2.4.1
|
||||||
4
go.mod
4
go.mod
|
|
@ -4,12 +4,12 @@ go 1.24.1
|
||||||
|
|
||||||
require (
|
require (
|
||||||
github.com/BurntSushi/toml v1.4.0
|
github.com/BurntSushi/toml v1.4.0
|
||||||
github.com/WJQSERVER-STUDIO/go-utils/copyb v0.0.3
|
github.com/WJQSERVER-STUDIO/go-utils/copyb v0.0.4
|
||||||
github.com/WJQSERVER-STUDIO/go-utils/logger v1.5.0
|
github.com/WJQSERVER-STUDIO/go-utils/logger v1.5.0
|
||||||
github.com/gin-gonic/gin v1.10.0
|
github.com/gin-gonic/gin v1.10.0
|
||||||
github.com/go-git/go-git/v5 v5.14.0
|
github.com/go-git/go-git/v5 v5.14.0
|
||||||
github.com/pierrec/lz4 v2.6.1+incompatible
|
github.com/pierrec/lz4 v2.6.1+incompatible
|
||||||
github.com/satomitouka/touka-httpc v0.3.1
|
github.com/satomitouka/touka-httpc v0.3.3
|
||||||
golang.org/x/net v0.37.0
|
golang.org/x/net v0.37.0
|
||||||
golang.org/x/time v0.11.0
|
golang.org/x/time v0.11.0
|
||||||
)
|
)
|
||||||
|
|
|
||||||
8
go.sum
8
go.sum
|
|
@ -7,8 +7,8 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
|
||||||
github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
|
github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
|
||||||
github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
|
github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
|
||||||
github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
|
github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
|
||||||
github.com/WJQSERVER-STUDIO/go-utils/copyb v0.0.3 h1:S1tFRwMZkrAswOJxF1X2yTvL6Tz+6IeOBuqmycDnydw=
|
github.com/WJQSERVER-STUDIO/go-utils/copyb v0.0.4 h1:JLtFd00AdFg/TP+dtvIzLkdHwKUGPOAijN1sMtEYoFg=
|
||||||
github.com/WJQSERVER-STUDIO/go-utils/copyb v0.0.3/go.mod h1:FZ6XE+4TKy4MOfX1xWKe6Rwsg0ucYFCdNh1KLvyKTfc=
|
github.com/WJQSERVER-STUDIO/go-utils/copyb v0.0.4/go.mod h1:FZ6XE+4TKy4MOfX1xWKe6Rwsg0ucYFCdNh1KLvyKTfc=
|
||||||
github.com/WJQSERVER-STUDIO/go-utils/log v0.0.1 h1:gJEQspQPB527Vp2FPcdOrynQEj3YYtrg1ixVSB/JvZM=
|
github.com/WJQSERVER-STUDIO/go-utils/log v0.0.1 h1:gJEQspQPB527Vp2FPcdOrynQEj3YYtrg1ixVSB/JvZM=
|
||||||
github.com/WJQSERVER-STUDIO/go-utils/log v0.0.1/go.mod h1:j9Q+xnwpOfve7/uJnZ2izRQw6NNoXjvJHz7vUQAaLZE=
|
github.com/WJQSERVER-STUDIO/go-utils/log v0.0.1/go.mod h1:j9Q+xnwpOfve7/uJnZ2izRQw6NNoXjvJHz7vUQAaLZE=
|
||||||
github.com/WJQSERVER-STUDIO/go-utils/logger v1.5.0 h1:Uk4N7Sh4OPth3am3xVv17JlAm7tsna97ZLQRpQj7r5c=
|
github.com/WJQSERVER-STUDIO/go-utils/logger v1.5.0 h1:Uk4N7Sh4OPth3am3xVv17JlAm7tsna97ZLQRpQj7r5c=
|
||||||
|
|
@ -113,8 +113,8 @@ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZN
|
||||||
github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
|
github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
|
||||||
github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
|
github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
|
||||||
github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
|
github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
|
||||||
github.com/satomitouka/touka-httpc v0.3.1 h1:UnKFHgK0diEZeSxRW5Q7ibCO2EyAyK1lgXvGEbUmz6I=
|
github.com/satomitouka/touka-httpc v0.3.3 h1:Th0uJ5do3oqqZgdUDtqD1SH11x8TcJmrwHMJQlEIKCg=
|
||||||
github.com/satomitouka/touka-httpc v0.3.1/go.mod h1:b5b+/0x4/uodWQSYCerbQyH8GrpNg92q+GcCBPhFjhI=
|
github.com/satomitouka/touka-httpc v0.3.3/go.mod h1:sNXyW5XBufkwB9ZJ+PIlgN/6xiJ7aZV1fWGrXR0u3bA=
|
||||||
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
|
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
|
||||||
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
|
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
|
||||||
github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
|
github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
|
||||||
|
|
|
||||||
308
proxy/handler.go
308
proxy/handler.go
|
|
@ -12,6 +12,8 @@ import (
|
||||||
"github.com/gin-gonic/gin"
|
"github.com/gin-gonic/gin"
|
||||||
)
|
)
|
||||||
|
|
||||||
|
var re = regexp.MustCompile(`^(http:|https:)?/?/?(.*)`) // 匹配http://或https://开头的路径
|
||||||
|
/*
|
||||||
var exps = []*regexp.Regexp{
|
var exps = []*regexp.Regexp{
|
||||||
regexp.MustCompile(`^(?:https?://)?github\.com/([^/]+)/([^/]+)/(?:releases|archive)/.*`), // 匹配 GitHub Releases 或 Archive 链接
|
regexp.MustCompile(`^(?:https?://)?github\.com/([^/]+)/([^/]+)/(?:releases|archive)/.*`), // 匹配 GitHub Releases 或 Archive 链接
|
||||||
regexp.MustCompile(`^(?:https?://)?github\.com/([^/]+)/([^/]+)/(?:blob|raw)/.*`), // 匹配 GitHub Blob 或 Raw 链接
|
regexp.MustCompile(`^(?:https?://)?github\.com/([^/]+)/([^/]+)/(?:blob|raw)/.*`), // 匹配 GitHub Blob 或 Raw 链接
|
||||||
|
|
@ -20,151 +22,213 @@ var exps = []*regexp.Regexp{
|
||||||
regexp.MustCompile(`^(?:https?://)?gist\.github(?:usercontent|)\.com/([^/]+)/.+?/.+`), // 匹配 gist.githubusercontent.com 链接
|
regexp.MustCompile(`^(?:https?://)?gist\.github(?:usercontent|)\.com/([^/]+)/.+?/.+`), // 匹配 gist.githubusercontent.com 链接
|
||||||
regexp.MustCompile(`^(?:https?://)?api\.github\.com/repos/([^/]+)/([^/]+)/.*`), // 匹配 api.github.com/repos 链接 (GitHub API)
|
regexp.MustCompile(`^(?:https?://)?api\.github\.com/repos/([^/]+)/([^/]+)/.*`), // 匹配 api.github.com/repos 链接 (GitHub API)
|
||||||
}
|
}
|
||||||
|
*/
|
||||||
|
|
||||||
// NoRouteHandler 是 Gin 框架的 NoRoute 处理器函数，用于处理所有未匹配到预定义路由的请求
|
|
||||||
// 此函数实现了请求的频率限制、URL 路径解析、白名单/黑名单检查、URL 类型匹配和最终的代理请求处理
|
|
||||||
func NoRouteHandler(cfg *config.Config, limiter *rate.RateLimiter, iplimiter *rate.IPRateLimiter, runMode string) gin.HandlerFunc {
|
func NoRouteHandler(cfg *config.Config, limiter *rate.RateLimiter, iplimiter *rate.IPRateLimiter, runMode string) gin.HandlerFunc {
|
||||||
return func(c *gin.Context) {
|
return func(c *gin.Context) {
|
||||||
|
|
||||||
// **频率限制处理**
|
// 限制访问频率
|
||||||
if cfg.RateLimit.Enabled { // 检查是否启用频率限制
|
if cfg.RateLimit.Enabled {
|
||||||
|
|
||||||
var allowed bool // 用于标记是否允许请求
|
var allowed bool
|
||||||
|
|
||||||
switch cfg.RateLimit.RateMethod { // 根据配置的频率限制方法选择
|
switch cfg.RateLimit.RateMethod {
|
||||||
case "ip": // 基于 IP 地址的频率限制
|
case "ip":
|
||||||
allowed = iplimiter.Allow(c.ClientIP()) // 使用 IPRateLimiter 检查客户端 IP 是否允许请求
|
allowed = iplimiter.Allow(c.ClientIP())
|
||||||
case "total": // 基于总请求量的频率限制
|
case "total":
|
||||||
allowed = limiter.Allow() // 使用 RateLimiter 检查总请求量是否允许请求
|
allowed = limiter.Allow()
|
||||||
default: // 无效的频率限制方法
|
default:
|
||||||
logWarning("Invalid RateLimit Method") // 记录警告日志
|
logWarning("Invalid RateLimit Method")
|
||||||
return // 中断请求处理
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
if !allowed { // 如果请求被频率限制阻止
|
if !allowed {
|
||||||
c.JSON(http.StatusTooManyRequests, gin.H{"error": "Too Many Requests"}) // 返回 429 状态码和错误信息
|
c.JSON(http.StatusTooManyRequests, gin.H{"error": "Too Many Requests"})
|
||||||
logWarning("%s %s %s %s %s 429-TooManyRequests", c.ClientIP(), c.Request.Method, c.Request.URL.RequestURI(), c.Request.Header.Get("User-Agent"), c.Request.Proto) // 记录警告日志
|
logWarning("%s %s %s %s %s 429-TooManyRequests", c.ClientIP(), c.Request.Method, c.Request.URL.RequestURI(), c.Request.Header.Get("User-Agent"), c.Request.Proto)
|
||||||
return // 中断请求处理
|
return
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
rawPath := strings.TrimPrefix(c.Request.URL.RequestURI(), "/") // 去掉 URL 前缀的斜杠 '/', 获取原始路径 (例如: /https://github.com/user/repo -> https://github.com/user/repo)
|
//rawPath := strings.TrimPrefix(c.Request.URL.Path, "/") // 去掉前缀/
|
||||||
re := regexp.MustCompile(`^(http:|https:)?/?/?(.*)`) // 定义正则表达式，匹配以 http:// 或 https:// 开头的路径，并捕获协议和剩余部分
|
rawPath := strings.TrimPrefix(c.Request.URL.RequestURI(), "/") // 去掉前缀/
|
||||||
matches := re.FindStringSubmatch(rawPath) // 使用正则表达式匹配原始路径
|
matches := re.FindStringSubmatch(rawPath) // 匹配路径
|
||||||
|
logInfo("Matches: %v", matches)
|
||||||
|
|
||||||
// **路径匹配错误处理**
|
// 匹配路径错误处理
|
||||||
if len(matches) < 3 { // 如果匹配结果少于 3 个子串 (完整匹配 + 协议 + 剩余部分)，则说明 URL 格式无效
|
if len(matches) < 3 {
|
||||||
errMsg := fmt.Sprintf("%s %s %s %s %s Invalid URL", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto) // 构建错误日志信息
|
errMsg := fmt.Sprintf("%s %s %s %s %s Invalid URL", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto)
|
||||||
logWarning(errMsg) // 记录警告日志
|
logWarning(errMsg)
|
||||||
c.String(http.StatusForbidden, "Invalid URL Format. Path: %s", rawPath) // 返回 403 状态码和错误信息，提示 URL 格式无效
|
c.String(http.StatusForbidden, "Invalid URL Format. Path: %s", rawPath)
|
||||||
return // 中断请求处理
|
|
||||||
}
|
|
||||||
|
|
||||||
// **构建完整的 URL**
|
|
||||||
rawPath = "https://" + matches[2] // 从匹配结果中提取 URL 的剩余部分，并添加 https:// 协议头，构建完整的 URL
|
|
||||||
|
|
||||||
username, repo := MatchUserRepo(rawPath, cfg, c, matches) // 调用 MatchUserRepo 函数，从 URL 中提取用户名和仓库名
|
|
||||||
|
|
||||||
logInfo("%s %s %s %s %s Matched-Username: %s, Matched-Repo: %s", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto, username, repo) // 记录 info 日志，包含匹配到的用户名和仓库名
|
|
||||||
// dump log 记录详细信息 c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto, full Header
|
|
||||||
LogDump("%s %s %s %s %s %s", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto, c.Request.Header) // 记录 dump 日志，包含更详细的请求头信息
|
|
||||||
repouser := fmt.Sprintf("%s/%s", username, repo) // 构建 "用户名/仓库名" 格式的字符串
|
|
||||||
|
|
||||||
// **白名单检查**
|
|
||||||
if cfg.Whitelist.Enabled { // 检查是否启用白名单
|
|
||||||
whitelist := auth.CheckWhitelist(username, repo) // 调用 CheckWhitelist 函数检查当前仓库是否在白名单中
|
|
||||||
if !whitelist { // 如果仓库不在白名单中
|
|
||||||
logErrMsg := fmt.Sprintf("%s %s %s %s %s Whitelist Blocked repo: %s", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto, repouser) // 构建错误日志信息
|
|
||||||
errMsg := fmt.Sprintf("Whitelist Blocked repo: %s", repouser) // 构建返回给客户端的错误信息
|
|
||||||
c.JSON(http.StatusForbidden, gin.H{"error": errMsg}) // 返回 403 状态码和 JSON 错误信息
|
|
||||||
logWarning(logErrMsg) // 记录警告日志
|
|
||||||
return // 中断请求处理
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// **黑名单检查**
|
|
||||||
if cfg.Blacklist.Enabled { // 检查是否启用黑名单
|
|
||||||
blacklist := auth.CheckBlacklist(username, repo) // 调用 CheckBlacklist 函数检查当前仓库是否在黑名单中
|
|
||||||
if blacklist { // 如果仓库在黑名单中
|
|
||||||
logErrMsg := fmt.Sprintf("%s %s %s %s %s Blacklist Blocked repo: %s", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto, repouser) // 构建错误日志信息
|
|
||||||
errMsg := fmt.Sprintf("Blacklist Blocked repo: %s", repouser) // 构建返回给客户端的错误信息
|
|
||||||
c.JSON(http.StatusForbidden, gin.H{"error": errMsg}) // 返回 403 状态码和 JSON 错误信息
|
|
||||||
logWarning(logErrMsg) // 记录警告日志
|
|
||||||
return // 中断请求处理
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
var matchedIndex = -1 // 用于存储匹配到的正则表达式索引，初始化为 -1 表示未匹配
|
|
||||||
|
|
||||||
// **优化的 URL 匹配逻辑：基于关键词分类匹配**
|
|
||||||
switch {
|
|
||||||
case strings.Contains(rawPath, "/releases/") || strings.Contains(rawPath, "/archive/"): // 检查 URL 中是否包含 "/releases/" 或 "/archive/" 关键词
|
|
||||||
matchedIndex = 0 // 如果包含，则匹配 exps[0] (GitHub Releases/Archive 链接)
|
|
||||||
case strings.Contains(rawPath, "/blob/") || strings.Contains(rawPath, "/raw/"): // 检查 URL 中是否包含 "/blob/" 或 "/raw/" 关键词
|
|
||||||
matchedIndex = 1 // 如果包含，则匹配 exps[1] (GitHub Blob/Raw 链接)
|
|
||||||
case strings.Contains(rawPath, "/info/") || strings.Contains(rawPath, "/git-"): // 检查 URL 中是否包含 "/info/" 或 "/git-" 关键词
|
|
||||||
matchedIndex = 2 // 如果包含，则匹配 exps[2] (GitHub Info/Git 相关链接)
|
|
||||||
case strings.Contains(rawPath, "raw.githubusercontent.com"): // 检查 URL 中是否包含 "raw.githubusercontent.com" 域名
|
|
||||||
matchedIndex = 3 // 如果包含，则匹配 exps[3] (raw.githubusercontent.com 链接)
|
|
||||||
case strings.Contains(rawPath, "gist.githubusercontent.com"): // 检查 URL 中是否包含 "gist.githubusercontent.com" 域名
|
|
||||||
matchedIndex = 4 // 如果包含，则匹配 exps[4] (gist.githubusercontent.com 链接)
|
|
||||||
case strings.Contains(rawPath, "api.github.com/repos/"): // 检查 URL 中是否包含 "api.github.com/repos/" 路径前缀
|
|
||||||
matchedIndex = 5 // 如果包含，则匹配 exps[5] (api.github.com/repos 链接)
|
|
||||||
}
|
|
||||||
|
|
||||||
if matchedIndex == -1 { // 如果没有任何关键词匹配到，则说明 URL 类型无法识别
|
|
||||||
c.AbortWithStatus(http.StatusNotFound) // 返回 404 状态码
|
|
||||||
logWarning("%s %s %s %s %s 404-NOMATCH", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto) // 记录警告日志
|
|
||||||
return // 中断请求处理
|
|
||||||
}
|
|
||||||
|
|
||||||
// **使用分类匹配到的正则表达式进行精确匹配**
|
|
||||||
exp := exps[matchedIndex]
|
|
||||||
matches = exp.FindStringSubmatch(rawPath)
|
|
||||||
if len(matches) == 0 {
|
|
||||||
// 如果精确匹配失败 (例如，关键词匹配到 releases，但实际 URL 格式不符合 releases 的正则)
|
|
||||||
c.AbortWithStatus(http.StatusNotFound)
|
|
||||||
logWarning("%s %s %s %s %s 404-NOMATCH-ExpSpecific", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto) // 记录警告日志，表明是特定正则匹配失败
|
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
// **HeaderAuth 鉴权检查 (仅针对 api.github.com/repos 链接)**
|
// 制作url
|
||||||
if matchedIndex == 5 { // 如果匹配的是 api.github.com/repos 链接 (对应 exps[5])
|
rawPath = "https://" + matches[2]
|
||||||
if cfg.Auth.AuthMethod != "header" || !cfg.Auth.Enabled { // 检查是否启用了 HeaderAuth 并且 AuthMethod 配置为 "header"
|
|
||||||
c.JSON(http.StatusForbidden, gin.H{"error": "HeaderAuth is not enabled."}) // 返回 403 状态码和错误信息，提示 HeaderAuth 未启用
|
var (
|
||||||
logError("%s %s %s %s %s HeaderAuth-Error: HeaderAuth is not enabled.", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto) // 记录错误日志
|
user string
|
||||||
return // 中断请求处理
|
repo string
|
||||||
|
matcher string
|
||||||
|
)
|
||||||
|
|
||||||
|
// 匹配 "https://github.com"开头的链接
|
||||||
|
if strings.HasPrefix(rawPath, "https://github.com") {
|
||||||
|
remainingPath := strings.TrimPrefix(rawPath, "https://github.com")
|
||||||
|
if strings.HasPrefix(remainingPath, "/") {
|
||||||
|
remainingPath = strings.TrimPrefix(remainingPath, "/")
|
||||||
|
}
|
||||||
|
// 预期格式/user/repo/more...
|
||||||
|
// 取出user和repo和最后部分
|
||||||
|
parts := strings.Split(remainingPath, "/")
|
||||||
|
if len(parts) <= 2 {
|
||||||
|
logWarning("%s %s %s %s %s Invalid URL", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto)
|
||||||
|
c.String(http.StatusForbidden, "Invalid URL Format. Path: %s", rawPath)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
user = parts[0]
|
||||||
|
repo = parts[1]
|
||||||
|
// 匹配 "https://github.com"开头的链接
|
||||||
|
if len(parts) >= 3 {
|
||||||
|
switch parts[2] {
|
||||||
|
case "releases", "archive":
|
||||||
|
matcher = "releases"
|
||||||
|
case "blob", "raw":
|
||||||
|
matcher = "blob"
|
||||||
|
case "info", "git-upload-pack":
|
||||||
|
matcher = "clone"
|
||||||
|
default:
|
||||||
|
fmt.Println("Invalid URL: Unknown type")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// 匹配 "https://raw"开头的链接
|
||||||
|
if strings.HasPrefix(rawPath, "https://raw") {
|
||||||
|
remainingPath := strings.TrimPrefix(rawPath, "https://")
|
||||||
|
parts := strings.Split(remainingPath, "/")
|
||||||
|
if len(parts) <= 3 {
|
||||||
|
logWarning("%s %s %s %s %s Invalid URL", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto)
|
||||||
|
c.String(http.StatusForbidden, "Invalid URL Format. Path: %s", rawPath)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
user = parts[1]
|
||||||
|
repo = parts[2]
|
||||||
|
matcher = "raw"
|
||||||
|
}
|
||||||
|
// 匹配 "https://gist"开头的链接
|
||||||
|
if strings.HasPrefix(rawPath, "https://gist") {
|
||||||
|
remainingPath := strings.TrimPrefix(rawPath, "https://")
|
||||||
|
parts := strings.Split(remainingPath, "/")
|
||||||
|
if len(parts) <= 3 {
|
||||||
|
logWarning("%s %s %s %s %s Invalid URL", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto)
|
||||||
|
c.String(http.StatusForbidden, "Invalid URL Format. Path: %s", rawPath)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
user = parts[1]
|
||||||
|
matcher = "gist"
|
||||||
|
}
|
||||||
|
// 匹配 "https://api.github.com/"开头的链接
|
||||||
|
if strings.HasPrefix(rawPath, "https://api.github.com/") {
|
||||||
|
matcher = "api"
|
||||||
|
remainingPath := strings.TrimPrefix(rawPath, "https://api.github.com/")
|
||||||
|
|
||||||
|
parts := strings.Split(remainingPath, "/")
|
||||||
|
if parts[0] == "repos" {
|
||||||
|
user = parts[1]
|
||||||
|
repo = parts[2]
|
||||||
|
}
|
||||||
|
if parts[0] == "users" {
|
||||||
|
user = parts[1]
|
||||||
|
}
|
||||||
|
if cfg.Auth.AuthMethod != "header" || !cfg.Auth.Enabled {
|
||||||
|
c.JSON(http.StatusForbidden, gin.H{"error": "HeaderAuth is not enabled."})
|
||||||
|
logError("%s %s %s %s %s HeaderAuth-Error: HeaderAuth is not enabled.", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto)
|
||||||
|
return
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// **处理 blob/raw 路径**
|
username := user
|
||||||
if matchedIndex == 1 { // 如果匹配的是 GitHub Blob/Raw 链接 (对应 exps[1])
|
//username, repo := MatchUserRepo(rawPath, cfg, c, matches) // 匹配用户名和仓库名
|
||||||
rawPath = strings.Replace(rawPath, "/blob/", "/raw/", 1) // 将 URL 中的 "/blob/" 替换为 "/raw/"，获取 raw 链接 (用于下载原始文件内容)
|
|
||||||
|
logInfo("%s %s %s %s %s Matched-Username: %s, Matched-Repo: %s", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto, username, repo)
|
||||||
|
// dump log 记录详细信息 c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto, full Header
|
||||||
|
LogDump("%s %s %s %s %s %s", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto, c.Request.Header)
|
||||||
|
repouser := fmt.Sprintf("%s/%s", username, repo)
|
||||||
|
|
||||||
|
// 白名单检查
|
||||||
|
if cfg.Whitelist.Enabled {
|
||||||
|
whitelist := auth.CheckWhitelist(username, repo)
|
||||||
|
if !whitelist {
|
||||||
|
logErrMsg := fmt.Sprintf("%s %s %s %s %s Whitelist Blocked repo: %s", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto, repouser)
|
||||||
|
errMsg := fmt.Sprintf("Whitelist Blocked repo: %s", repouser)
|
||||||
|
c.JSON(http.StatusForbidden, gin.H{"error": errMsg})
|
||||||
|
logWarning(logErrMsg)
|
||||||
|
return
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// **通用鉴权处理**
|
// 黑名单检查
|
||||||
authcheck, err := auth.AuthHandler(c, cfg) // 调用 AuthHandler 函数进行通用鉴权检查 (例如，基于 Cookie 或 Header 的鉴权)
|
if cfg.Blacklist.Enabled {
|
||||||
if !authcheck { // 如果鉴权失败
|
blacklist := auth.CheckBlacklist(username, repo)
|
||||||
c.AbortWithStatusJSON(401, gin.H{"error": "Unauthorized"}) // 返回 401 状态码和 JSON 错误信息，提示未授权
|
if blacklist {
|
||||||
logWarning("%s %s %s %s %s Auth-Error: %v", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto, err) // 记录警告日志，包含鉴权错误信息
|
logErrMsg := fmt.Sprintf("%s %s %s %s %s Blacklist Blocked repo: %s", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto, repouser)
|
||||||
return // 中断请求处理
|
errMsg := fmt.Sprintf("Blacklist Blocked repo: %s", repouser)
|
||||||
|
c.JSON(http.StatusForbidden, gin.H{"error": errMsg})
|
||||||
|
logWarning(logErrMsg)
|
||||||
|
return
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// **Debug 日志记录匹配结果**
|
/*
|
||||||
logDebug("%s %s %s %s %s Matches: %v", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto, matches) // 记录 debug 日志，包含匹配结果信息
|
matches = CheckURL(rawPath, c)
|
||||||
|
if matches == nil {
|
||||||
|
c.AbortWithStatus(http.StatusNotFound)
|
||||||
|
logWarning("%s %s %s %s %s 404-NOMATCH", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
*/
|
||||||
|
|
||||||
// **根据匹配到的 URL 类型，进行不同的代理请求处理**
|
// 若匹配api.github.com/repos/用户名/仓库名/路径, 则检查是否开启HeaderAuth
|
||||||
switch matchedIndex {
|
|
||||||
case 0, 1, 3, 4: // 如果匹配的是 Releases/Archive, Blob/Raw, raw.githubusercontent.com 或 gist.githubusercontent.com 链接 (对应 exps[0], exps[1], exps[3], exps[4])
|
// 处理blob/raw路径
|
||||||
//ProxyRequest(c, rawPath, cfg, "chrome", runMode) // 原始的 ProxyRequest 函数 (可能一次性读取全部响应)
|
if matcher == "blob" {
|
||||||
ChunkedProxyRequest(c, rawPath, cfg, "chrome", runMode) // 使用 ChunkedProxyRequest 函数进行分块代理 (更高效，特别是对于大文件)
|
rawPath = strings.Replace(rawPath, "/blob/", "/raw/", 1)
|
||||||
case 2: // 如果匹配的是 Info/Git 相关链接 (对应 exps[2])
|
}
|
||||||
//ProxyRequest(c, rawPath, cfg, "git", runMode) // 原始的 ProxyRequest 函数
|
|
||||||
GitReq(c, rawPath, cfg, "git", runMode) // 使用 GitReq 函数处理 Git 相关请求 (针对 .gitattributes, .gitignore 等)
|
// 鉴权
|
||||||
default: // 如果匹配到其他类型 (理论上不应该发生，因为前面的 matchedIndex == -1 已经处理了未识别类型)
|
authcheck, err := auth.AuthHandler(c, cfg)
|
||||||
c.String(http.StatusForbidden, "Invalid input.") // 返回 403 状态码和错误信息，提示无效输入
|
if !authcheck {
|
||||||
fmt.Println("Invalid input.") // 打印错误信息到控制台
|
c.AbortWithStatusJSON(401, gin.H{"error": "Unauthorized"})
|
||||||
return // 中断请求处理
|
logWarning("%s %s %s %s %s Auth-Error: %v", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// IP METHOD URL USERAGENT PROTO MATCHES
|
||||||
|
logDebug("%s %s %s %s %s Matches: %v", c.ClientIP(), c.Request.Method, rawPath, c.Request.Header.Get("User-Agent"), c.Request.Proto, matches)
|
||||||
|
|
||||||
|
switch matcher {
|
||||||
|
case "releases", "blob", "raw", "gist", "api":
|
||||||
|
//ProxyRequest(c, rawPath, cfg, "chrome", runMode)
|
||||||
|
ChunkedProxyRequest(c, rawPath, cfg, "chrome", runMode) // dev test chunk
|
||||||
|
case "clone":
|
||||||
|
//ProxyRequest(c, rawPath, cfg, "git", runMode)
|
||||||
|
GitReq(c, rawPath, cfg, "git", runMode)
|
||||||
|
default:
|
||||||
|
c.String(http.StatusForbidden, "Invalid input.")
|
||||||
|
fmt.Println("Invalid input.")
|
||||||
|
return
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
func CheckURL(u string, c *gin.Context) []string {
|
||||||
|
for _, exp := range exps {
|
||||||
|
if matches := exp.FindStringSubmatch(u); matches != nil {
|
||||||
|
return matches[1:]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
errMsg := fmt.Sprintf("%s %s %s %s %s Invalid URL", c.ClientIP(), c.Request.Method, u, c.Request.Header.Get("User-Agent"), c.Request.Proto)
|
||||||
|
logError(errMsg)
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
*/
|
||||||
|
|
|
||||||
|
|
@ -44,12 +44,18 @@ func initHTTPClient(cfg *config.Config) {
|
||||||
}).DialContext,
|
}).DialContext,
|
||||||
}
|
}
|
||||||
*/
|
*/
|
||||||
|
var proTolcols = new(http.Protocols)
|
||||||
|
proTolcols.SetHTTP1(true)
|
||||||
|
proTolcols.SetHTTP2(true)
|
||||||
|
proTolcols.SetUnencryptedHTTP2(true)
|
||||||
if cfg.Httpc.Mode == "auto" {
|
if cfg.Httpc.Mode == "auto" {
|
||||||
|
|
||||||
tr = &http.Transport{
|
tr = &http.Transport{
|
||||||
//MaxIdleConns: 160,
|
//MaxIdleConns: 160,
|
||||||
IdleConnTimeout: 30 * time.Second,
|
IdleConnTimeout: 30 * time.Second,
|
||||||
WriteBufferSize: 32 * 1024, // 32KB
|
WriteBufferSize: 32 * 1024, // 32KB
|
||||||
ReadBufferSize: 32 * 1024, // 32KB
|
ReadBufferSize: 32 * 1024, // 32KB
|
||||||
|
Protocols: proTolcols,
|
||||||
}
|
}
|
||||||
} else if cfg.Httpc.Mode == "advanced" {
|
} else if cfg.Httpc.Mode == "advanced" {
|
||||||
tr = &http.Transport{
|
tr = &http.Transport{
|
||||||
|
|
@ -58,6 +64,7 @@ func initHTTPClient(cfg *config.Config) {
|
||||||
MaxIdleConnsPerHost: cfg.Httpc.MaxIdleConnsPerHost,
|
MaxIdleConnsPerHost: cfg.Httpc.MaxIdleConnsPerHost,
|
||||||
WriteBufferSize: 32 * 1024, // 32KB
|
WriteBufferSize: 32 * 1024, // 32KB
|
||||||
ReadBufferSize: 32 * 1024, // 32KB
|
ReadBufferSize: 32 * 1024, // 32KB
|
||||||
|
Protocols: proTolcols,
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
// 错误的模式
|
// 错误的模式
|
||||||
|
|
|
||||||
|
|
@ -30,56 +30,7 @@ func readRequestBody(c *gin.Context) ([]byte, error) {
|
||||||
return body, nil
|
return body, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
|
||||||
func SendRequest(c *gin.Context, req *req.Request, method, url string) (*req.Response, error) {
|
|
||||||
switch method {
|
|
||||||
case "GET":
|
|
||||||
return req.Get(url)
|
|
||||||
case "POST":
|
|
||||||
return req.Post(url)
|
|
||||||
case "PUT":
|
|
||||||
return req.Put(url)
|
|
||||||
case "DELETE":
|
|
||||||
return req.Delete(url)
|
|
||||||
default:
|
|
||||||
// IP METHOD URL USERAGENT PROTO UNSUPPORTED-METHOD
|
|
||||||
errmsg := fmt.Sprintf("%s %s %s %s %s Unsupported method", c.ClientIP(), method, url, c.Request.Header.Get("User-Agent"), c.Request.Proto)
|
|
||||||
logWarning(errmsg)
|
|
||||||
return nil, fmt.Errorf(errmsg)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
*/
|
|
||||||
|
|
||||||
func HandleError(c *gin.Context, message string) {
|
func HandleError(c *gin.Context, message string) {
|
||||||
c.String(http.StatusInternalServerError, fmt.Sprintf("server error %v", message))
|
c.String(http.StatusInternalServerError, fmt.Sprintf("server error %v", message))
|
||||||
logError(message)
|
logError(message)
|
||||||
}
|
}
|
||||||
|
|
||||||
func CheckURL(u string, c *gin.Context) []string {
|
|
||||||
for _, exp := range exps {
|
|
||||||
if matches := exp.FindStringSubmatch(u); matches != nil {
|
|
||||||
return matches[1:]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
errMsg := fmt.Sprintf("%s %s %s %s %s Invalid URL", c.ClientIP(), c.Request.Method, u, c.Request.Header.Get("User-Agent"), c.Request.Proto)
|
|
||||||
logError(errMsg)
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
// 处理响应大小
|
|
||||||
func HandleResponseSize(resp *http.Response, cfg *config.Config, c *gin.Context) error {
|
|
||||||
contentLength := resp.Header.Get("Content-Length")
|
|
||||||
sizelimit := cfg.Server.SizeLimit * 1024 * 1024
|
|
||||||
if contentLength != "" {
|
|
||||||
size, err := strconv.Atoi(contentLength)
|
|
||||||
if err == nil && size > sizelimit {
|
|
||||||
finalURL := resp.Request.URL.String()
|
|
||||||
c.Redirect(http.StatusMovedPermanently, finalURL)
|
|
||||||
logWarning("%s %s %s %s %s Final-URL: %s Size-Limit-Exceeded: %d", c.ClientIP(), c.Request.Method, c.Request.URL.String(), c.Request.Header.Get("User-Agent"), c.Request.Proto, finalURL, size)
|
|
||||||
return fmt.Errorf("Path: %s size limit exceeded: %d", finalURL, size)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
*/
|
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue