53 Commits

Author SHA1 Message Date
5dec128510
Merge pull request #3 from xfy911/improve-comments
docs: add comprehensive documentation comments
2026-06-03 15:41:36 +08:00
xfy911
a136b07bb9 docs: add documentation comments for exported constants and variables
- Fix gjson/gjson.go package comments and constant documentation
- Fix internal/config/config.go constant documentation
- Fix internal/utils/httperror.go variable documentation
- Fix internal/matcher/matcher.go constant documentation
- Fix internal/middleware/compression/compression.go constant documentation
- Fix internal/middleware/limitrate/limitrate.go constant documentation
- Fix internal/middleware/rewrite/rewrite.go constant documentation
- Fix internal/middleware/security/access.go and auth.go constant documentation
- Fix internal/ssl/client_verify.go constant documentation
- Fix internal/variable/builtin.go and ssl.go constant documentation
- Fix internal/lua/api_log.go HTTP and log level constant documentation
- Fix internal/benchmark/tools/tools.go constant documentation
- Include author attribution (xfy)
2026-06-03 15:28:53 +08:00
xfy911
fc1de2d445 docs: add documentation comments for more exported constants and variables
- Add comments for ssl/client_verify.go verification modes
- Add comments for security/auth.go hash algorithms
- Add comments for rewrite/rewrite.go flags
- Add comments for compression/compression.go algorithms
- Add comments for limitrate/limitrate.go strategies
- Include author attribution (xfy)
2026-06-03 15:28:53 +08:00
xfy
bc0bc5fbbb refactor: remove unused security header preset functions and tests 2026-06-03 13:49:57 +08:00
xfy
edc135ae5f refactor(utils): enhance ParseCIDR to support single IP
Enhance parseCIDR in utils/ipallowlist.go to support single IP addresses
(without CIDR prefix) and ensure IP is in canonical form. This matches
the functionality previously in access.go.

- Add ParseCIDR as public function supporting CIDR and single IP
- Update access.go to use utils.ParseCIDR instead of local implementation
- Remove duplicate parseCIDR function from access.go
- Update tests to use utils.ParseCIDR

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-08 18:20:09 +08:00
xfy
f145a8770e refactor: modernize code with Go 1.22+ features
Apply modern Go patterns across the codebase:
- Replace `interface{}` with `any` (Go 1.18+)
- Use `for range n` instead of `for i := 0; i < n; i++` (Go 1.22+)
- Replace `sort.Slice` with `slices.Sort` from slices package
- Simplify sync.WaitGroup patterns with errgroup where appropriate
- Add Makefile targets for modernize analyzer

Total: 84 files updated, net reduction of 79 lines

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-30 10:37:45 +08:00
xfy
e7306a0c72 perf: optimize ConsistentHash and RateLimiter for better concurrency
- ConsistentHash: reuse main hash ring in SelectExcludingByKey instead of
  rebuilding per call, reducing memory allocation from 369KB to 1.8KB (99.5%)
- RateLimiter: replace single RWMutex with 16-segment sharded locks to
  reduce lock contention in high-concurrency scenarios
- TLS SessionTickets: add warning log when KeyFile is empty to alert
  users about session invalidation after restart

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-30 10:23:19 +08:00
xfy
ecb020fed9 refactor(security): extract auth_request defaults helper
Extract applyDefaults function to unify configuration initialization
logic between NewAuthRequest and UpdateConfig methods.

Eliminates ~20 lines of duplicate default value setting code.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-29 18:22:02 +08:00
xfy
bc9b7ba616 refactor(security): merge access Update methods
- 新增 UpdateList(target string, cidrs []string) 统一更新方法
- UpdateAllowList/UpdateDenyList 改为包装调用
- 消除约 15 行重复代码,保持向后兼容

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-29 18:20:14 +08:00
xfy
cf2fcca7e8 refactor: 提取公共逻辑、消除重复代码、加强错误处理
- 提取 App 公共逻辑到 app_common.go,消除 app.go/app_windows.go 重复定义
- 提取 Server 生命周期/中间件/路由逻辑到独立文件(lifecycle.go/middleware_builder.go/router.go)
- 提取 Proxy 缓存处理/头部修改/目标选择到独立模块
- 提取 CheckIPAccess/CheckTokenAuth 到 utils/httperror.go,消除 status/purge 重复实现
- 修复 stream 双向转发:任一方向完成立即关闭双端,避免连接泄漏
- 修复 SSL/TLS 中静默忽略错误的问题,添加日志记录
- 统一日志消息为英文

💘 Generated with Crush

Assisted-by: GLM 5.1 via Crush <crush@charm.land>
2026-04-28 18:00:48 +08:00
xfy
6f6a8f0455 refactor(adapter): 提取 HTTP/2/3 适配器公共逻辑为 CommonAdapter
将 http2 和 http3 适配器中重复的 sync.Pool 管理、流式请求体处理、
上下文重置等逻辑提取到 internal/adapter 包,通过 struct embedding 复用。
同时简化 ConnLimiter 直接实现 middleware.Middleware 接口,移除冗余 wrapper。

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-28 17:06:41 +08:00
xfy
179090fa34 fix(security): 修复 2 个 CRITICAL + 6 个 HIGH 安全与代码质量问题
安全修复:
- ConnLimiter Acquire() TOCTOU 竞态: atomic.AddInt64 替代 loadInt64+addInt64
- Cache Purge token 时序侧信道: 改用 subtle.ConstantTimeCompare
- Lua Cosocket SSRF: 新增 ip_guard 两层 IP 检查(字面量+解析后),拒绝私有/回环地址
- X-Accel-Redirect 路径遍历: urlpath.Clean + 前缀拒绝(/internal/ /admin/)
- CRLF 注入: containsCRLF 校验变量展开后的 header 值,logging.Warn 可观测
- Proxy URI 注入: bytes.ContainsAny 检查 path 中的 @\r\n 危险字符

代码质量:
- disk_cache.go Set() 7 处静默 return 改为 logging.Error 日志记录
- config.go 从 2392 行拆分为 9 个按域文件(config/server/proxy/security/ssl/cache/performance/monitoring/variable)

验证: go build + vet + golangci-lint(0 issues) + test(83.2% 无回归) + race detector 全部通过

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-28 10:13:47 +08:00
xfy
1e38fe9e90 fix: 显式忽略不需要处理的错误返回值
对 os.Remove、conn.Close 等清理操作的返回值使用 _ 忽略,
避免 errcheck 静态检查告警。

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-24 10:41:35 +08:00
xfy
9f7090df67 test(handler,middleware,server,ssl,proxy): 扩展测试覆盖率
- handler: 添加 sendfile 和 static 处理器测试
- middleware/security: 添加访问控制、认证、请求头、限流测试
- server: 添加池、pprof、清理、状态、升级、vhost 测试
- ssl: 添加客户端验证、OCSP、SSL 测试
- proxy: 添加代理覆盖率补充测试

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-22 10:42:05 +08:00
xfy
91f954936e refactor(server,middleware): 提取常量提高代码可读性
- ratelimit: 使用 accessUnknown 常量替代硬编码字符串
- testutil: 提取 testListenAddr 常量

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-22 10:41:48 +08:00
xfy
13bfc090f7 docs(middleware): 为中间件模块添加标准化 godoc 注释
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-20 11:23:03 +08:00
xfy
2458ac1ed1 docs: 为其余模块添加标准化 godoc 注释
为剩余模块添加完整文档注释:
- app: 应用生命周期管理
- cache: 文件缓存
- config: 配置加载器
- handler: 静态文件处理和错误页面
- http2/http3: HTTP/2 和 HTTP/3 适配器
- loadbalance: 负载均衡算法和均衡器
- middleware: bodylimit、compression、rewrite、security
- mimeutil: MIME 类型检测
- netutil: URL 处理工具
- resolver: DNS 解析器
- server: 服务器升级处理
- ssl: SSL/TLS 和 OCSP
- stream: 流处理
- testutil: 测试工具
- variable: 变量池和 SSL 变量

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-20 10:59:53 +08:00
xfy
5f5717d6a4 test: 添加各模块覆盖率补充测试
- middleware/security: access 中间件覆盖率测试
- proxy: proxy 核心功能覆盖率测试
- server: server 扩展功能测试
- stream: stream 处理覆盖率测试

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-20 08:27:25 +08:00
xfy
584ca9170d test(lua,security): 优化测试代码错误返回值处理
- api_socket_tcp_test.go: 使用空白标识符忽略非关键错误返回值
- auth_test.go: 使用空白标识符忽略不需要的 hash 返回值

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-16 18:24:05 +08:00
xfy
3bdecd87eb test(security): 扩展认证和 GeoIP 中间件测试
- auth_test: 扩展 Basic/JWT/IP 白名单测试
- geoip_test: 扩展 GeoIP 限制和数据库加载测试
- 提高安全中间件测试覆盖率

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-16 18:12:29 +08:00
xfy
8ed800271d test: 迁移基准测试循环到 Go 1.24 b.Loop() API
- 所有 *_bench_test.go 文件从 for i := 0; i < b.N; i++ 改为 for b.Loop()
- 部分测试文件从 for i := 0; i < N; ... 改为 for range N 或 for i := range N
- 涵盖模块: cache, handler, http2, http3, loadbalance, logging, lua,
  middleware/accesslog, middleware/bodylimit, middleware/rewrite,
  middleware/security, netutil, resolver, server, ssl, stream

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-16 13:50:15 +08:00
xfy
6866c763f1 refactor(security,proxy): 移除重复代码使用公共函数
- access: 移除 getRemoteAddrIP 改用 netutil.GetRemoteAddrIP
- proxy: 简化 createBalancer 调用 createBalancerByName

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-14 15:56:20 +08:00
xfy
cdc767160b refactor(security): 调整分段锁桶字段顺序优化内存布局
将 counters 字段置于 mu 锁之前,符合 Go 结构体字段排序最佳实践,
数据字段优先于锁字段,可能优化内存访问效率。

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-14 14:53:21 +08:00
xfy
fd4e164ae6 refactor(security): 滑动窗口限流器使用分段锁优化并发性能
将单一 counters map + 全局 mutex 改为 16 buckets 分段锁结构:

- 新增 limiterBucket 结构体,每个桶独立持有 RW 锁和计数器 map
- 使用 FNV-1a 哈希算法将键均匀分布到 16 个桶中
- 各方法修改为按 bucket 分发操作:
  - Allow() / allowApproximate() / allowPrecise()
  - Reset() / ResetAll() / Cleanup()
  - GetStats() / GetCount()

收益:
- 并发场景下锁竞争降低约 94% (16 个桶并行)
- 基准测试显示并行 Allow 操作约 89ns/op

测试验证:
- go test -race 通过并发安全测试
- 基准测试显示吞吐提升

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-14 14:26:01 +08:00
xfy
1bf9e7ad5d fix(test,security): 改进测试稳定性和认证安全性
- socket_test.go: 降低压力测试参数避免超时,改进连接状态等待逻辑
- auth.go: 使用 subtle.ConstantTimeCompare 替代手动循环比较

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-13 16:20:01 +08:00
xfy
d21e27fbac fix(lint): 修复 golangci-lint 错误 (119 -> 0 issues)
主要修复:
- errcheck: defer Close 使用 //nolint:errcheck,类型断言改为 ok 检查
- govet fieldalignment: 调整结构体字段顺序优化内存布局
- revive unused-parameter: 将未使用参数改为 _
- exhaustive: 添加缺失的 switch case 或 default
- goconst: 提取重复字符串为常量 (accessAllow, accessDeny 等)
- staticcheck SA9003: 修复空分支逻辑
- gofmt: 运行 gofmt -w 格式化
- nolintlint: 修复 nolint 注释格式

其他改进:
- 更新 .golangci.yml 配置,启用更严格的检查
- 移除未使用的代码和导入
- 简化测试辅助函数调用

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-13 16:15:31 +08:00
xfy
103e8ff0cf feat(geoip): 添加基于国家代码的 GeoIP 访问控制功能
- 新增 GeoIPConfig 配置结构,支持 MaxMind MMDB 数据库
- 实现 GeoIPLookup 查询器,带 LRU 缓存和 TTL 支持
- AccessControl 集成 GeoIP 检查,按国家代码过滤请求
- 支持私有 IP 特殊处理策略 (allow/deny)
- 添加完整的单元测试和配置验证测试
- 新增 stream-udp.conf 示例配置文档

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-13 16:14:44 +08:00
xfy
e646cc5d05 refactor(test): 提取 testutil 包统一测试辅助函数
- 新增 NewRequestCtx 和 NewRequestCtxWithHeader 辅助函数
- 简化各测试文件中 RequestCtx 创建代码
- 减少测试代码重复,提高可维护性

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-13 13:15:20 +08:00
xfy
e1df0ec205 refactor(utils): 提取 HTTP 错误响应辅助函数
新增 SendError 和 SendErrorWithDetail 函数,统一处理 HTTP 错误响应,减少重复代码。

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-13 11:12:49 +08:00
xfy
8b382606df Merge branch 'lint-fix' - resolve sendfile.go conflict
Conflict: sendfile.go (!linux build tag) was incorrectly modified to
include linuxSendfile and getSocketFd functions which already exist
in sendfile_linux.go.

Resolution: Keep HEAD version (simple fallback returning ENOTSUP) as
Linux implementation is properly separated in sendfile_linux.go.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-13 09:26:48 +08:00
xfy
bab0228e1d refactor(security): 将安全头辅助函数改为私有
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-10 13:22:35 +08:00
xfy
4d608c4284 refactor(middleware): 提取限流 key 解析函数
- 新增 parseKeyFunc() 统一处理 key type 解析逻辑
- 消除重复代码,提高可维护性

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-10 11:20:43 +08:00
xfy
649a6ed23f refactor(security): 重命名 HeadersMiddleware 移除冗余前缀
SecurityHeadersMiddleware → HeadersMiddleware
NewSecurityHeaders → NewHeaders
NewSecurityHeadersWithHSTS → NewHeadersWithHSTS

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-10 09:40:38 +08:00
xfy
84c26c61ca style(benchmark): 修复代码格式和忽略无用错误返回值 2026-04-09 12:19:08 +08:00
xfy
25bdba4e01 test(benchmark): 新增组件级基准测试套件
- 新增 benchmark_context.go 标准化测试上下文构造器
- 新增静态文件处理器基准测试(缓存命中/未命中、try_files)
- 新增访问日志中间件基准测试
- 新增压缩中间件基准测试(gzip/brotli、Pool 复用)
- 新增限流器基准测试(令牌桶、滑动窗口、多客户端并发)
- 新增变量展开基准测试(模板展开、Pool 操作)
2026-04-08 18:25:38 +08:00
xfy
0602796ee1 feat(ratelimit): 新增后台自动清理和优雅关闭
- RateLimiter 启动时自动开启后台清理 goroutine
- 新增 StopCleanup 方法优雅关闭清理 goroutine
- 新增 AutoCleanup 和 StopCleanup 测试

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-08 15:03:10 +08:00
xfy
49d33f8b0c feat(middleware/security): 新增 auth_request 外部认证中间件
- 支持将认证委托给外部服务,根据响应状态码决定请求是否继续
- 配置 URI、Method、Timeout 和自定义 Headers
- 支持 $request_uri 等变量在 Headers 中使用

Co-Authored-By: Claude <noreply@anthropic.com>
2026-04-08 14:37:29 +08:00
xfy
ee4f7a5ca9 refactor(config): 移除已废弃的配置字段
移除以下已标记废弃的字段:
- AuthConfig.MinPasswordLength (auth)
- FileCacheConfig.LRUEviction (file_cache)
- TransportConfig.MaxIdleConns (transport)

同时清理相关的验证逻辑、默认值设置、测试代码和文档。

Co-Authored-By: Claude <noreply@anthropic.com>
2026-04-08 09:50:32 +08:00
xfy
f2352ab9cc docs(config,stream,logging,handler,proxy,cache,server,ssl,middleware): 为核心模块添加详细 GoDoc 文档注释
- config: 为 Config 和所有子配置结构添加完整文档,包含使用示例和注意事项
- stream: 为负载均衡器和服务器添加详细的参数、返回值和功能说明
- logging: 为日志格式化和输出函数添加文档,说明支持的变量替换
- handler: 为路由器、静态文件和 sendfile 处理器添加文档
- proxy: 为健康检查器和代理功能添加完整文档
- cache/server/ssl/middleware: 补充相关模块的文档注释
- config.example.yaml: 添加可信代理配置、加密套件示例,更新压缩级别说明

Co-Authored-By: Claude <noreply@anthropic.com>
2026-04-07 15:36:09 +08:00
xfy
3cc2dc7625 style(netutil,server,test): 修复代码格式问题,更新文档
- 修复 server.go 缩进问题
- 添加文件末尾换行符
- 格式化测试文件表格对齐
- 更新 update-prompts.md 添加新任务

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-07 11:38:54 +08:00
xfy
ff260def3b test(loadbalance,security): 完善模块测试覆盖率
loadbalance 模块覆盖率从 52.4% 提升至 96.1%:
- TestConsistentHash: 一致性哈希算法测试
- TestIsValidAlgorithm: 算法验证函数测试

security 模块覆盖率从 50.2% 提升至 63.7%:
- TestNewSlidingWindowLimiter: 滑动窗口限流器创建测试
- TestSlidingWindowLimiter_Allow: 请求允许/拒绝测试
- TestSlidingWindowLimiter_Reset/ResetAll: 重置测试
- TestSlidingWindowLimiter_Cleanup: 清理测试
- TestSlidingWindowLimiter_GetStats/GetCount: 统计测试

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-03 18:38:35 +08:00
xfy
7a98a0b044 refactor: 抽取网络工具函数到 netutil 包,移除冗余代码
- 新增 internal/netutil 包,统一 IP 提取和 URL 解析函数
- proxy/websocket/middleware 使用 netutil 替代重复实现
- 移除 handler/sendfile 中未使用的 BufferPool 相关代码
- 移除 http3/adapter 中未使用的反向转换函数
- 提取 server.registerStaticHandler 函数改进代码结构
- 优化 access.go 锁范围,减少持锁时间

Co-Authored-By: Claude <noreply@anthropic.com>
2026-04-03 18:24:21 +08:00
xfy
fc71cf4835 refactor(test): 统一测试文件错误处理风格
使用空白标识符忽略测试辅助函数中 Close、ReadFrom、Set 等返回值,
与主代码风格保持一致。

Co-Authored-By: Claude <noreply@anthropic.com>
2026-04-03 17:37:05 +08:00
xfy
98736e1f1c feat(security): 增强访问控制安全性,支持可信代理配置
- 新增 TrustedProxies 配置项,安全解析 X-Forwarded-For
- 防止 IP 伪造攻击,仅信任来自可信代理的头部
- 使用右侧非可信 IP 作为真实客户端 IP
- 改进连接数限制中间件集成

Co-Authored-By: Claude <noreply@anthropic.com>
2026-04-03 16:57:32 +08:00
xfy
d42844b2fa test(app,handler,server,http3): 补充单元测试覆盖率
- app: 添加信号处理、配置重载、日志重开测试
- handler/sendfile: 添加小文件、偏移量、错误情况测试
- server: 添加统计追踪、监听器、TLS配置测试
- http3: 新增 adapter 和 server 单元测试
- 格式修复: 末尾换行符、注释对齐
- 文档: AGENTS.md 添加 http3 模块说明

Co-Authored-By: Claude <noreply@anthropic.com>
2026-04-03 16:25:21 +08:00
xfy
ec916d882d feat(proxy,middleware,config): 集成配置与代码差异修复
- 集成一致性哈希负载均衡到 proxy.go,支持 hash_key 和 virtual_nodes 配置
- 集成滑动窗口限流算法到 ratelimit.go,支持 algorithm 选择
- 应用 Transport 连接池配置到 createHostClient
- 集成 HSTS 配置到安全头部中间件
- 补充 config.example.yaml 缺失配置(http3、gzip_static、sliding_window)

Co-Authored-By: Claude <noreply@anthropic.com>
2026-04-03 16:08:45 +08:00
xfy
d6367a1c38 feat(http3,docs,middleware): 实现 Phase 9 HTTP/3 与性能优化扩展
- 新增 HTTP/3 (QUIC) 服务器支持,集成到 App 生命周期管理
- 新增 nginx 内置变量速查表文档
- 完善多篇 nginx 文档(代理、安全、流、限流、HTTP/2/3、核心事件)
- 新增一致性哈希负载均衡、gzip_static、滑动窗口限流中间件
- 扩展配置支持 HTTP/3 和日志格式选项

Co-Authored-By: Claude <noreply@anthropic.com>
2026-04-03 15:39:06 +08:00
xfy
94a2ae7113 feat(config,logging): 增强日志配置,支持全局格式和 nginx combined 格式
- 新增全局日志格式配置 (text/json),控制启动/停止日志输出格式
- 访问日志默认格式改为近似 nginx combined 格式
- 支持 $remote_user 变量,BasicAuth 认证成功后存储用户名到上下文
- 扩展 config.example.yaml 虚拟主机配置说明

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-03 15:02:27 +08:00
xfy
ac9153f09d fix(proxy,stream,server): Phase 8 问题修复与功能完善
- WebSocket 代理集成:handleWebSocket 现调用 ProxyWebSocket 实现
- 删除 UDP Stream 冗余代码:移除 udpListener 类型及相关测试
- 热升级监听器继承:改用 net.Listen + Serve 模式支持监听器传递
- 代码格式修复:注释格式调整、字段对齐、文件末尾换行符

Co-Authored-By: Claude <noreply@anthropic.com>
2026-04-03 14:28:00 +08:00
xfy
95030cd68a docs: 更新 AGENTS.md 文档
添加各模块的 AGENTS.md 文档文件,记录模块职责和代码结构

Co-Authored-By: Claude <noreply@anthropic.com>
2026-04-03 14:07:42 +08:00