@abtnode/router-provider 1.16.45-beta-20250620-082630-c0c76051 → 1.16.45-beta-20250625-064956-91b0fb8f

package/lib/nginx/index.js

@@ -224,6 +224,9 @@ class NginxProvider extends BaseProvider {
         } else {
           this.updateBlacklist([]);
         }
+
+        this.updateWhitelist();
+
         this.updateProxyPolicy(proxyPolicy);
 
         const allRules = sites.reduce((acc, site) => {
@@ -283,15 +286,20 @@ class NginxProvider extends BaseProvider {
         }
 
         if (!enableIpServer) {
-          this._addIpBlackholeServer(conf);
+          this._addIpBlackHoleServer(conf);
           logger.info('add ip blackhole server success');
         }
 
+        if (process.env.ABT_NODE_DOMAIN_BLACKLIST) {
+          this._addUnknownHostBlackHoleServer(conf, process.env.ABT_NODE_DOMAIN_BLACKLIST);
+          logger.info('add unknown host blacklist server success');
+        }
+
         if (enableDefaultServer) {
           this._addDefaultServer(conf, nodeInfo.port);
           logger.info('enable default server success');
         } else {
-          this._addDefaultBlackholeServer(conf);
+          this._addDefaultBlackHoleServer(conf);
           logger.info('add default blackhole server success');
         }
 
@@ -717,7 +725,7 @@ class NginxProvider extends BaseProvider {
     location._addVerbatimBlock('if ($query_string)', 'set $abt_query_string "?$query_string";');
   }
 
-  _addDefaultLocations(server, daemonPort) {
+  _addDefaultLocations({ server, daemonPort, serverName }) {
     if (!server) {
       throw new Error('server is required');
     }
@@ -729,6 +737,8 @@ class NginxProvider extends BaseProvider {
     server._add('root', this.getRelativeConfigDir(this.wwwDir));
     server._addVerbatimBlock('if ($access_blocked)', 'return 403;');
 
+    this._addHostBlockWhitelistServer({ server, serverName });
+
     server._add('error_page', '404 =404 /_abtnode_404');
     server._add('error_page', '502 =502 /_abtnode_502');
     server._add('error_page', '500 502 503 504 =500 /_abtnode_5xx');
@@ -814,20 +824,50 @@ class NginxProvider extends BaseProvider {
     });
   }
 
+  _addUnknownHostBlackHoleServer(conf, blacklist) {
+    let blacklistDomains = blacklist.split(',');
+    if (blacklistDomains.length === 0) {
+      logger.info('unknown host blacklist is empty');
+      return;
+    }
+
+    blacklistDomains = blacklistDomains.filter((domain) => domain.trim() !== '').join(' ');
+
+    conf.nginx.http._add('server');
+    const server = this._getLastServer(conf);
+    server._add('server_name', blacklistDomains);
+    server._add('listen', `${decideHttpPort()}`);
+
+    const certPath = `${joinNginxPath(this.certDir, 'abtnode_dummy.crt')}`;
+    const keyPath = `${joinNginxPath(this.certDir, 'abtnode_dummy.key')}`;
+
+    if (fs.existsSync(certPath) && fs.existsSync(keyPath)) {
+      server._add('ssl_certificate', certPath);
+      server._add('ssl_certificate_key', keyPath);
+      server._add('listen', `${decideHttpsPort()} ssl`);
+    }
+
+    server._add('return', '444');
+
+    logger.info('add unknown host blacklist server success');
+  }
+
   _addDefaultServer(conf, daemonPort) {
     conf.nginx.http._add('server');
     const server = this._getLastServer(conf);
-    server._add('server_name', '_');
+    const serverName = '_';
+
+    server._add('server_name', serverName);
     server._add('listen', `${decideHttpPort()} default_server`);
 
-    this._addDefaultLocations(server, daemonPort);
+    this._addDefaultLocations({ server, daemonPort, serverName });
     server._add('location', '/');
     const location = server.location[server.location.length - 1];
     location._add('try_files', '$uri /404.html break');
     location._add('add_header', 'X-Request-ID $request_id');
   }
 
-  _addDefaultBlackholeServer(conf) {
+  _addDefaultBlackHoleServer(conf) {
     conf.nginx.http._add('server');
     const server = this._getLastServer(conf);
     server._add('server_name', '_');
@@ -845,7 +885,7 @@ class NginxProvider extends BaseProvider {
     server._add('return', '444');
   }
 
-  _addIpBlackholeServer(conf) {
+  _addIpBlackHoleServer(conf) {
     conf.nginx.http._add('server');
     const server = this._getLastServer(conf);
     server._add('server_name', DOMAIN_FOR_IP_SITE_REGEXP);
@@ -860,7 +900,12 @@ class NginxProvider extends BaseProvider {
       server._add('listen', `${decideHttpsPort()} ssl`);
     }
 
-    server._add('return', '444');
+    if (process.env.ABT_NODE_IP_WHITELIST) {
+      server._addVerbatimBlock('if ($access_trusted = 0)', 'return 444;');
+      server._add('return', '200');
+    } else {
+      server._add('return', '444');
+    }
   }
 
   _addStubStatusLocation(conf) {
@@ -922,7 +967,7 @@ class NginxProvider extends BaseProvider {
     blockletDid,
   }) {
     const httpServerUnit = this._addHttpServerUnit({ conf, serverName, port });
-    this._addDefaultLocations(httpServerUnit, daemonPort);
+    this._addDefaultLocations({ server: httpServerUnit, daemonPort, serverName });
     // eslint-disable-next-line max-len
     locations.forEach((x) => this._addReverseProxy({ server: httpServerUnit, ...x, serverName, corsAllowedOrigins, commonHeaders, blockletDid })); // prettier-ignore
   }
@@ -942,7 +987,7 @@ class NginxProvider extends BaseProvider {
     const httpServerUnit = this._addHttpServerUnit({ conf, serverName });
     httpServerUnit._add('return', '307 https://$host$request_uri'); // redirect to https if has https
 
-    this._addDefaultLocations(httpsServerUnit, daemonPort);
+    this._addDefaultLocations({ server: httpsServerUnit, daemonPort, serverName });
     // eslint-disable-next-line max-len
     locations.forEach((x) => this._addReverseProxy({ server: httpsServerUnit, ...x, serverName, corsAllowedOrigins, commonHeaders, blockletDid })); // prettier-ignore
   }
@@ -958,6 +1003,48 @@ class NginxProvider extends BaseProvider {
     return httpServerUnit;
   }
 
+  _addHostBlockWhitelistServer({ server, serverName }) {
+    if (
+      process.env.ABT_NODE_DOMAIN_WHITELIST &&
+      toLower(process.env.ABT_NODE_DOMAIN_WHITELIST).includes(toLower(serverName)) &&
+      process.env.ABT_NODE_DOMAIN_WHITELIST_HEADERS
+    ) {
+      let whitelistHeaders = [];
+      try {
+        whitelistHeaders = JSON.parse(process.env.ABT_NODE_DOMAIN_WHITELIST_HEADERS);
+        if (whitelistHeaders && !Array.isArray(whitelistHeaders) && typeof whitelistHeaders === 'object') {
+          whitelistHeaders = [whitelistHeaders];
+        }
+      } catch (e) {
+        logger.warn('invalid ABT_NODE_DOMAIN_WHITELIST_HEADERS env, should be JSON array', {
+          error: e,
+          env: process.env.ABT_NODE_DOMAIN_WHITELIST_HEADERS,
+        });
+
+        return;
+      }
+
+      if (!Array.isArray(whitelistHeaders) || whitelistHeaders.length === 0) {
+        logger.warn('ABT_NODE_DOMAIN_WHITELIST_HEADERS env is empty');
+        return;
+      }
+
+      for (let i = 0; i < whitelistHeaders.length; i++) {
+        const h = whitelistHeaders[i];
+        if (!h.name || typeof h.value === 'undefined') {
+          // skip invalid header config
+          logger.warn('invalid header config', { header: h });
+        } else {
+          server._addVerbatimBlock(
+            `if ($http_${h.name.toLowerCase().replace(/-/g, '_')} != ${h.value})`,
+            'return 444;'
+          );
+          logger.info('add host block whitelist server with multi-header success', { header: h });
+        }
+      }
+    }
+  }
+
   _addHttpsServerUnit({ conf, serverName, certificateFileName }) {
     // assignment the `server`segment just created to httpServerUnit
     conf.nginx.http._add('server');
@@ -1004,12 +1091,15 @@ class NginxProvider extends BaseProvider {
       return;
     }
 
+    const maxBodySize = 1024 * 1024 * 5; // 5MB
+    const minBodySize = 1024 * 1024 * 1; // 1MB
+
     const variables = {
       ...pick(wafPolicy, ['mode', 'inboundAnomalyScoreThreshold', 'outboundAnomalyScoreThreshold', 'logLevel']),
       tmpDir: this.tmpDir,
       logDir: this.logDir,
       maxUploadSize: Math.floor(+CLIENT_MAX_BODY_SIZE * 1024 * 1024),
-      maxBodySize: Math.floor((+CLIENT_MAX_BODY_SIZE * 1024 * 1024) / 100),
+      maxBodySize: Math.max(minBodySize, Math.min(Math.floor((+CLIENT_MAX_BODY_SIZE * 1024 * 1024) / 10), maxBodySize)),
     };
 
     logger.info('modsecurity variables', variables);
@@ -1108,6 +1198,18 @@ class NginxProvider extends BaseProvider {
     fs.writeFileSync(blacklistFile, blacklist.map((x) => `${x} 1;`).join(os.EOL));
   }
 
+  updateWhitelist() {
+    try {
+      const whitelistFile = path.join(this.includesDir, 'whitelist');
+      let whitelist = process.env.ABT_NODE_IP_WHITELIST?.split(',') || []; // IP 地址列表，支持 CIDR 格式
+      whitelist = whitelist.map((x) => x.trim()).filter(Boolean);
+
+      fs.writeFileSync(whitelistFile, whitelist.map((x) => `${x} 1;`).join(os.EOL));
+    } catch (error) {
+      logger.error('Failed to update whitelist', { error, env: process.env.ABT_NODE_IP_WHITELIST });
+    }
+  }
+
   updateProxyPolicy(proxyPolicy) {
     const proxyRaw = fs.readFileSync(path.join(this.includesDir, 'proxy.raw'), 'utf8');
     const proxyPolicyFile = path.join(this.includesDir, 'proxy');
@@ -1365,6 +1467,10 @@ NginxProvider.check = async ({ configDir = '' } = {}) => {
     await provider.start();
     await provider.stop();
 
+    if (fs.existsSync(testDir)) {
+      fs.rmSync(testDir, { recursive: true, force: true });
+    }
+
     return result;
   } catch (error) {
     if (process.env.DEBUG) {
@@ -1374,10 +1480,6 @@ NginxProvider.check = async ({ configDir = '' } = {}) => {
     result.error = error.message;
     logger.error('check nginx failed', { error });
     return result;
-  } finally {
-    if (fs.existsSync(testDir)) {
-      fs.rmSync(testDir, { recursive: true, force: true });
-    }
   }
 };
 

package/lib/nginx/util.js

@@ -209,6 +209,10 @@ real_ip_recursive ${proxyPolicy?.trustRecursive ? 'on' : 'off'};`
       default 0;
       include includes/blacklist;
     }
+    geo $access_trusted {
+      default 0;
+      include includes/whitelist;
+    }
     map $http_upgrade $connection_upgrade {
       default upgrade;
       '' "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abtnode/router-provider",
-  "version": "1.16.45-beta-20250620-082630-c0c76051",
+  "version": "1.16.45-beta-20250625-064956-91b0fb8f",
   "description": "Routing engine implementations for abt node",
   "author": "polunzh <polunzh@gmail.com>",
   "homepage": "https://github.com/ArcBlock/blocklet-server#readme",
@@ -32,11 +32,11 @@
     "url": "https://github.com/ArcBlock/blocklet-server/issues"
   },
   "dependencies": {
-    "@abtnode/constant": "1.16.45-beta-20250620-082630-c0c76051",
-    "@abtnode/db-cache": "1.16.45-beta-20250620-082630-c0c76051",
-    "@abtnode/logger": "1.16.45-beta-20250620-082630-c0c76051",
-    "@abtnode/router-templates": "1.16.45-beta-20250620-082630-c0c76051",
-    "@abtnode/util": "1.16.45-beta-20250620-082630-c0c76051",
+    "@abtnode/constant": "1.16.45-beta-20250625-064956-91b0fb8f",
+    "@abtnode/db-cache": "1.16.45-beta-20250625-064956-91b0fb8f",
+    "@abtnode/logger": "1.16.45-beta-20250625-064956-91b0fb8f",
+    "@abtnode/router-templates": "1.16.45-beta-20250625-064956-91b0fb8f",
+    "@abtnode/util": "1.16.45-beta-20250625-064956-91b0fb8f",
     "@arcblock/http-proxy": "^1.19.1",
     "@arcblock/is-valid-domain": "^1.0.5",
     "@ocap/util": "^1.20.14",
@@ -62,5 +62,5 @@
     "bluebird": "^3.7.2",
     "fs-extra": "^11.2.0"
   },
-  "gitHead": "70151f84be54392ce491a1f40976e533286d06b8"
+  "gitHead": "90b9c4c9352f9ae33139f4e376b97b3be43698fa"
 }