@xcanwin/manyoyo 8.4.0 → 8.5.0

package/lib/network-policy.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const net = require('net');
-const { isValidId } = require('./container-state');
+const { isValidId } = require('./container-id');
 
 // 容器网络策略：校验（唯一入口）+ 生成 nft 规则文本。
 // nft 文本只由校验过的结构化数据生成：IP/CIDR 经 net.isIP + 前缀整数、端口是 1-65535 的整数、域名不进规则
@@ -196,6 +196,7 @@ function cidrList(cidrs, family) {
  * @param {string[]} [endpoints.dns]
  * @param {{ip:string, ports:string, proto?:string}[]} [endpoints.allow] manyoyo 必需端点、上游代理、过滤代理、Playwright、镜像、host 端口、出站 peer
  * @param {{ip:string, ports:string, proto?:string}[]} [endpoints.peerIn] 允许进来的 peer
+ * @param {{daddr:string, saddr:string}[]} [endpoints.antiSpoof] 发往 daddr 的包来源必须是 saddr（过滤代理按来源 IP 认容器）
  * @param {{subnet:string, gateway:string}|null} [endpoints.bridge]
  * @returns {string} 整份 nft 脚本（先删后建，一次 nft -f 原子替换）；open 预设只删表
  */
@@ -204,6 +205,9 @@ function buildNftRuleset(policy, endpoints = {}) {
     if (policy.preset === 'open') return `${lines.join('\n')}\n`;
 
     const out = ['    oif lo accept', '    ct state established,related accept'];
+    (endpoints.antiSpoof || []).forEach(item => {
+        out.push(`    ${addrExpr('daddr', item.daddr, 'antiSpoof')} ${addrExpr('saddr', item.saddr, 'antiSpoof').replace(' saddr ', ' saddr != ')} drop`);
+    });
     // 用户 deny 排在所有放行规则之前，才能真正“禁止”
     if (policy.preset !== 'open') policy.deny.forEach(rule => out.push(`    ${addrExpr('daddr', rule.cidr, 'deny')} reject`));
     (endpoints.dns || []).forEach(ip => {

package/lib/port-forward.js

@@ -8,13 +8,15 @@ const { buildExecArgs } = require('./container-exec');
 // 运行中暴露容器端口：serve 在宿主机监听 bind:hostPort，每个连接起一个 `exec -i <容器> socat STDIO TCP:127.0.0.1:<端口>` 双向 pipe。
 // 不需要重启容器、不依赖容器的网络模式（slirp4netns / bridge / pasta 都一样）。
 const MAX_CONNECTIONS_PER_FORWARD = 64;
+// 连接空闲（双向都没有数据）超过这个时间就断开，socat 与 node 兜底一致
+const IDLE_SECONDS = 2 * 60 * 60;
 
 // 容器里优先 socat，没有就用 node 兜底；端口是校验过的整数
 function containerCommand(port) {
     const p = Number(port);
     if (!Number.isInteger(p) || p < 1 || p > 65535) throw new Error(`端口非法: ${port}`);
-    const nodeScript = `const s=require('net').connect(${p},'127.0.0.1');process.stdin.pipe(s);s.pipe(process.stdout);s.on('error',()=>process.exit(1));s.on('close',()=>process.exit(0))`;
-    return ['/bin/sh', '-c', `if command -v socat >/dev/null 2>&1; then exec socat STDIO TCP:127.0.0.1:${p}; else exec node -e "${nodeScript}"; fi`];
+    const nodeScript = `const s=require('net').connect(${p},'127.0.0.1');s.setTimeout(${IDLE_SECONDS}*1000,()=>process.exit(0));process.stdin.pipe(s);s.pipe(process.stdout);s.on('error',()=>process.exit(1));s.on('close',()=>process.exit(0))`;
+    return ['/bin/sh', '-c', `if command -v socat >/dev/null 2>&1; then exec socat -T ${IDLE_SECONDS} STDIO TCP:127.0.0.1:${p}; else exec node -e "${nodeScript}"; fi`];
 }
 
 function keyOf(id, bind, hostPort) {
@@ -132,4 +134,4 @@ function createPortForwarder(options) {
     return { open, close, closeFor, closeAll, list, sync };
 }
 
-module.exports = { createPortForwarder, containerCommand, MAX_CONNECTIONS_PER_FORWARD };
+module.exports = { createPortForwarder, containerCommand, MAX_CONNECTIONS_PER_FORWARD, IDLE_SECONDS };

package/lib/web/AGENTS.md

@@ -23,7 +23,7 @@
 
 ## 容器管理接口
 
-`lib/web/container-manage.js`（路由工厂，由 `handleWebApi` 追加进路由表）：`/api/containers/:name/{env,autostart,autostart/run,autostart/log,network,expose}` 与 `/api/containers/orphans`。旧容器（无 `manyoyo.id`）GET 返回 `{legacy:true}`、写返回 409。`PUT env` 用 `If-Match`（etag）防止覆盖容器内的修改；放开类改动（`open`、非 loopback 暴露）服务端也要求 `confirmRisk:true`。serve 运行时就绪后 `startContainerServices` 订阅 `<runtime> events`（start）补下发规则、拉起 `autostartOnServe` 容器、恢复端口暴露；过滤代理 `ensureWebEgressProxy` 懒启动。所有 exec 经 `spawnContainerExec`（env 临时文件在子进程 close 时删）。
+`lib/web/container-manage.js`（路由工厂，由 `handleWebApi` 追加进路由表）：`/api/containers/:name/{env,autostart,autostart/run,autostart/log,network,network/allow,network/denied,expose}` 与 `/api/containers/orphans`。旧容器（无 `manyoyo.id`）GET 返回 `{legacy:true}`、写返回 409。`PUT env` 用 `If-Match`（etag）防止覆盖容器内的修改；放开类改动（`open`、非 loopback 暴露）服务端也要求 `confirmRisk:true`。serve 运行时就绪后 `startContainerServices` 订阅 `<runtime> events`（start / die）补下发规则、拉起 `autostartOnServe` 容器、恢复端口暴露；事件流断开重连（运行时重启）后 `reconcileContainerServices` 再对账一次；过滤代理是 sidecar 容器（`lib/egress-sidecar.js`），由网络管理器 `ensure()` 保证在运行，不在 serve 进程里。`GET network` 带 `denied`（最近被拦截，已放行的不列）；`/agent/stream` 进行中 `createWebDeniedNotifier` 每 2 秒读一次拦截记录，有新域名就推一条 `trace`（只有 `text`，同一域名同一轮一次）。所有 exec 经 `spawnContainerExec`（env 临时文件在子进程 close 时删）。
 
 ## lib/web/index.html
 

package/lib/web/container-manage.js

@@ -7,6 +7,10 @@ const { resolveContainerId } = require('../container-exec');
 const { normalizePolicy } = require('../network-policy');
 const { parseEnvEntry } = require('../runtime-normalizers');
 const { envUrlDomains } = require('../network-endpoints');
+const { egressPaths } = require('../egress-sidecar');
+const deniedLib = require('../egress-denied');
+const { isBrowserBackground } = require('../browser-background');
+const { domainAllowed } = require('../network-policy');
 
 // 容器管理接口：环境变量、自启动、网络（含端口暴露）、孤儿状态目录。
 // 全部挂在全局认证网关之后；非只读请求由 handleWebApi 统一校验 X-Requested-With。
@@ -117,6 +121,17 @@ function createContainerManageRoutes({ ctx, state, req, res, deps }) {
         };
     }
 
+    // 最近被过滤代理拦截的域名（已在白名单里的不再列出）；background 标记浏览器自己的后台请求
+    function deniedPayload(id, policy) {
+        try {
+            return deniedLib.read(egressPaths(homeDir).denied, id)
+                .filter(record => !domainAllowed(policy.egress.domains, record.host))
+                .map(record => ({ ...record, background: isBrowserBackground(record.host) }));
+        } catch (e) {
+            return [];
+        }
+    }
+
     async function networkPayload(target, extra = {}) {
         const policy = readPolicy(target.id);
         const manager = getNetworkManager();
@@ -138,6 +153,7 @@ function createContainerManageRoutes({ ctx, state, req, res, deps }) {
             id: target.id,
             running: isRunning(target.name),
             suggestedDomains,
+            denied: deniedPayload(target.id, policy),
             policy,
             status: state_.readNetStatus(homeDir, target.id),
             forwards: getPortForwarder().list(target.id),
@@ -193,6 +209,21 @@ function createContainerManageRoutes({ ctx, state, req, res, deps }) {
         else sendJson(res, 200, payload);
     }
 
+    // 一键放行被拦截的域名：加进白名单并立即下发
+    async function postAllow(target, body) {
+        const domain = String(body.domain || '').trim().toLowerCase();
+        const policy = readPolicy(target.id);
+        if (policy.preset !== 'allowlist') {
+            sendJson(res, 400, { error: '只有「仅白名单」出站模式才需要放行域名' });
+            return;
+        }
+        if (!policy.egress.domains.includes(domain)) {
+            await putNetwork(target, { policy: { ...policy, egress: { ...policy.egress, domains: [...policy.egress.domains, domain] } }, confirmRisk: body.confirmRisk });
+            return;
+        }
+        sendJson(res, 200, await networkPayload(target));
+    }
+
     async function postExpose(target, body) {
         const policy = readPolicy(target.id);
         const entry = { bind: body.bind, hostPort: body.hostPort, port: body.port };
@@ -419,6 +450,31 @@ function createContainerManageRoutes({ ctx, state, req, res, deps }) {
                 }
             }
         },
+        {
+            method: 'POST',
+            match: p => p.match(/^\/api\/containers\/([^/]+)\/network\/allow$/),
+            handler: async match => {
+                const target = resolveTarget(match[1], { write: true });
+                if (!target) return;
+                const body = await readJsonBody(req);
+                try {
+                    await postAllow(target, body);
+                } catch (e) {
+                    if (res.headersSent) throw e;
+                    sendJson(res, 400, { error: e.message });
+                }
+            }
+        },
+        {
+            method: 'DELETE',
+            match: p => p.match(/^\/api\/containers\/([^/]+)\/network\/denied$/),
+            handler: async match => {
+                const target = resolveTarget(match[1], { write: true });
+                if (!target) return;
+                deniedLib.clear(egressPaths(homeDir).denied, target.id);
+                sendJson(res, 200, await networkPayload(target));
+            }
+        },
         {
             method: 'POST',
             match: p => p.match(/^\/api\/containers\/([^/]+)\/expose$/),

package/lib/web/denied-notify.js

@@ -0,0 +1,52 @@
+'use strict';
+
+// Agent 一轮对话进行中，容器里有新的域名被过滤代理拦下时，立即在对话里提示一次（同一域名同一轮只提示一次）。
+// 只轮询拦截记录文件（每 2 秒读一个小文件），不写任何日志。
+const DEFAULT_INTERVAL_MS = 2000;
+
+/**
+ * @param {object} options
+ * @param {() => {host: string, port: number, count: number}[]} options.read 当前拦截记录
+ * @param {(host: string) => boolean} options.isIgnored 不提示的域名（已放行、浏览器后台请求）
+ * @param {(text: string) => void} options.emit
+ */
+function createDeniedNotifier(options) {
+    const intervalMs = options.intervalMs || DEFAULT_INTERVAL_MS;
+    const baseline = new Map();
+    const notified = new Set();
+    let timer = null;
+
+    function snapshot() {
+        try { return options.read() || []; } catch (e) { return []; }
+    }
+
+    // 在定时器里跑：任何异常（含 emit 里写历史失败）都不能冒泡成 uncaughtException 把 serve 打挂
+    function tick() {
+        try {
+            snapshot().forEach(record => {
+                const key = `${record.host}:${record.port}`;
+                if (record.count > (baseline.get(key) || 0) && !notified.has(record.host) && !options.isIgnored(record.host)) {
+                    notified.add(record.host);
+                    options.emit(`[提示] 已拦截：${record.host}（不在白名单），可在「容器 → 网络」里一键允许`);
+                }
+                baseline.set(key, record.count);
+            });
+        } catch (e) { /* 下一轮再试 */ }
+    }
+
+    return {
+        start() {
+            snapshot().forEach(record => baseline.set(`${record.host}:${record.port}`, record.count));
+            timer = setInterval(tick, intervalMs);
+            if (timer.unref) timer.unref();
+        },
+        tick,
+        stop() {
+            if (timer) clearInterval(timer);
+            timer = null;
+            tick(); // 最后一次：对话结束前的拦截也提示
+        }
+    };
+}
+
+module.exports = { createDeniedNotifier };