@xcanwin/manyoyo 8.4.0 → 8.5.1

package/lib/container-network.js

@@ -11,6 +11,7 @@ const path = require('path');
 const state = require('./container-state');
 const { buildExecArgs } = require('./container-exec');
 const policyLib = require('./network-policy');
+const { createSidecarManager } = require('./egress-sidecar');
 
 // 容器网络：把策略翻译成 nft 规则，用一次性 helper 容器（--network container:<名> + NET_ADMIN）写进
 // 目标容器自己的 netns。Agent 没有 NET_ADMIN，改不掉；规则热更新，不重启。
@@ -113,7 +114,7 @@ function createNetworkManager(options) {
     const runtimeEnv = options.env ? { ...process.env, ...options.env } : process.env;
     const getImageRef = typeof options.imageRef === 'function' ? options.imageRef : () => options.imageRef;
     const getMirrorUrls = options.getMirrorUrls || (() => []);
-    const getFilterProxy = options.getFilterProxy || (() => null);
+    const getUpstream = options.getUpstream || (() => process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || '');
     const warn = options.warn || (() => {});
     const locks = new Map();
 
@@ -147,6 +148,9 @@ function createNetworkManager(options) {
         });
     }
 
+    // 域名白名单的过滤代理：manyoyo 网络里的 sidecar 容器，按来源 IP 认容器（见 egress-sidecar.js）
+    const sidecar = createSidecarManager({ run, command, homeDir, imageRef: getImageRef, networkName: NETWORK_NAME, ensureNetwork: ensureBridgeNetwork, getUpstream });
+
     // buildExecArgs 只需要同步 inspect 取 id；这里 withEnv:false 不会用到
     const execCtx = { homeDir, dockerExecArgs: () => '' };
 
@@ -252,14 +256,17 @@ function createNetworkManager(options) {
         for (const target of uniqueBy(proxyTargets, t => `${t.host}:${t.port}`)) {
             for (const ip of await resolveHostToIps(target.host)) allow.push({ ip, ports: String(target.port), proto: 'tcp' });
         }
-        // 过滤代理（serve 进程内）：allowlist 容器经它出网；宿主机 IP 取容器视角的 host.containers.internal
+        // 过滤代理（sidecar 容器）：allowlist 容器经它出网，只放行到它的 IP:端口；
+        // 容器发往它的包来源必须是自己的 IP（第二道保险：识别身份靠的就是来源 IP）
         let managedEnv = [];
+        const antiSpoof = [];
         if (policy.preset === 'allowlist' && policy.egress.domains.length) {
-            const filter = await getFilterProxy(self.id);
-            if (!filter || !filter.port) throw new Error('域名白名单需要 manyoyo serve 运行（过滤代理在 serve 进程里）');
-            if (!hostIps.length) throw new Error('容器里找不到宿主机地址（host.containers.internal / 网关），无法使用域名白名单');
-            addHost(filter.port, 'tcp');
-            const url = `http://${self.id}:${state.ensureEgressToken(homeDir, self.id)}@${hostIps[0]}:${filter.port}`;
+            const selfBridge = safeBridge(self.info);
+            if (!selfBridge) throw new Error('域名白名单需要容器在 manyoyo 网络里，这个容器的网络不支持');
+            const proxy = await sidecar.ensure();
+            allow.push({ ip: proxy.ip, ports: String(proxy.port), proto: 'tcp' });
+            antiSpoof.push({ daddr: proxy.ip, saddr: selfBridge.ip });
+            const url = `http://${proxy.ip}:${proxy.port}`;
             managedEnv = ['HTTP_PROXY', 'HTTPS_PROXY', 'http_proxy', 'https_proxy'].map(key => `${key}=${url}`);
         }
         playwrightHostPorts().forEach(port => addHost(port, 'tcp'));
@@ -285,6 +292,7 @@ function createNetworkManager(options) {
         }
         return {
             managedEnv,
+            antiSpoof,
             dns: dnsServers,
             allow: uniqueBy(allow, a => `${a.ip}|${a.ports}|${a.proto}`),
             peerIn,
@@ -296,6 +304,20 @@ function createNetworkManager(options) {
         try { return bridgeOf(info); } catch (e) { return null; }
     }
 
+    // 过滤代理的「来源 IP → 容器 id + 策略」：所有运行中、属于本 HOME、策略是 allowlist 的容器
+    function syncEgressClients(all) {
+        const clients = {};
+        for (const item of all) {
+            if (!item.running || !state.stateExists(homeDir, item.id)) continue;
+            let policy;
+            try { policy = loadPolicy(item.id); } catch (e) { continue; }
+            if (policy.preset !== 'allowlist') continue;
+            const bridge = safeBridge(item.info);
+            if (bridge) clients[bridge.ip] = { id: item.id, preset: policy.preset, domains: policy.egress.domains, rules: policy.egress.rules };
+        }
+        sidecar.writeClients(clients);
+    }
+
     async function sendRuleset(name, text) {
         await run([
             'run', '--rm', '-i',
@@ -348,6 +370,7 @@ function createNetworkManager(options) {
             const endpoints = await resolveEndpoints(self, policy, all);
             state.syncFilesEnv(homeDir, self.id); // 环境变量文件的最新快照（供自启动脚本用）
             state.writeManagedEnv(homeDir, self.id, endpoints.managedEnv);
+            syncEgressClients(all); // 先让代理认得这个容器，再放行门闩
             await sendRuleset(name, policyLib.buildNftRuleset(policy, endpoints));
             await execInContainer(name, ['/bin/sh', '-c', `mkdir -p ${path.posix.dirname(GATE_READY)} && : > ${GATE_READY}`]);
             const privileged = Boolean(self.info.HostConfig && self.info.HostConfig.Privileged);
@@ -403,7 +426,18 @@ function createNetworkManager(options) {
         const startedAt = String((info.State && info.State.StartedAt) || '');
         const sameRun = status && status.startedAt === startedAt;
         if (sameRun && status.status === 'unsupported') return { status: 'unsupported' };
-        if (policy && sameRun && status.status === 'applied' && status.policyHash === policyHashOf(policy)) return { status: 'applied' };
+        if (policy && sameRun && status.status === 'applied' && status.policyHash === policyHashOf(policy)) {
+            // 规则还在，但过滤代理可能意外退了（容器出网此时是失败即关闭）：顺手拉起，失败不拦 exec
+            if (policy.preset === 'allowlist' && policy.egress.domains.length) {
+                try {
+                    if (!await sidecar.isHealthy()) {
+                        await sidecar.ensure();
+                        syncEgressClients(await listManaged());
+                    }
+                } catch (e) { warn(`域名白名单代理恢复失败: ${e.message}`); }
+            }
+            return { status: 'applied' };
+        }
         return await apply(name, { expectId: id });
     }
 
@@ -433,11 +467,49 @@ function createNetworkManager(options) {
                 warn(`容器 ${item.name} 网络规则下发失败: ${e.message}`);
             }
         }
+        // 没有容器需要重新下发规则时，过滤代理也要在（运行时重启后它同样是停着的）
+        await healSidecar().catch(e => warn(`域名白名单代理恢复失败: ${e.message}`));
     }
 
     // 订阅容器 start 事件：容器被外部重启（podman restart、machine 重启后手动 start）后 netns 重建、规则丢失，
     // 事件到来就重新下发，并重算与它有 peers 关系的容器（它的 IP 可能变了）。
-    function watchStarts() {
+    async function needsSidecar(all) {
+        return all.some(item => {
+            if (!state.stateExists(homeDir, item.id)) return false;
+            try {
+                const policy = loadPolicy(item.id);
+                return policy.preset === 'allowlist' && policy.egress.domains.length > 0;
+            } catch (e) { return false; }
+        });
+    }
+
+    // 过滤代理容器自己退出 / 被删：有 allowlist 容器就拉起来，并重写映射
+    let lastHealAt = 0;
+    let healTimer = null;
+    async function healSidecar() {
+        // 起不来时（镜像坏了、权限问题）die 事件会反复触发：至少隔 10 秒才再试一次，不能形成忙等循环；
+        // 冷却期内的请求合并成冷却结束后的一次
+        const wait = 10000 - (Date.now() - lastHealAt);
+        if (wait > 0) {
+            if (!healTimer) {
+                healTimer = setTimeout(() => {
+                    healTimer = null;
+                    healSidecar().catch(e => warn(`域名白名单代理恢复失败: ${e.message}`));
+                }, wait + 50);
+                if (healTimer.unref) healTimer.unref();
+            }
+            return;
+        }
+        lastHealAt = Date.now();
+        const all = await listManaged();
+        if (!await needsSidecar(all)) return;
+        await sidecar.ensure();
+        syncEgressClients(all);
+    }
+
+    function watchStarts(watchOptions = {}) {
+        let attempts = 0;
+        let outageWarned = false;
         let stopped = false;
         let child = null;
         let delay = 1000;
@@ -451,7 +523,12 @@ function createNetworkManager(options) {
             timers.set(key, setTimeout(async () => {
                 timers.delete(key);
                 try {
+                    if (name === sidecar.name) {
+                        await healSidecar();
+                        return;
+                    }
                     if (status === 'start') await apply(name);
+                    if (status === 'die') syncEgressClients(await listManaged()); // 回收的 IP 不能再被认成它
                     for (const related of await relatedContainers(name, { includeStopped: status === 'die' })) {
                         await apply(related).catch(e => warn(`容器 ${related} 网络规则重算失败: ${e.message}`));
                     }
@@ -467,7 +544,9 @@ function createNetworkManager(options) {
             const attrs = event.Attributes || (event.Actor && event.Actor.Attributes) || {};
             const name = event.Name || attrs.name;
             const status = event.Status || event.status || event.Action;
-            if ((status !== 'start' && status !== 'die') || !name || !state.isValidId(attrs['manyoyo.id'])) return null;
+            if ((status !== 'start' && status !== 'die') || !name) return null;
+            if (name === sidecar.name && attrs['manyoyo.role'] === 'egress') return { name, status };
+            if (!state.isValidId(attrs['manyoyo.id'])) return null;
             return { name, status };
         };
 
@@ -499,7 +578,17 @@ function createNetworkManager(options) {
             };
             child.on('error', again);
             child.on('close', again);
-            reconcileAll().catch(e => warn(`网络规则对账失败: ${e.message}`));
+            // 第二次起的连接 = 事件流断过，运行时可能重启过（machine 重启、服务重置）：除了补下发规则，
+            // 还要让调用方把该拉起的容器拉起来。运行时还没恢复时对账会失败，每次断线只警告一次
+            attempts += 1;
+            const reconnected = attempts > 1;
+            reconcileAll()
+                .then(() => (reconnected && watchOptions.onReconnect ? watchOptions.onReconnect() : null))
+                .then(() => { outageWarned = false; })
+                .catch(e => {
+                    if (!outageWarned) warn(`网络规则对账失败: ${e.message}`);
+                    outageWarned = true;
+                });
         };
         connect();
         return {
@@ -512,7 +601,7 @@ function createNetworkManager(options) {
         };
     }
 
-    return { NETWORK_NAME, run, listManaged, loadPolicy, ensureBridgeNetwork, apply, ensureReady, relatedContainers, resolveEndpoints, reconcileAll, watchStarts };
+    return { NETWORK_NAME, sidecar, run, listManaged, loadPolicy, ensureBridgeNetwork, apply, ensureReady, relatedContainers, resolveEndpoints, reconcileAll, watchStarts };
 }
 
 module.exports = {

package/lib/container-run.js

@@ -26,6 +26,9 @@ function buildContainerRunArgs(options) {
         'run', '-d',
         '--name', options.containerName,
         '--entrypoint', `${SYS_MOUNT}/init.sh`,
+        // docker 默认带 NET_RAW（podman 默认不带）：有它的容器能发原始包 / 伪造 ARP，冒充别的容器的来源 IP，
+        // 域名白名单的过滤代理就是按来源 IP 认容器的，所以统一去掉
+        '--cap-drop', 'NET_RAW',
         ...(options.contModeArgs || []),
         ...(options.containerExtraArgs || []),
         ...(options.defaultNetwork && !hasNetworkArg([...(options.contModeArgs || []), ...(options.containerExtraArgs || [])])

package/lib/container-state.js

@@ -9,17 +9,14 @@ const { parseEnvEntry } = require('./runtime-normalizers');
 
 // 每个容器一个状态目录，按随机 manyoyo.id 索引（不按容器名：删了重建同名容器不会继承旧文件）
 //   box/  读写挂到 /run/manyoyo/        env、autostart.sh、autostart.log（容器可写）
-//   sys/  只读挂到 /run/manyoyo-sys/    init.sh、managed.env、net-required
+//   sys/  只读挂到 /run/manyoyo-sys/    init.sh、env.sh、managed.env、net-required
 //   network.json / meta.json            不挂进容器
-const ID_RE = /^[0-9a-f]{16}$/;
 const { ENV_KEY_RE, parseEnvText, serializeEnvEntries, formatEnvValue } = require('./env-text');
 const MAX_ENV_BYTES = 256 * 1024;
 const MAX_AUTOSTART_BYTES = 256 * 1024;
 const INIT_TEMPLATE = path.join(__dirname, 'container-init.sh');
-
-function isValidId(id) {
-    return typeof id === 'string' && ID_RE.test(id);
-}
+const ENV_TEMPLATE = path.join(__dirname, 'container-env.sh');
+const { ID_RE, isValidId } = require('./container-id');
 
 function newId() {
     return crypto.randomBytes(8).toString('hex');
@@ -44,13 +41,13 @@ function paths(homeDir, id) {
         autostart: path.join(dir, 'box', 'autostart.sh'),
         autostartLog: path.join(dir, 'box', 'autostart.log'),
         init: path.join(dir, 'sys', 'init.sh'),
+        envLoader: path.join(dir, 'sys', 'env.sh'),
         netRequired: path.join(dir, 'sys', 'net-required'),
         managedEnv: path.join(dir, 'sys', 'managed.env'),
         filesEnv: path.join(dir, 'sys', 'files.env'),
         envFiles: path.join(dir, 'env-files.json'),
         network: path.join(dir, 'network.json'),
         netStatus: path.join(dir, 'net-status.json'),
-        egressToken: path.join(dir, 'egress-token'),
         meta: path.join(dir, 'meta.json')
     };
 }
@@ -189,6 +186,7 @@ function createState(options) {
 function refreshInit(homeDir, id) {
     const p = paths(homeDir, id);
     ensureDir(p.sys, 0o700);
+    writeFileAtomic(p.envLoader, fs.readFileSync(ENV_TEMPLATE, 'utf-8'), 0o644);
     writeFileAtomic(p.init, fs.readFileSync(INIT_TEMPLATE, 'utf-8'), 0o755);
 }
 
@@ -400,23 +398,6 @@ function writeNetStatus(homeDir, id, status) {
     writeFileAtomic(paths(homeDir, id).netStatus, `${JSON.stringify(status)}\n`);
 }
 
-// 过滤代理的容器凭据：256 bit 随机，只存宿主机侧（不挂进容器，容器从自己的 managed.env 拿到带凭据的代理地址）
-function readEgressToken(homeDir, id) {
-    try {
-        return fs.readFileSync(paths(homeDir, id).egressToken, 'utf-8').trim() || null;
-    } catch (e) {
-        return null;
-    }
-}
-
-function ensureEgressToken(homeDir, id) {
-    const existing = readEgressToken(homeDir, id);
-    if (existing) return existing;
-    const token = crypto.randomBytes(32).toString('hex');
-    writeFileAtomic(paths(homeDir, id).egressToken, `${token}\n`);
-    return token;
-}
-
 function removeState(homeDir, id) {
     if (!isValidId(id)) return false;
     fs.rmSync(stateDir(homeDir, id), { recursive: true, force: true });
@@ -480,8 +461,6 @@ module.exports = {
     writeNetworkRaw,
     readNetStatus,
     writeNetStatus,
-    readEgressToken,
-    ensureEgressToken,
     removeState,
     listStateIds,
     findOrphans

package/lib/egress-denied.js

@@ -0,0 +1,128 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { isValidId } = require('./container-id');
+
+// 过滤代理拒绝过的访问记录：每个容器一个 <id>.jsonl，同一 host:port 合并计数。
+// sidecar 里写（目录以读写方式挂入）、宿主机读 / 清空。文件超过 256 KiB 就丢最久没出现的。
+// 只依赖 node 内置模块：sidecar 里带的就是这个文件。
+const MAX_BYTES = 256 * 1024;
+const MAX_RECORDS = 1000;
+const FLUSH_MS = 1000;
+const MAX_PENDING_PER_ID = 500; // 一次合并周期内最多攒这么多不同的 host:port，防止被刷爆内存
+const MAX_HOST_LENGTH = 255;
+
+function fileOf(dir, id) {
+    if (!isValidId(id)) throw new Error(`非法的容器 id: ${id}`);
+    return path.join(dir, `${id}.jsonl`);
+}
+
+function parse(text) {
+    const records = [];
+    String(text || '').split('\n').forEach(line => {
+        if (!line.trim()) return;
+        try {
+            const r = JSON.parse(line);
+            if (typeof r.host === 'string' && Number.isInteger(r.port) && Number.isInteger(r.count)) {
+                records.push({ host: r.host, port: r.port, reason: String(r.reason || ''), count: r.count, first: String(r.first || ''), last: String(r.last || '') });
+            }
+        } catch (e) { /* 损坏的行跳过 */ }
+    });
+    return records;
+}
+
+function readFileSafe(file) {
+    try {
+        const stat = fs.statSync(file);
+        if (!stat.isFile() || stat.size > MAX_BYTES * 2) return '';
+        return fs.readFileSync(file, 'utf-8');
+    } catch (e) {
+        return '';
+    }
+}
+
+/** 宿主机：按最近出现时间倒序返回 [{host, port, reason, count, first, last}] */
+function read(dir, id) {
+    return parse(readFileSafe(fileOf(dir, id))).sort((a, b) => (a.last < b.last ? 1 : a.last > b.last ? -1 : 0));
+}
+
+/** 宿主机：清空（删文件；目录是宿主机用户的，sidecar 以 root 写出的文件也删得掉） */
+function clear(dir, id) {
+    try { fs.unlinkSync(fileOf(dir, id)); } catch (e) { if (e.code !== 'ENOENT') throw e; }
+}
+
+function serialize(records) {
+    const sorted = records.slice().sort((a, b) => (a.last < b.last ? 1 : a.last > b.last ? -1 : 0)).slice(0, MAX_RECORDS);
+    let text = '';
+    const kept = [];
+    for (const r of sorted) {
+        const line = `${JSON.stringify(r)}\n`;
+        if (text.length + line.length > MAX_BYTES) break;
+        text += line;
+        kept.push(r);
+    }
+    return text;
+}
+
+/**
+ * sidecar：记录拒绝。内存里只攒“还没写盘的增量”，每秒合并进文件一次（高频路径不逐条写盘）；
+ * 合并时总是以磁盘上的当前内容为底，所以宿主机清空（删文件）后会从空白重新计数。
+ */
+function createRecorder(options) {
+    const dir = options.dir;
+    const now = options.now || (() => new Date().toISOString());
+    const pending = new Map(); // id → Map(host:port → record 增量)
+    let timer = null;
+
+    function record({ id, host, port, reason }) {
+        if (!isValidId(id) || !host || host.length > MAX_HOST_LENGTH || !Number.isInteger(port)) return;
+        const byKey = pending.get(id) || new Map();
+        pending.set(id, byKey);
+        const key = `${host}:${port}`;
+        if (!byKey.has(key) && byKey.size >= MAX_PENDING_PER_ID) return;
+        const at = now();
+        const hit = byKey.get(key);
+        if (hit) {
+            hit.count += 1;
+            hit.last = at;
+            hit.reason = reason;
+        } else {
+            byKey.set(key, { host, port, reason, count: 1, first: at, last: at });
+        }
+        if (!timer) {
+            timer = setTimeout(() => { timer = null; flush(); }, FLUSH_MS);
+            if (timer.unref) timer.unref();
+        }
+    }
+
+    function flush() {
+        const batch = [...pending.entries()];
+        pending.clear();
+        for (const [id, byKey] of batch) {
+            try {
+                const file = fileOf(dir, id);
+                const merged = new Map(parse(readFileSafe(file)).map(r => [`${r.host}:${r.port}`, r]));
+                byKey.forEach((delta, key) => {
+                    const old = merged.get(key);
+                    merged.set(key, old
+                        ? { ...old, reason: delta.reason, count: old.count + delta.count, last: delta.last }
+                        : delta);
+                });
+                const tmp = `${file}.tmp`;
+                fs.writeFileSync(tmp, serialize([...merged.values()]), { mode: 0o644 });
+                fs.renameSync(tmp, file);
+            } catch (e) { /* 写不进去不影响代理本身 */ }
+        }
+    }
+
+    function stop() {
+        if (timer) clearTimeout(timer);
+        timer = null;
+        flush();
+    }
+
+    return { record, flush, stop };
+}
+
+module.exports = { MAX_BYTES, MAX_RECORDS, MAX_PENDING_PER_ID, read, clear, parse, serialize, createRecorder };

package/lib/egress-proxy.js

@@ -1,17 +1,16 @@
 'use strict';
 
-const crypto = require('crypto');
 const dns = require('dns').promises;
 const http = require('http');
 const net = require('net');
 const { domainAllowed, PRIVATE_V4, PRIVATE_V6 } = require('./network-policy');
-const { isValidId } = require('./container-state');
 
-// 域名白名单的强制执行点：serve 进程内的 HTTP(S) 过滤代理。
-// 开启 allowlist 的容器防火墙只放行到这个代理，直连被挡；这里按域名放行 CONNECT / 普通 HTTP，
+// 域名白名单的强制执行点：运行在 manyoyo 网络里专用 sidecar 容器中的 HTTP(S) 过滤代理（见 egress-sidecar.js）。
+// 开启 allowlist 的容器防火墙只放行到这个代理，直连被挡；这里按连接的来源 IP 认出是哪个容器（getClient），
+// 认不出的来源一律 403；按域名放行 CONNECT / 普通 HTTP，
 // 并且解析出的 IP 属于私有 / 环回 / 链路本地段一律拒绝（防借代理打宿主机 loopback 与 DNS 重绑定），
-// 除非该容器的 egress.rules 显式放行该 IP:端口。监听 0.0.0.0（容器只能经宿主机 LAN IP 访问宿主机），靠凭据挡局域网。
-const REALM = 'manyoyo';
+// 除非该容器的 egress.rules 显式放行该 IP:端口。
+// 被拒绝时统一回 403（带 Proxy-Status，不带任何能暴露代理身份的内容），并通过 onDenied 记录。
 const CONNECT_TIMEOUT_MS = 15000;
 const IDLE_TIMEOUT_MS = 10 * 60 * 1000;
 const MAX_TUNNELS_PER_CONTAINER = 256;
@@ -65,21 +64,6 @@ function ruleCovers(rule, ip, port) {
     return list.check(ip, family === 4 ? 'ipv4' : 'ipv6');
 }
 
-function parseBasicAuth(header) {
-    const m = /^Basic\s+([A-Za-z0-9+/=]+)$/.exec(String(header || '').trim());
-    if (!m) return null;
-    const decoded = Buffer.from(m[1], 'base64').toString('utf-8');
-    const i = decoded.indexOf(':');
-    if (i < 0) return null;
-    return { id: decoded.slice(0, i), token: decoded.slice(i + 1) };
-}
-
-function tokenEquals(a, b) {
-    const x = Buffer.from(String(a));
-    const y = Buffer.from(String(b));
-    return x.length === y.length && crypto.timingSafeEqual(x, y);
-}
-
 function parseTarget(text) {
     const m = /^(?:\[([0-9a-fA-F:.]+)\]|([^:/\s]+)):(\d{1,5})$/.exec(text);
     if (!m) return null;
@@ -90,40 +74,53 @@ function parseTarget(text) {
 
 /**
  * @param {object} options
- * @param {(id: string) => string|null} options.getToken 容器的代理 token（没有返回 null）
- * @param {(id: string) => {preset: string, domains: string[], rules: object[]}|null} options.getPolicy
+ * @param {(ip: string) => {id: string, preset: string, domains: string[], rules: object[]}|null} options.getClient 按来源 IP 认容器（认不出返回 null）
+ * @param {(event: {id: string, host: string, port: number, reason: string}) => void} [options.onDenied] 拒绝记录
  * @param {string} [options.upstream] 上游 HTTP 代理 URL（串联）
  * @param {(host: string) => Promise<string[]>} [options.lookup] 测试替身
  */
 function createEgressProxy(options) {
-    const getToken = options.getToken;
-    const getPolicy = options.getPolicy;
+    const getClient = options.getClient;
+    const onDenied = options.onDenied || (() => {});
     const lookup = options.lookup || (async host => (await dns.lookup(host, { all: true })).map(r => r.address));
-    let upstream = null;
-    if (options.upstream) {
-        try {
-            const url = new URL(options.upstream);
-            if (url.protocol === 'http:') {
-                upstream = { host: url.hostname.replace(/^\[|\]$/g, ''), port: Number(url.port) || 80, auth: url.username ? `Basic ${Buffer.from(`${decodeURIComponent(url.username)}:${decodeURIComponent(url.password)}`).toString('base64')}` : '' };
+    // upstream 可以是字符串或返回字符串的函数（sidecar 里按文件改动热更新）；解析结果按字符串缓存
+    let parsedFor = null;
+    let parsedUpstream = null;
+    function currentUpstream() {
+        const text = typeof options.upstream === 'function' ? options.upstream() : options.upstream;
+        if (text !== parsedFor) {
+            parsedFor = text;
+            parsedUpstream = null;
+            if (text) {
+                try {
+                    const url = new URL(text);
+                    if (url.protocol === 'http:') {
+                        parsedUpstream = { host: url.hostname.replace(/^\[|\]$/g, ''), port: Number(url.port) || 80, auth: url.username ? `Basic ${Buffer.from(`${decodeURIComponent(url.username)}:${decodeURIComponent(url.password)}`).toString('base64')}` : '' };
+                    }
+                } catch (e) { /* 无效上游当作没有 */ }
             }
-        } catch (e) { /* 无效上游当作没有 */ }
+        }
+        return parsedUpstream;
     }
     const tunnels = new Map();
     const sockets = new Set(); // CONNECT 劫持出来的 socket 不在 http.Server 的跟踪里，stop 时要自己关
     let server = null;
 
-    function authenticate(req) {
-        const cred = parseBasicAuth(req.headers['proxy-authorization']);
-        if (!cred || !isValidId(cred.id)) return null;
-        const token = getToken(cred.id);
-        if (!token || !tokenEquals(token, cred.token)) return null;
-        return cred.id;
+    function normalizeSource(address) {
+        const text = String(address || '');
+        return /^::ffff:\d+\.\d+\.\d+\.\d+$/i.test(text) ? text.slice(7) : text;
+    }
+
+    // 按来源 IP 认容器：返回 {id, policy}，认不出返回 null
+    function identify(socket) {
+        let client = null;
+        try { client = getClient(normalizeSource(socket.remoteAddress)); } catch (e) { client = null; }
+        return client && client.id ? { id: client.id, policy: client } : null;
     }
 
     // 返回 {ok:true, ip?} 或 {ok:false, status, message}
-    async function authorize(id, host, port) {
-        const policy = getPolicy(id);
-        if (!policy || policy.preset !== 'allowlist') return { ok: false, status: 403, message: 'policy' };
+    async function authorize(policy, host, port, upstream) {
+        if (!policy || policy.preset !== 'allowlist') return { ok: false, status: 403, message: 'domain' };
         const isIp = net.isIP(host) !== 0;
         const explicit = (ip, p) => (policy.rules || []).some(rule => ruleCovers(rule, ip, p));
         if (isIp) {
@@ -153,11 +150,21 @@ function createEgressProxy(options) {
         return { ok: true, ip: usable[0] };
     }
 
+    // Proxy-Status（RFC 9209）只带通用错误类型；拒绝一律 403，正文只有 Forbidden
+    function statusHeader(message) {
+        return message === 'address' ? 'proxy; error=destination_ip_prohibited' : 'proxy; error=http_request_denied';
+    }
+
     function reject(res, status, message) {
-        const headers = { 'Content-Type': 'text/plain; charset=utf-8', Connection: 'close' };
-        if (status === 407) headers['Proxy-Authenticate'] = `Basic realm="${REALM}"`;
+        const body = { 400: 'Bad Request', 403: 'Forbidden', 429: 'Too Many Requests' }[status] || 'Bad Gateway';
+        const headers = { 'Content-Type': 'text/plain; charset=utf-8', 'Content-Length': Buffer.byteLength(body), Connection: 'close' };
+        if (status === 403) headers['Proxy-Status'] = statusHeader(message);
         res.writeHead(status, headers);
-        res.end(`manyoyo egress proxy: ${message}\n`);
+        res.end(body);
+    }
+
+    function deny(client, host, port, reason) {
+        try { onDenied({ id: client ? client.id : '', host, port, reason }); } catch (e) { /* 记录失败不影响拒绝 */ }
     }
 
     function acquire(id) {
@@ -172,8 +179,8 @@ function createEgressProxy(options) {
         if (n <= 0) tunnels.delete(id); else tunnels.set(id, n);
     }
 
-    function rawReject(socket, status, text) {
-        const extra = status === 407 ? `Proxy-Authenticate: Basic realm="${REALM}"\r\n` : '';
+    function rawReject(socket, status, text, message) {
+        const extra = status === 403 ? `Proxy-Status: ${statusHeader(message)}\r\n` : '';
         socket.end(`HTTP/1.1 ${status} ${text}\r\n${extra}Connection: close\r\nContent-Length: 0\r\n\r\n`);
     }
 
@@ -186,12 +193,17 @@ function createEgressProxy(options) {
     async function onConnect(req, clientSocket, head) {
         track(clientSocket);
         clientSocket.on('error', () => {});
-        const id = authenticate(req);
-        if (!id) return rawReject(clientSocket, 407, 'Proxy Authentication Required');
+        const client = identify(clientSocket);
         const target = parseTarget(String(req.url || ''));
+        if (!client) return rawReject(clientSocket, 403, 'Forbidden', 'domain');
         if (!target) return rawReject(clientSocket, 400, 'Bad Request');
-        const verdict = await authorize(id, target.host, target.port);
-        if (!verdict.ok) return rawReject(clientSocket, verdict.status, verdict.status === 403 ? 'Forbidden' : 'Bad Gateway');
+        const id = client.id;
+        const upstream = currentUpstream();
+        const verdict = await authorize(client.policy, target.host, target.port, upstream);
+        if (!verdict.ok) {
+            if (verdict.status === 403) deny(client, target.host, target.port, verdict.message);
+            return rawReject(clientSocket, verdict.status, verdict.status === 403 ? 'Forbidden' : 'Bad Gateway', verdict.message);
+        }
         if (!acquire(id)) return rawReject(clientSocket, 429, 'Too Many Requests');
         let released = false;
         const done = () => { if (!released) { released = true; release(id); } };
@@ -239,17 +251,22 @@ function createEgressProxy(options) {
 
     // 普通 HTTP 代理（绝对 URI 请求）
     async function onRequest(req, res) {
-        const id = authenticate(req);
-        if (!id) return reject(res, 407, 'proxy authentication required');
+        const client = identify(req.socket);
+        if (!client) return reject(res, 403, 'domain');
+        const id = client.id;
         let url;
-        try { url = new URL(req.url); } catch (e) { return reject(res, 400, 'absolute URI required'); }
-        if (url.protocol !== 'http:') return reject(res, 400, 'only http: URIs');
+        try { url = new URL(req.url); } catch (e) { return reject(res, 400, 'bad request'); }
+        if (url.protocol !== 'http:') return reject(res, 400, 'bad request');
         const port = Number(url.port) || 80;
         const host = url.hostname.replace(/^\[|\]$/g, '').toLowerCase().replace(/\.$/, '');
-        const verdict = await authorize(id, host, port);
-        if (!verdict.ok) return reject(res, verdict.status, verdict.status === 403 ? 'forbidden by policy' : 'bad gateway');
-        if (!acquire(id)) return reject(res, 429, 'too many connections');
-        const headers = { ...req.headers };
+        const upstream = currentUpstream();
+        const verdict = await authorize(client.policy, host, port, upstream);
+        if (!verdict.ok) {
+            if (verdict.status === 403) deny(client, host, port, verdict.message);
+            return reject(res, verdict.status, verdict.message);
+        }
+        if (!acquire(id)) return reject(res, 429, 'limit');
+        const headers = { ...req.headers, host: url.host }; // 放行判断看的是 URL 里的主机，Host 头必须与它一致（RFC 9112）
         delete headers['proxy-authorization'];
         delete headers['proxy-connection'];
         const outbound = upstream
@@ -263,14 +280,14 @@ function createEgressProxy(options) {
             proxyRes.pipe(res);
         });
         proxyReq.on('timeout', () => proxyReq.destroy());
-        proxyReq.on('error', () => { if (!res.headersSent) reject(res, 502, 'bad gateway'); else res.destroy(); });
+        proxyReq.on('error', () => { if (!res.headersSent) reject(res, 502, 'upstream'); else res.destroy(); });
         res.on('close', () => { done(); proxyReq.destroy(); });
         req.pipe(proxyReq);
     }
 
     function start(listen) {
         return new Promise((resolve, fail) => {
-            server = http.createServer((req, res) => { onRequest(req, res).catch(() => { try { reject(res, 500, 'error'); } catch (e) { /* 连接已断 */ } }); });
+            server = http.createServer((req, res) => { onRequest(req, res).catch(() => { try { reject(res, 500, 'upstream'); } catch (e) { /* 连接已断 */ } }); });
             server.on('connect', (req, socket, head) => { onConnect(req, socket, head).catch(() => socket.destroy()); });
             server.headersTimeout = 20000;
             server.on('clientError', (err, socket) => socket.destroy());
@@ -295,4 +312,4 @@ function createEgressProxy(options) {
     return { start, stop, authorize, isListening: () => Boolean(server && server.listening) };
 }
 
-module.exports = { createEgressProxy, isRestrictedAddress, ruleCovers, parseBasicAuth, parseTarget, REALM };
+module.exports = { createEgressProxy, isRestrictedAddress, ruleCovers, parseTarget };