@xcanwin/manyoyo 8.5.0 → 8.6.0

package/lib/web/container-manage.js

@@ -4,13 +4,12 @@ const os = require('os');
 const net = require('net');
 const state_ = require('../container-state');
 const { resolveContainerId } = require('../container-exec');
-const { normalizePolicy } = require('../network-policy');
+const { normalizePolicy, resolveContainerRefs, isUnrestricted, domainRuleAllows, targetKind } = require('../network-policy');
 const { parseEnvEntry } = require('../runtime-normalizers');
 const { envUrlDomains } = require('../network-endpoints');
 const { egressPaths } = require('../egress-sidecar');
 const deniedLib = require('../egress-denied');
 const { isBrowserBackground } = require('../browser-background');
-const { domainAllowed } = require('../network-policy');
 
 // 容器管理接口：环境变量、自启动、网络（含端口暴露）、孤儿状态目录。
 // 全部挂在全局认证网关之后；非只读请求由 handleWebApi 统一校验 X-Requested-With。
@@ -20,33 +19,52 @@ function isLoopbackBind(bind) {
     return bind === '127.0.0.1' || bind === '::1';
 }
 
-// 把 `wide` 当作放开限制：整个 /8 以上的网段（含 0.0.0.0/0）、公共后缀通配（*.co.uk 之类），效果接近 open
+// `wide`：新增的“允许”规则范围极宽，效果接近不设限：任何地址 / 内网 / 元数据、其他容器（入站）、宿主机全部端口、
+// /8 以上的网段（含 0.0.0.0/0）、公共后缀通配（*.co.uk 之类）
 const PUBLIC_SUFFIX_WILDCARD_RE = /^\*\.(co|com|net|org|gov|edu|ac|or|ne|go)\.[a-z]{2}$/;
+const WIDE_OUTBOUND_VARS = ['@any', '@private', '@metadata'];
+const WIDE_INBOUND_VARS = ['@any', '@containers'];
 
-function isWideRule(cidr) {
+function isWideCidr(cidr) {
     const m = /\/(\d+)$/.exec(cidr);
     const prefix = m ? Number(m[1]) : 32;
     return cidr.includes(':') ? prefix <= 16 : prefix <= 8;
 }
 
+function isWideRule(rule, direction) {
+    const target = direction === 'inbound' ? rule.source : rule.target;
+    if (rule.action !== 'allow' || !rule.enabled) return false;
+    const kind = targetKind(target);
+    if (kind === 'var') return (direction === 'inbound' ? WIDE_INBOUND_VARS : WIDE_OUTBOUND_VARS).includes(target) || (direction !== 'inbound' && target === '@host' && !rule.ports);
+    if (kind === 'cidr') return isWideCidr(target);
+    return PUBLIC_SUFFIX_WILDCARD_RE.test(target);
+}
+
 function wideKeys(policy) {
+    const key = (rule, direction) => `${direction}:${rule.action}|${direction === 'inbound' ? rule.source : rule.target}|${rule.ports}|${rule.proto}`;
     return [
-        ...policy.egress.rules.filter(rule => isWideRule(rule.cidr)).map(rule => `rule:${rule.cidr}|${rule.ports}|${rule.proto}`),
-        ...policy.egress.domains.filter(domain => PUBLIC_SUFFIX_WILDCARD_RE.test(domain)).map(domain => `domain:${domain}`)
+        ...policy.outbound.filter(rule => isWideRule(rule, 'outbound')).map(rule => key(rule, 'outbound')),
+        ...policy.inbound.filter(rule => isWideRule(rule, 'inbound')).map(rule => key(rule, 'inbound'))
     ];
 }
 
-// 需要二次确认的风险：切到 open（等于不加规则）、新增非 loopback 的端口暴露、新增范围极宽的出站规则
+// 需要二次确认的风险：切到自定义、新增非 loopback 的端口暴露、新增范围极宽的允许规则（自定义里本来就不设限，不再逐条问）
 function pendingRisks(before, after) {
     const risks = [];
-    if (after.preset === 'open' && before.preset !== 'open') risks.push('open');
+    if (after.preset === 'custom' && before.preset !== 'custom') risks.push('custom');
     const hadWide = new Set(wideKeys(before));
-    if (after.preset !== 'open' && wideKeys(after).some(key => !hadWide.has(key))) risks.push('wide');
+    if (after.preset !== 'custom' && wideKeys(after).some(key => !hadWide.has(key))) risks.push('wide');
     const had = new Set(before.expose.filter(e => !isLoopbackBind(e.bind)).map(e => `${e.bind}:${e.hostPort}`));
     if (after.expose.some(e => !isLoopbackBind(e.bind) && !had.has(`${e.bind}:${e.hostPort}`))) risks.push('publicBind');
     return risks;
 }
 
+function peerIp(info) {
+    const networks = (info && info.NetworkSettings && info.NetworkSettings.Networks) || {};
+    const pick = networks.manyoyo || Object.values(networks).find(n => n && n.IPAddress);
+    return (pick && pick.IPAddress) || '';
+}
+
 function parseTail(value, fallback = 16 * 1024) {
     const n = Number(value);
     if (!Number.isInteger(n) || n < 1) return fallback;
@@ -79,6 +97,16 @@ function createContainerManageRoutes({ ctx, state, req, res, deps }) {
         return { name, id };
     }
 
+    // 名称 → 受管容器 id（只认运行时里真实存在的）
+    async function containerIdLookup() {
+        try {
+            const byName = new Map((await getNetworkManager().listManaged()).map(item => [item.name, item.id]));
+            return name => byName.get(name) || '';
+        } catch (e) {
+            return () => '';
+        }
+    }
+
     function readPolicy(id) {
         return normalizePolicy(state_.readNetworkRaw(homeDir, id) || undefined);
     }
@@ -125,7 +153,7 @@ function createContainerManageRoutes({ ctx, state, req, res, deps }) {
     function deniedPayload(id, policy) {
         try {
             return deniedLib.read(egressPaths(homeDir).denied, id)
-                .filter(record => !domainAllowed(policy.egress.domains, record.host))
+                .filter(record => !domainRuleAllows(policy, record.host))
                 .map(record => ({ ...record, background: isBrowserBackground(record.host) }));
         } catch (e) {
             return [];
@@ -137,17 +165,23 @@ function createContainerManageRoutes({ ctx, state, req, res, deps }) {
         const manager = getNetworkManager();
         let peers = [];
         try {
-            peers = (await manager.listManaged()).filter(item => item.id !== target.id).map(item => ({ id: item.id, name: item.name, running: item.running }));
+            peers = (await manager.listManaged()).filter(item => item.id !== target.id).map(item => ({ id: item.id, name: item.name, running: item.running, ip: (item.running && peerIp(item.info)) || '' }));
         } catch (e) {
             peers = [];
         }
+        let derived = [];
+        try {
+            derived = typeof manager.derivedOf === 'function' ? await manager.derivedOf(target.name) : [];
+        } catch (e) {
+            derived = [];
+        }
         // 建议放行的域名：来自当前环境变量（含容器里改过的）里的 URL。只是建议，要用户自己点才会加进策略
         // （容器可写的 env 不能直接决定防火墙）
         const envLines = [
             ...state_.readEnv(homeDir, target.id).entries.map(entry => `${entry.key}=${entry.value}`),
             ...state_.envFileEntries(homeDir, target.id).map(entry => `${entry.key}=${entry.value}`)
         ];
-        const suggestedDomains = envUrlDomains(envLines).filter(domain => !policy.egress.domains.includes(domain));
+        const suggestedDomains = envUrlDomains(envLines).filter(domain => !domainRuleAllows(policy, domain));
         return {
             legacy: false,
             id: target.id,
@@ -158,20 +192,24 @@ function createContainerManageRoutes({ ctx, state, req, res, deps }) {
             status: state_.readNetStatus(homeDir, target.id),
             forwards: getPortForwarder().list(target.id),
             peers,
+            derived,
+            unrestricted: isUnrestricted(policy),
             ...extra
         };
     }
 
     // 保存策略后：下发规则（容器在运行时）、同步端口转发、重算有 peers 关系的容器
-    async function applyPolicy(target, policy) {
+    async function applyPolicy(target, policy, relatedBefore = []) {
         const out = { applyError: '', forwardFailures: [] };
         const running = isRunning(target.name);
         if (running) {
             const manager = getNetworkManager();
             try {
                 await manager.apply(target.name, { expectId: target.id });
-                for (const related of await manager.relatedContainers(target.name)) {
-                    await manager.apply(related).catch(e => ctx.logger.warn('related container network apply failed', { related, message: e && e.message }));
+                // 旧规则关联的容器也要重算：撤掉“允许 @container:Y”后，Y 出站里原来的派生行得去掉
+                const related = [...new Set([...relatedBefore, ...await manager.relatedContainers(target.name)])];
+                for (const other of related) {
+                    await manager.apply(other).catch(e => ctx.logger.warn('related container network apply failed', { related: other, message: e && e.message }));
                 }
             } catch (e) {
                 out.applyError = e.message;
@@ -187,21 +225,25 @@ function createContainerManageRoutes({ ctx, state, req, res, deps }) {
             return;
         }
         const before = readPolicy(target.id);
-        const next = normalizePolicy({ ...body.policy, autostartOnServe: body.policy && body.policy.autostartOnServe !== undefined ? body.policy.autostartOnServe : before.autostartOnServe });
-        for (const entry of next.peers.inbound) {
-            if (entry.from === target.id || !state_.stateExists(homeDir, entry.from)) {
-                sendJson(res, 400, { error: `peers.inbound 里的容器不存在: ${entry.from}` });
-                return;
-            }
+        const normalized = normalizePolicy({ ...body.policy, autostartOnServe: body.policy && body.policy.autostartOnServe !== undefined ? body.policy.autostartOnServe : before.autostartOnServe });
+        let next;
+        try {
+            next = resolveContainerRefs(normalized, await containerIdLookup());
+        } catch (e) {
+            sendJson(res, 400, { error: e.message });
+            return;
         }
         const risks = pendingRisks(before, next);
         if (risks.length && body.confirmRisk !== true) {
             sendJson(res, 400, { error: '该改动会放开网络限制，需要确认', needsConfirm: true, risks });
             return;
         }
+        // 保存前先取旧规则关联的容器（保存后旧规则就读不到了）
+        let relatedBefore = [];
+        try { relatedBefore = isRunning(target.name) ? await getNetworkManager().relatedContainers(target.name) : []; } catch (e) { relatedBefore = []; }
         writePolicy(target.id, next);
-        state_.setNetRequired(homeDir, target.id, next.preset !== 'open');
-        const result = await applyPolicy(target, next);
+        state_.setNetRequired(homeDir, target.id, !isUnrestricted(next));
+        const result = await applyPolicy(target, next, relatedBefore);
         const payload = await networkPayload(target, { applyError: result.applyError, forwardFailures: result.forwardFailures });
         // 策略已保存；规则下发失败（502）或端口暴露没起来（409，如端口被占）都要明确报错
         if (result.applyError) sendJson(res, 502, { error: result.applyError, ...payload });
@@ -209,16 +251,12 @@ function createContainerManageRoutes({ ctx, state, req, res, deps }) {
         else sendJson(res, 200, payload);
     }
 
-    // 一键放行被拦截的域名：加进白名单并立即下发
+    // 一键放行被拦截的域名：在出站规则最前面插入“允许 <域名>”并立即下发（任何模式都可以）
     async function postAllow(target, body) {
         const domain = String(body.domain || '').trim().toLowerCase();
         const policy = readPolicy(target.id);
-        if (policy.preset !== 'allowlist') {
-            sendJson(res, 400, { error: '只有「仅白名单」出站模式才需要放行域名' });
-            return;
-        }
-        if (!policy.egress.domains.includes(domain)) {
-            await putNetwork(target, { policy: { ...policy, egress: { ...policy.egress, domains: [...policy.egress.domains, domain] } }, confirmRisk: body.confirmRisk });
+        if (!domainRuleAllows(policy, domain)) {
+            await putNetwork(target, { policy: { ...policy, outbound: [{ action: 'allow', target: domain, ports: '', proto: 'all', enabled: true }, ...policy.outbound] }, confirmRisk: body.confirmRisk });
             return;
         }
         sendJson(res, 200, await networkPayload(target));