whistle.easy-proxy 1.0.0

package/lib/plugin/resolver.js

@@ -0,0 +1,228 @@
+const https = require('node:https');
+const net = require('node:net');
+const { debug } = require('../debug');
+const defaultHosts = require('./default-hosts');
+
+let CONFIG = null;
+
+// host -> { ip, ts, all }
+const cache = new Map();
+
+function setConfig(config) {
+  CONFIG = config;
+}
+
+function ttl() {
+  return (CONFIG?.ipCacheTtl ? CONFIG.ipCacheTtl : 600) * 1000;
+}
+
+function fresh(host) {
+  const e = cache.get(host);
+  if (e && Date.now() - e.ts < ttl()) return e.ip;
+  return null;
+}
+
+/**
+ * DoH (RFC 8484 JSON) resolve real IPv4.
+ * Direct-connects bootstrap IP with servername = DoH hostname,
+ * so it's immune to client-side DNS pollution and avoids GFW SNI detection.
+ */
+function dohResolve(host) {
+  const doh = CONFIG?.doh || {
+    bootstrapIp: '8.8.8.8',
+    host: 'dns.google',
+    path: '/resolve',
+    port: 443,
+  };
+  const qs = `?name=${encodeURIComponent(host)}&type=A`;
+  const reqOpts = {
+    host: doh.bootstrapIp,
+    port: doh.port || 443,
+    servername: doh.host,
+    path: doh.path + qs,
+    method: 'GET',
+    headers: {
+      Host: doh.host,
+      Accept: 'application/dns-json',
+    },
+    lookup: (_h, _o, cb) => cb(null, doh.bootstrapIp, 4),
+    timeout: 5000,
+  };
+
+  return new Promise((resolve, reject) => {
+    try {
+      const req = https.request(reqOpts, (res) => {
+        let body = '';
+        res.on('data', (c) => (body += c));
+        res.on('end', () => {
+          try {
+            const json = JSON.parse(body);
+            if (json.Status !== 0 || !Array.isArray(json.Answer)) {
+              return resolve([]);
+            }
+            const ips = json.Answer.filter((a) => a.type === 1).map((a) => a.data);
+            resolve(ips);
+          } catch (e) {
+            reject(new Error(`DoH response parse error: ${e.message}`));
+          }
+        });
+      });
+      req.on('error', (e) => reject(new Error(`DoH request error: ${e.message}`)));
+      req.on('timeout', () => req.destroy(new Error('DoH timeout')));
+      req.end();
+    } catch (e) {
+      reject(new Error(`DoH setup error: ${e.message}`));
+    }
+  });
+}
+
+async function refresh(host) {
+  try {
+    const ips = await dohResolve(host);
+    if (ips?.length) {
+      cache.set(host, { ip: ips[0], ts: Date.now(), all: ips });
+      return ips[0];
+    }
+  } catch (e) {
+    debug('DoH resolve failed for', `${host}:`, e.message);
+    // DoH failed, keep old cache or fallback
+  }
+  const curated = defaultHosts.curated[host];
+  if (curated?.length) {
+    cache.set(host, { ip: curated[0], ts: Date.now(), all: curated });
+    return curated[0];
+  }
+  return null;
+}
+
+/**
+ * 将 DoH 解析结果缓存到内存（供 rule-actions 的 SNI 处理器调用）。
+ * 用于非 GitHub 域名的 IP 缓存。
+ */
+function cacheDohResult(host, ips) {
+  if (!ips?.length) return;
+  cache.set(host, { ip: ips[0], ts: Date.now(), all: ips });
+}
+
+function userOverride(host) {
+  if (!CONFIG || !Array.isArray(CONFIG.hosts)) return null;
+  for (const h of CONFIG.hosts) {
+    if (h.pattern === host && h.ip) return h.ip;
+  }
+  return null;
+}
+
+/**
+ * Synchronous best-IP resolution: user override > cache > curated fallback.
+ * Triggers async DoH refresh in background.
+ */
+function resolve(host) {
+  const ov = userOverride(host);
+  if (ov) return ov;
+
+  const cached = fresh(host);
+  if (cached) return cached;
+
+  const curated = defaultHosts.curated[host];
+  const fallback = curated?.length ? curated[0] : null;
+
+  refresh(host).catch((e) => {
+    debug('Background refresh failed for', `${host}:`, e.message);
+  });
+
+  return fallback;
+}
+
+/**
+ * TCP connection latency in ms.
+ */
+function measureLatency(ip, port) {
+  port = port || 443;
+  return new Promise((resolve) => {
+    const start = process.hrtime.bigint();
+    const sock = net.connect({ host: ip, port }, () => {
+      const ms = Number(process.hrtime.bigint() - start) / 1e6;
+      sock.destroy();
+      resolve(Math.round(ms * 100) / 100);
+    });
+    sock.on('error', () => resolve(-1));
+    sock.setTimeout(3000, () => {
+      sock.destroy();
+      resolve(-1);
+    });
+  });
+}
+
+function clearCache() {
+  cache.clear();
+}
+
+function snapshot() {
+  const out = {};
+  cache.forEach((v, k) => (out[k] = v));
+  return out;
+}
+
+/**
+ * Get all candidate IPs for a host with source labels.
+ * Returns [{ ip, source: 'doh'|'curated'|'override'|'cached', latency: null }]
+ */
+async function getAllCandidates(host) {
+  const seen = new Set();
+  const candidates = [];
+
+  const ov = userOverride(host);
+  if (ov && !seen.has(ov)) {
+    seen.add(ov);
+    candidates.push({ ip: ov, source: 'override', latency: null });
+  }
+
+  try {
+    const dohIps = await dohResolve(host);
+    if (dohIps?.length) {
+      cache.set(host, { ip: dohIps[0], ts: Date.now(), all: dohIps });
+      for (const ip of dohIps) {
+        if (!seen.has(ip)) {
+          seen.add(ip);
+          candidates.push({ ip, source: 'doh', latency: null });
+        }
+      }
+    }
+  } catch (e) {
+    debug('getAllCandidates DoH failed for', `${host}:`, e.message);
+  }
+
+  const cachedEntry = cache.get(host);
+  if (cachedEntry?.all) {
+    for (const ip of cachedEntry.all) {
+      if (!seen.has(ip)) {
+        seen.add(ip);
+        candidates.push({ ip, source: 'cached', latency: null });
+      }
+    }
+  }
+
+  const curated = defaultHosts.curated[host];
+  if (curated?.length) {
+    for (const ip of curated) {
+      if (!seen.has(ip)) {
+        seen.add(ip);
+        candidates.push({ ip, source: 'curated', latency: null });
+      }
+    }
+  }
+
+  return candidates;
+}
+
+module.exports = {
+  setConfig,
+  resolve,
+  refresh,
+  cacheDohResult,
+  measureLatency,
+  clearCache,
+  snapshot,
+  dohResolve,
+  getAllCandidates,
+};

package/lib/plugin/rule-actions.js

@@ -0,0 +1,344 @@
+/**
+ * 拦截规则动作执行器
+ *
+ * 根据匹配到的动作集合，执行对应的拦截行为：
+ *   abort / success / redirect → 直接返回响应
+ *   sni                        → 解析 IP + SNI 改写直连
+ *   proxy                      → host 映射（whistle host://）
+ *   requestReplace             → 请求头修改
+ *   responseReplace            → 响应头修改
+ *   cacheDays                  → 响应缓存（TTL 轮转 key）
+ *   tampermonkeyScript/script  → HTML 注入脚本
+ *   status                     → HTTP 状态码
+ *   proxy_backup               → 备用代理（模板变量替换）
+ */
+
+const dns = require('node:dns');
+const sniAgent = require('./sni-agent');
+
+// ---- 系统 DNS 解析（非 GitHub 域名兜底） ----
+
+function resolveSystemDns(host) {
+  return new Promise((resolve) => {
+    dns.resolve4(host, (err, addresses) => {
+      if (err || !addresses || !addresses.length) resolve(null);
+      else resolve(addresses[0]);
+    });
+  });
+}
+
+// ---- 请求头 / 响应头处理 ----
+
+/**
+ * 将 headers 对象中的特殊值标准化。
+ * "[remove]" → 空字符串（whistle 中空值表示删除头）
+ */
+function normalizeHeaders(headers) {
+  const out = {};
+  if (!headers || typeof headers !== 'object') return out;
+  for (const key of Object.keys(headers)) {
+    const val = headers[key];
+    if (val === '[remove]') {
+      out[key] = '';
+    } else {
+      out[key] = val;
+    }
+  }
+  return out;
+}
+
+/**
+ * 直接修改 whistle req 的请求头（用于 SNI forward 前的请求头篡改）
+ */
+function applyRequestHeadersToReq(req, headers) {
+  const normalized = normalizeHeaders(headers);
+  for (const key of Object.keys(normalized)) {
+    const lower = key.toLowerCase();
+    if (normalized[key] === '') {
+      delete req.headers[lower];
+    } else {
+      req.headers[lower] = normalized[key];
+    }
+  }
+}
+
+/**
+ * 修改上游响应头（用于 SNI forward 后的响应头篡改）
+ */
+function applyResponseHeadersToRes(res, headers) {
+  const normalized = normalizeHeaders(headers);
+  if (!res?.headers) return;
+  for (const key of Object.keys(normalized)) {
+    const lower = key.toLowerCase();
+    if (normalized[key] === '') {
+      delete res.headers[lower];
+    } else {
+      res.headers[lower] = normalized[key];
+    }
+  }
+}
+
+// ---- 构建 whistle 原生规则 ----
+
+/**
+ * 将动作集合转为 whistle 原生规则文本行数组。
+ * 用于 proxy / 纯 header 修改 / cache / script 注入等场景。
+ */
+function buildWhistleRules(actions, host, _groups) {
+  const rules = [];
+
+  // 请求头修改
+  if (actions.requestReplace?.headers) {
+    const headers = normalizeHeaders(actions.requestReplace.headers);
+    if (Object.keys(headers).length > 0) {
+      rules.push(`reqHeaders://${JSON.stringify(headers)}`);
+    }
+  }
+
+  // 响应头修改
+  if (actions.responseReplace) {
+    const respHeaders = {};
+    if (actions.responseReplace.headers) {
+      Object.assign(respHeaders, normalizeHeaders(actions.responseReplace.headers));
+    }
+    if (actions.responseReplace.doDownload) {
+      respHeaders['content-disposition'] = 'attachment';
+    }
+    if (Object.keys(respHeaders).length > 0) {
+      rules.push(`resHeaders://${JSON.stringify(respHeaders)}`);
+    }
+  }
+
+  // 缓存 (TTL 轮转 key: 每 cacheDays 天换一个 key)
+  if (actions.cacheDays && actions.cacheDays > 0) {
+    const period = Math.floor(Date.now() / (actions.cacheDays * 86400000));
+    rules.push(`cache://${host}_${period}`);
+  }
+
+  // 状态码
+  if (actions.status) {
+    rules.push(`status://${actions.status}`);
+  }
+
+  // 脚本注入
+  const scripts = [];
+  if (actions.tampermonkeyScript) scripts.push(actions.tampermonkeyScript);
+  if (actions.script) scripts.push(actions.script);
+  if (scripts.length > 0) {
+    const html = scripts.map((s) => `<script src="${s}"></script>`).join('');
+    // whistle resAppend:// 内联内容用 base64 编码
+    rules.push(`resAppend://${Buffer.from(html).toString('base64')}`);
+  }
+
+  return rules;
+}
+
+// ---- 动作处理器 ----
+
+/**
+ * 主入口：根据匹配结果执行动作。
+ *
+ * @param {object} req       whistle PluginServerRequest
+ * @param {object} client    whistle ServerResponse
+ * @param {function} next    pass-through 回调
+ * @param {object} matched   matchRules 返回值 { actions, groups, matches }
+ * @param {object} ctx       { host, path, config, resolver }
+ * @returns {Promise|undefined}
+ */
+async function applyActions(req, client, next, matched, ctx) {
+  const actions = matched.actions || {};
+  const groups = matched.groups || null;
+  const host = ctx.host;
+
+  // --- 1. abort（中断请求）---
+  if (actions.abort === true) {
+    client.statusCode = actions.status || 204;
+    client.end();
+    return;
+  }
+
+  // --- 2. success（直接返回成功响应）---
+  if (actions.success !== undefined) {
+    handleSuccess(client, actions);
+    return;
+  }
+
+  // --- 3. redirect（重定向）---
+  if (actions.redirect) {
+    client.statusCode = 302;
+    client.setHeader('location', actions.redirect);
+    client.end();
+    return;
+  }
+
+  // --- 4. sni（SNI 改写直连）---
+  if (actions.sni !== undefined) {
+    return await handleSni(req, client, next, actions, groups, ctx);
+  }
+
+  // --- 5. proxy（host 映射）---
+  if (actions.proxy) {
+    return handleProxyAction(req, client, next, actions, host, groups);
+  }
+
+  // --- 6. 其他动作（纯 header / cache / script，走 whistle 原生规则）---
+  const rules = buildWhistleRules(actions, host, groups);
+  if (rules.length > 0) {
+    req.setReqRules(rules.join('\n'));
+  }
+  req.passThrough();
+}
+
+// ---- success 处理器 ----
+
+function handleSuccess(client, actions) {
+  const success = actions.success;
+  let body = '';
+  let contentType = 'text/plain; charset=utf-8';
+
+  if (success === true) {
+    // 简单成功
+    body = '';
+  } else if (typeof success === 'object') {
+    if (success.script) {
+      body = success.script;
+      contentType = 'application/javascript; charset=utf-8';
+    } else if (success.body) {
+      body = success.body;
+    }
+  } else if (typeof success === 'string') {
+    body = success;
+  }
+
+  client.statusCode = actions.status || 200;
+  client.setHeader('content-type', contentType);
+  client.setHeader('content-length', Buffer.byteLength(body));
+  client.end(body);
+}
+
+// ---- SNI 处理器 ----
+
+async function handleSni(req, _client, next, actions, groups, ctx) {
+  const host = ctx.host;
+  const sniValue = actions.sni;
+
+  // sni: "none" → 不改写 SNI，仅做直连（或配合其他动作走 whistle 规则）
+  if (sniValue === 'none') {
+    const otherActions = Object.assign({}, actions);
+    delete otherActions.sni;
+    const rules = buildWhistleRules(otherActions, host, groups);
+    if (rules.length > 0) {
+      req.setReqRules(rules.join('\n'));
+    }
+    req.passThrough();
+    return;
+  }
+
+  // 解析 IP: 先用已有 resolver（GitHub 域名有缓存/curated），再 DoH，最后系统 DNS
+  let ip = null;
+  if (ctx.resolver && typeof ctx.resolver.resolve === 'function') {
+    ip = ctx.resolver.resolve(host);
+  }
+  if (!ip && ctx.resolver && typeof ctx.resolver.dohResolve === 'function') {
+    try {
+      const ips = await ctx.resolver.dohResolve(host);
+      if (ips?.length) {
+        ip = ips[0];
+        // 缓存结果
+        if (typeof ctx.resolver.cacheDohResult === 'function') {
+          ctx.resolver.cacheDohResult(host, ips);
+        }
+      }
+    } catch (_e) {
+      /* DoH 失败 */
+    }
+  }
+  if (!ip) {
+    ip = await resolveSystemDns(host);
+  }
+  if (!ip) {
+    // 无法解析 IP，放行
+    return next();
+  }
+
+  // 请求头篡改（SNI forward 前修改原始请求头）
+  if (actions.requestReplace?.headers) {
+    applyRequestHeadersToReq(req, actions.requestReplace.headers);
+  }
+  if (actions.requestReplace?.doDownload) {
+    // 请求侧 doDownload: 无实际请求头修改需要
+  }
+
+  // 响应头篡改回调
+  let onResponse = null;
+  if (actions.responseReplace) {
+    const respHeaders = {};
+    if (actions.responseReplace.headers) {
+      Object.assign(respHeaders, normalizeHeaders(actions.responseReplace.headers));
+    }
+    if (actions.responseReplace.doDownload) {
+      respHeaders['content-disposition'] = 'attachment';
+    }
+    if (Object.keys(respHeaders).length > 0) {
+      onResponse = (res) => {
+        applyResponseHeadersToRes(res, respHeaders);
+      };
+    }
+  }
+
+  // proxy_backup 模板替换（记录备用代理，当前版本仅记录不自动切换）
+  if (actions.proxy_backup && groups) {
+    // 替换模板变量 ${var}
+    const _backup = require('./rule-engine').substituteTemplate(actions.proxy_backup, groups);
+    // TODO: 实现主连接失败后自动切换到 proxy_backup
+    // 当前版本: 仅记录，不自动切换
+  }
+
+  // SNI 直连转发
+  sniAgent.forward(
+    req,
+    {
+      domain: host,
+      ip: ip,
+      port: 443,
+      servername: sniValue,
+    },
+    onResponse
+  );
+}
+
+// ---- proxy 处理器 ----
+
+function handleProxyAction(req, _client, _next, actions, host, groups) {
+  const proxyHost = actions.proxy;
+
+  // 构建 whistle 规则
+  const rules = [`${host} host://${proxyHost}`];
+
+  // 附加其他动作（header 修改、cache 等）
+  const otherActions = Object.assign({}, actions);
+  delete otherActions.proxy;
+  delete otherActions.backup;
+  delete otherActions.desc;
+  delete otherActions.remark;
+  delete otherActions.test;
+
+  const extraRules = buildWhistleRules(otherActions, host, groups);
+  for (let i = 0; i < extraRules.length; i++) {
+    rules.push(extraRules[i]);
+  }
+
+  // backup 主机列表（当前版本仅记录，不自动切换）
+  // TODO: 实现主代理失败后自动尝试 backup 主机
+
+  req.setReqRules(rules.join('\n'));
+  req.passThrough();
+}
+
+module.exports = {
+  applyActions,
+  buildWhistleRules,
+  normalizeHeaders,
+  handleSuccess,
+  resolveSystemDns,
+};