whistle 2.9.109 → 2.10.1

package/biz/webui/lib/index.js

@@ -40,6 +40,7 @@ var DONT_CHECK_PATHS = ['/cgi-bin/server-info', '/cgi-bin/plugins/is-enable', '/
   '/preview.html', '/cgi-bin/rootca', '/cgi-bin/check-update', '/cgi-bin/log/set', '/cgi-bin/status'];
 var GUEST_PATHS = ['/cgi-bin/composer', '/cgi-bin/socket/data', '/cgi-bin/abort', '/cgi-bin/socket/abort',
   '/cgi-bin/socket/change-status', '/cgi-bin/sessions/export'];
+var CORS_PATHS = ['/cgi-bin/status',  '/cgi-bin/rootca'];
 var PLUGIN_PATH_RE = /^\/(whistle|plugin)\.([^/?#]+)(\/)?/;
 var STATIC_SRC_RE = /\.(?:ico|js|css|png)$/i;
 var UPLOAD_URLS = ['/cgi-bin/values/upload', '/cgi-bin/composer', '/cgi-bin/download'];
@@ -52,7 +53,6 @@ var INSPECTOR_HTML = fs.readFileSync(path.join(__dirname, '../../../assets/tab.h
 var MODAL_HTML = fs.readFileSync(path.join(__dirname, '../../../assets/modal.html'));
 var MENU_URL = '???_WHISTLE_PLUGIN_EXT_CONTEXT_MENU_' + config.port + '???';
 var INSPECTOR_URL = '???_WHISTLE_PLUGIN_INSPECTOR_TAB_' + config.port + '???';
-var UP_PATH_REGEXP = /(?:^|[\\/])\.\.(?:[\\/]|$)/;
 var KEY_RE_G = /\${[^{}\s]+}|{\S+}/g;
 var COMMENT_RE = /#[^\r\n]*$/mg;
 
@@ -148,7 +148,7 @@ function verifyLogin(req, res, auth) {
   if (correctKey === lkey) {
     return true;
   }
-  var headerAuth = parseAuth(req.headers.authorization);
+  var headerAuth = parseAuth(req.headers.authorization || req.headers['proxy-authorization']);
   var queryAuth = parseAuth(req.query.authorization);
   if (!isGuest && config.encrypted) {
     headerAuth.pass = headerAuth.pass && createHash(headerAuth.pass);
@@ -330,7 +330,7 @@ function checkInternalPath(req) {
   if (config.allowAllOrigin || ALLOW_CROSS_URLS.indexOf(req.path) !== -1) {
     return true;
   }
-  var host = req.headers['x-whistle-origin-host'];
+  var host = req.headers[common.ORIGIN_HOST_HEADER];
   return !host || isAllowHost(host);
 }
 
@@ -343,7 +343,7 @@ function checkAllowOrigin(req) {
   if (config.allowAllOrigin) {
     return true;
   }
-  if (req.path === '/cgi-bin/rootca' || req.path === '/cgi-bin/status') {
+  if (CORS_PATHS.indexOf(req.path) !== -1) {
     return true;
   }
   if (!config.allowOrigin) {
@@ -358,7 +358,7 @@ function checkAllowOrigin(req) {
 }
 
 function cgiHandler(req, res) {
-  if (UP_PATH_REGEXP.test(req.path) || !checkInternalPath(req)) {
+  if (common.existsUpPath(req.path) || !checkInternalPath(req)) {
     return res.status(403).end('Forbidden');
   }
   if (checkAllowOrigin(req)) {
@@ -435,9 +435,8 @@ app.all(PLUGIN_PATH_RE, function(req, res) {
   if (req.url.indexOf(INSPECTOR_URL) !== -1) {
     return readPluginPage(req, res, plugin, INSPECTOR_HTML, plugin[util.PLUGIN_INSPECTOR_CONFIG]);
   }
-  var internalId = req.headers['x-whistle-internal-id'];
-  if (internalId === util.INTERNAL_ID) {
-    delete req.headers['x-whistle-internal-id'];
+  if (req.headers[util.INTERNAL_ID_HEADER] === util.INTERNAL_ID) {
+    delete req.headers[util.INTERNAL_ID_HEADER];
   } else if (plugin.inheritAuth && !checkAuth(req, res)) {
     return;
   }
@@ -451,8 +450,6 @@ app.all(PLUGIN_PATH_RE, function(req, res) {
     var options = parseReqUrl(req);
     var headers = req.headers;
     headers[config.PLUGIN_HOOK_NAME_HEADER] = config.PLUGIN_HOOKS.UI;
-    headers['x-whistle-remote-address'] = req._remoteAddr || util.getRemoteAddr(req);
-    headers['x-whistle-remote-port'] = req._remotePort || util.getRemotePort(req);
     req.url = options.path.replace(result[0].slice(0, -1), '');
     var openInModal = req.url.indexOf('?openInModal=5b6af7b9884e1165') !== -1;
     util.transformReq(req, res, ports.uiPort, null, openInModal ? MODAL_HTML : null);
@@ -488,8 +485,8 @@ app.use(function(req, res, next) {
 });
 
 app.post('/cgi-bin/composer', function(req, res) {
-  req.headers[config.CLIENT_IP_HEAD] = util.getClientIp(req);
-  req.headers[config.CLIENT_PORT_HEAD] = util.getClientPort(req);
+  req.headers[config.CLIENT_IP_HEADER] = util.getClientIp(req);
+  req.headers[config.CLIENT_PORT_HEADER] = util.getClientPort(req);
   sendToService(req, res);
 });
 app.get('/cgi-bin/compose-data', sendToService);
@@ -557,7 +554,7 @@ app.all('/cgi-bin/*', function(req, res, next) {
 }, cgiHandler);
 
 app.use('/preview.html', function(req, res, next) {
-  if (req.headers[config.INTERNAL_ID_HEADER] !== config.INTERNAL_ID) {
+  if (req.headers[util.INTERNAL_ID_HEADER] !== util.INTERNAL_ID) {
     return res.status(404).end('Not Found');
   }
   next();

package/lib/config.js

@@ -29,8 +29,7 @@ var disableAgent = version[0] > 10;
 var useVerbatim = version[0] >= 17;
 var hasIPv6First = version[0] >= 22 && version[1] >= 1;
 var hasDnsOrder = typeof dns.setDefaultResultOrder === 'function';
-var uid =
-  Date.now() + '-' + process.pid + '-' + Math.floor(Math.random() * 10000);
+var uid = Date.now().toString(16) + (process.pid * 10000 + Math.floor(Math.random() * 10000)).toString(16);
 var IPV4_RE = /^([\d.]+)(:\d{1,5})?$/;
 var IPV6_RE = /^\[([\w:]+)\](:\d{1,5})?$/;
 var noop = function () {};
@@ -75,39 +74,23 @@ config.uid = uid;
 config.rejectUnauthorized = false;
 config.enableH2 = version[0] > 12; // 支持 HTTP2 要求的最低 Node 版本
 config.ASSESTS_PATH = path.join(__dirname, '../assets');
-config.REQ_FROM_HEADER = 'x-whistle-request-from';
-config.DISABLE_RULES_HEADER = 'x-whistle-proxy-rules-' + uid;
 config.WHISTLE_POLICY_HEADER = 'x-whistle-policy';
-config.CUSTOM_CERT_HEADER = 'x-whistle-exists-custom-cert';
-config.ENABLE_CAPTURE_HEADER = 'x-whistle-enable-capture';
-config.CLIENT_IP_HEAD = 'x-forwarded-for';
-config.HTTPS_FIELD = 'x-whistle-https-request';
-config.HTTPS_PROTO_HEADER = 'x-forwarded-proto';
-config.REAL_HOST_HEADER = common.REAL_HOST_HEADER;
-config.FWD_HOST_HEADER = 'x-forwarded-host';
-config.INTERNAL_ID =
-  Date.now() + '/' + process.pid + '/' + Math.floor(Math.random() * 100000);
-config.INTERNAL_ID_HEADER = '_x-whistle-internal-id';
-config.SNI_PLUGIN_HEADER = 'x-whistle-sni-callback-plugin-' + uid;
-config.PROXY_ID_HEADER = 'x-whistle-proxy-id-' + uid;
-config.CLIENT_PORT_HEAD = 'x-whistle-client-port';
-config.WEBUI_HEAD = 'x-forwarded-from-whistle-' + uid;
-config.RES_RULES_HEAD = 'x-whistle-res-rules-' + uid;
-config.CLIENT_INFO_HEAD = 'x-whistle-client-info-' + uid;
-config.REMOTE_ADDR_HEAD = 'x-whistle-remote-address-' + uid;
-config.REMOTE_PORT_HEAD = 'x-whistle-remote-port-' + uid;
-config.ADDITIONAL_HEAD = 'x-whistle-additional-headers';
+config.CLIENT_IP_HEADER = common.CLIENT_IP_HEADER;
+config.HTTPS_FIELD = common.HTTPS_FIELD;
+config.CLIENT_INFO_HEADER = 'x-whistle-client-info-' + uid;
+config.SHOW_LOGIN_BOX = 'x-whistle-show-login-box-' + uid;
 config.WEBUI_PATH = '/.whistle-path.5b6af7b9884e1165/';
 config.PREVIEW_PATH_RE = /\?\?\?WHISTLE_PREVIEW_CHARSET=([A-Z\d_-]+)\?\?\?$/;
 config.PLUGIN_HOOK_NAME_HEADER = 'x-whistle-plugin-hook-name_';
-config.CLIENT_ID_HEADER = 'x-whistle-client-id';
-config.CLIENT_ID_HEAD = 'x-whistle-client-id';
+config.CLIENT_ID_HEADER = common.CLIENT_ID_HEADER;
+config.CLIENT_PORT_HEADER = common.CLIENT_PORT_HEADER;
+config.ALPN_PROTOCOL_HEADER = common.ALPN_PROTOCOL_HEADER;
+config.DISABLE_RULES_HEADER = 'x-whistle-proxy-rules-' + uid;
+config.PROXY_ID_HEADER = 'x-whistle-proxy-id-' + uid;
+config.WEBUI_HEAD = 'x-forwarded-from-whistle-' + uid;
+config.RES_RULES_HEAD = 'x-whistle-res-rules-' + uid;
 config.COMPOSER_CLIENT_ID_HEADER = 'x-whistle-client-id-' + uid;
-config.TUNNEL_DATA_HEADER = 'x-whistle-tunnel-data';
-config.TEMP_TUNNEL_DATA_HEADER = 'x-whistle-tunnel-data-' + uid;
-config.UPGRADE_HEADER = 'x-whistle-upgrade-' + uid;
-config.SNI_TYPE_HEADER = 'x-whistle-sni-type-' + uid;
-config.ALPN_PROTOCOL_HEADER = 'x-whistle-alpn-protocol';
+config.FROM_COM_HEADER = 'x-whistle-composer-' + uid;
 config.PLUGIN_HOOKS = {
   SNI: 'sni-' + uid,
   AUTH: 'auth-' + uid,
@@ -140,15 +123,11 @@ var DOMAIN_STAR_RE = /([*~]+)(\\.)?/g;
 
 config.CONN_TIMEOUT = CONN_TIMEOUT;
 
-var getHomedir = common.getHomedir;
-var getHomePath = common.getHomePath;
 var getWhistlePath = common.getWhistlePath;
 var getHostPort = common.getHostPort;
 
 var ALL_WHISTLES_PATH = path.join(getWhistlePath(), 'all_whistles');
 
-config.getHomedir = getHomedir;
-config.getHomePath = getHomePath;
 
 function domainToRegExp(_, star, dot) {
   var len = star.length;
@@ -870,7 +849,7 @@ exports.extend = function (newConf) {
         config.pureProxy = true;
       } else if (
         m === 'keepXFF' ||
-        m === 'x-forwarded-for' ||
+        m === common.CLIENT_IP_HEADER ||
         m === 'forwardedFor'
       ) {
         config.keepXFF = true;
@@ -884,6 +863,8 @@ exports.extend = function (newConf) {
         process.env.PFORK_EXEC_PATH = process.execPath;
       } else if (m === 'safe' || m === 'rejectUnauthorized') {
         config.rejectUnauthorized = true;
+      } else if (m === 'enableRequestHeaderRules') {
+        config.enableRequestHeaderRules = true;
       } else if (m === 'persistentCapture') {
         config.isEnableCapture = true;
         config.persistentCapture = true;
@@ -1139,7 +1120,7 @@ exports.extend = function (newConf) {
     return agent;
   };
   var baseDir = config.baseDir
-    ? path.resolve(getHomePath(config.baseDir), config.dataDirname)
+    ? path.resolve(common.getHomePath(config.baseDir), config.dataDirname)
     : (config.whistleName ? path.join(ALL_WHISTLES_PATH, config.whistleName) : getDataDir(config.dataDirname));
   var customDirs = path.join(baseDir, 'custom_dirs');
   config.baseDir = baseDir;

package/lib/handlers/file-proxy.js

@@ -26,6 +26,7 @@ var HASH_RE = /#.*$/;
 var CROSS_RE = /^x(s)?/;
 var HTTP_RE = /^http:/;
 var NOT_A_FILE_ERR = new Error('Not a file');
+var INVALID_PATH = '(Path contains parent directory notation \'..\')';
 
 function urlToStr(url) {
   return url.replace(SLASH_RE, '').replace(QUOTE_RE, '\\$&').replace(BLANK_RE, ' ');
@@ -48,7 +49,7 @@ function readFiles(files, callback) {
     } else if (files.length) {
       readFiles(files, callback);
     } else {
-      callback(err || NOT_A_FILE_ERR, file);
+      callback(err || NOT_A_FILE_ERR, file == null ? INVALID_PATH : file);
     }
   };
 

package/lib/handlers/http-proxy.js

@@ -35,7 +35,7 @@ module.exports = function (req, res, next) {
     }
     var fullUrl = req.options._realUrl || req.fullUrl;
     var options = util.parseUrl(fullUrl);
-    pluginMgr.addRuleHeaders(req, req.rules);
+    pluginMgr.addSessionInfo(req, req.rules);
     options.protocol = 'http:';
     options.host = '127.0.0.1';
     options.port = ports.port;

package/lib/https/ca.js

@@ -12,6 +12,7 @@ var createSecureContext =
 var util = require('../util');
 var config = require('../config');
 var common = require('../util/common');
+var rulesUtil = require('../rules/util');
 
 var pki = forge.pki;
 var CUR_VERSION = process.version;
@@ -51,11 +52,20 @@ var pureCertFiles = {};
 var customRoot;
 var ROOT_KEY, ROOT_CRT;
 var rootKey, rootCrt;
+var ILLEGAL_PATH_RE = /[/\\]/;
 
 exports.remoteCerts = remoteCerts;
 exports.createSecureContext = createSecureContext;
 exports.CUSTOM_CERTS_DIR = CUSTOM_CERTS_DIR;
 
+function isRootCa(name) {
+  return name !== 'root';
+}
+
+function checkFilename(name) {
+  return name && !ILLEGAL_PATH_RE.test(name) && isRootCa(name);
+}
+
 function resetAllCerts() {
   cachePairs.reset();
   certsCache.reset();
@@ -255,27 +265,30 @@ function parseAllCustomCerts() {
     var validity = info.validity;
     var altNames = info.altNames;
     var dnsName = [];
+    var disabled = (isRootCa(filename) && rulesUtil.isDisabledCertFile(filename)) || undefined;
     altNames.forEach(function (item) {
       if ((item.type === 2 || item.type === 7) && !pairs[item.value]) {
-        var preCert = customPairs[item.value];
-        if (preCert && preCert.key === cert.key && preCert.cert === cert.cert) {
-          if (preCert.mtime < mtime) {
-            preCert.mtime = mtime;
+        if (!disabled) {
+          var preCert = customPairs[item.value];
+          if (preCert && preCert.key === cert.key && preCert.cert === cert.cert) {
+            if (preCert.mtime < mtime) {
+              preCert.mtime = mtime;
+            }
+            pairs[item.value] = preCert;
+          } else {
+            pairs[item.value] = cert;
           }
-          pairs[item.value] = preCert;
-        } else {
-          pairs[item.value] = cert;
         }
         dnsName.push(item.value);
         certsInfo[item.value] = extend(
-          { filename: filename, type: cert.type, mtime: mtime, domain: item.value },
+          { filename: filename, type: cert.type, mtime: mtime, domain: item.value, disabled: disabled },
           validity
         );
       }
     });
     if (dnsName.length) {
       certFiles[filename] = extend(
-        { mtime: mtime, type: cert.type, dir: cert.dir, dnsName: dnsName.join(', ') },
+        { mtime: mtime, type: cert.type, dir: cert.dir, dnsName: dnsName.join(', '), disabled: disabled },
         validity
       );
     }
@@ -424,22 +437,11 @@ function createRootCA() {
   }
 }
 
-function getRandom() {
-  var random = Math.floor(Math.random() * 1000);
-  if (random < 10) {
-    return '00' + random;
-  }
-  if (random < 100) {
-    return '0' + random;
-  }
-  return '' + random;
-}
-
 function createCACert(opts) {
   opts = opts || {};
   var keys = pki.rsa.generateKeyPair(requiredVersion ? 2048 : 1024);
   var cert = createCert(keys.publicKey);
-  var now = Date.now() + getRandom();
+  var now = Date.now() + common.padLeft(Math.floor(Math.random() * 1000), 3);
   var attrs = [
     {
       name: 'commonName',
@@ -730,12 +732,6 @@ function writeCertFile(filename, type, cert, mtime) {
   });
 }
 
-var ILLEGAL_PATH_RE = /[/\\]/;
-
-function checkFilename(name) {
-  return name && !ILLEGAL_PATH_RE.test(name) && name !== 'root';
-}
-
 function getCertType(type) {
   if (type !== 'cer' && type !== 'pem') {
     return 'crt';
@@ -756,6 +752,17 @@ exports.removeCert = function (opts) {
   }
 };
 
+exports.setActiveCert = function (opts) {
+  if (!CUSTOM_CERTS_DIR) {
+    return;
+  }
+  var filename = opts.filename;
+  if (isRootCa(filename) && allCustomCerts[filename]) {
+    rulesUtil.setDisabledCertFile(filename, opts.disabled);
+    parseAllCustomCerts();
+  }
+};
+
 exports.uploadCerts = function (certs) {
   if (!CUSTOM_CERTS_DIR) {
     return;

package/lib/https/h2.js

@@ -296,7 +296,7 @@ function requestH2(client, req, res, callback) {
       var statusCode = h2Headers[':status'];
       var svrRes = h2Session;
       if (additionalHeaders) {
-        newHeaders[config.ADDITIONAL_HEAD] = additionalHeaders;
+        newHeaders[util.ADDITIONAL_HEAD] = additionalHeaders;
       }
       svrRes.on('trailers', function (trailers) {
         svrRes.trailers = trailers;

package/lib/https/index.js

@@ -36,6 +36,7 @@ var CONN_TIMEOUT = 60000;
 var X_RE = /^x/;
 var PROTO_SEP_RE = /,\s*/;
 var HTTP_PROTO_RE = /^(ws|http)s?:\/\//;
+var clientIpKey = config.CLIENT_IP_HEADER;
 var proxy, server;
 
 function handleWebsocket(socket, clientIp, clientPort) {
@@ -274,7 +275,7 @@ function resolveWebsocket(socket, wss) {
             options.port = port;
             data.realUrl = util.changePort(fullUrl, options.port);
             socket.customParser = util.getParserStatus(socket);
-            pluginMgr.addRuleHeaders(socket, _rules);
+            pluginMgr.addSessionInfo(socket, _rules);
             socketMgr.setPending(socket);
             options.protocol = 'ws:';
             socket.headers[config.PLUGIN_HOOK_NAME_HEADER] =
@@ -441,7 +442,7 @@ function resolveWebsocket(socket, wss) {
                           wss = false;
                         }
                         if (!util.isLocalAddress(clientIp)) {
-                          proxyHeaders[config.CLIENT_IP_HEAD] = clientIp;
+                          proxyHeaders[clientIpKey] = clientIp;
                         }
                         if (isProxyPort) {
                           proxyHeaders[config.WEBUI_HEAD] = 1;
@@ -635,13 +636,13 @@ function resolveWebsocket(socket, wss) {
       util.setClientId(headers, enable, disable, clientIp, isInternalProxy);
     }
     if (disable.clientIp || disable.clientIP) {
-      delete headers[config.CLIENT_IP_HEAD];
+      delete headers[clientIpKey];
     } else {
       var forwardedFor = util.getMatcherValue(_rules.forwardedFor);
       if (net.isIP(forwardedFor)) {
-        headers[config.CLIENT_IP_HEAD] = forwardedFor;
-      } else if (net.isIP(socket._customXFF)) {
-        headers[config.CLIENT_IP_HEAD] = socket._customXFF;
+        headers[clientIpKey] = forwardedFor;
+      } else if (socket._customXFF) {
+        headers[clientIpKey] = socket._customXFF;
       } else if (
         (!isInternalProxy &&
           !plugin &&
@@ -650,9 +651,9 @@ function resolveWebsocket(socket, wss) {
           !enable.clientIP) ||
         util.isLocalAddress(clientIp)
       ) {
-        delete headers[config.CLIENT_IP_HEAD];
+        delete headers[clientIpKey];
       } else {
-        headers[config.CLIENT_IP_HEAD] = clientIp;
+        headers[clientIpKey] = clientIp;
       }
     }
     util.deleteReqHeaders(socket);
@@ -708,9 +709,12 @@ function resolveWebsocket(socket, wss) {
         socket._origin = headers.origin;
         if (reqHeaders) {
           reqHeaders = util.lowerCaseify(reqHeaders, socket.rawHeaderNames);
-          socket._customXFF = reqHeaders[config.CLIENT_IP_HEAD];
-          socket._customClientId = reqHeaders[config.CLIENT_ID_HEAD];
-          delete reqHeaders[config.CLIENT_IP_HEAD];
+          var xff = reqHeaders[clientIpKey];
+          if (net.isIP(xff)) {
+            socket._customXFF = xff;
+          }
+          socket._customClientId = reqHeaders[config.CLIENT_ID_HEADER];
+          delete reqHeaders[clientIpKey];
           extend(headers, reqHeaders);
           headers.host = headers.host || host;
         }
@@ -900,7 +904,7 @@ function getTunnelData(socket, clientIp, clientPort, isHttpH2) {
   var enable = socket.enable || '';
   var disable = socket.disable || '';
   var headers = socket.headers;
-  var tunnelData = headers[config.TUNNEL_DATA_HEADER];
+  var tunnelData = headers[util.TUNNEL_DATA_HEADER];
   var tdKey = config.tdKey;
   if (tdKey && (!tunnelData || config.overTdKey)) {
     tunnelData = headers[tdKey] || tunnelData;
@@ -944,7 +948,7 @@ function addReqInfo(req) {
     req.reqId = remoteData.id;
     socket._remoteDataInfo = remoteData;
     remoteData._connected = true;
-    headers[config.CLIENT_INFO_HEAD] =
+    headers[config.CLIENT_INFO_HEADER] =
       (remoteData.clientIp || LOCALHOST) +
       ',' + remoteData.clientPort +
       ',' + remoteData.remoteAddr +
@@ -1058,9 +1062,9 @@ function toHttp1(req, res) {
         } catch (e) {}
       }
     });
-    var addHeaders = svrRes.headers[config.ADDITIONAL_HEAD];
+    var addHeaders = svrRes.headers[util.ADDITIONAL_HEAD];
     if (addHeaders) {
-      delete svrRes.headers[config.ADDITIONAL_HEAD];
+      delete svrRes.headers[util.ADDITIONAL_HEAD];
       if (isH2 && res.stream && typeof res.stream.additionalHeaders === 'function'
         && (addHeaders = util.parseRawJson(addHeaders))) {
         try {
@@ -1117,7 +1121,7 @@ function addClientInfo(socket, chunk, statusLine, clientIp, clientPort) {
   chunk = chunk.slice(len);
   statusLine +=
     '\r\n' +
-    config.CLIENT_INFO_HEAD +
+    config.CLIENT_INFO_HEADER +
     ': ' +
     clientIp +
     ',' +
@@ -1128,7 +1132,7 @@ function addClientInfo(socket, chunk, statusLine, clientIp, clientPort) {
     socket._remotePort;
   var tunnelData = getTunnelData(socket, clientIp, clientPort);
   if (tunnelData) {
-    statusLine += '\r\n' + config.TEMP_TUNNEL_DATA_HEADER + ': ' + encodeURIComponent(JSON.stringify(tunnelData));
+    statusLine += '\r\n' + util.TEMP_TUNNEL_DATA_HEADER + ': ' + encodeURIComponent(JSON.stringify(tunnelData));
   }
   return Buffer.concat([Buffer.from(statusLine), chunk]);
 }

package/lib/index.js

@@ -162,7 +162,7 @@ function proxy(callback, _server) {
       var clientIp = util.removeIPV6Prefix(info.srcAddr) || '127.0.0.1';
       var clientPort = info.srcPort;
       headers['x-whistle-server'] = 'socks';
-      headers[config.CLIENT_INFO_HEAD] = [clientIp, clientPort, clientIp, clientPort].join();
+      headers[config.CLIENT_INFO_HEADER] = [clientIp, clientPort, clientIp, clientPort].join();
       if (config.socksMode) {
         headers[config.WHISTLE_POLICY_HEADER] = 'weakTunnel';
       }

package/lib/init.js

@@ -4,6 +4,7 @@ var socketMgr = require('./socket-mgr');
 var config = require('./config');
 
 var HTTPS_RE = /^https:/i;
+var clientIpKey = config.CLIENT_IP_HEADER;
 
 function addErrorEvents(req, res) {
   ++util.proc.allHttpRequests;
@@ -166,36 +167,36 @@ module.exports = function (req, res, next) {
   req._remoteAddr = clientInfo[2] || util.getRemoteAddr(req);
   req._remotePort = clientInfo[3] || util.getRemotePort(req);
   if (clientIp && util.isLocalAddress(clientIp)) {
-    delete headers[config.CLIENT_IP_HEAD];
+    delete headers[clientIpKey];
     clientIp = null;
   }
-  if (!socket[config.CLIENT_IP_HEAD]) {
-    socket[config.CLIENT_IP_HEAD] = clientIp || util.getClientIp(req);
+  if (!socket[clientIpKey]) {
+    socket[clientIpKey] = clientIp || util.getClientIp(req);
   }
-  req.clientIp = clientIp = clientIp || socket[config.CLIENT_IP_HEAD];
+  req.clientIp = clientIp = clientIp || socket[clientIpKey];
   req.method = util.getMethod(req.method);
   req._clientId = util.getComposerClientId(headers);
-  var clientPort = clientInfo[1] || headers[config.CLIENT_PORT_HEAD];
-  delete headers[config.CLIENT_PORT_HEAD];
+  var clientPort = clientInfo[1] || headers[config.CLIENT_PORT_HEADER];
+  delete headers[config.CLIENT_PORT_HEADER];
   if (!(clientPort > 0)) {
     clientPort = null;
   }
-  if (!socket[config.CLIENT_PORT_HEAD]) {
-    socket[config.CLIENT_PORT_HEAD] = clientPort || socket.remotePort;
+  if (!socket[config.CLIENT_PORT_HEADER]) {
+    socket[config.CLIENT_PORT_HEADER] = clientPort || socket.remotePort;
   }
-  req.clientPort = clientPort = clientPort || socket[config.CLIENT_PORT_HEAD];
+  req.clientPort = clientPort = clientPort || socket[config.CLIENT_PORT_HEADER];
   util.handleForwardedProps(req);
   var isHttps =
     req.socket.isHttps || req.isHttps || headers[config.HTTPS_FIELD];
   if (isHttps) {
     req.isHttps = true;
     delete headers[config.HTTPS_FIELD];
-    delete headers[config.HTTPS_PROTO_HEADER];
+    delete headers[util.HTTPS_PROTO_HEADER];
   }
-  var sniPlugin = headers[config.SNI_PLUGIN_HEADER];
+  var sniPlugin = headers[util.SNI_PLUGIN_HEADER];
   if (sniPlugin) {
     req.sniPlugin = sniPlugin;
-    delete headers[config.SNI_PLUGIN_HEADER];
+    delete headers[util.SNI_PLUGIN_HEADER];
   }
   if (!req.isHttps && HTTPS_RE.test(req.url)) {
     req.isHttps = true;

package/lib/inspectors/req.js

@@ -1,5 +1,6 @@
 var qs = require('querystring');
 var iconv = require('iconv-lite');
+var net = require('net');
 var util = require('../util');
 var extend = require('extend');
 var mime = require('mime');
@@ -25,6 +26,7 @@ var LF = CRLF[1];
 var LINE = Buffer.from('-')[0];
 var UPLOAD_CTN_SEP = Buffer.from('\r\n\r\n');
 var CTN_DIS = 'Content-Disposition: form-data; name="';
+var clientIpKey = config.CLIENT_IP_HEADER;
 
 var REQ_TYPE = {
   urlencoded: 'application/x-www-form-urlencoded',
@@ -129,17 +131,18 @@ function handleReq(req, data, reqRules, delType) {
   var opList = util.parseHeaderReplace(req.rules.headerReplace).req;
   if (opList) {
     var host = req.headers.host;
-    var xff = req.headers[config.CLIENT_IP_HEAD];
-    var clientId = req.headers[config.CLIENT_ID_HEAD];
+    var xff = req.headers[clientIpKey];
+    var clientId = req.headers[config.CLIENT_ID_HEADER];
     util.handleHeaderReplace(req.headers, opList);
     if (req.headers.host !== host) {
       req._customHost = req.headers.host;
     }
-    if (xff !== req.headers[config.CLIENT_IP_HEAD]) {
-      req._customXFF = req.headers[config.CLIENT_IP_HEAD];
+    var newXFF = req.headers[clientIpKey];
+    if (xff !== newXFF && net.isIP(newXFF)) {
+      req._customXFF = newXFF;
     }
-    if (clientId !== req.headers[config.CLIENT_ID_HEAD]) {
-      req._customClientId = req.headers[config.CLIENT_ID_HEAD];
+    if (clientId !== req.headers[config.CLIENT_ID_HEADER]) {
+      req._customClientId = req.headers[config.CLIENT_ID_HEADER];
     }
   }
 }
@@ -486,8 +489,8 @@ module.exports = function (req, res, next) {
       if (data.headers) {
         data.headers = util.lowerCaseify(data.headers, req.rawHeaderNames);
         req._customHost = data.headers.host;
-        req._customXFF = data.headers[config.CLIENT_IP_HEAD];
-        req._customClientId = data.headers[config.CLIENT_ID_HEAD];
+        req._customXFF = data.headers[clientIpKey];
+        req._customClientId = data.headers[config.CLIENT_ID_HEADER];
         if (typeof data.headers['content-type'] !== 'string') {
           delete data.headers['content-type'];
         }
@@ -575,10 +578,10 @@ module.exports = function (req, res, next) {
           util.disableReqProps(req);
           handleReplace(req, replacement);
           var reqWriter = util.hasRequestBody(req)
-            ? util.getRuleFile(reqRules.reqWrite)
+            ? util.getWriteFilePath(reqRules.reqWrite)
             : null;
           util.getFileWriters(
-            [reqWriter, util.getRuleFile(reqRules.reqWriteRaw)],
+            [reqWriter, util.getWriteFilePath(reqRules.reqWriteRaw)],
             function (writer, rawWriter) {
               if (writer) {
                 req.addZipTransform(