3f0017d1f1
主要改动： - 固定 Go 1.25.5 与 CI 校验并更新扫描流程 - 升级 quic-go、x/crypto、req 等依赖并通过 govulncheck - 强化 JWT 校验、TLS 配置与 xlsx 动态加载 - 新增审计豁免清单与校验脚本
100 lines
2.6 KiB
Go
100 lines
2.6 KiB
Go
package repository
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
"log"
|
|
"net/http"
|
|
"time"
|
|
|
|
"github.com/Wei-Shaw/sub2api/internal/config"
|
|
"github.com/Wei-Shaw/sub2api/internal/pkg/httpclient"
|
|
"github.com/Wei-Shaw/sub2api/internal/service"
|
|
)
|
|
|
|
func NewProxyExitInfoProber(cfg *config.Config) service.ProxyExitInfoProber {
|
|
insecure := false
|
|
allowPrivate := false
|
|
validateResolvedIP := true
|
|
if cfg != nil {
|
|
insecure = cfg.Security.ProxyProbe.InsecureSkipVerify
|
|
allowPrivate = cfg.Security.URLAllowlist.AllowPrivateHosts
|
|
validateResolvedIP = cfg.Security.URLAllowlist.Enabled
|
|
}
|
|
if insecure {
|
|
log.Printf("[ProxyProbe] Warning: insecure_skip_verify is not allowed and will cause probe failure.")
|
|
}
|
|
return &proxyProbeService{
|
|
ipInfoURL: defaultIPInfoURL,
|
|
insecureSkipVerify: insecure,
|
|
allowPrivateHosts: allowPrivate,
|
|
validateResolvedIP: validateResolvedIP,
|
|
}
|
|
}
|
|
|
|
const defaultIPInfoURL = "https://ipinfo.io/json"
|
|
|
|
type proxyProbeService struct {
|
|
ipInfoURL string
|
|
insecureSkipVerify bool
|
|
allowPrivateHosts bool
|
|
validateResolvedIP bool
|
|
}
|
|
|
|
func (s *proxyProbeService) ProbeProxy(ctx context.Context, proxyURL string) (*service.ProxyExitInfo, int64, error) {
|
|
client, err := httpclient.GetClient(httpclient.Options{
|
|
ProxyURL: proxyURL,
|
|
Timeout: 15 * time.Second,
|
|
InsecureSkipVerify: s.insecureSkipVerify,
|
|
ProxyStrict: true,
|
|
ValidateResolvedIP: s.validateResolvedIP,
|
|
AllowPrivateHosts: s.allowPrivateHosts,
|
|
})
|
|
if err != nil {
|
|
return nil, 0, fmt.Errorf("failed to create proxy client: %w", err)
|
|
}
|
|
|
|
startTime := time.Now()
|
|
req, err := http.NewRequestWithContext(ctx, "GET", s.ipInfoURL, nil)
|
|
if err != nil {
|
|
return nil, 0, fmt.Errorf("failed to create request: %w", err)
|
|
}
|
|
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return nil, 0, fmt.Errorf("proxy connection failed: %w", err)
|
|
}
|
|
defer func() { _ = resp.Body.Close() }()
|
|
|
|
latencyMs := time.Since(startTime).Milliseconds()
|
|
|
|
if resp.StatusCode != http.StatusOK {
|
|
return nil, latencyMs, fmt.Errorf("request failed with status: %d", resp.StatusCode)
|
|
}
|
|
|
|
var ipInfo struct {
|
|
IP string `json:"ip"`
|
|
City string `json:"city"`
|
|
Region string `json:"region"`
|
|
Country string `json:"country"`
|
|
}
|
|
|
|
body, err := io.ReadAll(resp.Body)
|
|
if err != nil {
|
|
return nil, latencyMs, fmt.Errorf("failed to read response: %w", err)
|
|
}
|
|
|
|
if err := json.Unmarshal(body, &ipInfo); err != nil {
|
|
return nil, latencyMs, fmt.Errorf("failed to parse response: %w", err)
|
|
}
|
|
|
|
return &service.ProxyExitInfo{
|
|
IP: ipInfo.IP,
|
|
City: ipInfo.City,
|
|
Region: ipInfo.Region,
|
|
Country: ipInfo.Country,
|
|
}, latencyMs, nil
|
|
}
|