mirror of
https://github.com/Buriburizaem0n/nezha_domains.git
synced 2026-09-19 09:40:12 +00:00
* test: TDD regression tests for GHSA-jx78-55p5-rwv5 stream quota enforcement * Apply remaining changes * fix: update action SHA allowlist and test assertions to match dependabot bump * fix: close GHSA-jx78-55p5-rwv5 incomplete fix of GHSA-qjpp-gffx-2wm9 Finding 1 (Moderate): nil-guard reporterServer in delayCheck and notifyCheck. ServerShared has its own lock independent of serviceResponseDataStoreLock, so m := ServerShared.GetList() taken inside the worker can return a nil entry for the reporter if the server was concurrently deleted. Previously this caused an unrecovered SIGSEGV in the worker goroutine (and in the gRPC layer with no recovery interceptor), taking down the whole instance. Finding 2 (Low): nil-guard ss.services[id] in ServiceSentinel.Delete(). A caller-supplied id that is absent from the registry caused ss.services[id].CronJobID to panic, aborting the Delete loop and leaving every subsequent valid id as a zombie service (DB row deleted, in-memory entry kept, cron probe still running). Regression tests added for both findings following the existing servicesentinel_lifecycle_test.go patterns. * Apply remaining changes * chore: replace commit hashes with version tags in test.yml * fix(server): serialize authoritative lifecycle changes Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * fix(service): bind reports to reporter lifecycle Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * fix(rpc): reject results from stale task streams Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * fix(agentcompat): allow version-tagged actions * fix(agentcompat): allow literal checkout refs * refactor(agentcompat): remove SHA resolver policy * test(agentcompat): remove resolver SHA fixtures * test(agentcompat): remove mutable ref fixtures * test(agentcompat): use tagged actions in secure fixtures * test(agentcompat): update credential fixtures for tags * test(agentcompat): update reusable action fixtures * test(agentcompat): update artifact redaction fixtures * test(agentcompat): finish artifact fixture tag migration * test(agentcompat): update workflow validation fixtures * test(agentcompat): update dependency workflow fixture * ci(agentcompat): stop pinning cross-repository revisions --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: naiba <hi@nai.ba> Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
204 lines
4.3 KiB
Go
204 lines
4.3 KiB
Go
package singleton
|
|
|
|
import (
|
|
"cmp"
|
|
"context"
|
|
"log"
|
|
"slices"
|
|
"strings"
|
|
"sync"
|
|
|
|
"github.com/nezhahq/nezha/model"
|
|
"github.com/nezhahq/nezha/pkg/ddns"
|
|
"github.com/nezhahq/nezha/pkg/utils"
|
|
)
|
|
|
|
type ServerClass struct {
|
|
class[uint64, *model.Server]
|
|
|
|
// lifecycleMu serializes changes to the authoritative server entries with
|
|
// synchronous ServiceSentinel report processing.
|
|
lifecycleMu sync.RWMutex
|
|
|
|
uuidToID map[string]uint64
|
|
|
|
sortedListForGuest []*model.Server
|
|
}
|
|
|
|
func NewServerClass() *ServerClass {
|
|
sc := &ServerClass{
|
|
class: class[uint64, *model.Server]{
|
|
list: make(map[uint64]*model.Server),
|
|
},
|
|
uuidToID: make(map[string]uint64),
|
|
}
|
|
|
|
var servers []model.Server
|
|
DB.Find(&servers)
|
|
for i := range servers {
|
|
innerS := &servers[i]
|
|
model.InitServer(innerS)
|
|
sc.list[innerS.ID] = innerS
|
|
sc.uuidToID[innerS.UUID] = innerS.ID
|
|
}
|
|
sc.sortList()
|
|
|
|
model.OwnerServerIDsLookup = sc.ownerServerIDs
|
|
model.AllServerIDsLookup = sc.allServerIDs
|
|
model.OwnerIsAdminLookup = ownerIsAdmin
|
|
|
|
return sc
|
|
}
|
|
|
|
func (c *ServerClass) ownerServerIDs(ownerUID uint64) []uint64 {
|
|
var ids []uint64
|
|
c.Range(func(id uint64, s *model.Server) bool {
|
|
if s != nil && s.GetUserID() == ownerUID {
|
|
ids = append(ids, id)
|
|
}
|
|
return true
|
|
})
|
|
return ids
|
|
}
|
|
|
|
func (c *ServerClass) allServerIDs() []uint64 {
|
|
var ids []uint64
|
|
c.Range(func(id uint64, s *model.Server) bool {
|
|
if s != nil {
|
|
ids = append(ids, id)
|
|
}
|
|
return true
|
|
})
|
|
return ids
|
|
}
|
|
|
|
func ownerIsAdmin(ownerUID uint64) bool {
|
|
return userIsAdmin(ownerUID)
|
|
}
|
|
|
|
func (c *ServerClass) lockLifecycleRead() {
|
|
c.lifecycleMu.RLock()
|
|
}
|
|
|
|
func (c *ServerClass) unlockLifecycleRead() {
|
|
c.lifecycleMu.RUnlock()
|
|
}
|
|
|
|
func (c *ServerClass) lockLifecycleWrite() {
|
|
c.lifecycleMu.Lock()
|
|
}
|
|
|
|
func (c *ServerClass) unlockLifecycleWrite() {
|
|
c.lifecycleMu.Unlock()
|
|
}
|
|
|
|
func (c *ServerClass) Update(s *model.Server, uuid string) {
|
|
c.lockLifecycleWrite()
|
|
defer c.unlockLifecycleWrite()
|
|
|
|
c.listMu.Lock()
|
|
|
|
c.list[s.ID] = s
|
|
if uuid != "" {
|
|
c.uuidToID[uuid] = s.ID
|
|
}
|
|
|
|
c.listMu.Unlock()
|
|
|
|
if s.EnableDDNS {
|
|
if err := c.UpdateDDNS(s, nil); err != nil {
|
|
log.Printf("NEZHA>> Failed to update DDNS for server %d: %v", err, s.ID)
|
|
}
|
|
}
|
|
|
|
c.sortList()
|
|
}
|
|
|
|
func (c *ServerClass) Delete(idList []uint64) {
|
|
c.lockLifecycleWrite()
|
|
defer c.unlockLifecycleWrite()
|
|
|
|
c.listMu.Lock()
|
|
|
|
for _, id := range idList {
|
|
s, ok := c.list[id]
|
|
if !ok {
|
|
continue
|
|
}
|
|
delete(c.uuidToID, s.UUID)
|
|
delete(c.list, id)
|
|
}
|
|
|
|
c.listMu.Unlock()
|
|
|
|
c.sortList()
|
|
}
|
|
|
|
// setUserID updates in-memory ownership under the server lifecycle lock so a
|
|
// transfer cannot change authorization during synchronous report processing.
|
|
func (c *ServerClass) setUserID(id, userID uint64) {
|
|
c.lockLifecycleWrite()
|
|
defer c.unlockLifecycleWrite()
|
|
|
|
if s, ok := c.Get(id); ok && s != nil {
|
|
s.SetUserID(userID)
|
|
}
|
|
}
|
|
|
|
func (c *ServerClass) GetSortedListForGuest() []*model.Server {
|
|
c.sortedListMu.RLock()
|
|
defer c.sortedListMu.RUnlock()
|
|
|
|
return slices.Clone(c.sortedListForGuest)
|
|
}
|
|
|
|
func (c *ServerClass) UUIDToID(uuid string) (id uint64, ok bool) {
|
|
c.listMu.RLock()
|
|
defer c.listMu.RUnlock()
|
|
|
|
id, ok = c.uuidToID[uuid]
|
|
return
|
|
}
|
|
|
|
func (c *ServerClass) UpdateDDNS(server *model.Server, ip *model.IP) error {
|
|
confServers := strings.Split(Conf.DNSServers, ",")
|
|
ctx := context.WithValue(context.Background(), ddns.DNSServerKey{}, utils.IfOr(confServers[0] != "", confServers, utils.DNSServers))
|
|
|
|
providers, err := DDNSShared.GetDDNSProvidersFromProfiles(server.DDNSProfiles, utils.IfOr(ip != nil, ip, &server.GeoIP.IP), server.GetUserID())
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
for _, provider := range providers {
|
|
domains := server.OverrideDDNSDomains[provider.GetProfileID()]
|
|
go func(provider *ddns.Provider) {
|
|
provider.UpdateDomain(ctx, domains...)
|
|
}(provider)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (c *ServerClass) sortList() {
|
|
c.listMu.RLock()
|
|
defer c.listMu.RUnlock()
|
|
c.sortedListMu.Lock()
|
|
defer c.sortedListMu.Unlock()
|
|
|
|
c.sortedList = utils.MapValuesToSlice(c.list)
|
|
// 按照服务器 ID 排序的具体实现(ID越大越靠前)
|
|
slices.SortStableFunc(c.sortedList, func(a, b *model.Server) int {
|
|
if a.DisplayIndex == b.DisplayIndex {
|
|
return cmp.Compare(a.ID, b.ID)
|
|
}
|
|
return cmp.Compare(b.DisplayIndex, a.DisplayIndex)
|
|
})
|
|
|
|
c.sortedListForGuest = make([]*model.Server, 0, len(c.sortedList))
|
|
for _, s := range c.sortedList {
|
|
if !s.HideForGuest {
|
|
c.sortedListForGuest = append(c.sortedListForGuest, s)
|
|
}
|
|
}
|
|
}
|