{

// 去掉前后空白.

range = strutil::remove_spaces(range);

// range 必须以 bytes= 开头, 否则返回空数组.

if (!range.starts_with("bytes="))

return {};

// 去掉开头的 bytes= 字符串 (不区分大小写).

static constexpr std::string_view bytes_prefix = "bytes=";

range.erase(0, bytes_prefix.size());

http_ranges results;

// 获取其中所有 range 字符串.

auto ranges = strutil::split(range, ",");

for (const auto& str : ranges)

{

auto r = strutil::split(std::string(str), "-");

// range 只有一个数值.

if (r.size() == 1)

{

if (str.empty())

{

results.emplace_back(0, -1);

}

else if (str.front() == '-')

{

auto pos = std::atoll(r.front().data());

results.emplace_back(-1, pos);

}

else

{

auto pos = std::atoll(r.front().data());

results.emplace_back(pos, -1);

}

continue;

}

if (r.size() == 2)

{

// range 有 start 和 end 的情况, 解析成整数到容器.

auto& start_str = r[0];

auto& end_str = r[1];

if (start_str.empty() && !end_str.empty())

{

auto end = std::atoll(end_str.data());

results.emplace_back(-1, end);

}

else

{

auto start = std::atoll(start_str.data());

auto end = std::atoll(end_str.data());

if (end_str.empty())

end = -1;

results.emplace_back(start, end);

}

continue;

}

// 在一个 range 项中不应该存在3个或以上的'-', 这属于无效的范围请求.

return {};

}

return results;

{

if (range.size() != 1)

return { -1, -1, http::status::ok };

auto& r = range.front();

int64_t offset = r.first;

int64_t end = r.second;

// 起始位置为 -1, 表示从文件末尾开始读取, 例如 Range: -500

// 则表示读取文件末尾的 500 字节.

if (offset == -1)

{

// 如果第二个参数也为 -1, 则表示请求有问题, 返回 416.

if (r.second < 0)

return { offset, end, http::status::range_not_satisfiable };

// 计算起始位置和结束位置, 例如 Range: -5

// 则表示读取文件末尾的 5 字节.

// content_length - r.second 表示起始位置.

// content_length - 1 表示结束位置.

// 例如文件长度为 10 字节, 则起始位置为 5,

// 结束位置为 9(数据总长度为[0-9]), 一共 5 字节.

offset = content_length - r.second;

end = content_length - 1;

}

else if (end == -1)

{

// 起始位置为正数, 表示从文件头开始读取, 例如 Range: 500

// 则表示读取文件头的 500 字节.

if (r.first < 0)

return { offset, end, http::status::range_not_satisfiable };

offset = r.first;

end = content_length - 1;

}

if (offset == -1)

return { offset, end, http::status::ok };

return { offset, end, http::status::partial_content };

{

switch (code)

{

case PROXY_AUTH_SUCCESS:

return "auth success";

case PROXY_AUTH_FAILED:

return "auth failed";

case PROXY_AUTH_NONE:

return "auth none";

case PROXY_AUTH_ILLEGAL:

return "auth illegal";

default:

return "auth unknown";

}

{

if (addr.empty())

return;

boost::system::error_code ec;

auto bind_if = net::ip::make_address(addr, ec);

if (ec)

{

// bind 地址有问题, 忽略 bind 参数, 并输出日志.

log_conn_warning()

<< ", bind address: " << addr

<< ", invalid: " << ec.message();

}

else

{

m_bind_interface = bind_if;

}

{

// 缓存 date string 以避免频繁调用 time/gmtime/strftime.

// 每秒刷新一次即可满足 HTTP Date 头精度要求.

// 使用 mutex 保护静态变量, 防止多协程并发访问导致数据竞争.

static std::string cached;

static std::chrono::steady_clock::time_point last_update;

static std::mutex mtx;

auto now = std::chrono::steady_clock::now();

{

std::lock_guard<std::mutex> lock(mtx);

if (now - last_update >= std::chrono::seconds(1))

{

auto time = std::time(nullptr);

auto gmt = gmtime((const time_t*)&time);

cached.resize(64, '\0');

auto ret = strftime(cached.data(), 64, "%a, %d %b %Y %H:%M:%S GMT", gmt);

cached.resize(ret);

last_update = now;

}

return cached;

}

{

// 在这里使用用户指定的速率设置替换全局速率配置.

auto found = m_option.users_rate_limit_.find(user);

if (found != m_option.users_rate_limit_.end())

{

auto& rate = *found;

m_option.tcp_rate_limit_ = rate.second;

}

{

boost::variant2::visit([](auto& s) mutable

{

using ValueType = std::decay_t<decltype(s)>;

using NextLayerType = util::proxy_tcp_socket::next_layer_type;

if constexpr (std::same_as<NextLayerType, util::tcp_socket>)

{

if constexpr (std::same_as<util::proxy_tcp_socket, ValueType>)

{

auto& next_layer = s.next_layer();

next_layer.expires_never();

}

else if constexpr (std::same_as<util::ssl_tcp_stream, ValueType>)

{

auto& next_layer = s.next_layer().next_layer();

next_layer.expires_never();

}

}

}, stream);

variant_stream_type& stream, net::steady_timer::duration expiry_time) noexcept

{

if (expiry_time.count() < 0)

return;

boost::variant2::visit([expiry_time](auto& s) mutable

{

using ValueType = std::decay_t<decltype(s)>;

using NextLayerType = util::proxy_tcp_socket::next_layer_type;

if constexpr (std::same_as<NextLayerType, util::tcp_socket>)

{

if constexpr (std::same_as<util::proxy_tcp_socket, ValueType>)

{

auto& next_layer = s.next_layer();

next_layer.expires_after(expiry_time);

}

else if constexpr (std::same_as<util::ssl_tcp_stream, ValueType>)

{

auto& next_layer = s.next_layer().next_layer();

next_layer.expires_after(expiry_time);

}

}

}, stream);

{

boost::variant2::visit([rate](auto& s) mutable

{

using ValueType = std::decay_t<decltype(s)>;

using NextLayerType = proxy_tcp_socket::next_layer_type;

if constexpr (std::same_as<NextLayerType, tcp_socket>)

{

if constexpr (std::same_as<proxy_tcp_socket, ValueType>)

{

auto& next_layer = s.next_layer();

next_layer.rate_limit(rate);

}

else if constexpr (std::same_as<ssl_tcp_stream, ValueType>)

{

auto& next_layer = s.next_layer().next_layer();

next_layer.rate_limit(rate);

}

}

}, stream);

struct pam_response **resp, void *appdata_ptr)

{

if (num_msg <= 0 || num_msg > PAM_MAX_NUM_MSG)

return PAM_CONV_ERR;

*resp = (struct pam_response *)std::calloc(num_msg, sizeof(struct pam_response));

if (*resp == nullptr)

return PAM_BUF_ERR;

const char *password = (const char *)appdata_ptr;

for (int i = 0; i < num_msg; i++)

{

if (msg[i]->msg_style == PAM_PROMPT_ECHO_OFF)

{

(*resp)[i].resp = strdup(password);

(*resp)[i].resp_retcode = 0;

}

else

{

(*resp)[i].resp = nullptr;

}

}

return PAM_SUCCESS;

{

pam_handle_t *pamh = nullptr;

struct pam_conv conv = {

.conv = pam_conv_func,

.appdata_ptr = (void *)password // 传入密码

};

int retval = pam_start(service, username, &conv, &pamh);

if (retval != PAM_SUCCESS)

{

log_conn_warning() << ", pam_start failed: " << pam_strerror(pamh, retval);

return false;

}

retval = pam_authenticate(pamh, 0); // 核心认证

if (retval != PAM_SUCCESS) {

log_conn_warning() << ", authentication failed: " << pam_strerror(pamh, retval);

pam_end(pamh, retval);

return false;

}

retval = pam_acct_mgmt(pamh, 0); // 检查账户（如锁定、过期）

if (retval != PAM_SUCCESS) {

log_conn_warning() << ", account management failed: " << pam_strerror(pamh, retval);

pam_end(pamh, retval);

return false;

}

pam_end(pamh, PAM_SUCCESS);

log_conn_debug() << ", pam_authenticate_user success";

return true;

{

if (!m_option.auth_users_.empty())

return true;

if (!m_option.pam_auth_.empty())

return true;

return false;

const std::string& username,

const std::string& passwd, bool skip_passwd) noexcept

{

// 若不需要认证, 直接返回 true.

if (!auth_required())

co_return true;

// 检查用户名和密码是否匹配.

for (const auto& [user, pwd, addr, proxy_pass] : m_option.auth_users_)

{

if (username == user)

{

if (!skip_passwd && passwd != pwd)

continue;

user_rate_limit_config(user);

update_bind_interface(addr);

if (proxy_pass)

m_proxy_pass = proxy_pass;

co_return true;

}

}

// 如果启用了 PAM 认证, 则尝试使用 PAM 认证.

if (!skip_passwd && !m_option.pam_auth_.empty())

{

#ifdef USE_PAM_AUTH

boost::system::error_code ec;

auto result = co_await async_pam_auth(username, passwd,

m_option.pam_auth_, net_awaitable[ec]);

if (result)

{

user_rate_limit_config(username);

co_return true;

}

#endif

}

co_return false;

{

auto server = m_proxy_server.lock();

if (!server)

return;

// 保存 server 的参数选项.

m_option = server->option();

// 将 local_ip 转换为 ip::address 对象, 用于后面向外发起连接时

// 绑定到指定的本地地址.

boost::system::error_code ec;

m_bind_interface = net::ip::make_address(m_option.local_ip_, ec);

if (ec)

{

// bind 地址有问题, 忽略bind参数.

m_bind_interface.reset();

}

// 如果指定了 proxy_pass_ 参数, 则记录这个参数, 在后面若用户又特指了更具体的

// proxy_pass, 则在 check_userpasswd 中更新 m_proxy_pass 为用户特定的

// proxy_pass.

m_proxy_pass = m_option.proxy_pass_;

// 保持 self 对象指针, 以防止在协程完成后 this 被销毁.

auto self = this->shared_from_this();

// 如果是透明代理, 则启动透明代理协程.

if (m_tproxy_remote)

{

net::co_spawn(m_executor,

[this, self]() -> net::awaitable<void>

{

co_await transparent_proxy();

co_return;

}, net::detached);

return;

}

// 如果是 stdio proxy, 则启动 stdio proxy 协程.

if (!m_option.stdio_target_.empty())

{

net::co_spawn(m_executor,

[this, self]() -> net::awaitable<void>

{

co_await stdio_proxy();

co_return;

}, net::detached);

return;

}

// 启动协议侦测协程.

net::co_spawn(m_executor,

[this, self]() -> net::awaitable<void>

{

if (boost::variant2::holds_alternative<proxy_tcp_socket>(m_local_socket))

{

co_await proto_detect<proxy_tcp_socket>();

}

else if (boost::variant2::holds_alternative<proxy_uds_socket>(m_local_socket))

{

co_await proto_detect<proxy_uds_socket>();

}

co_return;

}, net::detached);

{

if (m_abort)

return;

m_abort = true;

boost::system::error_code ignore_ec;

// 关闭所有 socket.

m_local_socket.close(ignore_ec);

m_remote_socket.close(ignore_ec);

{

log_conn_debug()

<< ", tproxy setup: " << tproxy_remote;

m_tproxy_remote = tproxy_remote;

{

auto executor = co_await net::this_coro::executor;

boost::system::error_code ec;

if (m_option.stdio_target_.empty())

{

log_conn_error() << ", stdio proxy requires a stdio_target";

co_return;

}

try

{

boost::system::result<url_info> expect_url;

std::string url = m_option.stdio_target_;

if (url.find("://") == std::string::npos)

url = "http://" + url;

expect_url = parse_urlinfo(url);

if (expect_url.has_error())

{

log_conn_error() << ", stdio proxy param stdio target is bad: " << url;

co_return;

}

auto [scheme, user, passwd, host, port, resource] = *expect_url;

// 查询 stdio_target_ 目标服务器的域名信息.

auto targets = co_await resolve_proxy_pass_targets();

// 创建 tcp socket 用于连接到目标服务器.

tcp::socket& remote_socket = net_tcp_socket(m_remote_socket);

// 发起连接到 stdio_target_ 目标服务器.

ec = co_await connect_proxy_pass(remote_socket, targets);

if (ec)

co_return;

// 与网关中继服务器握手.

ec = co_await proxy_pass_handshake(remote_socket,

std::string(host),

port,

*m_proxy_pass);

if (ec)

co_return;

size_t l2r_transferred = 0;

size_t r2l_transferred = 0;

#if defined(BOOST_ASIO_HAS_POSIX_STREAM_DESCRIPTOR)

net::posix::stream_descriptor stream_stdout(m_executor, ::dup(STDOUT_FILENO));

stdio_stream stream(std::move(stream_stdout));

auto out = init_proxy_stream(std::move(stream));

auto& in = m_local_socket;

// 并发读写, 在 local 和 remote 之间互传数据.

co_await(

transfer(in, m_remote_socket, l2r_transferred)

&&

transfer(m_remote_socket, out, r2l_transferred)

);

#else

auto in_executor = boost::variant2::get<stdio_stream>(m_local_socket).get_in_executor();

auto out_executor = boost::variant2::get<stdio_stream>(m_local_socket).get_out_executor();

stdio_stream stream(in_executor, out_executor);

auto out = init_proxy_stream(std::move(stream));

auto& in = m_local_socket;

auto self = shared_from_this();

net::co_spawn(in_executor,

[this, self, &in, &l2r_transferred]() mutable -> net::awaitable<void>

{

boost::system::error_code ec;

constexpr size_t buf_size = 4096;

char buf[buf_size]{ 0 };

while (!m_abort)

{

DWORD read_bytes = 0;

read_bytes = (DWORD)co_await in.async_read_some(

net::buffer(buf, buf_size), net_awaitable[ec]);

if (ec)

break;

co_await net::async_write(

m_remote_socket,

net::buffer(buf, read_bytes),

net_awaitable[ec]);

if (ec)

break;

l2r_transferred += read_bytes;

}

co_return;

}, net::detached);

co_await net::co_spawn(out_executor,

[this, self, &out, &r2l_transferred]() mutable -> net::awaitable<void>

{

boost::system::error_code ec;

constexpr size_t buf_size = 4096;

char buf[buf_size]{ 0 };

while (!m_abort)

{

DWORD read_bytes = (DWORD)co_await m_remote_socket.async_read_some(

net::buffer(buf, buf_size), net_awaitable[ec]);

if (ec)

break;

co_await net::async_write(

out,

net::buffer(buf, read_bytes),

net_awaitable[ec]);

if (ec)

break;

r2l_transferred += read_bytes;

}

co_return;

}, net::deferred);

#endif

log_conn_debug()

<< ", transfer completed"

<< ", local to remote: "

<< l2r_transferred

<< ", remote to local: "

<< r2l_transferred;

}

catch (const std::exception& e)

{

log_conn_error() << ", stdio_proxy exception: " << e.what();

}

co_return;

{

auto executor = co_await net::this_coro::executor;

boost::system::error_code ec;

if (!m_proxy_pass)

{

XLOG_ERR << "transparent proxy requires a proxy_pass";

co_return;

}

try

{

tcp::socket& remote_socket = net_tcp_socket(m_remote_socket);

// 查询网关代理中继服务器域名信息.

auto targets = co_await resolve_proxy_pass_targets();

// 发起连接到网关代理中继服务器.

ec = co_await connect_proxy_pass(remote_socket, targets);

if (ec)

co_return;

// 与网关中继服务器握手.

ec = co_await proxy_pass_handshake(remote_socket,

m_tproxy_remote->address().to_string(),

m_tproxy_remote->port(),

*m_proxy_pass);

if (ec)

co_return;

co_await concurrent_transfer();

}

catch (const std::exception& e)

{

log_conn_error()

<< ", transparent_proxy exception: " << e.what();

}

co_return;

{

// read

// +----+----------+----------+

// |VER | NMETHODS | METHODS |

// +----+----------+----------+

// | 1 | 1 | 1 to 255 |

// +----+----------+----------+

// [ ]

// or

// +----+----+----+----+----+----+----+----+----+----+....+----+

// | VN | CD | DSTPORT | DSTIP | USERID |NULL|

// +----+----+----+----+----+----+----+----+----+----+....+----+

// 1 1 2 4 variable 1

// [ ]

// 读取[]里的部分.

boost::system::error_code ec;

[[maybe_unused]] auto bytes =

co_await net::async_read(

m_local_socket,

m_local_buffer,

net::transfer_exactly(2),

net_awaitable[ec]);

if (ec)

{

log_conn_error()

<< ", read socks version: "

<< ec.message();

co_return;

}

BOOST_ASSERT(bytes == 2);

auto p = (const char*)m_local_buffer.data().data();

int socks_version = read<uint8_t>(p);

if (socks_version == SOCKS_VERSION_5)

{

if (m_option.disable_socks_)

{

log_conn_debug()

<< ", socks5 protocol disabled";

co_return;

}

log_conn_debug()