feat: 支持客户端->waf 使用http3

Fixes #550

global/config.go

@@ -37,6 +37,7 @@ var (
 	//GCONFIG_RECORD_PATCH_VERSION_CORE  int64 = 20250106 // 核心数据库补丁日期
 	//GCONFIG_RECORD_PATCH_VERSION_LOG   int64 = 20250106 // 日志数据库补丁日期
 	GCONFIG_RECORD_ALL_SRC_BYTE_INFO int64 = 0 //记录原始信息(默认不开启)
+	GCONFIG_ENABLE_HTTP3             int64 = 0 //配置是否启用http3(默认关闭)
 
 	GCONFIG_RECORD_TOKEN_EXPIRE_MINTUTES     int64 = 5  //令牌有效期 单位分钟
 	GCONFIG_RECORD_ANNOUNCEMENT_EXPIRE_HOURS int64 = 24 //公告有效期 单位小时

go.mod

@@ -25,6 +25,7 @@ require (
 	github.com/oschwald/geoip2-golang v1.11.0
 	github.com/pires/go-proxyproto v0.8.1
 	github.com/pquerna/otp v1.5.0
+	github.com/quic-go/quic-go v0.57.0
 	github.com/samwafgo/ahocorasick v1.0.0
 	github.com/samwafgo/cap_go_server v1.0.0
 	github.com/samwafgo/go-wxsqlite3 v1.0.1
@@ -114,6 +115,7 @@ require (
 	github.com/pjbgf/sha1cd v0.3.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
+	github.com/quic-go/qpack v0.6.0 // indirect
 	github.com/richardlehane/mscfb v1.0.4 // indirect
 	github.com/richardlehane/msoleps v1.0.4 // indirect
 	github.com/robfig/cron/v3 v3.0.1 // indirect

go.sum

@@ -300,6 +300,10 @@ github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:Om
 github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
 github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
+github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
+github.com/quic-go/quic-go v0.57.0 h1:AsSSrrMs4qI/hLrKlTH/TGQeTMY0ib1pAOX7vA3AdqE=
+github.com/quic-go/quic-go v0.57.0/go.mod h1:ly4QBAjHA2VhdnxhojRsCUOeJwKYg+taDlos92xb1+s=
 github.com/richardlehane/mscfb v1.0.4 h1:WULscsljNPConisD5hR0+OyZjwK46Pfyr6mPu5ZawpM=
 github.com/richardlehane/mscfb v1.0.4/go.mod h1:YzVpcZg9czvAuhk9T+a3avCpcFPMUWm7gK3DypaEsUk=
 github.com/richardlehane/msoleps v1.0.1/go.mod h1:BWev5JBpU9Ko2WAgmZEuiz4/u3ZYTKbjLycmwiWUfWg=
@@ -420,6 +424,8 @@ go.mongodb.org/mongo-driver v1.13.1 h1:YIc7HTYsKndGK4RFzJ3covLz1byri52x0IoMB0Pt/
 go.mongodb.org/mongo-driver v1.13.1/go.mod h1:wcDf1JBCXy2mOW0bWHwO/IOYqdca1MPCwDtFu/Z9+eo=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
+go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=

innerbean/server_runtime.go

@@ -1,6 +1,10 @@
 package innerbean
 
-import "net/http"
+import (
+	"net/http"
+
+	"github.com/quic-go/quic-go/http3"
+)
 
 type ServerRunTime struct {
 	//tcp http https
@@ -8,4 +12,5 @@ type ServerRunTime struct {
 	Port       int
 	Status     int // 0 是启动完成 ，1 是新增，2 是编辑 3，是删除
 	Svr        *http.Server
+	H3         *http3.Server
 }

wafenginecore/wafengine.go

@@ -38,6 +38,7 @@ import (
 	"time"
 
 	"github.com/pires/go-proxyproto"
+	"github.com/quic-go/quic-go/http3"
 	goahocorasick "github.com/samwafgo/ahocorasick"
 	"go.uber.org/zap"
 	"golang.org/x/time/rate"
@@ -1317,6 +1318,45 @@ func (waf *WafEngine) StartProxyServer(innruntime innerbean.ServerRunTime) {
 				waf.ServerOnline.Set(innruntime.Port, serclone)
 				zlog.Info("启动HTTPS 服务器" + strconv.Itoa(innruntime.Port))
 
+				if global.GCONFIG_ENABLE_HTTP3 == 1 {
+					h3 := &http3.Server{
+						Addr:      ":" + strconv.Itoa(innruntime.Port),
+						Handler:   waf,
+						TLSConfig: svr.TLSConfig,
+					}
+					svr.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+						h3.SetQUICHeaders(w.Header())
+						waf.ServeHTTP(w, r)
+					})
+					go func() {
+						defer func() {
+							e := recover()
+							if e != nil { // 捕获该协程的panic
+								zlog.Warn("https recover ", e)
+							}
+						}()
+						zlog.Info("启动HTTPS 3 服务器" + strconv.Itoa(innruntime.Port))
+						serclone.H3 = h3
+						err := h3.ListenAndServe()
+						if err == http.ErrServerClosed {
+							zlog.Error("[HTTP3Server] https server has been close, cause:[%v]", err)
+						} else {
+							wafSysLog := model.WafSysLog{
+								BaseOrm: baseorm.BaseOrm{
+									Id:          uuid.GenUUID(),
+									USER_CODE:   global.GWAF_USER_CODE,
+									Tenant_ID:   global.GWAF_TENANT_ID,
+									CREATE_TIME: customtype.JsonTime(time.Now()),
+									UPDATE_TIME: customtype.JsonTime(time.Now()),
+								},
+								OpType:    "系统运行错误",
+								OpContent: "HTTPS3端口被占用: " + strconv.Itoa(innruntime.Port) + ",请检查",
+							}
+							global.GQEQUE_LOG_DB.Enqueue(&wafSysLog)
+						}
+					}()
+				}
+
 				ln, err := net.Listen("tcp", svr.Addr)
 				if err != nil {
 					zlog.Error("https listen fail", err.Error())
@@ -1411,6 +1451,9 @@ func (waf *WafEngine) StopProxyServer(v innerbean.ServerRunTime) {
 	if v.Svr != nil {
 		v.Svr.Close()
 	}
+	if v.H3 != nil {
+		v.H3.Close()
+	}
 }
 func (waf *WafEngine) ClearCcWindows() {
 	// 清理所有主机的IP限流器记录

waftask/task_config.go

@@ -123,6 +123,8 @@ func setConfigIntValue(name string, value int64, change int) {
 	case "check_beta_version":
 		global.GCONFIG_CHECK_BETA_VERSION = value
 		break
+	case "http3":
+		global.GCONFIG_ENABLE_HTTP3 = value
 	default:
 		zlog.Warn("Unknown config item:", name)
 	}
@@ -271,6 +273,7 @@ func TaskLoadSetting(initLoad bool) {
 
 	updateConfigIntItem(initLoad, "network", "connect_time_out", global.GCONFIG_RECORD_CONNECT_TIME_OUT, "连接超时（默认30s）", "int", "", configMap)
 	updateConfigIntItem(initLoad, "network", "keepalive_time_out", global.GCONFIG_RECORD_KEEPALIVE_TIME_OUT, "保持活动超时（默认30s）", "int", "", configMap)
+	updateConfigIntItem(initLoad, "network", "http3", global.GCONFIG_ENABLE_HTTP3, "是否启用http3（1启用 0关闭）", "int", "", configMap)
 
 	updateConfigIntItem(initLoad, "system", "record_all_src_byte_info", global.GCONFIG_RECORD_ALL_SRC_BYTE_INFO, "启动记录原始请求BODY报文（1启动 0关闭）", "int", "", configMap)
 	updateConfigIntItem(initLoad, "system", "token_expire_time", global.GCONFIG_RECORD_TOKEN_EXPIRE_MINTUTES, "管理平台令牌有效期，单位分钟（默认5分钟）", "int", "", configMap)