229 lines
8.6 KiB
C#
229 lines
8.6 KiB
C#
using System.Net;
|
||
using System.Text.Json;
|
||
using MoShiro.Protocol;
|
||
|
||
namespace MoShiro.Measurement;
|
||
|
||
/// <summary>节点的本地硬上限（写在本机配置里，Backend 无法修改）。</summary>
|
||
public sealed class NodeLimits
|
||
{
|
||
public double MaxTotalMbps { get; init; } = 1200;
|
||
|
||
public long MaxTotalPps { get; init; } = 20_000;
|
||
|
||
/// <summary>目标任务允许访问的网段；默认为空，即不开放任何目标任务。</summary>
|
||
public IReadOnlyList<string> AllowedTargetCidrs { get; init; } = [];
|
||
|
||
public int MaxConcurrentTests { get; init; } = 1;
|
||
|
||
/// <summary>任务参数里的 <c>port</c> 只能取这些端口（本机配置的 listen 列表）。</summary>
|
||
public IReadOnlyList<int> AllowedQuicPorts { get; init; } = [7443];
|
||
|
||
public IReadOnlyList<int> AllowedTcpPorts { get; init; } = [7444];
|
||
}
|
||
|
||
/// <summary>被拒绝的原因，用于 <c>rejected[]</c>：<c>unsupported</c>、<c>invalid_params</c>、<c>budget_exceeded</c>、<c>policy_denied</c>。</summary>
|
||
public static class RejectReasons
|
||
{
|
||
public const string Unsupported = "unsupported";
|
||
public const string InvalidParams = "invalid_params";
|
||
public const string BudgetExceeded = "budget_exceeded";
|
||
public const string PolicyDenied = "policy_denied";
|
||
}
|
||
|
||
public sealed record TaskDecision(bool Accepted, string? Reason, ParamValues? Resolved, KindSpec? Kind)
|
||
{
|
||
public static TaskDecision Reject(string reason) => new(false, reason, null, null);
|
||
}
|
||
|
||
/// <summary>
|
||
/// 本地硬上限检查：Backend 下发的任何参数都要先经过 <see cref="ParamResolver"/> 校验，再经过这里的本地上限检查，两道都不能省略。
|
||
/// 持续任务按顺序累计码率和包速率，超出总预算的任务被拒绝（并给出原因），其余照常运行。
|
||
/// </summary>
|
||
public sealed class BudgetGuard
|
||
{
|
||
private readonly NodeLimits _limits;
|
||
private readonly IReadOnlyCollection<string> _supportedKinds;
|
||
private readonly List<(IPAddress Network, int Prefix)> _cidrs = [];
|
||
|
||
public BudgetGuard(NodeLimits limits, IReadOnlyCollection<string> supportedKinds)
|
||
{
|
||
_limits = limits;
|
||
_supportedKinds = supportedKinds;
|
||
foreach (string cidr in limits.AllowedTargetCidrs)
|
||
{
|
||
if (TryParseCidr(cidr, out IPAddress? network, out int prefix))
|
||
{
|
||
_cidrs.Add((network, prefix));
|
||
}
|
||
}
|
||
}
|
||
|
||
/// <summary>检查一个任务；<paramref name="usedMbps"/> 和 <paramref name="usedPps"/> 是已经接受的任务占用的预算，接受之后会累加。</summary>
|
||
public TaskDecision Check(TaskSpec task, ref double usedMbps, ref long usedPps)
|
||
{
|
||
KindSpec? kind = Kinds.Find(task.Kind);
|
||
if (kind is null || !_supportedKinds.Contains(task.Kind))
|
||
{
|
||
return TaskDecision.Reject(RejectReasons.Unsupported);
|
||
}
|
||
|
||
ParamResolution resolved = ParamResolver.Resolve(kind.Params, task.Params);
|
||
if (!resolved.IsValid)
|
||
{
|
||
return TaskDecision.Reject(RejectReasons.InvalidParams);
|
||
}
|
||
|
||
if (task.Scope == "target")
|
||
{
|
||
if (!TargetAllowed(task.Target))
|
||
{
|
||
return TaskDecision.Reject(RejectReasons.PolicyDenied);
|
||
}
|
||
}
|
||
else if (!PortAllowed(kind, resolved.Values!))
|
||
{
|
||
return TaskDecision.Reject(RejectReasons.PolicyDenied);
|
||
}
|
||
|
||
double mbps = kind.BudgetBitsPerSecond(resolved.Values!) / 1_000_000.0;
|
||
long pps = EstimatePps(kind.Id, resolved.Values!);
|
||
if (usedMbps + mbps > _limits.MaxTotalMbps || usedPps + pps > _limits.MaxTotalPps)
|
||
{
|
||
return TaskDecision.Reject(RejectReasons.BudgetExceeded);
|
||
}
|
||
|
||
usedMbps += mbps;
|
||
usedPps += pps;
|
||
return new TaskDecision(true, null, resolved.Values, kind);
|
||
}
|
||
|
||
/// <summary>按需测试的一个阶段是否在本地上限之内（单独运行，不和持续任务累计）。</summary>
|
||
public TaskDecision CheckPhase(string kindId, IReadOnlyDictionary<string, JsonElement> parameters)
|
||
{
|
||
double mbps = 0;
|
||
long pps = 0;
|
||
return Check(new TaskSpec { Id = new TaskId("tsk_phase"), Scope = "line", Kind = kindId, Params = new Dictionary<string, JsonElement>(parameters) }, ref mbps, ref pps);
|
||
}
|
||
|
||
/// <summary>
|
||
/// 目标在静态上可不可以接受：IP 字面量直接用 <see cref="AddressAllowed"/> 判断；域名（包括 URL 里的）要解析之后才知道，
|
||
/// 这里先接受，运行时每次解析出的地址再逐个检查。
|
||
/// </summary>
|
||
public bool TargetAllowed(string? target)
|
||
{
|
||
if (!TargetHost.TryParse(target, out string? host, out _, out _))
|
||
{
|
||
return false;
|
||
}
|
||
|
||
return !IPAddress.TryParse(host, out IPAddress? address) || AddressAllowed(address);
|
||
}
|
||
|
||
/// <summary>
|
||
/// 这个地址能不能作为单个 Agent 任务的目标。<c>allowed_target_cidrs</c> 没配置时只允许公网地址（内网、回环、链路本地、组播等一律拒绝），
|
||
/// 防止被攻破的 Backend 借 Agent 探测它所在的内网；配置了就只允许列出的网段（包括内网段，由节点所有者显式决定）。
|
||
/// </summary>
|
||
public bool AddressAllowed(IPAddress address)
|
||
{
|
||
if (address.IsIPv4MappedToIPv6)
|
||
{
|
||
address = address.MapToIPv4();
|
||
}
|
||
|
||
if (_limits.AllowedTargetCidrs.Count == 0)
|
||
{
|
||
return IsPublic(address);
|
||
}
|
||
|
||
foreach ((IPAddress network, int prefix) in _cidrs)
|
||
{
|
||
if (InCidr(address, network, prefix))
|
||
{
|
||
return true;
|
||
}
|
||
}
|
||
|
||
return false;
|
||
}
|
||
|
||
private static readonly (IPAddress Network, int Prefix)[] s_nonPublic =
|
||
[
|
||
(IPAddress.Parse("0.0.0.0"), 8), (IPAddress.Parse("10.0.0.0"), 8), (IPAddress.Parse("100.64.0.0"), 10), (IPAddress.Parse("127.0.0.0"), 8),
|
||
(IPAddress.Parse("169.254.0.0"), 16), (IPAddress.Parse("172.16.0.0"), 12), (IPAddress.Parse("192.0.0.0"), 24), (IPAddress.Parse("192.168.0.0"), 16),
|
||
(IPAddress.Parse("198.18.0.0"), 15), (IPAddress.Parse("224.0.0.0"), 3),
|
||
(IPAddress.Parse("::"), 128), (IPAddress.Parse("::1"), 128), (IPAddress.Parse("fc00::"), 7), (IPAddress.Parse("fe80::"), 10), (IPAddress.Parse("ff00::"), 8),
|
||
];
|
||
|
||
/// <summary>不是公网：私有、回环、链路本地、运营商级 NAT、组播、保留地址。</summary>
|
||
private static bool IsPublic(IPAddress address)
|
||
{
|
||
foreach ((IPAddress network, int prefix) in s_nonPublic)
|
||
{
|
||
if (InCidr(address, network, prefix))
|
||
{
|
||
return false;
|
||
}
|
||
}
|
||
|
||
return true;
|
||
}
|
||
|
||
private bool PortAllowed(KindSpec kind, ParamValues values)
|
||
{
|
||
if (!kind.Params.Any(p => p.Name == "port"))
|
||
{
|
||
return true;
|
||
}
|
||
|
||
int port = (int)values.GetInt("port");
|
||
return kind.Blocks.Transport == "quic_datagram" ? _limits.AllowedQuicPorts.Contains(port) : _limits.AllowedTcpPorts.Contains(port);
|
||
}
|
||
|
||
private static long EstimatePps(string kindId, ParamValues values) => kindId switch
|
||
{
|
||
"quic_ping" or "tcp_ping" => Kinds.PeakRateHz(kindId, values) * 2,
|
||
"icmp_ping" => values.GetInt("rate_hz") * 2,
|
||
"quic_stream" => (long)(values.GetNumber("mbps") * 1_000_000 / 8 / Math.Max(1, values.GetInt("size"))),
|
||
"tcp_connect" => values.GetInt("per_minute") * 6 / 60,
|
||
"http_request" => Math.Max(1, values.GetInt("rate_max_per_min") * 20 / 60),
|
||
_ => 1,
|
||
};
|
||
|
||
private static bool TryParseCidr(string text, out IPAddress network, out int prefix)
|
||
{
|
||
network = IPAddress.None;
|
||
prefix = 0;
|
||
int slash = text.IndexOf('/', StringComparison.Ordinal);
|
||
if (slash < 0 || !IPAddress.TryParse(text.AsSpan(0, slash), out IPAddress? parsed) || !int.TryParse(text.AsSpan(slash + 1), out prefix))
|
||
{
|
||
return false;
|
||
}
|
||
|
||
network = parsed;
|
||
return prefix >= 0 && prefix <= parsed.GetAddressBytes().Length * 8;
|
||
}
|
||
|
||
private static bool InCidr(IPAddress address, IPAddress network, int prefix)
|
||
{
|
||
byte[] a = address.GetAddressBytes();
|
||
byte[] n = network.GetAddressBytes();
|
||
if (a.Length != n.Length)
|
||
{
|
||
return false;
|
||
}
|
||
|
||
int bits = prefix;
|
||
for (int i = 0; i < a.Length && bits > 0; i++, bits -= 8)
|
||
{
|
||
int mask = bits >= 8 ? 0xFF : (0xFF << (8 - bits)) & 0xFF;
|
||
if ((a[i] & mask) != (n[i] & mask))
|
||
{
|
||
return false;
|
||
}
|
||
}
|
||
|
||
return true;
|
||
}
|
||
}
|