From a247997e388cda3b31108a8f107ad87680dcd9ca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=A3=8E=E6=89=87=E6=BB=91=E7=BF=94=E7=BF=BC?= Date: Wed, 11 Sep 2024 22:45:47 +0800 Subject: [PATCH] Log: Add MaskAddress option to hide IP addresses (#3783) * Log: Add maskAddress option * Correct IPv6 subnet --- app/log/config.pb.go | 31 ++++++++++++++------- app/log/config.proto | 1 + app/log/log.go | 66 ++++++++++++++++++++++++++++++++++++++++++-- infra/conf/log.go | 10 ++++--- 4 files changed, 91 insertions(+), 17 deletions(-) diff --git a/app/log/config.pb.go b/app/log/config.pb.go index eb7abc50..43197238 100644 --- a/app/log/config.pb.go +++ b/app/log/config.pb.go @@ -84,6 +84,7 @@ type Config struct { AccessLogType LogType `protobuf:"varint,4,opt,name=access_log_type,json=accessLogType,proto3,enum=xray.app.log.LogType" json:"access_log_type,omitempty"` AccessLogPath string `protobuf:"bytes,5,opt,name=access_log_path,json=accessLogPath,proto3" json:"access_log_path,omitempty"` EnableDnsLog bool `protobuf:"varint,6,opt,name=enable_dns_log,json=enableDnsLog,proto3" json:"enable_dns_log,omitempty"` + MaskAddress string `protobuf:"bytes,7,opt,name=mask_address,json=maskAddress,proto3" json:"mask_address,omitempty"` } func (x *Config) Reset() { @@ -160,13 +161,20 @@ func (x *Config) GetEnableDnsLog() bool { return false } +func (x *Config) GetMaskAddress() string { + if x != nil { + return x.MaskAddress + } + return "" +} + var File_app_log_config_proto protoreflect.FileDescriptor var file_app_log_config_proto_rawDesc = []byte{ 0x0a, 0x14, 0x61, 0x70, 0x70, 0x2f, 0x6c, 0x6f, 0x67, 0x2f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0c, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x61, 0x70, 0x70, 0x2e, 0x6c, 0x6f, 0x67, 0x1a, 0x14, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x6c, 0x6f, 0x67, - 0x2f, 0x6c, 0x6f, 0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xbb, 0x02, 0x0a, 0x06, 0x43, + 0x2f, 0x6c, 0x6f, 0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xde, 0x02, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x3b, 0x0a, 0x0e, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6c, 0x6f, 0x67, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x15, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x61, 0x70, 0x70, 0x2e, 0x6c, 0x6f, 0x67, 0x2e, 0x4c, 0x6f, 0x67, @@ -186,15 +194,18 @@ var file_app_log_config_proto_rawDesc = []byte{ 0x01, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x50, 0x61, 0x74, 0x68, 0x12, 0x24, 0x0a, 0x0e, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x64, 0x6e, 0x73, 0x5f, 0x6c, 0x6f, 0x67, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x65, 0x6e, 0x61, 0x62, - 0x6c, 0x65, 0x44, 0x6e, 0x73, 0x4c, 0x6f, 0x67, 0x2a, 0x35, 0x0a, 0x07, 0x4c, 0x6f, 0x67, 0x54, - 0x79, 0x70, 0x65, 0x12, 0x08, 0x0a, 0x04, 0x4e, 0x6f, 0x6e, 0x65, 0x10, 0x00, 0x12, 0x0b, 0x0a, - 0x07, 0x43, 0x6f, 0x6e, 0x73, 0x6f, 0x6c, 0x65, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x46, 0x69, - 0x6c, 0x65, 0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x10, 0x03, 0x42, - 0x46, 0x0a, 0x10, 0x63, 0x6f, 0x6d, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x61, 0x70, 0x70, 0x2e, - 0x6c, 0x6f, 0x67, 0x50, 0x01, 0x5a, 0x21, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, - 0x6d, 0x2f, 0x78, 0x74, 0x6c, 0x73, 0x2f, 0x78, 0x72, 0x61, 0x79, 0x2d, 0x63, 0x6f, 0x72, 0x65, - 0x2f, 0x61, 0x70, 0x70, 0x2f, 0x6c, 0x6f, 0x67, 0xaa, 0x02, 0x0c, 0x58, 0x72, 0x61, 0x79, 0x2e, - 0x41, 0x70, 0x70, 0x2e, 0x4c, 0x6f, 0x67, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, + 0x6c, 0x65, 0x44, 0x6e, 0x73, 0x4c, 0x6f, 0x67, 0x12, 0x21, 0x0a, 0x0c, 0x6d, 0x61, 0x73, 0x6b, + 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, + 0x6d, 0x61, 0x73, 0x6b, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x2a, 0x35, 0x0a, 0x07, 0x4c, + 0x6f, 0x67, 0x54, 0x79, 0x70, 0x65, 0x12, 0x08, 0x0a, 0x04, 0x4e, 0x6f, 0x6e, 0x65, 0x10, 0x00, + 0x12, 0x0b, 0x0a, 0x07, 0x43, 0x6f, 0x6e, 0x73, 0x6f, 0x6c, 0x65, 0x10, 0x01, 0x12, 0x08, 0x0a, + 0x04, 0x46, 0x69, 0x6c, 0x65, 0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x45, 0x76, 0x65, 0x6e, 0x74, + 0x10, 0x03, 0x42, 0x46, 0x0a, 0x10, 0x63, 0x6f, 0x6d, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x61, + 0x70, 0x70, 0x2e, 0x6c, 0x6f, 0x67, 0x50, 0x01, 0x5a, 0x21, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, + 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x78, 0x74, 0x6c, 0x73, 0x2f, 0x78, 0x72, 0x61, 0x79, 0x2d, 0x63, + 0x6f, 0x72, 0x65, 0x2f, 0x61, 0x70, 0x70, 0x2f, 0x6c, 0x6f, 0x67, 0xaa, 0x02, 0x0c, 0x58, 0x72, + 0x61, 0x79, 0x2e, 0x41, 0x70, 0x70, 0x2e, 0x4c, 0x6f, 0x67, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, + 0x6f, 0x33, } var ( diff --git a/app/log/config.proto b/app/log/config.proto index 47e010d2..8dc729d0 100644 --- a/app/log/config.proto +++ b/app/log/config.proto @@ -23,4 +23,5 @@ message Config { LogType access_log_type = 4; string access_log_path = 5; bool enable_dns_log = 6; + string mask_address= 7; } diff --git a/app/log/log.go b/app/log/log.go index 098fe631..8b3d3367 100644 --- a/app/log/log.go +++ b/app/log/log.go @@ -4,6 +4,9 @@ package log import ( "context" + "fmt" + "regexp" + "strings" "sync" "github.com/xtls/xray-core/common" @@ -101,18 +104,25 @@ func (g *Instance) Handle(msg log.Message) { return } + var Msg log.Message + if g.config.MaskAddress != "" { + Msg = &MaskedMsgWrapper{Message: msg, config: g.config} + } else { + Msg = msg + } + switch msg := msg.(type) { case *log.AccessMessage: if g.accessLogger != nil { - g.accessLogger.Handle(msg) + g.accessLogger.Handle(Msg) } case *log.DNSLog: if g.dns && g.accessLogger != nil { - g.accessLogger.Handle(msg) + g.accessLogger.Handle(Msg) } case *log.GeneralMessage: if g.errorLogger != nil && msg.Severity <= g.config.ErrorLogLevel { - g.errorLogger.Handle(msg) + g.errorLogger.Handle(Msg) } default: // Swallow @@ -141,6 +151,56 @@ func (g *Instance) Close() error { return nil } +// MaskedMsgWrapper is to wrap the string() method to mask IP addresses in the log. +type MaskedMsgWrapper struct { + log.Message + config *Config +} + +func (m *MaskedMsgWrapper) String() string { + str := m.Message.String() + + ipv4Regex := regexp.MustCompile(`(\d{1,3}\.){3}\d{1,3}`) + ipv6Regex := regexp.MustCompile(`((?:[\da-fA-F]{0,4}:[\da-fA-F]{0,4}){2,7})(?:[\/\\%](\d{1,3}))?`) + + // Process ipv4 + maskedMsg := ipv4Regex.ReplaceAllStringFunc(str, func(ip string) string { + parts := strings.Split(ip, ".") + switch m.config.MaskAddress { + case "half": + return fmt.Sprintf("%s.%s.*.*", parts[0], parts[1]) + case "quarter": + return fmt.Sprintf("%s.*.*.*", parts[0]) + case "full": + return "[Masked IPv4]" + default: + return ip + } + }) + + // process ipv6 + maskedMsg = ipv6Regex.ReplaceAllStringFunc(maskedMsg, func(ip string) string { + parts := strings.Split(ip, ":") + switch m.config.MaskAddress { + case "half": + if len(parts) >= 2 { + return fmt.Sprintf("%s:%s::/32", parts[0], parts[1]) + } + case "quarter": + if len(parts) >= 1 { + return fmt.Sprintf("%s::/16", parts[0]) + } + case "full": + return "Masked IPv6" // Do not use [Masked IPv6] like ipv4, or you will get "[[Masked IPv6]]" (v6 address already has []) + default: + return ip + } + return ip + }) + + return maskedMsg +} + func init() { common.Must(common.RegisterConfig((*Config)(nil), func(ctx context.Context, config interface{}) (interface{}, error) { return New(ctx, config.(*Config)) diff --git a/infra/conf/log.go b/infra/conf/log.go index 14f2a694..fee8f570 100644 --- a/infra/conf/log.go +++ b/infra/conf/log.go @@ -16,10 +16,11 @@ func DefaultLogConfig() *log.Config { } type LogConfig struct { - AccessLog string `json:"access"` - ErrorLog string `json:"error"` - LogLevel string `json:"loglevel"` - DNSLog bool `json:"dnsLog"` + AccessLog string `json:"access"` + ErrorLog string `json:"error"` + LogLevel string `json:"loglevel"` + DNSLog bool `json:"dnsLog"` + MaskAddress string `json:"maskAddress"` } func (v *LogConfig) Build() *log.Config { @@ -59,5 +60,6 @@ func (v *LogConfig) Build() *log.Config { default: config.ErrorLogLevel = clog.Severity_Warning } + config.MaskAddress = v.MaskAddress return config }