From 44887f7ba685f7f68662dca3674362b47d901d5e Mon Sep 17 00:00:00 2001 From: CooooolFrog Date: Wed, 11 Mar 2026 16:10:42 +0800 Subject: [PATCH 1/6] chore(proxy): print request safety in proxy Signed-off-by: CooooolFrog --- dragonfly-client/src/proxy/mod.rs | 80 ++++++++++++++++++++----------- 1 file changed, 51 insertions(+), 29 deletions(-) diff --git a/dragonfly-client/src/proxy/mod.rs b/dragonfly-client/src/proxy/mod.rs index f1c87339c..f4ed262bc 100644 --- a/dragonfly-client/src/proxy/mod.rs +++ b/dragonfly-client/src/proxy/mod.rs @@ -31,6 +31,7 @@ use dragonfly_client_metric::{ }; use dragonfly_client_util::{ http::{hashmap_to_headermap, headermap_to_hashmap}, + net::format_socket_addr, shutdown, tls::{generate_self_signed_certs_by_ca_cert, generate_simple_self_signed_certs, NoVerifier}, }; @@ -50,8 +51,9 @@ use lazy_static::lazy_static; use rcgen::Certificate; use rustls::{RootCertStore, ServerConfig}; use rustls_pki_types::CertificateDer; -use std::collections::HashMap; -use std::net::SocketAddr; +use std::collections::{HashMap, HashSet}; +use std::net::{IpAddr, SocketAddr}; +use std::str::FromStr; use std::sync::Arc; use tokio::io::{AsyncWriteExt, BufReader, BufWriter}; use tokio::net::TcpListener; @@ -420,17 +422,11 @@ pub async fn http_handler( } if request.uri().scheme().cloned() == Some(http::uri::Scheme::HTTPS) { - info!( - "proxy HTTPS request directly to remote server: {:?}", - request - ); + log_request(&request, "proxy HTTPS request directly to remote server:"); return proxy_via_https(request, registry_cert).await; } - info!( - "proxy HTTP request directly to remote server: {:?}", - request - ); + log_request(&request, "proxy HTTP request directly to remote server:"); return proxy_via_http(request).await; } @@ -445,7 +441,7 @@ pub async fn https_handler( registry_cert: Arc>>>, server_ca_cert: Arc>, ) -> ClientResult { - info!("handle HTTPS request: {:?}", request); + log_request(&request,"handle HTTPS request:"); // Proxy the request directly to the remote server. if let Some(host) = request.uri().host() { @@ -622,10 +618,7 @@ pub async fn upgraded_handler( config.proxy.rules.as_deref(), url::Url::parse(&request_uri.to_string()).or_err(ErrorType::ParseError)?, ) { - info!( - "proxy HTTPS request via dfdaemon by rule config: {:?}", - request, - ); + log_request(&request, "proxy HTTPS request via dfdaemon by rule config:"); return proxy_via_dfdaemon( config, task, @@ -640,10 +633,7 @@ pub async fn upgraded_handler( // If the request header contains the X-Dragonfly-Use-P2P header, proxy the request via the // dfdaemon. if header::get_use_p2p(request.headers()) { - info!( - "proxy HTTP request via dfdaemon by X-Dragonfly-Use-P2P header: {:?}", - request, - ); + log_request(&request, "proxy HTTP request via dfdaemon by X-Dragonfly-Use-P2P header:"); return proxy_via_dfdaemon( config, task, @@ -656,17 +646,11 @@ pub async fn upgraded_handler( } if request.uri().scheme().cloned() == Some(http::uri::Scheme::HTTPS) { - info!( - "proxy HTTPS request directly to remote server: {:?}", - request, - ); + log_request(&request, "proxy HTTPS request directly to remote server:"); return proxy_via_https(request, registry_cert).await; } - info!( - "proxy HTTP request directly to remote server: {:?}", - request, - ); + log_request(&request, "proxy HTTP request directly to remote server:"); return proxy_via_http(request).await; } @@ -1178,8 +1162,6 @@ fn make_download_task_request( prefetch: need_prefetch(config.clone(), &header), object_storage: None, hdfs: None, - hugging_face: None, - model_scope: None, is_prefetch: false, need_piece_content: false, force_hard_link: header::get_force_hard_link(&header), @@ -1327,3 +1309,43 @@ fn empty() -> BoxBody { .map_err(|never| match never {}) .boxed() } + +/// log_request safely output information from the request through logs +fn log_request(request: &Request, log_info: &str) { + const HEADER_BLACKLIST: &[&str] = &[ + "authorization", + "cookie", + "set-cookie", + "proxy-authorization", + "x-access-token", + "x-auth-token", + ]; + + let blacklist_set: HashSet<&str> = HEADER_BLACKLIST.iter().cloned().collect(); + + let (mut safe_headers, mut sensitive_headers) = (Vec::new(), Vec::new()); + for (name, value) in request.headers().iter() { + if blacklist_set.contains(&name.as_str()) { + sensitive_headers.push((name, value)); + } else { + safe_headers.push((name, value)); + } + } + + info!( + "{} | method={}, uri={}, version={:?}, safe_headers={:?}", + log_info, + request.method(), + request.uri(), + request.version(), + safe_headers, + ); + + if !sensitive_headers.is_empty() { + debug!( + "{} | BLACKLISTED_HEADERS (SENSITIVE): {:?}", + log_info, + sensitive_headers, + ); + } +} \ No newline at end of file From 21bee66a97d05d124613a2276d890145734b0342 Mon Sep 17 00:00:00 2001 From: CooooolFrog Date: Wed, 11 Mar 2026 16:21:24 +0800 Subject: [PATCH 2/6] make lint happy Signed-off-by: CooooolFrog --- dragonfly-client/src/proxy/mod.rs | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/dragonfly-client/src/proxy/mod.rs b/dragonfly-client/src/proxy/mod.rs index f4ed262bc..e57c1ce1d 100644 --- a/dragonfly-client/src/proxy/mod.rs +++ b/dragonfly-client/src/proxy/mod.rs @@ -441,7 +441,7 @@ pub async fn https_handler( registry_cert: Arc>>>, server_ca_cert: Arc>, ) -> ClientResult { - log_request(&request,"handle HTTPS request:"); + log_request(&request, "handle HTTPS request:"); // Proxy the request directly to the remote server. if let Some(host) = request.uri().host() { @@ -633,7 +633,10 @@ pub async fn upgraded_handler( // If the request header contains the X-Dragonfly-Use-P2P header, proxy the request via the // dfdaemon. if header::get_use_p2p(request.headers()) { - log_request(&request, "proxy HTTP request via dfdaemon by X-Dragonfly-Use-P2P header:"); + log_request( + &request, + "proxy HTTP request via dfdaemon by X-Dragonfly-Use-P2P header:", + ); return proxy_via_dfdaemon( config, task, @@ -1343,9 +1346,8 @@ fn log_request(request: &Request, log_info: &str) { if !sensitive_headers.is_empty() { debug!( - "{} | BLACKLISTED_HEADERS (SENSITIVE): {:?}", - log_info, - sensitive_headers, - ); + "{} | BLACKLISTED_HEADERS (SENSITIVE): {:?}", + log_info, sensitive_headers, + ); } } \ No newline at end of file From 861bce102a59d181947971e8d66525692e2f4b0c Mon Sep 17 00:00:00 2001 From: CooooolFrog Date: Wed, 11 Mar 2026 16:26:41 +0800 Subject: [PATCH 3/6] make lint happy Signed-off-by: CooooolFrog --- dragonfly-client/src/proxy/mod.rs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dragonfly-client/src/proxy/mod.rs b/dragonfly-client/src/proxy/mod.rs index e57c1ce1d..a43089b4c 100644 --- a/dragonfly-client/src/proxy/mod.rs +++ b/dragonfly-client/src/proxy/mod.rs @@ -1165,6 +1165,8 @@ fn make_download_task_request( prefetch: need_prefetch(config.clone(), &header), object_storage: None, hdfs: None, + hugging_face: None, + model_scope: None, is_prefetch: false, need_piece_content: false, force_hard_link: header::get_force_hard_link(&header), From a71be6303e49e2113fe124992d74c5ed37491141 Mon Sep 17 00:00:00 2001 From: CooooolFrog Date: Wed, 11 Mar 2026 16:35:55 +0800 Subject: [PATCH 4/6] make lint happy Signed-off-by: CooooolFrog --- dragonfly-client/src/proxy/mod.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dragonfly-client/src/proxy/mod.rs b/dragonfly-client/src/proxy/mod.rs index a43089b4c..8d4f28fdb 100644 --- a/dragonfly-client/src/proxy/mod.rs +++ b/dragonfly-client/src/proxy/mod.rs @@ -1352,4 +1352,4 @@ fn log_request(request: &Request, log_info: &str) { log_info, sensitive_headers, ); } -} \ No newline at end of file +} From 1ee3d711f0b8d164a9326f9ed03a9568a1285258 Mon Sep 17 00:00:00 2001 From: CooooolFrog Date: Wed, 11 Mar 2026 16:41:54 +0800 Subject: [PATCH 5/6] make lint happy Signed-off-by: CooooolFrog --- dragonfly-client/src/proxy/mod.rs | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/dragonfly-client/src/proxy/mod.rs b/dragonfly-client/src/proxy/mod.rs index 8d4f28fdb..d90e9a316 100644 --- a/dragonfly-client/src/proxy/mod.rs +++ b/dragonfly-client/src/proxy/mod.rs @@ -31,7 +31,6 @@ use dragonfly_client_metric::{ }; use dragonfly_client_util::{ http::{hashmap_to_headermap, headermap_to_hashmap}, - net::format_socket_addr, shutdown, tls::{generate_self_signed_certs_by_ca_cert, generate_simple_self_signed_certs, NoVerifier}, }; @@ -52,8 +51,7 @@ use rcgen::Certificate; use rustls::{RootCertStore, ServerConfig}; use rustls_pki_types::CertificateDer; use std::collections::{HashMap, HashSet}; -use std::net::{IpAddr, SocketAddr}; -use std::str::FromStr; +use std::net::{SocketAddr}; use std::sync::Arc; use tokio::io::{AsyncWriteExt, BufReader, BufWriter}; use tokio::net::TcpListener; From 16a938f2ffa043a7364012c3a1b87c0041e4a93c Mon Sep 17 00:00:00 2001 From: CooooolFrog Date: Wed, 11 Mar 2026 16:52:02 +0800 Subject: [PATCH 6/6] make lint happy Signed-off-by: CooooolFrog --- dragonfly-client/src/proxy/mod.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dragonfly-client/src/proxy/mod.rs b/dragonfly-client/src/proxy/mod.rs index d90e9a316..3f88ce738 100644 --- a/dragonfly-client/src/proxy/mod.rs +++ b/dragonfly-client/src/proxy/mod.rs @@ -51,7 +51,7 @@ use rcgen::Certificate; use rustls::{RootCertStore, ServerConfig}; use rustls_pki_types::CertificateDer; use std::collections::{HashMap, HashSet}; -use std::net::{SocketAddr}; +use std::net::SocketAddr; use std::sync::Arc; use tokio::io::{AsyncWriteExt, BufReader, BufWriter}; use tokio::net::TcpListener;