增加对授权用户的访问频率限制功能，可限制某段时间该用户的访问总次数及并发访问数

.gitignore

@@ -33,3 +33,4 @@ _testmain.go
 
 .vscode/
 cmd/gost/gost
+.idea

cmd/gost/cfg.go

@@ -11,7 +11,7 @@ import (
 	"os"
 	"strings"
 
-	"github.com/ginuerzh/gost"
+	"github.com/tongsq/gost"
 )
 
 var (
@@ -148,6 +148,26 @@ func parseAuthenticator(s string) (gost.Authenticator, error) {
 	return au, nil
 }
 
+func parseLimiter(s string) (gost.Limiter, error) {
+	if s == "" {
+		return nil, nil
+	}
+	f, err := os.Open(s)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+
+	l, _ := gost.NewLocalLimiter("", "")
+	err = l.Reload(f)
+	if err != nil {
+		return nil, err
+	}
+	go gost.PeriodReload(l, s)
+
+	return l, nil
+}
+
 func parseIP(s string, port string) (ips []string) {
 	if s == "" {
 		return

cmd/gost/main.go

@@ -11,8 +11,8 @@ import (
 
 	_ "net/http/pprof"
 
-	"github.com/ginuerzh/gost"
 	"github.com/go-log/log"
+	"github.com/tongsq/gost"
 )
 
 var (

cmd/gost/peer.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/ginuerzh/gost"
+	"github.com/tongsq/gost"
 )
 
 type peerConfig struct {

cmd/gost/route.go

@@ -12,8 +12,8 @@ import (
 	"strings"
 	"time"
 
-	"github.com/ginuerzh/gost"
 	"github.com/go-log/log"
+	"github.com/tongsq/gost"
 )
 
 type stringList []string
@@ -386,6 +386,19 @@ func (r *route) GenRouters() ([]router, error) {
 				node.User = users[0]
 			}
 		}
+
+		//init rate limiter
+		limiterHandler, err := parseLimiter(node.Get("secrets"))
+		if err != nil {
+			return nil, err
+		}
+		if limiterHandler == nil && strings.TrimSpace(node.Get("limiter")) != "" && node.User != nil {
+			limiterHandler, err = gost.NewLocalLimiter(node.User.Username(), strings.TrimSpace(node.Get("limiter")))
+			if err != nil {
+				return nil, err
+			}
+		}
+
 		certFile, keyFile := node.Get("cert"), node.Get("key")
 		tlsCfg, err := tlsConfig(certFile, keyFile, node.Get("ca"))
 		if err != nil && certFile != "" && keyFile != "" {
@@ -671,6 +684,7 @@ func (r *route) GenRouters() ([]router, error) {
 			gost.IPRoutesHandlerOption(tunRoutes...),
 			gost.ProxyAgentHandlerOption(node.Get("proxyAgent")),
 			gost.HTTPTunnelHandlerOption(node.GetBool("httpTunnel")),
+			gost.LimiterHandlerOption(limiterHandler),
 		)
 
 		rt := router{

examples/bench/cli.go

@@ -10,7 +10,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/ginuerzh/gost"
+	"github.com/tongsq/gost"
 	"golang.org/x/net/http2"
 )
 

examples/bench/srv.go

@@ -9,7 +9,7 @@ import (
 	"net/url"
 	"time"
 
-	"github.com/ginuerzh/gost"
+	"github.com/tongsq/gost"
 	"golang.org/x/net/http2"
 )
 

examples/forward/direct/client.go

@@ -3,7 +3,7 @@ package main
 import (
 	"log"
 
-	"github.com/ginuerzh/gost"
+	"github.com/tongsq/gost"
 )
 
 func main() {

examples/forward/direct/server.go

@@ -4,7 +4,7 @@ import (
 	"crypto/tls"
 	"log"
 
-	"github.com/ginuerzh/gost"
+	"github.com/tongsq/gost"
 )
 
 func main() {

examples/forward/remote/client.go

@@ -3,7 +3,7 @@ package main
 import (
 	"log"
 
-	"github.com/ginuerzh/gost"
+	"github.com/tongsq/gost"
 )
 
 func main() {

examples/forward/remote/server.go

@@ -4,7 +4,7 @@ import (
 	"crypto/tls"
 	"log"
 
-	"github.com/ginuerzh/gost"
+	"github.com/tongsq/gost"
 )
 
 func main() {

examples/forward/udp/direct.go

@@ -5,7 +5,7 @@ import (
 	"log"
 	"time"
 
-	"github.com/ginuerzh/gost"
+	"github.com/tongsq/gost"
 )
 
 var (
@@ -37,20 +37,20 @@ func udpDirectForwardServer() {
 	}
 	h := gost.UDPDirectForwardHandler(
 		faddr,
-	/*
-		gost.ChainHandlerOption(gost.NewChain(gost.Node{
-			Protocol:  "socks5",
-			Transport: "tcp",
-			Addr:      ":11080",
-			User:      url.UserPassword("admin", "123456"),
-			Client: &gost.Client{
-				Connector: gost.SOCKS5Connector(
-					url.UserPassword("admin", "123456"),
-				),
-				Transporter: gost.TCPTransporter(),
-			},
-		})),
-	*/
+		/*
+			gost.ChainHandlerOption(gost.NewChain(gost.Node{
+				Protocol:  "socks5",
+				Transport: "tcp",
+				Addr:      ":11080",
+				User:      url.UserPassword("admin", "123456"),
+				Client: &gost.Client{
+					Connector: gost.SOCKS5Connector(
+						url.UserPassword("admin", "123456"),
+					),
+					Transporter: gost.TCPTransporter(),
+				},
+			})),
+		*/
 	)
 	s := &gost.Server{ln}
 	log.Fatal(s.Serve(h))

examples/forward/udp/remote.go

@@ -5,7 +5,7 @@ import (
 	"log"
 	"time"
 
-	"github.com/ginuerzh/gost"
+	"github.com/tongsq/gost"
 )
 
 var (

examples/http2/http2.go

@@ -8,7 +8,7 @@ import (
 
 	"golang.org/x/net/http2"
 
-	"github.com/ginuerzh/gost"
+	"github.com/tongsq/gost"
 )
 
 var (

examples/quic/quicc.go

@@ -6,7 +6,7 @@ import (
 	"log"
 	"time"
 
-	"github.com/ginuerzh/gost"
+	"github.com/tongsq/gost"
 )
 
 var (

examples/quic/quics.go

@@ -5,7 +5,7 @@ import (
 	"flag"
 	"log"
 
-	"github.com/ginuerzh/gost"
+	"github.com/tongsq/gost"
 )
 
 var (

examples/ssh/sshc.go

@@ -6,7 +6,7 @@ import (
 	"log"
 	"time"
 
-	"github.com/ginuerzh/gost"
+	"github.com/tongsq/gost"
 )
 
 var (

examples/ssh/sshd.go

@@ -5,7 +5,7 @@ import (
 	"flag"
 	"log"
 
-	"github.com/ginuerzh/gost"
+	"github.com/tongsq/gost"
 )
 
 var (

go.mod

@@ -1,4 +1,4 @@
-module github.com/ginuerzh/gost
+module github.com/tongsq/gost
 
 go 1.22
 

handler.go

@@ -44,6 +44,7 @@ type HandlerOptions struct {
 	IPRoutes      []IPRoute
 	ProxyAgent    string
 	HTTPTunnel    bool
+	Limiter       Limiter
 }
 
 // HandlerOption allows a common way to set handler options.
@@ -87,6 +88,13 @@ func AuthenticatorHandlerOption(au Authenticator) HandlerOption {
 	}
 }
 
+// LimiterHandlerOption sets the Rate limiter option of HandlerOptions
+func LimiterHandlerOption(l Limiter) HandlerOption {
+	return func(opts *HandlerOptions) {
+		opts.Limiter = l
+	}
+}
+
 // TLSConfigHandlerOption sets the TLSConfig option of HandlerOptions.
 func TLSConfigHandlerOption(config *tls.Config) HandlerOption {
 	return func(opts *HandlerOptions) {

http.go

@@ -212,7 +212,23 @@ func (h *httpHandler) handleRequest(conn net.Conn, req *http.Request) {
 	if !h.authenticate(conn, req, resp) {
 		return
 	}
+	user, _, _ := basicProxyAuth(req.Header.Get("Proxy-Authorization"))
+	if h.options.Limiter != nil {
+		done, ok := h.options.Limiter.CheckRate(user, true)
+		if !ok {
+			resp.StatusCode = http.StatusTooManyRequests
 
+			if Debug {
+				dump, _ := httputil.DumpResponse(resp, false)
+				log.Logf("[http] %s <- %s rate limiter \n%s", conn.RemoteAddr(), conn.LocalAddr(), string(dump))
+			}
+
+			resp.Write(conn)
+			return
+		} else {
+			defer done()
+		}
+	}
 	if req.Method == "PRI" || (req.Method != http.MethodConnect && req.URL.Scheme != "http") {
 		resp.StatusCode = http.StatusBadRequest
 

http2.go

@@ -394,7 +394,18 @@ func (h *http2Handler) roundTrip(w http.ResponseWriter, r *http.Request) {
 	if !h.authenticate(w, r, resp) {
 		return
 	}
-
+	user, _, _ := basicProxyAuth(r.Header.Get("Proxy-Authorization"))
+	if h.options.Limiter != nil {
+		done, ok := h.options.Limiter.CheckRate(user, true)
+		if !ok {
+			log.Logf("[http2] %s - %s rate limiter %s, user is %s",
+				r.RemoteAddr, laddr, host, user)
+			w.WriteHeader(http.StatusTooManyRequests)
+			return
+		} else {
+			defer done()
+		}
+	}
 	// delete the proxy related headers.
 	r.Header.Del("Proxy-Authorization")
 	r.Header.Del("Proxy-Connection")