EdgeCommon/pkg/nodeconfigs/node_config.go

package nodeconfigs

import (
	"bytes"
	"context"
	"crypto/sha256"
	"encoding/base64"
	"encoding/json"
	"errors"
	"fmt"
	"github.com/TeaOSLab/EdgeCommon/pkg/nodeutils"
	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/ddosconfigs"
	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/firewallconfigs"
	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/shared"
	"github.com/iwind/TeaGo/Tea"
	"github.com/iwind/TeaGo/lists"
	"github.com/iwind/TeaGo/maps"
	"os"
	"reflect"
	"strconv"
	"strings"
	"sync"
)

var sharedNodeConfig *NodeConfig = nil
var uamPolicyLocker = &sync.RWMutex{}
var httpCCPolicyLocker = &sync.RWMutex{}
var http3PolicyLocker = &sync.RWMutex{}
var httpPagesPolicyLocker = &sync.RWMutex{}
var webPPolicyLocker = &sync.RWMutex{}
var plansLocker = &sync.RWMutex{}

type ServerError struct {
	Id      int64
	Message string
}

func NewServerError(serverId int64, message string) *ServerError {
	return &ServerError{Id: serverId, Message: message}
}

// NodeConfig 边缘节点配置
type NodeConfig struct {
	Id                   int64                         `yaml:"id" json:"id"`
	Edition              string                        `yaml:"edition" json:"edition"`
	NodeId               string                        `yaml:"nodeId" json:"nodeId"`
	Secret               string                        `yaml:"secret" json:"secret"`
	IsOn                 bool                          `yaml:"isOn" json:"isOn"`
	Servers              []*serverconfigs.ServerConfig `yaml:"servers" json:"servers"`
	SupportCNAME         bool                          `yaml:"supportCNAME" json:"supportCNAME"`
	Version              int64                         `yaml:"version" json:"version"`
	Name                 string                        `yaml:"name" json:"name"`
	GroupId              int64                         `yaml:"groupId" json:"groupId"`
	RegionId             int64                         `yaml:"regionId" json:"regionId"`
	OCSPVersion          int64                         `yaml:"ocspVersion" json:"ocspVersion"`
	DataMap              *shared.DataMap               `yaml:"dataMap" json:"dataMap"`
	UpdatingServerListId int64                         `yaml:"updatingServerListId" json:"updatingServerListId"`

	// 性能
	MaxCPU       int32                                 `yaml:"maxCPU" json:"maxCPU"`
	APINodeAddrs []*serverconfigs.NetworkAddressConfig `yaml:"apiNodeAddrs" json:"apiNodeAddrs"`

	CacheDiskDir         string               `yaml:"cacheDiskDir" json:"cacheDiskDir"`                 // 文件缓存目录
	MaxCacheDiskCapacity *shared.SizeCapacity `yaml:"maxCacheDiskCapacity" json:"maxCacheDiskCapacity"` // 文件缓存容量

	CacheDiskSubDirs []*serverconfigs.CacheDir `yaml:"cacheDiskSubDirs" json:"cacheDiskSubDirs"` // 其余缓存目录

	MaxCacheMemoryCapacity *shared.SizeCapacity          `yaml:"maxCacheMemoryCapacity" json:"maxCacheMemoryCapacity"` // 内容缓存容量
	MaxThreads             int                           `yaml:"maxThreads" json:"maxThreads"`                         // 最大线程数
	DDoSProtection         *ddosconfigs.ProtectionConfig `yaml:"ddosProtection" json:"ddosProtection"`                 // DDoS防护
	EnableIPLists          bool                          `yaml:"enableIPLists" json:"enableIPLists"`                   // 启用IP名单

	// 级别
	Level       int32                         `yaml:"level" json:"level"`
	ParentNodes map[int64][]*ParentNodeConfig `yaml:"parentNodes" json:"parentNodes"` // clusterId => []*ParentNodeConfig

	// 全局配置
	GlobalServerConfig *serverconfigs.GlobalServerConfig `yaml:"globalServerConfig" json:"globalServerConfig"` // 服务全局配置，用来替代 GlobalConfig
	ProductConfig      *ProductConfig                    `yaml:"productConfig" json:"productConfig"`

	// 集群统一配置
	HTTPFirewallPolicies []*firewallconfigs.HTTPFirewallPolicy   `yaml:"httpFirewallPolicies" json:"httpFirewallPolicies"`
	HTTPCachePolicies    []*serverconfigs.HTTPCachePolicy        `yaml:"httpCachePolicies" json:"httpCachePolicies"`
	TOA                  *TOAConfig                              `yaml:"toa" json:"toa"`
	SystemServices       map[string]maps.Map                     `yaml:"systemServices" json:"systemServices"`           // 系统服务配置 type => params
	FirewallActions      []*firewallconfigs.FirewallActionConfig `yaml:"firewallActions" json:"firewallActions"`         // 防火墙动作
	TimeZone             string                                  `yaml:"timeZone" json:"timeZone"`                       // 自动设置时区
	AutoOpenPorts        bool                                    `yaml:"autoOpenPorts" json:"autoOpenPorts"`             // 自动开放所需端口
	Clock                *ClockConfig                            `yaml:"clock" json:"clock"`                             // 时钟配置
	AutoInstallNftables  bool                                    `yaml:"autoInstallNftables" json:"autoInstallNftables"` // 自动安装nftables
	AutoSystemTuning     bool                                    `yaml:"autoSystemTuning" json:"autoSystemTuning"`       // 自动调整系统参数
	AutoTrimDisks        bool                                    `yaml:"autoTrimDisks" json:"autoTrimDisks"`             // 自动执行TRIM

	// 指标
	MetricItems []*serverconfigs.MetricItemConfig `yaml:"metricItems" json:"metricItems"`

	IPAddresses []string `yaml:"ipAddresses" json:"ipAddresses"` // IP地址
	AllowedIPs  []string `yaml:"allowedIPs" json:"allowedIPs"`   // 自动IP白名单

	// 脚本
	CommonScripts []*serverconfigs.CommonScript `yaml:"commonScripts" json:"commonScripts"`

	WebPImagePolicies     map[int64]*WebPImagePolicy          `yaml:"webpImagePolicies" json:"webpImagePolicies"`         // WebP相关配置，clusterId => *WebPImagePolicy
	UAMPolicies           map[int64]*UAMPolicy                `yaml:"uamPolicies" json:"uamPolicies"`                     // UAM相关配置，clusterId => *UAMPolicy
	HTTPCCPolicies        map[int64]*HTTPCCPolicy             `yaml:"httpCCPolicies" json:"httpCCPolicies"`               // CC相关配置， clusterId => *HTTPCCPolicy
	HTTP3Policies         map[int64]*HTTP3Policy              `yaml:"http3Policies" json:"http3Policies"`                 // HTTP3相关配置， clusterId => *HTTP3Policy
	HTTPPagesPolicies     map[int64]*HTTPPagesPolicy          `yaml:"httpPagesPolicies" json:"httpPagesPolicies"`         // 自定义页面，clusterId => *HTTPPagesPolicy
	NetworkSecurityPolicy *NetworkSecurityPolicy              `yaml:"networkSecurityPolicy" json:"networkSecurityPolicy"` // 网络安全策略
	Plans                 map[int64]*serverconfigs.PlanConfig `yaml:"plans" json:"plans"`                                 // 套餐 plan id => *serverconfigs.PlanConfig

	// DNS
	DNSResolver *DNSResolverConfig `yaml:"dnsResolver" json:"dnsResolver"`

	paddedId string

	// firewall
	firewallPolicies []*firewallconfigs.HTTPFirewallPolicy

	// metrics
	hasHTTPConnectionMetrics bool

	// 源站集合
	originMap map[int64]*serverconfigs.OriginConfig

	// 自动白名单
	allowedIPMap map[string]bool

	// syn flood
	synFlood *firewallconfigs.SYNFloodConfig

	secretHash string
}

// SharedNodeConfig 取得当前节点配置单例
func SharedNodeConfig() (*NodeConfig, error) {
	shared.Locker.Lock()
	defer shared.Locker.Unlock()

	if sharedNodeConfig != nil {
		return sharedNodeConfig, nil
	}

	// 从本地缓存读取
	var configFile = Tea.ConfigFile("node.json")
	var readCacheOk = false
	defer func() {
		if !readCacheOk {
			_ = os.Remove(configFile)
		}
	}()

	data, err := os.ReadFile(configFile)
	if err != nil {
		return &NodeConfig{}, err
	}

	encodedNodeInfo, encodedJSONData, found := bytes.Cut(data, []byte("\n"))
	if !found {
		// 删除缓存文件
		return &NodeConfig{}, errors.New("node.json: invalid data format")
	}

	encodedNodeInfoData, err := base64.StdEncoding.DecodeString(string(encodedNodeInfo))
	if err != nil {
		// 删除缓存文件
		return &NodeConfig{}, err
	}

	nodeUniqueId, nodeSecret, found := strings.Cut(string(encodedNodeInfoData), "|")
	if !found {
		// 删除缓存文件
		return &NodeConfig{}, errors.New("node.json: node info: invalid data format")
	}

	jsonData, err := nodeutils.DecryptData(nodeUniqueId, nodeSecret, string(encodedJSONData))
	if err != nil {
		return &NodeConfig{}, err
	}

	var config = &NodeConfig{}
	err = json.Unmarshal(jsonData, &config)
	if err != nil {
		return &NodeConfig{}, err
	}

	readCacheOk = true
	sharedNodeConfig = config
	return config, nil
}

// ResetNodeConfig 重置节点配置
func ResetNodeConfig(nodeConfig *NodeConfig) {
	shared.Locker.Lock()
	sharedNodeConfig = nodeConfig
	shared.Locker.Unlock()
}

// CloneNodeConfig 复制节点配置
func CloneNodeConfig(nodeConfig *NodeConfig) (*NodeConfig, error) {
	if nodeConfig == nil {
		return nil, errors.New("node config should not be nil")
	}

	uamPolicyLocker.RLock()
	defer uamPolicyLocker.RUnlock()

	httpCCPolicyLocker.RLock()
	defer httpCCPolicyLocker.RUnlock()

	http3PolicyLocker.RLock()
	defer http3PolicyLocker.RUnlock()

	httpPagesPolicyLocker.RLock()
	defer httpPagesPolicyLocker.RUnlock()

	webPPolicyLocker.RLock()
	defer webPPolicyLocker.RUnlock()

	plansLocker.RLock()
	defer plansLocker.RUnlock()

	var newConfigValue = reflect.Indirect(reflect.ValueOf(&NodeConfig{}))
	var oldValue = reflect.Indirect(reflect.ValueOf(nodeConfig))
	var valueType = oldValue.Type()
	for i := 0; i < valueType.NumField(); i++ {
		var field = valueType.Field(i)
		var fieldName = field.Name
		if !field.IsExported() {
			continue
		}
		if fieldName == "Servers" {
			continue
		}

		newConfigValue.FieldByName(fieldName).Set(oldValue.FieldByName(fieldName))
	}

	var newConfig = newConfigValue.Interface().(NodeConfig)
	newConfig.Servers = append([]*serverconfigs.ServerConfig{}, nodeConfig.Servers...)
	return &newConfig, nil
}

// Init 初始化
func (this *NodeConfig) Init(ctx context.Context) (err error, serverErrors []*ServerError) {
	// 设置Context
	if ctx == nil {
		ctx = context.Background()
	}
	ctx = context.WithValue(ctx, "DataMap", this.DataMap)

	this.secretHash = fmt.Sprintf("%x", sha256.Sum256([]byte(this.NodeId+"@"+this.Secret)))
	this.paddedId = fmt.Sprintf("%08d", this.Id)

	// servers
	for _, server := range this.Servers {
		// 避免在运行时重新初始化
		if server.IsInitialized() {
			continue
		}

		// 初始化
		errs := server.Init(ctx)
		if len(errs) > 0 {
			// 这里不返回错误，而是继续往下，防止单个服务错误而影响其他服务
			for _, serverErr := range errs {
				serverErrors = append(serverErrors, NewServerError(server.Id, "server '"+strconv.FormatInt(server.Id, 10)+"' init failed: "+serverErr.Error()))
			}
		}

		// 检查ACME支持
		if server.IsOn && server.SupportCNAME {
			this.SupportCNAME = true
		}
	}

	// cache policy
	if len(this.HTTPCachePolicies) > 0 {
		for _, policy := range this.HTTPCachePolicies {
			err = policy.Init()
			if err != nil {
				return
			}
		}
	}

	// firewall policy
	if len(this.HTTPFirewallPolicies) > 0 {
		for _, policy := range this.HTTPFirewallPolicies {
			err = policy.Init()
			if err != nil {
				return
			}
		}
	}

	// TOA
	if this.TOA != nil {
		err = this.TOA.Init()
		if err != nil {
			return
		}
	}

	// 源站
	this.originMap = map[int64]*serverconfigs.OriginConfig{}

	// 查找FirewallPolicy
	this.synFlood = nil
	this.firewallPolicies = []*firewallconfigs.HTTPFirewallPolicy{}
	for _, policy := range this.HTTPFirewallPolicies {
		if policy.IsOn {
			this.firewallPolicies = append(this.firewallPolicies, policy)
			if policy.SYNFlood != nil && policy.SYNFlood.IsOn {
				this.synFlood = policy.SYNFlood
			}
		}
	}
	for _, server := range this.Servers {
		if !server.IsOk() || !server.IsOn {
			continue
		}

		// WAF策略
		if server.HTTPFirewallPolicyId > 0 {
			for _, policy := range this.HTTPFirewallPolicies {
				if server.HTTPFirewallPolicyId == policy.Id {
					server.HTTPFirewallPolicy = policy
					break
				}
			}
		}

		// 缓存策略
		if server.HTTPCachePolicyId > 0 {
			for _, policy := range this.HTTPCachePolicies {
				if server.HTTPCachePolicyId == policy.Id {
					server.HTTPCachePolicy = policy
				}
			}
		}

		// 源站
		if server.ReverseProxyRef != nil && server.ReverseProxyRef.IsOn && server.ReverseProxy != nil && server.ReverseProxy.IsOn {
			for _, origin := range server.ReverseProxy.PrimaryOrigins {
				if origin.IsOn {
					this.originMap[origin.Id] = origin
				}
			}
			for _, origin := range server.ReverseProxy.BackupOrigins {
				if origin.IsOn {
					this.originMap[origin.Id] = origin
				}
			}
		}

		if server.Web != nil {
			this.lookupWeb(server, server.Web)
		}
	}

	// firewall actions
	for _, action := range this.FirewallActions {
		err = action.Init()
		if err != nil {
			return
		}
	}

	// metric items
	this.hasHTTPConnectionMetrics = false
	for _, item := range this.MetricItems {
		err = item.Init()
		if err != nil {
			return
		}
		if item.IsOn && item.HasHTTPConnectionValue() {
			this.hasHTTPConnectionMetrics = true
		}
	}

	// 自动白名单
	this.allowedIPMap = map[string]bool{}
	for _, allowIP := range this.AllowedIPs {
		this.allowedIPMap[allowIP] = true
	}

	// webp image policy
	webPPolicyLocker.RLock()
	if this.WebPImagePolicies != nil {
		for _, policy := range this.WebPImagePolicies {
			err = policy.Init()
			if err != nil {
				webPPolicyLocker.RUnlock()
				return
			}
		}
	}
	webPPolicyLocker.RUnlock()

	// uam policy
	uamPolicyLocker.RLock()
	if len(this.UAMPolicies) > 0 {
		for _, policy := range this.UAMPolicies {
			err = policy.Init()
			if err != nil {
				uamPolicyLocker.RUnlock()
				return
			}
		}
	}
	uamPolicyLocker.RUnlock()

	// http cc policy
	httpCCPolicyLocker.RLock()
	if len(this.HTTPCCPolicies) > 0 {
		for _, policy := range this.HTTPCCPolicies {
			err = policy.Init()
			if err != nil {
				httpCCPolicyLocker.RUnlock()
				return
			}
		}
	}
	httpCCPolicyLocker.RUnlock()

	// http3 policy
	http3PolicyLocker.RLock()
	if len(this.HTTP3Policies) > 0 {
		for _, policy := range this.HTTP3Policies {
			err = policy.Init()
			if err != nil {
				http3PolicyLocker.RUnlock()
				return
			}
		}
	}
	http3PolicyLocker.RUnlock()

	// http pages policy
	httpPagesPolicyLocker.RLock()
	if len(this.HTTPPagesPolicies) > 0 {
		for _, policy := range this.HTTPPagesPolicies {
			err = policy.Init()
			if err != nil {
				httpPagesPolicyLocker.RUnlock()
				return
			}
		}
	}
	httpPagesPolicyLocker.RUnlock()

	// plans
	plansLocker.RLock()
	if len(this.Plans) > 0 {
		for _, plan := range this.Plans {
			err = plan.Init()
			if err != nil {
				plansLocker.RUnlock()
				return
			}
		}
	}
	plansLocker.RUnlock()

	// dns resolver
	if this.DNSResolver != nil {
		err = this.DNSResolver.Init()
		if err != nil {
			return
		}
	}

	// 全局服务设置
	if this.GlobalServerConfig != nil {
		err = this.GlobalServerConfig.Init()
		if err != nil {
			return
		}
	}

	// api node addrs
	if len(this.APINodeAddrs) > 0 {
		for _, addr := range this.APINodeAddrs {
			err = addr.Init()
			if err != nil {
				return err, nil
			}
		}
	}

	// network security policy
	if this.NetworkSecurityPolicy != nil {
		err = this.NetworkSecurityPolicy.Init()
		if err != nil {
			return err, nil
		}
	}

	return
}

// AddServer 添加服务
func (this *NodeConfig) AddServer(server *serverconfigs.ServerConfig) {
	if server == nil {
		return
	}

	var found = false
	for index, oldServer := range this.Servers {
		if oldServer.Id == server.Id {
			this.Servers[index] = server
			found = true
			break
		}
	}
	if !found {
		this.Servers = append(this.Servers, server)
	}
}

// RemoveServer 删除服务
func (this *NodeConfig) RemoveServer(serverId int64) {
	for index, oldServer := range this.Servers {
		if oldServer.Id == serverId {
			this.Servers = append(this.Servers[:index], this.Servers[index+1:]...)
			break
		}
	}
}

// AvailableGroups 根据网络地址和协议分组
func (this *NodeConfig) AvailableGroups() []*serverconfigs.ServerAddressGroup {
	var groupMapping = map[string]*serverconfigs.ServerAddressGroup{} // protocol://addr => Server Group
	for _, server := range this.Servers {
		if !server.IsOk() || !server.IsOn {
			continue
		}
		for _, addr := range server.FullAddresses() {
			group, ok := groupMapping[addr]
			if ok {
				group.Add(server)
			} else {
				group = serverconfigs.NewServerAddressGroup(addr)
				group.Add(server)
			}
			groupMapping[addr] = group
		}
	}
	var result = []*serverconfigs.ServerAddressGroup{}
	for _, group := range groupMapping {
		result = append(result, group)
	}
	return result
}

// HTTP3Group HTTP/3网站分组
// 这里暂时不区分集群
func (this *NodeConfig) HTTP3Group() *serverconfigs.ServerAddressGroup {
	var group = serverconfigs.NewServerAddressGroup("HTTP3")
	for _, server := range this.Servers {
		if !server.SupportsHTTP3() {
			continue
		}
		group.Add(server)
	}
	return group
}

// FindAllFirewallPolicies 获取所有的防火墙策略
func (this *NodeConfig) FindAllFirewallPolicies() []*firewallconfigs.HTTPFirewallPolicy {
	return this.firewallPolicies
}

// Save 写入到文件
func (this *NodeConfig) Save() error {
	shared.Locker.Lock()
	defer shared.Locker.Unlock()

	data, err := json.Marshal(this)
	if err != nil {
		return err
	}

	var headerData = []byte(base64.StdEncoding.EncodeToString([]byte(this.NodeId+"|"+this.Secret)) + "\n")

	encodedData, err := nodeutils.EncryptData(this.NodeId, this.Secret, data)
	if err != nil {
		return err
	}

	return os.WriteFile(Tea.ConfigFile("node.json"), append(headerData, encodedData...), 0777)
}

// PaddedId 获取填充后的ID
func (this *NodeConfig) PaddedId() string {
	return this.paddedId
}

// HasHTTPConnectionMetrics 是否含有HTTP连接数的指标
func (this *NodeConfig) HasHTTPConnectionMetrics() bool {
	return this.hasHTTPConnectionMetrics
}

// FindOrigin 读取源站配置
func (this *NodeConfig) FindOrigin(originId int64) *serverconfigs.OriginConfig {
	if this.originMap == nil {
		return nil
	}
	config, ok := this.originMap[originId]
	if ok {
		return config
	}
	return nil
}

// 搜索WAF策略
func (this *NodeConfig) lookupWeb(server *serverconfigs.ServerConfig, web *serverconfigs.HTTPWebConfig) {
	if web == nil || !web.IsOn {
		return
	}
	if web.FirewallPolicy != nil && web.FirewallPolicy.IsOn {
		// 复用节点的选项设置
		if server.HTTPFirewallPolicy != nil {
			if (web.FirewallPolicy.BlockOptions == nil || !web.FirewallPolicy.BlockOptions.IsPrior) && server.HTTPFirewallPolicy.BlockOptions != nil {
				web.FirewallPolicy.BlockOptions = server.HTTPFirewallPolicy.BlockOptions
			}
			if (web.FirewallPolicy.PageOptions == nil || !web.FirewallPolicy.PageOptions.IsPrior) && server.HTTPFirewallPolicy.PageOptions != nil {
				web.FirewallPolicy.PageOptions = server.HTTPFirewallPolicy.PageOptions
			}
			if (web.FirewallPolicy.CaptchaOptions == nil || !web.FirewallPolicy.CaptchaOptions.IsPrior) && server.HTTPFirewallPolicy.CaptchaOptions != nil {
				web.FirewallPolicy.CaptchaOptions = server.HTTPFirewallPolicy.CaptchaOptions
			}
			if (web.FirewallPolicy.SYNFlood == nil || !web.FirewallPolicy.SYNFlood.IsPrior) && server.HTTPFirewallPolicy.SYNFlood != nil {
				web.FirewallPolicy.SYNFlood = server.HTTPFirewallPolicy.SYNFlood
			}
			if (web.FirewallPolicy.Log == nil || !web.FirewallPolicy.Log.IsPrior) && server.HTTPFirewallPolicy.Log != nil {
				web.FirewallPolicy.Log = server.HTTPFirewallPolicy.Log
			}

			web.FirewallPolicy.Mode = server.HTTPFirewallPolicy.Mode
			web.FirewallPolicy.UseLocalFirewall = server.HTTPFirewallPolicy.UseLocalFirewall
		}

		this.firewallPolicies = append(this.firewallPolicies, web.FirewallPolicy)
	}
	if len(web.Locations) > 0 {
		for _, location := range web.Locations {
			// 源站
			if location.IsOn && location.ReverseProxyRef != nil && location.ReverseProxyRef.IsOn && location.ReverseProxy != nil && location.ReverseProxy.IsOn {
				for _, origin := range location.ReverseProxy.PrimaryOrigins {
					if origin.IsOn {
						this.originMap[origin.Id] = origin
					}
				}
				for _, origin := range location.ReverseProxy.BackupOrigins {
					if origin.IsOn {
						this.originMap[origin.Id] = origin
					}
				}
			}

			// Web
			if location.Web != nil && location.Web.IsOn {
				this.lookupWeb(server, location.Web)
			}
		}
	}
}

// IPIsAutoAllowed 检查是否自动允许某个IP
func (this *NodeConfig) IPIsAutoAllowed(ip string) bool {
	_, ok := this.allowedIPMap[ip]
	return ok
}

// SYNFloodConfig 获取SYN Flood配置
func (this *NodeConfig) SYNFloodConfig() *firewallconfigs.SYNFloodConfig {
	return this.synFlood
}

// UpdateCertOCSP 修改证书OCSP
func (this *NodeConfig) UpdateCertOCSP(certId int64, ocsp []byte, expiresAt int64) {
	shared.Locker.Lock()
	defer shared.Locker.Unlock()

	var servers = this.Servers
	for _, server := range servers {
		if server.HTTPS != nil &&
			server.HTTPS.SSLPolicy != nil &&
			server.HTTPS.SSLPolicy.OCSPIsOn &&
			server.HTTPS.SSLPolicy.ContainsCert(certId) {
			server.HTTPS.SSLPolicy.UpdateCertOCSP(certId, ocsp, expiresAt)
		}

		if server.TLS != nil &&
			server.TLS.SSLPolicy != nil &&
			server.TLS.SSLPolicy.OCSPIsOn &&
			server.TLS.SSLPolicy.ContainsCert(certId) {
			server.TLS.SSLPolicy.UpdateCertOCSP(certId, ocsp, expiresAt)
		}
	}
}

// FindWebPImagePolicyWithClusterId 使用集群ID查找WebP策略
func (this *NodeConfig) FindWebPImagePolicyWithClusterId(clusterId int64) *WebPImagePolicy {
	webPPolicyLocker.RLock()
	defer webPPolicyLocker.RUnlock()

	if this.WebPImagePolicies == nil {
		return nil
	}
	return this.WebPImagePolicies[clusterId]
}

// UpdateWebPImagePolicies 修改集群WebP策略
func (this *NodeConfig) UpdateWebPImagePolicies(policies map[int64]*WebPImagePolicy) {
	webPPolicyLocker.Lock()
	defer webPPolicyLocker.Unlock()
	this.WebPImagePolicies = policies
}

// FindUAMPolicyWithClusterId 使用集群ID查找UAM策略
func (this *NodeConfig) FindUAMPolicyWithClusterId(clusterId int64) *UAMPolicy {
	uamPolicyLocker.RLock()
	defer uamPolicyLocker.RUnlock()
	if this.UAMPolicies == nil {
		return nil
	}
	return this.UAMPolicies[clusterId]
}

// UpdateUAMPolicies 修改集群UAM策略
func (this *NodeConfig) UpdateUAMPolicies(policies map[int64]*UAMPolicy) {
	uamPolicyLocker.Lock()
	defer uamPolicyLocker.Unlock()
	this.UAMPolicies = policies
}

// FindHTTPCCPolicyWithClusterId 使用集群ID查找CC策略
func (this *NodeConfig) FindHTTPCCPolicyWithClusterId(clusterId int64) *HTTPCCPolicy {
	httpCCPolicyLocker.RLock()
	defer httpCCPolicyLocker.RUnlock()
	if this.HTTPCCPolicies == nil {
		return nil
	}
	return this.HTTPCCPolicies[clusterId]
}

// UpdateHTTPCCPolicies 修改集群CC策略
func (this *NodeConfig) UpdateHTTPCCPolicies(policies map[int64]*HTTPCCPolicy) {
	httpCCPolicyLocker.Lock()
	defer httpCCPolicyLocker.Unlock()
	this.HTTPCCPolicies = policies
}

// FindHTTP3PolicyWithClusterId 使用集群ID查找HTTP/3策略
func (this *NodeConfig) FindHTTP3PolicyWithClusterId(clusterId int64) *HTTP3Policy {
	http3PolicyLocker.RLock()
	defer http3PolicyLocker.RUnlock()
	if this.HTTP3Policies == nil {
		return nil
	}
	return this.HTTP3Policies[clusterId]
}

// FindHTTP3Ports 查询HTTP/3所有端口
func (this *NodeConfig) FindHTTP3Ports() (ports []int) {
	http3PolicyLocker.RLock()
	defer http3PolicyLocker.RUnlock()
	for _, policy := range this.HTTP3Policies {
		if !policy.IsOn {
			continue
		}
		if policy.Port <= 0 {
			policy.Port = DefaultHTTP3Port
		}
		if !lists.ContainsInt(ports, policy.Port) {
			ports = append(ports, policy.Port)
		}
	}
	return
}

// UpdateHTTP3Policies 修改集群HTTP/3策略
func (this *NodeConfig) UpdateHTTP3Policies(policies map[int64]*HTTP3Policy) {
	http3PolicyLocker.Lock()
	defer http3PolicyLocker.Unlock()
	this.HTTP3Policies = policies
}

// UpdateHTTPPagesPolicies 修改集群自定义页面策略
func (this *NodeConfig) UpdateHTTPPagesPolicies(policies map[int64]*HTTPPagesPolicy) {
	httpPagesPolicyLocker.Lock()
	defer httpPagesPolicyLocker.Unlock()
	this.HTTPPagesPolicies = policies
}

// FindHTTPPagesPolicyWithClusterId 使用集群ID查找自定义页面策略
func (this *NodeConfig) FindHTTPPagesPolicyWithClusterId(clusterId int64) *HTTPPagesPolicy {
	httpPagesPolicyLocker.RLock()
	defer httpPagesPolicyLocker.RUnlock()
	if this.HTTPPagesPolicies == nil {
		return nil
	}
	return this.HTTPPagesPolicies[clusterId]
}

// UpdatePlans 更新套餐
func (this *NodeConfig) UpdatePlans(planMap map[int64]*serverconfigs.PlanConfig) {
	plansLocker.Lock()
	this.Plans = planMap
	plansLocker.Unlock()
}

// FindAllPlans 查找所有套餐
func (this *NodeConfig) FindAllPlans() map[int64]*serverconfigs.PlanConfig {
	plansLocker.RLock()
	defer plansLocker.RUnlock()
	return this.Plans
}

// 查找单个套餐
func (this *NodeConfig) FindPlan(planId int64) *serverconfigs.PlanConfig {
	plansLocker.RLock()
	defer plansLocker.RUnlock()
	return this.Plans[planId]
}

// SecretHash 对Id和Secret的Hash计算
func (this *NodeConfig) SecretHash() string {
	return this.secretHash
}

// HasConnTimeoutSettings 检查是否有连接超时设置
func (this *NodeConfig) HasConnTimeoutSettings() bool {
	return this.GlobalServerConfig != nil && (this.GlobalServerConfig.Performance.AutoReadTimeout || this.GlobalServerConfig.Performance.AutoWriteTimeout)
}