wangwanjie/gately v0.6.5

on GitHub

中文

后端超时、访客超时与自动重试

• 反向代理站点的「流量」页新增「后端超时」：连接、TLS 握手、等待响应头三项，留空分别为 10 秒、10 秒与不限；等待响应头超时返回 504，不影响之后的下载与 WebSocket、SSE 等长连接。
• 连接后端失败（拒绝连接、不可达、连接超时）时，同一个请求立即改用下一个后端，一个请求最多尝试 3 个后端；这时请求还没有发出，POST 等请求换后端同样安全。
• 「访客超时」限制读取请求体与写出响应时的空闲时间，默认 60 秒，用于断开极慢发送或读取的访客；读取请求体超时返回 408。
• 导入 nginx 配置时，proxy_connect_timeout 与 proxy_read_timeout 转换为站点的连接超时与等待响应头超时。

详见 后端超时 与 访客超时。

向后端传递身份信息

原来的「传递用户名」与「传递邮箱」合并为「传递身份信息」列表，每行把登录用户的一项信息写入一个请求头：用户名、邮箱、显示名或分组，例如 Firefly III 这类用邮箱作为账号的应用可以直接读取 Remote-Email。访客自带的同名请求头（包括用下划线代替连字符的写法）在认证前删除，无法伪造；访客也无法借 Connection 头让这些请求头被去掉。旧配置升级后自动转换。详见 传递身份信息。

自动放行防火墙

Web 服务的监听、端口转发与协议分流的规则新增「自动放行防火墙」开关，只在本机防火墙（nftables、iptables 或 ip6tables）中放行实际监听的端口，支持 IPv6 与端口区间，连续端口合并为一条规则；开启 HTTP/3 的监听同时放行同号 UDP 端口，只监听回环地址时无需放行。监听停止或删除时撤销。详见 自动放行防火墙。

运行日志

• Web 服务的访问日志按天切分并压缩归档，可设置保留天数与总大小，过去的访问记录可以继续检索；「加载更早的日志」会查找归档。
• 日志工具栏新增「导出」，按当前筛选条件导出全部日志（含文件与归档中的历史），格式为 CSV（UTF-8 带 BOM，Excel 可直接打开，已防公式注入）或 JSON Lines；只读账号导出的内容同样隐藏地址中的密码与令牌。
• 「设置 → 运行」新增「日志目录」，可以把运行日志放到外接硬盘等其他目录。
• 来源筛选列出全部来源；同名的 IPv4 与 IPv6 监听的日志不再混在一起，站点的「日志」窗口只显示本监听的访客。
• 待写盘的日志达到 256 KB 时立即写盘，高并发站点不再丢访问日志；手机上打开日志重新停在最新一条。

详见 运行日志。

入侵防护：IPv6 严格模式

端口扫描检测新增「IPv6 严格模式」：IPv6 来源只能连接开放端口（正在监听的端口加额外开放端口），第一次连接其他端口即按 /64 封禁；IPv4 仍按阈值检测。端口短暂停止监听时 30 秒内仍视为开放，FTP 服务的被动端口范围自动计入开放端口。详见 入侵防护。

托管进程资源

概览页新增「托管进程」卡片，性能页列出 Gately 管理的外部程序（frpc / frps、tailscaled、NetBird、cloudflared、File Browser）各自的 CPU 与内存，进程重启后曲线保持连续。详见 性能监控。

其他改进与修复

• 站点链接：监听只对本机开放、经协议分流或端口转发进入时，站点链接自动使用规则的入口端口，例如 4435 监听由 4433 的 SNI 分流转入时链接用 4433；手动填写的访问端口仍优先。
• 网络拓扑新增「聚焦活动」，只显示最近 60 秒有请求或有活动 IP 的站点与后端；活动中的节点不再被收进「其余 N 个」。
• 网络自检：本机 DNS 偶尔超时不再把解析正确的 DDNS 记录报为未解析，改用公共 DNS 复查。
• DDNS：任务停止或重启时取消的同步不再记录错误、不再把记录标为失败。
• 扫描器造成的 TLS 握手失败改为调试级别日志，运行日志不再被刷屏；目标使用 {host} 等变量的重定向站点，对没有 Host 头的请求返回 400。
• 入侵防护封禁表改为紧凑格式写盘，只是到期的封禁不再触发重写。
• 导入的反向代理配置保留监听的 HTTP/3 设置。
• 登录页不再显示默认账号与重置密码提示。
• Web 终端：文件管理器的编辑器用右上角 X 或 Esc 关闭后可以再次打开；手机上选择模式向上拖过一屏后复制正常。
• 界面：站点行在平板与小屏笔记本上不再把域名挤成一列；IPv6 监听地址显示为 http://[::1]:18951。

更新说明：https://gately.cn/news/v0.6.5

English

Backend timeouts, visitor timeouts and automatic retry

• The Traffic tab of reverse proxy sites gets Backend timeouts: connect, TLS handshake and response header, defaulting to 10 seconds, 10 seconds and no limit. A response header timeout returns 504 and does not affect downloads or long connections such as WebSocket and SSE afterwards.
• When a backend cannot be reached (connection refused, unreachable or connect timeout), the same request moves to the next backend at once, trying up to 3 backends per request; the request has not been sent yet at that point, so this is safe for POST and other requests too.
• Visitor timeouts limit idle time while reading the request body and writing the response, 60 seconds by default, to drop visitors that send or read extremely slowly; a request body read timeout returns 408.
• nginx import turns proxy_connect_timeout and proxy_read_timeout into the site's connect and response header timeouts.

See Backend timeouts and Visitor timeouts.

Passing identity to the backend

The separate "Pass user name" and "Pass email" settings become one Pass identity list, where each row writes one field of the signed-in user into a request header: user name, email, display name or groups. Apps that use email as the account, such as Firefly III, can read Remote-Email directly. Copies of these headers sent by visitors, including variants with underscores instead of hyphens, are removed before authentication and cannot be forged, and visitors cannot get them dropped through the Connection header either. Existing settings are converted on upgrade. See Pass identity.

Opening firewall ports automatically

Web Services listeners and the rules of Port Forwarding and Protocol Routing get an Open firewall port switch that allows only the ports actually listened on in the local firewall (nftables, iptables or ip6tables), with IPv6 and port ranges, merging consecutive ports into one rule; listeners with HTTP/3 also open the UDP port with the same number, and listeners on loopback addresses need nothing. The rules are removed when the listener stops or is deleted. See Open firewall port.

Run logs

• Web Services access logs are split by day and compressed, with retention days and a total size limit, so past traffic can still be searched; Load earlier logs looks into the archives.
• The log toolbar gets Export, which downloads every entry matching the current filters, including the history in log files and archives, as CSV (UTF-8 with BOM for Excel, guarded against formula injection) or JSON Lines; exports by read-only accounts hide passwords and tokens in addresses just as the viewer does.
• Settings → Runtime gets Log directory, to keep run logs in another directory such as one on an external disk.
• The Source filter lists every source; logs of IPv4 and IPv6 listeners with the same name are no longer mixed, and a site's Logs window shows only its own listener's visitors.
• Logs are written to disk as soon as 256 KB are waiting, so busy sites no longer lose access log entries; on phones the log viewer opens at the newest entry again.

See Run logs.

Guard: IPv6 strict mode

Port scan detection gets IPv6 strict mode: IPv6 sources may only connect to open ports (listening ports plus the extra open ports), and the first connection to any other port bans their /64; IPv4 keeps the threshold. A port that stops listening for a moment still counts as open for 30 seconds, and the FTP service's passive port range counts as open automatically. See Guard.

Managed process resources

The Overview page gets a Managed processes card, and the Performance page lists the CPU and memory of each external program Gately manages (frpc / frps, tailscaled, NetBird, cloudflared, File Browser), with curves that continue across restarts. See Performance.

Other improvements and fixes

• Site links: when a listener is only reachable through Protocol Routing or Port Forwarding, site links use the rule's entry port, for example 4433 for a listener on 4435 fed by an SNI rule on 4433; a manually set access port still wins.
• The network topology gets Active only, showing just the sites and backends with requests or active IPs in the last 60 seconds; active nodes are no longer folded into "N more".
• Network self-check: an occasional local DNS timeout no longer reports a correctly resolving DDNS record as unresolved; public DNS is used to double-check.
• DDNS: syncs cancelled because a task stops or restarts no longer log errors or mark records as failed.
• TLS handshake failures caused by scanners are logged at debug level, so they no longer flood the run log; redirect sites whose target uses variables such as {host} answer requests without a Host header with 400.
• Guard writes its ban table in a compact format, and bans that merely expire no longer trigger a rewrite.
• Imported reverse proxy settings keep the HTTP/3 setting of listeners.
• The sign-in page no longer shows the default account and the reset-password hint.
• Web Terminal: the file manager's editor opens again after being closed with the X or Esc; on phones, Copy in select mode works after dragging the selection up past the top of the screen.
• UI: site rows no longer squeeze domains into a narrow column on tablets and small laptops; IPv6 listen addresses are shown as http://[::1]:18951.

Release notes: https://gately.cn/en/news/v0.6.5