wangwanjie/gately v0.6.6

on GitHub

Security / 安全修复

访客可借下划线写法向后端伪造来源请求头。 v0.6.5.5 及更早版本只删除访客自带的 X-Real-Ip 等精确同名头，PHP、WSGI、CGI 一类后端会把 X_Forwarded_For、X_Real_IP、X_Forwarded_Proto 等写法与正式头映射为同一变量，访客因此可以向后端伪造客户端地址或访问协议；转发认证的子请求同样受影响，认证服务按 X-Original-URI 判断路径时也可被访客自带的值误导。v0.6.6 起转发前一律删除这些头及其变体，X-Original-URI 由 Gately 写入。

WebDAV、FTP、SMB 的密码可被无限次猜测。 v0.6.5.5 及更早版本的文件服务没有登录失败次数限制。v0.6.6 起同一来源 15 分钟内失败 10 次即拒绝到窗口结束（IPv6 按 /64）。

公告：GHSA-qqg3-r235-cjxq、GHSA-4g96-47vq-mj47

其他加固：恢复账号文件时换用新的会话密钥（旧备份不再让此后吊销的会话复活）；恢复备份限制解压总量与文件数；nginx 导入限制块嵌套深度（深度嵌套会让进程崩溃）；超长 Host 头返回 400；登录失败写入的用户名截断；管理端口慢速请求防护；Go 1.26.11 标准库与 golang.org/x/net、klauspost/compress、andybalholm/brotli、go-smb2（GO-2026-5051）依赖的安全更新。建议所有用户升级。

Visitors could forge source headers to backends through underscore variants. v0.6.5.5 and earlier only removed the exact X-Real-Ip and similar headers sent by visitors, while PHP, WSGI and CGI backends map X_Forwarded_For, X_Real_IP, X_Forwarded_Proto and similar forms to the same variable as the real header, so a visitor could tell such a backend any client address or scheme; forward auth subrequests were affected too, and auth services deciding by X-Original-URI could be misled by a visitor's value. From v0.6.6 these headers and their variants are always removed before forwarding, and Gately writes X-Original-URI itself.

WebDAV, FTP and SMB passwords could be guessed without limit. The file services in v0.6.5.5 and earlier had no limit on failed logins. From v0.6.6 a source with 10 failures within 15 minutes is refused until the window ends (IPv6 grouped by /64).

Advisories: GHSA-qqg3-r235-cjxq, GHSA-4g96-47vq-mj47

Other hardening: restoring an account file uses a new session secret (an old backup no longer revives sessions revoked later); restore limits the expanded size and file count; nginx import limits block nesting (deep nesting crashed the process); oversized Host headers get 400; user names from failed logins are clipped; slow request protection on the admin port; security updates in the Go 1.26.11 standard library and golang.org/x/net, klauspost/compress, andybalholm/brotli and go-smb2 (GO-2026-5051). Upgrading is recommended for everyone.

中文

账号与会话

• 服务端会话撤销：登出时吊销该令牌；「设置 → 账号与安全 → 登录会话」新增「退出所有设备」（POST /api/account/sessions/revoke），密码、Passkey、第三方登录与飞牛网关登录签发的会话立即全部失效，API 令牌不受影响。
• 出站请求限制（restrictOutbound，默认关闭）：开启后 Webhook、通知、IP 列表订阅、DDNS 回调、更新检查、第三方登录等管理员配置的出站请求拒绝回环、私网、链路本地（含 169.254.169.254）等地址，按解析后的 IP 在每次连接时检查，重定向与 DNS 重绑定同样覆盖；反向代理上游、网络唤醒、存储挂载等面向内网的功能不受影响。
• 慢速请求防护：管理端口按接口限制请求体的读取，普通接口须在 60 秒内发完；备份恢复、升级包与文件上传等大文件接口不限总时长，但须持续发送并保持每秒 4 KiB 以上的平均速率。

Web 服务

• 分路径后端去掉前缀（#86）：分路径后端新增「转发时去掉路径前缀」，/api/zyqd/abc 发往后端为 /abc，后端地址自带的路径接在前面，对应 nginx 的 proxy_pass http://后端/;；导入 nginx 配置时自动转换。
• 访客源端口（#83）：开启「添加 X-Forwarded-*」后向后端发送 X-Real-Port 与 X-Forwarded-For-Port；Gately 在 CDN / 反向代理之后时，可在全局设置中指定「真实端口请求头」。
• 双层 Gately（#81）：外层只做 WAF、内层负责登录时，两层填写相同的认证标记密钥，外层站点开启「信任后端认证标记」，内层认证过的访客在外层同样跳过 WAF。

详见 Web 服务 与 WAF。

备份与恢复（#85）

恢复配置新增「保留当前管理员账号」：备份里的账号、API 令牌与管理界面的第三方登录设置保持当前值，备份可以不含 account.json，适合把另一台实例的配置迁移过来。详见 配置 · 备份与恢复。

问题修复

• 动态域名（#84）：dynv6 记录的主域名填成 dynv6.net、子域名填 xxxx 时，同步与删除服务商记录不再返回 404，会自动匹配到 xxxx.dynv6.net 区域。

性能

• 封禁名单在大量封禁时增删不再重建网段列表；站点路由在精确域名未命中时只比较通配域名；限流与认证失败记录的过期清理改为每秒最多一次。
• 站点基本认证与 WebDAV 缓存验证通过的 bcrypt 结果 10 分钟，每个请求的 CPU 开销从约 85 毫秒降到微秒级。
• 端口转发在不能使用 splice 时复用缓冲区；实时连接列表只构造返回的 500 行；来源类请求头清理不再分配内存。
• 管理界面的站点统计、Docker 状态与日志、终端会话列表在浏览器标签页隐藏时停止轮询。

更新说明：https://gately.cn/news/v0.6.6

English

Accounts and sessions

• Server-side session revocation: logging out revokes the token, and "Settings → Account & Security → Sign-in sessions" has a new "Sign out of all devices" (POST /api/account/sessions/revoke) that ends all sessions from password, Passkey, third-party and fnOS gateway logins at once. API tokens are not affected.
• Outbound request limits (restrictOutbound, off by default): when on, outbound requests to administrator-configured addresses (webhooks, notifications, IP list subscriptions, DDNS callbacks, update checks, third-party login and so on) refuse loopback, private and link-local addresses (including 169.254.169.254). The check runs on the resolved IP for every connection, so redirects and DNS rebinding are covered. Reverse proxy upstreams, Wake-on-LAN, storage mounts and other internal-network features are not affected.
• Slow request protection: the admin port limits request body reads per endpoint. Regular endpoints must finish within 60 seconds; large-file endpoints (backup restore, upgrade packages, file uploads) have no total time limit but must keep sending at 4 KiB/s or more on average.

Web service

• Strip the path prefix on per-path backends (#86): a per-path backend can now strip its prefix before forwarding, so /api/zyqd/abc reaches the backend as /abc, with any path in the backend address in front. This matches nginx's proxy_pass http://backend/;, and nginx imports convert it automatically.
• Visitor source port (#83): with "Add X-Forwarded-*" enabled, X-Real-Port and X-Forwarded-For-Port are sent to the backend. When Gately sits behind a CDN or reverse proxy, the global settings take a "Real port header".
• Two-tier Gately (#81): when an outer instance only runs the WAF and an inner instance handles sign-in, set the same auth marker key on both and enable "Trust backend auth marker" on the outer site; visitors authenticated by the inner instance then skip the outer WAF as well.

See Web service and WAF.

Backup and restore (#85)

Restoring a configuration can now "Keep the current administrator account": the account, API tokens and third-party login to the admin UI keep their current values, and the backup may omit account.json, which suits moving another instance's configuration over. See Configuration · Backup and restore.

Fixes

• DDNS (#84): dynv6 records whose main domain is dynv6.net with sub domain xxxx no longer fail with 404 on sync and on deleting the provider record; the xxxx.dynv6.net zone is matched automatically.

Performance

• The ban list no longer rebuilds its CIDR list on every change when it holds many bans; site routing only compares wildcard domains after an exact-domain miss; expired rate limit and login failure records are swept at most once per second.
• Site Basic authentication and WebDAV cache successful bcrypt checks for 10 minutes, bringing the CPU cost per request from about 85 ms down to microseconds.
• Port forwarding reuses copy buffers when splice cannot be used; the live connection list only builds the 500 rows it returns; stripping source headers no longer allocates.
• Site statistics, Docker stats and logs, and the terminal session list in the web UI stop polling while the browser tab is hidden.

Release notes: https://gately.cn/en/news/v0.6.6