为什么你的全球化网站总在“无限循环”？从 302 重定向死循环、CDN 缓存污染到精准就近调度：GeoIP、CDN 与 HTTP 重定向全链路架构深潜与避坑指南

# /etc/nginx/conf.d/realip_cloudflare.conf

# 1. 声明 Cloudflare 官方公布的所有可信代理网段
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2a06:98c0::/29;
set_real_ip_from 2c0f:f248::/32;

# 2. 指定从专有凭据头中提取原始客户端真实 IP
real_ip_header CF-Connecting-IP;

# 3. 开启递归排除，确保拿到的是最外层接入客户端的真正公网 IP
real_ip_recursive on;

# /etc/nginx/conf.d/geoip2_engine.conf

geoip2 /var/lib/GeoIP/GeoLite2-Country.mmdb {
    auto_reload 15m;
    $geoip2_data_country_code default=US country iso_code;
    $geoip2_data_country_name country names en;
}

# 映射不同国家代码对应的语言子路径
map $geoip2_data_country_code $target_prefix {
    default     /en-us/;
    CN          /zh-cn/;
    JP          /ja-jp/;
    DE          /de-de/;
}

# /etc/nginx/sites-available/example.conf

server {
    listen 443 ssl http2;
    server_name example.com;

    # SSL 证书与安全选项略...

    location = / {
        # 防御措施 1：告诉所有中间代理与 CDN，必须按照客户端国家隔离缓存！
        add_header Vary "Accept-Encoding, CF-IPCountry" always;

        # 防御措施 2：严禁公共 CDN 节点对 302 响应进行共享持久存储
        add_header Cache-Control "private, no-cache, no-store, must-revalidate" always;

        # 防御措施 3：执行临时 302 调度
        return 302 $target_prefix;
    }

    # 实际内容目录允许长期高速缓存
    location /zh-cn/ {
        add_header Cache-Control "public, max-age=14400" always;
        try_files $uri $uri/ /index.html;
    }

    location /en-us/ {
        add_header Cache-Control "public, max-age=14400" always;
        try_files $uri $uri/ /index.html;
    }
}

<#
.SYNOPSIS
    Windows 11 原生 GeoIP、CDN 与 302 重定向全链路健康体检与安全审计脚本
.DESCRIPTION
    零第三方依赖，严格脱敏打印，支持人工彩色展示与 AI Agent 结构化 JSON 交付。
#>

[CmdletBinding()]
param(
    [string]$TargetUrl = "https://example.com/",
    [switch]$Agent
)

# 强制 TLS 1.2 / 1.3
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 -bor [Net.SecurityProtocolType]::Tls13

function Mask-IP ([string]$ip) {
    if (-not $ip) { return "unknown" }
    return ($ip -replace '\b(\d{1,3}\.\d{1,3}\.)\d{1,3}\.\d{1,3}\b', '$1*.*')
}

$IsAgentMode = $Agent.IsPresent -or ($env:AGENT_MODE -eq "1")

if (-not $IsAgentMode) {
    Write-Host "================================================================================" -ForegroundColor Cyan
    Write-Host "  GEO IP · CDN · 302 REDIRECT AUDIT & HARDENING TOOLKIT (Windows 11)" -ForegroundColor Yellow
    Write-Host "  Target : $TargetUrl" -ForegroundColor White
    Write-Host "================================================================================" -ForegroundColor Cyan
}

# 1. 探测客户端出口网络与 DNS
$EgressIP = "unknown"
$GeoCountry = "unknown"
try {
    $traceReq = Invoke-WebRequest -Uri "https://www.cloudflare.com/cdn-cgi/trace" -UseBasicParsing -TimeoutSec 5 -ErrorAction SilentlyContinue
    if ($traceReq.Content) {
        if ($traceReq.Content -match 'ip=([^\r\n]+)') { $EgressIP = $matches[1] }
        if ($traceReq.Content -match 'loc=([^\r\n]+)') { $GeoCountry = $matches[1] }
    }
} catch {}

$MaskedEgress = Mask-IP $EgressIP

# 2. 探测目标域名与 CDN Ingress
$UriObj = [System.Uri]$TargetUrl
$HostName = $UriObj.Host
$ResolvedIPs = @()
try {
    $dnsQuery = [System.Net.Dns]::GetHostAddresses($HostName)
    foreach ($addr in $dnsQuery) {
        $ResolvedIPs += (Mask-IP $addr.IPAddressToString)
    }
} catch {
    $ResolvedIPs += "DNS_RESOLVE_FAILED"
}

# 3. 发送根路径请求，审查 302 响应与头部安全
$HttpCode = 0
$Location = ""
$VaryHeader = ""
$CacheControl = ""
$CdnProvider = "unknown"
$CdnCacheStatus = "NONE"
$EdgeRay = ""

try {
    $req = [System.Net.HttpWebRequest]::Create($TargetUrl)
    $req.AllowAutoRedirect = $false
    $req.Timeout = 8000
    $req.UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) NativeAudit/2.6"
    
    $response = $req.GetResponse()
    $HttpCode = [int]$response.StatusCode
    $response.Close()
} catch [System.Net.WebException] {
    if ($_.Response) {
        $HttpCode = [int]$_.Response.StatusCode
        $Location = $_.Response.Headers["Location"]
        $VaryHeader = $_.Response.Headers["Vary"]
        $CacheControl = $_.Response.Headers["Cache-Control"]
        $CdnCacheStatus = $_.Response.Headers["CF-Cache-Status"]
        if (-not $CdnCacheStatus) { $CdnCacheStatus = $_.Response.Headers["X-Cache"] }
        $EdgeRay = $_.Response.Headers["CF-RAY"]
        $serverHeader = $_.Response.Headers["Server"]
        if ($serverHeader -match "cloudflare") { $CdnProvider = "Cloudflare" }
        elseif ($serverHeader -match "cloudfront") { $CdnProvider = "CloudFront" }
        elseif ($serverHeader) { $CdnProvider = $serverHeader }
        $_.Response.Close()
    }
}

# 4. 风险分析与脆弱性判断
$HasVaryGeo = $false
if ($VaryHeader -and ($VaryHeader -match "CF-IPCountry|X-Country|Geo|Accept-Language")) {
    $HasVaryGeo = $true
}

$CachePoisonRisk = "LOW"
if ($HttpCode -eq 302 -and -not $HasVaryGeo -and ($CacheControl -match "public" -or $CdnCacheStatus -eq "HIT")) {
    $CachePoisonRisk = "HIGH_CRITICAL"
} elseif ($HttpCode -eq 302 -and -not $HasVaryGeo) {
    $CachePoisonRisk = "MEDIUM_WARNING"
}

$ResultObj = [PSCustomObject]@{
    timestamp             = (Get-Date -Format "yyyy-MM-ddTHH:mm:ssZ")
    target_url            = $TargetUrl
    client_egress_masked  = $MaskedEgress
    detected_country      = $GeoCountry
    cdn_provider          = $CdnProvider
    cdn_cache_status      = $CdnCacheStatus
    http_status           = $HttpCode
    redirect_location     = $Location
    has_vary_geo_header   = $HasVaryGeo
    cache_control         = $CacheControl
    cache_poisoning_risk  = $CachePoisonRisk
    audit_status          = $(if ($CachePoisonRisk -eq "HIGH_CRITICAL") { "FAILED" } else { "PASSED" })
}

if ($IsAgentMode) {
    # Agent 结构化输出
    $ResultObj | ConvertTo-Json -Compress
} else {
    Write-Host "[*] 客户端网络状态:" -ForegroundColor Green
    Write-Host "    出口 IP (已脱敏) : $MaskedEgress"
    Write-Host "    地理归属国家     : $GeoCountry"
    Write-Host "    目标解析 CDN IP  : $($ResolvedIPs -join ', ')"
    Write-Host ""
    Write-Host "[*] 边缘重定向与缓存审计:" -ForegroundColor Green
    Write-Host "    HTTP 状态码      : $HttpCode"
    Write-Host "    目标 Location    : $Location"
    Write-Host "    CDN 厂商识别     : $CdnProvider"
    Write-Host "    Vary 响应头      : $VaryHeader"
    Write-Host "    Cache-Control    : $CacheControl"
    Write-Host "    边缘缓存命中状态 : $CdnCacheStatus"
    Write-Host ""
    
    if ($CachePoisonRisk -eq "HIGH_CRITICAL") {
        Write-Host "[!] 致命风险警告: 发现高危 302 缓存污染漏洞！" -ForegroundColor Red
        Write-Host "    原因: 302 响应被 CDN 缓存，但未声明 Vary: CF-IPCountry 隔离键！" -ForegroundColor Red
        Write-Host "    建议: 在源站立即配置 Cache-Control: no-store 或注入 Vary 头。" -ForegroundColor Yellow
    } elseif ($CachePoisonRisk -eq "MEDIUM_WARNING") {
        Write-Host "[i] 潜在风险提示: 302 重定向未配置明确的地域 Vary 头，请持续观察。" -ForegroundColor Yellow
    } else {
        Write-Host "[✓] 审计通过: 边缘重定向隔离策略健壮，未发现缓存投毒风险。" -ForegroundColor Green
    }
}

#!/usr/bin/env bash
# ==============================================================================
# GeoIP、CDN 与 302 重定向全链路深度健康审计工具 (Ubuntu 26.04 原生)
# 零第三方依赖，严格脱敏打印，支持人工交互模式与 Agent 结构化 JSON 模式
# ==============================================================================
set -euo pipefail

TARGET_URL="${1:-https://example.com/}"
AGENT_MODE=0

for arg in "$@"; do
    if [[ "$arg" == "--agent" ]]; then
        AGENT_MODE=1
    fi
done
if [[ "${AGENT_MODE:-0}" == "1" || "${AGENT_ENV:-}" == "1" ]]; then
    AGENT_MODE=1
fi

mask_ip() {
    local ip="$1"
    echo "$ip" | sed -E 's/([0-9]{1,3}\.[0-9]{1,3}\.)[0-9]{1,3}\.[0-9]{1,3}/\1*.* /g'
}

# 1. 探测客户端出口网络与国家识别
EGRESS_RAW=$(curl -s --max-time 4 "https://www.cloudflare.com/cdn-cgi/trace" 2>/dev/null || true)
CLIENT_IP=$(echo "$EGRESS_RAW" | grep '^ip=' | cut -d= -f2 || echo "unknown")
CLIENT_LOC=$(echo "$EGRESS_RAW" | grep '^loc=' | cut -d= -f2 || echo "unknown")
MASKED_IP=$(mask_ip "$CLIENT_IP")

# 2. 探测目标 CDN 边缘响应头
HEADER_DUMP=$(curl -sI --max-time 6 "$TARGET_URL" 2>/dev/null || true)
HTTP_CODE=$(echo "$HEADER_DUMP" | grep -i '^HTTP/' | tail -n1 | awk '{print $2}' || echo "0")
LOCATION=$(echo "$HEADER_DUMP" | grep -i '^location:' | tail -n1 | cut -d' ' -f2- | tr -d '\r' || echo "")
VARY=$(echo "$HEADER_DUMP" | grep -i '^vary:' | tail -n1 | cut -d' ' -f2- | tr -d '\r' || echo "")
CACHE_CTRL=$(echo "$HEADER_DUMP" | grep -i '^cache-control:' | tail -n1 | cut -d' ' -f2- | tr -d '\r' || echo "")
CF_CACHE=$(echo "$HEADER_DUMP" | grep -i '^cf-cache-status:' | tail -n1 | cut -d' ' -f2- | tr -d '\r' || echo "NONE")
CF_RAY=$(echo "$HEADER_DUMP" | grep -i '^cf-ray:' | tail -n1 | cut -d' ' -f2- | tr -d '\r' || echo "")
SERVER=$(echo "$HEADER_DUMP" | grep -i '^server:' | tail -n1 | cut -d' ' -f2- | tr -d '\r' || echo "unknown")

# 3. 风险判定
HAS_VARY_GEO=false
if echo "$VARY" | grep -iE 'CF-IPCountry|X-Country|Geo|Accept-Language' >/dev/null 2>&1; then
    HAS_VARY_GEO=true
fi

RISK="LOW"
if [[ "$HTTP_CODE" == "302" && "$HAS_VARY_GEO" == "false" ]]; then
    if [[ "$CACHE_CTRL" =~ public || "$CF_CACHE" == "HIT" ]]; then
        RISK="HIGH_CRITICAL"
    else
        RISK="MEDIUM_WARNING"
    fi
fi

if [[ "$AGENT_MODE" -eq 1 ]]; then
    printf '{"timestamp":"%s","target_url":"%s","client_egress_masked":"%s","detected_country":"%s","http_code":%d,"redirect_location":"%s","has_vary_geo":%s,"cache_poison_risk":"%s","server":"%s"}\n' \
        "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
        "$TARGET_URL" \
        "$MASKED_IP" \
        "$CLIENT_LOC" \
        "${HTTP_CODE:-0}" \
        "$LOCATION" \
        "$HAS_VARY_GEO" \
        "$RISK" \
        "$SERVER"
else
    echo "================================================================================"
    echo "  GEO IP · CDN · 302 REDIRECT AUDITOR (Ubuntu 26.04 Native)"
    echo "================================================================================"
    echo "[*] 客户端出口 IP (脱敏) : $MASKED_IP (国家: $CLIENT_LOC)"
    echo "[*] HTTP 返回状态码       : $HTTP_CODE"
    echo "[*] 目标重定向 Location   : $LOCATION"
    echo "[*] 边缘服务器标识 Server : $SERVER"
    echo "[*] Vary 隔离声明         : ${VARY:-<未设置>}"
    echo "[*] Cache-Control 策略    : ${CACHE_CTRL:-<未设置>}"
    echo "[*] CDN 缓存命中状态      : $CF_CACHE"
    echo "--------------------------------------------------------------------------------"
    if [[ "$RISK" == "HIGH_CRITICAL" ]]; then
        echo -e "\033[31m[!] 发现严重漏洞: 302 重定向存在全局缓存污染风险！请务必补全 Vary 或禁用公网缓存！\033[0m"
    elif [[ "$RISK" == "MEDIUM_WARNING" ]]; then
        echo -e "\033[33m[i] 提示: 302 缺少显式地域 Vary 头，请检查多语言分流一致性。\033[0m"
    else
        echo -e "\033[32m[✓] 恭喜: 边缘重定向防污染策略配置优秀，审计通过。\033[0m"
    fi
fi

#!/usr/bin/env zsh
# ==============================================================================
# GeoIP、CDN 与 302 重定向全链路深度健康审计工具 (macOS 26 原生)
# 零第三方依赖，严格脱敏打印，支持交互式展示与 Agent 自动化模式
# ==============================================================================
set -eu

TARGET_URL="${1:-https://example.com/}"
AGENT_MODE=0

for arg in "$@"; do
    if [[ "$arg" == "--agent" ]]; then
        AGENT_MODE=1
    fi
done

mask_ip() {
    local ip="$1"
    echo "$ip" | sed -E 's/([0-9]{1,3}\.[0-9]{1,3}\.)[0-9]{1,3}\.[0-9]{1,3}/\1*.* /g'
}

# 1. 探测出口与 DNS 解析
EGRESS_DATA=$(curl -s --max-time 4 "https://www.cloudflare.com/cdn-cgi/trace" 2>/dev/null || true)
RAW_IP=$(echo "$EGRESS_DATA" | awk -F= '$1=="ip"{print $2}')
RAW_LOC=$(echo "$EGRESS_DATA" | awk -F= '$1=="loc"{print $2}')
MASKED_IP=$(mask_ip "${RAW_IP:-127.0.0.1}")

# 2. 审查目标网站 302 头部
RESP_HEADERS=$(curl -sI --max-time 6 "$TARGET_URL" 2>/dev/null || true)
HTTP_CODE=$(echo "$RESP_HEADERS" | awk 'NR==1{print $2}')
LOCATION=$(echo "$RESP_HEADERS" | awk -F': ' 'tolower($1)=="location"{print $2}' | tr -d '\r')
VARY=$(echo "$RESP_HEADERS" | awk -F': ' 'tolower($1)=="vary"{print $2}' | tr -d '\r')
CACHE_CTRL=$(echo "$RESP_HEADERS" | awk -F': ' 'tolower($1)=="cache-control"{print $2}' | tr -d '\r')
CF_CACHE=$(echo "$RESP_HEADERS" | awk -F': ' 'tolower($1)=="cf-cache-status"{print $2}' | tr -d '\r')
SERVER=$(echo "$RESP_HEADERS" | awk -F': ' 'tolower($1)=="server"{print $2}' | tr -d '\r')

HAS_VARY_GEO="false"
if echo "${VARY:-}" | grep -Ei 'CF-IPCountry|X-Country|Geo|Accept-Language' >/dev/null 2>&1; then
    HAS_VARY_GEO="true"
fi

RISK="LOW"
if [[ "${HTTP_CODE:-}" == "302" && "$HAS_VARY_GEO" == "false" ]]; then
    if [[ "${CACHE_CTRL:-}" =~ "public" || "${CF_CACHE:-}" == "HIT" ]]; then
        RISK="HIGH_CRITICAL"
    else
        RISK="MEDIUM_WARNING"
    fi
fi

if [[ "$AGENT_MODE" -eq 1 ]]; then
    printf '{"timestamp":"%s","target_url":"%s","client_egress_masked":"%s","detected_country":"%s","http_code":"%s","location":"%s","has_vary_geo":%s,"risk":"%s","server":"%s"}\n' \
        "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
        "$TARGET_URL" \
        "$MASKED_IP" \
        "${RAW_LOC:-unknown}" \
        "${HTTP_CODE:-0}" \
        "${LOCATION:-none}" \
        "$HAS_VARY_GEO" \
        "$RISK" \
        "${SERVER:-unknown}"
else
    echo "\033[1;36m================================================================================\033[0m"
    echo "\033[1;33m  GEO IP · CDN · 302 REDIRECT AUDIT SUITE (macOS 26 Native)\033[0m"
    echo "\033[1;36m================================================================================\033[0m"
    echo "  出口 IP (脱敏) : $MASKED_IP"
    echo "  识别物理区域   : ${RAW_LOC:-unknown}"
    echo "  HTTP 状态响应  : ${HTTP_CODE:-0}"
    echo "  302 跳转目标   : ${LOCATION:-<无跳转>}"
    echo "  Vary 缓存隔离  : ${VARY:-<缺失>}"
    echo "  缓存控制策略   : ${CACHE_CTRL:-<未配置>}"
    echo "  边缘缓存状态   : ${CF_CACHE:-NONE}"
    echo "--------------------------------------------------------------------------------"
    if [[ "$RISK" == "HIGH_CRITICAL" ]]; then
        echo "\033[1;31m[!] 发现高危配置缺陷: 302 重定向未设地域隔离，易引发全球缓存投毒与循环！\033[0m"
    elif [[ "$RISK" == "MEDIUM_WARNING" ]]; then
        echo "\033[1;33m[i] 提示: 缺少明确的 Vary: CF-IPCountry 头部。\033[0m"
    else
        echo "\033[1;32m[✓] 系统健康: 302 重定向与缓存控制隔离策略完美！\033[0m"
    fi
fi