Log: Add MaskAddress option to hide IP addresses (#3783)

* Log: Add maskAddress option

* Correct IPv6 subnet

app/log/config.proto

@@ -23,4 +23,5 @@ message Config {
   LogType access_log_type = 4;
   string access_log_path = 5;
   bool enable_dns_log = 6;
+  string mask_address= 7;
 }

app/log/log.go

@@ -4,6 +4,9 @@ package log
 
 import (
 	"context"
+	"fmt"
+	"regexp"
+	"strings"
 	"sync"
 
 	"github.com/xtls/xray-core/common"
@@ -101,18 +104,25 @@ func (g *Instance) Handle(msg log.Message) {
 		return
 	}
 
+	var Msg log.Message
+	if g.config.MaskAddress != "" {
+		Msg = &MaskedMsgWrapper{Message: msg, config: g.config}
+	} else {
+		Msg = msg
+	}
+
 	switch msg := msg.(type) {
 	case *log.AccessMessage:
 		if g.accessLogger != nil {
-			g.accessLogger.Handle(msg)
+			g.accessLogger.Handle(Msg)
 		}
 	case *log.DNSLog:
 		if g.dns && g.accessLogger != nil {
-			g.accessLogger.Handle(msg)
+			g.accessLogger.Handle(Msg)
 		}
 	case *log.GeneralMessage:
 		if g.errorLogger != nil && msg.Severity <= g.config.ErrorLogLevel {
-			g.errorLogger.Handle(msg)
+			g.errorLogger.Handle(Msg)
 		}
 	default:
 		// Swallow
@@ -141,6 +151,56 @@ func (g *Instance) Close() error {
 	return nil
 }
 
+// MaskedMsgWrapper is to wrap the string() method to mask IP addresses in the log.
+type MaskedMsgWrapper struct {
+	log.Message
+	config *Config
+}
+
+func (m *MaskedMsgWrapper) String() string {
+	str := m.Message.String()
+
+	ipv4Regex := regexp.MustCompile(`(\d{1,3}\.){3}\d{1,3}`)
+	ipv6Regex := regexp.MustCompile(`((?:[\da-fA-F]{0,4}:[\da-fA-F]{0,4}){2,7})(?:[\/\\%](\d{1,3}))?`)
+
+	// Process ipv4
+	maskedMsg := ipv4Regex.ReplaceAllStringFunc(str, func(ip string) string {
+		parts := strings.Split(ip, ".")
+		switch m.config.MaskAddress {
+		case "half":
+			return fmt.Sprintf("%s.%s.*.*", parts[0], parts[1])
+		case "quarter":
+			return fmt.Sprintf("%s.*.*.*", parts[0])
+		case "full":
+			return "[Masked IPv4]"
+		default:
+			return ip
+		}
+	})
+
+	// process ipv6
+	maskedMsg = ipv6Regex.ReplaceAllStringFunc(maskedMsg, func(ip string) string {
+		parts := strings.Split(ip, ":")
+		switch m.config.MaskAddress {
+		case "half":
+			if len(parts) >= 2 {
+				return fmt.Sprintf("%s:%s::/32", parts[0], parts[1])
+			}
+		case "quarter":
+			if len(parts) >= 1 {
+				return fmt.Sprintf("%s::/16", parts[0])
+			}
+		case "full":
+			return "Masked IPv6" // Do not use [Masked IPv6] like ipv4, or you will get "[[Masked IPv6]]" (v6 address already has [])
+		default:
+			return ip
+		}
+		return ip
+	})
+
+	return maskedMsg
+}
+
 func init() {
 	common.Must(common.RegisterConfig((*Config)(nil), func(ctx context.Context, config interface{}) (interface{}, error) {
 		return New(ctx, config.(*Config))

infra/conf/log.go

@@ -16,10 +16,11 @@ func DefaultLogConfig() *log.Config {
 }
 
 type LogConfig struct {
-	AccessLog string `json:"access"`
-	ErrorLog  string `json:"error"`
-	LogLevel  string `json:"loglevel"`
-	DNSLog    bool   `json:"dnsLog"`
+	AccessLog   string `json:"access"`
+	ErrorLog    string `json:"error"`
+	LogLevel    string `json:"loglevel"`
+	DNSLog      bool   `json:"dnsLog"`
+	MaskAddress string `json:"maskAddress"`
 }
 
 func (v *LogConfig) Build() *log.Config {
@@ -59,5 +60,6 @@ func (v *LogConfig) Build() *log.Config {
 	default:
 		config.ErrorLogLevel = clog.Severity_Warning
 	}
+	config.MaskAddress = v.MaskAddress
 	return config
 }