kevin
61189a53ec
- JWT 密钥改为环境变量/配置文件/随机生成注入，移除硬编码 - AuthMiddleware 用数据库 role 覆盖 claims，降级/禁用即时生效 - 改 role/status 时主动失效目标用户会话 - /ws 支持 JWT 认证（?token=），兼容密码认证，CheckOrigin 改同源校验 - 默认管理员改用随机密码，stdout 与文件双交付 - 登录与 WS 密码认证加限流（5次/分钟） - role 字段白名单校验（仅 admin/user） - socket/目录权限可配置（sock_mode/sock_group/sock_dir_mode），默认兼容现状 - 配置文件权限收紧 0644→0600，目录 0755→0700 - 静态文件改用 http.Dir.Open + NoRoute，移除手动路径拼接 - 隧道加 SetReadLimit(1MB) 与单用户连接数上限(3) - README 补充安全配置与生产部署说明
82 lines
1.6 KiB
Go
82 lines
1.6 KiB
Go
package vpn
|
|
|
|
import (
|
|
"log"
|
|
"sync"
|
|
"time"
|
|
|
|
"lmvpn/internal/model"
|
|
|
|
"github.com/gorilla/websocket"
|
|
)
|
|
|
|
const (
|
|
readTimeout = 60 * time.Second
|
|
writeTimeout = 10 * time.Second
|
|
pingPeriod = 30 * time.Second
|
|
maxMessageSize = 1 << 20
|
|
maxConnsPerUser = 3
|
|
)
|
|
|
|
var (
|
|
activeConns = make(map[uint]int)
|
|
activeConnsMu sync.Mutex
|
|
)
|
|
|
|
func runTunnel(conn *websocket.Conn, user *model.User) {
|
|
defer conn.Close()
|
|
|
|
activeConnsMu.Lock()
|
|
if activeConns[user.ID] >= maxConnsPerUser {
|
|
activeConnsMu.Unlock()
|
|
sendJSON(conn, authResponse{Type: "auth_err", Message: "连接数已达上限"})
|
|
return
|
|
}
|
|
activeConns[user.ID]++
|
|
activeConnsMu.Unlock()
|
|
|
|
defer func() {
|
|
activeConnsMu.Lock()
|
|
activeConns[user.ID]--
|
|
if activeConns[user.ID] <= 0 {
|
|
delete(activeConns, user.ID)
|
|
}
|
|
activeConnsMu.Unlock()
|
|
}()
|
|
|
|
log.Printf("用户 %s 已连接", user.Username)
|
|
|
|
conn.SetReadLimit(maxMessageSize)
|
|
|
|
go func() {
|
|
ticker := time.NewTicker(pingPeriod)
|
|
defer ticker.Stop()
|
|
for range ticker.C {
|
|
conn.SetWriteDeadline(time.Now().Add(writeTimeout))
|
|
if err := conn.WriteMessage(websocket.PingMessage, nil); err != nil {
|
|
return
|
|
}
|
|
}
|
|
}()
|
|
|
|
conn.SetPongHandler(func(string) error {
|
|
conn.SetReadDeadline(time.Now().Add(readTimeout))
|
|
return nil
|
|
})
|
|
|
|
for {
|
|
conn.SetReadDeadline(time.Now().Add(readTimeout))
|
|
messageType, data, err := conn.ReadMessage()
|
|
if err != nil {
|
|
log.Printf("用户 %s 断开连接: %v", user.Username, err)
|
|
return
|
|
}
|
|
|
|
conn.SetWriteDeadline(time.Now().Add(writeTimeout))
|
|
if err := conn.WriteMessage(messageType, data); err != nil {
|
|
log.Printf("用户 %s 发送失败: %v", user.Username, err)
|
|
return
|
|
}
|
|
}
|
|
}
|