kevin
61189a53ec
- JWT 密钥改为环境变量/配置文件/随机生成注入，移除硬编码 - AuthMiddleware 用数据库 role 覆盖 claims，降级/禁用即时生效 - 改 role/status 时主动失效目标用户会话 - /ws 支持 JWT 认证（?token=），兼容密码认证，CheckOrigin 改同源校验 - 默认管理员改用随机密码，stdout 与文件双交付 - 登录与 WS 密码认证加限流（5次/分钟） - role 字段白名单校验（仅 admin/user） - socket/目录权限可配置（sock_mode/sock_group/sock_dir_mode），默认兼容现状 - 配置文件权限收紧 0644→0600，目录 0755→0700 - 静态文件改用 http.Dir.Open + NoRoute，移除手动路径拼接 - 隧道加 SetReadLimit(1MB) 与单用户连接数上限(3) - README 补充安全配置与生产部署说明
70 lines
1.3 KiB
Go
70 lines
1.3 KiB
Go
package vpn
|
|
|
|
import (
|
|
"log"
|
|
"net/http"
|
|
"net/url"
|
|
|
|
"lmvpn/internal/db"
|
|
"lmvpn/internal/middleware"
|
|
"lmvpn/internal/model"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/gorilla/websocket"
|
|
)
|
|
|
|
var upgrader = websocket.Upgrader{
|
|
ReadBufferSize: 4096,
|
|
WriteBufferSize: 4096,
|
|
CheckOrigin: func(r *http.Request) bool {
|
|
origin := r.Header.Get("Origin")
|
|
if origin == "" {
|
|
return true
|
|
}
|
|
u, err := url.Parse(origin)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
return u.Host == r.Host
|
|
},
|
|
}
|
|
|
|
func HandleWS(c *gin.Context) {
|
|
tokenStr := c.Query("token")
|
|
|
|
conn, err := upgrader.Upgrade(c.Writer, c.Request, nil)
|
|
if err != nil {
|
|
log.Printf("WebSocket 升级失败: %v", err)
|
|
return
|
|
}
|
|
|
|
if tokenStr != "" {
|
|
claims, err := middleware.ParseToken(tokenStr)
|
|
if err != nil {
|
|
sendJSON(conn, authResponse{Type: "auth_err", Message: "令牌无效或已过期"})
|
|
conn.Close()
|
|
return
|
|
}
|
|
var u model.User
|
|
if err := db.DB.First(&u, claims.UserID).Error; err != nil || u.Status != 1 {
|
|
sendJSON(conn, authResponse{Type: "auth_err", Message: "用户不存在或已禁用"})
|
|
conn.Close()
|
|
return
|
|
}
|
|
runTunnel(conn, &u)
|
|
return
|
|
}
|
|
|
|
user, err := authenticate(conn, db.DB, c.ClientIP())
|
|
if err != nil {
|
|
log.Printf("认证读取失败: %v", err)
|
|
conn.Close()
|
|
return
|
|
}
|
|
if user == nil {
|
|
return
|
|
}
|
|
|
|
runTunnel(conn, user)
|
|
}
|