feat(audit): F1+F2 告警静默规则标记完成 + 审计日志CSV导出实现
F1 告警静默规则 [done]: - 后端 alert_silence.go: CRUD + Toggle (onetime/daily/weekly 三模式) - 告警引擎 isSilenced 集成 (alert_engine.go) - 前端 SilenceRuleTab + SilenceDialog - 路由 /alerts/silences 已注册 F2 审计日志导出 [done]: - 重写 ExportAuditLogs: 真正的 CSV 导出 (encoding/csv + UTF-8 BOM) - 支持 module/action/username/startTime/endTime 筛选 - 导出限制 10000 条防溢出，自动记录审计日志 - JSON 格式向后兼容 (format=json) - 前端 exportLogs 传递查询参数 同时包含累积的前期工作: - 目录重构 internal/ -> controller/model/router (v0.55-v0.57) - 后端分层架构 dto/repository/service/utils - 审计模块全功能 (终端审计/操作审计/登录日志) - asciicast v2 录制格式 - SFTP 文件浏览器 - StatStrip 紧凑统计条 - 在线会话自动刷新 - LiveMonitor WebSocket 诊断修复 验证: go build ✅ | npm run build ✅ | Docker 部署 ✅ | 10 回归端点 ✅ | CSV 导出 ✅ | 静默 CRUD ✅
This commit is contained in:
attacker committed
1 parent
e57718998a
commit
77c234b060
314 files changed
+10050
-4065
No files matched your search
@@ -0,0 +1,319 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net"
|
||||
"net/http"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"ezops/model"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/go-ldap/ldap/v3"
|
||||
"gorm.io/gorm"
|
||||
)
|
||||
|
||||
// LDAPHandler LDAP处理器
|
||||
type LDAPHandler struct {
|
||||
db *gorm.DB
|
||||
}
|
||||
|
||||
// NewLDAPHandler 创建LDAP处理器
|
||||
func NewLDAPHandler(db *gorm.DB) *LDAPHandler {
|
||||
return &LDAPHandler{db: db}
|
||||
}
|
||||
|
||||
// LDAPAuthInfo LDAP认证返回的用户信息
|
||||
type LDAPAuthInfo struct {
|
||||
Username string
|
||||
DisplayName string
|
||||
Email string
|
||||
}
|
||||
|
||||
// dialLDAP 连接LDAP服务器
|
||||
func dialLDAP(cfg *model.LDAPConfig) (*ldap.Conn, error) {
|
||||
if cfg.LDAPHost == "" {
|
||||
return nil, fmt.Errorf("LDAP not configured")
|
||||
}
|
||||
protocol := "ldap"
|
||||
if cfg.UseLDAPS != nil && *cfg.UseLDAPS {
|
||||
protocol = "ldaps"
|
||||
}
|
||||
port := 389
|
||||
if cfg.LDAPPort != nil && *cfg.LDAPPort > 0 {
|
||||
port = *cfg.LDAPPort
|
||||
}
|
||||
uri := fmt.Sprintf("%s://%s:%d", protocol, cfg.LDAPHost, port)
|
||||
dialer := &net.Dialer{Timeout: 5 * time.Second}
|
||||
return ldap.DialURL(uri, ldap.DialWithDialer(dialer))
|
||||
}
|
||||
|
||||
// tryLDAPAuth 尝试LDAP认证，返回用户信息
|
||||
func tryLDAPAuth(db *gorm.DB, username, password string) (*LDAPAuthInfo, error) {
|
||||
var cfg model.LDAPConfig
|
||||
if err := db.Order("id").First(&cfg).Error; err != nil {
|
||||
return nil, fmt.Errorf("LDAP未配置")
|
||||
}
|
||||
if cfg.LDAPHost == "" {
|
||||
return nil, fmt.Errorf("LDAP not configured")
|
||||
}
|
||||
|
||||
conn, err := dialLDAP(&cfg)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("LDAP连接失败: %w", err)
|
||||
}
|
||||
defer conn.Close()
|
||||
|
||||
// Admin bind
|
||||
if err := conn.Bind(cfg.AdminDN, cfg.AdminPassword); err != nil {
|
||||
return nil, fmt.Errorf("LDAP管理员绑定失败: %w", err)
|
||||
}
|
||||
|
||||
// Build search filter
|
||||
userFilter := ""
|
||||
baseFilter := "(objectClass=inetOrgPerson)"
|
||||
if cfg.SearchFilter != nil && *cfg.SearchFilter != "" {
|
||||
sf := *cfg.SearchFilter
|
||||
if strings.Contains(sf, "%s") {
|
||||
userFilter = strings.ReplaceAll(sf, "%s", ldap.EscapeFilter(username))
|
||||
} else {
|
||||
baseFilter = sf
|
||||
userFilter = fmt.Sprintf("(&%s(uid=%s))", baseFilter, ldap.EscapeFilter(username))
|
||||
}
|
||||
} else {
|
||||
userFilter = fmt.Sprintf("(&%s(uid=%s))", baseFilter, ldap.EscapeFilter(username))
|
||||
}
|
||||
|
||||
// Search user
|
||||
searchReq := ldap.NewSearchRequest(
|
||||
cfg.BaseDN,
|
||||
ldap.ScopeWholeSubtree, ldap.NeverDerefAliases,
|
||||
1, 10, false,
|
||||
userFilter,
|
||||
[]string{"uid", "cn", "mail", "telephoneNumber"},
|
||||
nil,
|
||||
)
|
||||
sr, err := conn.Search(searchReq)
|
||||
if err != nil || len(sr.Entries) == 0 {
|
||||
return nil, fmt.Errorf("LDAP用户不存在")
|
||||
}
|
||||
entry := sr.Entries[0]
|
||||
userDN := entry.DN
|
||||
|
||||
// Verify password by binding as user
|
||||
if err := conn.Bind(userDN, password); err != nil {
|
||||
return nil, fmt.Errorf("LDAP密码验证失败: %w", err)
|
||||
}
|
||||
|
||||
// Extract user info using mapping
|
||||
userMapping := map[string]string{
|
||||
"username": "uid",
|
||||
"email": "mail",
|
||||
"display_name": "cn",
|
||||
}
|
||||
if cfg.UserMapping != nil && *cfg.UserMapping != "" {
|
||||
json.Unmarshal([]byte(*cfg.UserMapping), &userMapping)
|
||||
}
|
||||
|
||||
getAttr := func(key string) string {
|
||||
if v := entry.GetAttributeValue(key); v != "" {
|
||||
return v
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
info := &LDAPAuthInfo{
|
||||
Username: getAttr(userMapping["username"]),
|
||||
DisplayName: getAttr(userMapping["display_name"]),
|
||||
Email: getAttr(userMapping["email"]),
|
||||
}
|
||||
if info.Username == "" {
|
||||
info.Username = username
|
||||
}
|
||||
|
||||
return info, nil
|
||||
}
|
||||
|
||||
// GetLDAPConfig 获取LDAP配置
|
||||
// GET /api/v1/admin/ldap-config
|
||||
func (h *LDAPHandler) GetLDAPConfig(c *gin.Context) {
|
||||
var configs []model.LDAPConfig
|
||||
h.db.Order("id").Find(&configs)
|
||||
if len(configs) == 0 {
|
||||
c.JSON(http.StatusOK, gin.H{})
|
||||
return
|
||||
}
|
||||
cfg := configs[0]
|
||||
// mask password
|
||||
cfg.AdminPassword = "******"
|
||||
c.JSON(http.StatusOK, model.Response{Code: 200, Data: cfg})
|
||||
}
|
||||
|
||||
// UpdateLDAPConfig 更新LDAP配置
|
||||
// PUT /api/v1/admin/ldap-config
|
||||
func (h *LDAPHandler) UpdateLDAPConfig(c *gin.Context) {
|
||||
var input map[string]interface{}
|
||||
if err := c.ShouldBindJSON(&input); err != nil {
|
||||
c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: err.Error()})
|
||||
return
|
||||
}
|
||||
|
||||
var configs []model.LDAPConfig
|
||||
h.db.Order("id").Find(&configs)
|
||||
|
||||
getStr := func(key string) string {
|
||||
if v, ok := input[key].(string); ok {
|
||||
return v
|
||||
}
|
||||
return ""
|
||||
}
|
||||
getInt := func(key string) int {
|
||||
if v, ok := input[key].(float64); ok {
|
||||
return int(v)
|
||||
}
|
||||
return 0
|
||||
}
|
||||
getBool := func(key string) *bool {
|
||||
if v, ok := input[key].(bool); ok {
|
||||
return &v
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
userMappingStr := ""
|
||||
if um, ok := input["user_mapping"]; ok {
|
||||
if bytes, err := json.Marshal(um); err == nil {
|
||||
userMappingStr = string(bytes)
|
||||
}
|
||||
}
|
||||
|
||||
if len(configs) == 0 {
|
||||
// Create
|
||||
cfg := model.LDAPConfig{
|
||||
LDAPHost: getStr("ldap_host"),
|
||||
AdminDN: getStr("admin_dn"),
|
||||
BaseDN: getStr("base_dn"),
|
||||
AdminPassword: getStr("admin_password"),
|
||||
}
|
||||
if sf := getStr("search_filter"); sf != "" {
|
||||
cfg.SearchFilter = &sf
|
||||
}
|
||||
if userMappingStr != "" {
|
||||
cfg.UserMapping = &userMappingStr
|
||||
}
|
||||
if port := getInt("ldap_port"); port > 0 {
|
||||
cfg.LDAPPort = &port
|
||||
}
|
||||
if b := getBool("use_ldaps"); b != nil {
|
||||
cfg.UseLDAPS = b
|
||||
}
|
||||
h.db.Create(&cfg)
|
||||
cfg.AdminPassword = "******"
|
||||
c.JSON(http.StatusOK, model.Response{Code: 200, Message: "LDAP配置已创建", Data: cfg})
|
||||
} else {
|
||||
// Update
|
||||
cfg := configs[0]
|
||||
updates := map[string]interface{}{}
|
||||
if v := getStr("ldap_host"); v != "" {
|
||||
updates["ldap_host"] = v
|
||||
}
|
||||
if v := getStr("base_dn"); v != "" {
|
||||
updates["base_dn"] = v
|
||||
}
|
||||
if v := getStr("admin_dn"); v != "" {
|
||||
updates["admin_dn"] = v
|
||||
}
|
||||
if v := getStr("search_filter"); v != "" {
|
||||
updates["search_filter"] = v
|
||||
}
|
||||
if userMappingStr != "" {
|
||||
updates["user_mapping"] = userMappingStr
|
||||
}
|
||||
if v := getStr("admin_password"); v != "" && v != "******" {
|
||||
updates["admin_password"] = v
|
||||
}
|
||||
if port := getInt("ldap_port"); port > 0 {
|
||||
updates["ldap_port"] = port
|
||||
}
|
||||
if b := getBool("use_ldaps"); b != nil {
|
||||
updates["use_ldaps"] = *b
|
||||
}
|
||||
if len(updates) > 0 {
|
||||
h.db.Model(&cfg).Updates(updates)
|
||||
}
|
||||
h.db.First(&cfg, cfg.ID)
|
||||
cfg.AdminPassword = "******"
|
||||
c.JSON(http.StatusOK, model.Response{Code: 200, Message: "LDAP配置已更新", Data: cfg})
|
||||
}
|
||||
}
|
||||
|
||||
// TestLDAPConnection 测试LDAP连接
|
||||
// POST /api/v1/admin/ldap-config/test
|
||||
func (h *LDAPHandler) TestLDAPConnection(c *gin.Context) {
|
||||
var req struct {
|
||||
TestUser string `json:"test_user"`
|
||||
TestPassword string `json:"test_password"`
|
||||
}
|
||||
c.ShouldBindJSON(&req)
|
||||
|
||||
var cfg model.LDAPConfig
|
||||
if err := h.db.Order("id").First(&cfg).Error; err != nil {
|
||||
c.JSON(http.StatusOK, gin.H{"success": false, "message": "LDAP配置不存在，请先保存配置"})
|
||||
return
|
||||
}
|
||||
if cfg.LDAPHost == "" {
|
||||
c.JSON(http.StatusOK, gin.H{"success": false, "message": "LDAP未配置"})
|
||||
return
|
||||
}
|
||||
|
||||
conn, err := dialLDAP(&cfg)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusOK, gin.H{"success": false, "message": fmt.Sprintf("连接失败: %s", err)})
|
||||
return
|
||||
}
|
||||
defer conn.Close()
|
||||
|
||||
if err := conn.Bind(cfg.AdminDN, cfg.AdminPassword); err != nil {
|
||||
c.JSON(http.StatusOK, gin.H{"success": false, "message": fmt.Sprintf("管理员绑定失败: %s", err)})
|
||||
return
|
||||
}
|
||||
|
||||
// If test_user provided, search and verify
|
||||
if req.TestUser != "" && req.TestPassword != "" {
|
||||
userFilter := ""
|
||||
baseFilter := "(objectClass=inetOrgPerson)"
|
||||
if cfg.SearchFilter != nil && *cfg.SearchFilter != "" {
|
||||
sf := *cfg.SearchFilter
|
||||
if strings.Contains(sf, "%s") {
|
||||
userFilter = strings.ReplaceAll(sf, "%s", ldap.EscapeFilter(req.TestUser))
|
||||
} else {
|
||||
baseFilter = sf
|
||||
userFilter = fmt.Sprintf("(&%s(uid=%s))", baseFilter, ldap.EscapeFilter(req.TestUser))
|
||||
}
|
||||
} else {
|
||||
userFilter = fmt.Sprintf("(&%s(uid=%s))", baseFilter, ldap.EscapeFilter(req.TestUser))
|
||||
}
|
||||
|
||||
sr, err := conn.Search(ldap.NewSearchRequest(
|
||||
cfg.BaseDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases,
|
||||
1, 10, false, userFilter,
|
||||
[]string{"uid", "cn", "mail"},
|
||||
nil,
|
||||
))
|
||||
if err != nil || len(sr.Entries) == 0 {
|
||||
c.JSON(http.StatusOK, gin.H{"success": false, "message": fmt.Sprintf("用户 %s 不存在", req.TestUser)})
|
||||
return
|
||||
}
|
||||
userDN := sr.Entries[0].DN
|
||||
if err := conn.Bind(userDN, req.TestPassword); err != nil {
|
||||
c.JSON(http.StatusOK, gin.H{"success": false, "message": fmt.Sprintf("密码验证失败: %s", err)})
|
||||
return
|
||||
}
|
||||
c.JSON(http.StatusOK, model.Response{Code: 200, Data: gin.H{"success": true, "message": fmt.Sprintf("认证成功！用户DN: %s", userDN)}})
|
||||
return
|
||||
}
|
||||
|
||||
c.JSON(http.StatusOK, model.Response{Code: 200, Data: gin.H{"success": true, "message": "LDAP连接成功，管理员认证通过"}})
|
||||
}
|
||||
Reference in new issue
Block a user