Files
attacker e4f1018ca1 feat(ws): A3 WebSocket 统一连接管理 — 心跳/注册表/监控/优雅关闭
- 新增 pkg/wshub/manager.go 统一 WebSocket 连接管理器 (WSManager)
- 6 个 WebSocket handler 全部迁移: WebShell/kubectl/PodExec/Audit/Metrics/Pipeline
- 心跳机制: ping(30s) + pong handler + read deadline(60s) 自动检测死连接
- 连接注册表: 元数据(类型/用户/远程地址/连接时间/最后活跃)
- 每用户连接限制 MaxConnsPerUser=15 防资源耗尽
- 监控端点: GET /api/v1/ws/stats + GET /api/v1/ws/connections
- 优雅关闭: CloseAll() 发送 CloseGoingAway 帧并关闭所有连接
- 消除 3 个重复 websocket.Upgrader 变量统一为 WSManager 内部 upgrader
- 6/6 A3 测试通过, 17/17 回归测试通过
2026-06-27 07:20:11 +08:00

132 lines
3.0 KiB
Go

// 终端审计实时流 Hub — 在线会话内容广播给审计查看者 // Logan.Li
package controller
import (
"log"
"sync"
"ezops/middleware"
"ezops/pkg/wshub"
"github.com/gin-gonic/gin"
)
// AuditHub 终端审计流中心 — 管理所有活跃会话的审计订阅者
type AuditHub struct {
mu sync.RWMutex
watchers map[uint]map[chan []byte]struct{} // sessionID -> set of watcher channels
wsMgr *wshub.WSManager
}
// NewAuditHub 创建审计 Hub
func NewAuditHub(wsMgr *wshub.WSManager) *AuditHub {
return &AuditHub{
watchers: make(map[uint]map[chan []byte]struct{}),
wsMgr: wsMgr,
}
}
// Subscribe 订阅某个会话的实时输出
func (h *AuditHub) Subscribe(sessionID uint) chan []byte {
ch := make(chan []byte, 256)
h.mu.Lock()
defer h.mu.Unlock()
if h.watchers[sessionID] == nil {
h.watchers[sessionID] = make(map[chan []byte]struct{})
}
h.watchers[sessionID][ch] = struct{}{}
return ch
}
// Unsubscribe 取消订阅
func (h *AuditHub) Unsubscribe(sessionID uint, ch chan []byte) {
h.mu.Lock()
defer h.mu.Unlock()
if watchers, ok := h.watchers[sessionID]; ok {
delete(watchers, ch)
close(ch)
if len(watchers) == 0 {
delete(h.watchers, sessionID)
}
}
}
// Broadcast 向所有订阅者广播终端输出数据(非阻塞)
func (h *AuditHub) Broadcast(sessionID uint, data []byte) {
h.mu.RLock()
watchers, ok := h.watchers[sessionID]
h.mu.RUnlock()
if !ok || len(watchers) == 0 {
return
}
for ch := range watchers {
select {
case ch <- data:
default:
}
}
}
// Cleanup 清理某个会话的所有订阅者
func (h *AuditHub) Cleanup(sessionID uint) {
h.mu.Lock()
defer h.mu.Unlock()
if watchers, ok := h.watchers[sessionID]; ok {
for ch := range watchers {
close(ch)
}
delete(h.watchers, sessionID)
}
}
// ServeAuditStream 处理 /ws/audit/:sessionId WebSocket — 实时推送终端输出
func (h *AuditHub) ServeAuditStream(c *gin.Context, sessionID uint, historyData string, sessionInfo map[string]interface{}) {
userID := middleware.GetUserID(c)
username := middleware.GetUsername(c)
conn, info, err := h.wsMgr.Upgrade(c, wshub.TypeAudit, userID, username)
if err != nil {
log.Printf("[AuditStream] WS 升级失败 session=%d: %v", sessionID, err)
return
}
defer h.wsMgr.Unregister(info)
h.wsMgr.StartHeartbeat(conn, info)
// 发送会话元信息
conn.WriteJSON(map[string]interface{}{
"type": "session_info",
"payload": sessionInfo,
})
// 发送历史数据(已录制的输出)
if historyData != "" {
conn.WriteJSON(map[string]interface{}{
"type": "history",
"data": historyData,
})
}
// 订阅实时流
ch := h.Subscribe(sessionID)
defer h.Unsubscribe(sessionID, ch)
// goroutine 读取关闭信号
go func() {
for {
if _, _, err := conn.ReadMessage(); err != nil {
break
}
}
}()
// 推送实时数据
for data := range ch {
if err := conn.WriteJSON(map[string]interface{}{
"type": "output",
"data": string(data),
}); err != nil {
break
}
}
}