rlwj-lab/opsx-vpn
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: implement VPN platform management and real protocol services

Browse Source
This commit is contained in:
Logan.Li committed 2026-07-22 21:49:13 +08:00
commit 58c036c34c
45 files changed
+9244
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

backend/internal/api/api.go
+781
View File
@@ -0,0 +1,781 @@
// Package api 提供 REST API 路由与处理器
package api
import (
"crypto/rand"
"encoding/base64"
"encoding/json"
"fmt"
"net"
"net/http"
"os"
"strconv"
"strings"
"sync"
"time"
"github.com/gin-gonic/gin"
"golang.org/x/crypto/bcrypt"
"vpn-platform/backend/internal/core"
"vpn-platform/backend/internal/model"
"vpn-platform/backend/internal/service"
"vpn-platform/backend/internal/service/custom"
"vpn-platform/backend/internal/service/ipsec"
"vpn-platform/backend/internal/service/openvpn"
"vpn-platform/backend/internal/service/wireguard"
"vpn-platform/backend/internal/store"
)
// Server API 服务器
type Server struct {
mgr *core.Manager
}
func NewServer(mgr *core.Manager) *Server { return &Server{mgr: mgr} }
// ---- 简易 Token 会话 ----
var (
sessions = map[string]sessionInfo{}
sessionsMu sync.RWMutex
)
type sessionInfo struct {
username string
userID uint
role string
expireAt time.Time
}
func issueToken(user *model.User) string {
raw := make([]byte, 32)
_, _ = rand.Read(raw)
token := base64.RawURLEncoding.EncodeToString(raw)
sessionsMu.Lock()
sessions[token] = sessionInfo{username: user.Username, userID: user.ID, role: user.Role, expireAt: time.Now().Add(24 * time.Hour)}
sessionsMu.Unlock()
return token
}
func authMiddleware() gin.HandlerFunc {
return func(c *gin.Context) {
token := c.GetHeader("Authorization")
token = strings.TrimPrefix(token, "Bearer ")
sessionsMu.RLock()
sess, ok := sessions[token]
sessionsMu.RUnlock()
if !ok || time.Now().After(sess.expireAt) {
c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "未登录或会话已过期"})
return
}
c.Set("username", sess.username)
c.Set("user_id", sess.userID)
c.Set("role", sess.role)
c.Next()
}
}
// RegisterRoutes 注册全部路由
func (s *Server) RegisterRoutes(r *gin.Engine) {
api := r.Group("/api")
api.POST("/login", s.login)
api.GET("/health", func(c *gin.Context) { c.JSON(200, gin.H{"ok": true}) })
auth := api.Group("")
auth.Use(authMiddleware())
{
auth.GET("/overview", s.overview)
auth.GET("/protocols", s.listProtocols)
auth.POST("/password", s.changePassword)
auth.GET("/mfa/status", s.mfaStatus)
auth.POST("/mfa/setup", s.mfaSetup)
auth.POST("/mfa/enable", s.mfaEnable)
auth.POST("/mfa/disable", s.mfaDisable)
admin := auth.Group("")
admin.Use(requireRole("admin"))
admin.GET("/users", s.listUsers)
admin.POST("/users", s.createUser)
admin.PUT("/users/:id", s.updateUser)
admin.DELETE("/users/:id", s.deleteUser)
admin.GET("/ldap", s.getLDAPConfig)
admin.PUT("/ldap", s.saveLDAPConfig)
admin.POST("/ldap/test", s.testLDAP)
admin.GET("/vpn-users", s.listVPNUsers)
admin.POST("/vpn-users", s.createVPNUser)
admin.PUT("/vpn-users/:id", s.updateVPNUser)
admin.DELETE("/vpn-users/:id", s.deleteVPNUser)
admin.POST("/tunnels/:id/openvpn/pki", s.initializeOpenVPNPKI)
admin.GET("/vpn-users/:id/config", s.downloadVPNUserConfig)
admin.GET("/tunnels/:id/wireguard/peers/:peer_id/config", s.downloadWireGuardPeerConfig)
auth.GET("/tunnels", s.listTunnels)
auth.POST("/tunnels", s.createTunnel)
auth.GET("/tunnels/:id", s.getTunnel)
auth.PUT("/tunnels/:id", s.updateTunnel)
auth.DELETE("/tunnels/:id", s.deleteTunnel)
auth.POST("/tunnels/:id/start", s.startTunnel)
auth.POST("/tunnels/:id/stop", s.stopTunnel)
auth.GET("/tunnels/:id/config", s.downloadConfig)
auth.GET("/tunnels/:id/status", s.tunnelStatus)
auth.POST("/tunnels/:id/test", s.testConnectivity)
auth.GET("/ipsec/templates", s.ipsecTemplates)
auth.POST("/ipsec/compare", s.ipsecCompare)
auth.GET("/nodes", s.listNodes)
auth.POST("/nodes", s.createNode)
auth.DELETE("/nodes/:id", s.deleteNode)
auth.GET("/plugins", s.listPlugins)
auth.POST("/plugins", s.createPlugin)
auth.PUT("/plugins/:id", s.updatePlugin)
auth.DELETE("/plugins/:id", s.deletePlugin)
auth.GET("/audit", s.listAudit)
}
}
func (s *Server) initializeOpenVPNPKI(c *gin.Context) {
t, err := s.mustTunnel(c)
if err != nil {
return
}
if t.Protocol != "openvpn" {
c.JSON(400, gin.H{"error": "仅 OpenVPN 隧道支持 PKI 初始化"})
return
}
if err := openvpn.New().InitializePKI(t); err != nil {
c.JSON(500, gin.H{"error": err.Error()})
return
}
store.Audit(c.GetString("username"), "initialize_openvpn_pki", t.Name, "")
c.JSON(200, gin.H{"ok": true})
}
func (s *Server) downloadVPNUserConfig(c *gin.Context) {
id, err := strconv.Atoi(c.Param("id"))
if err != nil {
c.JSON(400, gin.H{"error": "非法 ID"})
return
}
var user model.VPNUser
if err := store.DB.First(&user, id).Error; err != nil {
c.JSON(404, gin.H{"error": "拨号用户不存在"})
return
}
t, err := store.GetTunnel(user.TunnelID)
if err != nil {
c.JSON(404, gin.H{"error": "OpenVPN 隧道不存在"})
return
}
if t.Protocol != "openvpn" {
c.JSON(400, gin.H{"error": "拨号用户不属于 OpenVPN 隧道"})
return
}
conf, err := openvpn.New().GenerateUserConfig(t, &user)
if err != nil {
c.JSON(500, gin.H{"error": err.Error()})
return
}
c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=openvpn-%s.ovpn", user.Username))
c.Data(200, "application/x-openvpn-profile", []byte(conf))
}
func (s *Server) downloadWireGuardPeerConfig(c *gin.Context) {
t, err := s.mustTunnel(c)
if err != nil {
return
}
if t.Protocol != "wireguard" {
c.JSON(400, gin.H{"error": "仅 WireGuard 隧道支持 Peer 配置"})
return
}
conf, err := wireguard.New().GeneratePeerClientConfig(t, c.Param("peer_id"))
if err != nil {
c.JSON(500, gin.H{"error": err.Error()})
return
}
c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=wireguard-%s-%s.conf", t.Name, c.Param("peer_id")))
c.Data(200, "text/plain; charset=utf-8", []byte(conf))
}
// ---- 认证 ----
func (s *Server) login(c *gin.Context) {
var req struct {
Username string `json:"username"`
Password string `json:"password"`
MFACode string `json:"mfa_code"`
}
if err := c.ShouldBindJSON(&req); err != nil {
c.JSON(400, gin.H{"error": "参数错误"})
return
}
user, err := s.authenticateUser(req.Username, req.Password)
if err != nil {
c.JSON(401, gin.H{"error": "用户名或密码错误"})
return
}
if !user.Enabled {
c.JSON(403, gin.H{"error": "用户已禁用"})
return
}
if err := verifyMFA(user, req.MFACode); err != nil {
c.JSON(401, gin.H{"error": err.Error(), "mfa_required": true})
return
}
c.JSON(200, gin.H{"token": issueToken(user), "username": user.Username, "role": user.Role})
}
func (s *Server) changePassword(c *gin.Context) {
var req struct {
Old string `json:"old_password"`
New string `json:"new_password"`
}
if err := c.ShouldBindJSON(&req); err != nil || len(req.New) < 6 {
c.JSON(400, gin.H{"error": "新密码至少 6 位"})
return
}
username := c.GetString("username")
var user model.User
if err := store.DB.Where("username = ?", username).First(&user).Error; err != nil {
c.JSON(404, gin.H{"error": "用户不存在"})
return
}
if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(req.Old)); err != nil {
c.JSON(400, gin.H{"error": "原密码错误"})
return
}
hash, _ := bcrypt.GenerateFromPassword([]byte(req.New), bcrypt.DefaultCost)
store.DB.Model(&user).Update("password", string(hash))
store.Audit(username, "change_password", username, "修改登录密码")
c.JSON(200, gin.H{"ok": true})
}
// ---- 总览 ----
func (s *Server) overview(c *gin.Context) {
var total, running int64
store.DB.Model(&model.Tunnel{}).Count(&total)
store.DB.Model(&model.Tunnel{}).Where("state = ?", "running").Count(&running)
var nodeCount, pluginCount int64
store.DB.Model(&model.Node{}).Count(&nodeCount)
store.DB.Model(&model.Plugin{}).Where("enabled = ?", true).Count(&pluginCount)
// 各协议数量分布
type protoCount struct {
Protocol string
Count int64
}
var dist []protoCount
store.DB.Model(&model.Tunnel{}).Select("protocol, count(*) as count").Group("protocol").Scan(&dist)
// 总流量
var sum struct {
Rx int64
Tx int64
}
store.DB.Model(&model.Tunnel{}).Select("COALESCE(SUM(rx_bytes),0) as rx, COALESCE(SUM(tx_bytes),0) as tx").Scan(&sum)
// 即将到期（7 天内）
var expiring []model.Tunnel
week := time.Now().Add(7 * 24 * time.Hour)
store.DB.Where("expire_at IS NOT NULL AND expire_at < ?", week).Order("expire_at asc").Limit(5).Find(&expiring)
c.JSON(200, gin.H{
"total": total, "running": running, "nodes": nodeCount, "plugins": pluginCount,
"rx_bytes": sum.Rx, "tx_bytes": sum.Tx,
"protocol_distribution": dist, "expiring": expiring,
})
}
func (s *Server) listProtocols(c *gin.Context) {
type item struct {
Name string `json:"name"`
DisplayName string `json:"display_name"`
Available bool `json:"available"`
Dependency string `json:"dependency"`
Custom bool `json:"custom"`
}
var out []item
for _, p := range s.mgr.List() {
ok, dep := p.Available()
out = append(out, item{p.Name(), p.DisplayName(), ok, dep, strings.HasPrefix(p.Name(), "custom:")})
}
c.JSON(200, out)
}
// ---- 专线管理 ----
func (s *Server) listTunnels(c *gin.Context) {
var tunnels []model.Tunnel
q := store.DB.Preload("Node").Order("id desc")
if p := c.Query("protocol"); p != "" {
q = q.Where("protocol = ?", p)
}
if kw := c.Query("keyword"); kw != "" {
q = q.Where("name LIKE ?", "%"+kw+"%")
}
q.Find(&tunnels)
// 附带实时状态
type resp struct {
model.Tunnel
Runtime *core.Status `json:"runtime,omitempty"`
}
out := make([]resp, 0, len(tunnels))
for _, t := range tunnels {
r := resp{Tunnel: t}
if st, ok := s.mgr.GetStatus(t.ID); ok {
r.Runtime = &st
}
out = append(out, r)
}
c.JSON(200, out)
}
type tunnelReq struct {
Name string `json:"name"`
Protocol string `json:"protocol"`
Remark string `json:"remark"`
Config map[string]interface{} `json:"config"`
AutoStart bool `json:"auto_start"`
ExpireAt *time.Time `json:"expire_at"`
NodeID *uint `json:"node_id"`
}
func (s *Server) createTunnel(c *gin.Context) {
var req tunnelReq
if err := c.ShouldBindJSON(&req); err != nil {
c.JSON(400, gin.H{"error": "参数错误: " + err.Error()})
return
}
if req.Name == "" || req.Protocol == "" {
c.JSON(400, gin.H{"error": "名称与协议类型必填"})
return
}
p, err := s.mgr.Get(req.Protocol)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
cfg, err := p.Validate(req.Config)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
t := model.Tunnel{
Name: req.Name, Protocol: req.Protocol, Remark: req.Remark,
State: "stopped", AutoStart: req.AutoStart, ExpireAt: req.ExpireAt, NodeID: req.NodeID,
}
// 先创建不含配置的记录以取得 ID；敏感字段只在内存中交给协议层，
// 由 SaveTunnelConfig 拆分并加密后才会写入数据库。
t.Config = "{}"
if err := store.DB.Create(&t).Error; err != nil {
c.JSON(500, gin.H{"error": "保存失败: " + err.Error()})
return
}
raw, _ := json.Marshal(cfg)
t.Config = string(raw)
if err := p.Create(&t); err != nil {
store.DB.Delete(&t)
_ = service.RemoveInstance(&t)
c.JSON(500, gin.H{"error": "生成配置失败: " + err.Error()})
return
}
username := c.GetString("username")
store.Audit(username, "create_tunnel", fmt.Sprintf("%s(%s)", t.Name, t.Protocol), "")
if t.AutoStart {
if err := p.Start(&t); err != nil {
t.LastError = err.Error()
t.State = "error"
} else {
t.State = "running"
}
store.DB.Save(&t)
}
c.JSON(200, t)
}
func (s *Server) getTunnel(c *gin.Context) {
t, err := s.mustTunnel(c)
if err != nil {
return
}
// 客户端配置预览
var clientConf string
if p, err := s.mgr.Get(t.Protocol); err == nil {
clientConf, _ = p.GenerateClientConfig(t)
}
c.JSON(200, gin.H{"tunnel": t, "client_config": clientConf})
}
func (s *Server) updateTunnel(c *gin.Context) {
t, err := s.mustTunnel(c)
if err != nil {
return
}
var req tunnelReq
if err := c.ShouldBindJSON(&req); err != nil {
c.JSON(400, gin.H{"error": "参数错误"})
return
}
var (
p core.Protocol
newRaw string
hasCfg = req.Config != nil
wasRunning = t.State == "running"
)
if hasCfg {
var err error
p, err = s.mgr.Get(t.Protocol)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
cfg, err := p.Validate(req.Config)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
raw, _ := json.Marshal(cfg)
newRaw = string(raw)
if wasRunning {
if err := p.Stop(t); err != nil {
c.JSON(500, gin.H{"error": "停止旧配置失败: " + err.Error()})
return
}
}
}
if req.Name != "" {
t.Name = req.Name
}
t.Remark = req.Remark
t.AutoStart = req.AutoStart
t.ExpireAt = req.ExpireAt
// 不通过 Save(t) 写入 Config，避免更新请求中的密钥明文落库。
if err := store.DB.Model(t).Updates(map[string]interface{}{
"name": t.Name, "remark": t.Remark, "auto_start": t.AutoStart, "expire_at": t.ExpireAt,
}).Error; err != nil {
c.JSON(500, gin.H{"error": "保存失败: " + err.Error()})
return
}
if hasCfg {
t.Config = newRaw
if err := p.Create(t); err != nil {
c.JSON(500, gin.H{"error": "生成配置失败: " + err.Error()})
return
}
if wasRunning {
if err := p.Start(t); err != nil {
t.State = "error"
t.LastError = err.Error()
} else {
t.State = "running"
t.LastError = ""
}
store.DB.Model(t).Updates(map[string]interface{}{"state": t.State, "last_error": t.LastError})
}
}
store.Audit(c.GetString("username"), "update_tunnel", t.Name, "")
c.JSON(200, t)
}
func (s *Server) deleteTunnel(c *gin.Context) {
t, err := s.mustTunnel(c)
if err != nil {
return
}
if p, err := s.mgr.Get(t.Protocol); err == nil {
_ = p.Delete(t)
}
if err := service.RemoveInstance(t); err != nil && !os.IsNotExist(err) {
c.JSON(500, gin.H{"error": "清理实例文件失败: " + err.Error()})
return
}
s.mgr.RemoveStatus(t.ID)
store.DB.Delete(t)
store.Audit(c.GetString("username"), "delete_tunnel", t.Name, "")
c.JSON(200, gin.H{"ok": true})
}
func (s *Server) startTunnel(c *gin.Context) {
t, err := s.mustTunnel(c)
if err != nil {
return
}
if t.ExpireAt != nil && time.Now().After(*t.ExpireAt) {
c.JSON(400, gin.H{"error": "专线已到期，请先调整到期时间"})
return
}
p, err := s.mgr.Get(t.Protocol)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
if t.State == "running" {
c.JSON(200, gin.H{"ok": true, "state": "running", "message": "专线已在运行"})
return
}
if err := p.Start(t); err != nil {
t.State = "error"
t.LastError = err.Error()
store.DB.Save(t)
c.JSON(500, gin.H{"error": err.Error()})
return
}
t.State = "running"
t.LastError = ""
store.DB.Save(t)
store.Audit(c.GetString("username"), "start_tunnel", t.Name, "")
c.JSON(200, gin.H{"ok": true, "state": "running"})
}
func (s *Server) stopTunnel(c *gin.Context) {
t, err := s.mustTunnel(c)
if err != nil {
return
}
p, err := s.mgr.Get(t.Protocol)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
if err := p.Stop(t); err != nil {
c.JSON(500, gin.H{"error": err.Error()})
return
}
t.State = "stopped"
store.DB.Save(t)
store.Audit(c.GetString("username"), "stop_tunnel", t.Name, "")
c.JSON(200, gin.H{"ok": true, "state": "stopped"})
}
func (s *Server) downloadConfig(c *gin.Context) {
t, err := s.mustTunnel(c)
if err != nil {
return
}
p, err := s.mgr.Get(t.Protocol)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
conf, err := p.GenerateClientConfig(t)
if err != nil {
c.JSON(500, gin.H{"error": err.Error()})
return
}
ext := "conf"
switch t.Protocol {
case "openvpn":
ext = "ovpn"
case "frp":
ext = "toml"
case "ipsec", "l2tp":
ext = "txt"
}
filename := fmt.Sprintf("%s-%s.%s", t.Protocol, strings.ReplaceAll(t.Name, " ", "_"), ext)
c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=%s", filename))
c.Data(200, "text/plain; charset=utf-8", []byte(conf))
}
func (s *Server) tunnelStatus(c *gin.Context) {
t, err := s.mustTunnel(c)
if err != nil {
return
}
p, err := s.mgr.Get(t.Protocol)
if err != nil {
c.JSON(400, gin.H{"error": err.Error()})
return
}
st, err := p.Status(t)
if err != nil {
c.JSON(500, gin.H{"error": err.Error()})
return
}
c.JSON(200, st)
}
// testConnectivity 一键测试与对端网关的连通性
func (s *Server) testConnectivity(c *gin.Context) {
t, err := s.mustTunnel(c)
if err != nil {
return
}
cfg, err := store.TunnelConfig(t)
if err != nil {
c.JSON(500, gin.H{"error": err.Error()})
return
}
target := service.Str(cfg, "remote_gateway")
if target == "" {
target = service.Str(cfg, "server_addr")
}
if target == "" {
target = service.Str(cfg, "public_endpoint")
}
if host, _, err := net.SplitHostPort(target); err == nil {
target = host
}
if target == "" {
c.JSON(400, gin.H{"error": "该专线未配置对端地址，无法测试"})
return
}
result := map[string]interface{}{"target": target}
start := time.Now()
// ICMP 不可用时退化为 TCP 常见端口探测
conn, err := net.DialTimeout("tcp", net.JoinHostPort(target, "500"), 3*time.Second)
if err == nil {
conn.Close()
result["ike_udp500_note"] = "TCP 探测通过（仅供参考，IPSec 实际走 UDP 500/4500）"
result["reachable"] = true
} else {
conn2, err2 := net.DialTimeout("tcp", net.JoinHostPort(target, "443"), 3*time.Second)
if err2 == nil {
conn2.Close()
result["reachable"] = true
result["note"] = "对端可达（TCP 443）"
} else {
result["reachable"] = false
result["note"] = "TCP 探测未通过，可能防火墙仅放行 UDP，建议结合 IPSec SA 状态判断"
}
}
result["latency_ms"] = time.Since(start).Milliseconds()
store.Audit(c.GetString("username"), "test_connectivity", t.Name, fmt.Sprintf("target=%s", target))
c.JSON(200, result)
}
// ---- IPSec 专用 ----
func (s *Server) ipsecTemplates(c *gin.Context) {
c.JSON(200, ipsec.Templates())
}
// ipsecCompare 双方参数一致性对比检查
func (s *Server) ipsecCompare(c *gin.Context) {
var req struct {
Local map[string]interface{} `json:"local"`
Peer map[string]interface{} `json:"peer"`
}
if err := c.ShouldBindJSON(&req); err != nil {
c.JSON(400, gin.H{"error": "参数错误"})
return
}
diffs := ipsec.ComparePeerParams(req.Local, req.Peer)
c.JSON(200, gin.H{"consistent": len(diffs) == 0, "differences": diffs})
}
// ---- 节点管理 ----
func (s *Server) listNodes(c *gin.Context) {
var nodes []model.Node
store.DB.Find(&nodes)
c.JSON(200, nodes)
}
func (s *Server) createNode(c *gin.Context) {
var n model.Node
if err := c.ShouldBindJSON(&n); err != nil || n.Name == "" {
c.JSON(400, gin.H{"error": "节点名称必填"})
return
}
n.ID = 0
store.DB.Create(&n)
store.Audit(c.GetString("username"), "create_node", n.Name, "")
c.JSON(200, n)
}
func (s *Server) deleteNode(c *gin.Context) {
id, _ := strconv.Atoi(c.Param("id"))
store.DB.Delete(&model.Node{}, id)
c.JSON(200, gin.H{"ok": true})
}
// ---- 自定义协议插件 ----
func (s *Server) listPlugins(c *gin.Context) {
var plugins []model.Plugin
store.DB.Find(&plugins)
c.JSON(200, plugins)
}
func (s *Server) createPlugin(c *gin.Context) {
var p model.Plugin
if err := c.ShouldBindJSON(&p); err != nil || p.Name == "" || p.StartHook == "" {
c.JSON(400, gin.H{"error": "插件标识与 start 钩子必填"})
return
}
if strings.ContainsAny(p.Name, " /;|&") {
c.JSON(400, gin.H{"error": "插件标识不能包含特殊字符"})
return
}
p.ID = 0
if p.DisplayName == "" {
p.DisplayName = p.Name
}
if err := store.DB.Create(&p).Error; err != nil {
c.JSON(400, gin.H{"error": "插件标识已存在"})
return
}
if p.Enabled {
s.mgr.Register(custom.New(&p))
}
store.Audit(c.GetString("username"), "create_plugin", p.Name, "")
c.JSON(200, p)
}
func (s *Server) updatePlugin(c *gin.Context) {
id, _ := strconv.Atoi(c.Param("id"))
var p model.Plugin
if err := store.DB.First(&p, id).Error; err != nil {
c.JSON(404, gin.H{"error": "插件不存在"})
return
}
var req model.Plugin
if err := c.ShouldBindJSON(&req); err != nil {
c.JSON(400, gin.H{"error": "参数错误"})
return
}
p.DisplayName = req.DisplayName
p.Description = req.Description
p.CreateHook, p.StartHook, p.StopHook = req.CreateHook, req.StartHook, req.StopHook
p.StatusHook, p.ConfigHook = req.StatusHook, req.ConfigHook
p.Enabled = req.Enabled
store.DB.Save(&p)
if p.Enabled {
s.mgr.Register(custom.New(&p))
}
c.JSON(200, p)
}
func (s *Server) deletePlugin(c *gin.Context) {
id, _ := strconv.Atoi(c.Param("id"))
store.DB.Delete(&model.Plugin{}, id)
c.JSON(200, gin.H{"ok": true})
}
// ---- 审计 ----
func (s *Server) listAudit(c *gin.Context) {
var logs []model.AuditLog
store.DB.Order("id desc").Limit(100).Find(&logs)
c.JSON(200, logs)
}
// ---- 工具 ----
func (s *Server) mustTunnel(c *gin.Context) (*model.Tunnel, error) {
id, err := strconv.Atoi(c.Param("id"))
if err != nil {
c.JSON(400, gin.H{"error": "非法 ID"})
return nil, err
}
t, err := store.GetTunnel(uint(id))
if err != nil {
c.JSON(404, gin.H{"error": "专线不存在"})
return nil, err
}
return t, nil
}
backend/internal/api/identity.go
+415
View File
@@ -0,0 +1,415 @@
package api
import (
"crypto/rand"
"encoding/json"
"fmt"
"net/http"
"strconv"
"strings"
"sync"
"time"
"github.com/gin-gonic/gin"
"github.com/go-ldap/ldap/v3"
"github.com/pquerna/otp/totp"
"golang.org/x/crypto/bcrypt"
"vpn-platform/backend/internal/model"
"vpn-platform/backend/internal/store"
)
type pendingMFA struct {
secret string
backups []string
expires time.Time
}
var (
pendingMFAMu sync.Mutex
pendingMFAs = map[uint]pendingMFA{}
)
func requireRole(roles ...string) gin.HandlerFunc {
return func(c *gin.Context) {
role := c.GetString("role")
for _, allowed := range roles {
if role == allowed {
c.Next()
return
}
}
c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "权限不足"})
}
}
func (s *Server) authenticateUser(username, password string) (*model.User, error) {
var user model.User
err := store.DB.Where("username = ?", username).First(&user).Error
if err == nil && user.Source != "ldap" {
if bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)) == nil {
return &user, nil
}
return nil, fmt.Errorf("invalid password")
}
if user.Source == "ldap" || err != nil {
return s.authenticateLDAP(username, password)
}
return nil, err
}
func ldapSettings() (*model.LDAPConfig, error) {
var cfg model.LDAPConfig
if err := store.DB.First(&cfg).Error; err != nil || !cfg.Enabled {
return nil, fmt.Errorf("LDAP 未启用")
}
plain, err := store.DecryptSecret(cfg.BindPassword)
if err != nil {
return nil, fmt.Errorf("LDAP 配置密钥无效")
}
cfg.BindPassword = plain
if cfg.UsernameAttribute == "" {
cfg.UsernameAttribute = "uid"
}
if cfg.UserFilter == "" {
cfg.UserFilter = "(objectClass=inetOrgPerson)"
}
return &cfg, nil
}
func ldapConnect(cfg *model.LDAPConfig) (*ldap.Conn, error) {
url := cfg.URL
if !strings.HasPrefix(url, "ldap://") && !strings.HasPrefix(url, "ldaps://") {
url = "ldap://" + url
}
conn, err := ldap.DialURL(url)
if err != nil {
return nil, err
}
if cfg.BindDN != "" {
if err := conn.Bind(cfg.BindDN, cfg.BindPassword); err != nil {
conn.Close()
return nil, err
}
}
return conn, nil
}
func (s *Server) authenticateLDAP(username, password string) (*model.User, error) {
cfg, err := ldapSettings()
if err != nil || password == "" {
return nil, fmt.Errorf("LDAP 认证不可用")
}
conn, err := ldapConnect(cfg)
if err != nil {
return nil, err
}
defer conn.Close()
filter := fmt.Sprintf("(&%s(%s=%s))", cfg.UserFilter, cfg.UsernameAttribute, ldap.EscapeFilter(username))
result, err := conn.Search(ldap.NewSearchRequest(cfg.BaseDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 1, 5, false, filter, []string{"dn", cfg.UsernameAttribute, "cn", "mail"}, nil))
if err != nil || len(result.Entries) != 1 {
return nil, fmt.Errorf("LDAP 用户不存在")
}
entry := result.Entries[0]
if err := conn.Bind(entry.DN, password); err != nil {
return nil, fmt.Errorf("LDAP 密码错误")
}
var user model.User
err = store.DB.Where("username = ?", username).First(&user).Error
if err != nil {
user = model.User{Username: username, Email: entry.GetAttributeValue("mail"), Source: "ldap", Role: "viewer", Enabled: true}
if err := store.DB.Create(&user).Error; err != nil {
return nil, err
}
}
return &user, nil
}
func verifyMFA(user *model.User, code string) error {
var device model.MFADevice
if err := store.DB.Where("user_id = ? AND enabled = ?", user.ID, true).First(&device).Error; err != nil {
return nil
}
secret, err := store.DecryptSecret(device.Secret)
if err != nil {
return fmt.Errorf("MFA 配置无效")
}
if totp.Validate(strings.TrimSpace(code), secret) {
return nil
}
return fmt.Errorf("需要有效的 MFA 验证码")
}
func (s *Server) mfaStatus(c *gin.Context) {
var device model.MFADevice
err := store.DB.Where("user_id = ?", c.GetUint("user_id")).First(&device).Error
c.JSON(200, gin.H{"enabled": err == nil && device.Enabled})
}
func backupCodes() []string {
codes := make([]string, 10)
for i := range codes {
raw := make([]byte, 5)
_, _ = rand.Read(raw)
codes[i] = fmt.Sprintf("%X", raw)
}
return codes
}
func (s *Server) mfaSetup(c *gin.Context) {
var user model.User
if err := store.DB.First(&user, c.GetUint("user_id")).Error; err != nil {
c.JSON(404, gin.H{"error": "用户不存在"})
return
}
key, err := totp.Generate(totp.GenerateOpts{Issuer: "OPSX VPN", AccountName: user.Username})
if err != nil {
c.JSON(500, gin.H{"error": err.Error()})
return
}
pendingMFAMu.Lock()
pendingMFAs[user.ID] = pendingMFA{secret: key.Secret(), backups: backupCodes(), expires: time.Now().Add(15 * time.Minute)}
pendingMFAMu.Unlock()
c.JSON(200, gin.H{"otpauth_url": key.URL(), "secret": key.Secret(), "expires_in": 900})
}
func (s *Server) mfaEnable(c *gin.Context) {
var req struct {
Code string `json:"code"`
}
if c.ShouldBindJSON(&req) != nil {
c.JSON(400, gin.H{"error": "参数错误"})
return
}
userID := c.GetUint("user_id")
pendingMFAMu.Lock()
pending, ok := pendingMFAs[userID]
delete(pendingMFAs, userID)
pendingMFAMu.Unlock()
if !ok || time.Now().After(pending.expires) || !totp.Validate(req.Code, pending.secret) {
c.JSON(400, gin.H{"error": "验证码无效或设置已过期"})
return
}
secret, _ := store.EncryptSecret(pending.secret)
raw, _ := json.Marshal(pending.backups)
backups, _ := store.EncryptSecret(string(raw))
device := model.MFADevice{UserID: userID, Secret: secret, BackupCodes: backups, Enabled: true}
store.DB.Where("user_id = ?", userID).Assign(device).FirstOrCreate(&device)
store.Audit(c.GetString("username"), "enable_mfa", c.GetString("username"), "")
c.JSON(200, gin.H{"ok": true, "backup_codes": pending.backups})
}
func (s *Server) mfaDisable(c *gin.Context) {
store.DB.Where("user_id = ?", c.GetUint("user_id")).Delete(&model.MFADevice{})
store.Audit(c.GetString("username"), "disable_mfa", c.GetString("username"), "")
c.JSON(200, gin.H{"ok": true})
}
func (s *Server) listUsers(c *gin.Context) {
var users []model.User
store.DB.Order("id").Find(&users)
c.JSON(200, users)
}
func (s *Server) createUser(c *gin.Context) {
var req struct {
Username, Password, Email, Role string
Enabled bool `json:"enabled"`
}
if c.ShouldBindJSON(&req) != nil || req.Username == "" || len(req.Password) < 8 {
c.JSON(400, gin.H{"error": "用户名及至少 8 位的密码必填"})
return
}
if req.Role == "" {
req.Role = "viewer"
}
if req.Role != "admin" && req.Role != "operator" && req.Role != "viewer" {
c.JSON(400, gin.H{"error": "角色无效"})
return
}
hash, _ := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
user := model.User{Username: req.Username, Password: string(hash), Email: req.Email, Role: req.Role, Source: "local", Enabled: req.Enabled}
if err := store.DB.Create(&user).Error; err != nil {
c.JSON(400, gin.H{"error": "用户创建失败：" + err.Error()})
return
}
store.Audit(c.GetString("username"), "create_user", user.Username, "")
c.JSON(200, user)
}
func (s *Server) updateUser(c *gin.Context) {
id, _ := strconv.Atoi(c.Param("id"))
var user model.User
if store.DB.First(&user, id).Error != nil {
c.JSON(404, gin.H{"error": "用户不存在"})
return
}
var req struct {
Email, Role, Password string
Enabled *bool `json:"enabled"`
}
if c.ShouldBindJSON(&req) != nil {
c.JSON(400, gin.H{"error": "参数错误"})
return
}
if req.Email != "" {
user.Email = req.Email
}
if req.Role != "" {
user.Role = req.Role
}
if req.Enabled != nil {
user.Enabled = *req.Enabled
}
if req.Password != "" {
if len(req.Password) < 8 {
c.JSON(400, gin.H{"error": "密码至少 8 位"})
return
}
hash, _ := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
user.Password = string(hash)
}
store.DB.Save(&user)
c.JSON(200, user)
}
func (s *Server) deleteUser(c *gin.Context) {
id, _ := strconv.Atoi(c.Param("id"))
if uint(id) == c.GetUint("user_id") {
c.JSON(400, gin.H{"error": "不能删除当前用户"})
return
}
store.DB.Delete(&model.User{}, id)
c.JSON(200, gin.H{"ok": true})
}
func (s *Server) getLDAPConfig(c *gin.Context) {
var cfg model.LDAPConfig
if store.DB.First(&cfg).Error != nil {
c.JSON(200, gin.H{"enabled": false})
return
}
c.JSON(200, cfg)
}
func (s *Server) saveLDAPConfig(c *gin.Context) {
var req struct {
URL string `json:"url"`
BindDN string `json:"bind_dn"`
BindPassword string `json:"bind_password"`
BaseDN string `json:"base_dn"`
UserFilter string `json:"user_filter"`
UsernameAttribute string `json:"username_attribute"`
Enabled bool `json:"enabled"`
}
if c.ShouldBindJSON(&req) != nil || (req.Enabled && (req.URL == "" || req.BaseDN == "")) {
c.JSON(400, gin.H{"error": "LDAP 地址与 Base DN 必填"})
return
}
var cfg model.LDAPConfig
store.DB.First(&cfg)
cfg.URL, cfg.BindDN, cfg.BaseDN, cfg.UserFilter, cfg.UsernameAttribute, cfg.Enabled = req.URL, req.BindDN, req.BaseDN, req.UserFilter, req.UsernameAttribute, req.Enabled
if req.BindPassword != "" {
cfg.BindPassword, _ = store.EncryptSecret(req.BindPassword)
}
store.DB.Save(&cfg)
c.JSON(200, gin.H{"ok": true})
}
func (s *Server) testLDAP(c *gin.Context) {
cfg, err := ldapSettings()
if err == nil {
conn, connErr := ldapConnect(cfg)
if connErr == nil {
conn.Close()
c.JSON(200, gin.H{"ok": true})
return
}
err = connErr
}
c.JSON(400, gin.H{"error": "LDAP 连接失败: " + err.Error()})
}
func (s *Server) listVPNUsers(c *gin.Context) {
var users []model.VPNUser
q := store.DB.Order("id desc")
if id := c.Query("tunnel_id"); id != "" {
q = q.Where("tunnel_id = ?", id)
}
q.Find(&users)
c.JSON(200, users)
}
func (s *Server) createVPNUser(c *gin.Context) {
var req struct {
TunnelID uint `json:"tunnel_id"`
Username string `json:"username"`
DisplayName string `json:"display_name"`
Email string `json:"email"`
Source string `json:"source"`
LDAPDN string `json:"ldap_dn"`
Password string `json:"password"`
Enabled *bool `json:"enabled"`
}
if c.ShouldBindJSON(&req) != nil || req.TunnelID == 0 || req.Username == "" {
c.JSON(400, gin.H{"error": "隧道和用户名必填"})
return
}
if req.Source == "" {
req.Source = "local"
}
if req.Source != "local" && req.Source != "ldap" {
c.JSON(400, gin.H{"error": "来源必须为 local 或 ldap"})
return
}
user := model.VPNUser{TunnelID: req.TunnelID, Username: req.Username, DisplayName: req.DisplayName, Email: req.Email, Source: req.Source, LDAPDN: req.LDAPDN, Enabled: true}
if req.Enabled != nil {
user.Enabled = *req.Enabled
}
if user.Source == "local" {
if len(req.Password) < 8 {
c.JSON(400, gin.H{"error": "本地拨号用户密码必填"})
return
}
hash, _ := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
user.Password = string(hash)
} else if user.LDAPDN == "" {
c.JSON(400, gin.H{"error": "LDAP 拨号用户必须填写 LDAP DN"})
return
}
if err := store.DB.Create(&user).Error; err != nil {
c.JSON(400, gin.H{"error": "创建失败：" + err.Error()})
return
}
c.JSON(200, user)
}
func (s *Server) updateVPNUser(c *gin.Context) {
id, _ := strconv.Atoi(c.Param("id"))
var user model.VPNUser
if store.DB.First(&user, id).Error != nil {
c.JSON(404, gin.H{"error": "拨号用户不存在"})
return
}
var req struct {
DisplayName, Email, Password string
Enabled *bool `json:"enabled"`
}
if c.ShouldBindJSON(&req) != nil {
c.JSON(400, gin.H{"error": "参数错误"})
return
}
user.DisplayName, user.Email = req.DisplayName, req.Email
if req.Enabled != nil {
user.Enabled = *req.Enabled
}
if req.Password != "" {
hash, _ := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
user.Password = string(hash)
}
store.DB.Save(&user)
c.JSON(200, user)
}
func (s *Server) deleteVPNUser(c *gin.Context) {
id, _ := strconv.Atoi(c.Param("id"))
store.DB.Delete(&model.VPNUser{}, id)
c.JSON(200, gin.H{"ok": true})
}
backend/internal/core/protocol.go
+123
View File
@@ -0,0 +1,123 @@
// Package core 定义 VPN 协议统一抽象接口与运行时管理器。
// 所有协议（内置或自定义插件）只需实现 Protocol 接口即可接入平台。
package core
import (
"fmt"
"sync"
"vpn-platform/backend/internal/model"
)
// Status 专线运行状态
type Status struct {
Running bool `json:"running"`
State string `json:"state"` // running / stopped / error / undeployed
Detail string `json:"detail"`
RxBytes int64 `json:"rx_bytes"`
TxBytes int64 `json:"tx_bytes"`
// Peers 为协议可选的对端实时状态。WireGuard 等多对端协议使用它向
// 管理端返回逐 Peer 的握手时间、端点和内核计数器，不能用隧道总流量冒充。
Peers []PeerStatus `json:"peers,omitempty"`
UpdatedAt int64 `json:"updated_at"`
}
// PeerStatus 是多对端协议的真实运行时数据。RxBytes/TxBytes 来自协议
// 进程或内核的累计计数器；服务重启后计数器可能从零重新开始。
type PeerStatus struct {
ID string `json:"id"`
Name string `json:"name,omitempty"`
PublicKey string `json:"public_key"`
Endpoint string `json:"endpoint,omitempty"`
AllowedIPs string `json:"allowed_ips,omitempty"`
LatestHandshakeAt int64 `json:"latest_handshake_at,omitempty"`
Connected bool `json:"connected"`
RxBytes int64 `json:"rx_bytes"`
TxBytes int64 `json:"tx_bytes"`
}
// Protocol 统一协议接口 —— 自定义协议按此契约实现即可热插拔接入
type Protocol interface {
// Name 协议标识，如 wireguard / ipsec / frp
Name() string
// DisplayName 展示名
DisplayName() string
// Validate 创建前校验参数，返回规范化后的配置
Validate(cfg map[string]interface{}) (map[string]interface{}, error)
// Create 生成服务端配置并落盘（不启动）
Create(t *model.Tunnel) error
// Start 启动实例
Start(t *model.Tunnel) error
// Stop 停止实例
Stop(t *model.Tunnel) error
// Status 查询运行状态与流量
Status(t *model.Tunnel) (Status, error)
// GenerateClientConfig 生成客户端配置（用于下载 / 二维码）
GenerateClientConfig(t *model.Tunnel) (string, error)
// Delete 清理实例配置与运行时资源
Delete(t *model.Tunnel) error
// Available 检测系统依赖是否就绪（wg / strongswan / frps 等）
Available() (bool, string)
}
// Manager 协议注册中心 + 实例状态缓存
type Manager struct {
mu sync.RWMutex
protocols map[string]Protocol
statuses map[uint]Status
}
func NewManager() *Manager {
return &Manager{protocols: map[string]Protocol{}, statuses: map[uint]Status{}}
}
// Register 注册协议实现（内置协议与自定义插件共用入口）
func (m *Manager) Register(p Protocol) {
m.mu.Lock()
defer m.mu.Unlock()
m.protocols[p.Name()] = p
}
// Get 获取协议实现
func (m *Manager) Get(name string) (Protocol, error) {
m.mu.RLock()
defer m.mu.RUnlock()
p, ok := m.protocols[name]
if !ok {
return nil, fmt.Errorf("不支持的协议类型: %s", name)
}
return p, nil
}
// List 列出全部已注册协议
func (m *Manager) List() []Protocol {
m.mu.RLock()
defer m.mu.RUnlock()
out := make([]Protocol, 0, len(m.protocols))
for _, p := range m.protocols {
out = append(out, p)
}
return out
}
// SetStatus 更新实例状态缓存（monitor 写入）
func (m *Manager) SetStatus(tunnelID uint, s Status) {
m.mu.Lock()
defer m.mu.Unlock()
m.statuses[tunnelID] = s
}
// GetStatus 读取实例状态缓存
func (m *Manager) GetStatus(tunnelID uint) (Status, bool) {
m.mu.RLock()
defer m.mu.RUnlock()
s, ok := m.statuses[tunnelID]
return s, ok
}
// RemoveStatus 删除状态缓存
func (m *Manager) RemoveStatus(tunnelID uint) {
m.mu.Lock()
defer m.mu.Unlock()
delete(m.statuses, tunnelID)
}
backend/internal/model/model.go
+117
View File
@@ -0,0 +1,117 @@
// Package model 定义平台数据模型（GORM + SQLite）
package model
import "time"
// User 平台账号
type User struct {
ID uint `gorm:"primaryKey" json:"id"`
Username string `gorm:"uniqueIndex;size:64" json:"username"`
Email string `gorm:"size:128" json:"email"`
Password string `gorm:"size:128" json:"-"` // 仅本地用户保存 bcrypt 哈希
Role string `gorm:"size:16;default:viewer" json:"role"` // admin / operator / viewer
Source string `gorm:"size:16;default:local" json:"source"` // local / ldap
Enabled bool `gorm:"default:true" json:"enabled"`
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
}
// LDAPConfig LDAP 身份源配置。BindPassword 由 store.EncryptSecret 加密后保存。
type LDAPConfig struct {
ID uint `gorm:"primaryKey" json:"id"`
URL string `gorm:"size:256" json:"url"`
BindDN string `gorm:"size:256" json:"bind_dn"`
BindPassword string `gorm:"type:text" json:"-"`
BaseDN string `gorm:"size:256" json:"base_dn"`
UserFilter string `gorm:"size:512" json:"user_filter"`
UsernameAttribute string `gorm:"size:64" json:"username_attribute"`
Enabled bool `gorm:"default:false" json:"enabled"`
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
}
// MFADevice 保存管理平台用户的 TOTP 密钥和备用码（均加密保存）。
type MFADevice struct {
ID uint `gorm:"primaryKey" json:"id"`
UserID uint `gorm:"uniqueIndex" json:"user_id"`
Secret string `gorm:"type:text" json:"-"`
BackupCodes string `gorm:"type:text" json:"-"`
Enabled bool `gorm:"default:false" json:"enabled"`
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
}
// VPNUser 是拨号身份，不等同于管理平台登录账号；可来自本地或 LDAP。
type VPNUser struct {
ID uint `gorm:"primaryKey" json:"id"`
TunnelID uint `gorm:"index" json:"tunnel_id"`
Username string `gorm:"size:128;uniqueIndex:idx_vpn_user" json:"username"`
DisplayName string `gorm:"size:128" json:"display_name"`
Email string `gorm:"size:128" json:"email"`
Source string `gorm:"size:16;default:local" json:"source"` // local / ldap
LDAPDN string `gorm:"size:512" json:"ldap_dn"`
Password string `gorm:"size:128" json:"-"`
Enabled bool `gorm:"default:true" json:"enabled"`
Certificate string `gorm:"size:128" json:"certificate"`
RxBytes int64 `gorm:"default:0" json:"rx_bytes"`
TxBytes int64 `gorm:"default:0" json:"tx_bytes"`
LastSeenAt *time.Time `json:"last_seen_at"`
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
}
// Tunnel 专线实例（所有协议统一存储，协议参数存 Config JSON）
type Tunnel struct {
ID uint `gorm:"primaryKey" json:"id"`
Name string `gorm:"size:128;index" json:"name"`
Protocol string `gorm:"size:32;index" json:"protocol"` // wireguard/ipsec/l2tp/frp/openvpn/custom:xxx
Remark string `gorm:"size:512" json:"remark"`
Config string `gorm:"type:text" json:"config"` // JSON，密钥字段加密存储
Secrets string `gorm:"type:text" json:"-"` // AES-GCM 加密的敏感字段 JSON
State string `gorm:"size:16;default:stopped" json:"state"` // running/stopped/error
AutoStart bool `gorm:"default:false" json:"auto_start"`
RxBytes int64 `gorm:"default:0" json:"rx_bytes"`
TxBytes int64 `gorm:"default:0" json:"tx_bytes"`
ExpireAt *time.Time `json:"expire_at"`
NodeID *uint `json:"node_id"`
Node *Node `json:"node,omitempty"`
LastError string `gorm:"size:1024" json:"last_error"`
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
}
// Node 中继节点（本机为内置节点）
type Node struct {
ID uint `gorm:"primaryKey" json:"id"`
Name string `gorm:"size:128" json:"name"`
Address string `gorm:"size:256" json:"address"` // 节点地址（API 或 SSH）
Kind string `gorm:"size:32;default:local" json:"kind"` // local / remote
Remark string `gorm:"size:512" json:"remark"`
CreatedAt time.Time `json:"created_at"`
}
// Plugin 自定义协议插件（通过命令钩子实现 Protocol 契约）
type Plugin struct {
ID uint `gorm:"primaryKey" json:"id"`
Name string `gorm:"uniqueIndex;size:64" json:"name"` // 协议标识
DisplayName string `gorm:"size:128" json:"display_name"`
Description string `gorm:"size:512" json:"description"`
// 命令钩子：平台将专线 Config JSON 通过 stdin 传入，插件按约定动作执行
CreateHook string `gorm:"size:512" json:"create_hook"`
StartHook string `gorm:"size:512" json:"start_hook"`
StopHook string `gorm:"size:512" json:"stop_hook"`
StatusHook string `gorm:"size:512" json:"status_hook"`
ConfigHook string `gorm:"size:512" json:"config_hook"` // 生成客户端配置
Enabled bool `gorm:"default:true" json:"enabled"`
CreatedAt time.Time `json:"created_at"`
}
// AuditLog 操作审计
type AuditLog struct {
ID uint `gorm:"primaryKey" json:"id"`
Username string `gorm:"size:64" json:"username"`
Action string `gorm:"size:64" json:"action"`
Target string `gorm:"size:256" json:"target"`
Detail string `gorm:"size:1024" json:"detail"`
CreatedAt time.Time `json:"created_at"`
}
backend/internal/monitor/monitor.go
+74
View File
@@ -0,0 +1,74 @@
// Package monitor 周期性采集各专线运行状态与流量
package monitor
import (
"time"
"vpn-platform/backend/internal/core"
"vpn-platform/backend/internal/model"
"vpn-platform/backend/internal/store"
)
// Start 启动状态采集循环（每 15 秒刷新一次）
func Start(mgr *core.Manager, interval time.Duration) {
if interval == 0 {
interval = 15 * time.Second
}
ticker := time.NewTicker(interval)
go func() {
collect(mgr) // 启动即采集一次
for range ticker.C {
collect(mgr)
}
}()
}
func collect(mgr *core.Manager) {
var tunnels []model.Tunnel
if err := store.DB.Find(&tunnels).Error; err != nil {
return
}
for i := range tunnels {
t := &tunnels[i]
p, err := mgr.Get(t.Protocol)
if err != nil {
continue
}
st, err := p.Status(t)
if err != nil {
continue
}
mgr.SetStatus(t.ID, st)
// 数据库状态与协议真实状态同步，避免页面长期展示过时的“运行中”。
if st.State != "" && st.State != t.State {
store.DB.Model(t).Update("state", st.State)
}
// 流量持久化（仅在有增量时写库）
if st.RxBytes > 0 || st.TxBytes > 0 {
store.DB.Model(t).Updates(map[string]interface{}{"rx_bytes": st.RxBytes, "tx_bytes": st.TxBytes})
}
// 到期自动停止
if t.ExpireAt != nil && time.Now().After(*t.ExpireAt) && t.State == "running" {
_ = p.Stop(t)
store.DB.Model(t).Update("state", "stopped")
}
}
}
// AutoStartAll 启动时拉起所有标记为自启的专线
func AutoStartAll(mgr *core.Manager) {
var tunnels []model.Tunnel
if err := store.DB.Where("auto_start = ?", true).Find(&tunnels).Error; err != nil {
return
}
for i := range tunnels {
t := &tunnels[i]
if p, err := mgr.Get(t.Protocol); err == nil {
if err := p.Start(t); err != nil {
store.DB.Model(t).Updates(map[string]interface{}{"state": "error", "last_error": err.Error()})
} else {
store.DB.Model(t).Update("state", "running")
}
}
}
}
backend/internal/service/common.go
+305
View File
@@ -0,0 +1,305 @@
// Package service 提供协议实现共用的运行时工具函数
package service
import (
"bytes"
"crypto/rand"
"encoding/base64"
"encoding/json"
"fmt"
"net"
"os"
"os/exec"
"path/filepath"
"strconv"
"strings"
"syscall"
"time"
"vpn-platform/backend/internal/core"
"vpn-platform/backend/internal/model"
"vpn-platform/backend/internal/store"
)
// BaseDir 实例配置与运行时根目录（可通过 VPN_DATA_DIR 覆盖）
func BaseDir() string {
if v := os.Getenv("VPN_DATA_DIR"); v != "" {
return v
}
exe, _ := os.Executable()
if exe != "" {
return filepath.Join(filepath.Dir(exe), "data")
}
return "data"
}
// InstanceDir 专线实例目录
func InstanceDir(t *model.Tunnel) string {
return filepath.Join(BaseDir(), "instances", fmt.Sprintf("%d-%s", t.ID, t.Protocol))
}
// LookBin 检测系统依赖二进制
func LookBin(names ...string) (string, bool) {
for _, n := range names {
if p, err := exec.LookPath(n); err == nil {
return p, true
}
}
return "", false
}
// Run 执行命令并返回输出
func Run(name string, args ...string) (string, error) {
cmd := exec.Command(name, args...)
var out, errOut bytes.Buffer
cmd.Stdout = &out
cmd.Stderr = &errOut
if err := cmd.Run(); err != nil {
return out.String(), fmt.Errorf("%s %s 执行失败: %v %s", name, strings.Join(args, " "), err, errOut.String())
}
return out.String(), nil
}
// RequireRoot rejects service operations that need kernel networking privileges.
// Starting the web process as an unprivileged account must never be reported as
// a running VPN service merely because configuration generation succeeded.
func RequireRoot(component string) error {
if os.Geteuid() != 0 {
return fmt.Errorf("无法启动 %s：需要 root 权限以管理内核网络、IPSec SA 和防火墙规则", component)
}
return nil
}
// RequireIPv4Forwarding verifies the kernel prerequisite for forwarding traffic
// between a VPN address pool and the LAN/Internet.
func RequireIPv4Forwarding(component string) error {
sysctl, ok := LookBin("sysctl")
if !ok {
return fmt.Errorf("无法启动 %s：未检测到 sysctl，无法确认 net.ipv4.ip_forward", component)
}
out, err := Run(sysctl, "-n", "net.ipv4.ip_forward")
if err != nil || strings.TrimSpace(out) != "1" {
return fmt.Errorf("无法启动 %s：请先执行 sysctl -w net.ipv4.ip_forward=1", component)
}
return nil
}
// RequireUDPPortAvailable checks a port before handing it to a daemon. This is
// deliberately a real bind check instead of parsing process output, so it also
// catches listeners started outside this platform.
func RequireUDPPortAvailable(port int, component string) error {
conn, err := net.ListenUDP("udp4", &net.UDPAddr{Port: port})
if err != nil {
return fmt.Errorf("无法启动 %s：UDP %d 已被其他服务占用: %w", component, port, err)
}
return conn.Close()
}
// DefaultRouteInterface returns the interface used for IPv4 Internet egress.
// It is used only when a VPN configuration does not explicitly set one.
func DefaultRouteInterface() (string, error) {
ip, ok := LookBin("ip")
if !ok {
return "", fmt.Errorf("未检测到 iproute2 的 ip 命令，无法确定 NAT 出口接口")
}
out, err := Run(ip, "-4", "route", "show", "default")
if err != nil {
return "", err
}
fields := strings.Fields(out)
for i := 0; i+1 < len(fields); i++ {
if fields[i] == "dev" {
return fields[i+1], nil
}
}
return "", fmt.Errorf("未找到 IPv4 默认路由，无法确定 NAT 出口接口")
}
// StartDaemon 以守护方式启动进程并记录 PID
func StartDaemon(t *model.Tunnel, name string, args ...string) error {
if err := os.MkdirAll(InstanceDir(t), 0o700); err != nil {
return err
}
logFile, err := os.OpenFile(filepath.Join(InstanceDir(t), "instance.log"), os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0o600)
if err != nil {
return err
}
cmd := exec.Command(name, args...)
cmd.Stdout = logFile
cmd.Stderr = logFile
cmd.Dir = InstanceDir(t)
if err := cmd.Start(); err != nil {
logFile.Close()
return err
}
pid := cmd.Process.Pid
_ = os.WriteFile(PidFile(t), []byte(strconv.Itoa(pid)), 0o600)
go func() { _ = cmd.Wait(); logFile.Close() }()
return nil
}
// PidFile 实例 PID 文件
func PidFile(t *model.Tunnel) string {
return filepath.Join(InstanceDir(t), "instance.pid")
}
// ReadPid 读取实例 PID 并校验存活
func ReadPid(t *model.Tunnel) (int, bool) {
raw, err := os.ReadFile(PidFile(t))
if err != nil {
return 0, false
}
pid, err := strconv.Atoi(strings.TrimSpace(string(raw)))
if err != nil || pid <= 0 {
return 0, false
}
proc, err := os.FindProcess(pid)
if err != nil {
return 0, false
}
// signal 0 检测进程存活
if err := proc.Signal(syscall.Signal(0)); err != nil {
return pid, false
}
return pid, true
}
// KillPid 停止实例进程
func KillPid(t *model.Tunnel) error {
pid, alive := ReadPid(t)
if !alive {
return nil
}
proc, err := os.FindProcess(pid)
if err != nil {
return nil
}
_ = proc.Kill()
_, _ = proc.Wait()
_ = os.Remove(PidFile(t))
return nil
}
// WriteConfig 写入实例配置文件（0600 权限）
func WriteConfig(t *model.Tunnel, name, content string) (string, error) {
if err := os.MkdirAll(InstanceDir(t), 0o700); err != nil {
return "", err
}
p := filepath.Join(InstanceDir(t), name)
if err := os.WriteFile(p, []byte(content), 0o600); err != nil {
return "", err
}
return p, nil
}
// RandomSecret 生成适合配置文件与 API 凭据使用的不可预测随机值。
func RandomSecret(bytesLen int) (string, error) {
raw := make([]byte, bytesLen)
if _, err := rand.Read(raw); err != nil {
return "", err
}
return base64.RawURLEncoding.EncodeToString(raw), nil
}
// RemoveInstance 清理隧道的专属配置、日志与 PID 文件。
func RemoveInstance(t *model.Tunnel) error {
return os.RemoveAll(InstanceDir(t))
}
// Str / StrOr / Num / Bool 从配置 map 中安全取值
func Str(cfg map[string]interface{}, key string) string {
if v, ok := cfg[key]; ok {
if s, ok := v.(string); ok {
return s
}
}
return ""
}
func StrOr(cfg map[string]interface{}, key, def string) string {
if s := Str(cfg, key); s != "" {
return s
}
return def
}
func Num(cfg map[string]interface{}, key string, def float64) float64 {
if v, ok := cfg[key]; ok {
switch n := v.(type) {
case float64:
return n
case int:
return float64(n)
case string:
if f, err := strconv.ParseFloat(n, 64); err == nil {
return f
}
}
}
return def
}
func Bool(cfg map[string]interface{}, key string, def bool) bool {
if v, ok := cfg[key]; ok {
if b, ok := v.(bool); ok {
return b
}
}
return def
}
// MustValidate 公共校验：配置必须是合法 JSON 对象
func MustValidate(cfg map[string]interface{}, required ...string) error {
for _, k := range required {
if Str(cfg, k) == "" && Num(cfg, k, 0) == 0 {
return fmt.Errorf("缺少必填参数: %s", k)
}
}
return nil
}
// ConfigJSON 序列化配置
func ConfigJSON(cfg map[string]interface{}) string {
raw, _ := json.Marshal(cfg)
return string(raw)
}
// NowStatus 构造状态对象
func NowStatus(running bool, state, detail string) core.Status {
return core.Status{Running: running, State: state, Detail: detail, UpdatedAt: time.Now().Unix()}
}
// MergeSecrets 从 cfg 中提取敏感字段，返回 (脱敏后的公开配置, 敏感配置)
func MergeSecrets(cfg map[string]interface{}, secretKeys ...string) (public map[string]interface{}, secrets map[string]interface{}) {
public = map[string]interface{}{}
secrets = map[string]interface{}{}
for k, v := range cfg {
isSecret := false
for _, sk := range secretKeys {
if k == sk {
isSecret = true
break
}
}
if isSecret {
secrets[k] = v
} else {
public[k] = v
}
}
return
}
// SaveTunnelConfig 将公开配置与加密密钥写回数据库
func SaveTunnelConfig(t *model.Tunnel, public, secrets map[string]interface{}) error {
t.Config = ConfigJSON(public)
if len(secrets) > 0 {
raw, _ := json.Marshal(secrets)
enc, err := store.EncryptSecret(string(raw))
if err != nil {
return err
}
t.Secrets = enc
}
return store.DB.Save(t).Error
}
backend/internal/service/custom/custom.go
+138
View File
@@ -0,0 +1,138 @@
// Package custom 实现自定义协议插件：用户在平台注册命令钩子，
// 平台按统一 Protocol 契约调用（Create/Start/Stop/Status/Config）。
// 钩子通过 stdin 接收专线 Config JSON，约定 stdout 返回结果。
package custom
import (
"bytes"
"encoding/json"
"fmt"
"os/exec"
"strings"
"time"
"vpn-platform/backend/internal/core"
"vpn-platform/backend/internal/model"
"vpn-platform/backend/internal/store"
)
// Service 以数据库中的 Plugin 定义为驱动的协议实现
type Service struct {
plugin *model.Plugin
}
func New(p *model.Plugin) *Service { return &Service{plugin: p} }
func (s *Service) Name() string { return "custom:" + s.plugin.Name }
func (s *Service) DisplayName() string { return s.plugin.DisplayName }
func (s *Service) Available() (bool, string) {
if s.plugin.StartHook == "" {
return false, "插件未配置 start 钩子"
}
return true, "插件钩子: " + s.plugin.StartHook
}
// runHook 执行钩子命令，stdin 传入专线上下文 JSON
func (s *Service) runHook(hook string, t *model.Tunnel) (string, error) {
if hook == "" {
return "", fmt.Errorf("插件 [%s] 未配置该动作的钩子命令", s.plugin.Name)
}
payload, _ := json.Marshal(map[string]interface{}{
"id": t.ID,
"name": t.Name,
"protocol": t.Protocol,
"config": json.RawMessage(t.Config),
})
ctx := exec.Command("sh", "-c", hook)
done := make(chan error, 1)
ctx.Stdin = bytes.NewReader(payload)
var out, errOut bytes.Buffer
ctx.Stdout = &out
ctx.Stderr = &errOut
if err := ctx.Start(); err != nil {
return "", err
}
go func() { done <- ctx.Wait() }()
select {
case err := <-done:
if err != nil {
return out.String(), fmt.Errorf("钩子执行失败: %v %s", err, errOut.String())
}
return strings.TrimSpace(out.String()), nil
case <-time.After(30 * time.Second):
_ = ctx.Process.Kill()
return "", fmt.Errorf("钩子执行超时（30s）")
}
}
func (s *Service) Validate(cfg map[string]interface{}) (map[string]interface{}, error) {
out := map[string]interface{}{}
for k, v := range cfg {
out[k] = v
}
return out, nil
}
func (s *Service) Create(t *model.Tunnel) error {
if s.plugin.CreateHook == "" {
return nil // 可选
}
_, err := s.runHook(s.plugin.CreateHook, t)
return err
}
func (s *Service) Start(t *model.Tunnel) error {
_, err := s.runHook(s.plugin.StartHook, t)
return err
}
func (s *Service) Stop(t *model.Tunnel) error {
if s.plugin.StopHook == "" {
return nil
}
_, err := s.runHook(s.plugin.StopHook, t)
return err
}
func (s *Service) Status(t *model.Tunnel) (core.Status, error) {
if s.plugin.StatusHook == "" {
return core.Status{State: "unknown", Detail: "插件未配置 status 钩子", UpdatedAt: timeNow()}, nil
}
out, err := s.runHook(s.plugin.StatusHook, t)
if err != nil {
return core.Status{Running: false, State: "error", Detail: err.Error(), UpdatedAt: timeNow()}, nil
}
// 约定：status 钩子 stdout 输出 running / stopped / 任意描述
running := strings.EqualFold(out, "running") || strings.EqualFold(out, "up") || out == "0"
state := "stopped"
if running {
state = "running"
}
return core.Status{Running: running, State: state, Detail: out, UpdatedAt: timeNow()}, nil
}
func timeNow() int64 { return time.Now().Unix() }
func (s *Service) GenerateClientConfig(t *model.Tunnel) (string, error) {
if s.plugin.ConfigHook == "" {
return "", fmt.Errorf("插件未配置 config 钩子，无法生成客户端配置")
}
return s.runHook(s.plugin.ConfigHook, t)
}
func (s *Service) Delete(t *model.Tunnel) error { return s.Stop(t) }
// LoadAll 从数据库加载全部启用的插件并注册到管理器
func LoadAll(m *core.Manager) {
if store.DB == nil {
return
}
var plugins []model.Plugin
if err := store.DB.Where("enabled = ?", true).Find(&plugins).Error; err != nil {
return
}
for i := range plugins {
m.Register(New(&plugins[i]))
}
}
backend/internal/service/frp/frp.go
+388
View File
@@ -0,0 +1,388 @@
// Package frp manages real frps/frpc processes and FRP's TOML configuration.
package frp
import (
"fmt"
"regexp"
"sort"
"strconv"
"strings"
"vpn-platform/backend/internal/core"
"vpn-platform/backend/internal/model"
"vpn-platform/backend/internal/service"
"vpn-platform/backend/internal/store"
)
type Service struct{}
// Proxy is the supported, repeatable FRP proxy rule. It is deliberately kept
// as a JSON-friendly struct so callers may put a `proxies` array in Config.
// The old single proxy_name fields remain supported for existing installations.
type Proxy struct {
Name string `json:"name"`
Type string `json:"type"`
LocalIP string `json:"local_ip"`
LocalPort int `json:"local_port"`
RemotePort int `json:"remote_port"`
CustomDomains []string `json:"custom_domains"`
Subdomain string `json:"subdomain"`
Locations []string `json:"locations"`
HostHeaderRewrite string `json:"host_header_rewrite"`
}
var safeName = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$`)
func New() *Service { return &Service{} }
func (s *Service) Name() string { return "frp" }
func (s *Service) DisplayName() string { return "FRP 内网穿透" }
func (s *Service) Available() (bool, string) {
if p, ok := service.LookBin("frps", "frpc"); ok {
return true, p
}
return false, "未检测到 frps/frpc 二进制，可生成配置但无法启动"
}
func (s *Service) Validate(cfg map[string]interface{}) (map[string]interface{}, error) {
out := clone(cfg)
mode := service.StrOr(out, "mode", "server")
if mode != "server" && mode != "client" {
return nil, fmt.Errorf("mode 必须为 server 或 client")
}
out["mode"] = mode
if mode == "server" {
setDefaultPort(out, "bind_port", 7000)
setDefaultPort(out, "dashboard_port", 7500)
for _, key := range []string{"bind_port", "dashboard_port"} {
if err := validPort(key, service.Num(out, key, 0)); err != nil {
return nil, err
}
}
for _, key := range []string{"vhost_http_port", "vhost_https_port"} {
if service.Num(out, key, 0) != 0 {
if err := validPort(key, service.Num(out, key, 0)); err != nil {
return nil, err
}
}
}
} else {
if err := service.MustValidate(out, "server_addr"); err != nil {
return nil, err
}
setDefaultPort(out, "server_port", 7000)
if err := validPort("server_port", service.Num(out, "server_port", 0)); err != nil {
return nil, err
}
}
rules, err := proxyRules(out)
if err != nil {
return nil, err
}
for _, rule := range rules {
if err := validateProxy(rule); err != nil {
return nil, err
}
}
if len(rules) > 0 {
out["proxies"] = proxiesJSON(rules)
}
return out, nil
}
func setDefaultPort(cfg map[string]interface{}, key string, value int) {
if service.Num(cfg, key, 0) == 0 {
cfg[key] = value
}
}
func validPort(name string, port float64) error {
if port < 1 || port > 65535 || port != float64(int(port)) {
return fmt.Errorf("%s 必须是 1-65535 的整数", name)
}
return nil
}
func validateProxy(p Proxy) error {
if !safeName.MatchString(p.Name) {
return fmt.Errorf("代理名称 %q 无效", p.Name)
}
if p.Type != "tcp" && p.Type != "udp" && p.Type != "http" && p.Type != "https" {
return fmt.Errorf("代理 %s 的类型必须为 tcp、udp、http 或 https", p.Name)
}
if p.LocalPort < 1 || p.LocalPort > 65535 {
return fmt.Errorf("代理 %s 的 local_port 无效", p.Name)
}
if p.LocalIP == "" {
p.LocalIP = "127.0.0.1"
}
if strings.ContainsAny(p.LocalIP, "\r\n\"'") {
return fmt.Errorf("代理 %s 的 local_ip 非法", p.Name)
}
if p.Type == "tcp" || p.Type == "udp" {
if p.RemotePort < 1 || p.RemotePort > 65535 {
return fmt.Errorf("代理 %s 的 remote_port 无效", p.Name)
}
return nil
}
if len(p.CustomDomains) == 0 && p.Subdomain == "" {
return fmt.Errorf("HTTP/HTTPS 代理 %s 必须填写 custom_domains 或 subdomain", p.Name)
}
domains := append([]string{}, p.CustomDomains...)
if p.Subdomain != "" {
domains = append(domains, p.Subdomain)
}
for _, d := range domains {
if !validDomain(d) {
return fmt.Errorf("代理 %s 的域名 %q 无效", p.Name, d)
}
}
return nil
}
func validDomain(v string) bool {
v = strings.TrimSuffix(strings.ToLower(strings.TrimSpace(v)), ".")
if v == "" || len(v) > 253 || strings.ContainsAny(v, "\r\n\"' /\\") {
return false
}
for _, label := range strings.Split(v, ".") {
if label == "" || len(label) > 63 || label[0] == '-' || label[len(label)-1] == '-' {
return false
}
}
return true
}
func (s *Service) Create(t *model.Tunnel) error {
cfg, err := store.TunnelConfig(t)
if err != nil {
return err
}
secrets, _ := store.TunnelSecrets(t)
token := service.Str(cfg, "token")
if token == "" {
token = service.Str(secrets, "token")
}
if token == "" {
token, err = service.RandomSecret(32)
if err != nil {
return err
}
}
secrets["token"] = token
dashboardPassword := service.Str(cfg, "dashboard_password")
if dashboardPassword == "" {
dashboardPassword = service.Str(secrets, "dashboard_password")
}
if dashboardPassword == "" {
dashboardPassword, err = service.RandomSecret(24)
if err != nil {
return err
}
}
secrets["dashboard_password"] = dashboardPassword
if service.StrOr(cfg, "mode", "server") == "server" {
if _, err = service.WriteConfig(t, "frps.toml", frpsConfig(cfg, token, dashboardPassword)); err != nil {
return err
}
} else if _, err = service.WriteConfig(t, "frpc.toml", s.frpcConfig(cfg, token)); err != nil {
return err
}
public, sec := service.MergeSecrets(cfg, "token", "dashboard_password")
for k, v := range secrets {
sec[k] = v
}
return service.SaveTunnelConfig(t, public, sec)
}
func frpsConfig(cfg map[string]interface{}, token, password string) string {
var b strings.Builder
fmt.Fprintf(&b, "bindPort = %d\nauth.method = \"token\"\nauth.token = %q\n\n", int(service.Num(cfg, "bind_port", 7000)), token)
fmt.Fprintf(&b, "webServer.addr = %q\nwebServer.port = %d\nwebServer.user = %q\nwebServer.password = %q\n", service.StrOr(cfg, "dashboard_addr", "127.0.0.1"), int(service.Num(cfg, "dashboard_port", 7500)), service.StrOr(cfg, "dashboard_user", "admin"), password)
if p := int(service.Num(cfg, "vhost_http_port", 0)); p > 0 {
fmt.Fprintf(&b, "vhostHTTPPort = %d\n", p)
}
if p := int(service.Num(cfg, "vhost_https_port", 0)); p > 0 {
fmt.Fprintf(&b, "vhostHTTPSPort = %d\n", p)
}
if ranges := allowPorts(service.Str(cfg, "allow_ports")); len(ranges) > 0 {
fmt.Fprintf(&b, "allowPorts = [%s]\n", strings.Join(ranges, ", "))
}
b.WriteString("log.to = \"frps.log\"\nlog.level = \"info\"\n")
return b.String()
}
func (s *Service) frpcConfig(cfg map[string]interface{}, token string) string {
var b strings.Builder
fmt.Fprintf(&b, "serverAddr = %q\nserverPort = %d\nauth.method = \"token\"\nauth.token = %q\nlog.to = \"frpc.log\"\nlog.level = \"info\"\n", service.Str(cfg, "server_addr"), int(service.Num(cfg, "server_port", 7000)), token)
rules, _ := proxyRules(cfg)
for _, p := range rules {
fmt.Fprintf(&b, "\n[[proxies]]\nname = %q\ntype = %q\nlocalIP = %q\nlocalPort = %d\n", p.Name, p.Type, defaultString(p.LocalIP, "127.0.0.1"), p.LocalPort)
if p.Type == "tcp" || p.Type == "udp" {
fmt.Fprintf(&b, "remotePort = %d\n", p.RemotePort)
} else {
if len(p.CustomDomains) > 0 {
fmt.Fprintf(&b, "customDomains = [%s]\n", strings.Join(quoteStrings(p.CustomDomains), ", "))
}
if p.Subdomain != "" {
fmt.Fprintf(&b, "subdomain = %q\n", p.Subdomain)
}
if len(p.Locations) > 0 {
fmt.Fprintf(&b, "locations = [%s]\n", strings.Join(quoteStrings(p.Locations), ", "))
}
if p.HostHeaderRewrite != "" {
fmt.Fprintf(&b, "hostHeaderRewrite = %q\n", p.HostHeaderRewrite)
}
}
}
return b.String()
}
func (s *Service) GenerateClientConfig(t *model.Tunnel) (string, error) {
cfg, err := store.TunnelConfig(t)
if err != nil {
return "", err
}
secrets, _ := store.TunnelSecrets(t)
token := service.Str(secrets, "token")
if service.StrOr(cfg, "mode", "server") == "server" {
cfg = clone(cfg)
cfg["server_addr"] = service.StrOr(cfg, "public_endpoint", "your-server-ip")
cfg["server_port"] = service.Num(cfg, "bind_port", 7000)
}
return s.frpcConfig(cfg, token), nil
}
func (s *Service) Start(t *model.Tunnel) error {
cfg, err := store.TunnelConfig(t)
if err != nil {
return err
}
bin, conf := "frpc", "frpc.toml"
if service.StrOr(cfg, "mode", "server") == "server" {
bin, conf = "frps", "frps.toml"
}
if p, ok := service.LookBin(bin); ok {
return service.StartDaemon(t, p, "-c", fmt.Sprintf("%s/%s", service.InstanceDir(t), conf))
}
return fmt.Errorf("无法启动 FRP：未检测到 %s", bin)
}
func (s *Service) Stop(t *model.Tunnel) error { return service.KillPid(t) }
func (s *Service) Status(t *model.Tunnel) (core.Status, error) {
if _, alive := service.ReadPid(t); alive {
return service.NowStatus(true, "running", "FRP 进程运行中"), nil
}
cfg, _ := store.TunnelConfig(t)
bin := "frpc"
if service.StrOr(cfg, "mode", "server") == "server" {
bin = "frps"
}
if _, ok := service.LookBin(bin); !ok {
return service.NowStatus(false, "undeployed", fmt.Sprintf("配置已生成，但未检测到 %s，尚未部署", bin)), nil
}
return service.NowStatus(false, "stopped", "未启动"), nil
}
func (s *Service) Delete(t *model.Tunnel) error { return s.Stop(t) }
func proxyRules(cfg map[string]interface{}) ([]Proxy, error) {
if raw, ok := cfg["proxies"]; ok {
items, ok := raw.([]interface{})
if !ok {
return nil, fmt.Errorf("proxies 必须是数组")
}
rules := make([]Proxy, 0, len(items))
for _, item := range items {
m, ok := item.(map[string]interface{})
if !ok {
return nil, fmt.Errorf("proxies 中每项必须是对象")
}
p := Proxy{Name: service.Str(m, "name"), Type: service.StrOr(m, "type", "tcp"), LocalIP: service.StrOr(m, "local_ip", "127.0.0.1"), LocalPort: int(service.Num(m, "local_port", 0)), RemotePort: int(service.Num(m, "remote_port", 0)), Subdomain: service.Str(m, "subdomain"), HostHeaderRewrite: service.Str(m, "host_header_rewrite")}
p.CustomDomains = stringList(m["custom_domains"])
p.Locations = stringList(m["locations"])
rules = append(rules, p)
}
return rules, nil
}
if name := service.Str(cfg, "proxy_name"); name != "" {
return []Proxy{{Name: name, Type: service.StrOr(cfg, "proxy_type", "tcp"), LocalIP: service.StrOr(cfg, "local_ip", "127.0.0.1"), LocalPort: int(service.Num(cfg, "local_port", 0)), RemotePort: int(service.Num(cfg, "remote_port", 0)), CustomDomains: splitDomains(service.Str(cfg, "custom_domains"))}}, nil
}
return nil, nil
}
func proxiesJSON(in []Proxy) []interface{} {
out := make([]interface{}, 0, len(in))
for _, p := range in {
out = append(out, map[string]interface{}{"name": p.Name, "type": p.Type, "local_ip": p.LocalIP, "local_port": p.LocalPort, "remote_port": p.RemotePort, "custom_domains": p.CustomDomains, "subdomain": p.Subdomain, "locations": p.Locations, "host_header_rewrite": p.HostHeaderRewrite})
}
return out
}
func stringList(v interface{}) []string {
switch x := v.(type) {
case []interface{}:
out := []string{}
for _, item := range x {
if s, ok := item.(string); ok && strings.TrimSpace(s) != "" {
out = append(out, strings.TrimSpace(s))
}
}
return out
case []string:
return x
case string:
return splitDomains(x)
}
return nil
}
func splitDomains(v string) []string {
return strings.FieldsFunc(v, func(r rune) bool { return r == ',' || r == ' ' || r == '\n' || r == '\t' })
}
func quoteStrings(v []string) []string {
out := make([]string, 0, len(v))
for _, s := range v {
out = append(out, strconv.Quote(s))
}
return out
}
func defaultString(v, d string) string {
if v != "" {
return v
}
return d
}
func clone(in map[string]interface{}) map[string]interface{} {
out := map[string]interface{}{}
for k, v := range in {
out[k] = v
}
return out
}
func allowPorts(value string) []string {
seen := map[string]bool{}
out := []string{}
for _, part := range strings.Split(value, ",") {
part = strings.TrimSpace(part)
if part == "" {
continue
}
pieces := strings.Split(part, "-")
a, err := strconv.Atoi(strings.TrimSpace(pieces[0]))
if err != nil || a < 1 || a > 65535 || len(pieces) > 2 {
continue
}
entry := ""
if len(pieces) == 1 {
entry = fmt.Sprintf("{ single = %d }", a)
} else {
b, err := strconv.Atoi(strings.TrimSpace(pieces[1]))
if err != nil || b < a || b > 65535 {
continue
}
entry = fmt.Sprintf("{ start = %d, end = %d }", a, b)
}
if !seen[entry] {
seen[entry] = true
out = append(out, entry)
}
}
sort.Strings(out)
return out
}
backend/internal/service/frp/frp_test.go
+37
View File
@@ -0,0 +1,37 @@
package frp
import (
"strings"
"testing"
)
func TestValidateMultipleHTTPAndTCPProxies(t *testing.T) {
s := New()
cfg, err := s.Validate(map[string]interface{}{
"mode": "client",
"server_addr": "frps.example.com",
"proxies": []interface{}{
map[string]interface{}{"name": "ssh", "type": "tcp", "local_port": float64(22), "remote_port": float64(2222)},
map[string]interface{}{"name": "web", "type": "https", "local_port": float64(443), "custom_domains": []interface{}{"vpn.example.com"}},
},
})
if err != nil {
t.Fatal(err)
}
text := s.frpcConfig(cfg, "test-token")
for _, expected := range []string{"name = \"ssh\"", "remotePort = 2222", "name = \"web\"", "customDomains = [\"vpn.example.com\"]"} {
if !strings.Contains(text, expected) {
t.Errorf("generated config missing %q:\n%s", expected, text)
}
}
}
func TestHTTPProxyNeedsDomain(t *testing.T) {
_, err := New().Validate(map[string]interface{}{
"mode": "client", "server_addr": "127.0.0.1",
"proxies": []interface{}{map[string]interface{}{"name": "web", "type": "http", "local_port": float64(8080)}},
})
if err == nil {
t.Fatal("expected HTTP domain validation error")
}
}
backend/internal/service/ipsec/ipsec.go
+421
View File
@@ -0,0 +1,421 @@
// Package ipsec 实现 IPSec 站点到站点对接管理（StrongSwan swanctl），
// 内置 Cisco / FortiGate / 华为 / 华三 常用对接模板，重点服务第三方对接场景。
package ipsec
import (
"fmt"
"net/netip"
"os"
"strconv"
"strings"
"vpn-platform/backend/internal/core"
"vpn-platform/backend/internal/model"
"vpn-platform/backend/internal/service"
"vpn-platform/backend/internal/store"
)
type Service struct{}
func New() *Service { return &Service{} }
func (s *Service) Name() string { return "ipsec" }
func (s *Service) DisplayName() string { return "IPSec 站点互联" }
func (s *Service) Available() (bool, string) {
if p, ok := service.LookBin("swanctl"); ok {
return true, p
}
return false, "未检测到 strongSwan（swanctl），可生成配置但无法启动"
}
// VendorTemplate 第三方设备对接模板
type VendorTemplate struct {
Key string `json:"key"`
Name string `json:"name"`
IKEVersion string `json:"ike_version"`
IKEProposal string `json:"ike_proposal"`
ESPProposal string `json:"esp_proposal"`
DPDAction string `json:"dpd_action"`
Note string `json:"note"`
}
// Templates 常用第三方设备模板（Phase1 / Phase2 参数预置）
func Templates() []VendorTemplate {
return []VendorTemplate{
{"cisco", "Cisco ISR/ASR", "ikev2", "aes256-sha256-modp2048", "aes256-sha256", "restart", "思科设备建议 IKEv2 + DH group14，注意对端 lifetime 默认 86400s"},
{"fortigate", "FortiGate 防火墙", "ikev2", "aes256-sha256-modp1536", "aes256-sha256", "clear", "飞塔默认 DH group5，Phase2 建议开启 PFS group14"},
{"huawei", "华为 USG/AR", "ikev2", "aes256-sha1-modp1024", "aes256-sha1", "restart", "华为老设备常用 DH group2，建议升级到 modp2048"},
{"h3c", "H3C 防火墙", "ikev1", "aes128-sha1-modp1024", "aes128-sha1", "restart", "华三老型号仅支持 IKEv1 主模式，需关闭 DPD 周期性探测"},
{"generic", "通用标准（推荐）", "ikev2", "aes256gcm16-sha256-modp2048", "aes256gcm16", "restart", "现代设备首选：AES-GCM 认证加密，性能与安全兼顾"},
}
}
func (s *Service) Validate(cfg map[string]interface{}) (map[string]interface{}, error) {
if err := service.MustValidate(cfg, "remote_gateway", "local_subnets", "remote_subnets"); err != nil {
return nil, err
}
out := map[string]interface{}{}
for k, v := range cfg {
out[k] = v
}
if service.Str(out, "ike_version") == "" {
out["ike_version"] = "ikev2"
}
if service.Str(out, "ike_proposal") == "" {
out["ike_proposal"] = "aes256-sha256-modp2048"
}
if service.Str(out, "esp_proposal") == "" {
out["esp_proposal"] = "aes256-sha256"
}
if service.Str(out, "dpd_action") == "" {
out["dpd_action"] = "restart"
}
if service.Str(out, "local_id") == "" {
out["local_id"] = "@vpn-local"
}
if service.Str(out, "remote_id") == "" {
out["remote_id"] = "@vpn-remote"
}
remoteGateway := service.Str(out, "remote_gateway")
// StrongSwan accepts both literal addresses and DNS names. Keep DNS support
// for peers with dynamic addresses, while rejecting syntax that can alter the
// generated swanctl stanza.
if _, err := netip.ParseAddr(remoteGateway); err != nil &&
(strings.ContainsAny(remoteGateway, " \t\r\n{}\"") || !strings.ContainsAny(remoteGateway, ".abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")) {
return nil, fmt.Errorf("remote_gateway 必须是 IPv4/IPv6 地址或有效域名")
}
if err := validatePrefixes(service.Str(out, "local_subnets")); err != nil {
return nil, fmt.Errorf("local_subnets 无效: %w", err)
}
if err := validatePrefixes(service.Str(out, "remote_subnets")); err != nil {
return nil, fmt.Errorf("remote_subnets 无效: %w", err)
}
if intersects(service.Str(out, "local_subnets"), service.Str(out, "remote_subnets")) {
return nil, fmt.Errorf("local_subnets 与 remote_subnets 不能重叠")
}
for _, key := range []string{"ike_proposal", "esp_proposal", "local_id", "remote_id", "dpd_action"} {
if strings.ContainsAny(service.Str(out, key), "\r\n{}\"") {
return nil, fmt.Errorf("%s 包含配置文件不允许的字符", key)
}
}
return out, nil
}
func validatePrefixes(raw string) error {
for _, item := range strings.Split(raw, ",") {
if _, err := netip.ParsePrefix(strings.TrimSpace(item)); err != nil {
return err
}
}
return nil
}
func intersects(a, b string) bool {
for _, left := range strings.Split(a, ",") {
lp, err := netip.ParsePrefix(strings.TrimSpace(left))
if err != nil {
continue
}
for _, right := range strings.Split(b, ",") {
rp, err := netip.ParsePrefix(strings.TrimSpace(right))
if err == nil && (lp.Overlaps(rp)) {
return true
}
}
}
return false
}
func (s *Service) Create(t *model.Tunnel) error {
cfg, err := store.TunnelConfig(t)
if err != nil {
return err
}
secrets, _ := store.TunnelSecrets(t)
if psk := service.Str(cfg, "psk"); psk != "" {
secrets["psk"] = psk // 显式提交新 PSK 时覆盖旧值
} else if service.Str(secrets, "psk") == "" {
return fmt.Errorf("缺少预共享密钥 psk（第三方对接必填）")
}
conf := s.swanctlConf(t.ID, cfg, service.Str(secrets, "psk"))
if _, err := service.WriteConfig(t, "swanctl.conf", conf); err != nil {
return err
}
// 同时导出一份对端参考配置（方便发给第三方）
peerRef := s.PeerReference(cfg)
if _, err := service.WriteConfig(t, "peer-reference.txt", peerRef); err != nil {
return err
}
public, sec := service.MergeSecrets(cfg, "psk")
for k, v := range secrets {
sec[k] = v
}
return service.SaveTunnelConfig(t, public, sec)
}
// swanctlConf 生成 StrongSwan swanctl 配置
func (s *Service) swanctlConf(id uint, cfg map[string]interface{}, psk string) string {
vip := ""
if v := service.Str(cfg, "local_ts_vip"); v != "" {
vip = "\n vips = " + v
}
return fmt.Sprintf(`connections {
tunnel-%d {
remote_addrs = %s
version = %s
dpd_delay = 30s
dpd_timeout = 120s
proposals = %s
local {
auth = psk
id = %s
}
remote {
auth = psk
id = %s
}
children {
site-%d {
local_ts = %s
remote_ts = %s
esp_proposals = %s
dpd_action = %s
start_action = start%s
}
}
}
}
secrets {
ike-tunnel-%d {
id-local = %s
id-remote = %s
secret = %s
}
}
`,
id,
service.Str(cfg, "remote_gateway"),
ikeVersionNum(service.Str(cfg, "ike_version")),
service.Str(cfg, "ike_proposal"),
service.Str(cfg, "local_id"),
service.Str(cfg, "remote_id"),
id,
service.Str(cfg, "local_subnets"),
service.Str(cfg, "remote_subnets"),
service.Str(cfg, "esp_proposal"),
service.Str(cfg, "dpd_action"),
vip,
id,
service.Str(cfg, "local_id"),
service.Str(cfg, "remote_id"),
strconv.Quote(psk),
)
}
func ikeVersionNum(v string) string {
if strings.EqualFold(v, "ikev1") {
return "1"
}
return "2"
}
// PeerReference 生成对端（第三方）参数参考文档
func (s *Service) PeerReference(cfg map[string]interface{}) string {
return fmt.Sprintf(`======== IPSec 对接参数（请提供给对端管理员）========
本端网关公网地址 : %s
对端网关地址 : %s
IKE 版本 : %s
认证方式 : 预共享密钥 (PSK)
----- Phase 1 (IKE SA) -----
加密/认证/DH : %s
本端标识 ID : %s
对端标识 ID : %s
SA 生存期 : %ds
DPD 策略 : %s (30s 探测 / 120s 超时)
----- Phase 2 (IPSec SA) -----
封装协议 : ESP (隧道模式)
加密/认证 : %s
本端网段 : %s
对端网段 : %s
PFS : %s
注意：双方 Phase1/Phase2 的加密算法、认证算法、DH 组必须完全一致，
两端 ID 需交叉对应（本端 local_id = 对端 remote_id）。
`,
service.StrOr(cfg, "public_endpoint", "<本端公网 IP>"),
service.Str(cfg, "remote_gateway"),
service.Str(cfg, "ike_version"),
service.Str(cfg, "ike_proposal"),
service.Str(cfg, "local_id"),
service.Str(cfg, "remote_id"),
int(service.Num(cfg, "ike_lifetime", 86400)),
service.Str(cfg, "dpd_action"),
service.Str(cfg, "esp_proposal"),
service.Str(cfg, "local_subnets"),
service.Str(cfg, "remote_subnets"),
service.StrOr(cfg, "pfs_group", "modp2048"),
)
}
// ComparePeerParams 双方参数一致性检查（返回不一致项列表）
func ComparePeerParams(local, peer map[string]interface{}) []string {
var diffs []string
checks := []struct{ key, label string }{
{"ike_version", "IKE 版本"},
{"ike_proposal", "Phase1 加密/认证/DH 提议"},
{"esp_proposal", "Phase2 ESP 提议"},
{"pfs_group", "PFS DH 组"},
}
for _, c := range checks {
lv, pv := service.Str(local, c.key), service.Str(peer, c.key)
if pv != "" && lv != pv {
diffs = append(diffs, fmt.Sprintf("%s 不一致：本端 [%s] vs 对端 [%s]", c.label, lv, pv))
}
}
// 网段交叉检查：本端 local 应等于对端 remote
if service.Str(peer, "local_subnets") != "" &&
service.Str(local, "remote_subnets") != service.Str(peer, "local_subnets") {
diffs = append(diffs, "网段交叉不匹配：本端 remote_subnets 应等于对端 local_subnets")
}
return diffs
}
// GenerateClientConfig 导出对端参考配置（第三方对接场景）
func (s *Service) GenerateClientConfig(t *model.Tunnel) (string, error) {
cfg, err := store.TunnelConfig(t)
if err != nil {
return "", err
}
return s.PeerReference(cfg), nil
}
func (s *Service) Start(t *model.Tunnel) error {
confPath := fmt.Sprintf("%s/swanctl.conf", service.InstanceDir(t))
bin, ok := service.LookBin("swanctl")
if !ok {
return fmt.Errorf("无法启动 IPSec：未检测到 swanctl，请先安装 strongSwan")
}
if err := service.RequireRoot("IPSec"); err != nil {
return err
}
if err := service.RequireIPv4Forwarding("IPSec"); err != nil {
return err
}
if _, err := os.Stat(confPath); err != nil {
return fmt.Errorf("无法启动 IPSec：配置文件不存在，请先重新生成配置: %w", err)
}
if err := s.installFirewall(t); err != nil {
return err
}
// Loading a revised configuration without unloading the previous connection
// can leave stale traffic selectors and credentials in charon.
_ = s.unload(bin, confPath)
if _, err := service.Run(bin, "--load-all", "--file", confPath); err != nil {
_ = s.removeFirewall(t)
return err
}
if _, err := service.Run(bin, "--initiate", "--child", fmt.Sprintf("site-%d", t.ID)); err != nil {
_ = s.unload(bin, confPath)
_ = s.removeFirewall(t)
return err
}
return nil
}
func (s *Service) Stop(t *model.Tunnel) error {
var firstErr error
if bin, ok := service.LookBin("swanctl"); ok {
if _, err := service.Run(bin, "--terminate", "--ike", fmt.Sprintf("tunnel-%d", t.ID)); err != nil {
firstErr = err
}
if err := s.unload(bin, fmt.Sprintf("%s/swanctl.conf", service.InstanceDir(t))); err != nil && firstErr == nil {
firstErr = err
}
}
if err := s.removeFirewall(t); err != nil && firstErr == nil {
firstErr = err
}
return firstErr
}
func (s *Service) Status(t *model.Tunnel) (core.Status, error) {
if bin, ok := service.LookBin("swanctl"); ok {
out, err := service.Run(bin, "--list-sas")
child := fmt.Sprintf("site-%d", t.ID)
if err == nil && strings.Contains(out, child) && strings.Contains(out, "INSTALLED") {
st := service.NowStatus(true, "running", "IKE/Child SA 已建立")
return st, nil
}
if err != nil {
return service.NowStatus(false, "error", "无法读取 strongSwan SA 状态: "+err.Error()), nil
}
return service.NowStatus(false, "stopped", "IPSec Child SA 未建立"), nil
}
return service.NowStatus(false, "undeployed", "配置已生成，但未检测到 strongSwan（swanctl），尚未部署"), nil
}
func (s *Service) Delete(t *model.Tunnel) error { return s.Stop(t) }
func (s *Service) unload(bin, confPath string) error {
// Both commands are idempotent from the platform perspective: an already
// unloaded connection should not prevent stop/delete from cleaning its files.
_, _ = service.Run(bin, "--unload-conns", "--file", confPath)
_, _ = service.Run(bin, "--unload-creds", "--file", confPath)
return nil
}
func (s *Service) installFirewall(t *model.Tunnel) error {
iptables, ok := service.LookBin("iptables")
if !ok {
return fmt.Errorf("无法启动 IPSec：未检测到 iptables，无法放行 UDP 500/4500 与 ESP")
}
comment := fmt.Sprintf("opsx-vpn-ipsec-%d", t.ID)
rules := [][]string{
{"-p", "udp", "--dport", "500", "-m", "comment", "--comment", comment, "-j", "ACCEPT"},
{"-p", "udp", "--dport", "4500", "-m", "comment", "--comment", comment, "-j", "ACCEPT"},
{"-p", "esp", "-m", "comment", "--comment", comment, "-j", "ACCEPT"},
}
for _, rule := range rules {
check := append([]string{"-C", "INPUT"}, rule...)
if _, err := service.Run(iptables, check...); err == nil {
continue
}
add := append([]string{"-A", "INPUT"}, rule...)
if _, err := service.Run(iptables, add...); err != nil {
_ = s.removeFirewall(t)
return fmt.Errorf("无法添加 IPSec 防火墙规则: %w", err)
}
}
return nil
}
func (s *Service) removeFirewall(t *model.Tunnel) error {
iptables, ok := service.LookBin("iptables")
if !ok {
return nil // Service removal must still work after a package uninstall.
}
comment := fmt.Sprintf("opsx-vpn-ipsec-%d", t.ID)
rules := [][]string{
{"-p", "udp", "--dport", "500", "-m", "comment", "--comment", comment, "-j", "ACCEPT"},
{"-p", "udp", "--dport", "4500", "-m", "comment", "--comment", comment, "-j", "ACCEPT"},
{"-p", "esp", "-m", "comment", "--comment", comment, "-j", "ACCEPT"},
}
for _, rule := range rules {
for {
check := append([]string{"-C", "INPUT"}, rule...)
if _, err := service.Run(iptables, check...); err != nil {
break
}
remove := append([]string{"-D", "INPUT"}, rule...)
if _, err := service.Run(iptables, remove...); err != nil {
return fmt.Errorf("无法移除 IPSec 防火墙规则: %w", err)
}
}
}
return nil
}
backend/internal/service/l2tp/l2tp.go
+411
View File
@@ -0,0 +1,411 @@
// Package l2tp 实现 L2TP/IPSec 接入管理（StrongSwan + xl2tpd），兼容手机/老设备。
package l2tp
import (
"fmt"
"net/netip"
"os"
"strconv"
"strings"
"vpn-platform/backend/internal/core"
"vpn-platform/backend/internal/model"
"vpn-platform/backend/internal/service"
"vpn-platform/backend/internal/store"
)
type Service struct{}
func New() *Service { return &Service{} }
func (s *Service) Name() string { return "l2tp" }
func (s *Service) DisplayName() string { return "L2TP/IPSec" }
func (s *Service) Available() (bool, string) {
_, hasSwan := service.LookBin("swanctl", "ipsec")
_, hasL2tp := service.LookBin("xl2tpd")
if hasSwan && hasL2tp {
return true, "strongSwan + xl2tpd"
}
return false, "未检测到 strongSwan/xl2tpd，可生成配置但无法启动"
}
func (s *Service) Validate(cfg map[string]interface{}) (map[string]interface{}, error) {
out := map[string]interface{}{}
for k, v := range cfg {
out[k] = v
}
if service.Str(out, "ip_range") == "" {
out["ip_range"] = "10.9.0.100-10.9.0.200"
}
if service.Str(out, "local_ip") == "" {
out["local_ip"] = "10.9.0.1"
}
if service.Str(out, "dns") == "" {
out["dns"] = "223.5.5.5"
}
if service.Str(out, "ike_proposal") == "" {
out["ike_proposal"] = "aes256-sha256-modp2048,aes128-sha1-modp1024"
}
if service.Str(out, "esp_proposal") == "" {
out["esp_proposal"] = "aes256-sha256,aes128-sha1"
}
local, err := netip.ParseAddr(service.Str(out, "local_ip"))
if err != nil || !local.Is4() {
return nil, fmt.Errorf("local_ip 必须是 IPv4 地址")
}
start, end, err := parseIPRange(service.Str(out, "ip_range"))
if err != nil || !start.Is4() || !end.Is4() || start.Compare(end) > 0 {
return nil, fmt.Errorf("ip_range 必须是递增的 IPv4 地址范围")
}
if local.Compare(start) >= 0 && local.Compare(end) <= 0 {
return nil, fmt.Errorf("local_ip 不能落在拨号客户端 ip_range 内")
}
if service.Str(out, "client_subnet") == "" {
out["client_subnet"] = netip.PrefixFrom(start, 24).Masked().String()
}
prefix, err := netip.ParsePrefix(service.Str(out, "client_subnet"))
if err != nil || !prefix.Addr().Is4() || !prefix.Contains(start) || !prefix.Contains(end) {
return nil, fmt.Errorf("client_subnet 必须覆盖整个 ip_range")
}
if username := service.Str(out, "username"); username != "" && strings.ContainsAny(username, " \t\r\n\"") {
return nil, fmt.Errorf("username 不能包含空白或引号")
}
for _, key := range []string{"ike_proposal", "esp_proposal"} {
if strings.ContainsAny(service.Str(out, key), "\r\n{}\"") {
return nil, fmt.Errorf("%s 包含配置文件不允许的字符", key)
}
}
return out, nil
}
func parseIPRange(raw string) (netip.Addr, netip.Addr, error) {
parts := strings.Split(raw, "-")
if len(parts) != 2 {
return netip.Addr{}, netip.Addr{}, fmt.Errorf("格式应为 起始IP-结束IP")
}
start, err := netip.ParseAddr(strings.TrimSpace(parts[0]))
if err != nil {
return netip.Addr{}, netip.Addr{}, err
}
end, err := netip.ParseAddr(strings.TrimSpace(parts[1]))
return start, end, err
}
func (s *Service) Create(t *model.Tunnel) error {
cfg, err := store.TunnelConfig(t)
if err != nil {
return err
}
secrets, _ := store.TunnelSecrets(t)
if psk := service.Str(cfg, "psk"); psk != "" {
secrets["psk"] = psk
} else if service.Str(secrets, "psk") == "" {
return fmt.Errorf("缺少 IPSec 预共享密钥 psk")
}
username := service.StrOr(cfg, "username", "vpnuser")
if pw := service.Str(cfg, "password"); pw != "" {
secrets["password"] = pw
} else if service.Str(secrets, "password") == "" {
return fmt.Errorf("缺少拨号密码 password")
}
// 1) IPSec 层（transport 模式，L2TP over IPSec）
swanConf := fmt.Sprintf(`connections {
l2tp-%d {
type = transport
proposals = %s
local { auth = psk }
remote { auth = psk }
children {
l2tp-child-%d {
local_ts = dynamic[udp/l2tp]
remote_ts = dynamic[udp/l2tp]
esp_proposals = %s
start_action = trap
}
}
}
}
secrets {
ike-l2tp-%d {
secret = %s
}
}
`, t.ID, service.Str(cfg, "ike_proposal"), t.ID, service.Str(cfg, "esp_proposal"), t.ID, strconv.Quote(service.Str(secrets, "psk")))
// 2) L2TP 层
xl2tpdConf := fmt.Sprintf(`[global]
port = 1701
access control = yes
auth file = %s/chap-secrets
[lns default]
ip range = %s
local ip = %s
require chap = yes
refuse pap = yes
require authentication = yes
name = opsx-l2tp-%d
ppp debug = no
pppoptfile = %s/ppp-options
length bit = yes
`, service.InstanceDir(t), service.Str(cfg, "ip_range"), service.Str(cfg, "local_ip"), t.ID, service.InstanceDir(t))
pppOpts := fmt.Sprintf(`ms-dns %s
asyncmap 0
auth
ipcp-accept-local
ipcp-accept-remote
nodefaultroute
crtscts
lock
hide-password
modem
debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4
mtu 1400
mru 1400
require-mschap-v2
`, service.Str(cfg, "dns"))
chapSecrets := fmt.Sprintf(`# client server secret IP addresses
%s l2tpd %s *
`, username, strconv.Quote(service.Str(secrets, "password")))
for name, content := range map[string]string{
"swanctl-l2tp.conf": swanConf,
"xl2tpd.conf": xl2tpdConf,
"ppp-options": pppOpts,
"chap-secrets": chapSecrets,
} {
if _, err := service.WriteConfig(t, name, content); err != nil {
return err
}
}
public, sec := service.MergeSecrets(cfg, "psk", "password")
for k, v := range secrets {
sec[k] = v
}
return service.SaveTunnelConfig(t, public, sec)
}
// GenerateClientConfig 导出客户端接入说明（手机/Windows 手动配置）
func (s *Service) GenerateClientConfig(t *model.Tunnel) (string, error) {
cfg, err := store.TunnelConfig(t)
if err != nil {
return "", err
}
secrets, _ := store.TunnelSecrets(t)
return fmt.Sprintf(`======== L2TP/IPSec 客户端接入信息 ========
服务器地址 : %s
VPN 类型 : L2TP/IPSec PSK（预共享密钥）
IPSec PSK : %s
用户名 : %s
密码 : %s
客户端配置指引：
- iOS/macOS : 设置 → VPN → 添加 L2TP，填入服务器/账号/密码/密钥
- Windows : 设置 → VPN → L2TP/IPsec 预共享密钥，需注册表开启 NAT-T
- Android : 部分新机型已移除 L2TP，建议改用 WireGuard
- 路由器 : 选择 L2TP 拨号，填入上述参数
`,
service.StrOr(cfg, "public_endpoint", "<服务器公网 IP>"),
secrets["psk"],
service.StrOr(cfg, "username", "vpnuser"),
secrets["password"],
), nil
}
func (s *Service) Start(t *model.Tunnel) error {
dir := service.InstanceDir(t)
swanctl, hasSwan := service.LookBin("swanctl")
xl2tpd, hasL2tp := service.LookBin("xl2tpd")
if !hasSwan || !hasL2tp {
return fmt.Errorf("无法启动 L2TP/IPSec：需要 strongSwan（swanctl）和 xl2tpd")
}
if err := service.RequireRoot("L2TP/IPSec"); err != nil {
return err
}
if err := service.RequireIPv4Forwarding("L2TP/IPSec"); err != nil {
return err
}
if _, err := os.Stat(dir + "/swanctl-l2tp.conf"); err != nil {
return fmt.Errorf("无法启动 L2TP/IPSec：配置文件不存在，请先重新生成配置: %w", err)
}
if err := s.ensureExclusiveListener(t); err != nil {
return err
}
if err := service.RequireUDPPortAvailable(1701, "L2TP/IPSec"); err != nil {
return err
}
cfg, err := store.TunnelConfig(t)
if err != nil {
return err
}
if err := s.installFirewall(t, cfg); err != nil {
return err
}
_ = s.unload(swanctl, dir+"/swanctl-l2tp.conf")
if _, err := service.Run(swanctl, "--load-all", "--file", dir+"/swanctl-l2tp.conf"); err != nil {
_ = s.removeFirewall(t, cfg)
return err
}
if err := service.StartDaemon(t, xl2tpd, "-c", dir+"/xl2tpd.conf", "-p", dir+"/xl2tpd.pid", "-D"); err != nil {
_ = s.unload(swanctl, dir+"/swanctl-l2tp.conf")
_ = s.removeFirewall(t, cfg)
return err
}
return nil
}
func (s *Service) Stop(t *model.Tunnel) error {
var firstErr error
if bin, ok := service.LookBin("swanctl"); ok {
_, _ = service.Run(bin, "--terminate", "--ike", fmt.Sprintf("l2tp-%d", t.ID))
if err := s.unload(bin, service.InstanceDir(t)+"/swanctl-l2tp.conf"); err != nil {
firstErr = err
}
}
if err := service.KillPid(t); err != nil && firstErr == nil {
firstErr = err
}
if cfg, err := store.TunnelConfig(t); err == nil {
if err := s.removeFirewall(t, cfg); err != nil && firstErr == nil {
firstErr = err
}
}
return firstErr
}
func (s *Service) Status(t *model.Tunnel) (core.Status, error) {
if _, alive := service.ReadPid(t); alive {
detail := "L2TP 服务正在 UDP 1701 监听，等待客户端连接"
if _, ok := service.LookBin("xl2tpd"); !ok {
detail = "托管进程仍在运行，但 xl2tpd 当前不可用"
}
if swanctl, ok := service.LookBin("swanctl"); ok {
if out, err := service.Run(swanctl, "--list-sas"); err == nil && strings.Contains(out, fmt.Sprintf("l2tp-child-%d", t.ID)) {
detail = "L2TP/IPSec 服务运行中，已有已建立的 IPSec SA"
}
}
return service.NowStatus(true, "running", detail), nil
}
if ok, _ := s.Available(); !ok {
return service.NowStatus(false, "undeployed", "配置已生成，但缺少 strongSwan 或 xl2tpd，尚未部署"), nil
}
return service.NowStatus(false, "stopped", "未启动"), nil
}
func (s *Service) Delete(t *model.Tunnel) error { return s.Stop(t) }
// xl2tpd owns a host-wide UDP socket. Independent configs cannot safely share
// it; without this guard a later instance would look started but accept no VPN
// sessions. Network namespaces can deliberately lift this restriction later.
func (s *Service) ensureExclusiveListener(t *model.Tunnel) error {
var count int64
if err := store.DB.Model(&model.Tunnel{}).Where("protocol = ? AND state = ? AND id <> ?", "l2tp", "running", t.ID).Count(&count).Error; err != nil {
return fmt.Errorf("检查 L2TP 监听冲突失败: %w", err)
}
if count > 0 {
return fmt.Errorf("无法启动 L2TP/IPSec：本机已有 L2TP 实例运行；xl2tpd 共享 UDP 1701，每台主机仅支持一个实例")
}
return nil
}
func (s *Service) unload(bin, confPath string) error {
// swanctl reports an error when an object was never loaded. Treat that as
// success so Stop/Delete remain idempotent after a partial failed startup.
_, _ = service.Run(bin, "--unload-conns", "--file", confPath)
_, _ = service.Run(bin, "--unload-creds", "--file", confPath)
return nil
}
type firewallRule struct {
table, chain string
args []string
}
func (s *Service) firewallRules(t *model.Tunnel, cfg map[string]interface{}) ([]firewallRule, error) {
outbound := service.Str(cfg, "outbound_interface")
if outbound == "" {
var err error
outbound, err = service.DefaultRouteInterface()
if err != nil {
return nil, err
}
}
comment := fmt.Sprintf("opsx-vpn-l2tp-%d", t.ID)
return []firewallRule{
{"filter", "INPUT", []string{"-p", "udp", "--dport", "500", "-m", "comment", "--comment", comment, "-j", "ACCEPT"}},
{"filter", "INPUT", []string{"-p", "udp", "--dport", "4500", "-m", "comment", "--comment", comment, "-j", "ACCEPT"}},
{"filter", "INPUT", []string{"-p", "udp", "--dport", "1701", "-m", "comment", "--comment", comment, "-j", "ACCEPT"}},
{"filter", "INPUT", []string{"-p", "esp", "-m", "comment", "--comment", comment, "-j", "ACCEPT"}},
{"filter", "FORWARD", []string{"-i", "ppp+", "-m", "comment", "--comment", comment, "-j", "ACCEPT"}},
{"filter", "FORWARD", []string{"-o", "ppp+", "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-m", "comment", "--comment", comment, "-j", "ACCEPT"}},
{"nat", "POSTROUTING", []string{"-s", service.Str(cfg, "client_subnet"), "-o", outbound, "-m", "comment", "--comment", comment, "-j", "MASQUERADE"}},
}, nil
}
func (s *Service) installFirewall(t *model.Tunnel, cfg map[string]interface{}) error {
iptables, ok := service.LookBin("iptables")
if !ok {
return fmt.Errorf("无法启动 L2TP/IPSec：未检测到 iptables，无法配置防火墙和 NAT")
}
rules, err := s.firewallRules(t, cfg)
if err != nil {
return err
}
for _, rule := range rules {
prefix := []string{}
if rule.table != "filter" {
prefix = append(prefix, "-t", rule.table)
}
check := append(append([]string{}, prefix...), "-C", rule.chain)
check = append(check, rule.args...)
if _, err := service.Run(iptables, check...); err == nil {
continue
}
add := append(append([]string{}, prefix...), "-A", rule.chain)
add = append(add, rule.args...)
if _, err := service.Run(iptables, add...); err != nil {
_ = s.removeFirewall(t, cfg)
return fmt.Errorf("无法添加 L2TP/IPSec 防火墙规则: %w", err)
}
}
return nil
}
func (s *Service) removeFirewall(t *model.Tunnel, cfg map[string]interface{}) error {
iptables, ok := service.LookBin("iptables")
if !ok {
return nil
}
rules, err := s.firewallRules(t, cfg)
if err != nil {
return nil
}
for _, rule := range rules {
prefix := []string{}
if rule.table != "filter" {
prefix = append(prefix, "-t", rule.table)
}
for {
check := append(append([]string{}, prefix...), "-C", rule.chain)
check = append(check, rule.args...)
if _, err := service.Run(iptables, check...); err != nil {
break
}
remove := append(append([]string{}, prefix...), "-D", rule.chain)
remove = append(remove, rule.args...)
if _, err := service.Run(iptables, remove...); err != nil {
return fmt.Errorf("无法移除 L2TP/IPSec 防火墙规则: %w", err)
}
}
}
return nil
}
backend/internal/service/openvpn/openvpn.go
+514
View File
@@ -0,0 +1,514 @@
// Package openvpn manages a real OpenVPN server, its Easy-RSA PKI and dial-in
// identities. It never creates a placeholder process when host dependencies
// are missing.
package openvpn
import (
"encoding/json"
"errors"
"flag"
"fmt"
"net"
"os"
"os/exec"
"path/filepath"
"regexp"
"strconv"
"strings"
"time"
"github.com/go-ldap/ldap/v3"
"golang.org/x/crypto/bcrypt"
"gorm.io/gorm"
"vpn-platform/backend/internal/core"
"vpn-platform/backend/internal/model"
"vpn-platform/backend/internal/service"
"vpn-platform/backend/internal/store"
)
type Service struct{}
var certificateName = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$`)
func New() *Service { return &Service{} }
func (s *Service) Name() string { return "openvpn" }
func (s *Service) DisplayName() string { return "OpenVPN" }
func (s *Service) Available() (bool, string) {
if p, ok := service.LookBin("openvpn"); ok {
return true, p
}
return false, "未检测到 openvpn 二进制，可生成配置但无法启动"
}
func (s *Service) Validate(cfg map[string]interface{}) (map[string]interface{}, error) {
out := map[string]interface{}{}
for k, v := range cfg {
out[k] = v
}
if service.Num(out, "port", 0) == 0 {
out["port"] = 1194
}
if p := service.Num(out, "port", 0); p < 1 || p > 65535 || p != float64(int(p)) {
return nil, fmt.Errorf("port 必须是 1-65535 的整数")
}
if service.Str(out, "proto") == "" {
out["proto"] = "udp"
}
if p := service.Str(out, "proto"); p != "udp" && p != "tcp-server" {
return nil, fmt.Errorf("proto 必须为 udp 或 tcp-server")
}
if service.Str(out, "subnet") == "" {
out["subnet"] = "10.10.0.0 255.255.255.0"
}
if _, _, err := parseSubnet(service.Str(out, "subnet")); err != nil {
return nil, err
}
if service.Str(out, "cipher") == "" {
out["cipher"] = "AES-256-GCM"
}
if !regexp.MustCompile(`^[A-Za-z0-9-]+$`).MatchString(service.Str(out, "cipher")) {
return nil, fmt.Errorf("cipher 非法")
}
if service.Str(out, "dns") == "" {
out["dns"] = "223.5.5.5"
}
if net.ParseIP(service.Str(out, "dns")) == nil {
return nil, fmt.Errorf("dns 必须是 IP 地址")
}
if service.Str(out, "auth_mode") == "" {
out["auth_mode"] = "certificate"
}
switch service.Str(out, "auth_mode") {
case "certificate", "password", "certificate+password":
default:
return nil, fmt.Errorf("auth_mode 必须为 certificate、password 或 certificate+password")
}
if _, ok := out["pki_auto_init"]; !ok {
out["pki_auto_init"] = true
}
return out, nil
}
func parseSubnet(v string) (net.IP, net.IPMask, error) {
f := strings.Fields(v)
if len(f) != 2 {
return nil, nil, fmt.Errorf("subnet 必须为“网络地址 掩码”，例如 10.10.0.0 255.255.255.0")
}
ip := net.ParseIP(f[0]).To4()
mask := net.ParseIP(f[1]).To4()
if ip == nil || mask == nil {
return nil, nil, fmt.Errorf("subnet 必须是 IPv4 网络")
}
return ip, net.IPMask(mask), nil
}
func (s *Service) Create(t *model.Tunnel) error {
cfg, err := store.TunnelConfig(t)
if err != nil {
return err
}
if _, err := service.WriteConfig(t, "server.conf", s.serverConfig(t, cfg)); err != nil {
return err
}
if _, err := service.WriteConfig(t, "auth-user-pass.sh", authScript(t)); err != nil {
return err
}
_ = os.Chmod(filepath.Join(service.InstanceDir(t), "auth-user-pass.sh"), 0o700)
if _, err := service.WriteConfig(t, "init-pki.sh", pkiScript(t)); err != nil {
return err
}
_ = os.Chmod(filepath.Join(service.InstanceDir(t), "init-pki.sh"), 0o700)
public, secrets := service.MergeSecrets(cfg)
if err := service.SaveTunnelConfig(t, public, secrets); err != nil {
return err
}
// PKI creation is intentionally best-effort: a missing easy-rsa must not be
// reported as a running server. Start() verifies every required artifact.
_, openvpnInstalled := service.LookBin("openvpn")
if service.Bool(cfg, "pki_auto_init", true) && easyRSAPath() != "" && openvpnInstalled && pkiReady(t) != nil {
return s.InitializePKI(t)
}
return nil
}
func (s *Service) serverConfig(t *model.Tunnel, cfg map[string]interface{}) string {
dir := service.InstanceDir(t)
ca, cert, key, dh, ta := filepath.Join(dir, "pki", "ca.crt"), filepath.Join(dir, "pki", "issued", "server.crt"), filepath.Join(dir, "pki", "private", "server.key"), filepath.Join(dir, "pki", "dh.pem"), filepath.Join(dir, "ta.key")
var b strings.Builder
fmt.Fprintf(&b, "port %d\nproto %s\ndev tun\nca %q\ncert %q\nkey %q\ndh %q\ntls-crypt %q\n", int(service.Num(cfg, "port", 1194)), service.StrOr(cfg, "proto", "udp"), ca, cert, key, dh, ta)
fmt.Fprintf(&b, "topology subnet\nserver %s\nifconfig-pool-persist %q\npush \"dhcp-option DNS %s\"\npush \"redirect-gateway def1 bypass-dhcp\"\n", service.StrOr(cfg, "subnet", "10.10.0.0 255.255.255.0"), filepath.Join(dir, "ipp.txt"), service.StrOr(cfg, "dns", "223.5.5.5"))
fmt.Fprintf(&b, "keepalive 10 120\ndata-ciphers %s:AES-128-GCM\npersist-key\npersist-tun\nstatus %q 10\nstatus-version 3\nverb 3\n", service.StrOr(cfg, "cipher", "AES-256-GCM"), filepath.Join(dir, "openvpn-status.log"))
if service.StrOr(cfg, "proto", "udp") == "udp" {
b.WriteString("explicit-exit-notify 1\n")
}
switch service.StrOr(cfg, "auth_mode", "certificate") {
case "password":
b.WriteString("verify-client-cert none\nusername-as-common-name\n")
case "certificate+password":
b.WriteString("verify-client-cert require\n")
default:
b.WriteString("verify-client-cert require\n")
}
if mode := service.StrOr(cfg, "auth_mode", "certificate"); mode == "password" || mode == "certificate+password" {
fmt.Fprintf(&b, "script-security 2\nauth-user-pass-verify %q via-file\n", filepath.Join(dir, "auth-user-pass.sh"))
}
return b.String()
}
// InitializePKI creates the CA and server key material in the instance's
// private directory. It is safe to call repeatedly after a successful setup.
func (s *Service) InitializePKI(t *model.Tunnel) error {
if pkiReady(t) == nil {
return nil
}
easy := easyRSAPath()
if easy == "" {
return fmt.Errorf("无法初始化 OpenVPN PKI：未检测到 easy-rsa/easyrsa")
}
dir := service.InstanceDir(t)
if err := os.MkdirAll(dir, 0o700); err != nil {
return err
}
if err := runEasyRSA(dir, easy, "init-pki"); err != nil {
return err
}
if err := runEasyRSA(dir, easy, "--batch", "build-ca", "nopass"); err != nil {
return err
}
if err := runEasyRSA(dir, easy, "--batch", "build-server-full", "server", "nopass"); err != nil {
return err
}
if err := runEasyRSA(dir, easy, "gen-dh"); err != nil {
return err
}
if err := runEasyRSA(dir, easy, "gen-crl"); err != nil {
return err
}
openvpn, ok := service.LookBin("openvpn")
if !ok {
return fmt.Errorf("PKI 证书已生成，但未检测到 openvpn，无法生成 tls-crypt 密钥")
}
cmd := exec.Command(openvpn, "--genkey", "secret", filepath.Join(dir, "ta.key"))
cmd.Dir = dir
if out, err := cmd.CombinedOutput(); err != nil {
return fmt.Errorf("生成 tls-crypt 密钥失败: %v: %s", err, out)
}
return pkiReady(t)
}
func easyRSAPath() string {
if p, ok := service.LookBin("easyrsa"); ok {
return p
}
for _, p := range []string{"/usr/share/easy-rsa/easyrsa", "/usr/local/share/easy-rsa/easyrsa"} {
if st, err := os.Stat(p); err == nil && st.Mode().IsRegular() {
return p
}
}
return ""
}
func runEasyRSA(dir, binary string, args ...string) error {
cmd := exec.Command(binary, args...)
cmd.Dir = dir
cmd.Env = append(os.Environ(), "EASYRSA_BATCH=1", "EASYRSA_REQ_CN=OPSX-VPN-CA")
out, err := cmd.CombinedOutput()
if err != nil {
return fmt.Errorf("easy-rsa %s 失败: %v: %s", strings.Join(args, " "), err, out)
}
return nil
}
func pkiReady(t *model.Tunnel) error {
for _, p := range []string{"pki/ca.crt", "pki/issued/server.crt", "pki/private/server.key", "pki/dh.pem", "ta.key"} {
if _, err := os.Stat(filepath.Join(service.InstanceDir(t), p)); err != nil {
return fmt.Errorf("缺少 %s", p)
}
}
return nil
}
func pkiScript(t *model.Tunnel) string {
easy := shellQuote(easyRSAPathOrDefault())
return "#!/bin/sh\nset -eu\ncd " + shellQuote(service.InstanceDir(t)) + "\nexport EASYRSA_BATCH=1 EASYRSA_REQ_CN=OPSX-VPN-CA\n" + easy + " init-pki\n" + easy + " --batch build-ca nopass\n" + easy + " --batch build-server-full server nopass\n" + easy + " gen-dh\n" + easy + " gen-crl\nopenvpn --genkey secret ta.key\necho 'OpenVPN PKI initialized'\n"
}
func easyRSAPathOrDefault() string {
if p := easyRSAPath(); p != "" {
return p
}
return "easyrsa"
}
func authScript(t *model.Tunnel) string {
exe, _ := os.Executable()
if exe == "" {
exe = "opsx-vpn"
}
return "#!/bin/sh\nset -eu\nexec " + shellQuote(exe) + " openvpn-auth --tunnel " + strconv.FormatUint(uint64(t.ID), 10) + " --credentials \"$1\"\n"
}
func shellQuote(v string) string { return "'" + strings.ReplaceAll(v, "'", "'\\''") + "'" }
// IssueClientCertificate signs a per-VPNUser certificate and records the exact
// certificate CN. LDAP users can use certificates as a second factor too.
func (s *Service) IssueClientCertificate(t *model.Tunnel, user *model.VPNUser) error {
if user.TunnelID != t.ID {
return errors.New("拨号用户不属于该 OpenVPN 隧道")
}
if !user.Enabled {
return errors.New("拨号用户已禁用")
}
if err := pkiReady(t); err != nil {
return fmt.Errorf("无法签发客户端证书：%w", err)
}
name := user.Certificate
if name == "" {
name = certificateCN(user.Username)
}
if !certificateName.MatchString(name) {
return fmt.Errorf("客户端证书名称无效")
}
cert := filepath.Join(service.InstanceDir(t), "pki", "issued", name+".crt")
if _, err := os.Stat(cert); err != nil {
easy := easyRSAPath()
if easy == "" {
return fmt.Errorf("未检测到 easy-rsa，无法签发客户端证书")
}
if err := runEasyRSA(service.InstanceDir(t), easy, "--batch", "build-client-full", name, "nopass"); err != nil {
return err
}
}
user.Certificate = name
return store.DB.Save(user).Error
}
func certificateCN(username string) string {
v := strings.Map(func(r rune) rune {
if (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') || r == '-' || r == '_' {
return r
}
return '-'
}, username)
v = strings.Trim(v, "-_")
if v == "" {
v = "vpn-user"
}
if len(v) > 48 {
v = v[:48]
}
return "u-" + v
}
// GenerateUserConfig returns an immediately importable profile after signing
// the user certificate. It replaces the former instructional, non-functional
// profile generation.
func (s *Service) GenerateUserConfig(t *model.Tunnel, user *model.VPNUser) (string, error) {
cfg, err := store.TunnelConfig(t)
if err != nil {
return "", err
}
mode := service.StrOr(cfg, "auth_mode", "certificate")
if mode != "password" {
if err := s.IssueClientCertificate(t, user); err != nil {
return "", err
}
}
dir := service.InstanceDir(t)
read := func(p string) (string, error) { b, e := os.ReadFile(p); return string(b), e }
ca, e := read(filepath.Join(dir, "pki", "ca.crt"))
if e != nil {
return "", e
}
ta, e := read(filepath.Join(dir, "ta.key"))
if e != nil {
return "", e
}
var cert, key string
if mode != "password" {
cert, e = read(filepath.Join(dir, "pki", "issued", user.Certificate+".crt"))
if e != nil {
return "", e
}
key, e = read(filepath.Join(dir, "pki", "private", user.Certificate+".key"))
if e != nil {
return "", e
}
}
var b strings.Builder
fmt.Fprintf(&b, "client\ndev tun\nproto %s\nremote %s %d\nresolv-retry infinite\nnobind\npersist-key\npersist-tun\nremote-cert-tls server\ndata-ciphers %s:AES-128-GCM\nverb 3\n", clientProto(service.StrOr(cfg, "proto", "udp")), service.StrOr(cfg, "public_endpoint", "your-server-ip"), int(service.Num(cfg, "port", 1194)), service.StrOr(cfg, "cipher", "AES-256-GCM"))
if mode == "password" || mode == "certificate+password" {
b.WriteString("auth-user-pass\n")
}
b.WriteString("<ca>\n" + ca + "</ca>\n")
if cert != "" {
b.WriteString("<cert>\n" + cert + "</cert>\n<key>\n" + key + "</key>\n")
}
b.WriteString("<tls-crypt>\n" + ta + "</tls-crypt>\n")
return b.String(), nil
}
func clientProto(proto string) string {
if proto == "tcp-server" {
return "tcp-client"
}
return proto
}
func (s *Service) GenerateClientConfig(t *model.Tunnel) (string, error) {
cfg, err := store.TunnelConfig(t)
if err != nil {
return "", err
}
username := service.Str(cfg, "client_username")
if username == "" {
return "", fmt.Errorf("请指定 client_username 或通过拨号用户下载其专属 .ovpn 配置")
}
var user model.VPNUser
if err := store.DB.Where("tunnel_id = ? AND username = ?", t.ID, username).First(&user).Error; err != nil {
return "", fmt.Errorf("拨号用户 %q 不存在: %w", username, err)
}
return s.GenerateUserConfig(t, &user)
}
func (s *Service) Start(t *model.Tunnel) error {
if _, ok := service.LookBin("openvpn"); !ok {
return fmt.Errorf("无法启动 OpenVPN：未检测到 openvpn")
}
if err := pkiReady(t); err != nil {
return fmt.Errorf("无法启动 OpenVPN：PKI 尚未就绪：%w", err)
}
return service.StartDaemon(t, serviceMustBin("openvpn"), "--config", filepath.Join(service.InstanceDir(t), "server.conf"))
}
func serviceMustBin(name string) string { p, _ := service.LookBin(name); return p }
func (s *Service) Stop(t *model.Tunnel) error { return service.KillPid(t) }
func (s *Service) Status(t *model.Tunnel) (core.Status, error) {
if _, alive := service.ReadPid(t); alive {
st := service.NowStatus(true, "running", "OpenVPN 进程运行中")
rx, tx := s.collectTraffic(t)
st.RxBytes = t.RxBytes + rx
st.TxBytes = t.TxBytes + tx
return st, nil
}
if _, ok := service.LookBin("openvpn"); !ok {
return service.NowStatus(false, "undeployed", "配置已生成，但未检测到 openvpn，尚未部署"), nil
}
return service.NowStatus(false, "stopped", "未启动"), nil
}
type trafficSnapshot map[string]trafficCounter
type trafficCounter struct {
Rx int64 `json:"rx"`
Tx int64 `json:"tx"`
}
func (s *Service) collectTraffic(t *model.Tunnel) (int64, int64) {
raw, err := os.ReadFile(filepath.Join(service.InstanceDir(t), "openvpn-status.log"))
if err != nil {
return 0, 0
}
snap := trafficSnapshot{}
if b, e := os.ReadFile(filepath.Join(service.InstanceDir(t), "traffic-state.json")); e == nil {
_ = json.Unmarshal(b, &snap)
}
next := trafficSnapshot{}
var totalRx, totalTx int64
now := time.Now()
for _, line := range strings.Split(string(raw), "\n") {
f := strings.Split(line, ",")
if len(f) < 7 || f[0] != "CLIENT_LIST" {
continue
}
rx, e1 := strconv.ParseInt(f[5], 10, 64)
tx, e2 := strconv.ParseInt(f[6], 10, 64)
if e1 != nil || e2 != nil {
continue
}
cn := f[1]
username := cn
if len(f) > 9 && f[9] != "" && f[9] != "UNDEF" {
username = f[9]
}
key := username + "|" + f[2]
old := snap[key]
deltaRx, deltaTx := rx-old.Rx, tx-old.Tx
if deltaRx < 0 {
deltaRx = rx
}
if deltaTx < 0 {
deltaTx = tx
}
totalRx += deltaRx
totalTx += deltaTx
next[key] = trafficCounter{rx, tx}
if store.DB != nil && username != "" {
store.DB.Model(&model.VPNUser{}).Where("tunnel_id = ? AND (username = ? OR certificate = ?)", t.ID, username, cn).Updates(map[string]interface{}{"rx_bytes": gorm.Expr("rx_bytes + ?", deltaRx), "tx_bytes": gorm.Expr("tx_bytes + ?", deltaTx), "last_seen_at": now})
}
}
b, _ := json.Marshal(next)
_ = os.WriteFile(filepath.Join(service.InstanceDir(t), "traffic-state.json"), b, 0o600)
return totalRx, totalTx
}
func (s *Service) Delete(t *model.Tunnel) error { return s.Stop(t) }
// RunAuthHelper is called by the same opsx-vpn binary from OpenVPN's
// auth-user-pass-verify hook. It returns 0 only for enabled, tunnel-scoped
// local users or LDAP users whose recorded LDAP DN accepts the password.
func RunAuthHelper(args []string) error {
fs := flag.NewFlagSet("openvpn-auth", flag.ContinueOnError)
fs.SetOutput(os.Stderr)
tunnel := fs.Uint("tunnel", 0, "tunnel id")
credentials := fs.String("credentials", "", "credentials file")
if err := fs.Parse(args); err != nil {
return err
}
if *tunnel == 0 || *credentials == "" {
return errors.New("--tunnel 和 --credentials 必填")
}
raw, err := os.ReadFile(*credentials)
if err != nil {
return err
}
lines := strings.Split(strings.ReplaceAll(string(raw), "\r\n", "\n"), "\n")
if len(lines) < 2 || strings.TrimSpace(lines[0]) == "" {
return errors.New("认证凭据格式无效")
}
return Authenticate(uint(*tunnel), strings.TrimSpace(lines[0]), strings.TrimSpace(lines[1]))
}
func Authenticate(tunnelID uint, username, password string) error {
if password == "" {
return errors.New("密码为空")
}
var user model.VPNUser
if err := store.DB.Where("tunnel_id = ? AND username = ? AND enabled = ?", tunnelID, username, true).First(&user).Error; err != nil {
return errors.New("拨号用户不存在或已禁用")
}
if user.Source == "local" {
if bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)) != nil {
return errors.New("密码错误")
}
return nil
}
if user.Source != "ldap" || user.LDAPDN == "" {
return errors.New("拨号用户认证来源无效")
}
var cfg model.LDAPConfig
if err := store.DB.Where("enabled = ?", true).First(&cfg).Error; err != nil {
return errors.New("LDAP 未启用")
}
url := cfg.URL
if !strings.HasPrefix(url, "ldap://") && !strings.HasPrefix(url, "ldaps://") {
url = "ldap://" + url
}
conn, err := ldap.DialURL(url)
if err != nil {
return err
}
defer conn.Close()
if cfg.BindDN != "" {
bind, err := store.DecryptSecret(cfg.BindPassword)
if err != nil {
return errors.New("LDAP 绑定密钥无效")
}
if err := conn.Bind(cfg.BindDN, bind); err != nil {
return err
}
}
if err := conn.Bind(user.LDAPDN, password); err != nil {
return errors.New("LDAP 密码错误")
}
return nil
}
backend/internal/service/openvpn/openvpn_test.go
+26
View File
@@ -0,0 +1,26 @@
package openvpn
import (
"strings"
"testing"
)
func TestValidateOpenVPNModes(t *testing.T) {
cfg, err := New().Validate(map[string]interface{}{"auth_mode": "password", "subnet": "10.8.0.0 255.255.255.0"})
if err != nil {
t.Fatal(err)
}
if cfg["proto"] != "udp" || cfg["port"] != 1194 {
t.Fatalf("defaults not applied: %#v", cfg)
}
if _, err := New().Validate(map[string]interface{}{"auth_mode": "unknown"}); err == nil {
t.Fatal("expected invalid auth mode error")
}
}
func TestCertificateCNIsSafeAndStable(t *testing.T) {
cn := certificateCN("张三 / alice@example.com")
if !certificateName.MatchString(cn) || !strings.HasPrefix(cn, "u-") {
t.Fatalf("unsafe CN: %q", cn)
}
}
backend/internal/service/wireguard/wireguard.go
+676
View File
@@ -0,0 +1,676 @@
// Package wireguard manages real WireGuard interfaces through wg-quick and wg.
// Every tunnel owns one interface and any number of peers. Private material is
// retained in Tunnel.Secrets; the JSON configuration only contains public keys.
package wireguard
import (
"crypto/rand"
"encoding/base64"
"fmt"
"net"
"regexp"
"sort"
"strconv"
"strings"
"sync"
"time"
"golang.org/x/crypto/curve25519"
"vpn-platform/backend/internal/core"
"vpn-platform/backend/internal/model"
"vpn-platform/backend/internal/service"
"vpn-platform/backend/internal/store"
)
const (
defaultPort = 51820
maxListenPort = 60999
handshakeAlive = 3 * time.Minute
)
var (
peerIDPattern = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$`)
ifacePattern = regexp.MustCompile(`^[a-zA-Z0-9_.-]{1,15}$`)
portMu sync.Mutex
)
type Service struct{}
// peer is the public, persisted description of a WireGuard peer. private_key
// and preshared_key deliberately never appear here.
type peer struct {
ID string `json:"id"`
Name string `json:"name,omitempty"`
PublicKey string `json:"public_key"`
ClientAddress string `json:"client_address"`
AllowedIPs string `json:"allowed_ips,omitempty"`
Enabled bool `json:"enabled"`
Managed bool `json:"managed"`
}
type peerSecret struct {
PrivateKey string `json:"private_key,omitempty"`
PresharedKey string `json:"preshared_key,omitempty"`
}
func New() *Service { return &Service{} }
func (s *Service) Name() string { return "wireguard" }
func (s *Service) DisplayName() string { return "WireGuard" }
func (s *Service) Available() (bool, string) {
if p, ok := service.LookBin("wg-quick"); ok {
if _, wgOK := service.LookBin("wg"); wgOK {
return true, p
}
}
return false, "未检测到 wireguard-tools（需要 wg 与 wg-quick）"
}
// genKey generates a WireGuard-compatible Curve25519 private/public key pair.
func genKey() (priv, pub string, err error) {
var sk [32]byte
if _, err = rand.Read(sk[:]); err != nil {
return
}
sk[0] &= 248
sk[31] = (sk[31] & 127) | 64
pk, err := curve25519.X25519(sk[:], curve25519.Basepoint)
if err != nil {
return
}
priv = base64.StdEncoding.EncodeToString(sk[:])
pub = base64.StdEncoding.EncodeToString(pk)
return
}
func publicKey(privateKey string) (string, error) {
raw, err := base64.StdEncoding.DecodeString(privateKey)
if err != nil || len(raw) != curve25519.ScalarSize {
return "", fmt.Errorf("WireGuard 私钥格式非法")
}
pub, err := curve25519.X25519(raw, curve25519.Basepoint)
if err != nil {
return "", err
}
return base64.StdEncoding.EncodeToString(pub), nil
}
func isWireGuardKey(key string) bool {
raw, err := base64.StdEncoding.DecodeString(key)
return err == nil && len(raw) == curve25519.PointSize
}
func (s *Service) Validate(cfg map[string]interface{}) (map[string]interface{}, error) {
if err := service.MustValidate(cfg, "address"); err != nil {
return nil, err
}
out := map[string]interface{}{}
for k, v := range cfg {
out[k] = v
}
if !validCIDR(service.Str(out, "address")) {
return nil, fmt.Errorf("address 必须是合法 CIDR")
}
port := int(service.Num(out, "listen_port", 0))
if port < 0 || port > 65535 || (port > 0 && port < 1024) {
return nil, fmt.Errorf("listen_port 必须是 1024-65535 之间的 UDP 端口")
}
// Port zero means "allocate a free WireGuard port when this tunnel is created".
if port > 0 {
out["listen_port"] = port
}
if service.Str(out, "allowed_ips") == "" {
out["allowed_ips"] = "0.0.0.0/0, ::/0"
}
if err := validateCIDRList(service.Str(out, "allowed_ips")); err != nil {
return nil, fmt.Errorf("allowed_ips: %w", err)
}
if service.Str(out, "dns") == "" {
out["dns"] = "223.5.5.5"
}
if service.Num(out, "keepalive", 0) == 0 {
out["keepalive"] = 25
}
keepalive := int(service.Num(out, "keepalive", 25))
if keepalive < 0 || keepalive > 65535 {
return nil, fmt.Errorf("keepalive 必须是 0-65535")
}
if egress := service.Str(out, "egress_interface"); egress != "" && !ifacePattern.MatchString(egress) {
return nil, fmt.Errorf("egress_interface 包含非法字符")
}
if service.Bool(out, "enable_nat", false) && service.Str(out, "egress_interface") == "" {
return nil, fmt.Errorf("启用 NAT 时必须填写 egress_interface")
}
if _, supplied := out["peers"]; supplied {
peers, err := parsePeers(out)
if err != nil {
return nil, err
}
if err := validatePeerInput(peers); err != nil {
return nil, err
}
} else if addr := service.Str(out, "client_address"); addr != "" && !validCIDR(addr) {
return nil, fmt.Errorf("client_address 必须是合法 CIDR")
}
return out, nil
}
func (s *Service) Create(t *model.Tunnel) error {
// Config allocation and persistence need to be serialised: otherwise two
// concurrent create requests can both observe the same currently-free port.
portMu.Lock()
defer portMu.Unlock()
cfg, err := store.TunnelConfig(t)
if err != nil {
return err
}
secrets, err := store.TunnelSecrets(t)
if err != nil {
return err
}
if int(service.Num(cfg, "listen_port", 0)) == 0 {
port, err := allocatePort(t.ID)
if err != nil {
return err
}
cfg["listen_port"] = port
} else if err := ensurePortAvailable(t.ID, int(service.Num(cfg, "listen_port", 0))); err != nil {
return err
}
cfg["interface_name"] = interfaceName(t)
serverPrivate, _ := secrets["server_private_key"].(string)
if serverPrivate == "" {
var serverPublic string
serverPrivate, serverPublic, err = genKey()
if err != nil {
return err
}
secrets["server_private_key"] = serverPrivate
cfg["server_public_key"] = serverPublic
} else {
serverPublic, err := publicKey(serverPrivate)
if err != nil {
return err
}
cfg["server_public_key"] = serverPublic
}
peers, peerSecrets, err := buildPeers(cfg, secrets)
if err != nil {
return err
}
if len(peers) == 0 {
return fmt.Errorf("至少需要一个 WireGuard Peer")
}
cfg["peers"] = peersToConfig(peers)
// Legacy single-client fields must not leak into Config or conflict with peers.
delete(cfg, "client_address")
delete(cfg, "client_public_key")
delete(secrets, "client_private_key")
delete(secrets, "preshared_key")
secrets["peer_secrets"] = peerSecretsToConfig(peerSecrets)
serverConf := renderServerConfig(cfg, serverPrivate, peers, peerSecrets)
if _, err := service.WriteConfig(t, interfaceName(t)+".conf", serverConf); err != nil {
return err
}
// client.conf remains a convenience export for the first platform-managed peer.
if clientConf, err := generateClientConfig(cfg, peers, peerSecrets, ""); err == nil {
if _, err := service.WriteConfig(t, "client.conf", clientConf); err != nil {
return err
}
}
public, sec := service.MergeSecrets(cfg, "server_private_key")
for k, v := range secrets {
sec[k] = v
}
return service.SaveTunnelConfig(t, public, sec)
}
// GenerateClientConfig exports the first managed peer for backward compatible
// downloads. Use GeneratePeerClientConfig when the caller has selected a peer.
func (s *Service) GenerateClientConfig(t *model.Tunnel) (string, error) {
cfg, err := store.TunnelConfig(t)
if err != nil {
return "", err
}
peers, err := parsePeers(cfg)
if err != nil {
return "", err
}
secrets, err := store.TunnelSecrets(t)
if err != nil {
return "", err
}
return generateClientConfig(cfg, peers, parsePeerSecrets(secrets), "")
}
// GeneratePeerClientConfig generates one device's configuration without exposing
// any other peer's key material.
func (s *Service) GeneratePeerClientConfig(t *model.Tunnel, peerID string) (string, error) {
cfg, err := store.TunnelConfig(t)
if err != nil {
return "", err
}
secrets, err := store.TunnelSecrets(t)
if err != nil {
return "", err
}
peers, err := parsePeers(cfg)
if err != nil {
return "", err
}
peerSecrets := parsePeerSecrets(secrets)
return generateClientConfig(cfg, peers, peerSecrets, peerID)
}
func generateClientConfig(cfg map[string]interface{}, peers []peer, peerSecrets map[string]peerSecret, requestedID string) (string, error) {
for _, p := range peers {
if requestedID != "" && p.ID != requestedID {
continue
}
if requestedID == "" && (!p.Managed || !p.Enabled) {
continue
}
sec := peerSecrets[p.ID]
if !p.Managed || sec.PrivateKey == "" {
return "", fmt.Errorf("Peer %s 为外部设备，平台未保存其私钥", p.ID)
}
endpoint := service.StrOr(cfg, "public_endpoint", fmt.Sprintf("your-server-ip:%d", int(service.Num(cfg, "listen_port", defaultPort))))
allowed := p.AllowedIPs
if allowed == "" {
allowed = service.StrOr(cfg, "allowed_ips", "0.0.0.0/0, ::/0")
}
return fmt.Sprintf(`[Interface]
PrivateKey = %s
Address = %s
DNS = %s
[Peer]
PublicKey = %s
PresharedKey = %s
Endpoint = %s
AllowedIPs = %s
PersistentKeepalive = %d
`, sec.PrivateKey, p.ClientAddress, service.StrOr(cfg, "dns", "223.5.5.5"), service.Str(cfg, "server_public_key"), sec.PresharedKey, endpoint, allowed, int(service.Num(cfg, "keepalive", 25))), nil
}
if requestedID != "" {
return "", fmt.Errorf("WireGuard Peer 不存在: %s", requestedID)
}
return "", fmt.Errorf("没有可下载配置的托管 Peer；外部 Peer 请在其设备上配置")
}
func (s *Service) Start(t *model.Tunnel) error {
if available, _ := s.Available(); !available {
return fmt.Errorf("无法启动 WireGuard：未检测到 wg 和 wg-quick，请先安装 wireguard-tools")
}
if _, err := service.Run("wg", "show", interfaceName(t)); err == nil {
return nil
}
conf := fmt.Sprintf("%s/%s.conf", service.InstanceDir(t), interfaceName(t))
if _, err := service.Run("wg-quick", "up", conf); err != nil {
return err
}
return nil
}
func (s *Service) Stop(t *model.Tunnel) error {
if _, ok := service.LookBin("wg-quick"); !ok {
return fmt.Errorf("无法停止 WireGuard：未检测到 wg-quick")
}
if _, ok := service.LookBin("wg"); ok {
if _, err := service.Run("wg", "show", interfaceName(t)); err != nil {
return nil // already stopped; do not claim a fake process was stopped
}
}
conf := fmt.Sprintf("%s/%s.conf", service.InstanceDir(t), interfaceName(t))
_, err := service.Run("wg-quick", "down", conf)
return err
}
func (s *Service) Status(t *model.Tunnel) (core.Status, error) {
bin, ok := service.LookBin("wg")
if !ok {
return service.NowStatus(false, "undeployed", "配置已生成，但未检测到 wireguard-tools（wg），尚未部署"), nil
}
dump, err := service.Run(bin, "show", interfaceName(t), "dump")
if err != nil {
return service.NowStatus(false, "stopped", "WireGuard 接口未启动"), nil
}
cfg, err := store.TunnelConfig(t)
if err != nil {
return core.Status{}, err
}
peers, err := parsePeers(cfg)
if err != nil {
return core.Status{}, err
}
byKey := make(map[string]peer, len(peers))
for _, p := range peers {
byKey[p.PublicKey] = p
}
st := service.NowStatus(true, "running", "WireGuard 接口运行中")
connected := 0
for _, line := range strings.Split(strings.TrimSpace(dump), "\n") {
fields := strings.Split(line, "\t")
if len(fields) < 8 { // the first interface row has five columns
continue
}
p, known := byKey[fields[0]]
if !known {
// Preserve visibility for a manually added peer instead of silently
// attributing it to a configured client.
p = peer{ID: "unknown-" + fields[0][:min(8, len(fields[0]))], PublicKey: fields[0], Enabled: true}
}
handshake, _ := strconv.ParseInt(fields[4], 10, 64)
rx, _ := strconv.ParseInt(fields[5], 10, 64)
tx, _ := strconv.ParseInt(fields[6], 10, 64)
alive := handshake > 0 && time.Since(time.Unix(handshake, 0)) <= handshakeAlive
if alive {
connected++
}
st.RxBytes += rx
st.TxBytes += tx
st.Peers = append(st.Peers, core.PeerStatus{
ID: p.ID, Name: p.Name, PublicKey: fields[0], Endpoint: fields[2], AllowedIPs: fields[3],
LatestHandshakeAt: handshake, Connected: alive, RxBytes: rx, TxBytes: tx,
})
}
sort.Slice(st.Peers, func(i, j int) bool { return st.Peers[i].ID < st.Peers[j].ID })
st.Detail = fmt.Sprintf("WireGuard 接口 %s 运行中，%d/%d 个 Peer 最近已握手", interfaceName(t), connected, len(st.Peers))
return st, nil
}
func (s *Service) Delete(t *model.Tunnel) error { return s.Stop(t) }
// interfaceName is deterministic, <= IFNAMSIZ-1 (15) and does not depend on
// the user supplied tunnel name. This prevents cross-tunnel interface clashes.
func interfaceName(t *model.Tunnel) string { return "wg" + strconv.FormatUint(uint64(t.ID), 36) }
func allocatePort(tunnelID uint) (int, error) {
for port := defaultPort; port <= maxListenPort; port++ {
if ensurePortAvailable(tunnelID, port) == nil {
return port, nil
}
}
return 0, fmt.Errorf("没有可用的 WireGuard UDP 端口（%d-%d）", defaultPort, maxListenPort)
}
func ensurePortAvailable(tunnelID uint, port int) error {
var tunnels []model.Tunnel
if store.DB == nil {
return nil
}
if err := store.DB.Where("protocol = ? AND id <> ?", "wireguard", tunnelID).Find(&tunnels).Error; err != nil {
return err
}
for _, other := range tunnels {
cfg, err := store.TunnelConfig(&other)
if err == nil && int(service.Num(cfg, "listen_port", defaultPort)) == port {
return fmt.Errorf("WireGuard UDP 端口 %d 已被专线 %q 占用", port, other.Name)
}
}
if !hostUDPPortAvailable(port) {
return fmt.Errorf("WireGuard UDP 端口 %d 已被本机其他服务占用", port)
}
return nil
}
func hostUDPPortAvailable(port int) bool {
listener, err := net.ListenUDP("udp4", &net.UDPAddr{Port: port})
if err != nil {
return false
}
return listener.Close() == nil
}
func buildPeers(cfg, secrets map[string]interface{}) ([]peer, map[string]peerSecret, error) {
peers, err := parsePeers(cfg)
if err != nil {
return nil, nil, err
}
// Compatibility migration: old one-client configs become client-1.
if len(peers) == 0 {
address := service.StrOr(cfg, "client_address", "10.8.0.2/32")
if !validCIDR(address) {
return nil, nil, fmt.Errorf("client_address 必须是合法 CIDR")
}
peers = []peer{{ID: "client-1", Name: "客户端 1", PublicKey: service.Str(cfg, "client_public_key"), ClientAddress: address, AllowedIPs: service.Str(cfg, "allowed_ips"), Enabled: true, Managed: true}}
}
oldSecrets := parsePeerSecrets(secrets)
if legacyPrivate := service.Str(secrets, "client_private_key"); legacyPrivate != "" {
oldSecrets["client-1"] = peerSecret{PrivateKey: legacyPrivate, PresharedKey: service.Str(secrets, "preshared_key")}
}
seenIDs, seenKeys, seenAddresses := map[string]bool{}, map[string]bool{}, map[string]bool{}
for i := range peers {
p := &peers[i]
if p.ID == "" {
p.ID = fmt.Sprintf("client-%d", i+1)
}
if !peerIDPattern.MatchString(p.ID) {
return nil, nil, fmt.Errorf("Peer ID %q 包含非法字符", p.ID)
}
if seenIDs[p.ID] {
return nil, nil, fmt.Errorf("Peer ID 重复: %s", p.ID)
}
seenIDs[p.ID] = true
if p.ClientAddress == "" || !validCIDR(p.ClientAddress) {
return nil, nil, fmt.Errorf("Peer %s 的 client_address 必须是合法 CIDR", p.ID)
}
if seenAddresses[p.ClientAddress] {
return nil, nil, fmt.Errorf("Peer client_address 重复: %s", p.ClientAddress)
}
seenAddresses[p.ClientAddress] = true
if p.AllowedIPs == "" {
p.AllowedIPs = service.StrOr(cfg, "allowed_ips", "0.0.0.0/0, ::/0")
}
if err := validateCIDRList(p.AllowedIPs); err != nil {
return nil, nil, fmt.Errorf("Peer %s allowed_ips: %w", p.ID, err)
}
if strings.ContainsAny(p.Name, "\r\n") {
return nil, nil, fmt.Errorf("Peer %s 的 name 不能包含换行符", p.ID)
}
sec := oldSecrets[p.ID]
// An unchanged public key with a stored private key is still a platform
// managed peer even if a client omitted the derived `managed` flag when
// submitting an update. A changed public key deliberately becomes an
// external peer and must not retain the old device private key/PSK.
if p.PublicKey != "" && sec.PrivateKey != "" {
existingPublic, err := publicKey(sec.PrivateKey)
if err != nil {
return nil, nil, fmt.Errorf("Peer %s: %w", p.ID, err)
}
if existingPublic == p.PublicKey {
p.Managed = true
} else {
p.Managed = false
sec.PrivateKey = ""
sec.PresharedKey = ""
}
}
if p.PublicKey == "" {
if sec.PrivateKey != "" {
pub, err := publicKey(sec.PrivateKey)
if err != nil {
return nil, nil, fmt.Errorf("Peer %s: %w", p.ID, err)
}
p.PublicKey, p.Managed = pub, true
} else {
priv, pub, err := genKey()
if err != nil {
return nil, nil, err
}
p.PublicKey, sec.PrivateKey, p.Managed = pub, priv, true
}
}
if !isWireGuardKey(p.PublicKey) {
return nil, nil, fmt.Errorf("Peer %s 的 public_key 不是 WireGuard 公钥", p.ID)
}
if seenKeys[p.PublicKey] {
return nil, nil, fmt.Errorf("Peer public_key 重复: %s", p.ID)
}
seenKeys[p.PublicKey] = true
if sec.PresharedKey == "" {
raw := make([]byte, 32)
if _, err := rand.Read(raw); err != nil {
return nil, nil, err
}
sec.PresharedKey = base64.StdEncoding.EncodeToString(raw)
}
if !isWireGuardKey(sec.PresharedKey) {
return nil, nil, fmt.Errorf("Peer %s 的 preshared_key 格式非法", p.ID)
}
oldSecrets[p.ID] = sec
}
return peers, oldSecrets, nil
}
func parsePeers(cfg map[string]interface{}) ([]peer, error) {
raw, exists := cfg["peers"]
if !exists || raw == nil {
return nil, nil
}
items, ok := raw.([]interface{})
if !ok {
// JSON retrieved from store uses []interface{}, but accepting []map makes
// service-level callers and tests practical as well.
if maps, mapsOK := raw.([]map[string]interface{}); mapsOK {
items = make([]interface{}, len(maps))
for i := range maps {
items[i] = maps[i]
}
} else {
return nil, fmt.Errorf("peers 必须是数组")
}
}
peers := make([]peer, 0, len(items))
for _, item := range items {
m, ok := item.(map[string]interface{})
if !ok {
return nil, fmt.Errorf("peers 项必须是对象")
}
p := peer{ID: service.Str(m, "id"), Name: service.Str(m, "name"), PublicKey: service.Str(m, "public_key"), ClientAddress: service.Str(m, "client_address"), AllowedIPs: service.Str(m, "allowed_ips"), Managed: service.Bool(m, "managed", false), Enabled: true}
if _, set := m["enabled"]; set {
p.Enabled = service.Bool(m, "enabled", true)
}
peers = append(peers, p)
}
return peers, nil
}
func validatePeerInput(peers []peer) error {
seenIDs, seenKeys, seenAddresses := map[string]bool{}, map[string]bool{}, map[string]bool{}
for i := range peers {
p := peers[i]
if p.ID == "" {
p.ID = fmt.Sprintf("client-%d", i+1)
}
if !peerIDPattern.MatchString(p.ID) {
return fmt.Errorf("Peer ID %q 包含非法字符", p.ID)
}
if seenIDs[p.ID] {
return fmt.Errorf("Peer ID 重复: %s", p.ID)
}
seenIDs[p.ID] = true
if !validCIDR(p.ClientAddress) {
return fmt.Errorf("Peer %s 的 client_address 必须是合法 CIDR", p.ID)
}
if seenAddresses[p.ClientAddress] {
return fmt.Errorf("Peer client_address 重复: %s", p.ClientAddress)
}
seenAddresses[p.ClientAddress] = true
if p.PublicKey != "" {
if !isWireGuardKey(p.PublicKey) {
return fmt.Errorf("Peer %s 的 public_key 不是 WireGuard 公钥", p.ID)
}
if seenKeys[p.PublicKey] {
return fmt.Errorf("Peer public_key 重复: %s", p.ID)
}
seenKeys[p.PublicKey] = true
}
if p.AllowedIPs != "" {
if err := validateCIDRList(p.AllowedIPs); err != nil {
return fmt.Errorf("Peer %s allowed_ips: %w", p.ID, err)
}
}
if strings.ContainsAny(p.Name, "\r\n") {
return fmt.Errorf("Peer %s 的 name 不能包含换行符", p.ID)
}
}
return nil
}
func peersToConfig(peers []peer) []map[string]interface{} {
out := make([]map[string]interface{}, 0, len(peers))
for _, p := range peers {
out = append(out, map[string]interface{}{"id": p.ID, "name": p.Name, "public_key": p.PublicKey, "client_address": p.ClientAddress, "allowed_ips": p.AllowedIPs, "enabled": p.Enabled, "managed": p.Managed})
}
return out
}
func parsePeerSecrets(secrets map[string]interface{}) map[string]peerSecret {
out := map[string]peerSecret{}
raw, ok := secrets["peer_secrets"].(map[string]interface{})
if !ok {
return out
}
for id, value := range raw {
m, ok := value.(map[string]interface{})
if !ok {
continue
}
out[id] = peerSecret{PrivateKey: service.Str(m, "private_key"), PresharedKey: service.Str(m, "preshared_key")}
}
return out
}
func peerSecretsToConfig(secrets map[string]peerSecret) map[string]interface{} {
out := make(map[string]interface{}, len(secrets))
for id, sec := range secrets {
out[id] = map[string]interface{}{"private_key": sec.PrivateKey, "preshared_key": sec.PresharedKey}
}
return out
}
func renderServerConfig(cfg map[string]interface{}, serverPrivate string, peers []peer, secrets map[string]peerSecret) string {
var b strings.Builder
fmt.Fprintf(&b, "[Interface]\nPrivateKey = %s\nAddress = %s\nListenPort = %d\n", serverPrivate, service.Str(cfg, "address"), int(service.Num(cfg, "listen_port", defaultPort)))
if service.Bool(cfg, "enable_nat", false) {
egress := service.Str(cfg, "egress_interface")
fmt.Fprintf(&b, "PostUp = iptables -A FORWARD -i %%i -j ACCEPT; iptables -A FORWARD -o %%i -j ACCEPT; iptables -t nat -A POSTROUTING -o %s -j MASQUERADE\n", egress)
fmt.Fprintf(&b, "PostDown = iptables -D FORWARD -i %%i -j ACCEPT; iptables -D FORWARD -o %%i -j ACCEPT; iptables -t nat -D POSTROUTING -o %s -j MASQUERADE\n", egress)
}
for _, p := range peers {
if !p.Enabled {
continue
}
fmt.Fprintf(&b, "\n[Peer]\n# %s (%s)\nPublicKey = %s\nPresharedKey = %s\nAllowedIPs = %s\n", p.Name, p.ID, p.PublicKey, secrets[p.ID].PresharedKey, p.ClientAddress)
}
return b.String()
}
func validCIDR(value string) bool {
_, _, err := net.ParseCIDR(strings.TrimSpace(value))
return err == nil
}
func validateCIDRList(value string) error {
for _, entry := range strings.Split(value, ",") {
if !validCIDR(entry) {
return fmt.Errorf("%q 不是 CIDR", strings.TrimSpace(entry))
}
}
return nil
}
func min(a, b int) int {
if a < b {
return a
}
return b
}
backend/internal/service/wireguard/wireguard_test.go
+127
View File
@@ -0,0 +1,127 @@
package wireguard
import (
"encoding/json"
"os"
"strconv"
"strings"
"testing"
"vpn-platform/backend/internal/model"
"vpn-platform/backend/internal/store"
)
func TestBuildPeersMigratesLegacySingleClient(t *testing.T) {
cfg := map[string]interface{}{
"address": "10.8.0.1/24",
"client_address": "10.8.0.2/32",
"allowed_ips": "0.0.0.0/0, ::/0",
}
peers, secrets, err := buildPeers(cfg, map[string]interface{}{})
if err != nil {
t.Fatalf("buildPeers: %v", err)
}
if len(peers) != 1 || peers[0].ID != "client-1" || !peers[0].Managed {
t.Fatalf("legacy peer migration = %#v", peers)
}
if !isWireGuardKey(peers[0].PublicKey) || !isWireGuardKey(secrets["client-1"].PrivateKey) || !isWireGuardKey(secrets["client-1"].PresharedKey) {
t.Fatal("generated peer keys are not WireGuard keys")
}
cfg["server_public_key"] = "server-public-key"
cfg["listen_port"] = 51820
client, err := generateClientConfig(cfg, peers, secrets, "client-1")
if err != nil {
t.Fatalf("generateClientConfig: %v", err)
}
if !strings.Contains(client, "Address = 10.8.0.2/32") || !strings.Contains(client, "Endpoint = your-server-ip:51820") {
t.Fatalf("unexpected client config:\n%s", client)
}
}
func TestBuildPeersKeepsExternalPeerPrivateKeyOutOfPlatform(t *testing.T) {
_, externalPublic, err := genKey()
if err != nil {
t.Fatal(err)
}
cfg := map[string]interface{}{
"allowed_ips": "10.0.0.0/8",
"peers": []interface{}{map[string]interface{}{
"id": "branch-office",
"name": "Branch office",
"public_key": externalPublic,
"client_address": "10.8.0.10/32",
"enabled": true,
}},
}
peers, secrets, err := buildPeers(cfg, map[string]interface{}{})
if err != nil {
t.Fatalf("buildPeers: %v", err)
}
if peers[0].Managed || secrets["branch-office"].PrivateKey != "" {
t.Fatalf("external peer must not gain a platform-held private key: %#v %#v", peers[0], secrets["branch-office"])
}
if _, err := generateClientConfig(cfg, peers, secrets, "branch-office"); err == nil {
t.Fatal("external peer configuration should not be downloadable")
}
}
func TestValidateRejectsUnsafeNATAndInvalidPeerAddress(t *testing.T) {
s := New()
if _, err := s.Validate(map[string]interface{}{"address": "10.8.0.1/24", "enable_nat": true}); err == nil {
t.Fatal("NAT without explicit egress interface was accepted")
}
_, err := s.Validate(map[string]interface{}{
"address": "10.8.0.1/24",
"peers": []interface{}{map[string]interface{}{"id": "bad", "client_address": "not-a-cidr"}},
})
if err == nil {
t.Fatal("invalid peer address was accepted")
}
}
func TestInterfaceNameFitsLinuxLimit(t *testing.T) {
name := interfaceName(&model.Tunnel{ID: ^uint(0)})
if len(name) > 15 {
t.Fatalf("interface name %q exceeds IFNAMSIZ-1", name)
}
}
func TestCreatePersistsOnlyPublicPeerData(t *testing.T) {
dataDir := t.TempDir()
t.Setenv("VPN_DATA_DIR", dataDir)
if err := store.Init(dataDir); err != nil {
t.Fatalf("store.Init: %v", err)
}
tunnel := &model.Tunnel{
Name: "wg-test",
Protocol: "wireguard",
Config: `{"address":"10.60.0.1/24","client_address":"10.60.0.2/32"}`,
}
if err := store.DB.Create(tunnel).Error; err != nil {
t.Fatal(err)
}
if err := New().Create(tunnel); err != nil {
t.Fatalf("Create: %v", err)
}
if strings.Contains(tunnel.Config, "private_key") || strings.Contains(tunnel.Config, "preshared_key") {
t.Fatalf("private material leaked into Config: %s", tunnel.Config)
}
var config map[string]interface{}
if err := json.Unmarshal([]byte(tunnel.Config), &config); err != nil {
t.Fatal(err)
}
if config["interface_name"] != interfaceName(tunnel) || int(config["listen_port"].(float64)) < defaultPort {
t.Fatalf("missing interface/allocated port: %#v", config)
}
conf, err := New().GenerateClientConfig(tunnel)
if err != nil || !strings.Contains(conf, "PrivateKey = ") {
t.Fatalf("client configuration unavailable: %v\n%s", err, conf)
}
if _, err := os.Stat(serviceConfigPath(tunnel)); err != nil {
t.Fatalf("server config not written: %v", err)
}
}
func serviceConfigPath(tunnel *model.Tunnel) string {
return os.Getenv("VPN_DATA_DIR") + "/instances/" + strconv.Itoa(int(tunnel.ID)) + "-" + tunnel.Protocol + "/" + interfaceName(tunnel) + ".conf"
}
backend/internal/store/store.go
+165
View File
@@ -0,0 +1,165 @@
// Package store 负责 SQLite 初始化、敏感字段 AES-GCM 加密存储
package store
import (
"crypto/aes"
"crypto/cipher"
"crypto/rand"
"crypto/sha256"
"encoding/base64"
"encoding/hex"
"encoding/json"
"fmt"
"os"
"path/filepath"
"github.com/glebarez/sqlite"
"golang.org/x/crypto/bcrypt"
"gorm.io/gorm"
gormlogger "gorm.io/gorm/logger"
"vpn-platform/backend/internal/model"
)
var DB *gorm.DB
var gcm cipher.AEAD
// Init 打开数据库、迁移、初始化加密密钥与默认账号
func Init(dataDir string) error {
if err := os.MkdirAll(dataDir, 0o700); err != nil {
return err
}
db, err := gorm.Open(sqlite.Open(filepath.Join(dataDir, "vpn-platform.db")), &gorm.Config{
Logger: gormlogger.Default.LogMode(gormlogger.Warn),
})
if err != nil {
return fmt.Errorf("打开数据库失败: %w", err)
}
if err := db.AutoMigrate(&model.User{}, &model.LDAPConfig{}, &model.MFADevice{}, &model.VPNUser{}, &model.Tunnel{}, &model.Node{}, &model.Plugin{}, &model.AuditLog{}); err != nil {
return err
}
DB = db
if err := initKey(dataDir); err != nil {
return err
}
// 默认管理员 admin / admin123（首次登录后请修改） // Logan.Li
var count int64
DB.Model(&model.User{}).Count(&count)
if count == 0 {
hash, _ := bcrypt.GenerateFromPassword([]byte("admin123"), bcrypt.DefaultCost)
DB.Create(&model.User{Username: "admin", Password: string(hash), Role: "admin", Source: "local", Enabled: true})
} else {
// 兼容早期单管理员数据：管理员升级后保留完整管理权限。
DB.Model(&model.User{}).Where("username = ? AND source = ?", "admin", "local").Update("role", "admin")
}
// 内置本机节点
var nodeCount int64
DB.Model(&model.Node{}).Count(&nodeCount)
if nodeCount == 0 {
DB.Create(&model.Node{Name: "本机节点", Address: "127.0.0.1", Kind: "local", Remark: "平台所在服务器"})
}
return nil
}
func initKey(dataDir string) error {
keyFile := filepath.Join(dataDir, "secret.key")
raw, err := os.ReadFile(keyFile)
if err != nil {
key := make([]byte, 32)
if _, err := rand.Read(key); err != nil {
return err
}
raw = []byte(hex.EncodeToString(key))
if err := os.WriteFile(keyFile, raw, 0o600); err != nil {
return err
}
}
keyBytes, err := hex.DecodeString(string(raw))
if err != nil || len(keyBytes) != 32 {
sum := sha256.Sum256(raw)
keyBytes = sum[:]
}
block, err := aes.NewCipher(keyBytes)
if err != nil {
return err
}
g, err := cipher.NewGCM(block)
if err != nil {
return err
}
gcm = g
return nil
}
// EncryptSecret 加密敏感字符串
func EncryptSecret(plain string) (string, error) {
if plain == "" {
return "", nil
}
nonce := make([]byte, gcm.NonceSize())
if _, err := rand.Read(nonce); err != nil {
return "", err
}
out := gcm.Seal(nonce, nonce, []byte(plain), nil)
return base64.StdEncoding.EncodeToString(out), nil
}
// DecryptSecret 解密敏感字符串
func DecryptSecret(enc string) (string, error) {
if enc == "" {
return "", nil
}
raw, err := base64.StdEncoding.DecodeString(enc)
if err != nil {
return "", err
}
if len(raw) < gcm.NonceSize() {
return "", fmt.Errorf("密文长度非法")
}
plain, err := gcm.Open(nil, raw[:gcm.NonceSize()], raw[gcm.NonceSize():], nil)
if err != nil {
return "", err
}
return string(plain), nil
}
// Audit 写入操作审计
func Audit(username, action, target, detail string) {
if DB != nil {
DB.Create(&model.AuditLog{Username: username, Action: action, Target: target, Detail: detail})
}
}
// GetTunnel 按 ID 查询专线
func GetTunnel(id uint) (*model.Tunnel, error) {
var t model.Tunnel
if err := DB.Preload("Node").First(&t, id).Error; err != nil {
return nil, err
}
return &t, nil
}
// TunnelConfig 解析专线 Config JSON
func TunnelConfig(t *model.Tunnel) (map[string]interface{}, error) {
cfg := map[string]interface{}{}
if t.Config != "" {
if err := json.Unmarshal([]byte(t.Config), &cfg); err != nil {
return nil, err
}
}
return cfg, nil
}
// TunnelSecrets 解析并解密敏感字段
func TunnelSecrets(t *model.Tunnel) (map[string]interface{}, error) {
out := map[string]interface{}{}
plain, err := DecryptSecret(t.Secrets)
if err != nil || plain == "" {
return out, nil
}
_ = json.Unmarshal([]byte(plain), &out)
return out, nil
}
backend/main.go
+108
View File
@@ -0,0 +1,108 @@
// VPN 管理平台 —— 单二进制交付（前端静态资源内嵌） // Logan.Li
package main
import (
"embed"
"io/fs"
"log"
"net/http"
"os"
"strings"
"time"
"github.com/gin-gonic/gin"
"vpn-platform/backend/internal/api"
"vpn-platform/backend/internal/core"
"vpn-platform/backend/internal/monitor"
"vpn-platform/backend/internal/service"
"vpn-platform/backend/internal/service/custom"
"vpn-platform/backend/internal/service/frp"
"vpn-platform/backend/internal/service/ipsec"
"vpn-platform/backend/internal/service/l2tp"
"vpn-platform/backend/internal/service/openvpn"
"vpn-platform/backend/internal/service/wireguard"
"vpn-platform/backend/internal/store"
)
//go:embed all:dist
var webFS embed.FS
func main() {
gin.SetMode(gin.ReleaseMode)
// 数据目录：默认 ./data，可用 VPN_DATA_DIR 覆盖
dataDir := service.BaseDir()
if err := store.Init(dataDir); err != nil {
log.Fatalf("初始化存储失败: %v", err)
}
// OpenVPN invokes this same, already-installed binary from its
// auth-user-pass-verify hook. Keep it before HTTP startup so the hook has a
// short-lived process and a meaningful exit status.
if len(os.Args) > 1 && os.Args[1] == "openvpn-auth" {
if err := openvpn.RunAuthHelper(os.Args[2:]); err != nil {
log.Printf("OpenVPN 用户认证失败: %v", err)
os.Exit(1)
}
return
}
// 注册内置协议
mgr := core.NewManager()
mgr.Register(wireguard.New())
mgr.Register(ipsec.New())
mgr.Register(l2tp.New())
mgr.Register(frp.New())
mgr.Register(openvpn.New())
// 加载数据库中的自定义协议插件
custom.LoadAll(mgr)
r := gin.New()
r.Use(gin.Recovery())
srv := api.NewServer(mgr)
srv.RegisterRoutes(r)
// 内嵌前端（SPA 回退到 index.html）
dist, err := fs.Sub(webFS, "dist")
if err != nil {
log.Fatalf("内嵌资源损坏: %v", err)
}
fileServer := http.FileServer(http.FS(dist))
r.NoRoute(func(c *gin.Context) {
path := strings.TrimPrefix(c.Request.URL.Path, "/")
if path == "" {
path = "index.html"
}
if f, err := dist.Open(path); err == nil {
f.Close()
fileServer.ServeHTTP(c.Writer, c.Request)
return
}
// SPA fallback
c.Request.URL.Path = "/"
fileServer.ServeHTTP(c.Writer, c.Request)
})
// 状态采集 + 自启恢复
monitor.Start(mgr, 15*time.Second)
monitor.AutoStartAll(mgr)
addr := os.Getenv("VPN_LISTEN_ADDR")
if addr == "" {
addr = ":8080"
}
log.Printf("VPN 管理平台已启动: http://localhost%s (默认账号 admin / admin123)", addr)
log.Printf("协议依赖检测:")
for _, p := range mgr.List() {
ok, dep := p.Available()
mark := "✓"
if !ok {
mark = "✗"
}
log.Printf(" [%s] %-10s %s", mark, p.Name(), dep)
}
if err := r.Run(addr); err != nil {
log.Fatal(err)
}
}