feat: configure HTTP/HTTPS public entry and managed certificates
This commit is contained in:
Codex committed
1 parent
35596cda9d
commit
88ea6b7854
21 files changed
+1309
-149
No files matched your search
@@ -15,6 +15,7 @@ import (
|
||||
"gorm.io/gorm"
|
||||
"vpn-platform/backend/internal/nginxgateway"
|
||||
"vpn-platform/backend/internal/store"
|
||||
"vpn-platform/backend/internal/tlsservice"
|
||||
)
|
||||
|
||||
const feishuTenantToken = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
|
||||
@@ -33,7 +34,14 @@ func secureAdmin(c *gin.Context) bool {
|
||||
return true
|
||||
}
|
||||
peer, _, err := net.SplitHostPort(c.Request.RemoteAddr)
|
||||
return err == nil && net.ParseIP(peer) != nil && net.ParseIP(peer).IsLoopback() && c.GetHeader("X-Forwarded-Proto") == "https"
|
||||
if err != nil || net.ParseIP(peer) == nil || !net.ParseIP(peer).IsLoopback() {
|
||||
return false
|
||||
}
|
||||
scheme := tlsservice.Status().Scheme
|
||||
if scheme == "" {
|
||||
scheme = "https"
|
||||
}
|
||||
return c.GetHeader("X-Forwarded-Proto") == scheme
|
||||
}
|
||||
|
||||
type tenantCredentials struct {
|
||||
@@ -116,7 +124,7 @@ func queryFeishuTenant(ctx context.Context, creds tenantCredentials) (string, st
|
||||
func (p *Provider) QueryTenant(c *gin.Context) {
|
||||
noStore(c)
|
||||
if !secureAdmin(c) {
|
||||
c.JSON(http.StatusForbidden, gin.H{"error": "请通过可信 HTTPS 管理入口查询飞书企业信息"})
|
||||
c.JSON(http.StatusForbidden, gin.H{"error": "请通过可信公网管理入口查询飞书企业信息"})
|
||||
return
|
||||
}
|
||||
var input tenantCredentials
|
||||
@@ -168,7 +176,7 @@ func (p *Provider) Status(c *gin.Context) {
|
||||
|
||||
func (p *Provider) Configure(c *gin.Context) {
|
||||
if !secureAdmin(c) {
|
||||
c.JSON(http.StatusForbidden, gin.H{"error": "请通过可信 HTTPS 管理入口保存飞书凭据"})
|
||||
c.JSON(http.StatusForbidden, gin.H{"error": "请通过可信公网管理入口保存飞书凭据"})
|
||||
return
|
||||
}
|
||||
var req struct {
|
||||
|
||||
@@ -86,8 +86,8 @@ func (p *Provider) Authorize(c *gin.Context) {
|
||||
return
|
||||
}
|
||||
redirect := c.Query("redirect_uri")
|
||||
domain := strings.TrimSuffix(strings.TrimPrefix(base, "https://"), "/id")
|
||||
if !validateRedirect(redirect, domain) || c.Query("client_id") != cfg.ClientID || c.Query("response_type") != "code" || !strings.Contains(" "+c.Query("scope")+" ", " openid ") {
|
||||
publicBase := strings.TrimSuffix(base, "/id")
|
||||
if !validateRedirect(redirect, publicBase) || c.Query("client_id") != cfg.ClientID || c.Query("response_type") != "code" || !strings.Contains(" "+c.Query("scope")+" ", " openid ") {
|
||||
oidcError(c, 400)
|
||||
return
|
||||
}
|
||||
|
||||
@@ -0,0 +1,57 @@
|
||||
package identityprovider
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"testing"
|
||||
|
||||
"vpn-platform/backend/internal/tlsservice"
|
||||
)
|
||||
|
||||
func TestIssuerHTTPPublicBase(t *testing.T) {
|
||||
t.Setenv("VPN_TLS_DOMAIN", "")
|
||||
t.Setenv("VPN_TLS_SCHEME", "")
|
||||
t.Setenv("VPN_TLS_PORT", "")
|
||||
t.Setenv("VPN_TLS_MODE", "")
|
||||
dir := t.TempDir()
|
||||
if err := tlsservice.ConfigureMode(dir, "nginx"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := tlsservice.ConfigurePublicEntry(dir, "http", "vpn.example.com", 8080); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
t.Setenv("VPN_TLS_HTTP_ADDR", "127.0.0.1:0")
|
||||
t.Setenv("VPN_TLS_HTTPS_ADDR", "127.0.0.1:0")
|
||||
if err := tlsservice.Start(http.NotFoundHandler(), dir); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
base, err := issuer()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if base != "http://vpn.example.com:8080/id" {
|
||||
t.Fatalf("issuer = %q", base)
|
||||
}
|
||||
}
|
||||
|
||||
func TestIssuerHTTPSOmitsDefaultPort(t *testing.T) {
|
||||
// PublicBaseURL unit coverage is primary; here ensure issuer refuses https without Valid cert.
|
||||
t.Setenv("VPN_TLS_DOMAIN", "")
|
||||
t.Setenv("VPN_TLS_SCHEME", "")
|
||||
t.Setenv("VPN_TLS_PORT", "")
|
||||
t.Setenv("VPN_TLS_MODE", "")
|
||||
dir := t.TempDir()
|
||||
if err := tlsservice.ConfigureMode(dir, "nginx"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := tlsservice.ConfigurePublicEntry(dir, "https", "vpn.example.com", 0); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
t.Setenv("VPN_TLS_HTTP_ADDR", "127.0.0.1:0")
|
||||
t.Setenv("VPN_TLS_HTTPS_ADDR", "127.0.0.1:0")
|
||||
if err := tlsservice.Start(http.NotFoundHandler(), dir); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := issuer(); err == nil {
|
||||
t.Fatal("https issuer must require Valid certificate")
|
||||
}
|
||||
}
|
||||
@@ -96,8 +96,15 @@ func SecureGateway() gin.HandlerFunc {
|
||||
return
|
||||
}
|
||||
peer, _, err := net.SplitHostPort(c.Request.RemoteAddr)
|
||||
if err == nil && net.ParseIP(peer) != nil && net.ParseIP(peer).IsLoopback() && c.GetHeader("X-Forwarded-Proto") == "https" {
|
||||
return
|
||||
if err == nil && net.ParseIP(peer) != nil && net.ParseIP(peer).IsLoopback() {
|
||||
proto := c.GetHeader("X-Forwarded-Proto")
|
||||
scheme := tlsservice.Status().Scheme
|
||||
if scheme == "" {
|
||||
scheme = "https"
|
||||
}
|
||||
if proto == scheme {
|
||||
return
|
||||
}
|
||||
}
|
||||
c.AbortWithStatus(http.StatusForbidden)
|
||||
}
|
||||
@@ -116,10 +123,17 @@ func init() {
|
||||
|
||||
func issuer() (string, error) {
|
||||
status := tlsservice.Status()
|
||||
if !status.Valid || status.RestartRequired || status.Domain == "" {
|
||||
if status.RestartRequired || status.Domain == "" || status.PublicBase == "" {
|
||||
return "", errors.New("需要先配置并启用公网入口")
|
||||
}
|
||||
scheme := status.Scheme
|
||||
if scheme == "" {
|
||||
scheme = "https"
|
||||
}
|
||||
if scheme == "https" && !status.Valid {
|
||||
return "", errors.New("需要先启用并验证公网 HTTPS 域名")
|
||||
}
|
||||
return "https://" + status.Domain + "/id", nil
|
||||
return status.PublicBase + "/id", nil
|
||||
}
|
||||
|
||||
func current() (model.IdentityProvider, error) {
|
||||
@@ -250,8 +264,9 @@ func signingKey() (*rsa.PrivateKey, string, error) {
|
||||
return key, base64.RawURLEncoding.EncodeToString(sum[:8]), nil
|
||||
}
|
||||
|
||||
func validateRedirect(raw, domain string) bool {
|
||||
return raw == "https://"+domain+"/oauth2/callback"
|
||||
func validateRedirect(raw, publicBase string) bool {
|
||||
publicBase = strings.TrimRight(strings.TrimSpace(publicBase), "/")
|
||||
return publicBase != "" && raw == publicBase+"/oauth2/callback"
|
||||
}
|
||||
|
||||
func validTenant(value string) bool {
|
||||
|
||||
@@ -158,11 +158,14 @@ func TestIDTokenOmitsMissingDisplayName(t *testing.T) {
|
||||
}
|
||||
|
||||
func TestRedirectIsExactAndNoOpenRedirect(t *testing.T) {
|
||||
if !validateRedirect("https://vpn.example.com/oauth2/callback", "vpn.example.com") {
|
||||
if !validateRedirect("https://vpn.example.com/oauth2/callback", "https://vpn.example.com") {
|
||||
t.Fatal("valid callback rejected")
|
||||
}
|
||||
if !validateRedirect("http://vpn.example.com:8080/oauth2/callback", "http://vpn.example.com:8080") {
|
||||
t.Fatal("http custom-port callback rejected")
|
||||
}
|
||||
for _, bad := range []string{"http://vpn.example.com/oauth2/callback", "https://vpn.example.com.evil/oauth2/callback", "https://vpn.example.com/oauth2/callback/extra", "https://vpn.example.com/oauth2/callback?next=evil"} {
|
||||
if validateRedirect(bad, "vpn.example.com") {
|
||||
if validateRedirect(bad, "https://vpn.example.com") {
|
||||
t.Errorf("accepted callback %q", bad)
|
||||
}
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user