增加弹窗输入OTP动态码的功能

server/handler/link_auth_otp.go

@@ -0,0 +1,222 @@
+package handler
+
+import (
+	"crypto/md5"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/xml"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"sync"
+
+	"github.com/bjdgyc/anylink/base"
+	"github.com/bjdgyc/anylink/dbdata"
+	"github.com/bjdgyc/anylink/sessdata"
+)
+
+var SessStore = NewSessionStore()
+
+type AuthSession struct {
+	ClientRequest *ClientRequest
+	UserActLog    *dbdata.UserActLog
+}
+
+// 存储临时会话信息
+type SessionStore struct {
+	session map[string]*AuthSession
+	mu      sync.Mutex
+}
+
+func NewSessionStore() *SessionStore {
+	return &SessionStore{
+		session: make(map[string]*AuthSession),
+	}
+}
+
+func (s *SessionStore) SaveAuthSession(sessionID string, session *AuthSession) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.session[sessionID] = session
+}
+
+func (s *SessionStore) GetAuthSession(sessionID string) (*AuthSession, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	session, exists := s.session[sessionID]
+	if !exists {
+		return nil, fmt.Errorf("auth session not found")
+	}
+
+	return session, nil
+}
+
+func (s *SessionStore) DeleteAuthSession(sessionID string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	delete(s.session, sessionID)
+}
+
+func GenerateSessionID() (string, error) {
+	b := make([]byte, 32)
+	_, err := rand.Read(b)
+	if err != nil {
+		return "", fmt.Errorf("failed to generate session ID: %w", err)
+	}
+
+	hash := sha256.Sum256(b)
+	sessionID := base64.URLEncoding.EncodeToString(hash[:])
+	return sessionID, nil
+}
+
+func SetCookie(w http.ResponseWriter, name, value string, maxAge int) {
+	cookie := &http.Cookie{
+		Name:     name,
+		Value:    value,
+		MaxAge:   maxAge,
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   true,
+		SameSite: http.SameSiteLaxMode,
+	}
+	http.SetCookie(w, cookie)
+}
+
+func GetCookie(r *http.Request, name string) (string, error) {
+	cookie, err := r.Cookie(name)
+	if err != nil {
+		return "", fmt.Errorf("failed to get cookie: %v", err)
+	}
+	return cookie.Value, nil
+}
+
+func DeleteCookie(w http.ResponseWriter, name string) {
+	cookie := &http.Cookie{
+		Name:     name,
+		Value:    "",
+		MaxAge:   -1,
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   true,
+		SameSite: http.SameSiteStrictMode,
+	}
+	http.SetCookie(w, cookie)
+}
+func CreateSession(w http.ResponseWriter, r *http.Request, authSession *AuthSession) {
+	cr := authSession.ClientRequest
+	ua := authSession.UserActLog
+
+	sess := sessdata.NewSession("")
+	sess.Username = cr.Auth.Username
+	sess.Group = cr.GroupSelect
+	oriMac := cr.MacAddressList.MacAddress
+	sess.UniqueIdGlobal = cr.DeviceId.UniqueIdGlobal
+	sess.UserAgent = cr.UserAgent
+	sess.DeviceType = ua.DeviceType
+	sess.PlatformVersion = ua.PlatformVersion
+	sess.RemoteAddr = cr.RemoteAddr
+	// 获取客户端mac地址
+	sess.UniqueMac = true
+	macHw, err := net.ParseMAC(oriMac)
+	if err != nil {
+		var sum [16]byte
+		if sess.UniqueIdGlobal != "" {
+			sum = md5.Sum([]byte(sess.UniqueIdGlobal))
+		} else {
+			sum = md5.Sum([]byte(sess.Token))
+			sess.UniqueMac = false
+		}
+		macHw = sum[0:5] // 5个byte
+		macHw = append([]byte{0x02}, macHw...)
+		sess.MacAddr = macHw.String()
+	}
+	sess.MacHw = macHw
+	// 统一macAddr的格式
+	sess.MacAddr = macHw.String()
+
+	other := &dbdata.SettingOther{}
+	dbdata.SettingGet(other)
+	rd := RequestData{
+		SessionId:    sess.Sid,
+		SessionToken: sess.Sid + "@" + sess.Token,
+		Banner:       other.Banner,
+		ProfileName:  base.Cfg.ProfileName,
+		ProfileHash:  profileHash,
+		CertHash:     certHash,
+	}
+
+	w.WriteHeader(http.StatusOK)
+	tplRequest(tpl_complete, w, rd)
+	base.Info("login", cr.Auth.Username, cr.UserAgent)
+}
+
+func LinkAuth_otp(w http.ResponseWriter, r *http.Request) {
+	sessionID, err := GetCookie(r, "auth-session-id")
+	if err != nil {
+		http.Error(w, "Invalid session, please login again", http.StatusUnauthorized)
+		return
+	}
+
+	sessionData, err := SessStore.GetAuthSession(sessionID)
+	if err != nil {
+		http.Error(w, "Invalid session, please login again", http.StatusUnauthorized)
+		return
+	}
+
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		w.WriteHeader(http.StatusBadRequest)
+		return
+	}
+	defer r.Body.Close()
+
+	cr := ClientRequest{}
+	err = xml.Unmarshal(body, &cr)
+	if err != nil {
+		base.Error(err)
+		w.WriteHeader(http.StatusBadRequest)
+		return
+	}
+
+	ua := sessionData.UserActLog
+	username := sessionData.ClientRequest.Auth.Username
+	otpSecret := sessionData.ClientRequest.Auth.OtpSecret
+	otp := cr.Auth.SecondaryPassword
+
+	if !dbdata.CheckOtp(username, otp, otpSecret) {
+		base.Warn("OTP 动态码错误", r.RemoteAddr)
+		ua.Info = "OTP 动态码错误"
+		ua.Status = dbdata.UserAuthFail
+		dbdata.UserActLogIns.Add(*ua, sessionData.ClientRequest.UserAgent)
+
+		w.WriteHeader(http.StatusOK)
+		data := RequestData{Error: "OTP 动态码错误"}
+		if base.Cfg.DisplayError {
+			data.Error = "OTP 动态码错误"
+		}
+		tplRequest(tpl_otp, w, data)
+		return
+	}
+	CreateSession(w, r, sessionData)
+
+	// 删除临时会话信息
+	SessStore.DeleteAuthSession(sessionID)
+	// DeleteCookie(w, "auth-session-id")
+}
+
+var auth_otp = `<?xml version="1.0" encoding="UTF-8"?>
+<config-auth client="vpn" type="auth-request" aggregate-auth-version="2">
+    <auth id="otp-verification">
+        <title>OTP 动态码验证</title>
+        <message>请输入您的 OTP 动态码</message>
+        {{if .Error}}
+        <error id="otp-verification" param1="{{.Error}}" param2="">验证失败:  %s</error>
+        {{end}}		
+        <form method="post" action="/otp-verification">
+            <input type="password" name="secondary_password" label="OTP"/>
+        </form>
+    </auth>
+</config-auth>`