From 78a8b06467ee523470ad08323b321756561275b4 Mon Sep 17 00:00:00 2001 From: bjdgyc Date: Thu, 17 Aug 2023 16:27:12 +0800 Subject: [PATCH 01/37] =?UTF-8?q?=E5=8F=98=E6=9B=B4qq=E7=BE=A4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- server/conf/files/info.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/conf/files/info.txt b/server/conf/files/info.txt index 2e7e2e0..9f89a52 100644 --- a/server/conf/files/info.txt +++ b/server/conf/files/info.txt @@ -1,2 +1,2 @@ 客户端软件需放置在files目录内， -如需要帮助请加QQ群：567510628 \ No newline at end of file +如需要帮助请加QQ群：567510628 、739072205 \ No newline at end of file From 7714c2a3e826989279a1bc7091395fb9ee26f567 Mon Sep 17 00:00:00 2001 From: bjdgyc Date: Thu, 24 Aug 2023 14:27:12 +0800 Subject: [PATCH 02/37] =?UTF-8?q?debug=E4=BF=A1=E6=81=AF=20=E9=9C=80?= =?UTF-8?q?=E8=A6=81=E9=89=B4=E6=9D=83=E5=90=8E=E6=98=BE=E7=A4=BA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- server/admin/api_base.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/server/admin/api_base.go b/server/admin/api_base.go index fa63b39..42dfd01 100644 --- a/server/admin/api_base.go +++ b/server/admin/api_base.go @@ -82,7 +82,7 @@ func authMiddleware(next http.Handler) http.Handler { route := mux.CurrentRoute(r) name := route.GetName() // fmt.Println("bb", r.URL.Path, name) - if utils.InArrStr([]string{"login", "index", "static", "debug"}, name) { + if utils.InArrStr([]string{"login", "index", "static"}, name) { // 不进行鉴权 next.ServeHTTP(w, r) return @@ -93,6 +93,12 @@ func authMiddleware(next http.Handler) http.Handler { if jwtToken == "" { jwtToken = r.FormValue("jwt") } + if jwtToken == "" { + cc, err := r.Cookie("jwt") + if err == nil { + jwtToken = cc.Value + } + } data, err := GetJwtData(jwtToken) if err != nil || base.Cfg.AdminUser != fmt.Sprint(data["admin_user"]) { w.WriteHeader(http.StatusUnauthorized) From 08de4fe08600bf736de62fdc1eadde7258951bae Mon Sep 17 00:00:00 2001 From: bjdgyc Date: Thu, 24 Aug 2023 16:59:35 +0800 Subject: [PATCH 03/37] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=E5=AE=89=E5=85=A8?= =?UTF-8?q?=E7=9A=84header=E5=A4=B4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- server/admin/api_base.go | 10 ++++++++++ server/admin/server.go | 8 ++++++++ server/handler/link_auth.go | 2 +- server/handler/link_base.go | 23 ----------------------- server/handler/link_home.go | 2 +- server/handler/server.go | 9 +++++++++ server/pkg/utils/secure_header.go | 27 +++++++++++++++++++++++++++ 7 files changed, 56 insertions(+), 25 deletions(-) create mode 100644 server/pkg/utils/secure_header.go diff --git a/server/admin/api_base.go b/server/admin/api_base.go index 42dfd01..61c81a6 100644 --- a/server/admin/api_base.go +++ b/server/admin/api_base.go @@ -67,6 +67,14 @@ func Login(w http.ResponseWriter, r *http.Request) { data["admin_user"] = adminUser data["expires_at"] = expiresAt + ck := &http.Cookie{ + Name: "jwt", + Value: tokenString, + Path: "/", + HttpOnly: true, + } + http.SetCookie(w, ck) + RespSucess(w, data) } @@ -76,6 +84,8 @@ func authMiddleware(next http.Handler) http.Handler { w.Header().Set("Access-Control-Allow-Methods", "GET,POST,OPTIONS") w.Header().Set("Access-Control-Allow-Headers", "*") if r.Method == http.MethodOptions { + // 正式环境不支持 OPTIONS + w.WriteHeader(http.StatusForbidden) return } diff --git a/server/admin/server.go b/server/admin/server.go index 3cabb99..b162755 100644 --- a/server/admin/server.go +++ b/server/admin/server.go @@ -10,6 +10,7 @@ import ( "github.com/arl/statsviz" "github.com/bjdgyc/anylink/base" "github.com/bjdgyc/anylink/dbdata" + "github.com/bjdgyc/anylink/pkg/utils" "github.com/gorilla/handlers" "github.com/gorilla/mux" ) @@ -20,6 +21,13 @@ var UiData embed.FS func StartAdmin() { r := mux.NewRouter() + // 所有路由添加安全头 + r.Use(func(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) { + utils.SetSecureHeader(w) + next.ServeHTTP(w, req) + }) + }) r.Use(authMiddleware) r.Use(handlers.CompressHandler) diff --git a/server/handler/link_auth.go b/server/handler/link_auth.go index 2e9bf8f..ca43bdd 100644 --- a/server/handler/link_auth.go +++ b/server/handler/link_auth.go @@ -49,7 +49,7 @@ func LinkAuth(w http.ResponseWriter, r *http.Request) { return } // fmt.Printf("%+v \n", cr) - setCommonHeader(w) + // setCommonHeader(w) if cr.Type == "logout" { // 退出删除session信息 if cr.SessionToken != "" { diff --git a/server/handler/link_base.go b/server/handler/link_base.go index 7581bcc..48e2258 100644 --- a/server/handler/link_base.go +++ b/server/handler/link_base.go @@ -3,7 +3,6 @@ package handler import ( "encoding/xml" "log" - "net/http" "os/exec" ) @@ -42,28 +41,6 @@ type macAddressList struct { MacAddress string `xml:"mac-address"` } -func setCommonHeader(w http.ResponseWriter) { - // Content-Length Date 默认已经存在 - w.Header().Set("Server", "AnyLinkOpenSource") - w.Header().Set("Content-Type", "text/html; charset=utf-8") - w.Header().Set("Cache-Control", "no-store,no-cache") - w.Header().Set("Pragma", "no-cache") - w.Header().Set("Transfer-Encoding", "chunked") - w.Header().Set("Connection", "keep-alive") - w.Header().Set("X-Frame-Options", "deny") - w.Header().Set("X-Content-Type-Options", "nosniff") - w.Header().Set("Content-Security-Policy", "default-src 'none'") - w.Header().Set("X-Permitted-Cross-Domain-Policies", "none") - w.Header().Set("Referrer-Policy", "no-referrer") - w.Header().Set("Clear-Site-Data", "cache,cookies,storage") - w.Header().Set("Cross-Origin-Embedder-Policy", "require-corp") - w.Header().Set("Cross-Origin-Opener-Policy", "same-origin") - w.Header().Set("Cross-Origin-Resource-Policy", "same-origin") - w.Header().Set("X-XSS-Protection", "0") - w.Header().Set("X-Aggregate-Auth", "1") - w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains") -} - func execCmd(cmdStrs []string) error { for _, cmdStr := range cmdStrs { cmd := exec.Command("sh", "-c", cmdStr) diff --git a/server/handler/link_home.go b/server/handler/link_home.go index a2dc30b..066e6f1 100644 --- a/server/handler/link_home.go +++ b/server/handler/link_home.go @@ -13,7 +13,7 @@ func LinkHome(w http.ResponseWriter, r *http.Request) { // fmt.Println(r.RemoteAddr) // hu, _ := httputil.DumpRequest(r, true) // fmt.Println("DumpHome: ", string(hu)) - w.Header().Set("Server", "AnyLinkOpenSource") + w.Header().Set("Content-Type", "text/html; charset=utf-8") connection := strings.ToLower(r.Header.Get("Connection")) userAgent := strings.ToLower(r.UserAgent()) if connection == "close" && (strings.Contains(userAgent, "anyconnect") || strings.Contains(userAgent, "openconnect")) { diff --git a/server/handler/server.go b/server/handler/server.go index 34fd016..06d72d5 100644 --- a/server/handler/server.go +++ b/server/handler/server.go @@ -12,6 +12,7 @@ import ( "github.com/bjdgyc/anylink/base" "github.com/bjdgyc/anylink/dbdata" + "github.com/bjdgyc/anylink/pkg/utils" "github.com/gorilla/mux" "github.com/pires/go-proxyproto" ) @@ -86,6 +87,14 @@ func startTls() { func initRoute() http.Handler { r := mux.NewRouter() + // 所有路由添加安全头 + r.Use(func(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) { + utils.SetSecureHeader(w) + next.ServeHTTP(w, req) + }) + }) + r.HandleFunc("/", LinkHome).Methods(http.MethodGet) r.HandleFunc("/", LinkAuth).Methods(http.MethodPost) r.HandleFunc("/CSCOSSLC/tunnel", LinkTunnel).Methods(http.MethodConnect) diff --git a/server/pkg/utils/secure_header.go b/server/pkg/utils/secure_header.go new file mode 100644 index 0000000..a0a3b31 --- /dev/null +++ b/server/pkg/utils/secure_header.go @@ -0,0 +1,27 @@ +package utils + +import "net/http" + +// 设置安全的header头 +func SetSecureHeader(w http.ResponseWriter) { + // Content-Length Date 默认已经存在 + w.Header().Set("Server", "AnyLinkOpenSource") + // w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.Header().Set("Cache-Control", "no-store,no-cache") + w.Header().Set("Pragma", "no-cache") + w.Header().Set("Transfer-Encoding", "chunked") + w.Header().Set("Connection", "keep-alive") + w.Header().Set("X-Frame-Options", "deny") + w.Header().Set("X-Content-Type-Options", "nosniff") + w.Header().Set("X-Download-Options", "noopen") + w.Header().Set("Content-Security-Policy", "default-src 'self' 'unsafe-inline'") + w.Header().Set("X-Permitted-Cross-Domain-Policies", "none") + w.Header().Set("Referrer-Policy", "no-referrer") + // w.Header().Set("Clear-Site-Data", "cache,cookies,storage") + w.Header().Set("Cross-Origin-Embedder-Policy", "require-corp") + w.Header().Set("Cross-Origin-Opener-Policy", "same-origin") + w.Header().Set("Cross-Origin-Resource-Policy", "same-origin") + w.Header().Set("X-XSS-Protection", "0") + w.Header().Set("X-Aggregate-Auth", "1") + w.Header().Set("Strict-Transport-Security", "max-age=31536000") +} From da1d6c6c6db1741779e816521054a101ff89c2bd Mon Sep 17 00:00:00 2001 From: bjdgyc Date: Fri, 25 Aug 2023 13:56:04 +0800 Subject: [PATCH 04/37] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=E5=AE=89=E5=85=A8?= =?UTF-8?q?=E7=9A=84header=E5=A4=B4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 1 + server/pkg/utils/secure_header.go | 8 +++++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index c4c67c2..e5fb56a 100644 --- a/README.md +++ b/README.md @@ -301,6 +301,7 @@ ipv4_end = "10.1.2.200" ## Discussion 添加QQ群(1): 567510628 + 添加QQ群(2): 739072205 群共享文件有相关软件下载 diff --git a/server/pkg/utils/secure_header.go b/server/pkg/utils/secure_header.go index a0a3b31..f323693 100644 --- a/server/pkg/utils/secure_header.go +++ b/server/pkg/utils/secure_header.go @@ -7,9 +7,11 @@ func SetSecureHeader(w http.ResponseWriter) { // Content-Length Date 默认已经存在 w.Header().Set("Server", "AnyLinkOpenSource") // w.Header().Set("Content-Type", "text/html; charset=utf-8") + // w.Header().Set("Transfer-Encoding", "chunked") + w.Header().Set("X-Aggregate-Auth", "1") + w.Header().Set("Cache-Control", "no-store,no-cache") w.Header().Set("Pragma", "no-cache") - w.Header().Set("Transfer-Encoding", "chunked") w.Header().Set("Connection", "keep-alive") w.Header().Set("X-Frame-Options", "deny") w.Header().Set("X-Content-Type-Options", "nosniff") @@ -17,11 +19,11 @@ func SetSecureHeader(w http.ResponseWriter) { w.Header().Set("Content-Security-Policy", "default-src 'self' 'unsafe-inline'") w.Header().Set("X-Permitted-Cross-Domain-Policies", "none") w.Header().Set("Referrer-Policy", "no-referrer") - // w.Header().Set("Clear-Site-Data", "cache,cookies,storage") w.Header().Set("Cross-Origin-Embedder-Policy", "require-corp") w.Header().Set("Cross-Origin-Opener-Policy", "same-origin") w.Header().Set("Cross-Origin-Resource-Policy", "same-origin") w.Header().Set("X-XSS-Protection", "0") - w.Header().Set("X-Aggregate-Auth", "1") w.Header().Set("Strict-Transport-Security", "max-age=31536000") + + // w.Header().Set("Clear-Site-Data", "cache,cookies,storage") } From 6127c41aeaca5b0311b5812fec10dd4798103378 Mon Sep 17 00:00:00 2001 From: bjdgyc Date: Fri, 1 Sep 2023 17:55:15 +0800 Subject: [PATCH 05/37] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20panic?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- server/handler/payload_access_audit.go | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/server/handler/payload_access_audit.go b/server/handler/payload_access_audit.go index 4384352..89f3450 100644 --- a/server/handler/payload_access_audit.go +++ b/server/handler/payload_access_audit.go @@ -106,6 +106,7 @@ func logAudit(userName string, pl *sessdata.Payload) { if !(pl.LType == sessdata.LTypeIPData && pl.PType == 0x00) { return } + ipProto := waterutil.IPv4Protocol(pl.Data) // 访问协议 var accessProto uint8 @@ -121,7 +122,15 @@ func logAudit(userName string, pl *sessdata.Payload) { ipSrc := waterutil.IPv4Source(pl.Data) ipDst := waterutil.IPv4Destination(pl.Data) - ipPort := waterutil.IPv4DestinationPort(pl.Data) + + // ipPort := waterutil.IPv4DestinationPort(pl.Data) + // 修复 panic: runtime error: index out of range [2] with length 2 + ipPl := waterutil.IPv4Payload(pl.Data) + if len(ipPl) < 3 { + base.Error("ipPl len < 3", pl.Data) + return + } + ipPort := (uint16(ipPl[2]) << 8) | uint16(ipPl[3]) b := getByte51() key := *b From a168c96a935e1065d78c24bdbc9cb37de9b418ae Mon Sep 17 00:00:00 2001 From: lanrenwo Date: Fri, 1 Sep 2023 18:10:20 +0800 Subject: [PATCH 06/37] =?UTF-8?q?=E4=BF=AE=E5=A4=8DsniNewParser=E7=9A=84pa?= =?UTF-8?q?nic?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- server/handler/payload_tcp_parser.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/server/handler/payload_tcp_parser.go b/server/handler/payload_tcp_parser.go index 6d3c4cc..f2e1c31 100644 --- a/server/handler/payload_tcp_parser.go +++ b/server/handler/payload_tcp_parser.go @@ -32,6 +32,9 @@ func sniNewParser(b []byte) (uint8, string) { if len(b) < 2 || b[0] != 0x16 || b[1] != 0x03 { return acc_proto_tcp, "" } + if len(b) < 6 { + return acc_proto_tcp, "" + } rest := b[5:] restLen := len(rest) if restLen == 0 { From 2af2d273e4725284f255a4f8c2dd486dee7502c0 Mon Sep 17 00:00:00 2001 From: lanrenwo Date: Sat, 2 Sep 2023 10:44:47 +0800 Subject: [PATCH 07/37] =?UTF-8?q?=E7=AE=80=E5=8C=96sniNewParser=E4=BB=A3?= =?UTF-8?q?=E7=A0=81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- server/handler/payload_tcp_parser.go | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/server/handler/payload_tcp_parser.go b/server/handler/payload_tcp_parser.go index f2e1c31..bbb933e 100644 --- a/server/handler/payload_tcp_parser.go +++ b/server/handler/payload_tcp_parser.go @@ -29,10 +29,7 @@ func onTCP(payload []byte) (uint8, string) { } func sniNewParser(b []byte) (uint8, string) { - if len(b) < 2 || b[0] != 0x16 || b[1] != 0x03 { - return acc_proto_tcp, "" - } - if len(b) < 6 { + if len(b) < 6 || b[0] != 0x16 || b[1] != 0x03 { return acc_proto_tcp, "" } rest := b[5:] From 7651b69ed636649161c36f0613719d69960b4b6c Mon Sep 17 00:00:00 2001 From: lanrenwo Date: Sat, 2 Sep 2023 10:46:01 +0800 Subject: [PATCH 08/37] =?UTF-8?q?=E5=88=A0=E9=99=A4sniNewParser=E5=A4=9A?= =?UTF-8?q?=E4=BD=99=E7=9A=84=E7=A9=BA=E6=A0=BC?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- server/handler/payload_tcp_parser.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/handler/payload_tcp_parser.go b/server/handler/payload_tcp_parser.go index bbb933e..95c9a0d 100644 --- a/server/handler/payload_tcp_parser.go +++ b/server/handler/payload_tcp_parser.go @@ -31,7 +31,7 @@ func onTCP(payload []byte) (uint8, string) { func sniNewParser(b []byte) (uint8, string) { if len(b) < 6 || b[0] != 0x16 || b[1] != 0x03 { return acc_proto_tcp, "" - } + } rest := b[5:] restLen := len(rest) if restLen == 0 { From f6980261d456531f69fd8ab92437539d75dd344d Mon Sep 17 00:00:00 2001 From: lanrenwo Date: Sun, 3 Sep 2023 11:18:52 +0800 Subject: [PATCH 09/37] =?UTF-8?q?logAudit=E5=BC=95=E5=85=A5recover,=20?= =?UTF-8?q?=E9=98=B2=E6=AD=A2=E4=B8=BB=E7=A8=8B=E5=BA=8F=E5=B4=A9=E6=BA=83?= =?UTF-8?q?.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- server/handler/payload_access_audit.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/server/handler/payload_access_audit.go b/server/handler/payload_access_audit.go index 89f3450..e703c1c 100644 --- a/server/handler/payload_access_audit.go +++ b/server/handler/payload_access_audit.go @@ -3,6 +3,7 @@ package handler import ( "crypto/md5" "encoding/binary" + "runtime/debug" "time" "github.com/bjdgyc/anylink/base" @@ -101,7 +102,12 @@ func logAuditBatch() { // 解析IP包的数据 func logAudit(userName string, pl *sessdata.Payload) { - defer putPayload(pl) + defer func() { + putPayload(pl) + if err := recover(); err != nil { + base.Error("logAudit is panic: ", err, "\n", string(debug.Stack()), "\n", pl.Data) + } + }() if !(pl.LType == sessdata.LTypeIPData && pl.PType == 0x00) { return From 7b9be9377f61f7bb5d174614c36c294a3b730c78 Mon Sep 17 00:00:00 2001 From: lanrenwo Date: Fri, 8 Sep 2023 20:33:30 +0800 Subject: [PATCH 10/37] =?UTF-8?q?=E4=BF=AE=E5=A4=8DlogAudit=E7=9A=84panic?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- server/handler/payload_access_audit.go | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/server/handler/payload_access_audit.go b/server/handler/payload_access_audit.go index e703c1c..99efa24 100644 --- a/server/handler/payload_access_audit.go +++ b/server/handler/payload_access_audit.go @@ -103,10 +103,10 @@ func logAuditBatch() { // 解析IP包的数据 func logAudit(userName string, pl *sessdata.Payload) { defer func() { - putPayload(pl) if err := recover(); err != nil { base.Error("logAudit is panic: ", err, "\n", string(debug.Stack()), "\n", pl.Data) } + putPayload(pl) }() if !(pl.LType == sessdata.LTypeIPData && pl.PType == 0x00) { @@ -125,19 +125,16 @@ func logAudit(userName string, pl *sessdata.Payload) { default: return } - - ipSrc := waterutil.IPv4Source(pl.Data) - ipDst := waterutil.IPv4Destination(pl.Data) - // ipPort := waterutil.IPv4DestinationPort(pl.Data) - // 修复 panic: runtime error: index out of range [2] with length 2 + // 修复 panic: runtime error: index out of range [2] / range [3] ipPl := waterutil.IPv4Payload(pl.Data) - if len(ipPl) < 3 { - base.Error("ipPl len < 3", pl.Data) + if len(ipPl) < 4 { + base.Error("ipPl len < 4", ipPl, pl.Data) return } ipPort := (uint16(ipPl[2]) << 8) | uint16(ipPl[3]) - + ipSrc := waterutil.IPv4Source(pl.Data) + ipDst := waterutil.IPv4Destination(pl.Data) b := getByte51() key := *b copy(key[:16], ipSrc) @@ -193,7 +190,6 @@ func logAudit(userName string, pl *sessdata.Payload) { AccessProto: accessProto, Info: info, } - select { case logBatch.LogChan <- audit: default: From 8e843d5eaed90c32323244651cc1d09bd5871238 Mon Sep 17 00:00:00 2001 From: lanrenwo Date: Fri, 8 Sep 2023 21:01:03 +0800 Subject: [PATCH 11/37] Update payload_access_audit.go --- server/handler/payload_access_audit.go | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/server/handler/payload_access_audit.go b/server/handler/payload_access_audit.go index 99efa24..a3cc0c2 100644 --- a/server/handler/payload_access_audit.go +++ b/server/handler/payload_access_audit.go @@ -125,8 +125,7 @@ func logAudit(userName string, pl *sessdata.Payload) { default: return } - // ipPort := waterutil.IPv4DestinationPort(pl.Data) - // 修复 panic: runtime error: index out of range [2] / range [3] + // IP报文只包含头部信息时, 则打印LOG，并退出 ipPl := waterutil.IPv4Payload(pl.Data) if len(ipPl) < 4 { base.Error("ipPl len < 4", ipPl, pl.Data) From bbc5877eb9dd72e71d48a06f553d7b0bbf78caf5 Mon Sep 17 00:00:00 2001 From: bjdgyc Date: Fri, 22 Sep 2023 16:18:38 +0800 Subject: [PATCH 12/37] =?UTF-8?q?=E4=BF=AE=E5=A4=8Dheader?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- server/conf/profile.xml | 11 ++++++++++- server/pkg/utils/secure_header.go | 8 ++++---- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/server/conf/profile.xml b/server/conf/profile.xml index 0df0912..81645b8 100644 --- a/server/conf/profile.xml +++ b/server/conf/profile.xml @@ -8,6 +8,7 @@ false IPSec true + false AllowRemoteUsers AllowRemoteUsers pinAllowed @@ -21,14 +22,22 @@ - localhost + localhost-bak + VPN Server localhost + + + VPN Server2 + localhost2 + + + \ No newline at end of file diff --git a/server/pkg/utils/secure_header.go b/server/pkg/utils/secure_header.go index f323693..f31dbe1 100644 --- a/server/pkg/utils/secure_header.go +++ b/server/pkg/utils/secure_header.go @@ -13,17 +13,17 @@ func SetSecureHeader(w http.ResponseWriter) { w.Header().Set("Cache-Control", "no-store,no-cache") w.Header().Set("Pragma", "no-cache") w.Header().Set("Connection", "keep-alive") - w.Header().Set("X-Frame-Options", "deny") + w.Header().Set("X-Frame-Options", "SAMEORIGIN") w.Header().Set("X-Content-Type-Options", "nosniff") w.Header().Set("X-Download-Options", "noopen") - w.Header().Set("Content-Security-Policy", "default-src 'self' 'unsafe-inline'") + w.Header().Set("Content-Security-Policy", "default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob:; frame-ancestors 'self'; base-uri 'self'; block-all-mixed-content") w.Header().Set("X-Permitted-Cross-Domain-Policies", "none") w.Header().Set("Referrer-Policy", "no-referrer") w.Header().Set("Cross-Origin-Embedder-Policy", "require-corp") w.Header().Set("Cross-Origin-Opener-Policy", "same-origin") w.Header().Set("Cross-Origin-Resource-Policy", "same-origin") - w.Header().Set("X-XSS-Protection", "0") - w.Header().Set("Strict-Transport-Security", "max-age=31536000") + w.Header().Set("X-XSS-Protection", "1") + w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains") // w.Header().Set("Clear-Site-Data", "cache,cookies,storage") } From 012f636cf7856c5874a840c1eee6c908253b4782 Mon Sep 17 00:00:00 2001 From: bjdgyc Date: Wed, 11 Oct 2023 10:19:23 +0800 Subject: [PATCH 13/37] =?UTF-8?q?=E4=BF=AE=E6=94=B9=20profile.xml?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- server/conf/profile.xml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/server/conf/profile.xml b/server/conf/profile.xml index 81645b8..914f53d 100644 --- a/server/conf/profile.xml +++ b/server/conf/profile.xml @@ -21,23 +21,19 @@ - - localhost-bak - - VPN Server + VPN localhost - VPN Server2 + VPN2 localhost2 - \ No newline at end of file From ebc7cc85c0969d71598bb9d87af35b2b2895ad81 Mon Sep 17 00:00:00 2001 From: bjdgyc Date: Wed, 11 Oct 2023 16:00:53 +0800 Subject: [PATCH 14/37] =?UTF-8?q?=E6=B7=BB=E5=8A=A0nginx=20stream=E7=A4=BA?= =?UTF-8?q?=E4=BE=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- doc/question.md | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/doc/question.md b/doc/question.md index 190da8a..82334c2 100644 --- a/doc/question.md +++ b/doc/question.md @@ -46,6 +46,34 @@ stream { } ``` +> nginx实现 共用443端口 示例 + +```conf +stream { + map $ssl_preread_server_name $name { + vpn.xx.com myvpn; + default defaultpage; + } + + # upstream pool + upstream myvpn { + server 127.0.0.1:8443; + } + upstream defaultpage { + server 127.0.0.1:8080; + } + + server { + listen 443 so_keepalive=on; + ssl_preread on; + #接收端也需要设置 proxy_protocol + #proxy_protocol on; + proxy_pass $name; + } +} + +``` + ### 性能问题 ``` 内网环境测试数据 From 06c8ee11972a57de4ca48bb5e685968215d8f784 Mon Sep 17 00:00:00 2001 From: bjdgyc Date: Wed, 11 Oct 2023 17:20:57 +0800 Subject: [PATCH 15/37] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=E8=87=AA=E5=AE=9A?= =?UTF-8?q?=E4=B9=89=E9=A6=96=E9=A1=B5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- home/自定义首页1.html | 101 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 101 insertions(+) create mode 100644 home/自定义首页1.html diff --git a/home/自定义首页1.html b/home/自定义首页1.html new file mode 100644 index 0000000..9c8f8f9 --- /dev/null +++ b/home/自定义首页1.html @@ -0,0 +1,101 @@ + + + + + AnyLink - 企业级远程办公 SSL VPN + + + +
+

欢迎使用 AnyLink

+
+ +
+

什么是 AnyLink？

+

AnyLink 是一款面向企业级的远程办公 SSL VPN 软件，支持多人同时在线使用。它提供安全、便捷的访问内部网络资源的方式，使远程工作者能够有效协作。

+ +

核心功能

+
    +
  • 安全远程访问：AnyLink 使用 SSL/TLS 加密技术，确保远程用户与企业网络之间的连接安全可靠。
    • +
  • 多用户支持：多个用户可以同时连接 VPN，实现不同地点团队的无缝协作。
    • +
  • 灵活网络访问：AnyLink 能够安全地让远程工作者访问内部资源，如文件、应用程序和数据库。
    • +
  • 集中化管理：该 VPN 解决方案提供集中化管理控制台，便于用户管理、访问控制和监控。
    • +
+ +

开始使用 AnyLink

+

体验 AnyLink 为您的企业远程办公需求所带来的便利和安全。

+ +

下载客户端

+ Windows 客户端 + Mac 客户端 + + iOS 客户端 + Android 客户端 + + Android FreeOTP客户端 + iOS FreeOTP客户端 +

使用手册

+ 使用手册(Windows) +
+ +
+ © 2023 AnyLink. 保留所有权利。 +
+ + From 6eea265b15f3a6bb0014275130194ae3c575aa3d Mon Sep 17 00:00:00 2001 From: bjdgyc Date: Wed, 11 Oct 2023 17:21:26 +0800 Subject: [PATCH 16/37] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=E8=87=AA=E5=AE=9A?= =?UTF-8?q?=E4=B9=89=E9=A6=96=E9=A1=B5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- home/自定义首页1.html | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/home/自定义首页1.html b/home/自定义首页1.html index 9c8f8f9..171febc 100644 --- a/home/自定义首页1.html +++ b/home/自定义首页1.html @@ -82,16 +82,16 @@

体验 AnyLink 为您的企业远程办公需求所带来的便利和安全。

下载客户端

- Windows 客户端 - Mac 客户端 + Windows 客户端 + Mac 客户端 iOS 客户端 - Android 客户端 + Android 客户端 - Android FreeOTP客户端 + Android FreeOTP客户端 iOS FreeOTP客户端

使用手册

- 使用手册(Windows) + 使用手册(Windows)