Merge pull request #92 from bjdgyc/dev

Dev

Dockerfile

@@ -2,12 +2,12 @@
 FROM node:lts-alpine as builder_node
 WORKDIR /web
 COPY ./web /web
-RUN npm install --registry=https://registry.npm.taobao.org \
-    && npm run build \
+RUN yarn install \
+    && yarn run build \
     && ls /web/ui
 
 # server
-FROM golang:1.16-alpine as builder_golang
+FROM golang:1.17-alpine as builder_golang
 #TODO 本地打包时使用镜像
 ENV GOPROXY=https://goproxy.io
 ENV GOOS=linux

README.md

@@ -30,16 +30,6 @@ AnyLink 服务端仅在 CentOS 7、Ubuntu 18.04 测试通过，如需要安装
 
 ![online](doc/screenshot/online.jpg)
 
-## Donate
-
-> 如果您觉得 anylink 对你有帮助，欢迎给我们打赏，也是帮助 anylink 更好的发展。
->
-> [查看打赏列表](doc/README.md)
-
-<p>
-    <img src="doc/screenshot/wxpay2.png" width="400" />
-</p>
-
 ## Installation
 
 > 没有编程基础的同学建议直接下载 release 包，从下面的地址下载 anylink-deploy.tar.gz
@@ -56,7 +46,7 @@ AnyLink 服务端仅在 CentOS 7、Ubuntu 18.04 测试通过，如需要安装
 
 ### 自行编译安装
 
-> 需要提前安装好 golang >= 1.16 和 nodejs >= 14.x
+> 需要提前安装好 golang >= 1.17 和 nodejs >= 14.x 和 yarn >= v1.22.x
 
 ```shell
 git clone https://github.com/bjdgyc/anylink.git
@@ -250,14 +240,15 @@ sh bridge-init.sh
 5. 启动容器
 
    ```bash
+   # -e IPV4_CIDR=192.168.10.0/24 这个参数要与配置文件内的网段一致
    docker run -itd --name anylink --privileged \
+       -e IPV4_CIDR=192.168.10.0/24
        -p 443:443 -p 8800:8800 \
        --restart=always \
        bjdgyc/anylink
    ```
 
 6. 使用自定义参数启动容器
-
    ```bash
    # 参数可以参考 -h 命令
    docker run -itd --name anylink --privileged \
@@ -277,6 +268,16 @@ sh bridge-init.sh
    docker build -t anylink .
    ```
 
+## Donate
+
+> 如果您觉得 anylink 对你有帮助，欢迎给我们打赏，也是帮助 anylink 更好的发展。
+>
+> [查看打赏列表](doc/README.md)
+
+<p>
+    <img src="doc/screenshot/wxpay2.png" width="400" />
+</p>
+
 ## 常见问题
 
 请前往 [问题地址](doc/question.md) 查看具体信息

build.sh

@@ -16,9 +16,13 @@ echo "编译前端项目"
 cd $cpath/web
 #国内可替换源加快速度
 #npx browserslist@latest --update-db
-npm install --registry=https://registry.npm.taobao.org
+#npm install --registry=https://registry.npm.taobao.org
 #npm install
-npm run build
+#npm run build
+
+yarn install
+yarn run build
+
 RETVAL $?
 
 echo "编译二进制文件"

server/admin/server.go

@@ -2,6 +2,7 @@
 package admin
 
 import (
+	"crypto/tls"
 	"embed"
 	"net/http"
 	"net/http/pprof"
@@ -69,7 +70,25 @@ func StartAdmin() {
 	}
 
 	base.Info("Listen admin", base.Cfg.AdminAddr)
-	err := http.ListenAndServeTLS(base.Cfg.AdminAddr, base.Cfg.CertFile, base.Cfg.CertKey, r)
+
+	// 修复 CVE-2016-2183
+	cipherSuites := tls.CipherSuites()
+	selectedCipherSuites := make([]uint16, 0, len(cipherSuites))
+	for _, s := range cipherSuites {
+		selectedCipherSuites = append(selectedCipherSuites, s.ID)
+	}
+	// 设置tls信息
+	tlsConfig := &tls.Config{
+		NextProtos:   []string{"http/1.1"},
+		MinVersion:   tls.VersionTLS12,
+		CipherSuites: selectedCipherSuites,
+	}
+	srv := &http.Server{
+		Addr:      base.Cfg.AdminAddr,
+		Handler:   r,
+		TLSConfig: tlsConfig,
+	}
+	err := srv.ListenAndServeTLS(base.Cfg.CertFile, base.Cfg.CertKey)
 	if err != nil {
 		base.Fatal(err)
 	}

server/base/app_ver.go

@@ -2,6 +2,6 @@ package base
 
 const (
 	APP_NAME = "AnyLink"
-	// 修复前端bug
-	APP_VER = "0.7.3"
+	// 修复 CVE-2016-2183
+	APP_VER = "0.7.4"
 )

server/dbdata/db.go

@@ -111,7 +111,7 @@ func addInitData() error {
 		Name:         "ops",
 		AllowLan:     true,
 		ClientDns:    []ValData{{Val: "114.114.114.114"}},
-		RouteInclude: []ValData{{Val: "10.0.0.0/8"}},
+		RouteInclude: []ValData{{Val: All}},
 	}
 	err = SetGroup(&g1)
 	if err != nil {

server/handler/server.go

@@ -20,9 +20,6 @@ func startTls() {
 		err error
 
 		addr = base.Cfg.ServerAddr
-		certFile = base.Cfg.CertFile
-		keyFile  = base.Cfg.CertKey
-		certs    = make([]tls.Certificate, 1)
 		ln   net.Listener
 	)
 
@@ -36,16 +33,20 @@ func startTls() {
 	//	certs[0], err = tls.LoadX509KeyPair(certFile, keyFile)
 	// }
 
-	certs[0], err = tls.LoadX509KeyPair(certFile, keyFile)
-	if err != nil {
-		panic(err)
+	// 修复 CVE-2016-2183
+	// https://segmentfault.com/a/1190000038486901
+	// nmap -sV --script ssl-enum-ciphers -p 443 www.example.com
+	cipherSuites := tls.CipherSuites()
+	selectedCipherSuites := make([]uint16, 0, len(cipherSuites))
+	for _, s := range cipherSuites {
+		selectedCipherSuites = append(selectedCipherSuites, s.ID)
 	}
 
 	// 设置tls信息
 	tlsConfig := &tls.Config{
 		NextProtos:   []string{"http/1.1"},
 		MinVersion:   tls.VersionTLS12,
-		Certificates: certs,
+		CipherSuites: selectedCipherSuites,
 		// InsecureSkipVerify: true,
 	}
 	srv := &http.Server{
@@ -66,7 +67,7 @@ func startTls() {
 	}
 
 	base.Info("listen server", addr)
-	err = srv.ServeTLS(ln, "", "")
+	err = srv.ServeTLS(ln, base.Cfg.CertFile, base.Cfg.CertKey)
 	if err != nil {
 		base.Fatal(err)
 	}