7x31
/
anylink
mirror of https://github.com/bjdgyc/anylink.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

新增radius认证方式

This commit is contained in:
lanrenwo 2022-06-02 17:58:22 +08:00
parent d4f266de66
commit e9c55a0853
6 changed files with 168 additions and 41 deletions
server
admin
api_group.go
dbdata
group.gotables.gouser.go
go.mod
web/src/pages/group
List.vue

4
server/admin/api_group.go
View File

@ -62,7 +62,9 @@ func GroupDetail(w http.ResponseWriter, r *http.Request) {
RespError(w, RespInternalErr, err)
return
}
if len(data.Auth) == 0 {
data.Auth["type"] = "local"
}
RespSucess(w, data)
}

70
server/dbdata/group.go
View File

@ -1,6 +1,7 @@
package dbdata
import (
"encoding/json"
"errors"
"fmt"
"net"
@ -32,19 +33,27 @@ type ValData struct {
Note string `json:"note"`
}
type AuthRadius struct {
Addr string `json:"addr"`
Secret string `json:"secret"`
}
// type Group struct {
// Id int `json:"id" xorm:"pk autoincr not null"`
// Name string `json:"name" xorm:"not null unique"`
// Note string `json:"note"`
// AllowLan bool `json:"allow_lan"`
// ClientDns []ValData `json:"client_dns"`
// RouteInclude []ValData `json:"route_include"`
// RouteExclude []ValData `json:"route_exclude"`
// LinkAcl []GroupLinkAcl `json:"link_acl"`
// Bandwidth int `json:"bandwidth"` // 带宽限制
// Status int8 `json:"status"` // 1正常
// CreatedAt time.Time `json:"created_at"`
// UpdatedAt time.Time `json:"updated_at"`
// Id int `json:"id" xorm:"pk autoincr not null"`
// Name string `json:"name" xorm:"varchar(60) not null unique"`
// Note string `json:"note" xorm:"varchar(255)"`
// AllowLan bool `json:"allow_lan" xorm:"Bool"`
// ClientDns []ValData `json:"client_dns" xorm:"Text"`
// RouteInclude []ValData `json:"route_include" xorm:"Text"`
// RouteExclude []ValData `json:"route_exclude" xorm:"Text"`
// DsExcludeDomains string `json:"ds_exclude_domains" xorm:"Text"`
// DsIncludeDomains string `json:"ds_include_domains" xorm:"Text"`
// LinkAcl []GroupLinkAcl `json:"link_acl" xorm:"Text"`
// Bandwidth int `json:"bandwidth" xorm:"Int"` // 带宽限制
// Auth map[string]interface{} `json:"auth" xorm:"not null default '{}' varchar(255)"` // 认证方式
// Status int8 `json:"status" xorm:"Int"` // 1正常
// CreatedAt time.Time `json:"created_at" xorm:"DateTime created"`
// UpdatedAt time.Time `json:"updated_at" xorm:"DateTime updated"`
// }
func GetGroupNames() []string {
@ -145,6 +154,20 @@ func SetGroup(g *Group) error {
if err != nil {
return errors.New("排除域名有误：" + err.Error())
}
// 处理认证类型
switch g.Auth["type"] {
case "local":
g.Auth = map[string]interface{}{
"type": g.Auth["type"],
}
case "radius":
err = checkRadiusData(g.Auth)
if err != nil {
return err
}
default:
return errors.New("未知的认证类型")
}
g.UpdatedAt = time.Now()
if g.Id > 0 {
@ -167,6 +190,24 @@ func parseIpNet(s string) (string, *net.IPNet, error) {
return ipMask, ipNet, nil
}
func checkRadiusData(auth map[string]interface{}) error {
radisConf := AuthRadius{}
bodyBytes, err := json.Marshal(auth["radius"])
if err != nil {
return errors.New("Radius的密钥/服务器地址填写有误")
}
json.Unmarshal(bodyBytes, &radisConf)
if !ValidateIpPort(radisConf.Addr) {
return errors.New("Radius的服务器地址填写有误")
}
// freeradius官网最大8000字符, 这里限制800
if len(radisConf.Secret) < 8 || len(radisConf.Secret) > 800 {
return errors.New("Radius的密钥长度需在8～800个字符之间")
}
return nil
}
func CheckDomainNames(domains string) error {
if domains == "" {
return nil
@ -187,3 +228,8 @@ func ValidateDomainName(domain string) bool {
RegExp := regexp.MustCompile(`^([a-zA-Z0-9][-a-zA-Z0-9]{0,62}\.)+[A-Za-z]{2,18}$`)
return RegExp.MatchString(domain)
}
func ValidateIpPort(addr string) bool {
RegExp := regexp.MustCompile(`^(\d{1,2}|1\d\d|2[0-4]\d|25[0-5])\.(\d{1,2}|1\d\d|2[0-4]\d|25[0-5])\.(\d{1,2}|1\d\d|2[0-4]\d|25[0-5])\.(\d{1,2}|1\d\d|2[0-4]\d|25[0-5])\:([0-9]|[1-9]\d{1,3}|[1-5]\d{4}|6[0-5]{2}[0-3][0-5])$$`)
return RegExp.MatchString(addr)
}

29
server/dbdata/tables.go
View File

@ -6,20 +6,21 @@ import (
)
type Group struct {
Id int `json:"id" xorm:"pk autoincr not null"`
Name string `json:"name" xorm:"varchar(60) not null unique"`
Note string `json:"note" xorm:"varchar(255)"`
AllowLan bool `json:"allow_lan" xorm:"Bool"`
ClientDns []ValData `json:"client_dns" xorm:"Text"`
RouteInclude []ValData `json:"route_include" xorm:"Text"`
RouteExclude []ValData `json:"route_exclude" xorm:"Text"`
DsExcludeDomains string `json:"ds_exclude_domains" xorm:"Text"`
DsIncludeDomains string `json:"ds_include_domains" xorm:"Text"`
LinkAcl []GroupLinkAcl `json:"link_acl" xorm:"Text"`
Bandwidth int `json:"bandwidth" xorm:"Int"` // 带宽限制
Status int8 `json:"status" xorm:"Int"` // 1正常
CreatedAt time.Time `json:"created_at" xorm:"DateTime created"`
UpdatedAt time.Time `json:"updated_at" xorm:"DateTime updated"`
Id int `json:"id" xorm:"pk autoincr not null"`
Name string `json:"name" xorm:"varchar(60) not null unique"`
Note string `json:"note" xorm:"varchar(255)"`
AllowLan bool `json:"allow_lan" xorm:"Bool"`
ClientDns []ValData `json:"client_dns" xorm:"Text"`
RouteInclude []ValData `json:"route_include" xorm:"Text"`
RouteExclude []ValData `json:"route_exclude" xorm:"Text"`
DsExcludeDomains string `json:"ds_exclude_domains" xorm:"Text"`
DsIncludeDomains string `json:"ds_include_domains" xorm:"Text"`
LinkAcl []GroupLinkAcl `json:"link_acl" xorm:"Text"`
Bandwidth int `json:"bandwidth" xorm:"Int"` // 带宽限制
Auth map[string]interface{} `json:"auth" xorm:"not null default '{}' varchar(255)"` // 认证方式
Status int8 `json:"status" xorm:"Int"` // 1正常
CreatedAt time.Time `json:"created_at" xorm:"DateTime created"`
UpdatedAt time.Time `json:"updated_at" xorm:"DateTime updated"`
}
type User struct {

53
server/dbdata/user.go
View File

@ -1,13 +1,18 @@
package dbdata
import (
"context"
"encoding/json"
"errors"
"fmt"
"sync"
"time"
"github.com/bjdgyc/anylink/base"
"github.com/bjdgyc/anylink/pkg/utils"
"github.com/xlzd/gotp"
"layeh.com/radius"
"layeh.com/radius/rfc2865"
)
// type User struct {
@ -68,6 +73,38 @@ func SetUser(v *User) error {
// 验证用户登陆信息
func CheckUser(name, pwd, group string) error {
// 获取登入的group数据
groupData := &Group{}
err := One("Name", group, groupData)
if err != nil {
return fmt.Errorf("%s %s", name, "No用户组")
}
if len(groupData.Auth) == 0 {
groupData.Auth["type"] = "local"
}
base.Debug(name + " auth type: " + fmt.Sprintf("%s", groupData.Auth["type"]))
switch groupData.Auth["type"] {
case "local":
return checkLocalUser(name, pwd, group)
case "radius":
radisConf := AuthRadius{}
bodyBytes, err := json.Marshal(groupData.Auth["radius"])
if err != nil {
fmt.Errorf("%s %s", name, "Radius出现Marshal错误")
}
err = json.Unmarshal(bodyBytes, &radisConf)
if err != nil {
fmt.Errorf("%s %s", name, "Radius出现Unmarshal错误")
}
return checkRadiusUser(name, pwd, radisConf)
default:
return fmt.Errorf("%s %s", name, "无效的认证类型")
}
return nil
}
// 验证本地用户登陆信息
func checkLocalUser(name, pwd, group string) error {
// TODO 严重问题
// return nil
@ -108,6 +145,22 @@ func CheckUser(name, pwd, group string) error {
return nil
}
func checkRadiusUser(name string, pwd string, raduisConf AuthRadius) error {
packet := radius.New(radius.CodeAccessRequest, []byte(raduisConf.Secret))
rfc2865.UserName_SetString(packet, name)
rfc2865.UserPassword_SetString(packet, pwd)
ctx, done := context.WithTimeout(context.Background(), 3*time.Second)
defer done()
response, err := radius.Exchange(ctx, packet, raduisConf.Addr)
if err != nil {
return fmt.Errorf("%s %s", name, "Radius服务器连接异常, 请检测服务器和端口")
}
if response.Code != radius.CodeAccessAccept {
return fmt.Errorf("%s %s", name, "Radius：用户名或密码错误")
}
return nil
}
var (
userOtpMux = sync.Mutex{}
userOtp = map[string]time.Time{}

1
server/go.mod
View File

@ -25,6 +25,7 @@ require (
golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97
golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d
golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac
layeh.com/radius v0.0.0-20210819152912-ad72663a72ab
xorm.io/xorm v1.2.2
)

52
web/src/pages/group/List.vue
View File

@ -207,6 +207,25 @@
</el-form-item>
</el-tab-pane>
<el-tab-pane label="认证方式" name="authtype">
<el-form-item label="认证" prop="authtype">
<el-radio-group v-model="ruleForm.auth.type">
<el-radio label="local" border>本地</el-radio>
<el-radio label="radius" border>Radius</el-radio>
</el-radio-group>
</el-form-item>
<el-form-item label="Radius密钥" v-if="ruleForm.auth.type == 'radius'">
<el-col :span="10">
<el-input v-model="ruleForm.auth.radius.secret"></el-input>
</el-col>
</el-form-item>
<el-form-item label="Radius服务器" v-if="ruleForm.auth.type == 'radius'">
<el-col :span="10">
<el-input v-model="ruleForm.auth.radius.addr" placeholder="输入IP和端口 192.168.2.1:1812"></el-input>
</el-col>
</el-form-item>
</el-tab-pane>
<el-tab-pane label="路由设置" name="route">
<el-form-item label="包含路由" prop="route_include">
<el-row class="msg-info">
@ -300,7 +319,7 @@
<el-button type="primary" @click="submitForm('ruleForm')">保存</el-button>
<el-button @click="disVisible">取消</el-button>
</el-form-item>
</el-form>
</el-form>
</el-dialog>
</div>
@ -318,7 +337,8 @@ export default {
this.$emit('update:route_name', ['用户组信息', '用户组列表'])
},
mounted() {
this.getData(1)
this.getData(1);
this.setAuthData();
},
data() {
return {
@ -335,21 +355,17 @@ export default {
route_include: [{val: 'all', note: '默认全局代理'}],
route_exclude: [],
link_acl: [],
auth : {"type":'local'}
},
rules: {
name: [
{required: true, message: '请输入用户名', trigger: 'blur'},
{required: true, message: '请输入组名', trigger: 'blur'},
{max: 30, message: '长度小于 30 个字符', trigger: 'blur'}
],
bandwidth: [
{required: true, message: '请输入用户姓名', trigger: 'blur'},
{type: 'number', message: '年龄必须为数字值'}
{required: true, message: '请输入带宽限制', trigger: 'blur'},
{type: 'number', message: '带宽限制必须为数字值'}
],
email: [
{required: true, message: '请输入用户邮箱', trigger: 'blur'},
{type: 'email', message: '请输入正确的邮箱地址', trigger: ['blur', 'change']}
],
status: [
{required: true}
],
@ -357,6 +373,14 @@ export default {
}
},
methods: {
setAuthData(row) {
var defAuthData = {"type":'local',
"radius":{"addr":"", "secret":""},
}
if (this.ruleForm.auth.type == "local" || !row) {
this.ruleForm.auth = defAuthData;
}
},
handleDel(row) {
axios.post('/group/del?id=' + row.id).then(resp => {
const rdata = resp.data;
@ -378,15 +402,16 @@ export default {
this.activeTab = "general"
this.user_edit_dialog = true
if (!row) {
this.setAuthData(row)
return;
}
axios.get('/group/detail', {
params: {
id: row.id,
}
}).then(resp => {
this.ruleForm = resp.data.data
this.ruleForm = resp.data.data;
this.setAuthData(resp.data.data);
}).catch(error => {
this.$message.error('哦，请求出错');
console.log(error);
@ -426,12 +451,11 @@ export default {
arr.push({val: "", action: "allow", port: 0});
},
submitForm(formName) {
this.$refs[formName].validate((valid) => {
this.$refs[formName].validate((valid, obj) => {
if (!valid) {
console.log('error submit!!');
return false;
}
axios.post('/group/set', this.ruleForm).then(resp => {
const rdata = resp.data;
if (rdata.code === 0) {