Merge pull request #297 from bjdgyc/dev

添加otp说明文字

.codecov.yml

@@ -0,0 +1,7 @@
+ignore:
+  - "^doc"
+  - "^home"
+  - "^web"
+  - "^server/conf"
+  - "^server/files"
+

.github/FUNDING.yml

@@ -0,0 +1,13 @@
+# These are supported funding model platforms
+
+github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+otechie: # Replace with a single Otechie username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+custom: [ 'https://github.com/bjdgyc/anylink/blob/main/doc/README.md' ] # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

.github/ISSUE_TEMPLATE/00-question.md

@@ -0,0 +1,35 @@
+---
+name: 问题描述
+about: 问题描述
+title: "affected/package: "
+---
+
+<!--
+请先填写下面的问题，再填写具体遇到的问题，感谢！
+-->
+
+### 使用的anylink版本 ?
+
+<pre>
+./anylink tool -v
+管理后台也可以查看
+</pre>
+
+
+### 使用操作系统的类型和版本?
+如： centos 7.9
+<pre>
+cat /etc/issue
+cat /etc/redhat-release
+
+</pre>
+
+### 使用linux 内核版本?
+<pre>
+uname -a
+
+</pre>
+
+### 具体遇到的问题，可上传截图
+
+

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,73 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '32 5 * * 1'
+#  push:
+#    branches: [ "main", "dev" ]
+#  pull_request:
+#    branches: [ "main", "dev" ]
+
+
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'go', 'javascript' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
+        # Learn more:
+        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+          # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 https://git.io/JvXDl
+
+      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+      #    and modify them (or add more) to build your code if your project
+      #    uses a compiled language
+
+      #- run: |
+      #   make bootstrap
+      #   make release
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2

.github/workflows/go-update.yml

@@ -0,0 +1,48 @@
+name: go-update
+on:
+  workflow_dispatch:
+#  schedule:
+#    - cron: "1 2 * * 5"
+
+jobs:
+  go:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Setup Go 1.x.y
+        uses: actions/setup-go@main
+        with:
+          go-version: '1.20'
+          stable: true
+
+      - name: Checkout codebase
+        uses: actions/checkout@main
+
+      - name: go
+        run: |
+          cd ./server
+          go mod tidy -compat=1.20
+          #gofmt -w -r 'interface{} -> any' .
+          go get -u
+          go mod download
+          go get -u
+          go mod download
+
+      - name: Git push
+        run: |
+          git init
+          git config --local user.name "github-actions[bot]"
+          git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git remote rm origin
+          git remote add origin "https://${{ github.actor }}:${{ secrets.GITHUBTOKEN }}@github.com/${{ github.repository }}"
+          git gc --aggressive
+          git add --all
+          git commit -m "update go.mod $(date +%Y.%m.%d.%H.%M)"
+          #git push -f -u origin _autoaction
+          git push -u origin _autoaction
+
+      # 删除无用 workflow runs;
+      - name: Delete workflow runs
+        uses: GitRML/delete-workflow-runs@main
+        with:
+          retain_days: 0.1
+          keep_minimum_runs: 1

.github/workflows/go.yml

@@ -1,10 +1,12 @@
 name: Go
 
 on:
+  workflow_dispatch:
+
   push:
-    branches: [ master ]
+    branches: [ "main", "dev" ]
   pull_request:
-    branches: [ master ]
+    branches: [ "main", "dev" ]
 
 jobs:
 
@@ -12,22 +14,36 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@v4
 
       - name: Set up Go 1.x
-      uses: actions/setup-go@v2
+        uses: actions/setup-go@v4
         with:
-        go-version: 1.16
+          go-version: '1.20'
-      id: go
+          go-version-file: 'server/go.mod'
-
+          cache-dependency-path: 'server/go.sum'
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v2
 
       - name: Get dependencies
         run: |
+          cd server
           go get -v -t -d ./...
 
       - name: Build
-      run: go build -v .
+        run: |
+          cd server
+          mkdir ui
+          touch ui/index.html
+          go build -v -o anylink -trimpath -ldflags "-X main.CommitId=`git rev-parse HEAD`"
+          ./anylink tool -v
 
-    - name: Test
+      - name: Test coverage
-      run: go test -v .
+        run: |
+          cd server
+          go test ./...
+          go test -race -coverprofile=coverage.txt -covermode=atomic -v ./...
+
+      - name: Upload coverage reports to Codecov
+        uses: codecov/codecov-action@v3
+        env:
+          CODECOV_TOKEN: 28d52fb0-8fc9-460f-95b9-fb84f9138e58

.github/workflows/release.yml

@@ -0,0 +1,98 @@
+name: release
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "v0.*"
+      - "v1.*"
+
+jobs:
+  Build:
+    name: build-binary
+    runs-on: ubuntu-latest
+    env:
+      TZ: Asia/Shanghai
+    steps:
+      - name: Hello world
+        run: uname -a
+
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '16'
+          cache: 'yarn'
+          cache-dependency-path: 'web/yarn.lock'
+      - name: Build web
+        working-directory: web
+        run: |
+          yarn install
+          yarn run build
+      #      - uses: actions/setup-go@v4
+      #        with:
+      #          go-version: '1.20'
+      #          cache-dependency-path: 'server/go.sum'
+
+      - name: Set up QEMU
+        # https://github.com/docker/setup-qemu-action
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: bjdgyc
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          logout: true
+
+      - name: Pre bash
+        shell: bash
+        run: |
+          appVer=`cat version`
+          commitId=`git rev-parse HEAD`
+          echo "APP_VER=$appVer" >> $GITHUB_ENV
+          echo "commitId=$commitId" >> $GITHUB_ENV
+          
+          echo $appVer > version_info
+          echo $commitId >> version_info
+          echo $GITHUB_REF >> version_info
+          echo $GITHUB_REF_NAME >> version_info
+          
+          #cd server;go mod tidy
+
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          push: true
+          cache-from: type=gha,scope=anylink
+          cache-to: type=gha,mode=max,scope=anylink
+          context: .
+          file: ./docker/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          #platforms: linux/amd64
+          build-args: |
+            appVer=${{ env.APP_VER }}
+            commitId=${{ env.commitId }}
+          tags: bjdgyc/anylink:${{ env.APP_VER }},bjdgyc/anylink:latest
+          #tags: bjdgyc/anylink:${{ env.APP_VER }}
+
+      - name: Build deploy binary
+        shell: bash
+        run: bash release.sh
+
+      - name: Release
+        # https://github.com/ncipollo/release-action
+        # artifacts: bin/release/*
+        # generateReleaseNotes: true
+        # draft: true
+        # https://github.com/softprops/action-gh-release
+        uses: softprops/action-gh-release@v1
+        #if: startsWith(github.ref, 'refs/tags/')
+        with:
+          tag_name: v${{ env.APP_VER }}
+          files: artifact-dist/*
+
+#  Docker:
+#    name: build-docker

.gitignore

@@ -1,19 +1,12 @@
 # Binaries for programs and plugins
-*.exe
-*.exe~
-*.dll
-*.so
-*.dylib
-
-# Test binary, built with `go test -c`
-*.test
-
-# Output of the go coverage tool, specifically when used with LiteIDE
-*.out
-
-# Dependency directories (remove the comment below to include it)
-vendor/
-
-ui/
 .idea/
+anylink-deploy
+anylink-deploy.tar.gz
 anylink
+anylink.db
+
+dist
+artifact-dist
+
+anylink_amd64
+anylink_arm64

.goreleaser.yaml

@@ -0,0 +1,104 @@
+#https://goreleaser.com/static/schema.json
+
+# release --skip=publish
+
+# goreleaser build --skip=validate --clean --debug
+
+# GOPROXY=https://goproxy.cn
+
+# docker run -it --rm -v $PWD:/app -v /go:/go -w /app --platform=linux/arm64 golang:alpine3.19
+
+# docker run -it --rm -v $PWD:/app -v /go:/go -w /app goreleaser/goreleaser-cross build --skip=validate --clean --debug
+
+# docker run -it --rm -v $PWD:/app -v /go:/go -w /app bjdgyc/dcross goreleaser build --skip=validate --clean --debug
+
+version: 1
+
+dist: dist
+
+before:
+  hooks:
+    - pwd
+#    - cmd: go mod tidy
+#      dir:
+#        "{{ dir .Dist}}"
+#      output: true
+#    - cmd: go generate
+#      dir:
+#        "{{ dir .Dist}}"
+#      output: true
+
+builds:
+  - id: "build"
+    #main: .
+    dir: ./server
+    hooks:
+      pre:
+        - cmd: go mod tidy
+          dir: ./server
+          output: true
+        - cmd: go generate
+          dir: ./server
+          output: true
+    # {{- if eq .Arch "amd64" }}CC=x86_64-linux-gnu-gcc CXX=x86_64-linux-gnu-g++{{- end }}
+    env:
+      - CGO_ENABLED=1
+      - >-
+        {{- if eq .Os "linux" }}
+          {{- if eq .Arch "amd64" }}CC=x86_64-linux-musl-gcc{{- end }}
+        
+          {{- if eq .Arch "arm64" }}CC=aarch64-linux-gnu-gcc{{- end }}
+        {{- end }}
+        {{- if eq .Os "darwin" }}
+          {{- if eq .Arch "amd64"}}CC=o64-clang{{- end }}
+          {{- if eq .Arch "arm64"}}CC=oa64-clang{{- end }}
+        {{- end }}
+        {{- if eq .Os "windows" }}
+          {{- if eq .Arch "amd64"}}CC=x86_64-w64-mingw32-gcc{{- end }}
+          {{- if eq .Arch "arm64"}}CC=aarch64-linux-gnu-gcc{{- end }}
+        {{- end }}
+    goos:
+      - linux
+      #- darwin
+      #- windows
+    goarch:
+      - amd64
+      #- arm64
+    # https://go.dev/wiki/MinimumRequirements
+    goamd64:
+      - v1
+    command: build
+    flags:
+      - -trimpath
+      - -tags osusergo,netgo,sqlite_omit_load_extension
+    ldflags:
+      # go tool link -help
+      # go tool compile -help
+      # -linkmode external
+      # -extld=$CC
+      # -fpic 作为动态链接库的时候 需要添加
+
+      - -s -w -extldflags '-static' -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}} -X main.builtBy=dcross
+
+archives:
+  - id: "archive1"
+    format: tar.gz
+    # this name template makes the OS and Arch compatible with the results of `uname`.
+    name_template: >-
+      {{ .ProjectName }}_
+      {{- title .Os }}_
+      {{- if eq .Arch "amd64" }}x86_64
+      {{- else if eq .Arch "386" }}i386
+      {{- else }}{{ .Arch }}{{ end }}
+      {{- if .Arm }}v{{ .Arm }}{{ end }}
+    # use zip for windows archives
+    format_overrides:
+      - goos: windows
+        format: zip
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"

LICENSE

@@ -1,21 +1,661 @@
-MIT License
+GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
 
-Copyright (c) 2020 bjdgyc
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
+                            Preamble
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
 
-The above copyright notice and this permission notice shall be included in all
+  The GNU Affero General Public License is a free, copyleft license for
-copies or substantial portions of the Software.
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  The licenses for most software and other practical works are designed
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+to take away your freedom to share and change the works.  By contrast,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+our General Public Licenses are intended to guarantee your freedom to
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+share and change all versions of a program--to make sure it remains free
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+software for all its users.
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+
-SOFTWARE.
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

README.md

@@ -1,8 +1,16 @@
 # AnyLink
 
+[![Go](https://github.com/bjdgyc/anylink/workflows/Go/badge.svg?branch=main)](https://github.com/bjdgyc/anylink/actions)
 [![PkgGoDev](https://pkg.go.dev/badge/github.com/bjdgyc/anylink)](https://pkg.go.dev/github.com/bjdgyc/anylink)
+[![Go Report Card](https://goreportcard.com/badge/github.com/bjdgyc/anylink)](https://goreportcard.com/report/github.com/bjdgyc/anylink)
+[![codecov](https://codecov.io/gh/bjdgyc/anylink/graph/badge.svg?token=JTFLIIIBQ0)](https://codecov.io/gh/bjdgyc/anylink)
+![GitHub release](https://img.shields.io/github/v/release/bjdgyc/anylink)
+![GitHub downloads total)](https://img.shields.io/github/downloads/bjdgyc/anylink/total)
+![GitHub Downloads (all assets, latest release)](https://img.shields.io/github/downloads/bjdgyc/anylink/latest/total)
+[![Docker pulls)](https://img.shields.io/docker/pulls/bjdgyc/anylink.svg)](https://hub.docker.com/r/bjdgyc/anylink)
+![LICENSE](https://img.shields.io/github/license/bjdgyc/anylink)
 
-AnyLink 是一个企业级远程办公ssl vpn软件，可以支持多人同时在线使用。
+AnyLink 是一个企业级远程办公 sslvpn 的软件，可以支持多人同时在线使用。
 
 ## Repo
 
@@ -15,132 +23,384 @@ AnyLink 是一个企业级远程办公ssl vpn软件，可以支持多人同时
 AnyLink 基于 [ietf-openconnect](https://tools.ietf.org/html/draft-mavrogiannopoulos-openconnect-02)
 协议开发，并且借鉴了 [ocserv](http://ocserv.gitlab.io/www/index.html) 的开发思路，使其可以同时兼容 AnyConnect 客户端。
 
-AnyLink 使用TLS/DTLS进行数据加密，因此需要RSA或ECC证书，可以通过 Let's Encrypt 和 TrustAsia 申请免费的SSL证书。
+AnyLink 使用 TLS/DTLS 进行数据加密，因此需要 RSA 或 ECC 证书，可以通过 Let's Encrypt 和 TrustAsia 申请免费的 SSL 证书。
 
-AnyLink 服务端仅在CentOS7测试通过，如需要安装在其他系统，需要服务端支持tun/tap功能、ip设置命令。
+AnyLink 服务端仅在 CentOS 7、CentOS 8、Ubuntu 18.04、Ubuntu 20.04 测试通过，如需要安装在其他系统，需要服务端支持 tun/tap
+功能、ip 设置命令。
 
 ## Screenshot
 
-![online](https://gitee.com/bjdgyc/anylink/raw/master/screenshot/online.jpg)
+![online](doc/screenshot/online.jpg)
+
+## Donate
+
+> 如果您觉得 anylink 对你有帮助，欢迎给我们打赏，也是帮助 anylink 更好的发展。
+>
+> [查看打赏列表](doc/README.md)
+
+<p>
+    <img src="doc/screenshot/wxpay2.png" width="400" />
+</p>
 
 ## Installation
 
-> 升级 go version = 1.16
+> 没有编程基础的同学建议直接下载 release 包，从下面的地址下载 anylink-deploy.tar.gz
+>
+> https://github.com/bjdgyc/anylink/releases
+>
+> 如果不会安装，可以提供有偿远程协助服务。添加QQ联系我 68492170
+
+### 使用问题
+
+> 对于测试环境，可以使用 vpn.test.vqilu.cn 绑定host进行测试
+>
+> 对于线上环境，必须申请安全的 https 证书，不支持私有证书连接
+>
+> 服务端安装 yum install iproute 或者 apt-get install iproute2
+>
+> 客户端请使用群共享文件的版本，其他版本没有测试过，不保证使用正常
+>
+> 其他问题 [前往查看](doc/question.md)
+>
+> 默认管理后台访问地址  https://host:8800 或 https://域名:8800 默认账号密码 admin 123456
+>
+> 首次使用，请在浏览器访问  https://域名:443   浏览器提示安全后，在客户端输入 【域名:443】 即可
+
+### 自行编译安装
+
+> 需要提前安装好 golang >= 1.20 和 nodejs = 16.x 和 yarn >= v1.22.x
 
 ```shell
 git clone https://github.com/bjdgyc/anylink.git
 
-cd anylink
+# 编译参考软件版本
-sh deploy.sh
+# go 1.20.12
+# node v16.20.2
+# yarn 1.22.19
 
-#注意使用root权限运行
+
+cd anylink
+sh build.sh
+
+# 注意使用root权限运行
 cd anylink-deploy
-sudo ./anylink -conf="conf/server.toml"
+sudo ./anylink
+
+# 默认管理后台访问地址
+# https://host:8800
+# 默认账号 密码
+# admin 123456
+
+
 ```
 
 ## Feature
 
-- [x] IP分配(实现IP、MAC映射信息的持久化)
+- [x] IP 分配(实现 IP、MAC 映射信息的持久化)
-- [x] TLS-TCP通道
+- [x] TLS-TCP 通道
-- [x] 兼容AnyConnect
+- [x] DTLS-UDP 通道
-- [x] 基于tun设备的nat访问模式
+- [x] 兼容 AnyConnect
-- [x] 基于tap设备的桥接访问模式
+- [x] 兼容 OpenConnect
-- [x] 支持 [proxy protocol v1](http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt) 协议
+- [x] 基于 tun 设备的 nat 访问模式
+- [x] 基于 tap 设备的桥接访问模式
+- [x] 基于 macvtap 设备的桥接访问模式
+- [x] 支持 [proxy protocol v1&v2](http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt) 协议
 - [x] 用户组支持
 - [x] 多用户支持
-- [x] TOTP令牌支持
+- [x] 用户策略支持
-- [x] 流量控制
+- [x] TOTP 令牌支持
+- [x] TOTP 令牌开关
+- [x] 流量速率限制
 - [x] 后台管理界面
-
+- [x] 访问权限管理
-- [ ] 访问权限管理
+- [x] IP 访问审计功能
-- [ ] DTLS-UDP通道
+- [x] 域名动态拆分隧道（域名路由功能）
+- [x] radius认证支持
+- [x] LDAP认证支持
+- [ ] 基于 ipvtap 设备的桥接访问模式
 
 ## Config
 
-默认配置文件内有详细的注释，根据注释填写配置即可。
+> 示例配置文件内有详细的注释，根据注释填写配置即可。
 
 ```shell
+# 查看帮助信息
+./anylink -h
+
 # 生成后台密码
-./anylink -passwd 123456
+./anylink tool -p 123456
 
 # 生成jwt密钥
-./anylink -secret
+./anylink tool -s
+
+# 查看所有配置项
+./anylink tool -d
 ```
 
-[conf/server.toml](https://github.com/bjdgyc/anylink/blob/master/conf/server.toml)
+> 数据库配置示例
+>
+> 数据库表结构自动生成，无需手动导入(请赋予 DDL 权限)
+
+| db_type  | db_source                                              |
+|----------|--------------------------------------------------------|
+| sqlite3  | ./conf/anylink.db                                      |
+| mysql    | user:password@tcp(127.0.0.1:3306)/anylink?charset=utf8 |
+| postgres | user:password@localhost/anylink?sslmode=verify-full    |
+
+> 示例配置文件
+>
+> [conf/server-sample.toml](server/conf/server-sample.toml)
+
+## Upgrade
+
+> 升级前请备份配置文件`conf`目录 和 数据库，并停止服务
+>
+> 使用新版的 `anylink` 二进制文件替换旧版
+>
+> 重启服务后，即可完成升级
 
 ## Setting
 
-网络模式选择，需要配置 `link_mode` 参数，如 `link_mode="tun"`,`link_mode="tap"` 两种参数。 不同的参数需要对服务器做相应的设置。
+> 以下参数必须设置其中之一
 
-建议优先选择tun模式，因客户端传输的是IP层数据，无须进行数据转换。 tap模式是在用户态做的链路层到IP层的数据互相转换，性能会有所下降。 如果需要在虚拟机内开启tap模式，请确认虚拟机的网卡开启混杂模式。
+网络模式选择，需要配置 `link_mode` 参数，如 `link_mode="tun"`,`link_mode="macvtap"`,`link_mode="tap"(不推荐)` 等参数。
+不同的参数需要对服务器做相应的设置。
 
-### tun设置
+建议优先选择 tun 模式，其次选择 macvtap 模式，因客户端传输的是 IP 层数据，无须进行数据转换。 tap 模式是在用户态做的链路层到
+IP 层的数据互相转换，性能会有所下降。 如果需要在虚拟机内开启 tap
+模式，请确认虚拟机的网卡开启混杂模式。
+
+### tun 设置
 
 1. 开启服务器转发
 
- ```shell
+```shell
- # flie: /etc/sysctl.conf
+# file: /etc/sysctl.conf
- net.ipv4.ip_forward = 1
+net.ipv4.ip_forward = 1
 
- #执行如下命令
+#执行如下命令
- sysctl -w net.ipv4.ip_forward=1
+sysctl -w net.ipv4.ip_forward=1
- ```
 
-2. 设置nat转发规则
+# 查看设置是否生效
+cat /proc/sys/net/ipv4/ip_forward
+```
+
+2.1 设置 nat 转发规则(二选一)
 
 ```shell
-# eth0为服务器内网网卡
+systemctl stop firewalld.service
-iptables -t nat -A POSTROUTING -s 192.168.10.0/255.255.255.0 -o eth0 -j MASQUERADE
+systemctl disable firewalld.service
+
+# 新版本支持自动设置nat转发，如有其他需求可以参考下面的命令配置
+
+# 请根据服务器内网网卡替换 eth0
+# iptables -t nat -A POSTROUTING -s 192.168.90.0/24 -o eth0 -j MASQUERADE
+# 如果执行第一个命令不生效，可以继续执行下面的命令
+# iptables -A FORWARD -i eth0 -s 192.168.90.0/24 -j ACCEPT
+# 查看设置是否生效
+# iptables -nL -t nat
 ```
 
-3. 使用AnyConnect客户端连接即可
+2.2 使用全局路由转发(二选一)
 
-### tap设置
+```shell
+# 假设anylink所在服务器的内网ip: 10.1.2.10
 
-1. 创建桥接网卡
+# 首先关闭nat转发功能
+iptables_nat = false
+
+# 传统网络架构，在华三交换机添加以下静态路由规则
+ip route-static 192.168.90.0 255.255.255.0 10.1.2.10
+# 其他品牌的交换机命令，请参考以下地址
+https://cloud.tencent.com/document/product/216/62007
+
+# 公有云环境下，需设置vpc下的路由表，添加以下路由策略
+目的端: 192.168.90.0/24
+下一跳类型: 云服务器
+下一跳: 10.1.2.10
 
-```
-注意 server.toml 的ip参数，需要与 bridge.sh 的配置参数一致
 ```
 
-2. 修改 bridge.sh 内的参数
+3. 使用 AnyConnect 客户端连接即可
+
+### macvtap 设置
+
+1. 设置配置文件
+
+> macvtap 设置相对比较简单，只需要配置相应的参数即可。
+> 以下参数可以通过执行 `ip a` 查看
 
 ```
-# file: ./bridge.sh
+
-eth="eth0"
+# 命令行执行 master网卡需要打开混杂模式
-eth_ip="192.168.1.4"
+ip link set dev eth0 promisc on
-eth_netmask="255.255.255.0"
+
-eth_broadcast="192.168.1.255"
+#=====================#
-eth_gateway="192.168.1.1"
+
+# 配置文件修改
+# 首先关闭nat转发功能
+iptables_nat = false
+
+link_mode = "macvtap"
+#内网主网卡名称
+ipv4_master = "eth0"
+#以下网段需要跟ipv4_master网卡设置成一样
+ipv4_cidr = "10.1.2.0/24"
+ipv4_gateway = "10.1.2.1"
+ipv4_start = "10.1.2.100"
+ipv4_end = "10.1.2.200"
 ```
 
-3. 执行 bridge.sh 文件
+## Deploy
 
-```
+> 部署配置文件放在 `deploy` 目录下，请根据实际情况修改配置文件
-sh bridge.sh
-```
 
-## Soft
+### Systemd
 
-相关软件下载： https://gitee.com/bjdgyc/anylink-soft
+1. 添加 anylink 程序
+    - 首先把 `anylink-deploy` 文件夹放入 `/usr/local/anylink-deploy`
+    - 添加执行权限 `chmod +x /usr/local/anylink-deploy/anylink`
+2. 把 `anylink.service` 脚本放入：
+    - centos: `/usr/lib/systemd/system/`
+    - ubuntu: `/lib/systemd/system/`
+3. 操作命令:
+    - 启动: `systemctl start anylink`
+    - 停止: `systemctl stop anylink`
+    - 开机自启: `systemctl enable anylink`
+
+### Docker Compose
+
+1. 进入 `deploy` 目录
+2. 执行脚本 `docker-compose up`
+
+### k8s
+
+1. 进入 `deploy` 目录
+2. 执行脚本 `kubectl apply -f deployment.yaml`
+
+## Docker
+
+1. 获取镜像
+   ```bash
+   # 具体tag可以从docker hub获取
+   # https://hub.docker.com/r/bjdgyc/anylink/tags
+   docker pull bjdgyc/anylink:latest
+   ```
+
+2. 查看命令信息
+   ```bash
+   docker run -it --rm bjdgyc/anylink -h
+   ```
+
+3. 生成密码
+   ```bash
+   docker run -it --rm bjdgyc/anylink tool -p 123456
+   #Passwd:$2a$10$lCWTCcGmQdE/4Kb1wabbLelu4vY/cUwBwN64xIzvXcihFgRzUvH2a
+   ```
+
+4. 生成 jwt secret
+   ```bash
+   docker run -it --rm bjdgyc/anylink tool -s
+   #Secret:9qXoIhY01jqhWIeIluGliOS4O_rhcXGGGu422uRZ1JjZxIZmh17WwzW36woEbA
+   ```
+
+5. 查看所有配置项
+   ```bash
+   docker run -it --rm bjdgyc/anylink tool -d
+   ```
+
+6. 启动容器
+   ```bash
+   # 默认启动
+   docker run -itd --name anylink --privileged \
+       -p 443:443 -p 8800:8800 -p 443:443/udp \
+       --restart=always \
+       bjdgyc/anylink
+   
+   # 自定义配置目录
+   # 首次启动会自动创建配置文件
+   # 配置文件初始化完成后，容器会强制退出，请重新启动容器
+   docker run -itd --name anylink --privileged \
+       -p 443:443 -p 8800:8800 -p 443:443/udp \
+       -v /home/myconf:/app/conf \
+       --restart=always \
+       bjdgyc/anylink
+   
+   docker restart anylink
+   ```
+
+6. 使用自定义参数启动容器
+   ```bash
+   # 参数可以参考 ./anylink tool -d
+   # 可以使用命令行参数 或者 环境变量 配置
+   docker run -itd --name anylink --privileged \
+       -e LINK_LOG_LEVEL=info \
+       -p 443:443 -p 8800:8800 -p 443:443/udp \
+       -v /home/myconf:/app/conf \
+       --restart=always \
+       bjdgyc/anylink \
+       --ip_lease=1209600 # IP地址租约时长
+   ```
+
+7. 构建镜像 (非必需)
+   ```bash
+   #获取仓库源码
+   git clone https://github.com/bjdgyc/anylink.git
+   # 构建镜像
+   sh build_docker.sh
+   或
+   docker build -t anylink -f docker/Dockerfile .
+   ```
+
+## 常见问题
+
+请前往 [问题地址](doc/question.md) 查看具体信息
+
+## Discussion
+
+添加QQ群(1)(已满): 567510628
+
+添加QQ群(2): 739072205
+
+群共享文件有相关软件下载
+
+<!--
+添加微信群: 群共享文件有相关软件下载
+
+![contact_me_qr](doc/screenshot/contact_me_qr.png)
+-->
+
+## Support Client
+
+- [AnyConnect Secure Client](https://www.cisco.com/) (可通过群文件下载: Windows/macOS/Linux/Android/iOS)
+- [OpenConnect](https://gitlab.com/openconnect/openconnect) (Windows/macOS/Linux)
+- [AnyLink Secure Client](https://github.com/tlslink/anylink-client) (Windows/macOS/Linux)
+
+## Contribution
+
+欢迎提交 PR、Issues，感谢为 AnyLink 做出贡献。
+
+注意新建 PR，需要提交到 dev 分支，其他分支暂不会合并。
 
 ## Other Screenshot
 
-![system.jpg](https://gitee.com/bjdgyc/anylink/raw/master/screenshot/system.jpg)
+<details>
-![setting.jpg](https://gitee.com/bjdgyc/anylink/raw/master/screenshot/setting.jpg)
+<summary>展开查看</summary>
-![users.jpg](https://gitee.com/bjdgyc/anylink/raw/master/screenshot/users.jpg)
+
-![ip_map.jpg](https://gitee.com/bjdgyc/anylink/raw/master/screenshot/ip_map.jpg)
+![system.jpg](doc/screenshot/system.jpg)
-![group.jpg](https://gitee.com/bjdgyc/anylink/raw/master/screenshot/group.jpg)
+![setting.jpg](doc/screenshot/setting.jpg)
+![users.jpg](doc/screenshot/users.jpg)
+![ip_map.jpg](doc/screenshot/ip_map.jpg)
+![group.jpg](doc/screenshot/group.jpg)
+
+</details>
 
 ## License
 
-本项目采用 MIT 开源授权许可证，完整的授权说明已放置在 LICENSE 文件中。
+本项目采用 AGPL-3.0 开源授权许可证，完整的授权说明已放置在 LICENSE 文件中。
-
-
-
-
-
-
 
+## Thank
 
+<a href="https://www.jetbrains.com">
+    <img src="doc/screenshot/jetbrains.png" width="200" alt="jetbrains.png" />
+</a>

admin/api_other.go

@@ -1,62 +0,0 @@
-package admin
-
-import (
-	"encoding/json"
-	"io/ioutil"
-	"net/http"
-
-	"github.com/bjdgyc/anylink/dbdata"
-)
-
-func setOtherGet(data interface{}, w http.ResponseWriter) {
-	err := dbdata.SettingGet(data)
-	if err != nil && !dbdata.CheckErrNotFound(err) {
-		RespError(w, RespInternalErr, err)
-		return
-	}
-	RespSucess(w, data)
-}
-
-func setOtherEdit(data interface{}, w http.ResponseWriter, r *http.Request) {
-	body, err := ioutil.ReadAll(r.Body)
-	if err != nil {
-		RespError(w, RespInternalErr, err)
-		return
-	}
-	defer r.Body.Close()
-
-	err = json.Unmarshal(body, data)
-	if err != nil {
-		RespError(w, RespInternalErr, err)
-		return
-	}
-
-	// fmt.Println(data)
-
-	err = dbdata.SettingSet(data)
-	if err != nil {
-		RespError(w, RespInternalErr, err)
-		return
-	}
-	RespSucess(w, data)
-}
-
-func SetOtherSmtp(w http.ResponseWriter, r *http.Request) {
-	data := &dbdata.SettingSmtp{}
-	setOtherGet(data, w)
-}
-
-func SetOtherSmtpEdit(w http.ResponseWriter, r *http.Request) {
-	data := &dbdata.SettingSmtp{}
-	setOtherEdit(data, w, r)
-}
-
-func SetOther(w http.ResponseWriter, r *http.Request) {
-	data := &dbdata.SettingOther{}
-	setOtherGet(data, w)
-}
-
-func SetOtherEdit(w http.ResponseWriter, r *http.Request) {
-	data := &dbdata.SettingOther{}
-	setOtherEdit(data, w, r)
-}

admin/server.go

@@ -1,74 +0,0 @@
-// admin:后台管理接口
-package admin
-
-import (
-	"embed"
-	"net/http"
-	"net/http/pprof"
-
-	"github.com/bjdgyc/anylink/base"
-	"github.com/gorilla/mux"
-)
-
-var UiPath embed.FS
-
-// 开启服务
-func StartAdmin() {
-
-	r := mux.NewRouter()
-	r.Use(authMiddleware)
-
-	r.Handle("/", http.RedirectHandler("/ui/", http.StatusFound)).
-		Name("static")
-	r.PathPrefix("/ui/").Handler(http.FileServer(
-		http.FS(UiPath),
-	)).Name("static")
-
-	r.HandleFunc("/base/login", Login).Name("login")
-	r.HandleFunc("/set/home", SetHome)
-	r.HandleFunc("/set/system", SetSystem)
-	r.HandleFunc("/set/soft", SetSoft)
-	r.HandleFunc("/set/other", SetOther)
-	r.HandleFunc("/set/other/edit", SetOtherEdit)
-	r.HandleFunc("/set/other/smtp", SetOtherSmtp)
-	r.HandleFunc("/set/other/smtp/edit", SetOtherSmtpEdit)
-
-	r.HandleFunc("/user/list", UserList)
-	r.HandleFunc("/user/detail", UserDetail)
-	r.HandleFunc("/user/set", UserSet)
-	r.HandleFunc("/user/del", UserDel)
-	r.HandleFunc("/user/online", UserOnline)
-	r.HandleFunc("/user/offline", UserOffline)
-	r.HandleFunc("/user/otp_qr", UserOtpQr)
-	r.HandleFunc("/user/ip_map/list", UserIpMapList)
-	r.HandleFunc("/user/ip_map/detail", UserIpMapDetail)
-	r.HandleFunc("/user/ip_map/set", UserIpMapSet)
-	r.HandleFunc("/user/ip_map/del", UserIpMapDel)
-
-	r.HandleFunc("/group/list", GroupList)
-	r.HandleFunc("/group/names", GroupNames)
-	r.HandleFunc("/group/detail", GroupDetail)
-	r.HandleFunc("/group/set", GroupSet)
-	r.HandleFunc("/group/del", GroupDel)
-
-	// pprof
-	r.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
-	r.HandleFunc("/debug/pprof/profile", pprof.Profile)
-	r.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
-	r.HandleFunc("/debug/pprof/trace", pprof.Trace)
-	r.HandleFunc("/debug/pprof", location("/debug/pprof/"))
-	r.PathPrefix("/debug/pprof/").HandlerFunc(pprof.Index)
-
-	base.Info("Listen admin", base.Cfg.AdminAddr)
-	err := http.ListenAndServe(base.Cfg.AdminAddr, r)
-	if err != nil {
-		base.Fatal(err)
-	}
-}
-
-func location(url string) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Location", url)
-		w.WriteHeader(http.StatusFound)
-	}
-}

base/app_ver.go

@@ -1,6 +0,0 @@
-package base
-
-const (
-	APP_NAME = "AnyLink"
-	APP_VER  = "0.0.6"
-)

base/cfg_server.go

@@ -1,127 +0,0 @@
-package base
-
-import (
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-
-	"github.com/pelletier/go-toml"
-)
-
-const (
-	LinkModeTUN = "tun"
-	LinkModeTAP = "tap"
-)
-
-var (
-	Cfg = &ServerConfig{}
-)
-
-// # ReKey time (in seconds)
-// rekey-time = 172800
-// # ReKey method
-// # Valid options: ssl, new-tunnel
-// #  ssl: Will perform an efficient rehandshake on the channel allowing
-// #       a seamless connection during rekey.
-// #  new-tunnel: Will instruct the client to discard and re-establish the channel.
-// #       Use this option only if the connecting clients have issues with the ssl
-// #       option.
-// rekey-method = ssl
-
-type ServerConfig struct {
-	LinkAddr      string `toml:"link_addr" info:"vpn服务对外地址"`
-	ServerAddr    string `toml:"server_addr" info:"前台服务监听地址"`
-	AdminAddr     string `toml:"admin_addr" info:"后台服务监听地址"`
-	ProxyProtocol bool   `toml:"proxy_protocol" info:"TCP代理协议"`
-	DbFile        string `toml:"db_file" info:"数据库地址"`
-	CertFile      string `toml:"cert_file" info:"证书文件"`
-	CertKey       string `toml:"cert_key" info:"证书密钥"`
-	DownFilesPath string `json:"down_files_path" info:"外部下载文件路径"`
-	LogLevel      string `toml:"log_level" info:"日志等级"`
-	Issuer        string `toml:"issuer" info:"系统名称"`
-	AdminUser     string `toml:"admin_user" info:"管理用户名"`
-	AdminPass     string `toml:"admin_pass" info:"管理用户密码"`
-	JwtSecret     string `toml:"jwt_secret" info:"JWT密钥"`
-
-	LinkMode    string   `toml:"link_mode" info:"虚拟网络类型"`          // tun tap
-	Ipv4Network string   `toml:"ipv4_network" info:"ipv4_network"` // 192.168.1.0
-	Ipv4Netmask string   `toml:"ipv4_netmask" info:"ipv4_netmask"` // 255.255.255.0
-	Ipv4Gateway string   `toml:"ipv4_gateway" info:"ipv4_gateway"`
-	Ipv4Pool    []string `toml:"ipv4_pool" info:"IPV4起止地址池"` // Pool[0]=192.168.1.100 Pool[1]=192.168.1.200
-	IpLease     int      `toml:"ip_lease"  info:"IP租期(秒)"`
-
-	MaxClient       int    `toml:"max_client" info:"最大用户连接"`
-	MaxUserClient   int    `toml:"max_user_client" info:"最大单用户连接"`
-	DefaultGroup    string `toml:"default_group" info:"默认用户组"`
-	CstpKeepalive   int    `toml:"cstp_keepalive" info:"keepalive时间(秒)"` // in seconds
-	CstpDpd         int    `toml:"cstp_dpd" info:"死链接检测时间(秒)"`           // Dead peer detection in seconds
-	MobileKeepalive int    `toml:"mobile_keepalive" info:"移动端keepalive接检测时间(秒)"`
-	MobileDpd       int    `toml:"mobile_dpd" info:"移动端死链接检测时间(秒)"`
-
-	SessionTimeout int `toml:"session_timeout" info:"session过期时间(秒)"` // in seconds
-	AuthTimeout    int `toml:"auth_timeout" info:"auth_timeout"`      // in seconds
-}
-
-func initServerCfg() {
-	b, err := ioutil.ReadFile(serverFile)
-	if err != nil {
-		panic(err)
-	}
-	err = toml.Unmarshal(b, Cfg)
-	if err != nil {
-		panic(err)
-	}
-
-	sf, _ := filepath.Abs(serverFile)
-	base := filepath.Dir(sf)
-
-	// 转换成绝对路径
-	Cfg.DbFile = getAbsPath(base, Cfg.DbFile)
-	Cfg.CertFile = getAbsPath(base, Cfg.CertFile)
-	Cfg.CertKey = getAbsPath(base, Cfg.CertKey)
-	Cfg.DownFilesPath = getAbsPath(base, Cfg.DownFilesPath)
-
-	if len(Cfg.JwtSecret) < 20 {
-		fmt.Println("请设置 jwt_secret 长度20位以上")
-		os.Exit(0)
-	}
-
-	fmt.Printf("ServerCfg: %+v \n", Cfg)
-}
-
-func getAbsPath(base, cfile string) string {
-	abs := filepath.IsAbs(cfile)
-	if abs {
-		return cfile
-	}
-	return filepath.Join(base, cfile)
-}
-
-func ServerCfg2Slice() interface{} {
-	ref := reflect.ValueOf(Cfg)
-	s := ref.Elem()
-
-	type cfg struct {
-		Name string      `json:"name"`
-		Info string      `json:"info"`
-		Data interface{} `json:"data"`
-	}
-	var datas []cfg
-
-	typ := s.Type()
-	numFields := s.NumField()
-	for i := 0; i < numFields; i++ {
-		field := typ.Field(i)
-		value := s.Field(i)
-		tag := field.Tag.Get("toml")
-		tags := strings.Split(tag, ",")
-		info := field.Tag.Get("info")
-
-		datas = append(datas, cfg{Name: tags[0], Info: info, Data: value.Interface()})
-	}
-
-	return datas
-}

base/flag.go

@@ -1,54 +0,0 @@
-package base
-
-import (
-	"flag"
-	"fmt"
-	"math/rand"
-	"os"
-	"runtime"
-	"strings"
-	"time"
-
-	"github.com/bjdgyc/anylink/pkg/utils"
-)
-
-var (
-	// 提交id
-	CommitId string
-	// 配置文件
-	serverFile string
-	// pass明文
-	passwd string
-	// 生成密钥
-	secret bool
-	// 显示版本信息
-	rev bool
-)
-
-func initFlag() {
-	flag.StringVar(&serverFile, "conf", "./conf/server.toml", "server config file path")
-	flag.StringVar(&passwd, "passwd", "", "convert the password plaintext")
-	flag.BoolVar(&secret, "secret", false, "generate a random jwt secret")
-	flag.BoolVar(&rev, "rev", false, "display version info")
-	flag.Parse()
-
-	if passwd != "" {
-		pass, _ := utils.PasswordHash(passwd)
-		fmt.Printf("Passwd:%s\n", pass)
-		os.Exit(0)
-	}
-
-	if secret {
-		rand.Seed(time.Now().UnixNano())
-		s, _ := utils.RandSecret(40, 60)
-		s = strings.Trim(s, "=")
-		fmt.Printf("Secret:%s\n", s)
-		os.Exit(0)
-	}
-
-	if rev {
-		fmt.Printf("%s v%s build on %s [%s, %s] commit_id(%s) \n",
-			APP_NAME, APP_VER, runtime.Version(), runtime.GOOS, runtime.GOARCH, CommitId)
-		os.Exit(0)
-	}
-}

base/log.go

@@ -1,90 +0,0 @@
-package base
-
-import (
-	"fmt"
-	"log"
-	"os"
-	"strings"
-)
-
-const (
-	_Debug = iota
-	_Info
-	_Warn
-	_Error
-	_Fatal
-)
-
-var (
-	baseLog   *log.Logger
-	baseLevel int
-	levels    map[int]string
-)
-
-func initLog() {
-	baseLog = log.New(os.Stderr, "", log.LstdFlags|log.Lshortfile)
-	baseLevel = logLevel2Int(Cfg.LogLevel)
-}
-
-func logLevel2Int(l string) int {
-	levels = map[int]string{
-		_Debug: "Debug",
-		_Info:  "Info",
-		_Warn:  "Warn",
-		_Error: "Error",
-		_Fatal: "Fatal",
-	}
-	lvl := _Info
-	for k, v := range levels {
-		if strings.ToLower(l) == strings.ToLower(v) {
-			lvl = k
-		}
-	}
-	return lvl
-}
-
-func output(l int, s ...interface{}) {
-	lvl := fmt.Sprintf("[%s] ", levels[l])
-	baseLog.Output(3, lvl+fmt.Sprintln(s...))
-}
-
-func Debug(v ...interface{}) {
-	l := _Debug
-	if baseLevel > l {
-		return
-	}
-	output(l, v...)
-}
-
-func Info(v ...interface{}) {
-	l := _Info
-	if baseLevel > l {
-		return
-	}
-	output(l, v...)
-}
-
-func Warn(v ...interface{}) {
-	l := _Warn
-	if baseLevel > l {
-		return
-	}
-	output(l, v...)
-}
-
-func Error(v ...interface{}) {
-	l := _Error
-	if baseLevel > l {
-		return
-	}
-	output(l, v...)
-}
-
-func Fatal(v ...interface{}) {
-	l := _Fatal
-	if baseLevel > l {
-		return
-	}
-	output(l, v...)
-	os.Exit(1)
-}

base/start.go

@@ -1,7 +0,0 @@
-package base
-
-func Start() {
-	initFlag()
-	initServerCfg()
-	initLog()
-}

bridge-init.sh

@@ -1,42 +0,0 @@
-#!/bin/bash
-
-#################################
-# Set up Ethernet bridge on Linux
-# Requires: bridge-utils
-#################################
-
-# Define Bridge Interface
-br="anylink0"
-
-# Define list of TAP interfaces to be bridged,
-# for example tap="tap0 tap1 tap2".
-tap="tap0"
-
-# Define physical ethernet interface to be bridged
-# with TAP interface(s) above.
-
-eth="eth0"
-eth_ip="192.168.10.4"
-eth_netmask="255.255.255.0"
-eth_broadcast="192.168.10.255"
-eth_gateway="192.168.10.1"
-
-
-brctl addbr $br
-brctl addif $br $eth
-
-ifconfig $eth 0.0.0.0 up
-
-mac=`cat /sys/class/net/$eth/address`
-ifconfig $br hw ether $mac
-ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast up
-
-route add default gateway $eth_gateway
-
-
-
-
-
-
-
-

build.sh

@@ -0,0 +1,65 @@
+#!/bin/bash
+
+set -x
+function RETVAL() {
+  rt=$1
+  if [ $rt != 0 ]; then
+    echo $rt
+    exit 1
+  fi
+}
+
+#当前目录
+cpath=$(pwd)
+#ver=`cat server/base/app_ver.go | grep APP_VER | awk '{print $3}' | sed 's/"//g'`
+ver=$(cat version)
+echo "当前版本 $ver"
+
+echo "编译前端项目"
+cd $cpath/web
+
+#国内可替换源加快速度
+#npx browserslist@latest --update-db
+yarn install --registry=https://registry.npmmirror.com
+yarn run build
+RETVAL $?
+
+echo "编译二进制文件"
+cd $cpath/server
+rm -rf ui
+cp -rf $cpath/web/ui .
+
+# -tags osusergo,netgo,sqlite_omit_load_extension
+flags="-v -trimpath"
+
+# -extldflags '-static'
+ldflags="-s -w -X main.appVer=$ver -X main.commitId=$(git rev-parse HEAD) -X main.date=$(date -Iseconds)"
+
+#国内可替换源加快速度
+export GOPROXY=https://goproxy.io
+go mod tidy
+go build -o anylink $flags -ldflags "$ldflags"
+
+cd $cpath
+
+exit 0
+
+echo "整理部署文件"
+deploy="anylink-deploy"
+rm -rf $deploy ${deploy}.tar.gz
+mkdir $deploy
+mkdir $deploy/log
+
+cp -r server/anylink $deploy
+cp -r server/bridge-init.sh $deploy
+cp -r server/conf $deploy
+
+cp -r systemd $deploy
+cp -r LICENSE $deploy
+cp -r home $deploy
+
+tar zcvf ${deploy}.tar.gz $deploy
+
+#注意使用root权限运行
+#cd anylink-deploy
+#sudo ./anylink --conf="conf/server.toml"

build_docker.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+ver=$(cat version)
+echo $ver
+
+# docker login -u bjdgyc
+
+# 生成时间 2024-01-30T21:41:27+08:00
+# date -Iseconds
+
+#docker run -it --rm -v $PWD/web:/app -w /app node:16-alpine \
+#  sh -c "yarn install --registry=https://registry.npmmirror.com && yarn run build"
+
+# docker buildx build --platform linux/amd64,linux/arm64 本地不生成镜像
+docker build -t bjdgyc/anylink:latest --progress=plain --build-arg CN="yes" --build-arg appVer=$ver \
+  --build-arg commitId=$(git rev-parse HEAD) -f docker/Dockerfile .
+
+echo "docker tag latest $ver"
+docker tag bjdgyc/anylink:latest bjdgyc/anylink:$ver
+
+#exit 0
+
+docker tag bjdgyc/anylink:latest registry.cn-qingdao.aliyuncs.com/bjdgyc/anylink:latest
+
+docker push registry.cn-qingdao.aliyuncs.com/bjdgyc/anylink:latest

conf/server.toml

@@ -1,64 +0,0 @@
-#服务配置信息
-
-#其他配置文件,可以使用绝对路径
-#或者相对于server.toml的路径
-
-#数据文件
-db_file = "./data.db"
-#证书文件
-cert_file = "./vpn_cert.pem"
-cert_key = "./vpn_cert.key"
-down_files_path = "../down_files"
-
-log_level = "info"
-
-#系统名称
-issuer = "XX公司VPN"
-#后台管理用户
-admin_user = "admin"
-#pass 123456
-admin_pass = "$2a$10$UQ7C.EoPifDeJh6d8.31TeSPQU7hM/NOM2nixmBucJpAuXDQNqNke"
-jwt_secret = ""
-
-
-#vpn服务对外地址
-link_addr = "vpn.xx.com"
-
-#前台服务监听地址
-server_addr = ":443"
-#后台服务监听地址
-admin_addr = ":8800"
-#开启tcp proxy protocol协议
-proxy_protocol = false
-
-link_mode = "tun"
-
-#客户端分配的ip地址池
-ipv4_network = "192.168.10.0"
-ipv4_netmask = "255.255.255.0"
-ipv4_gateway = "192.168.10.1"
-ipv4_pool = ["192.168.10.100", "192.168.10.200"]
-
-#最大客户端数量
-max_client = 100
-#单个用户同时在线数量
-max_user_client = 3
-#IP租期(秒)
-ip_lease = 1209600
-
-#默认选择的组
-default_group = "one"
-
-#客户端失效检测时间(秒) dpd > keepalive
-cstp_keepalive = 20
-cstp_dpd = 30
-mobile_keepalive = 50
-mobile_dpd = 60
-#session过期时间，用于断线重连，0永不过期
-session_timeout = 3600
-auth_timeout = 0
-
-
-
-
-

dbdata/db.go

@@ -1,90 +0,0 @@
-package dbdata
-
-import (
-	"time"
-
-	"github.com/asdine/storm/v3"
-	"github.com/asdine/storm/v3/codec/json"
-	"github.com/bjdgyc/anylink/base"
-	bolt "go.etcd.io/bbolt"
-)
-
-var (
-	sdb *storm.DB
-)
-
-func initDb() {
-	var err error
-	sdb, err = storm.Open(base.Cfg.DbFile, storm.Codec(json.Codec),
-		storm.BoltOptions(0600, &bolt.Options{Timeout: 10 * time.Second}))
-	if err != nil {
-		base.Fatal(err)
-	}
-
-	// 初始化数据库
-	err = sdb.Init(&User{})
-	if err != nil {
-		base.Fatal(err)
-	}
-
-	// fmt.Println("s1")
-}
-
-func initData() {
-	var (
-		err     error
-		install bool
-	)
-
-	// 判断是否初次使用
-	err = Get(SettingBucket, Installed, &install)
-	if err == nil && install {
-		// 已经安装过
-		return
-	}
-
-	defer Set(SettingBucket, Installed, true)
-
-	smtp := &SettingSmtp{
-		Host: "127.0.0.1",
-		Port: 25,
-		From: "vpn@xx.com",
-	}
-	SettingSet(smtp)
-
-	other := &SettingOther{
-		Banner:      "您已接入公司网络，请按照公司规定使用。\n请勿进行非工作下载及视频行为！",
-		AccountMail: accountMail,
-	}
-	SettingSet(other)
-
-}
-
-func CheckErrNotFound(err error) bool {
-	if err == storm.ErrNotFound {
-		return true
-	}
-	return false
-}
-
-const accountMail = `<p>您好:</p>
-<p>&nbsp;&nbsp;您的{{.Issuer}}账号已经审核开通。</p>
-<p>
-    登陆地址: <b>{{.LinkAddr}}</b> <br/>
-    用户组: <b>{{.Group}}</b> <br/>
-    用户名: <b>{{.Username}}</b> <br/>
-    用户PIN码: <b>{{.PinCode}}</b> <br/>
-    用户动态码(3天后失效):<br/>
-    <img src="{{.OtpImg}}"/>
-</p>
-<div>
-    使用说明:
-    <ul>
-        <li>请使用OTP软件扫描动态码二维码</li>
-        <li>然后使用anyconnect客户端进行登陆</li>
-        <li>登陆密码为 【PIN码+动态码】</li>
-    </ul>
-</div>
-<p>
-    软件下载地址: https://gitee.com/bjdgyc/anylink-soft/blob/master/README.md
-</p>`

dbdata/db_orm.go

@@ -1,66 +0,0 @@
-package dbdata
-
-import "github.com/asdine/storm/v3/index"
-
-const PageSize = 10
-
-func Save(data interface{}) error {
-	return sdb.Save(data)
-}
-
-func Update(data interface{}) error {
-	return sdb.Update(data)
-}
-
-func UpdateField(data interface{}, fieldName string, value interface{}) error {
-	return sdb.UpdateField(data, fieldName, value)
-}
-
-func Del(data interface{}) error {
-	return sdb.DeleteStruct(data)
-}
-
-func Set(bucket, key string, data interface{}) error {
-	return sdb.Set(bucket, key, data)
-}
-
-func Get(bucket, key string, data interface{}) error {
-	return sdb.Get(bucket, key, data)
-}
-
-func CountAll(data interface{}) int {
-	n, _ := sdb.Count(data)
-	return n
-}
-
-func One(fieldName string, value interface{}, to interface{}) error {
-	return sdb.One(fieldName, value, to)
-}
-
-func Find(fieldName string, value interface{}, to interface{}, options ...func(q *index.Options)) error {
-	return sdb.Find(fieldName, value, to, options...)
-}
-
-func All(to interface{}, limit, page int) error {
-	opt := getOpt(limit, page)
-	return sdb.All(to, opt)
-}
-
-func Prefix(fieldName string, prefix string, to interface{}, limit, page int) error {
-	opt := getOpt(limit, page)
-	return sdb.Prefix(fieldName, prefix, to, opt)
-}
-
-func getOpt(limit, page int) func(*index.Options) {
-	skip := (page - 1) * limit
-	opt := func(opt *index.Options) {
-		opt.Reverse = true
-		if limit > 0 {
-			opt.Limit = limit
-		}
-		if skip > 0 {
-			opt.Skip = skip
-		}
-	}
-	return opt
-}

dbdata/group.go

@@ -1,136 +0,0 @@
-package dbdata
-
-import (
-	"errors"
-	"fmt"
-	"net"
-	"strings"
-	"time"
-
-	"github.com/bjdgyc/anylink/base"
-)
-
-const (
-	Allow = "allow"
-	Deny  = "deny"
-)
-
-type GroupLinkAcl struct {
-	// 自上而下匹配 默认 allow * *
-	Action string     `json:"action"` // allow、deny
-	Val    string     `json:"val"`
-	Port   uint8      `json:"port"`
-	IpNet  *net.IPNet `json:"-"`
-}
-
-type ValData struct {
-	Val string `json:"val"`
-}
-
-type Group struct {
-	Id           int            `json:"id" storm:"id,increment"`
-	Name         string         `json:"name" storm:"unique"`
-	Note         string         `json:"note"`
-	AllowLan     bool           `json:"allow_lan"`
-	ClientDns    []ValData      `json:"client_dns"`
-	RouteInclude []ValData      `json:"route_include"`
-	RouteExclude []ValData      `json:"route_exclude"`
-	LinkAcl      []GroupLinkAcl `json:"link_acl"`
-	Bandwidth    int            `json:"bandwidth"` // 带宽限制
-	Status       int8           `json:"status"`    // 1正常
-	CreatedAt    time.Time      `json:"created_at"`
-	UpdatedAt    time.Time      `json:"updated_at"`
-}
-
-func GetGroupNames() []string {
-	var datas []Group
-	err := All(&datas, 0, 0)
-	if err != nil {
-		base.Error(err)
-		return nil
-	}
-	var names []string
-	for _, v := range datas {
-		names = append(names, v.Name)
-	}
-	return names
-}
-
-func SetGroup(g *Group) error {
-	var err error
-	if g.Name == "" {
-		return errors.New("用户组名错误")
-	}
-
-	// 判断数据
-	clientDns := []ValData{}
-	for _, v := range g.ClientDns {
-		if v.Val != "" {
-			clientDns = append(clientDns, v)
-		}
-	}
-	if len(clientDns) == 0 {
-		return errors.New("DNS错误")
-	}
-	g.ClientDns = clientDns
-
-	routeInclude := []ValData{}
-	for _, v := range g.RouteInclude {
-		if v.Val != "" {
-			v1, _ := parseIpNet(v.Val)
-			vn := ValData{Val: v1}
-			routeInclude = append(routeInclude, vn)
-		}
-	}
-	g.RouteInclude = routeInclude
-	routeExclude := []ValData{}
-	for _, v := range g.RouteExclude {
-		if v.Val != "" {
-			v1, _ := parseIpNet(v.Val)
-			vn := ValData{Val: v1}
-			routeExclude = append(routeExclude, vn)
-		}
-	}
-	g.RouteExclude = routeExclude
-	// 转换数据
-	linkAcl := []GroupLinkAcl{}
-	for _, v := range g.LinkAcl {
-		if v.Val != "" {
-			v1, v2 := parseIpNet(v.Val)
-			if v2 != nil {
-				vn := v
-				vn.Val = v1
-				vn.IpNet = v2
-				linkAcl = append(linkAcl, vn)
-			}
-		}
-	}
-	g.LinkAcl = linkAcl
-
-	g.UpdatedAt = time.Now()
-	err = Save(g)
-
-	return err
-}
-
-func parseIpNet(s string) (string, *net.IPNet) {
-	ips := strings.Split(s, "/")
-	if len(ips) != 2 {
-		return "", nil
-	}
-	ip := net.ParseIP(ips[0])
-	mask := net.ParseIP(ips[1])
-
-	if strings.Contains(ips[0], ".") {
-		ip = ip.To4()
-		mask = mask.To4()
-	}
-
-	ipmask := net.IPMask(mask)
-	ip0 := ip.Mask(ipmask)
-
-	ipNetS := fmt.Sprintf("%s/%s", ip0, mask)
-	ipNet := &net.IPNet{IP: ip0, Mask: ipmask}
-
-	return ipNetS, ipNet
-}

dbdata/ip_map.go

@@ -1,18 +0,0 @@
-package dbdata
-
-import (
-	"net"
-	"time"
-)
-
-type IpMap struct {
-	Id        int       `json:"id" storm:"id,increment"`
-	IpAddr    net.IP    `json:"ip_addr" storm:"unique"`
-	MacAddr   string    `json:"mac_addr" storm:"unique"`
-	Username  string    `json:"username"`
-	Keep      bool      `json:"keep"` // 保留 ip-mac 绑定
-	KeepTime  time.Time `json:"keep_time"`
-	Note      string    `json:"note"` // 备注
-	LastLogin time.Time `json:"last_login"`
-	UpdatedAt time.Time `json:"updated_at"`
-}

dbdata/setting.go

@@ -1,46 +0,0 @@
-package dbdata
-
-import (
-	"reflect"
-)
-
-const (
-	SettingBucket = "SettingBucket"
-	Installed     = "Installed"
-)
-
-func StructName(data interface{}) string {
-	ref := reflect.ValueOf(data)
-	s := &ref
-	if s.Kind() == reflect.Ptr {
-		e := s.Elem()
-		s = &e
-	}
-	name := s.Type().Name()
-	return name
-}
-
-func SettingSet(data interface{}) error {
-	key := StructName(data)
-	err := Set(SettingBucket, key, data)
-	return err
-}
-
-func SettingGet(data interface{}) error {
-	key := StructName(data)
-	err := Get(SettingBucket, key, data)
-	return err
-}
-
-type SettingSmtp struct {
-	Host     string `json:"host"`
-	Port     int    `json:"port"`
-	Username string `json:"username"`
-	Password string `json:"password"`
-	From     string `json:"from"`
-}
-
-type SettingOther struct {
-	Banner      string `json:"banner"`
-	AccountMail string `json:"account_mail"`
-}

dbdata/user.go

@@ -1,143 +0,0 @@
-package dbdata
-
-import (
-	"errors"
-	"fmt"
-	"sync"
-	"time"
-
-	"github.com/bjdgyc/anylink/pkg/utils"
-	"github.com/xlzd/gotp"
-)
-
-type User struct {
-	Id       int    `json:"id" storm:"id,increment"`
-	Username string `json:"username" storm:"unique"`
-	Nickname string `json:"nickname"`
-	Email    string `json:"email"`
-	// Password  string    `json:"password"`
-	PinCode   string    `json:"pin_code"`
-	OtpSecret string    `json:"otp_secret"`
-	Groups    []string  `json:"groups"`
-	Status    int8      `json:"status"` // 1正常
-	SendEmail bool      `json:"send_email"`
-	CreatedAt time.Time `json:"created_at"`
-	UpdatedAt time.Time `json:"updated_at"`
-}
-
-func SetUser(v *User) error {
-	var err error
-	if v.Username == "" || len(v.Groups) == 0 {
-		return errors.New("用户名或组错误")
-	}
-
-	planPass := v.PinCode
-	// 自动生成密码
-	if len(planPass) < 6 {
-		planPass = utils.RandomNum(8)
-	}
-	v.PinCode = planPass
-
-	if v.OtpSecret == "" {
-		v.OtpSecret = gotp.RandomSecret(24)
-	}
-
-	// 判断组是否有效
-	ng := []string{}
-	groups := GetGroupNames()
-	for _, g := range v.Groups {
-		if utils.InArrStr(groups, g) {
-			ng = append(ng, g)
-		}
-	}
-	if len(ng) == 0 {
-		return errors.New("用户名或组错误")
-	}
-	v.Groups = ng
-
-	v.UpdatedAt = time.Now()
-	err = Save(v)
-
-	return err
-}
-
-// 验证用户登陆信息
-func CheckUser(name, pwd, group string) error {
-	// return nil
-
-	pl := len(pwd)
-	if name == "" || pl < 6 {
-		return fmt.Errorf("%s %s", name, "密码错误")
-	}
-	v := &User{}
-	err := One("Username", name, v)
-	if err != nil || v.Status != 1 {
-		return fmt.Errorf("%s %s", name, "用户名错误")
-	}
-	// 判断用户组信息
-	if !utils.InArrStr(v.Groups, group) {
-		return fmt.Errorf("%s %s", name, "用户组错误")
-	}
-	groupData := &Group{}
-	err = One("Name", group, groupData)
-	if err != nil || groupData.Status != 1 {
-		return fmt.Errorf("%s %s", name, "用户组错误")
-	}
-
-	// 判断otp信息
-	otp := pwd[pl-6:]
-	if !checkOtp(name, otp) {
-		return fmt.Errorf("%s %s", name, "动态码错误")
-	}
-	totp := gotp.NewDefaultTOTP(v.OtpSecret)
-	unix := time.Now().Unix()
-	verify := totp.Verify(otp, int(unix))
-	if !verify {
-		return fmt.Errorf("%s %s", name, "动态码错误")
-	}
-
-	pinCode := pwd[:pl-6]
-	if pinCode != v.PinCode {
-		return fmt.Errorf("%s %s", name, "密码错误")
-	}
-
-	return nil
-}
-
-var (
-	userOtpMux = sync.Mutex{}
-	userOtp    = map[string]time.Time{}
-)
-
-func init() {
-	go func() {
-		expire := time.Second * 60
-
-		for range time.Tick(time.Second * 10) {
-			tnow := time.Now()
-			userOtpMux.Lock()
-			for k, v := range userOtp {
-				if tnow.After(v.Add(expire)) {
-					delete(userOtp, k)
-				}
-			}
-			userOtpMux.Unlock()
-		}
-	}()
-}
-
-// 令牌只能使用一次
-func checkOtp(username, otp string) bool {
-	key := fmt.Sprintf("%s:%s", username, otp)
-
-	userOtpMux.Lock()
-	defer userOtpMux.Unlock()
-
-	if _, ok := userOtp[key]; ok {
-		// 已经存在
-		return false
-	}
-
-	userOtp[key] = time.Now()
-	return true
-}

deploy.sh

@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-
-git clone https://github.com/bjdgyc/anylink-web.git
-
-cd anylink-web
-npm install
-npm run build
-
-cd ../
-cp -r anylink-web/ui .
-go build -o anylink -ldflags "-X main.COMMIT_ID=`git rev-parse HEAD`"
-
-#整理部署文件
-mkdir anylink-deploy
-cd anylink-deploy
-
-cp -r ../anylink .
-cp -r ../conf .
-cp -r ../down_files .
-
-#注意使用root权限运行
-#sudo ./anylink -conf="conf/server.toml"
-

deploy/anylink.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=AnyLink Server Service
+Documentation=https://github.com/bjdgyc/anylink
+After=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/usr/local/anylink-deploy
+Restart=on-failure
+RestartSec=5s
+ExecStart=/usr/local/anylink-deploy/anylink --conf=/usr/local/anylink-deploy/conf/server.toml
+
+# systemctl --version
+
+# systemd older than v236
+# ExecStart=/bin/bash -c 'exec /usr/local/anylink-deploy/anylink --conf=/usr/local/anylink-deploy/conf/server.toml >> /usr/local/anylink-deploy/log/anylink.log 2>&1'
+
+# systemd new than v236
+# StandardOutput=file:/usr/local/anylink-deploy/log/anylink-systemd.log
+# StandardError=file:/usr/local/anylink-deploy/log/anylink-systemd.log
+
+[Install]
+WantedBy=multi-user.target

deploy/deployment.yaml

@@ -0,0 +1,101 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: anylink
+  namespace: default
+  labels:
+    link-app: anylink
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      link-app: anylink
+  template:
+    metadata:
+      labels:
+        link-app: anylink
+    spec:
+      #hostNetwork: true
+      dnsPolicy: ClusterFirst
+      containers:
+        - name: anylink
+          env:
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: spec.nodeName
+            - name: GOMAXPROCS
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.cpu
+            - name: POD_CPU_LIMIT
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.cpu
+            - name: POD_MEMORY_LIMIT
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.memory
+            - name: TZ
+              value: "Asia/Shanghai"
+          image: bjdgyc/anylink:latest
+          imagePullPolicy: Always
+          args:
+            - --conf=/app/conf/server.toml
+          ports:
+            - name: https
+              containerPort: 443
+              protocol: TCP
+            - name: https-admin
+              containerPort: 8800
+              protocol: TCP
+            - name: dtls
+              containerPort: 443
+              protocol: UDP
+          # 设置资源
+          resources:
+            limits:
+              cpu: "2"
+              memory: 4Gi
+              ephemeral-storage: "2Gi"
+          securityContext:
+            privileged: true
+      # 禁用自动注入 service 信息到环境变量
+      enableServiceLinks: false
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 30
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext: { }
+      tolerations:
+        - operator: Exists
+      #设置优先级
+      priorityClassName: system-cluster-critical
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: anylink
+  namespace: default
+  labels:
+    link-app: anylink
+spec:
+  ports:
+    - name: https
+      port: 443
+      targetPort: 443
+      protocol: TCP
+    - name: https-admin
+      port: 8800
+      targetPort: 8800
+      protocol: TCP
+    - name: dtls
+      port: 443
+      targetPort: 443
+      protocol: UDP
+  selector:
+    link-app: anylink
+  sessionAffinity: ClientIP
+  type: ClusterIP

deploy/docker-compose.yaml

@@ -0,0 +1,19 @@
+services:
+  anylink:
+    image: bjdgyc/anylink:latest
+    container_name: anylink
+    restart: always
+    privileged: true
+    #cpus: 2
+    #mem_limit: 4g
+    ports:
+      - 443:443
+      - 8800:8800
+      - 443:443/udp
+    environment:
+      LINK_LOG_LEVEL: info
+    command:
+      - --conf=/app/conf/server.toml
+    #volumes:
+    #  - /home/myconf:/app/conf
+    dns_search: .

doc/README.md

@@ -0,0 +1,50 @@
+## Donate
+
+> 如果您觉得 AnyLink 对你有帮助，欢迎给我们打赏，也是帮助 AnyLink 更好的发展。
+
+<p>
+    <img src="screenshot/wxpay2.png" width="435" alt="anylink捐赠二维码" />
+</p>
+
+## Donator
+
+> 感谢以下同学的打赏，AnyLink 有你更美好！
+>
+> 需要展示主页的同学，可以在QQ群 直接联系我添加。
+
+| 昵称        | 主页 / 联系方式                    |
+|-----------|------------------------------|
+| 代码 oo8    |                              |
+| 甘磊        | https://github.com/ganlei333 |
+| Oo@       | https://github.com/chooop    |
+| 虚极静笃      |                              |
+| 请喝可乐      |                              |
+| 加油加油      |                              |
+| 李建        |                              |
+| lanbin    |                              |
+| 乐在东途      |                              |
+| 孤鸿        |                              |
+| 刘国华       |                              |
+| 改名好无聊     |                              |
+| 全能互联网专家   |                              |
+| JCM       |                              |
+| Eh...     |                              |
+| 沉         |                              |
+| 刘国华       |                              |
+| 忧郁的豚骨拉面   |                              |
+| 张小旋当爹地    |                              |
+| 对方正在输入    |                              |
+| Ronny     |                              |
+| 奔跑的少年     |                              |
+| ZBW       |                              |
+| 悲鸣        |                              |
+| 谢谢        |                              |
+| 云思科技      |                              |
+| 哆啦A伟(张佳伟) |                              |
+| 人类的悲欢并不相通 |                              |
+| 做人要低调     |                              |
+| 洛洛        |                              |
+
+
+
+

doc/question.md

@@ -0,0 +1,115 @@
+## 常见问题
+
+### anyconnect 客户端问题
+
+> 客户端请使用群共享文件的版本，其他版本没有测试过，不保证使用正常
+>
+> 添加QQ群: 567510628
+
+### OTP 动态码
+
+> 请使用手机安装 freeotp ，然后扫描otp二维码，生成的数字即是动态码
+
+### 远程桌面连接
+
+> 本软件已经支持远程桌面里面连接anyconnect。
+
+### 私有证书问题
+
+> anylink 默认不支持私有证书
+>
+> 其他使用私有证书的问题，请自行解决
+
+### 客户端连接名称
+
+> 客户端连接名称需要修改 [profile.xml](../server/conf/profile.xml) 文件
+
+```xml
+
+<HostEntry>
+    <HostName>VPN</HostName>
+    <HostAddress>localhost</HostAddress>
+</HostEntry>
+```
+
+### dpd timeout 设置问题
+
+```yaml
+#客户端失效检测时间(秒) dpd > keepalive
+cstp_keepalive = 4
+cstp_dpd = 9
+mobile_keepalive = 7
+mobile_dpd = 15
+```
+
+> 以上dpd参数为客户端的超时检测时间, 如一段时间内，没有数据传输，防火墙会主动关闭连接
+>
+> 如经常出现 timeout 的错误信息，应根据当前防火墙的设置，适当减小dpd数值
+
+### 关于审计日志 audit_interval 参数
+
+> 默认值 `audit_interval = 600` 表示相同日志600秒内只记录一次，不同日志首次出现立即记录
+>
+> 去重key的格式: 16字节源IP地址 + 16字节目的IP地址 + 2字节目的端口 + 1字节协议类型 + 16字节域名MD5
+
+### 反向代理问题
+
+> anylink 仅支持四层反向代理，不支持七层反向代理
+>
+> 如Nginx请使用 stream模块
+
+```conf
+stream {
+    upstream anylink_server {
+        server 127.0.0.1:8443;
+    }
+    server {
+        listen 443 tcp;
+        proxy_timeout 30s;
+        proxy_pass anylink_server;
+    }
+}
+```
+
+> nginx实现 共用443端口 示例
+
+```conf
+stream {
+    map $ssl_preread_server_name $name {
+        vpn.xx.com        myvpn;
+        default     defaultpage;
+    }
+    
+    # upstream pool
+    upstream myvpn {
+        server 127.0.0.1:8443;
+    }
+    upstream defaultpage {
+        server 127.0.0.1:8080;
+    }
+    
+    server {
+        listen 443 so_keepalive=on;
+        ssl_preread on;
+        #接收端也需要设置 proxy_protocol
+        #proxy_protocol on;
+        proxy_pass $name;
+    }
+}
+
+```
+
+### 性能问题
+
+```
+内网环境测试数据
+虚拟服务器：  centos7 4C8G
+anylink:    tun模式 tcp传输
+客户端文件下载速度：240Mb/s
+客户端网卡下载速度：270Mb/s
+服务端网卡上传速度：280Mb/s
+```
+
+> 客户端tls加密协议、隧道header头都会占用一定带宽
+
+

docker/Dockerfile

@@ -0,0 +1,59 @@
+#node:16-bullseye
+#golang:1.20-bullseye
+#debian:bullseye-slim
+#bullseye
+# sed -i 's/deb.debian.org/mirrors.ustc.edu.cn/g' /etc/apt/sources.list
+#bookworm
+# sed -i 's/deb.debian.org/mirrors.ustc.edu.cn/g' /etc/apt/sources.list.d/debian.sources
+
+# sed -i 's/dl-cdn.alpinelinux.org/mirrors.tuna.tsinghua.edu.cn/g' /etc/apk/repositories
+
+
+# 配合 github action 使用
+# 需要先编译出ui文件后 再执行docker编译
+
+# server
+FROM golang:1.20-alpine3.19 as builder_golang
+
+ARG CN="no"
+ARG appVer="appVer"
+ARG commitId="commitId"
+
+ENV TZ=Asia/Shanghai
+
+WORKDIR /server
+COPY docker/init_build.sh /tmp/
+COPY server/ /server/
+COPY web/ui  /server/ui
+
+#RUN apk add gcc musl-dev bash
+RUN sh /tmp/init_build.sh
+
+
+# anylink
+FROM alpine:3.19
+LABEL maintainer="github.com/bjdgyc"
+
+ARG CN="no"
+
+ENV TZ=Asia/Shanghai
+ENV ANYLINK_IN_CONTAINER=true
+
+WORKDIR /app
+COPY docker/init_release.sh /tmp/
+
+COPY --from=builder_golang /server/anylink  /app/
+COPY docker/docker_entrypoint.sh server/bridge-init.sh ./README.md ./LICENSE version_info /app/
+COPY ./deploy /app/deploy
+COPY ./index_template  /app/index_template
+COPY ./server/conf  /app/conf
+
+#TODO 本地打包时使用镜像
+RUN sh /tmp/init_release.sh
+
+
+EXPOSE 443 8800 443/udp
+
+#CMD ["/app/anylink"]
+ENTRYPOINT ["/app/docker_entrypoint.sh"]
+

docker/docker_entrypoint.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+var1=$1
+
+#set -x
+
+case $var1 in
+"bash" | "sh")
+  echo $var1
+  exec "$@"
+  ;;
+
+"tool")
+  /app/anylink "$@"
+  ;;
+
+*)
+  #sysctl -w net.ipv4.ip_forward=1
+  #iptables -t nat -A POSTROUTING -s "${IPV4_CIDR}" -o eth0+ -j MASQUERADE
+  #iptables -nL -t nat
+
+  # 启动服务 先判断配置文件是否存在
+  if [ ! -f /app/conf/profile.xml ]; then
+    /bin/cp -r /home/conf-bak/* /app/conf/
+    echo "After the configuration file is initialized, the container will be forcibly exited. Restart the container."
+    echo "配置文件初始化完成后，容器会强制退出，请重新启动容器。"
+    exit 1
+  fi
+
+  exec /app/anylink "$@"
+  ;;
+esac

docker/generate-certs.sh

@@ -0,0 +1,41 @@
+#!/bin/sh
+
+mkdir -p /ssl
+
+OUTPUT_FILENAME="vpn.xx.com"
+
+printf "[req]
+prompt                  = no
+default_bits            = 4096
+default_md              = sha256
+encrypt_key             = no
+string_mask             = utf8only
+
+distinguished_name      = cert_distinguished_name
+req_extensions          = req_x509v3_extensions
+x509_extensions         = req_x509v3_extensions
+
+[ cert_distinguished_name ]
+C  = CN
+ST = BJ
+L  = BJ
+O  = xx.com
+OU = xx.com
+CN = xx.com
+
+[req_x509v3_extensions]
+basicConstraints        = critical,CA:true
+subjectKeyIdentifier    = hash
+keyUsage                = critical,digitalSignature,keyCertSign,cRLSign #,keyEncipherment
+extendedKeyUsage        = critical,serverAuth #, clientAuth
+subjectAltName          = @alt_names
+
+[alt_names]
+DNS.1 = xx.com
+DNS.2 = *.xx.com
+
+">/ssl/${OUTPUT_FILENAME}.conf
+
+openssl req -x509 -newkey rsa:2048 -keyout /ssl/test_vpn_key.pem -out /ssl/test_vpn_cert.pem \
+-days 3600 -nodes -config /ssl/${OUTPUT_FILENAME}.conf
+

docker/init_build.sh

@@ -0,0 +1,33 @@
+#!/bin/sh
+
+set -x
+
+#TODO 本地打包时使用镜像
+if [[ $CN == "yes" ]]; then
+  sed -i 's/dl-cdn.alpinelinux.org/mirrors.tuna.tsinghua.edu.cn/g' /etc/apk/repositories
+  export GOPROXY=https://goproxy.cn
+fi
+
+apk add build-base tzdata gcc g++ musl musl-dev upx
+
+uname -a
+env
+date
+
+cd /server
+
+go mod tidy
+
+echo "start build"
+
+ldflags="-s -w -X main.appVer=$appVer -X main.commitId=$commitId -X main.buildDate=$(date -Iseconds) -extldflags '-static' "
+
+export CGO_ENABLED=1
+go build -v -o anylink -trimpath -ldflags "$ldflags"
+
+ls -lh /server/
+
+# 压缩文件
+upx -9 -k anylink
+
+/server/anylink -v

docker/init_release.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+
+set -x
+
+#TODO 本地打包时使用镜像
+if [[ $CN == "yes" ]]; then
+  sed -i 's/dl-cdn.alpinelinux.org/mirrors.tuna.tsinghua.edu.cn/g' /etc/apk/repositories
+  export GOPROXY=https://goproxy.cn
+fi
+
+# alpine:3.19 兼容老版 iptables
+apk add --no-cache iptables iptables-legacy
+rm /sbin/iptables
+ln -s /sbin/iptables-legacy /sbin/iptables
+
+apk add --no-cache ca-certificates bash iproute2 tzdata
+chmod +x /app/docker_entrypoint.sh
+mkdir /app/log
+
+#备份配置文件
+cp -r /app/conf /home/conf-bak
+
+tree /app
+
+uname -a
+date -Iseconds

down_files/.gitignore

@@ -1,5 +0,0 @@
-# Binaries for programs and plugins
-
-*
-!.gitignore
-!index.html

down_files/index.html

@@ -1,10 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <title>Title</title>
-</head>
-<body>
-
-</body>
-</html>

go.mod

@@ -1,26 +0,0 @@
-module github.com/bjdgyc/anylink
-
-go 1.15
-
-require (
-	github.com/StackExchange/wmi v0.0.0-20190523213315-cbe66965904d // indirect
-	github.com/asdine/storm/v3 v3.2.1
-	github.com/dgrijalva/jwt-go v3.2.0+incompatible
-	github.com/go-ole/go-ole v1.2.4 // indirect
-	github.com/google/gopacket v1.1.19
-	github.com/gorilla/mux v1.8.0
-	github.com/mojocn/base64Captcha v1.3.1
-	github.com/pelletier/go-toml v1.8.1
-	github.com/shirou/gopsutil v3.20.11+incompatible
-	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
-	github.com/songgao/packets v0.0.0-20160404182456-549a10cd4091
-	github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8
-	github.com/stretchr/testify v1.6.1
-	github.com/xhit/go-simple-mail/v2 v2.6.0
-	github.com/xlzd/gotp v0.0.0-20181030022105-c8557ba2c119
-	go.etcd.io/bbolt v1.3.5
-	golang.org/x/crypto v0.0.0-20201208171446-5f87f3452ae9
-	golang.org/x/net v0.0.0-20201209123823-ac852fbbde11
-	golang.org/x/time v0.0.0-20201208040808-7e3f01d25324
-	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1
-)

go.sum

@@ -1,98 +0,0 @@
-github.com/DataDog/zstd v1.4.1 h1:3oxKN3wbHibqx897utPC2LTQU4J+IHWWJO+glkAkpFM=
-github.com/DataDog/zstd v1.4.1/go.mod h1:1jcaCB/ufaK+sKp1NBhlGmpz41jOoPQ35bpF36t7BBo=
-github.com/Sereal/Sereal v0.0.0-20190618215532-0b8ac451a863 h1:BRrxwOZBolJN4gIwvZMJY1tzqBvQgpaZiQRuIDD40jM=
-github.com/Sereal/Sereal v0.0.0-20190618215532-0b8ac451a863/go.mod h1:D0JMgToj/WdxCgd30Kc1UcA9E+WdZoJqeVOuYW7iTBM=
-github.com/StackExchange/wmi v0.0.0-20190523213315-cbe66965904d h1:G0m3OIz70MZUWq3EgK3CesDbo8upS2Vm9/P3FtgI+Jk=
-github.com/StackExchange/wmi v0.0.0-20190523213315-cbe66965904d/go.mod h1:3eOhrUMpNV+6aFIbp5/iudMxNCF27Vw2OZgy4xEx0Fg=
-github.com/asdine/storm/v3 v3.2.1 h1:I5AqhkPK6nBZ/qJXySdI7ot5BlXSZ7qvDY1zAn5ZJac=
-github.com/asdine/storm/v3 v3.2.1/go.mod h1:LEpXwGt4pIqrE/XcTvCnZHT5MgZCV6Ub9q7yQzOFWr0=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
-github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
-github.com/go-ole/go-ole v1.2.4 h1:nNBDSCOigTSiarFpYE9J/KtEA1IOW4CNeqT9TQDqCxI=
-github.com/go-ole/go-ole v1.2.4/go.mod h1:XCwSNxSkXRo4vlyPy93sltvi/qJq0jqQhjqQNIwKuxM=
-github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 h1:DACJavvAHhabrF08vX0COfcOBJRhZ8lUbR+ZWIs0Y5g=
-github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/snappy v0.0.1 h1:Qgr9rKW7uDUkrbSmQeiDsGa8SjGyCOGtuasMWwvp2P4=
-github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
-github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
-github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
-github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
-github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/mojocn/base64Captcha v1.3.1 h1:2Wbkt8Oc8qjmNJ5GyOfSo4tgVQPsbKMftqASnq8GlT0=
-github.com/mojocn/base64Captcha v1.3.1/go.mod h1:wAQCKEc5bDujxKRmbT6/vTnTt5CjStQ8bRfPWUuz/iY=
-github.com/pelletier/go-toml v1.8.1 h1:1Nf83orprkJyknT6h7zbuEGUEjcyVlCxSUGTENmNCRM=
-github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/shirou/gopsutil v3.20.11+incompatible h1:LJr4ZQK4mPpIV5gOa4jCOKOGb4ty4DZO54I4FGqIpto=
-github.com/shirou/gopsutil v3.20.11+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA=
-github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e h1:MRM5ITcdelLK2j1vwZ3Je0FKVCfqOLp5zO6trqMLYs0=
-github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e/go.mod h1:XV66xRDqSt+GTGFMVlhk3ULuV0y9ZmzeVGR4mloJI3M=
-github.com/songgao/packets v0.0.0-20160404182456-549a10cd4091 h1:1zN6ImoqhSJhN8hGXFaJlSC8msLmIbX8bFqOfWLKw0w=
-github.com/songgao/packets v0.0.0-20160404182456-549a10cd4091/go.mod h1:N20Z5Y8oye9a7HmytmZ+tr8Q2vlP0tAHP13kTHzwvQY=
-github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8 h1:TG/diQgUe0pntT/2D9tmUCz4VNwm9MfrtPr0SU2qSX8=
-github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8/go.mod h1:P5HUIBuIWKbyjl083/loAegFkfbFNx5i2qEP4CNbm7E=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/vmihailenco/msgpack v4.0.4+incompatible h1:dSLoQfGFAo3F6OoNhwUmLwVgaUXK79GlxNBwueZn0xI=
-github.com/vmihailenco/msgpack v4.0.4+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
-github.com/xhit/go-simple-mail/v2 v2.6.0 h1:pvPmpDUUWy07cnTgwxwEe5fjdyYtETnxcvdGPQxtv/k=
-github.com/xhit/go-simple-mail/v2 v2.6.0/go.mod h1:kA1XbQfCI4JxQ9ccSN6VFyIEkkugOm7YiPkA5hKiQn4=
-github.com/xlzd/gotp v0.0.0-20181030022105-c8557ba2c119 h1:YyPWX3jLOtYKulBR6AScGIs74lLrJcgeKRwcbAuQOG4=
-github.com/xlzd/gotp v0.0.0-20181030022105-c8557ba2c119/go.mod h1:/nuTSlK+okRfR/vnIPqR89fFKonnWPiZymN5ydRJkX8=
-go.etcd.io/bbolt v1.3.4/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
-go.etcd.io/bbolt v1.3.5 h1:XAzx9gjCb0Rxj7EoqcClPD1d5ZBxZJk0jbuoPHenBt0=
-go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20201208171446-5f87f3452ae9 h1:sYNJzB4J8toYPQTM6pAkcmBRgw9SnQKP9oXCHfgy604=
-golang.org/x/crypto v0.0.0-20201208171446-5f87f3452ae9/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
-golang.org/x/image v0.0.0-20190501045829-6d32002ffd75 h1:TbGuee8sSq15Iguxu4deQ7+Bqq/d2rsQejGcEtADAMQ=
-golang.org/x/image v0.0.0-20190501045829-6d32002ffd75/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191105084925-a882066a44e0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20201209123823-ac852fbbde11 h1:lwlPPsmjDKK0J6eG6xDWd5XPehI0R024zxjDnw3esPA=
-golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68 h1:nxC68pudNYkKU6jWhgrqdreuFiOQWj1Fs7T3VrH4Pjw=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/time v0.0.0-20201208040808-7e3f01d25324 h1:Hir2P/De0WpUhtrKGGjvSb2YxUgyZ7EFOSLIcSSpiwE=
-golang.org/x/time v0.0.0-20201208040808-7e3f01d25324/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/appengine v1.6.5 h1:tycE03LOZYQNhDpS27tcQdAzLCVMaj7QT2SXxebnpCM=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

handler/dtls.go

@@ -1,5 +0,0 @@
-package handler
-
-// 暂时没有实现
-func startDtls() {
-}

handler/link_auth.go

@@ -1,177 +0,0 @@
-package handler
-
-import (
-	"encoding/xml"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"net/http"
-	"strings"
-	"text/template"
-
-	"github.com/bjdgyc/anylink/base"
-	"github.com/bjdgyc/anylink/dbdata"
-	"github.com/bjdgyc/anylink/sessdata"
-)
-
-func LinkAuth(w http.ResponseWriter, r *http.Request) {
-	// 判断anyconnect客户端
-	userAgent := strings.ToLower(r.UserAgent())
-	x_Aggregate_Auth := r.Header.Get("X-Aggregate-Auth")
-	x_Transcend_Version := r.Header.Get("X-Transcend-Version")
-	if !(strings.Contains(userAgent, "anyconnect") &&
-		x_Aggregate_Auth == "1" && x_Transcend_Version == "1") {
-		w.WriteHeader(http.StatusForbidden)
-		fmt.Fprintf(w, "error request")
-		return
-	}
-
-	body, err := ioutil.ReadAll(r.Body)
-	if err != nil {
-		w.WriteHeader(http.StatusBadRequest)
-		return
-	}
-	defer r.Body.Close()
-
-	cr := ClientRequest{}
-	err = xml.Unmarshal(body, &cr)
-	if err != nil {
-		w.WriteHeader(http.StatusBadRequest)
-		return
-	}
-	// fmt.Printf("%+v \n", cr)
-
-	setCommonHeader(w)
-	if cr.Type == "logout" {
-		// 退出删除session信息
-		if cr.SessionToken != "" {
-			sessdata.DelSessByStoken(cr.SessionToken)
-		}
-		w.WriteHeader(http.StatusOK)
-		return
-	}
-
-	if cr.Type == "init" {
-		w.WriteHeader(http.StatusOK)
-		data := RequestData{Group: cr.GroupSelect, Groups: dbdata.GetGroupNames()}
-		tplRequest(tpl_request, w, data)
-		return
-	}
-
-	// 登陆参数判断
-	if cr.Type != "auth-reply" {
-		w.WriteHeader(http.StatusBadRequest)
-		return
-	}
-
-	// TODO 用户密码校验
-	err = dbdata.CheckUser(cr.Auth.Username, cr.Auth.Password, cr.GroupSelect)
-	if err != nil {
-		base.Info(err)
-		w.WriteHeader(http.StatusOK)
-		data := RequestData{Group: cr.GroupSelect, Groups: dbdata.GetGroupNames(), Error: "用户名或密码错误"}
-		tplRequest(tpl_request, w, data)
-		return
-	}
-	// if !ok {
-	//	w.WriteHeader(http.StatusOK)
-	//	data := RequestData{Group: cr.GroupSelect, Groups: base.Cfg.UserGroups, Error: "请先激活用户"}
-	//	tplRequest(tpl_request, w, data)
-	//	return
-	// }
-
-	// 创建新的session信息
-	sess := sessdata.NewSession("")
-	sess.Username = cr.Auth.Username
-	sess.Group = cr.GroupSelect
-	sess.MacAddr = strings.ToLower(cr.MacAddressList.MacAddress)
-	sess.UniqueIdGlobal = cr.DeviceId.UniqueIdGlobal
-	other := &dbdata.SettingOther{}
-	dbdata.SettingGet(other)
-	rd := RequestData{SessionId: sess.Sid, SessionToken: sess.Sid + "@" + sess.Token,
-		Banner: other.Banner}
-	w.WriteHeader(http.StatusOK)
-	tplRequest(tpl_complete, w, rd)
-}
-
-const (
-	tpl_request = iota
-	tpl_complete
-)
-
-func tplRequest(typ int, w io.Writer, data RequestData) {
-	if typ == tpl_request {
-		t, _ := template.New("auth_request").Parse(auth_request)
-		t.Execute(w, data)
-		return
-	}
-
-	if strings.Contains(data.Banner, "\n") {
-		// 替换xml文件的换行符
-		data.Banner = strings.ReplaceAll(data.Banner, "\n", "
")
-	}
-	t, _ := template.New("auth_complete").Parse(auth_complete)
-	t.Execute(w, data)
-}
-
-// 设置输出信息
-type RequestData struct {
-	Groups []string
-	Group  string
-	Error  string
-
-	// complete
-	SessionId    string
-	SessionToken string
-	Banner       string
-}
-
-var auth_request = `<?xml version="1.0" encoding="UTF-8"?>
-<config-auth client="vpn" type="auth-request" aggregate-auth-version="2">
-    <opaque is-for="sg">
-        <tunnel-group>{{.Group}}</tunnel-group>
-        <group-alias>{{.Group}}</group-alias>
-        <aggauth-handle>168179266</aggauth-handle>
-        <config-hash>1595829378234</config-hash>
-        <auth-method>multiple-cert</auth-method>
-        <auth-method>single-sign-on-v2</auth-method>
-    </opaque>
-    <auth id="main">
-        <title>Login</title>
-        <message>请输入你的用户名和密码</message>
-        <banner></banner>
-        {{if .Error}}
-        <error id="88" param1="{{.Error}}" param2="">登陆失败:  %s</error>
-        {{end}}
-        <form>
-            <input type="text" name="username" label="Username:"></input>
-            <input type="password" name="password" label="Password:"></input>
-            <select name="group_list" label="GROUP:">
-                {{range $v := .Groups}}
-                <option {{if eq $v $.Group}} selected="true"{{end}}>{{$v}}</option>
-                {{end}}
-            </select>
-        </form>
-    </auth>
-</config-auth>
-`
-
-var auth_complete = `<?xml version="1.0" encoding="UTF-8"?>
-<config-auth client="vpn" type="complete" aggregate-auth-version="2">
-    <session-id>{{.SessionId}}</session-id>
-    <session-token>{{.SessionToken}}</session-token>
-    <auth id="success">
-        <banner>{{.Banner}}</banner>
-        <message id="0" param1="" param2=""></message>
-    </auth>
-    <capabilities>
-        <crypto-supported>ssl-dhe</crypto-supported>
-    </capabilities>
-    <config client="vpn" type="private">
-        <vpn-base-config>
-            <server-cert-hash>240B97A685B2BFA66AD699B90AAC49EA66495D69</server-cert-hash>
-        </vpn-base-config>
-        <opaque is-for="vpn-client"></opaque>
-    </config>
-</config-auth>
-`

handler/link_cstp.go

@@ -1,115 +0,0 @@
-package handler
-
-import (
-	"encoding/binary"
-	"net"
-	"time"
-
-	"github.com/bjdgyc/anylink/base"
-	"github.com/bjdgyc/anylink/sessdata"
-)
-
-func LinkCstp(conn net.Conn, cSess *sessdata.ConnSession) {
-	defer func() {
-		// log.Println("LinkCstp return")
-		conn.Close()
-		cSess.Close()
-	}()
-
-	var (
-		err     error
-		n       int
-		dataLen uint16
-		dead    = time.Duration(cSess.CstpDpd+5) * time.Second
-	)
-
-	go cstpWrite(conn, cSess)
-
-	for {
-
-		// 设置超时限制
-		err = conn.SetReadDeadline(time.Now().Add(dead))
-		if err != nil {
-			base.Error("SetDeadline: ", err)
-			return
-		}
-		hdata := make([]byte, BufferSize)
-		n, err = conn.Read(hdata)
-		if err != nil {
-			base.Error("read hdata: ", err)
-			return
-		}
-
-		// 限流设置
-		err = cSess.RateLimit(n, true)
-		if err != nil {
-			base.Error(err)
-		}
-
-		switch hdata[6] {
-		case 0x07: // KEEPALIVE
-			// do nothing
-			base.Debug("recv keepalive", cSess.IpAddr)
-		case 0x05: // DISCONNECT
-			base.Debug("DISCONNECT", cSess.IpAddr)
-			return
-		case 0x03: // DPD-REQ
-			base.Debug("recv DPD-REQ", cSess.IpAddr)
-			if payloadOut(cSess, sessdata.LTypeIPData, 0x04, nil) {
-				return
-			}
-		case 0x04:
-			// log.Println("recv DPD-RESP")
-		case 0x00: // DATA
-			dataLen = binary.BigEndian.Uint16(hdata[4:6]) // 4,5
-			if payloadIn(cSess, sessdata.LTypeIPData, 0x00, hdata[8:8+dataLen]) {
-				return
-			}
-
-		}
-	}
-}
-
-func cstpWrite(conn net.Conn, cSess *sessdata.ConnSession) {
-	defer func() {
-		// log.Println("cstpWrite return")
-		conn.Close()
-		cSess.Close()
-	}()
-
-	var (
-		err     error
-		n       int
-		header  []byte
-		payload *sessdata.Payload
-	)
-
-	for {
-		select {
-		case payload = <-cSess.PayloadOut:
-		case <-cSess.CloseChan:
-			return
-		}
-
-		if payload.LType != sessdata.LTypeIPData {
-			continue
-		}
-
-		header = []byte{'S', 'T', 'F', 0x01, 0x00, 0x00, payload.PType, 0x00}
-		if payload.PType == 0x00 { // data
-			binary.BigEndian.PutUint16(header[4:6], uint16(len(payload.Data)))
-			header = append(header, payload.Data...)
-		}
-		n, err = conn.Write(header)
-		if err != nil {
-			base.Error("write err", err)
-			return
-		}
-
-		// 限流设置
-		err = cSess.RateLimit(n, false)
-		if err != nil {
-			base.Error(err)
-		}
-	}
-}

handler/link_tunnel.go

@@ -1,156 +0,0 @@
-package handler
-
-import (
-	"fmt"
-	"log"
-	"net"
-	"net/http"
-	"os"
-
-	"github.com/bjdgyc/anylink/base"
-	"github.com/bjdgyc/anylink/sessdata"
-)
-
-var hn string
-
-func init() {
-	// 获取主机名称
-	hn, _ = os.Hostname()
-}
-
-func LinkTunnel(w http.ResponseWriter, r *http.Request) {
-	// TODO 调试信息输出
-	// hd, _ := httputil.DumpRequest(r, true)
-	// fmt.Println("DumpRequest: ", string(hd))
-	// fmt.Println("LinkTunnel", r.RemoteAddr)
-
-	// 判断session-token的值
-	cookie, err := r.Cookie("webvpn")
-	if err != nil || cookie.Value == "" {
-		w.WriteHeader(http.StatusBadRequest)
-		return
-	}
-
-	sess := sessdata.SToken2Sess(cookie.Value)
-	if sess == nil {
-		w.WriteHeader(http.StatusBadRequest)
-		return
-	}
-
-	// 开启link
-	cSess := sess.NewConn()
-	if cSess == nil {
-		log.Println(err)
-		w.WriteHeader(http.StatusBadRequest)
-		return
-	}
-
-	// 客户端信息
-	cstpMtu := r.Header.Get("X-CSTP-MTU")
-	masterSecret := r.Header.Get("X-DTLS-Master-Secret")
-	localIp := r.Header.Get("X-Cstp-Local-Address-Ip4")
-	mobile := r.Header.Get("X-Cstp-License")
-
-	cSess.SetMtu(cstpMtu)
-	cSess.MasterSecret = masterSecret
-	cSess.RemoteAddr = r.RemoteAddr
-	cSess.LocalIp = net.ParseIP(localIp)
-	cstpKeepalive := base.Cfg.CstpKeepalive
-	cstpDpd := base.Cfg.CstpDpd
-	cSess.Client = "pc"
-	if mobile == "mobile" {
-		// 手机客户端
-		cstpKeepalive = base.Cfg.MobileKeepalive
-		cstpDpd = base.Cfg.MobileDpd
-		cSess.Client = "mobile"
-	}
-	cSess.CstpDpd = cstpDpd
-
-	base.Debug(cSess.IpAddr, cSess.MacHw, sess.Username, mobile)
-
-	// 返回客户端数据
-	w.Header().Set("Server", fmt.Sprintf("%s %s", base.APP_NAME, base.APP_VER))
-	w.Header().Set("X-CSTP-Version", "1")
-	w.Header().Set("X-CSTP-Protocol", "Copyright (c) 2004 Cisco Systems, Inc.")
-	w.Header().Set("X-CSTP-Address", cSess.IpAddr.String()) // 分配的ip地址
-	w.Header().Set("X-CSTP-Netmask", base.Cfg.Ipv4Netmask)  // 子网掩码
-	w.Header().Set("X-CSTP-Hostname", hn)                   // 机器名称
-
-	// 允许本地LAN访问vpn网络，必须放在路由的第一个
-	if cSess.Group.AllowLan {
-		w.Header().Set("X-CSTP-Split-Exclude", "0.0.0.0/255.255.255.255")
-	}
-	// dns地址
-	for _, v := range cSess.Group.ClientDns {
-		w.Header().Add("X-CSTP-DNS", v.Val)
-	}
-	// 允许的路由
-	for _, v := range cSess.Group.RouteInclude {
-		w.Header().Add("X-CSTP-Split-Include", v.Val)
-	}
-	// 不允许的路由
-	for _, v := range cSess.Group.RouteExclude {
-		w.Header().Add("X-CSTP-Split-Exclude", v.Val)
-	}
-
-	w.Header().Set("X-CSTP-Lease-Duration", fmt.Sprintf("%d", base.Cfg.IpLease)) // ip地址租期
-	w.Header().Set("X-CSTP-Session-Timeout", "none")
-	w.Header().Set("X-CSTP-Session-Timeout-Alert-Interval", "60")
-	w.Header().Set("X-CSTP-Session-Timeout-Remaining", "none")
-	w.Header().Set("X-CSTP-Idle-Timeout", "18000")
-	w.Header().Set("X-CSTP-Disconnected-Timeout", "18000")
-	w.Header().Set("X-CSTP-Keep", "true")
-	w.Header().Set("X-CSTP-Tunnel-All-DNS", "false")
-
-	w.Header().Set("X-CSTP-Rekey-Time", "172800")
-	w.Header().Set("X-CSTP-Rekey-Method", "new-tunnel")
-
-	w.Header().Set("X-CSTP-DPD", fmt.Sprintf("%d", cstpDpd))
-	w.Header().Set("X-CSTP-Keepalive", fmt.Sprintf("%d", cstpKeepalive))
-	// w.Header().Set("X-CSTP-Banner", banner.Banner)
-	w.Header().Set("X-CSTP-MSIE-Proxy-Lockdown", "true")
-	w.Header().Set("X-CSTP-Smartcard-Removal-Disconnect", "true")
-
-	w.Header().Set("X-CSTP-MTU", fmt.Sprintf("%d", cSess.Mtu)) // 1399
-	w.Header().Set("X-DTLS-MTU", fmt.Sprintf("%d", cSess.Mtu))
-
-	w.Header().Set("X-DTLS-Session-ID", sess.DtlsSid)
-	w.Header().Set("X-DTLS-Port", "4433")
-	w.Header().Set("X-DTLS-Keepalive", fmt.Sprintf("%d", base.Cfg.CstpKeepalive))
-	w.Header().Set("X-DTLS-Rekey-Time", "5400")
-	w.Header().Set("X-DTLS12-CipherSuite", "ECDHE-ECDSA-AES128-GCM-SHA256")
-	// w.Header().Set("X-DTLS12-CipherSuite", "ECDHE-RSA-AES128-GCM-SHA256")
-
-	w.Header().Set("X-CSTP-License", "accept")
-	w.Header().Set("X-CSTP-Routing-Filtering-Ignore", "false")
-	w.Header().Set("X-CSTP-Quarantine", "false")
-	w.Header().Set("X-CSTP-Disable-Always-On-VPN", "false")
-	w.Header().Set("X-CSTP-Client-Bypass-Protocol", "false")
-	w.Header().Set("X-CSTP-TCP-Keepalive", "false")
-	// w.Header().Set("X-CSTP-Post-Auth-XML", ``)
-	w.WriteHeader(http.StatusOK)
-
-	// h := w.Header().Clone()
-	// h.Write(os.Stdout)
-
-	hj := w.(http.Hijacker)
-	conn, _, err := hj.Hijack()
-	if err != nil {
-		w.WriteHeader(http.StatusInternalServerError)
-		return
-	}
-
-	// 开始数据处理
-	switch base.Cfg.LinkMode {
-	case base.LinkModeTUN:
-		err = LinkTun(cSess)
-	case base.LinkModeTAP:
-		err = LinkTap(cSess)
-	}
-	if err != nil {
-		w.WriteHeader(http.StatusInternalServerError)
-		return
-	}
-
-	go LinkCstp(conn, cSess)
-}

handler/payload.go

@@ -1,47 +0,0 @@
-package handler
-
-import "github.com/bjdgyc/anylink/sessdata"
-
-func payloadIn(cSess *sessdata.ConnSession, lType sessdata.LType, pType byte, data []byte) bool {
-	payload := &sessdata.Payload{
-		LType: lType,
-		PType: pType,
-		Data:  data,
-	}
-
-	return payloadInData(cSess, payload)
-}
-
-func payloadInData(cSess *sessdata.ConnSession, payload *sessdata.Payload) bool {
-	closed := false
-
-	select {
-	case cSess.PayloadIn <- payload:
-	case <-cSess.CloseChan:
-		closed = true
-	}
-
-	return closed
-}
-
-func payloadOut(cSess *sessdata.ConnSession, lType sessdata.LType, pType byte, data []byte) bool {
-	payload := &sessdata.Payload{
-		LType: lType,
-		PType: pType,
-		Data:  data,
-	}
-
-	return payloadOutData(cSess, payload)
-}
-
-func payloadOutData(cSess *sessdata.ConnSession, payload *sessdata.Payload) bool {
-	closed := false
-
-	select {
-	case cSess.PayloadOut <- payload:
-	case <-cSess.CloseChan:
-		closed = true
-	}
-
-	return closed
-}

handler/server.go

@@ -1,76 +0,0 @@
-package handler
-
-import (
-	"crypto/tls"
-	"fmt"
-	"log"
-	"net"
-	"net/http"
-	"os"
-	"time"
-
-	"github.com/bjdgyc/anylink/base"
-	"github.com/bjdgyc/anylink/pkg/proxyproto"
-	"github.com/gorilla/mux"
-)
-
-func startTls() {
-	addr := base.Cfg.ServerAddr
-	certFile := base.Cfg.CertFile
-	keyFile := base.Cfg.CertKey
-
-	logger := log.New(os.Stdout, "[SERVER]", log.Lshortfile|log.Ldate)
-	// 设置tls信息
-	tlsConfig := &tls.Config{
-		NextProtos: []string{"http/1.1"},
-		MinVersion: tls.VersionTLS12,
-	}
-	srv := &http.Server{
-		Addr:      addr,
-		Handler:   initRoute(),
-		TLSConfig: tlsConfig,
-		ErrorLog:  logger,
-	}
-
-	var ln net.Listener
-
-	ln, err := net.Listen("tcp", addr)
-	if err != nil {
-		log.Fatal(err)
-	}
-	defer ln.Close()
-
-	if base.Cfg.ProxyProtocol {
-		ln = &proxyproto.Listener{Listener: ln, ProxyHeaderTimeout: time.Second * 5}
-	}
-
-	base.Info("listen server", addr)
-	err = srv.ServeTLS(ln, certFile, keyFile)
-	if err != nil {
-		base.Fatal(err)
-	}
-}
-
-func initRoute() http.Handler {
-	r := mux.NewRouter()
-	r.HandleFunc("/", LinkHome).Methods(http.MethodGet)
-	r.HandleFunc("/", LinkAuth).Methods(http.MethodPost)
-	r.HandleFunc("/CSCOSSLC/tunnel", LinkTunnel).Methods(http.MethodConnect)
-	r.HandleFunc("/otp_qr", LinkOtpQr).Methods(http.MethodGet)
-	r.PathPrefix("/down_files/").Handler(
-		http.StripPrefix("/down_files/",
-			http.FileServer(http.Dir(base.Cfg.DownFilesPath)),
-		),
-	)
-	r.NotFoundHandler = http.HandlerFunc(notFound)
-	return r
-}
-
-func notFound(w http.ResponseWriter, r *http.Request) {
-	// fmt.Println(r.RemoteAddr)
-	// hu, _ := httputil.DumpRequest(r, true)
-	// fmt.Println("NotFound: ", string(hu))
-
-	w.WriteHeader(http.StatusNotFound)
-	fmt.Fprintln(w, "404 page not found")
-}

handler/start.go

@@ -1,25 +0,0 @@
-package handler
-
-import (
-	"github.com/bjdgyc/anylink/admin"
-	"github.com/bjdgyc/anylink/base"
-	"github.com/bjdgyc/anylink/dbdata"
-	"github.com/bjdgyc/anylink/sessdata"
-)
-
-func Start() {
-	dbdata.Start()
-	sessdata.Start()
-
-	checkTun()
-	if base.Cfg.LinkMode == base.LinkModeTAP {
-		checkTap()
-	}
-	go admin.StartAdmin()
-	go startTls()
-	go startDtls()
-}
-
-func Stop() {
-	dbdata.Stop()
-}

index_template/自定义首页1.html

@@ -0,0 +1,101 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="UTF-8">
+  <title>AnyLink - 企业级远程办公 SSL VPN</title>
+  <style>
+    /* CSS样式表 */
+    body {
+      font-family: Arial, sans-serif;
+      margin: 0;
+      padding: 0;
+    }
+    
+    header {
+      background-color: #333;
+      color: #fff;
+      padding: 20px;
+      text-align: center;
+    }
+    
+    h1 {
+      margin: 0;
+      font-size: 32px;
+    }
+    
+    main {
+      max-width: 960px;
+      margin: 20px auto;
+      padding: 0 20px;
+	  margin-bottom: 100px;
+    }
+    
+    p {
+      line-height: 1.5;
+    }
+    
+	/* 设置页脚固定在底部，并且占满横向宽度 */
+	footer {
+		position: fixed;
+		bottom: 0;
+		left: 0;
+		width: 100%;
+	}
+	
+    footer {
+      background-color: #f2f2f2;
+      padding: 20px;
+      text-align: center;
+    }
+	
+    
+    .cta-button {
+      display: inline-block;
+      background-color: #007bff;
+      color: #fff;
+      padding: 10px 20px;
+      text-decoration: none;
+      border-radius: 4px;
+      font-weight: bold;
+      margin-right: 10px;
+    }
+  </style>
+</head>
+<body>
+  <header>
+    <h1>欢迎使用 AnyLink</h1>
+  </header>
+
+  <main>
+    <h2>什么是 AnyLink？</h2>
+    <p>AnyLink 是一款面向企业级的远程办公 SSL VPN 软件，支持多人同时在线使用。它提供安全、便捷的访问内部网络资源的方式，使远程工作者能够有效协作。</p>
+
+    <h2>核心功能</h2>
+    <ul>
+      <li>安全远程访问：AnyLink 使用 SSL/TLS 加密技术，确保远程用户与企业网络之间的连接安全可靠。</li>
+      <li>多用户支持：多个用户可以同时连接 VPN，实现不同地点团队的无缝协作。</li>
+      <li>灵活网络访问：AnyLink 能够安全地让远程工作者访问内部资源，如文件、应用程序和数据库。</li>
+      <li>集中化管理：该 VPN 解决方案提供集中化管理控制台，便于用户管理、访问控制和监控。</li>
+    </ul>
+
+    <h2>开始使用 AnyLink</h2>
+    <p>体验 AnyLink 为您的企业远程办公需求所带来的便利和安全。</p>
+
+    <h2>下载客户端</h2>
+    <a href="/files/anyconnect-win-4.10.05111.msi" class="cta-button">Windows 客户端</a>
+    <a href="/files/anyconnect-macos-4.10.05111.dmg" class="cta-button">Mac 客户端</a>
+
+    <a href="https://apps.apple.com/cn/app/cisco-secure-client/id1135064690" class="cta-button">iOS 客户端</a>
+    <a href="/files/CiscoSecureClientAnyConnect_v5.0.00247.apk" class="cta-button">Android 客户端</a>
+
+    <a href="/files/freeotp.apk" class="cta-button">Android FreeOTP客户端</a>
+    <a href="https://apps.apple.com/cn/app/freeotp-authenticator/id872559395" class="cta-button">iOS FreeOTP客户端</a>
+    <h2>使用手册</h2>
+    <a href="/files/anylink_doc.pdf" class="cta-button">使用手册(Windows)</a>
+  </main>
+
+  <footer>
+    &copy; 2023 AnyLink. 保留所有权利。
+  </footer>
+</body>
+</html>

pkg/proxyproto/protocol.go

@@ -1,288 +0,0 @@
-// copy from: https://github.com/armon/go-proxyproto/blob/master/protocol.go
-// design: http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt
-
-// HAProxy proxy proto v1
-package proxyproto
-
-import (
-	"bufio"
-	"bytes"
-	"errors"
-	"fmt"
-	"io"
-	"log"
-	"net"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-)
-
-var (
-	// prefix is the string we look for at the start of a connection
-	// to check if this connection is using the proxy protocol
-	prefix    = []byte("PROXY ")
-	prefixLen = len(prefix)
-
-	ErrInvalidUpstream = errors.New("upstream connection address not trusted for PROXY information")
-)
-
-// SourceChecker can be used to decide whether to trust the PROXY info or pass
-// the original connection address through. If set, the connecting address is
-// passed in as an argument. If the function returns an error due to the source
-// being disallowed, it should return ErrInvalidUpstream.
-//
-// If error is not nil, the call to Accept() will fail. If the reason for
-// triggering this failure is due to a disallowed source, it should return
-// ErrInvalidUpstream.
-//
-// If bool is true, the PROXY-set address is used.
-//
-// If bool is false, the connection's remote address is used, rather than the
-// address claimed in the PROXY info.
-type SourceChecker func(net.Addr) (bool, error)
-
-// Listener is used to wrap an underlying listener,
-// whose connections may be using the HAProxy Proxy Protocol (version 1).
-// If the connection is using the protocol, the RemoteAddr() will return
-// the correct client address.
-//
-// Optionally define ProxyHeaderTimeout to set a maximum time to
-// receive the Proxy Protocol Header. Zero means no timeout.
-type Listener struct {
-	Listener           net.Listener
-	ProxyHeaderTimeout time.Duration
-	SourceCheck        SourceChecker
-	UnknownOK          bool // allow PROXY UNKNOWN
-}
-
-// Conn is used to wrap and underlying connection which
-// may be speaking the Proxy Protocol. If it is, the RemoteAddr() will
-// return the address of the client instead of the proxy address.
-type Conn struct {
-	bufReader          *bufio.Reader
-	conn               net.Conn
-	dstAddr            *net.TCPAddr
-	srcAddr            *net.TCPAddr
-	useConnAddr        bool
-	once               sync.Once
-	proxyHeaderTimeout time.Duration
-	unknownOK          bool
-}
-
-// Accept waits for and returns the next connection to the listener.
-func (p *Listener) Accept() (net.Conn, error) {
-	// Get the underlying connection
-	conn, err := p.Listener.Accept()
-	if err != nil {
-		return nil, err
-	}
-	var useConnAddr bool
-	if p.SourceCheck != nil {
-		allowed, err := p.SourceCheck(conn.RemoteAddr())
-		if err != nil {
-			return nil, err
-		}
-		if !allowed {
-			useConnAddr = true
-		}
-	}
-	newConn := NewConn(conn, p.ProxyHeaderTimeout)
-	newConn.useConnAddr = useConnAddr
-	newConn.unknownOK = p.UnknownOK
-	return newConn, nil
-}
-
-// Close closes the underlying listener.
-func (p *Listener) Close() error {
-	return p.Listener.Close()
-}
-
-// Addr returns the underlying listener's network address.
-func (p *Listener) Addr() net.Addr {
-	return p.Listener.Addr()
-}
-
-// NewConn is used to wrap a net.Conn that may be speaking
-// the proxy protocol into a proxyproto.Conn
-func NewConn(conn net.Conn, timeout time.Duration) *Conn {
-	pConn := &Conn{
-		bufReader:          bufio.NewReader(conn),
-		conn:               conn,
-		proxyHeaderTimeout: timeout,
-	}
-	return pConn
-}
-
-// Read is check for the proxy protocol header when doing
-// the initial scan. If there is an error parsing the header,
-// it is returned and the socket is closed.
-func (p *Conn) Read(b []byte) (int, error) {
-	var err error
-	p.once.Do(func() { err = p.checkPrefix() })
-	if err != nil {
-		return 0, err
-	}
-	return p.bufReader.Read(b)
-}
-
-func (p *Conn) ReadFrom(r io.Reader) (int64, error) {
-	if rf, ok := p.conn.(io.ReaderFrom); ok {
-		return rf.ReadFrom(r)
-	}
-	return io.Copy(p.conn, r)
-}
-
-func (p *Conn) WriteTo(w io.Writer) (int64, error) {
-	var err error
-	p.once.Do(func() { err = p.checkPrefix() })
-	if err != nil {
-		return 0, err
-	}
-	return p.bufReader.WriteTo(w)
-}
-
-func (p *Conn) Write(b []byte) (int, error) {
-	return p.conn.Write(b)
-}
-
-func (p *Conn) Close() error {
-	return p.conn.Close()
-}
-
-func (p *Conn) LocalAddr() net.Addr {
-	p.checkPrefixOnce()
-	if p.dstAddr != nil && !p.useConnAddr {
-		return p.dstAddr
-	}
-	return p.conn.LocalAddr()
-}
-
-// RemoteAddr returns the address of the client if the proxy
-// protocol is being used, otherwise just returns the address of
-// the socket peer. If there is an error parsing the header, the
-// address of the client is not returned, and the socket is closed.
-// Once implication of this is that the call could block if the
-// client is slow. Using a Deadline is recommended if this is called
-// before Read()
-func (p *Conn) RemoteAddr() net.Addr {
-	p.checkPrefixOnce()
-	if p.srcAddr != nil && !p.useConnAddr {
-		return p.srcAddr
-	}
-	return p.conn.RemoteAddr()
-}
-
-func (p *Conn) SetDeadline(t time.Time) error {
-	return p.conn.SetDeadline(t)
-}
-
-func (p *Conn) SetReadDeadline(t time.Time) error {
-	return p.conn.SetReadDeadline(t)
-}
-
-func (p *Conn) SetWriteDeadline(t time.Time) error {
-	return p.conn.SetWriteDeadline(t)
-}
-
-func (p *Conn) checkPrefixOnce() {
-	p.once.Do(func() {
-		if err := p.checkPrefix(); err != nil && err != io.EOF {
-			log.Printf("[ERR] Failed to read proxy prefix: %v", err)
-			p.Close()
-			p.bufReader = bufio.NewReader(p.conn)
-		}
-	})
-}
-
-func (p *Conn) checkPrefix() error {
-	if p.proxyHeaderTimeout != 0 {
-		readDeadLine := time.Now().Add(p.proxyHeaderTimeout)
-		p.conn.SetReadDeadline(readDeadLine)
-		defer p.conn.SetReadDeadline(time.Time{})
-	}
-
-	// Incrementally check each byte of the prefix
-	for i := 1; i <= prefixLen; i++ {
-		inp, err := p.bufReader.Peek(i)
-
-		if err != nil {
-			if neterr, ok := err.(net.Error); ok && neterr.Timeout() {
-				return nil
-			} else {
-				return err
-			}
-		}
-
-		// Check for a prefix mis-match, quit early
-		if !bytes.Equal(inp, prefix[:i]) {
-			return nil
-		}
-	}
-
-	// Read the header line
-	header, err := p.bufReader.ReadString('\n')
-	if err != nil {
-		p.conn.Close()
-		return err
-	}
-
-	// Strip the carriage return and new line
-	header = header[:len(header)-2]
-
-	// Split on spaces, should be (PROXY <type> <src addr> <dst addr> <src port> <dst port>)
-	parts := strings.Split(header, " ")
-	if len(parts) < 2 {
-		p.conn.Close()
-		return fmt.Errorf("Invalid header line: %s", header)
-	}
-
-	// Verify the type is known
-	switch parts[1] {
-	case "UNKNOWN":
-		if !p.unknownOK || len(parts) != 2 {
-			p.conn.Close()
-			return fmt.Errorf("Invalid UNKNOWN header line: %s", header)
-		}
-		p.useConnAddr = true
-		return nil
-	case "TCP4":
-	case "TCP6":
-	default:
-		p.conn.Close()
-		return fmt.Errorf("Unhandled address type: %s", parts[1])
-	}
-
-	if len(parts) != 6 {
-		p.conn.Close()
-		return fmt.Errorf("Invalid header line: %s", header)
-	}
-
-	// Parse out the source address
-	ip := net.ParseIP(parts[2])
-	if ip == nil {
-		p.conn.Close()
-		return fmt.Errorf("Invalid source ip: %s", parts[2])
-	}
-	port, err := strconv.Atoi(parts[4])
-	if err != nil {
-		p.conn.Close()
-		return fmt.Errorf("Invalid source port: %s", parts[4])
-	}
-	p.srcAddr = &net.TCPAddr{IP: ip, Port: port}
-
-	// Parse out the destination address
-	ip = net.ParseIP(parts[3])
-	if ip == nil {
-		p.conn.Close()
-		return fmt.Errorf("Invalid destination ip: %s", parts[3])
-	}
-	port, err = strconv.Atoi(parts[5])
-	if err != nil {
-		p.conn.Close()
-		return fmt.Errorf("Invalid destination port: %s", parts[5])
-	}
-	p.dstAddr = &net.TCPAddr{IP: ip, Port: port}
-
-	return nil
-}

pkg/proxyproto/protocol_test.go

@@ -1,486 +0,0 @@
-// copy from: https://github.com/armon/go-proxyproto/blob/master/protocol_test.go
-package proxyproto
-
-import (
-	"bytes"
-	"io"
-	"net"
-	"testing"
-	"time"
-)
-
-const (
-	goodAddr = "127.0.0.1"
-	badAddr  = "127.0.0.2"
-	errAddr  = "9999.0.0.2"
-)
-
-var (
-	checkAddr string
-)
-
-func TestPassthrough(t *testing.T) {
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-
-	pl := &Listener{Listener: l}
-
-	go func() {
-		conn, err := net.Dial("tcp", pl.Addr().String())
-		if err != nil {
-			t.Fatalf("err: %v", err)
-		}
-		defer conn.Close()
-
-		conn.Write([]byte("ping"))
-		recv := make([]byte, 4)
-		_, err = conn.Read(recv)
-		if err != nil {
-			t.Fatalf("err: %v", err)
-		}
-		if !bytes.Equal(recv, []byte("pong")) {
-			t.Fatalf("bad: %v", recv)
-		}
-	}()
-
-	conn, err := pl.Accept()
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	defer conn.Close()
-
-	recv := make([]byte, 4)
-	_, err = conn.Read(recv)
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	if !bytes.Equal(recv, []byte("ping")) {
-		t.Fatalf("bad: %v", recv)
-	}
-
-	if _, err := conn.Write([]byte("pong")); err != nil {
-		t.Fatalf("err: %v", err)
-	}
-}
-
-func TestTimeout(t *testing.T) {
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-
-	clientWriteDelay := 200 * time.Millisecond
-	proxyHeaderTimeout := 50 * time.Millisecond
-	pl := &Listener{Listener: l, ProxyHeaderTimeout: proxyHeaderTimeout}
-
-	go func() {
-		conn, err := net.Dial("tcp", pl.Addr().String())
-		if err != nil {
-			t.Fatalf("err: %v", err)
-		}
-		defer conn.Close()
-
-		// Do not send data for a while
-		time.Sleep(clientWriteDelay)
-
-		conn.Write([]byte("ping"))
-		recv := make([]byte, 4)
-		_, err = conn.Read(recv)
-		if err != nil {
-			t.Fatalf("err: %v", err)
-		}
-		if !bytes.Equal(recv, []byte("pong")) {
-			t.Fatalf("bad: %v", recv)
-		}
-	}()
-
-	conn, err := pl.Accept()
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	defer conn.Close()
-
-	// Check the remote addr is the original 127.0.0.1
-	remoteAddrStartTime := time.Now()
-	addr := conn.RemoteAddr().(*net.TCPAddr)
-	if addr.IP.String() != "127.0.0.1" {
-		t.Fatalf("bad: %v", addr)
-	}
-	remoteAddrDuration := time.Since(remoteAddrStartTime)
-
-	// Check RemoteAddr() call did timeout
-	if remoteAddrDuration >= clientWriteDelay {
-		t.Fatalf("RemoteAddr() took longer than the specified timeout: %v < %v", proxyHeaderTimeout, remoteAddrDuration)
-	}
-
-	recv := make([]byte, 4)
-	_, err = conn.Read(recv)
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	if !bytes.Equal(recv, []byte("ping")) {
-		t.Fatalf("bad: %v", recv)
-	}
-
-	if _, err := conn.Write([]byte("pong")); err != nil {
-		t.Fatalf("err: %v", err)
-	}
-}
-
-func TestParse_ipv4(t *testing.T) {
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-
-	pl := &Listener{Listener: l}
-
-	go func() {
-		conn, err := net.Dial("tcp", pl.Addr().String())
-		if err != nil {
-			t.Fatalf("err: %v", err)
-		}
-		defer conn.Close()
-
-		// Write out the header!
-		header := "PROXY TCP4 10.1.1.1 20.2.2.2 1000 2000\r\n"
-		conn.Write([]byte(header))
-
-		conn.Write([]byte("ping"))
-		recv := make([]byte, 4)
-		_, err = conn.Read(recv)
-		if err != nil {
-			t.Fatalf("err: %v", err)
-		}
-		if !bytes.Equal(recv, []byte("pong")) {
-			t.Fatalf("bad: %v", recv)
-		}
-	}()
-
-	conn, err := pl.Accept()
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	defer conn.Close()
-
-	recv := make([]byte, 4)
-	_, err = conn.Read(recv)
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	if !bytes.Equal(recv, []byte("ping")) {
-		t.Fatalf("bad: %v", recv)
-	}
-
-	if _, err := conn.Write([]byte("pong")); err != nil {
-		t.Fatalf("err: %v", err)
-	}
-
-	// Check the remote addr
-	addr := conn.RemoteAddr().(*net.TCPAddr)
-	if addr.IP.String() != "10.1.1.1" {
-		t.Fatalf("bad: %v", addr)
-	}
-	if addr.Port != 1000 {
-		t.Fatalf("bad: %v", addr)
-	}
-}
-
-func TestParse_ipv6(t *testing.T) {
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-
-	pl := &Listener{Listener: l}
-
-	go func() {
-		conn, err := net.Dial("tcp", pl.Addr().String())
-		if err != nil {
-			t.Fatalf("err: %v", err)
-		}
-		defer conn.Close()
-
-		// Write out the header!
-		header := "PROXY TCP6 ffff::ffff ffff::ffff 1000 2000\r\n"
-		conn.Write([]byte(header))
-
-		conn.Write([]byte("ping"))
-		recv := make([]byte, 4)
-		_, err = conn.Read(recv)
-		if err != nil {
-			t.Fatalf("err: %v", err)
-		}
-		if !bytes.Equal(recv, []byte("pong")) {
-			t.Fatalf("bad: %v", recv)
-		}
-	}()
-
-	conn, err := pl.Accept()
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	defer conn.Close()
-
-	recv := make([]byte, 4)
-	_, err = conn.Read(recv)
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	if !bytes.Equal(recv, []byte("ping")) {
-		t.Fatalf("bad: %v", recv)
-	}
-
-	if _, err := conn.Write([]byte("pong")); err != nil {
-		t.Fatalf("err: %v", err)
-	}
-
-	// Check the remote addr
-	addr := conn.RemoteAddr().(*net.TCPAddr)
-	if addr.IP.String() != "ffff::ffff" {
-		t.Fatalf("bad: %v", addr)
-	}
-	if addr.Port != 1000 {
-		t.Fatalf("bad: %v", addr)
-	}
-}
-
-func TestParse_Unknown(t *testing.T) {
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-
-	pl := &Listener{Listener: l, UnknownOK: true}
-
-	go func() {
-		conn, err := net.Dial("tcp", pl.Addr().String())
-		if err != nil {
-			t.Fatalf("err: %v", err)
-		}
-		defer conn.Close()
-
-		// Write out the header!
-		header := "PROXY UNKNOWN\r\n"
-		conn.Write([]byte(header))
-
-		conn.Write([]byte("ping"))
-		recv := make([]byte, 4)
-		_, err = conn.Read(recv)
-		if err != nil {
-			t.Fatalf("err: %v", err)
-		}
-		if !bytes.Equal(recv, []byte("pong")) {
-			t.Fatalf("bad: %v", recv)
-		}
-	}()
-
-	conn, err := pl.Accept()
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	defer conn.Close()
-
-	recv := make([]byte, 4)
-	_, err = conn.Read(recv)
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	if !bytes.Equal(recv, []byte("ping")) {
-		t.Fatalf("bad: %v", recv)
-	}
-
-	if _, err := conn.Write([]byte("pong")); err != nil {
-		t.Fatalf("err: %v", err)
-	}
-
-}
-
-func TestParse_BadHeader(t *testing.T) {
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-
-	pl := &Listener{Listener: l}
-
-	go func() {
-		conn, err := net.Dial("tcp", pl.Addr().String())
-		if err != nil {
-			t.Fatalf("err: %v", err)
-		}
-		defer conn.Close()
-
-		// Write out the header!
-		header := "PROXY TCP4 what 127.0.0.1 1000 2000\r\n"
-		conn.Write([]byte(header))
-
-		conn.Write([]byte("ping"))
-
-		recv := make([]byte, 4)
-		_, err = conn.Read(recv)
-		if err == nil {
-			t.Fatalf("err: %v", err)
-		}
-	}()
-
-	conn, err := pl.Accept()
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	defer conn.Close()
-
-	// Check the remote addr, should be the local addr
-	addr := conn.RemoteAddr().(*net.TCPAddr)
-	if addr.IP.String() != "127.0.0.1" {
-		t.Fatalf("bad: %v", addr)
-	}
-
-	// Read should fail
-	recv := make([]byte, 4)
-	_, err = conn.Read(recv)
-	if err == nil {
-		t.Fatalf("err: %v", err)
-	}
-}
-
-func TestParse_ipv4_checkfunc(t *testing.T) {
-	checkAddr = goodAddr
-	testParse_ipv4_checkfunc(t)
-	checkAddr = badAddr
-	testParse_ipv4_checkfunc(t)
-	checkAddr = errAddr
-	testParse_ipv4_checkfunc(t)
-}
-
-func testParse_ipv4_checkfunc(t *testing.T) {
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-
-	checkFunc := func(addr net.Addr) (bool, error) {
-		tcpAddr := addr.(*net.TCPAddr)
-		if tcpAddr.IP.String() == checkAddr {
-			return true, nil
-		}
-		return false, nil
-	}
-
-	pl := &Listener{Listener: l, SourceCheck: checkFunc}
-
-	go func() {
-		conn, err := net.Dial("tcp", pl.Addr().String())
-		if err != nil {
-			t.Fatalf("err: %v", err)
-		}
-		defer conn.Close()
-
-		// Write out the header!
-		header := "PROXY TCP4 10.1.1.1 20.2.2.2 1000 2000\r\n"
-		conn.Write([]byte(header))
-
-		conn.Write([]byte("ping"))
-		recv := make([]byte, 4)
-		_, err = conn.Read(recv)
-		if err != nil {
-			t.Fatalf("err: %v", err)
-		}
-		if !bytes.Equal(recv, []byte("pong")) {
-			t.Fatalf("bad: %v", recv)
-		}
-	}()
-
-	conn, err := pl.Accept()
-	if err != nil {
-		if checkAddr == badAddr {
-			return
-		}
-		t.Fatalf("err: %v", err)
-	}
-	defer conn.Close()
-
-	recv := make([]byte, 4)
-	_, err = conn.Read(recv)
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	if !bytes.Equal(recv, []byte("ping")) {
-		t.Fatalf("bad: %v", recv)
-	}
-
-	if _, err := conn.Write([]byte("pong")); err != nil {
-		t.Fatalf("err: %v", err)
-	}
-
-	// Check the remote addr
-	addr := conn.RemoteAddr().(*net.TCPAddr)
-	switch checkAddr {
-	case goodAddr:
-		if addr.IP.String() != "10.1.1.1" {
-			t.Fatalf("bad: %v", addr)
-		}
-		if addr.Port != 1000 {
-			t.Fatalf("bad: %v", addr)
-		}
-	case badAddr:
-		if addr.IP.String() != "127.0.0.1" {
-			t.Fatalf("bad: %v", addr)
-		}
-		if addr.Port == 1000 {
-			t.Fatalf("bad: %v", addr)
-		}
-	}
-}
-
-type testConn struct {
-	readFromCalledWith io.Reader
-	net.Conn           // nil; crash on any unexpected use
-}
-
-func (c *testConn) ReadFrom(r io.Reader) (int64, error) {
-	c.readFromCalledWith = r
-	return 0, nil
-}
-func (c *testConn) Write(p []byte) (int, error) {
-	return len(p), nil
-}
-func (c *testConn) Read(p []byte) (int, error) {
-	return 1, nil
-}
-
-func TestCopyToWrappedConnection(t *testing.T) {
-	innerConn := &testConn{}
-	wrappedConn := NewConn(innerConn, 0)
-	dummySrc := &testConn{}
-
-	io.Copy(wrappedConn, dummySrc)
-	if innerConn.readFromCalledWith != dummySrc {
-		t.Error("Expected io.Copy to delegate to ReadFrom function of inner destination connection")
-	}
-}
-
-func TestCopyFromWrappedConnection(t *testing.T) {
-	wrappedConn := NewConn(&testConn{}, 0)
-	dummyDst := &testConn{}
-
-	io.Copy(dummyDst, wrappedConn)
-	if dummyDst.readFromCalledWith != wrappedConn.conn {
-		t.Errorf("Expected io.Copy to pass inner source connection to ReadFrom method of destination")
-	}
-}
-
-func TestCopyFromWrappedConnectionToWrappedConnection(t *testing.T) {
-	innerConn1 := &testConn{}
-	wrappedConn1 := NewConn(innerConn1, 0)
-	innerConn2 := &testConn{}
-	wrappedConn2 := NewConn(innerConn2, 0)
-
-	io.Copy(wrappedConn1, wrappedConn2)
-	if innerConn1.readFromCalledWith != innerConn2 {
-		t.Errorf("Expected io.Copy to pass inner source connection to ReadFrom of inner destination connection")
-	}
-
-}

release.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+
+#github action release.sh
+
+set -x
+function RETVAL() {
+  rt=$1
+  if [ $rt != 0 ]; then
+    echo $rt
+    exit 1
+  fi
+}
+
+#当前目录
+cpath=$(pwd)
+
+ver=$(cat version)
+echo "当前版本 $ver"
+
+rm -rf artifact-dist
+mkdir artifact-dist
+
+function archive() {
+  arch=$1
+  #echo "整理部署文件 $arch"
+  arch_name=${arch//\//-}
+  echo $arch_name
+
+  deploy="anylink-$ver-$arch_name"
+  docker container rm $deploy
+  docker container create --platform $arch --name $deploy bjdgyc/anylink:$ver
+  rm -rf anylink-deploy
+  docker cp -a $deploy:/app ./anylink-deploy
+
+  ls -lh anylink-deploy
+
+  tar zcf ${deploy}.tar.gz anylink-deploy
+  mv ${deploy}.tar.gz artifact-dist/
+}
+
+echo "copy二进制文件"
+
+archive "linux/amd64"
+archive "linux/arm64"
+
+ls -lh artifact-dist
+
+#注意使用root权限运行
+#cd anylink-deploy
+#sudo ./anylink --conf="conf/server.toml"

release_test.sh

@@ -0,0 +1,74 @@
+#!/bin/bash
+
+#github action release.sh
+
+set -x
+function RETVAL() {
+  rt=$1
+  if [ $rt != 0 ]; then
+    echo $rt
+    exit 1
+  fi
+}
+
+#当前目录
+cpath=$(pwd)
+
+ver=$(cat version)
+echo $ver
+
+echo "copy二进制文件"
+cd $cpath/server
+# -tags osusergo,netgo,sqlite_omit_load_extension
+flags="-trimpath"
+ldflags="-s -w -extldflags '-static' -X main.appVer=$ver -X main.commitId=$(git rev-parse HEAD) -X main.buildDate=$(date --iso-8601=seconds)"
+#github action
+gopath=/go
+
+dockercmd=$(
+  cat <<EOF
+sed -i 's/dl-cdn.alpinelinux.org/mirrors.tuna.tsinghua.edu.cn/g' /etc/apk/repositories
+apk add gcc g++ musl musl-dev tzdata
+export GOPROXY=https://goproxy.cn
+go mod tidy
+echo "build:"
+export CGO_ENABLED=1
+go build -v -o anylink_amd64 $flags -ldflags "$ldflags"
+./anylink_amd64 -v
+EOF
+)
+
+#使用 musl-dev 编译
+docker run -q --rm -v $PWD:/app -v $gopath:/go -w /app --platform=linux/amd64 \
+  golang:1.20-alpine3.19 sh -c "$dockercmd"
+
+exit 0
+
+#arm64编译
+docker run -q --rm -v $PWD:/app -v $gopath:/go -w /app --platform=linux/arm64 \
+  golang:1.20-alpine3.19 go build -o anylink_arm64 $flags -ldflags "$ldflags"
+./anylink_arm64 -v
+
+exit 0
+
+cd $cpath
+
+echo "整理部署文件"
+deploy="anylink-deploy"
+rm -rf $deploy ${deploy}.tar.gz
+mkdir $deploy
+mkdir $deploy/log
+
+cp -r server/anylink $deploy
+cp -r server/bridge-init.sh $deploy
+cp -r server/conf $deploy
+
+cp -r systemd $deploy
+cp -r LICENSE $deploy
+cp -r home $deploy
+
+tar zcvf ${deploy}.tar.gz $deploy
+
+#注意使用root权限运行
+#cd anylink-deploy
+#sudo ./anylink --conf="conf/server.toml"

server/.codecov.yml

@@ -0,0 +1,5 @@
+ignore:
+  - "screenshot"
+  - "web"
+  - "server/conf"
+  - "server/files"

server/.gitignore

@@ -0,0 +1,21 @@
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories (remove the comment below to include it)
+vendor/
+
+ui/
+.idea/
+anylink
+data.db
+conf/*.db

server/admin/api_base.go

@@ -8,28 +8,54 @@ import (
 	"github.com/bjdgyc/anylink/base"
 	"github.com/bjdgyc/anylink/pkg/utils"
 	"github.com/gorilla/mux"
+	"github.com/xlzd/gotp"
 )
 
-// 登陆接口
+// Login 登陆接口
 func Login(w http.ResponseWriter, r *http.Request) {
 	// TODO 调试信息输出
 	// hd, _ := httputil.DumpRequest(r, true)
 	// fmt.Println("DumpRequest: ", string(hd))
 
-	r.ParseForm()
+	_ = r.ParseForm()
-	admin_user := r.PostFormValue("admin_user")
+	adminUser := r.PostFormValue("admin_user")
-	admin_pass := r.PostFormValue("admin_pass")
+	adminPass := r.PostFormValue("admin_pass")
+
+	// 启用otp验证
+	if base.Cfg.AdminOtp != "" {
+		pwd := adminPass
+		pl := len(pwd)
+		if pl < 6 {
+			RespError(w, RespUserOrPassErr)
+			base.Error(adminUser, "管理员otp错误")
+			return
+		}
+		// 判断otp信息
+		adminPass = pwd[:pl-6]
+		otp := pwd[pl-6:]
+
+		totp := gotp.NewDefaultTOTP(base.Cfg.AdminOtp)
+		unix := time.Now().Unix()
+		verify := totp.Verify(otp, unix)
+
+		if !verify {
+			RespError(w, RespUserOrPassErr)
+			base.Error(adminUser, "管理员otp错误")
+			return
+		}
+	}
 
 	// 认证错误
-	if !(admin_user == base.Cfg.AdminUser &&
+	if !(adminUser == base.Cfg.AdminUser &&
-		utils.PasswordVerify(admin_pass, base.Cfg.AdminPass)) {
+		utils.PasswordVerify(adminPass, base.Cfg.AdminPass)) {
 		RespError(w, RespUserOrPassErr)
+		base.Error(adminUser, "管理员用户名或密码错误")
 		return
 	}
 
 	// token有效期
 	expiresAt := time.Now().Unix() + 3600*3
-	jwtData := map[string]interface{}{"admin_user": admin_user}
+	jwtData := map[string]interface{}{"admin_user": adminUser}
 	tokenString, err := SetJwtData(jwtData, expiresAt)
 	if err != nil {
 		RespError(w, 1, err)
@@ -38,9 +64,17 @@ func Login(w http.ResponseWriter, r *http.Request) {
 
 	data := make(map[string]interface{})
 	data["token"] = tokenString
-	data["admin_user"] = admin_user
+	data["admin_user"] = adminUser
 	data["expires_at"] = expiresAt
 
+	ck := &http.Cookie{
+		Name:     "jwt",
+		Value:    tokenString,
+		Path:     "/",
+		HttpOnly: true,
+	}
+	http.SetCookie(w, ck)
+
 	RespSucess(w, data)
 }
 
@@ -50,13 +84,15 @@ func authMiddleware(next http.Handler) http.Handler {
 		w.Header().Set("Access-Control-Allow-Methods", "GET,POST,OPTIONS")
 		w.Header().Set("Access-Control-Allow-Headers", "*")
 		if r.Method == http.MethodOptions {
+			// 正式环境不支持 OPTIONS
+			w.WriteHeader(http.StatusForbidden)
 			return
 		}
 
 		route := mux.CurrentRoute(r)
 		name := route.GetName()
 		// fmt.Println("bb", r.URL.Path, name)
-		if name == "login" || name == "static" {
+		if utils.InArrStr([]string{"login", "index", "static"}, name) {
 			// 不进行鉴权
 			next.ServeHTTP(w, r)
 			return
@@ -67,6 +103,12 @@ func authMiddleware(next http.Handler) http.Handler {
 		if jwtToken == "" {
 			jwtToken = r.FormValue("jwt")
 		}
+		if jwtToken == "" {
+			cc, err := r.Cookie("jwt")
+			if err == nil {
+				jwtToken = cc.Value
+			}
+		}
 		data, err := GetJwtData(jwtToken)
 		if err != nil || base.Cfg.AdminUser != fmt.Sprint(data["admin_user"]) {
 			w.WriteHeader(http.StatusUnauthorized)

server/admin/api_cert.go

@@ -0,0 +1,99 @@
+package admin
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+
+	"github.com/bjdgyc/anylink/base"
+	"github.com/bjdgyc/anylink/dbdata"
+)
+
+func CustomCert(w http.ResponseWriter, r *http.Request) {
+	cert, _, err := r.FormFile("cert")
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	key, _, err := r.FormFile("key")
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	certFile, err := os.OpenFile(base.Cfg.CertFile, os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0600)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	defer certFile.Close()
+	if _, err := io.Copy(certFile, cert); err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	keyFile, err := os.OpenFile(base.Cfg.CertKey, os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0600)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	defer keyFile.Close()
+	if _, err := io.Copy(keyFile, key); err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	if tlscert, _, err := dbdata.ParseCert(); err != nil {
+		RespError(w, RespInternalErr, fmt.Sprintf("证书不合法，请重新上传:%v", err))
+		return
+	} else {
+		dbdata.LoadCertificate(tlscert)
+	}
+	RespSucess(w, "上传成功")
+}
+func GetCertSetting(w http.ResponseWriter, r *http.Request) {
+	sess := dbdata.GetXdb().NewSession()
+	defer sess.Close()
+	data := &dbdata.SettingLetsEncrypt{}
+	if err := dbdata.SettingGet(data); err != nil {
+		dbdata.SettingSessAdd(sess, data)
+		RespError(w, RespInternalErr, err)
+	}
+	userData := &dbdata.LegoUserData{}
+	if err := dbdata.SettingGet(userData); err != nil {
+		dbdata.SettingSessAdd(sess, userData)
+	}
+	RespSucess(w, data)
+}
+func CreatCert(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	defer r.Body.Close()
+	config := &dbdata.SettingLetsEncrypt{}
+	if err := json.Unmarshal(body, config); err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	if err := dbdata.SettingSet(config); err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	client := dbdata.LeGoClient{}
+	if err := client.NewClient(config); err != nil {
+		base.Error(err)
+		RespError(w, RespInternalErr, fmt.Sprintf("获取证书失败:%v", err))
+		return
+	}
+	if err := client.GetCert(config.Domain); err != nil {
+		base.Error(err)
+		RespError(w, RespInternalErr, fmt.Sprintf("获取证书失败:%v", err))
+		return
+	}
+	RespSucess(w, "生成证书成功")
+}

server/admin/api_group.go

@@ -2,7 +2,7 @@ package admin
 
 import (
 	"encoding/json"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"strconv"
 
@@ -10,7 +10,7 @@ import (
 )
 
 func GroupList(w http.ResponseWriter, r *http.Request) {
-	r.ParseForm()
+	_ = r.ParseForm()
 	pageS := r.FormValue("page")
 	page, _ := strconv.Atoi(pageS)
 	if page < 1 {
@@ -22,7 +22,7 @@ func GroupList(w http.ResponseWriter, r *http.Request) {
 	count := dbdata.CountAll(&dbdata.Group{})
 
 	var datas []dbdata.Group
-	err := dbdata.All(&datas, pageSize, page)
+	err := dbdata.Find(&datas, pageSize, page)
 	if err != nil {
 		RespError(w, RespInternalErr, err)
 		return
@@ -47,8 +47,18 @@ func GroupNames(w http.ResponseWriter, r *http.Request) {
 	RespSucess(w, data)
 }
 
+func GroupNamesIds(w http.ResponseWriter, r *http.Request) {
+	var names = dbdata.GetGroupNamesIds()
+	data := map[string]interface{}{
+		"count":     len(names),
+		"page_size": 0,
+		"datas":     names,
+	}
+	RespSucess(w, data)
+}
+
 func GroupDetail(w http.ResponseWriter, r *http.Request) {
-	r.ParseForm()
+	_ = r.ParseForm()
 	idS := r.FormValue("id")
 	id, _ := strconv.Atoi(idS)
 	if id < 1 {
@@ -62,12 +72,14 @@ func GroupDetail(w http.ResponseWriter, r *http.Request) {
 		RespError(w, RespInternalErr, err)
 		return
 	}
-
+	if len(data.Auth) == 0 {
+		data.Auth["type"] = "local"
+	}
 	RespSucess(w, data)
 }
 
 func GroupSet(w http.ResponseWriter, r *http.Request) {
-	body, err := ioutil.ReadAll(r.Body)
+	body, err := io.ReadAll(r.Body)
 	if err != nil {
 		RespError(w, RespInternalErr, err)
 		return
@@ -90,7 +102,7 @@ func GroupSet(w http.ResponseWriter, r *http.Request) {
 }
 
 func GroupDel(w http.ResponseWriter, r *http.Request) {
-	r.ParseForm()
+	_ = r.ParseForm()
 	idS := r.FormValue("id")
 	id, _ := strconv.Atoi(idS)
 	if id < 1 {
@@ -106,3 +118,30 @@ func GroupDel(w http.ResponseWriter, r *http.Request) {
 	}
 	RespSucess(w, nil)
 }
+
+func GroupAuthLogin(w http.ResponseWriter, r *http.Request) {
+	type AuthLoginData struct {
+		Name string                 `json:"name"`
+		Pwd  string                 `json:"pwd"`
+		Auth map[string]interface{} `json:"auth"`
+	}
+
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	defer r.Body.Close()
+	v := &AuthLoginData{}
+	err = json.Unmarshal(body, &v)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	err = dbdata.GroupAuthLogin(v.Name, v.Pwd, v.Auth)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	RespSucess(w, "ok")
+}

server/admin/api_ip_map.go

@@ -2,16 +2,15 @@ package admin
 
 import (
 	"encoding/json"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"strconv"
-	"time"
 
 	"github.com/bjdgyc/anylink/dbdata"
 )
 
 func UserIpMapList(w http.ResponseWriter, r *http.Request) {
-	r.ParseForm()
+	_ = r.ParseForm()
 	pageS := r.FormValue("page")
 	page, _ := strconv.Atoi(pageS)
 	if page < 1 {
@@ -23,7 +22,7 @@ func UserIpMapList(w http.ResponseWriter, r *http.Request) {
 	count := dbdata.CountAll(&dbdata.IpMap{})
 
 	var datas []dbdata.IpMap
-	err := dbdata.All(&datas, pageSize, page)
+	err := dbdata.Find(&datas, pageSize, page)
 	if err != nil {
 		RespError(w, RespInternalErr, err)
 		return
@@ -39,7 +38,7 @@ func UserIpMapList(w http.ResponseWriter, r *http.Request) {
 }
 
 func UserIpMapDetail(w http.ResponseWriter, r *http.Request) {
-	r.ParseForm()
+	_ = r.ParseForm()
 	idS := r.FormValue("id")
 	id, _ := strconv.Atoi(idS)
 	if id < 1 {
@@ -58,9 +57,9 @@ func UserIpMapDetail(w http.ResponseWriter, r *http.Request) {
 }
 
 func UserIpMapSet(w http.ResponseWriter, r *http.Request) {
-	r.ParseForm()
+	_ = r.ParseForm()
 
-	body, err := ioutil.ReadAll(r.Body)
+	body, err := io.ReadAll(r.Body)
 	if err != nil {
 		RespError(w, RespInternalErr, err)
 		return
@@ -75,24 +74,19 @@ func UserIpMapSet(w http.ResponseWriter, r *http.Request) {
 
 	// fmt.Println(v, len(v.Ip), len(v.MacAddr))
 
-	if len(v.IpAddr) < 4 || len(v.MacAddr) < 6 {
+	err = dbdata.SetIpMap(v)
-		RespError(w, RespParamErr, "IP或MAC错误")
-		return
-	}
-
-	v.UpdatedAt = time.Now()
-	err = dbdata.Save(v)
-
 	if err != nil {
 		RespError(w, RespInternalErr, err)
 		return
 	}
 
+	// sessdata.IpAllSet(v)
+
 	RespSucess(w, nil)
 }
 
 func UserIpMapDel(w http.ResponseWriter, r *http.Request) {
-	r.ParseForm()
+	_ = r.ParseForm()
 	idS := r.FormValue("id")
 	id, _ := strconv.Atoi(idS)
 
@@ -101,11 +95,20 @@ func UserIpMapDel(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	data := dbdata.IpMap{Id: id}
+	var data dbdata.IpMap
-	err := dbdata.Del(&data)
+	err := dbdata.One("Id", id, &data)
 	if err != nil {
 		RespError(w, RespInternalErr, err)
 		return
 	}
+
+	err = dbdata.Del(&data)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+
+	// sessdata.IpAllDel(&data)
+
 	RespSucess(w, nil)
 }

server/admin/api_other.go

@@ -0,0 +1,118 @@
+package admin
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"regexp"
+
+	"github.com/bjdgyc/anylink/base"
+	"github.com/bjdgyc/anylink/dbdata"
+)
+
+func setOtherGet(data interface{}, w http.ResponseWriter) {
+	err := dbdata.SettingGet(data)
+	if err != nil && !dbdata.CheckErrNotFound(err) {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	// 不明文输出SMTP的密码
+	switch dbdata.StructName(data) {
+	case "SettingSmtp":
+		data.(*dbdata.SettingSmtp).Password = ""
+	}
+	RespSucess(w, data)
+}
+
+func setOtherEdit(data interface{}, w http.ResponseWriter, r *http.Request) {
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	defer r.Body.Close()
+
+	err = json.Unmarshal(body, data)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+
+	// fmt.Println(data)
+	switch dbdata.StructName(data) {
+	case "SettingSmtp":
+		// 密码为空时则不修改
+		smtp := &dbdata.SettingSmtp{}
+		err := dbdata.SettingGet(smtp)
+		if err == nil && data.(*dbdata.SettingSmtp).Password == "" {
+			data.(*dbdata.SettingSmtp).Password = smtp.Password
+		}
+	}
+	err = dbdata.SettingSet(data)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	RespSucess(w, data)
+}
+
+func SetOtherSmtp(w http.ResponseWriter, r *http.Request) {
+	data := &dbdata.SettingSmtp{}
+	setOtherGet(data, w)
+}
+
+func SetOtherSmtpEdit(w http.ResponseWriter, r *http.Request) {
+	data := &dbdata.SettingSmtp{}
+	setOtherEdit(data, w, r)
+}
+
+func SetOther(w http.ResponseWriter, r *http.Request) {
+	data := &dbdata.SettingOther{}
+	setOtherGet(data, w)
+}
+
+func SetOtherEdit(w http.ResponseWriter, r *http.Request) {
+	data := &dbdata.SettingOther{}
+	setOtherEdit(data, w, r)
+}
+
+func SetOtherAuditLog(w http.ResponseWriter, r *http.Request) {
+	data, err := dbdata.SettingGetAuditLog()
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	data.AuditInterval = base.Cfg.AuditInterval
+	RespSucess(w, data)
+}
+
+func SetOtherAuditLogEdit(w http.ResponseWriter, r *http.Request) {
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	defer r.Body.Close()
+	data := &dbdata.SettingAuditLog{}
+	err = json.Unmarshal(body, data)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	if data.LifeDay < 0 || data.LifeDay > 365 {
+		RespError(w, RespParamErr, errors.New("日志存储时长范围在 0 ~ 365"))
+		return
+	}
+	ok, _ := regexp.Match("^([0-9]|0[0-9]|1[0-9]|2[0-3]):([0][0])$", []byte(data.ClearTime))
+	if !ok {
+		RespError(w, RespParamErr, errors.New("每天清理时间填写有误"))
+		return
+	}
+	err = dbdata.SettingSet(data)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	RespSucess(w, data)
+}

server/admin/api_policy.go

@@ -0,0 +1,98 @@
+package admin
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"strconv"
+
+	"github.com/bjdgyc/anylink/dbdata"
+)
+
+func PolicyList(w http.ResponseWriter, r *http.Request) {
+	_ = r.ParseForm()
+	pageS := r.FormValue("page")
+	page, _ := strconv.Atoi(pageS)
+	if page < 1 {
+		page = 1
+	}
+
+	var pageSize = dbdata.PageSize
+
+	count := dbdata.CountAll(&dbdata.Policy{})
+
+	var datas []dbdata.Policy
+	err := dbdata.Find(&datas, pageSize, page)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+
+	data := map[string]interface{}{
+		"count":     count,
+		"page_size": pageSize,
+		"datas":     datas,
+	}
+
+	RespSucess(w, data)
+}
+
+func PolicyDetail(w http.ResponseWriter, r *http.Request) {
+	_ = r.ParseForm()
+	idS := r.FormValue("id")
+	id, _ := strconv.Atoi(idS)
+	if id < 1 {
+		RespError(w, RespParamErr, "Id错误")
+		return
+	}
+
+	var data dbdata.Policy
+	err := dbdata.One("Id", id, &data)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+
+	RespSucess(w, data)
+}
+
+func PolicySet(w http.ResponseWriter, r *http.Request) {
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	defer r.Body.Close()
+	v := &dbdata.Policy{}
+	err = json.Unmarshal(body, v)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+
+	err = dbdata.SetPolicy(v)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+
+	RespSucess(w, nil)
+}
+
+func PolicyDel(w http.ResponseWriter, r *http.Request) {
+	_ = r.ParseForm()
+	idS := r.FormValue("id")
+	id, _ := strconv.Atoi(idS)
+	if id < 1 {
+		RespError(w, RespParamErr, "Id错误")
+		return
+	}
+
+	data := dbdata.Policy{Id: id}
+	err := dbdata.Del(&data)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	RespSucess(w, nil)
+}

server/admin/api_set.go

@@ -1,16 +1,14 @@
 package admin
 
 import (
-	"encoding/json"
 	"fmt"
 	"net/http"
 	"runtime"
 
-	"github.com/bjdgyc/anylink/dbdata"
-	"github.com/bjdgyc/anylink/sessdata"
-
 	"github.com/bjdgyc/anylink/base"
+	"github.com/bjdgyc/anylink/dbdata"
 	"github.com/bjdgyc/anylink/pkg/utils"
+	"github.com/bjdgyc/anylink/sessdata"
 	"github.com/shirou/gopsutil/cpu"
 	"github.com/shirou/gopsutil/disk"
 	"github.com/shirou/gopsutil/host"
@@ -72,6 +70,9 @@ func SetSystem(w http.ResponseWriter, r *http.Request) {
 		"goArch":       runtime.GOARCH,
 		"goVersion":    runtime.Version(),
 		"goroutine":    runtime.NumGoroutine(),
+		"appVersion":   "v" + base.APP_VER,
+		"appCommitId":  base.CommitId,
+		"appBuildDate": base.BuildDate,
 
 		"hostname": hi.Hostname,
 		"platform": fmt.Sprintf("%v %v %v", hi.Platform, hi.PlatformFamily, hi.PlatformVersion),
@@ -84,9 +85,8 @@ func SetSystem(w http.ResponseWriter, r *http.Request) {
 }
 
 func SetSoft(w http.ResponseWriter, r *http.Request) {
-	datas := base.ServerCfg2Slice()
+	data := base.ServerCfg2Slice()
-	b, _ := json.Marshal(datas)
+	RespSucess(w, data)
-	w.Write(b)
 }
 
 func decimal(f float64) float64 {

server/admin/api_set_audit.go

@@ -0,0 +1,79 @@
+package admin
+
+import (
+	"net/http"
+	"strconv"
+
+	"github.com/bjdgyc/anylink/dbdata"
+	"github.com/gocarina/gocsv"
+)
+
+func SetAuditList(w http.ResponseWriter, r *http.Request) {
+	_ = r.ParseForm()
+	pageS := r.FormValue("page")
+	page, _ := strconv.Atoi(pageS)
+	if page < 1 {
+		page = 1
+	}
+	var datas []dbdata.AccessAudit
+	session := dbdata.GetAuditSession(r.FormValue("search"))
+	count, err := dbdata.FindAndCount(session, &datas, dbdata.PageSize, page)
+	if err != nil && !dbdata.CheckErrNotFound(err) {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	data := map[string]interface{}{
+		"count":     count,
+		"page_size": dbdata.PageSize,
+		"datas":     datas,
+	}
+
+	RespSucess(w, data)
+}
+
+func SetAuditExport(w http.ResponseWriter, r *http.Request) {
+	var datas []dbdata.AccessAudit
+	maxNum := 1000000
+	session := dbdata.GetAuditSession(r.FormValue("search"))
+	count, err := dbdata.FindAndCount(session, &datas, maxNum, 0)
+	if err != nil && !dbdata.CheckErrNotFound(err) {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	if count == 0 {
+		RespError(w, RespParamErr, "你导出的总数量为0条，请调整搜索条件，再导出")
+		return
+	}
+	if count > int64(maxNum) {
+		RespError(w, RespParamErr, "你导出的数据量超过100万条，请调整搜索条件，再导出")
+		return
+	}
+	gocsv.Marshal(datas, w)
+
+}
+
+func UserActLogList(w http.ResponseWriter, r *http.Request) {
+	_ = r.ParseForm()
+	pageS := r.FormValue("page")
+	page, _ := strconv.Atoi(pageS)
+	if page < 1 {
+		page = 1
+	}
+	var datas []dbdata.UserActLog
+	session := dbdata.UserActLogIns.GetSession(r.Form)
+	count, err := dbdata.FindAndCount(session, &datas, dbdata.PageSize, page)
+	if err != nil && !dbdata.CheckErrNotFound(err) {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	data := map[string]interface{}{
+		"count":     count,
+		"page_size": dbdata.PageSize,
+		"datas":     datas,
+		"statusOps": dbdata.UserActLogIns.GetStatusOpsWithTag(),
+		"osOps":     dbdata.UserActLogIns.OsOps,
+		"clientOps": dbdata.UserActLogIns.ClientOps,
+	}
+
+	RespSucess(w, data)
+}

server/admin/api_statsinfo.go

@@ -0,0 +1,33 @@
+package admin
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/bjdgyc/anylink/dbdata"
+)
+
+func StatsInfoList(w http.ResponseWriter, r *http.Request) {
+	var ok bool
+	_ = r.ParseForm()
+	action := r.FormValue("action")
+	scope := r.FormValue("scope")
+	ok = dbdata.StatsInfoIns.ValidAction(action)
+	if !ok {
+		RespError(w, RespParamErr, errors.New("不存在的图表类别"))
+		return
+	}
+	ok = dbdata.StatsInfoIns.ValidScope(scope)
+	if !ok {
+		RespError(w, RespParamErr, errors.New("不存在的日期范围"))
+		return
+	}
+	datas, err := dbdata.StatsInfoIns.GetData(action, scope)
+	if err != nil {
+		RespError(w, RespInternalErr, err)
+		return
+	}
+	data := make(map[string]interface{})
+	data["datas"] = datas
+	RespSucess(w, data)
+}

server/admin/api_uploaduser.go

@@ -0,0 +1,120 @@
+package admin
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/bjdgyc/anylink/dbdata"
+	"github.com/bjdgyc/anylink/pkg/utils"
+	mapset "github.com/deckarep/golang-set"
+	"github.com/spf13/cast"
+	"github.com/xuri/excelize/v2"
+)
+
+func UserUpload(w http.ResponseWriter, r *http.Request) {
+	r.ParseMultipartForm(8 << 20)
+	file, header, err := r.FormFile("file")
+	if err != nil || !strings.Contains(header.Filename, ".xlsx") || !strings.Contains(header.Filename, ".xls") {
+		RespError(w, RespInternalErr, "文件解析失败:仅支持xlsx或xls文件")
+		return
+	}
+	defer file.Close()
+
+	// go/path-injection
+	// base.Cfg.FilesPath 可以直接对外访问，不能上传文件到此
+	fileName := path.Join(os.TempDir(), utils.RandomRunes(10))
+	newFile, err := os.Create(fileName)
+	if err != nil {
+		RespError(w, RespInternalErr, "创建文件失败:", err)
+		return
+	}
+	defer newFile.Close()
+
+	io.Copy(newFile, file)
+	if err = UploadUser(newFile.Name()); err != nil {
+		RespError(w, RespInternalErr, err)
+		os.Remove(fileName)
+		return
+	}
+	os.Remove(fileName)
+	RespSucess(w, "批量添加成功")
+}
+
+func UploadUser(file string) error {
+	f, err := excelize.OpenFile(file)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err := f.Close(); err != nil {
+			return
+		}
+	}()
+	rows, err := f.GetRows("Sheet1")
+	if err != nil {
+		return err
+	}
+	if rows[0][0] != "id" || rows[0][1] != "username" || rows[0][2] != "nickname" || rows[0][3] != "email" || rows[0][4] != "pin_code" || rows[0][5] != "limittime" || rows[0][6] != "otp_secret" || rows[0][7] != "disable_otp" || rows[0][8] != "groups" || rows[0][9] != "status" || rows[0][10] != "send_email" {
+		return fmt.Errorf("批量添加失败，表格格式不正确")
+	}
+	var k []interface{}
+	for _, v := range dbdata.GetGroupNames() {
+		k = append(k, v)
+	}
+	for index, row := range rows {
+		if index == 0 {
+			continue
+		}
+		id, _ := strconv.Atoi(row[0])
+		if len(row[4]) < 6 {
+			row[4] = utils.RandomRunes(8)
+		}
+		limittime, _ := time.ParseInLocation("2006-01-02 15:04:05", row[5], time.Local)
+		disableOtp, _ := strconv.ParseBool(row[7])
+		var group []string
+		if row[8] == "" {
+			return fmt.Errorf("第%d行数据错误，用户组不允许为空", index)
+		}
+		for _, v := range strings.Split(row[8], ",") {
+			if s := mapset.NewSetFromSlice(k); s.Contains(v) {
+				group = append(group, v)
+			} else {
+				return fmt.Errorf("用户组【%s】不存在,请检查第%d行数据", v, index)
+			}
+		}
+		status := cast.ToInt8(row[9])
+		sendmail, _ := strconv.ParseBool(row[10])
+		// createdAt, _ := time.ParseInLocation("2006-01-02 15:04:05", row[11], time.Local)
+		// updatedAt, _ := time.ParseInLocation("2006-01-02 15:04:05", row[12], time.Local)
+		user := &dbdata.User{
+			Id:         id,
+			Username:   row[1],
+			Nickname:   row[2],
+			Email:      row[3],
+			PinCode:    row[4],
+			LimitTime:  &limittime,
+			OtpSecret:  row[6],
+			DisableOtp: disableOtp,
+			Groups:     group,
+			Status:     status,
+			SendEmail:  sendmail,
+			// CreatedAt:  createdAt,
+			// UpdatedAt:  updatedAt,
+		}
+		if err := dbdata.AddBatch(user); err != nil {
+			return fmt.Errorf("请检查第%d行数据是否导入有重复用户", index)
+		}
+		if user.SendEmail {
+			if err := userAccountMail(user); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}

server/admin/api_user.go

@@ -5,8 +5,9 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
+	"net/url"
 	"strconv"
 	"strings"
 	"text/template"
@@ -19,8 +20,9 @@ import (
 )
 
 func UserList(w http.ResponseWriter, r *http.Request) {
-	r.ParseForm()
+	_ = r.ParseForm()
 	prefix := r.FormValue("prefix")
+	prefix = strings.TrimSpace(prefix)
 	pageS := r.FormValue("page")
 	page, _ := strconv.Atoi(pageS)
 	if page < 1 {
@@ -36,11 +38,14 @@ func UserList(w http.ResponseWriter, r *http.Request) {
 
 	// 查询前缀匹配
 	if len(prefix) > 0 {
-		count = pageSize
+		fuzzy := "%" + prefix + "%"
-		err = dbdata.Prefix("Username", prefix, &datas, pageSize, 1)
+		where := "username LIKE ? OR nickname LIKE ? OR email LIKE ?"
+
+		count = dbdata.FindWhereCount(&dbdata.User{}, where, fuzzy, fuzzy, fuzzy)
+		err = dbdata.FindWhere(&datas, pageSize, page, where, fuzzy, fuzzy, fuzzy)
 	} else {
 		count = dbdata.CountAll(&dbdata.User{})
-		err = dbdata.All(&datas, pageSize, page)
+		err = dbdata.Find(&datas, pageSize, page)
 	}
 
 	if err != nil && !dbdata.CheckErrNotFound(err) {
@@ -58,7 +63,7 @@ func UserList(w http.ResponseWriter, r *http.Request) {
 }
 
 func UserDetail(w http.ResponseWriter, r *http.Request) {
-	r.ParseForm()
+	_ = r.ParseForm()
 	idS := r.FormValue("id")
 	id, _ := strconv.Atoi(idS)
 	if id < 1 {
@@ -77,9 +82,9 @@ func UserDetail(w http.ResponseWriter, r *http.Request) {
 }
 
 func UserSet(w http.ResponseWriter, r *http.Request) {
-	r.ParseForm()
+	_ = r.ParseForm()
 
-	body, err := ioutil.ReadAll(r.Body)
+	body, err := io.ReadAll(r.Body)
 	if err != nil {
 		RespError(w, RespInternalErr, err)
 		return
@@ -100,14 +105,19 @@ func UserSet(w http.ResponseWriter, r *http.Request) {
 
 	// 发送邮件
 	if data.SendEmail {
-		userAccountMail(data)
+		err = userAccountMail(data)
+		if err != nil {
+			RespError(w, RespInternalErr, err)
+			return
 		}
-
+	}
+	// 修改用户资料后执行过期用户检测
+	sessdata.CloseUserLimittimeSession()
 	RespSucess(w, nil)
 }
 
 func UserDel(w http.ResponseWriter, r *http.Request) {
-	r.ParseForm()
+	_ = r.ParseForm()
 	idS := r.FormValue("id")
 	id, _ := strconv.Atoi(idS)
 
@@ -126,29 +136,45 @@ func UserDel(w http.ResponseWriter, r *http.Request) {
 }
 
 func UserOtpQr(w http.ResponseWriter, r *http.Request) {
-	r.ParseForm()
+	_ = r.ParseForm()
-	b64 := r.FormValue("b64")
+	b64S := r.FormValue("b64")
 	idS := r.FormValue("id")
 	id, _ := strconv.Atoi(idS)
-	var user dbdata.User
+
-	err := dbdata.One("Id", id, &user)
+	var b64 bool
+	if b64S == "1" {
+		b64 = true
+	}
+	data, err := userOtpQr(id, b64)
 	if err != nil {
-		RespError(w, RespInternalErr, err)
+		base.Error(err)
-		return
+	}
+	io.WriteString(w, data)
+}
+
+func userOtpQr(uid int, b64 bool) (string, error) {
+	var user dbdata.User
+	err := dbdata.One("Id", uid, &user)
+	if err != nil {
+		return "", err
 	}
 
-	issuer := base.Cfg.Issuer
+	issuer := url.QueryEscape(base.Cfg.Issuer)
 	qrstr := fmt.Sprintf("otpauth://totp/%s:%s?issuer=%s&secret=%s", issuer, user.Email, issuer, user.OtpSecret)
 	qr, _ := qrcode.New(qrstr, qrcode.High)
 
-	if b64 == "1" {
+	if b64 {
-		data, _ := qr.PNG(300)
+		data, err := qr.PNG(300)
+		if err != nil {
+			return "", err
+		}
 		s := base64.StdEncoding.EncodeToString(data)
-		fmt.Fprint(w, s)
+		return s, nil
-	} else {
-		qr.Write(300, w)
 	}
 
+	buf := bytes.NewBuffer(nil)
+	err = qr.Write(300, buf)
+	return buf.String(), err
 }
 
 // 在线用户
@@ -165,9 +191,16 @@ func UserOnline(w http.ResponseWriter, r *http.Request) {
 }
 
 func UserOffline(w http.ResponseWriter, r *http.Request) {
-	r.ParseForm()
+	_ = r.ParseForm()
 	token := r.FormValue("token")
-	sessdata.CloseSess(token)
+	sessdata.CloseSess(token, dbdata.UserLogoutAdmin)
+	RespSucess(w, nil)
+}
+
+func UserReline(w http.ResponseWriter, r *http.Request) {
+	_ = r.ParseForm()
+	token := r.FormValue("token")
+	sessdata.CloseCSess(token)
 	RespSucess(w, nil)
 }
 
@@ -176,8 +209,10 @@ type userAccountMailData struct {
 	LinkAddr     string
 	Group        string
 	Username     string
+	Nickname     string
 	PinCode      string
 	OtpImg       string
+	OtpImgBase64 string
 }
 
 func userAccountMail(user *dbdata.User) error {
@@ -211,16 +246,31 @@ func userAccountMail(user *dbdata.User) error {
 		return err
 	}
 
+	setting := &dbdata.SettingOther{}
+	err = dbdata.SettingGet(setting)
+	if err != nil {
+		base.Error(err)
+		return err
+	}
+
+	otpData, _ := userOtpQr(user.Id, true)
+
 	data := userAccountMailData{
-		LinkAddr: base.Cfg.LinkAddr,
+		Issuer:       base.Cfg.Issuer,
+		LinkAddr:     setting.LinkAddr,
 		Group:        strings.Join(user.Groups, ","),
 		Username:     user.Username,
+		Nickname:     user.Nickname,
 		PinCode:      user.PinCode,
-		OtpImg:   fmt.Sprintf("https://%s/otp_qr?id=%d&jwt=%s", base.Cfg.LinkAddr, user.Id, tokenString),
+		OtpImg:       fmt.Sprintf("https://%s/otp_qr?id=%d&jwt=%s", setting.LinkAddr, user.Id, tokenString),
+		OtpImgBase64: "data:image/png;base64," + otpData,
 	}
 	w := bytes.NewBufferString("")
 	t, _ := template.New("auth_complete").Parse(htmlBody)
-	t.Execute(w, data)
+	err = t.Execute(w, data)
+	if err != nil {
+		return err
+	}
 	// fmt.Println(w.String())
 	return SendMail(base.Cfg.Issuer+"平台通知", user.Email, w.String())
 }

server/admin/common.go

@@ -7,9 +7,9 @@ import (
 
 	"github.com/bjdgyc/anylink/base"
 	"github.com/bjdgyc/anylink/dbdata"
-	"github.com/dgrijalva/jwt-go"
+	"github.com/golang-jwt/jwt/v4"
-	"github.com/mojocn/base64Captcha"
 	mail "github.com/xhit/go-simple-mail/v2"
+	// "github.com/mojocn/base64Captcha"
 )
 
 func SetJwtData(data map[string]interface{}, expiresAt int64) (string, error) {
@@ -43,15 +43,6 @@ func GetJwtData(jwtToken string) (map[string]interface{}, error) {
 	return claims, nil
 }
 
-func createCaptcha() {
-	var store = base64Captcha.DefaultMemStore
-	var driver base64Captcha.Driver
-	driverString := &base64Captcha.DriverString{}
-	driver = driverString.ConvertFonts()
-	c := base64Captcha.NewCaptcha(driver, store)
-	_ = c
-}
-
 func SendMail(subject, to, htmlBody string) error {
 
 	dataSmtp := &dbdata.SettingSmtp{}
@@ -68,7 +59,15 @@ func SendMail(subject, to, htmlBody string) error {
 	server.Port = dataSmtp.Port
 	server.Username = dataSmtp.Username
 	server.Password = dataSmtp.Password
-	// server.Encryption = mail.EncryptionTLS
+
+	switch dataSmtp.Encryption {
+	case "SSLTLS":
+		server.Encryption = mail.EncryptionSSLTLS
+	case "STARTTLS":
+		server.Encryption = mail.EncryptionSTARTTLS
+	default:
+		server.Encryption = mail.EncryptionNone
+	}
 
 	// Since v2.3.0 you can specified authentication type:
 	// - PLAIN (default)

server/admin/common_test.go

@@ -0,0 +1,23 @@
+package admin
+
+import (
+	"testing"
+	"time"
+
+	"github.com/bjdgyc/anylink/base"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestJwtData(t *testing.T) {
+	assert := assert.New(t)
+	base.Cfg.JwtSecret = "dsfasfdfsadfasdfasd3sdaf"
+	data := map[string]interface{}{
+		"key": "value",
+	}
+	expiresAt := time.Now().Add(time.Minute).Unix()
+	token, err := SetJwtData(data, expiresAt)
+	assert.Nil(err)
+	dataN, err := GetJwtData(token)
+	assert.Nil(err)
+	assert.Equal(dataN["key"], "value")
+}

server/admin/resp.go

@@ -43,8 +43,10 @@ func respHttp(w http.ResponseWriter, respCode int, data interface{}, errS ...int
 
 	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 	w.WriteHeader(http.StatusOK)
-	w.Write(b)
+	_, err = w.Write(b)
-
+	if err != nil {
+		base.Error(err)
+	}
 	// 记录返回数据
 	// logger.Category("response").Debug(string(b))
 }

server/admin/resp_test.go

@@ -0,0 +1,39 @@
+package admin
+
+import (
+	"encoding/json"
+	"io"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRespSucess(t *testing.T) {
+	assert := assert.New(t)
+	w := httptest.NewRecorder()
+	RespSucess(w, "data")
+	// fmt.Println(w)
+	assert.Equal(w.Code, 200)
+	body, _ := io.ReadAll(w.Body)
+	res := Resp{}
+	err := json.Unmarshal(body, &res)
+	assert.Nil(err)
+	assert.Equal(res.Code, 0)
+	assert.Equal(res.Data, "data")
+
+}
+
+func TestRespError(t *testing.T) {
+	assert := assert.New(t)
+	w := httptest.NewRecorder()
+	RespError(w, 10, "err-msg")
+	// fmt.Println(w)
+	assert.Equal(w.Code, 200)
+	body, _ := io.ReadAll(w.Body)
+	res := Resp{}
+	err := json.Unmarshal(body, &res)
+	assert.Nil(err)
+	assert.Equal(res.Code, 10)
+	assert.Equal(res.Msg, "err-msg")
+}

server/admin/server.go

@@ -0,0 +1,146 @@
+// admin:后台管理接口
+package admin
+
+import (
+	"crypto/tls"
+	"embed"
+	"net/http"
+	"net/http/pprof"
+
+	"github.com/arl/statsviz"
+	"github.com/bjdgyc/anylink/base"
+	"github.com/bjdgyc/anylink/dbdata"
+	"github.com/bjdgyc/anylink/pkg/utils"
+	"github.com/gorilla/handlers"
+	"github.com/gorilla/mux"
+)
+
+var UiData embed.FS
+
+// StartAdmin 开启服务
+func StartAdmin() {
+
+	r := mux.NewRouter()
+	// 所有路由添加安全头
+	r.Use(func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+			utils.SetSecureHeader(w)
+			w.Header().Set("Server", "AnyLinkAdminOpenSource")
+			next.ServeHTTP(w, req)
+		})
+	})
+	r.Use(authMiddleware)
+	r.Use(handlers.CompressHandler)
+
+	// 监控检测
+	r.HandleFunc("/status.html", func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte("ok"))
+	}).Name("index")
+
+	r.Handle("/", http.RedirectHandler("/ui/", http.StatusFound)).Name("index")
+	r.PathPrefix("/ui/").Handler(
+		// http.StripPrefix("/ui/", http.FileServer(http.Dir(base.Cfg.UiPath))),
+		http.FileServer(http.FS(UiData)),
+	).Name("static")
+	r.HandleFunc("/base/login", Login).Name("login")
+
+	r.HandleFunc("/set/home", SetHome)
+	r.HandleFunc("/set/system", SetSystem)
+	r.HandleFunc("/set/soft", SetSoft)
+	r.HandleFunc("/set/other", SetOther)
+	r.HandleFunc("/set/other/edit", SetOtherEdit)
+	r.HandleFunc("/set/other/smtp", SetOtherSmtp)
+	r.HandleFunc("/set/other/smtp/edit", SetOtherSmtpEdit)
+	r.HandleFunc("/set/other/audit_log", SetOtherAuditLog)
+	r.HandleFunc("/set/other/audit_log/edit", SetOtherAuditLogEdit)
+	r.HandleFunc("/set/audit/list", SetAuditList)
+	r.HandleFunc("/set/audit/export", SetAuditExport)
+	r.HandleFunc("/set/audit/act_log_list", UserActLogList)
+	r.HandleFunc("/set/other/createcert", CreatCert)
+	r.HandleFunc("/set/other/getcertset", GetCertSetting)
+	r.HandleFunc("/set/other/customcert", CustomCert)
+
+	r.HandleFunc("/user/list", UserList)
+	r.HandleFunc("/user/detail", UserDetail)
+	r.HandleFunc("/user/set", UserSet)
+	r.HandleFunc("/user/uploaduser", UserUpload).Methods(http.MethodPost)
+	r.HandleFunc("/user/del", UserDel)
+	r.HandleFunc("/user/online", UserOnline)
+	r.HandleFunc("/user/offline", UserOffline)
+	r.HandleFunc("/user/reline", UserReline)
+	r.HandleFunc("/user/otp_qr", UserOtpQr)
+	r.HandleFunc("/user/ip_map/list", UserIpMapList)
+	r.HandleFunc("/user/ip_map/detail", UserIpMapDetail)
+	r.HandleFunc("/user/ip_map/set", UserIpMapSet)
+	r.HandleFunc("/user/ip_map/del", UserIpMapDel)
+	r.HandleFunc("/user/policy/list", PolicyList)
+	r.HandleFunc("/user/policy/detail", PolicyDetail)
+	r.HandleFunc("/user/policy/set", PolicySet)
+	r.HandleFunc("/user/policy/del", PolicyDel)
+
+	r.HandleFunc("/group/list", GroupList)
+	r.HandleFunc("/group/names", GroupNames)
+	r.HandleFunc("/group/names_ids", GroupNamesIds)
+	r.HandleFunc("/group/detail", GroupDetail)
+	r.HandleFunc("/group/set", GroupSet)
+	r.HandleFunc("/group/del", GroupDel)
+	r.HandleFunc("/group/auth_login", GroupAuthLogin)
+
+	r.HandleFunc("/statsinfo/list", StatsInfoList)
+
+	// pprof
+	if base.Cfg.Pprof {
+		r.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline).Name("debug")
+		r.HandleFunc("/debug/pprof/profile", pprof.Profile).Name("debug")
+		r.HandleFunc("/debug/pprof/symbol", pprof.Symbol).Name("debug")
+		r.HandleFunc("/debug/pprof/trace", pprof.Trace).Name("debug")
+		r.HandleFunc("/debug/pprof", location("/debug/pprof/")).Name("debug")
+		r.PathPrefix("/debug/pprof/").HandlerFunc(pprof.Index).Name("debug")
+		// statsviz
+		srv, _ := statsviz.NewServer() // Create server or handle error
+		r.Path("/debug/statsviz/ws").Name("debug").HandlerFunc(srv.Ws())
+		r.PathPrefix("/debug/statsviz/").Name("debug").Handler(srv.Index())
+	}
+
+	base.Info("Listen admin", base.Cfg.AdminAddr)
+
+	// 修复 CVE-2016-2183
+	cipherSuites := tls.CipherSuites()
+	selectedCipherSuites := make([]uint16, 0, len(cipherSuites))
+	for _, s := range cipherSuites {
+		selectedCipherSuites = append(selectedCipherSuites, s.ID)
+	}
+
+	if tlscert, _, err := dbdata.ParseCert(); err != nil {
+		base.Fatal("证书加载失败", err)
+	} else {
+		dbdata.LoadCertificate(tlscert)
+	}
+
+	// 设置tls信息
+	tlsConfig := &tls.Config{
+		NextProtos:   []string{"http/1.1"},
+		MinVersion:   tls.VersionTLS12,
+		CipherSuites: selectedCipherSuites,
+		GetCertificate: func(chi *tls.ClientHelloInfo) (*tls.Certificate, error) {
+			return dbdata.GetCertificateBySNI(chi.ServerName)
+		},
+	}
+	srv := &http.Server{
+		Addr:      base.Cfg.AdminAddr,
+		Handler:   r,
+		TLSConfig: tlsConfig,
+		ErrorLog:  base.GetServerLog(),
+	}
+	err := srv.ListenAndServeTLS("", "")
+	if err != nil {
+		base.Fatal(err)
+	}
+}
+
+func location(url string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Location", url)
+		w.WriteHeader(http.StatusFound)
+	}
+}

server/base/app_ver.go

@@ -0,0 +1,13 @@
+package base
+
+const (
+	APP_NAME = "AnyLink"
+)
+
+var (
+	// APP_VER app版本号
+	APP_VER = "0.0.1"
+	// 提交id
+	CommitId  string
+	BuildDate string
+)

server/base/cfg.go

@@ -0,0 +1,203 @@
+package base
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"reflect"
+)
+
+const (
+	LinkModeTUN     = "tun"
+	LinkModeTAP     = "tap"
+	LinkModeMacvtap = "macvtap"
+	LinkModeIpvtap  = "ipvtap"
+)
+
+var (
+	Cfg = &ServerConfig{}
+)
+
+// # ReKey time (in seconds)
+// rekey-time = 172800
+// # ReKey method
+// # Valid options: ssl, new-tunnel
+// #  ssl: Will perform an efficient rehandshake on the channel allowing
+// #       a seamless connection during rekey.
+// #  new-tunnel: Will instruct the client to discard and re-establish the channel.
+// #       Use this option only if the connecting clients have issues with the ssl
+// #       option.
+// rekey-method = ssl
+
+type ServerConfig struct {
+	// LinkAddr      string `json:"link_addr"`
+	Conf           string `json:"conf"`
+	Profile        string `json:"profile"`
+	ServerAddr     string `json:"server_addr"`
+	ServerDTLSAddr string `json:"server_dtls_addr"`
+	ServerDTLS     bool   `json:"server_dtls"`
+	AdminAddr      string `json:"admin_addr"`
+	ProxyProtocol  bool   `json:"proxy_protocol"`
+	DbType         string `json:"db_type"`
+	DbSource       string `json:"db_source"`
+	CertFile       string `json:"cert_file"`
+	CertKey        string `json:"cert_key"`
+	FilesPath      string `json:"files_path"`
+	LogPath        string `json:"log_path"`
+	LogLevel       string `json:"log_level"`
+	HttpServerLog  bool   `json:"http_server_log"`
+	Pprof          bool   `json:"pprof"`
+	Issuer         string `json:"issuer"`
+	AdminUser      string `json:"admin_user"`
+	AdminPass      string `json:"admin_pass"`
+	AdminOtp       string `json:"admin_otp"`
+	JwtSecret      string `json:"jwt_secret"`
+
+	LinkMode    string `json:"link_mode"`    // tun tap macvtap ipvtap
+	Ipv4Master  string `json:"ipv4_master"`  // eth0
+	Ipv4CIDR    string `json:"ipv4_cidr"`    // 192.168.10.0/24
+	Ipv4Gateway string `json:"ipv4_gateway"` // 192.168.10.1
+	Ipv4Start   string `json:"ipv4_start"`   // 192.168.10.100
+	Ipv4End     string `json:"ipv4_end"`     // 192.168.10.200
+	IpLease     int    `json:"ip_lease"`
+
+	MaxClient       int    `json:"max_client"`
+	MaxUserClient   int    `json:"max_user_client"`
+	DefaultGroup    string `json:"default_group"`
+	CstpKeepalive   int    `json:"cstp_keepalive"` // in seconds
+	CstpDpd         int    `json:"cstp_dpd"`       // Dead peer detection in seconds
+	MobileKeepalive int    `json:"mobile_keepalive"`
+	MobileDpd       int    `json:"mobile_dpd"`
+	Mtu             int    `json:"mtu"`
+	DefaultDomain   string `json:"default_domain"`
+
+	IdleTimeout    int `json:"idle_timeout"`    // in seconds
+	SessionTimeout int `json:"session_timeout"` // in seconds
+	// AuthTimeout    int `json:"auth_timeout"`    // in seconds
+	AuditInterval int `json:"audit_interval"` // in seconds
+
+	ShowSQL         bool `json:"show_sql"` // bool
+	IptablesNat     bool `json:"iptables_nat"`
+	Compression     bool `json:"compression"`       // bool
+	NoCompressLimit int  `json:"no_compress_limit"` // int
+
+	DisplayError    bool `json:"display_error"`
+	ExcludeExportIp bool `json:"exclude_export_ip"`
+}
+
+func initServerCfg() {
+
+	// TODO 取消绝对地址转换
+	// sf, _ := filepath.Abs(cfgFile)
+	// base := filepath.Dir(sf)
+
+	// 转换成绝对路径
+	// Cfg.DbFile = getAbsPath(base, Cfg.DbFile)
+	// Cfg.CertFile = getAbsPath(base, Cfg.CertFile)
+	// Cfg.CertKey = getAbsPath(base, Cfg.CertKey)
+	// Cfg.UiPath = getAbsPath(base, Cfg.UiPath)
+	// Cfg.FilesPath = getAbsPath(base, Cfg.FilesPath)
+	// Cfg.LogPath = getAbsPath(base, Cfg.LogPath)
+
+	if Cfg.AdminPass == defaultPwd {
+		fmt.Fprintln(os.Stderr, "=== 使用默认的admin_pass有安全风险，请设置新的admin_pass ===")
+	}
+
+	if Cfg.JwtSecret == defaultJwt {
+		fmt.Fprintln(os.Stderr, "=== 使用默认的jwt_secret有安全风险，请设置新的jwt_secret ===")
+	}
+
+	fmt.Printf("ServerCfg: %+v \n", Cfg)
+}
+
+func getAbsPath(base, cfile string) string {
+	if cfile == "" {
+		return ""
+	}
+
+	abs := filepath.IsAbs(cfile)
+	if abs {
+		return cfile
+	}
+	return filepath.Join(base, cfile)
+}
+
+func initCfg() {
+	ref := reflect.ValueOf(Cfg)
+	s := ref.Elem()
+
+	typ := s.Type()
+	numFields := s.NumField()
+	for i := 0; i < numFields; i++ {
+		field := typ.Field(i)
+		value := s.Field(i)
+		tag := field.Tag.Get("json")
+
+		for _, v := range configs {
+			if v.Name == tag {
+				if v.Typ == cfgStr {
+					value.SetString(linkViper.GetString(v.Name))
+				}
+				if v.Typ == cfgInt {
+					value.SetInt(int64(linkViper.GetInt(v.Name)))
+				}
+				if v.Typ == cfgBool {
+					value.SetBool(linkViper.GetBool(v.Name))
+				}
+			}
+		}
+	}
+
+	initServerCfg()
+}
+
+type SCfg struct {
+	Name string      `json:"name"`
+	Env  string      `json:"env"`
+	Info string      `json:"info"`
+	Data interface{} `json:"data"`
+	Val  interface{} `json:"default"`
+}
+
+func ServerCfg2Slice() []SCfg {
+	ref := reflect.ValueOf(Cfg)
+	s := ref.Elem()
+
+	var datas []SCfg
+
+	typ := s.Type()
+	numFields := s.NumField()
+	for i := 0; i < numFields; i++ {
+		field := typ.Field(i)
+		value := s.Field(i)
+		tag := field.Tag.Get("json")
+		usage, env, val := getUsageEnv(tag)
+
+		datas = append(datas, SCfg{Name: tag, Env: env, Info: usage, Data: value.Interface(), Val: val})
+	}
+
+	return datas
+}
+
+func getUsageEnv(name string) (usage, env string, val interface{}) {
+	for _, v := range configs {
+		if v.Name == name {
+			usage = v.Usage
+			if v.Typ == cfgStr {
+				val = v.ValStr
+			}
+			if v.Typ == cfgInt {
+				val = v.ValInt
+			}
+			if v.Typ == cfgBool {
+				val = v.ValBool
+			}
+		}
+	}
+
+	if e, ok := envs[name]; ok {
+		env = e
+	}
+
+	return
+}

server/base/cmd.go

@@ -0,0 +1,175 @@
+package base
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"reflect"
+	"runtime"
+	"strings"
+
+	"github.com/bjdgyc/anylink/pkg/utils"
+	"github.com/skip2/go-qrcode"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"github.com/xlzd/gotp"
+)
+
+var (
+	// pass明文
+	passwd string
+	// 生成otp
+	otp bool
+	// 生成密钥
+	secret bool
+	// 显示版本信息
+	rev bool
+	// 输出debug信息
+	debug bool
+
+	// Used for flags.
+	runSrv bool
+
+	linkViper *viper.Viper
+	rootCmd   *cobra.Command
+)
+
+// Execute executes the root command.
+func execute() {
+	initCmd()
+
+	err := rootCmd.Execute()
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(0)
+	}
+
+	// viper.Debug()
+	ref := reflect.ValueOf(linkViper)
+	s := ref.Elem()
+	ee := s.FieldByName("env")
+	if ee.Kind() != reflect.Map {
+		panic("Viper env is err")
+	}
+	rr := ee.MapRange()
+	for rr.Next() {
+		// fmt.Println(rr.Key(), rr.Value().Index(0))
+		envs[rr.Key().String()] = rr.Value().Index(0).String()
+	}
+
+	if !runSrv {
+		if debug {
+			scfgData := ServerCfg2Slice()
+			fmtStr := "%-18v %-23v %-20v %v\n"
+			fmt.Printf(fmtStr, "Name", "Env", "Value", "Info")
+			for _, v := range scfgData {
+				if v.Name == "admin_pass" || v.Name == "jwt_secret" {
+					v.Val = "******"
+				}
+				fmt.Printf(fmtStr, v.Name, v.Env, v.Val, v.Info)
+			}
+		}
+		os.Exit(0)
+	}
+
+	// 移动配置解析代码
+	conf := linkViper.GetString("conf")
+	linkViper.SetConfigFile(conf)
+	err = linkViper.ReadInConfig()
+	if err != nil {
+		// 没有配置文件，直接报错
+		panic("config file err:" + err.Error())
+	}
+}
+
+func initCmd() {
+	linkViper = viper.New()
+	rootCmd = &cobra.Command{
+		Use:   "anylink",
+		Short: "AnyLink VPN Server",
+		Long:  `AnyLink is a VPN Server application`,
+		Run: func(cmd *cobra.Command, args []string) {
+			// fmt.Println("cmd：", cmd.Use, args)
+			runSrv = true
+
+			if rev {
+				printVersion()
+				os.Exit(0)
+			}
+		},
+	}
+
+	linkViper.SetEnvPrefix("link")
+
+	// 基础配置
+	for _, v := range configs {
+		if v.Typ == cfgStr {
+			rootCmd.Flags().StringP(v.Name, v.Short, v.ValStr, v.Usage)
+		}
+		if v.Typ == cfgInt {
+			rootCmd.Flags().IntP(v.Name, v.Short, v.ValInt, v.Usage)
+		}
+		if v.Typ == cfgBool {
+			rootCmd.Flags().BoolP(v.Name, v.Short, v.ValBool, v.Usage)
+		}
+
+		_ = linkViper.BindPFlag(v.Name, rootCmd.Flags().Lookup(v.Name))
+		_ = linkViper.BindEnv(v.Name)
+		// viper.SetDefault(v.Name, v.Value)
+	}
+
+	rootCmd.Flags().BoolVarP(&rev, "version", "v", false, "display version info")
+	rootCmd.AddCommand(initToolCmd())
+
+	cobra.OnInitialize(func() {
+		linkViper.AutomaticEnv()
+	})
+}
+
+func initToolCmd() *cobra.Command {
+	toolCmd := &cobra.Command{
+		Use:   "tool",
+		Short: "AnyLink tool",
+		Long:  `AnyLink tool is a application`,
+	}
+
+	toolCmd.Flags().BoolVarP(&rev, "version", "v", false, "display version info")
+	toolCmd.Flags().BoolVarP(&secret, "secret", "s", false, "generate a random jwt secret")
+	toolCmd.Flags().StringVarP(&passwd, "passwd", "p", "", "convert the password plaintext")
+	toolCmd.Flags().BoolVarP(&otp, "otp", "o", false, "generate a random otp secret")
+	toolCmd.Flags().BoolVarP(&debug, "debug", "d", false, "list the config viper.Debug() info")
+
+	toolCmd.Run = func(cmd *cobra.Command, args []string) {
+		runSrv = false
+
+		switch {
+		case rev:
+			printVersion()
+		case secret:
+			s, _ := utils.RandSecret(40, 60)
+			s = strings.Trim(s, "=")
+			fmt.Printf("Secret:%s\n", s)
+		case otp:
+			s := gotp.RandomSecret(32)
+			fmt.Printf("Otp:%s\n\n", s)
+			qrstr := fmt.Sprintf("otpauth://totp/%s:%s?issuer=%s&secret=%s", "anylink_admin", "admin@anylink", "anylink_admin", s)
+			qr, _ := qrcode.New(qrstr, qrcode.High)
+			ss := qr.ToSmallString(false)
+			io.WriteString(os.Stderr, ss)
+		case passwd != "":
+			pass, _ := utils.PasswordHash(passwd)
+			fmt.Printf("Passwd:%s\n", pass)
+		case debug:
+			// linkViper.Debug()
+		default:
+			fmt.Println("Using [anylink tool -h] for help")
+		}
+	}
+
+	return toolCmd
+}
+
+func printVersion() {
+	fmt.Printf("%s v%s build on %s [%s, %s] date:%s commit_id(%s)\n",
+		APP_NAME, APP_VER, runtime.Version(), runtime.GOOS, runtime.GOARCH, BuildDate, CommitId)
+}

server/base/config.go

@@ -0,0 +1,75 @@
+package base
+
+const (
+	cfgStr = iota
+	cfgInt
+	cfgBool
+
+	defaultJwt = "abcdef.0123456789.abcdef"
+	defaultPwd = "$2a$10$UQ7C.EoPifDeJh6d8.31TeSPQU7hM/NOM2nixmBucJpAuXDQNqNke"
+)
+
+type config struct {
+	Typ     int
+	Name    string
+	Short   string
+	Usage   string
+	ValStr  string
+	ValInt  int
+	ValBool bool
+}
+
+var configs = []config{
+	{Typ: cfgStr, Name: "conf", Usage: "config file", ValStr: "./conf/server.toml", Short: "c"},
+	{Typ: cfgStr, Name: "profile", Usage: "profile.xml file", ValStr: "./conf/profile.xml"},
+	{Typ: cfgStr, Name: "server_addr", Usage: "TCP服务监听地址(任意端口)", ValStr: ":443"},
+	{Typ: cfgBool, Name: "server_dtls", Usage: "开启DTLS", ValBool: true},
+	{Typ: cfgStr, Name: "server_dtls_addr", Usage: "DTLS监听地址(任意端口)", ValStr: ":443"},
+	{Typ: cfgStr, Name: "admin_addr", Usage: "后台服务监听地址", ValStr: ":8800"},
+	{Typ: cfgBool, Name: "proxy_protocol", Usage: "TCP代理协议", ValBool: false},
+	{Typ: cfgStr, Name: "db_type", Usage: "数据库类型 [sqlite3 mysql postgres]", ValStr: "sqlite3"},
+	{Typ: cfgStr, Name: "db_source", Usage: "数据库source", ValStr: "./conf/anylink.db"},
+	{Typ: cfgStr, Name: "cert_file", Usage: "证书文件", ValStr: "./conf/vpn_cert.pem"},
+	{Typ: cfgStr, Name: "cert_key", Usage: "证书密钥", ValStr: "./conf/vpn_cert.key"},
+	{Typ: cfgStr, Name: "files_path", Usage: "外部下载文件路径", ValStr: "./conf/files"},
+	{Typ: cfgStr, Name: "log_path", Usage: "日志文件路径,默认标准输出", ValStr: ""},
+	{Typ: cfgStr, Name: "log_level", Usage: "日志等级 [debug info warn error]", ValStr: "debug"},
+	{Typ: cfgBool, Name: "http_server_log", Usage: "开启go标准库http.Server的日志", ValBool: false},
+	{Typ: cfgBool, Name: "pprof", Usage: "开启pprof", ValBool: true},
+	{Typ: cfgStr, Name: "issuer", Usage: "系统名称", ValStr: "XX公司VPN"},
+	{Typ: cfgStr, Name: "admin_user", Usage: "管理用户名", ValStr: "admin"},
+	{Typ: cfgStr, Name: "admin_pass", Usage: "管理用户密码", ValStr: defaultPwd},
+	{Typ: cfgStr, Name: "admin_otp", Usage: "管理用户otp,生成命令 ./anylink tool -o", ValStr: ""},
+	{Typ: cfgStr, Name: "jwt_secret", Usage: "JWT密钥", ValStr: defaultJwt},
+	{Typ: cfgStr, Name: "link_mode", Usage: "虚拟网络类型[tun tap macvtap ipvtap]", ValStr: "tun"},
+	{Typ: cfgStr, Name: "ipv4_master", Usage: "ipv4主网卡名称", ValStr: "eth0"},
+	{Typ: cfgStr, Name: "ipv4_cidr", Usage: "ip地址网段", ValStr: "192.168.90.0/24"},
+	{Typ: cfgStr, Name: "ipv4_gateway", Usage: "ipv4_gateway", ValStr: "192.168.90.1"},
+	{Typ: cfgStr, Name: "ipv4_start", Usage: "IPV4开始地址", ValStr: "192.168.90.100"},
+	{Typ: cfgStr, Name: "ipv4_end", Usage: "IPV4结束", ValStr: "192.168.90.200"},
+	{Typ: cfgStr, Name: "default_group", Usage: "默认用户组", ValStr: "one"},
+	{Typ: cfgStr, Name: "default_domain", Usage: "客户端dns的默认搜索域", ValStr: ""},
+
+	{Typ: cfgInt, Name: "ip_lease", Usage: "IP租期(秒)", ValInt: 86400},
+	{Typ: cfgInt, Name: "max_client", Usage: "最大用户连接", ValInt: 200},
+	{Typ: cfgInt, Name: "max_user_client", Usage: "最大单用户连接", ValInt: 3},
+	{Typ: cfgInt, Name: "cstp_keepalive", Usage: "keepalive时间(秒)", ValInt: 5},
+	{Typ: cfgInt, Name: "cstp_dpd", Usage: "死链接检测时间(秒)", ValInt: 12},
+	{Typ: cfgInt, Name: "mobile_keepalive", Usage: "移动端keepalive接检测时间(秒)", ValInt: 10},
+	{Typ: cfgInt, Name: "mobile_dpd", Usage: "移动端死链接检测时间(秒)", ValInt: 22},
+	{Typ: cfgInt, Name: "mtu", Usage: "最大传输单元MTU", ValInt: 1460},
+	{Typ: cfgInt, Name: "idle_timeout", Usage: "空闲链接超时时间(秒)-超时后断开链接，0关闭此功能", ValInt: 1800},
+	{Typ: cfgInt, Name: "session_timeout", Usage: "session过期时间(秒)-用于断线重连，0永不过期", ValInt: 3600},
+	// {Typ: cfgInt, Name: "auth_timeout", Usage: "auth_timeout", ValInt: 0},
+	{Typ: cfgInt, Name: "audit_interval", Usage: "审计去重间隔(秒),-1关闭", ValInt: 600},
+
+	{Typ: cfgBool, Name: "show_sql", Usage: "显示sql语句，用于调试", ValBool: false},
+	{Typ: cfgBool, Name: "iptables_nat", Usage: "是否自动添加NAT", ValBool: true},
+	{Typ: cfgBool, Name: "compression", Usage: "启用压缩", ValBool: false},
+	{Typ: cfgInt, Name: "no_compress_limit", Usage: "低于及等于多少字节不压缩", ValInt: 256},
+
+	{Typ: cfgBool, Name: "display_error", Usage: "客户端显示详细错误信息(线上环境慎开启)", ValBool: false},
+	{Typ: cfgBool, Name: "exclude_export_ip", Usage: "排除出口ip路由(出口ip不加密传输)", ValBool: true},
+}
+
+var envs = map[string]string{}

server/base/log.go

@@ -0,0 +1,182 @@
+package base
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"path"
+	"strings"
+	"time"
+)
+
+const (
+	LogLevelTrace = iota
+	LogLevelDebug
+	LogLevelInfo
+	LogLevelWarn
+	LogLevelError
+	LogLevelFatal
+)
+
+var (
+	baseLw    *logWriter
+	baseLog   *log.Logger
+	baseLevel int
+	levels    map[int]string
+
+	dateFormat = "2006-01-02"
+	logName    = "anylink.log"
+)
+
+func init() {
+	log.SetFlags(log.LstdFlags | log.Lshortfile)
+}
+
+// 实现 os.Writer 接口
+type logWriter struct {
+	UseStdout bool
+	FileName  string
+	File      *os.File
+	NowDate   string
+}
+
+// 实现日志文件的切割
+func (lw *logWriter) Write(p []byte) (n int, err error) {
+	if !lw.UseStdout {
+		return lw.File.Write(p)
+	}
+
+	date := time.Now().Format(dateFormat)
+	if lw.NowDate != date {
+		_ = lw.File.Close()
+		_ = os.Rename(lw.FileName, lw.FileName+"."+lw.NowDate)
+		lw.NowDate = date
+		lw.newFile()
+	}
+	return lw.File.Write(p)
+}
+
+// 创建新文件
+func (lw *logWriter) newFile() {
+	if lw.UseStdout {
+		lw.File = os.Stdout
+		return
+	}
+
+	f, err := os.OpenFile(lw.FileName, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0666)
+	if err != nil {
+		panic(err)
+	}
+	lw.File = f
+}
+
+func initLog() {
+	// 初始化 baseLog
+	baseLw = &logWriter{
+		UseStdout: Cfg.LogPath == "",
+		FileName:  path.Join(Cfg.LogPath, logName),
+		NowDate:   time.Now().Format(dateFormat),
+	}
+
+	baseLw.newFile()
+	baseLevel = logLevel2Int(Cfg.LogLevel)
+	baseLog = log.New(baseLw, "", log.LstdFlags|log.Lshortfile)
+
+	serverLog = log.New(&sLogWriter{}, "[http_server]", log.LstdFlags|log.Lshortfile)
+}
+
+func GetBaseLw() *logWriter {
+	return baseLw
+}
+
+var serverLog *log.Logger
+
+type sLogWriter struct{}
+
+func (w *sLogWriter) Write(p []byte) (n int, err error) {
+	if Cfg.HttpServerLog {
+		return os.Stderr.Write(p)
+	}
+	return 0, nil
+}
+
+// 获取 log.Logger
+func GetServerLog() *log.Logger {
+	return serverLog
+}
+
+func GetLogLevel() int {
+	return baseLevel
+}
+
+func logLevel2Int(l string) int {
+	levels = map[int]string{
+		LogLevelTrace: "Trace",
+		LogLevelDebug: "Debug",
+		LogLevelInfo:  "Info",
+		LogLevelWarn:  "Warn",
+		LogLevelError: "Error",
+		LogLevelFatal: "Fatal",
+	}
+	lvl := LogLevelInfo
+	for k, v := range levels {
+		if strings.ToLower(l) == strings.ToLower(v) {
+			lvl = k
+		}
+	}
+	return lvl
+}
+
+func output(l int, s ...interface{}) {
+	lvl := fmt.Sprintf("[%s] ", levels[l])
+	_ = baseLog.Output(3, lvl+fmt.Sprintln(s...))
+}
+
+func Trace(v ...interface{}) {
+	l := LogLevelTrace
+	if baseLevel > l {
+		return
+	}
+	output(l, v...)
+}
+
+func Debug(v ...interface{}) {
+	l := LogLevelDebug
+	if baseLevel > l {
+		return
+	}
+	output(l, v...)
+}
+
+func Info(v ...interface{}) {
+	l := LogLevelInfo
+	if baseLevel > l {
+		return
+	}
+	output(l, v...)
+}
+
+func Warn(v ...interface{}) {
+	l := LogLevelWarn
+	if baseLevel > l {
+		return
+	}
+	output(l, v...)
+}
+
+func Error(v ...interface{}) {
+	l := LogLevelError
+	if baseLevel > l {
+		return
+	}
+	output(l, v...)
+}
+
+func Fatal(v ...interface{}) {
+	l := LogLevelFatal
+	if baseLevel > l {
+		return
+	}
+	output(l, v...)
+	os.Exit(1)
+}

server/base/mod.go

@@ -0,0 +1,82 @@
+package base
+
+import (
+	"bufio"
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"strings"
+)
+
+const (
+	procModulesPath = "/proc/modules"
+	inContainerKey  = "ANYLINK_IN_CONTAINER"
+	tunPath         = "/dev/net/tun"
+)
+
+var (
+	InContainer = false
+	modMap      = map[string]struct{}{}
+)
+
+func initMod() {
+	container := os.Getenv(inContainerKey)
+	if container == "true" {
+		InContainer = true
+	}
+	log.Println("InContainer", InContainer)
+
+	file, err := os.Open(procModulesPath)
+	if err != nil {
+		err = fmt.Errorf("[ERROR] Problem with open file: %s", err)
+		panic(err)
+	}
+	defer file.Close()
+	scanner := bufio.NewScanner(file)
+	scanner.Split(bufio.ScanLines)
+	for scanner.Scan() {
+		splited := strings.Split(scanner.Text(), " ")
+		if len(splited[0]) > 0 {
+			modMap[splited[0]] = struct{}{}
+		}
+	}
+}
+
+func CheckModOrLoad(mod string) {
+	log.Println("CheckModOrLoad", mod)
+
+	if _, ok := modMap[mod]; ok {
+		return
+	}
+
+	var err error
+
+	if mod == "tun" || mod == "tap" {
+		_, err = os.Stat(tunPath)
+		if err == nil {
+			// 文件存在
+			return
+		}
+		err = fmt.Errorf("[error] Linux tunFile is null %s", tunPath)
+		log.Println(err)
+		return
+		// panic(err)
+	}
+
+	if InContainer {
+		err = fmt.Errorf("[error] Linux module %s is not loaded, please run `modprobe %s`", mod, mod)
+		log.Println(err)
+		return
+		// panic(err)
+	}
+
+	cmdstr := fmt.Sprintln("modprobe", mod)
+
+	cmd := exec.Command("sh", "-c", cmdstr)
+	b, err := cmd.CombinedOutput()
+	if err != nil {
+		log.Println(string(b))
+		panic(err)
+	}
+}

server/base/start.go

@@ -0,0 +1,12 @@
+package base
+
+func Start() {
+	execute()
+	initCfg()
+	initLog()
+	initMod()
+}
+
+func Test() {
+	initLog()
+}

server/bridge-init.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+
+#yum install bridge-utils
+
+# Define Bridge Interface
+br="anylink0"
+
+# 请根据sever服务器信息，更新下面的信息
+eth="eth0"
+eth_ip="192.168.10.4/24"
+eth_broadcast="192.168.10.255"
+eth_gateway="192.168.10.1"
+
+
+brctl addbr $br
+brctl addif $br $eth
+
+ip addr del $eth_ip dev $eth
+ip addr add 0.0.0.0 dev $eth
+ip link set dev $eth up promisc on
+
+mac=`cat /sys/class/net/$eth/address`
+ip link set dev $br up address $mac promisc on
+ip addr add $eth_ip broadcast $eth_broadcast dev $br
+
+
+route add default gateway $eth_gateway
+
+
+
+
+
+
+
+

server/conf/files/info.txt

@@ -0,0 +1,2 @@
+客户端软件需放置在files目录内，
+如需要帮助请加QQ群：567510628 、739072205

server/conf/profile.xml

@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://schemas.xmlsoap.org/encoding/ AnyConnectProfile.xsd">
+
+    <ClientInitialization>
+        <UseStartBeforeLogon UserControllable="false">false</UseStartBeforeLogon>
+        <StrictCertificateTrust>false</StrictCertificateTrust>
+        <RestrictPreferenceCaching>false</RestrictPreferenceCaching>
+        <RestrictTunnelProtocols>IPSec</RestrictTunnelProtocols>
+        <BypassDownloader>true</BypassDownloader>
+        <AutoUpdate UserControllable="false">false</AutoUpdate>
+        <WindowsVPNEstablishment>AllowRemoteUsers</WindowsVPNEstablishment>
+        <LinuxVPNEstablishment>AllowRemoteUsers</LinuxVPNEstablishment>
+        <CertEnrollmentPin>pinAllowed</CertEnrollmentPin>
+        <CertificateMatch>
+            <KeyUsage>
+                <MatchKey>Digital_Signature</MatchKey>
+            </KeyUsage>
+            <ExtendedKeyUsage>
+                <ExtendedMatchKey>ClientAuth</ExtendedMatchKey>
+            </ExtendedKeyUsage>
+        </CertificateMatch>
+
+    </ClientInitialization>
+
+    <ServerList>
+
+        <HostEntry>
+            <HostName>VPN</HostName>
+            <HostAddress>localhost</HostAddress>
+        </HostEntry>
+
+        <HostEntry>
+            <HostName>VPN2</HostName>
+            <HostAddress>localhost2</HostAddress>
+        </HostEntry>
+
+    </ServerList>
+</AnyConnectProfile>

server/conf/server-sample.toml

@@ -0,0 +1,96 @@
+#示例配置信息
+
+#其他配置文件,可以使用绝对路径
+#或者相对于 anylink 二进制文件的路径
+
+#数据文件
+db_type = "sqlite3"
+db_source = "./conf/anylink.db"
+#证书文件 使用跟nginx一样的证书即可
+cert_file = "./conf/vpn_cert.pem"
+cert_key = "./conf/vpn_cert.key"
+files_path = "./conf/files"
+profile = "./conf/profile.xml"
+#日志目录,为空写入标准输出
+#log_path = "./log"
+log_path = ""
+log_level = "debug"
+pprof = true
+
+#系统名称
+issuer = "XX公司VPN"
+#后台管理用户
+admin_user = "admin"
+#pass 123456
+admin_pass = "$2a$10$UQ7C.EoPifDeJh6d8.31TeSPQU7hM/NOM2nixmBucJpAuXDQNqNke"
+# 留空表示不开启 otp, 开启otp后密码为  pass + 6位otp
+# 生成 ./anylink tool -o
+admin_otp = ""
+jwt_secret = "abcdef.0123456789.abcdef"
+
+
+#TCP服务监听地址(任意端口)
+server_addr = ":443"
+#开启 DTLS
+server_dtls = true
+#UDP监听地址(任意端口)
+server_dtls_addr = ":443"
+#后台服务监听地址
+admin_addr = ":8800"
+#开启tcp proxy protocol协议
+proxy_protocol = false
+
+#虚拟网络类型[tun macvtap tap]
+link_mode = "tun"
+
+#客户端分配的ip地址池
+ipv4_master = "eth0"
+ipv4_cidr = "192.168.90.0/24"
+ipv4_gateway = "192.168.90.1"
+ipv4_start = "192.168.90.100"
+ipv4_end = "192.168.90.200"
+
+#最大客户端数量
+max_client = 200
+#单个用户同时在线数量
+max_user_client = 3
+#IP租期(秒)
+ip_lease = 86400
+
+#默认选择的组
+default_group = "one"
+
+#客户端失效检测时间(秒) dpd > keepalive
+cstp_keepalive = 5
+cstp_dpd = 12
+mobile_keepalive = 10
+mobile_dpd = 22
+
+#设置最大传输单元
+mtu = 1460
+
+# 客户端dns的默认搜索域
+default_domain = "example.com"
+#default_domain = "example.com abc.example.com"
+
+#空闲链接超时时间(秒)-超时后断开链接，0关闭此功能
+idle_timeout = 1800
+#session过期时间，用于断线重连，0永不过期
+session_timeout = 3600
+auth_timeout = 0
+audit_interval = 600
+
+show_sql = false
+
+#是否自动添加nat
+iptables_nat = true
+
+#启用压缩
+compression = false
+#低于及等于多少字节不压缩
+no_compress_limit = 256
+
+#客户端显示详细错误信息(线上环境慎开启)
+display_error = false
+
+

server/conf/server.toml

@@ -0,0 +1,56 @@
+#示例配置信息
+
+#其他配置文件,可以使用绝对路径
+#或者相对于 anylink 二进制文件的路径
+
+#数据文件
+db_type = "sqlite3"
+db_source = "./conf/anylink.db"
+#证书文件
+cert_file = "./conf/vpn_cert.pem"
+cert_key = "./conf/vpn_cert.key"
+files_path = "./conf/files"
+log_level = "debug"
+
+#系统名称
+issuer = "XX公司VPN"
+#后台管理用户
+admin_user = "admin"
+#pass 123456
+admin_pass = "$2a$10$UQ7C.EoPifDeJh6d8.31TeSPQU7hM/NOM2nixmBucJpAuXDQNqNke"
+# 留空表示不开启 otp, 开启otp后密码为  pass + 6位otp
+# 生成 ./anylink tool -o
+admin_otp = ""
+jwt_secret = "abcdef.0123456789.abcdef"
+
+#TCP服务监听地址(任意端口)
+server_addr = ":443"
+#开启 DTLS
+server_dtls = true
+#UDP监听地址(任意端口)
+server_dtls_addr = ":443"
+#后台服务监听地址
+admin_addr = ":8800"
+
+#最大客户端数量
+max_client = 200
+#单个用户同时在线数量
+max_user_client = 3
+
+#虚拟网络类型[tun macvtap]
+link_mode = "tun"
+#客户端分配的ip地址池
+ipv4_master = "eth0"
+ipv4_cidr = "192.168.90.0/24"
+ipv4_gateway = "192.168.90.1"
+ipv4_start = "192.168.90.100"
+ipv4_end = "192.168.90.200"
+
+#是否自动添加nat
+iptables_nat = true
+
+
+#客户端显示详细错误信息(线上环境慎开启)
+display_error = true
+
+

server/conf/vpn_cert.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEuwIBADANBgkqhkiG9w0BAQEFAASCBKUwggShAgEAAoIBAQDRVjwa+YPKcvKD
+2YZJUMPcwXCL32hF9gFTyMFuojpvo/L9C710xkJBNW2ceEcAdYyohBhtylbCFKUy
+QpDRJsAmRiWL5zSjfeds4bVEInmXvF+Ga9FuN/o/R27/kyrejBVd7u9AKzg9k5vI
+/4FhXFMivZgwghaSiJkVHJG6ehmCVGR11A5LUIjrub+iYJfaS2dl4WVxn9kyYRuO
+NU0nDMInWE6F+dVa57HEUEOolDEmr9R+N5XIXYfXwE4W4Xj/5CL+mBLME+OaADK8
+RE9dPomgk3Vqc/s8thllyztqR/TfQIwCwmQNf+UB5DIWr5iYDsX4rU3hswJQUCTQ
+CLNEcdStAgMBAAECgf97UHp7u8+x4lz6BQB8/c0xHWdAw1clIveZbEVl0hNoVUN/
+EKku+q/1Sf+CuhnbgLjT1bkVnnotmVcGeWH2DeCnkMJqHVMOBRb/dso2fw+pCTzY
+VofQpmbPy1xCXb6chqrpT3MTaJdI7IrBCNEQ54cOxsojwzp0MfejS/NI41q8iuCS
+hVry+VEbmtA22vjwMvsF6NsRKlfc1DUyC/ZoHB91gzKmvLdXBREwBXtdiJfMlu9G
+EKH3ORxbcanmdsXWIG84t5M9Sf9L5FZe6tlL4FdoKv25Vxv2z+PVM8Y/0B3IBTCb
+yqMK8579PTlHl40WRjSgzpijGvMxuIpgm5KaXQECgYEA7U6lBhRWmPsJRaK0jyAv
+qnaC5AbnM8OjIbsDtnQxn0BWvx7aZznxOE4jL0QejUD/gov6yYkNhIu797LzO8Mq
+fEqEX7Bp23PfLvybqkyhJWFz26v0erU5q8Rlt648bK7Ul1j8FkmsEN3qu+64c8Fu
+pzN081bqOGjEcaCjsHswvkMCgYEA4dOPvYYu8wBfrH3Gn94XHWWVvFMnWErXEOzK
+eL0dFg3Ae+y8Sg5x9YTz3XjwyzwcTbrD0zg4huWwmD64BgPcliG7XKA093ea2JIs
+Mah5/KTQmltcIut7qUvzwwbQVfN3xTwWzd7eDtEIAeFZ8r/HzJM6X21b/LaQIXUY
+Gb7dik8CgYAaaUxYlt7ke9wWUfuCinSDplj/A/2rdzSqxmOtZNU5AjIlZ0urfXlp
+aNjlo9E6q2dEokuxLn3AqMSs1s/XcOtDlg+RjtLZR9YpJpg0pf6xaF06r7KwDYdz
+pJIllVDIT9T9WzwDRwPNhMVhUTpaN8cW+NUlWCENUiu68cQGGk/cfQKBgEmvRk+I
+4PjZPl6CC7VOOiyVYO46E7RzdwlGuin7SupPQmctL6LaY8TAxPGW7LrjujiCoDLj
+PU6G08BZdqI/0FIMX54xiBbXJ+dSiqkJWARfotE6zi12uLrc1YTlTEU/U+0/VhGG
+jt42xm4WocrbWM4fnARXIpSq3QyNsHd2F8NxAoGBAMEcT0mFQ0J7HCQ+zL36ogGv
+Bc/N6WR0xSEBQVG9D4iysxX4XyJukCuUCvMIbsBj5IVAVBlMNxfDtL/kD6tgy0L7
+tdN7nOaYgnqTyZfQItz92cQ6oiIqW7GPJA5ATJe1fxXINjcP6EkRDAfACBW7/l85
+Cd/yRpaOSMPbqKO1OOSn
+-----END PRIVATE KEY-----

server/conf/vpn_cert.pem

@@ -0,0 +1,67 @@
+-----BEGIN CERTIFICATE-----
+MIIGbTCCBNWgAwIBAgIQIodwqN03+Y3aYpdvfq2qKTANBgkqhkiG9w0BAQwFADBZ
+MQswCQYDVQQGEwJDTjElMCMGA1UEChMcVHJ1c3RBc2lhIFRlY2hub2xvZ2llcywg
+SW5jLjEjMCEGA1UEAxMaVHJ1c3RBc2lhIFJTQSBEViBUTFMgQ0EgRzIwHhcNMjQw
+MTIyMDAwMDAwWhcNMjUwMTIxMjM1OTU5WjAcMRowGAYDVQQDExF2cG4udGVzdC52
+cWlsdS5jbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANFWPBr5g8py
+8oPZhklQw9zBcIvfaEX2AVPIwW6iOm+j8v0LvXTGQkE1bZx4RwB1jKiEGG3KVsIU
+pTJCkNEmwCZGJYvnNKN952zhtUQieZe8X4Zr0W43+j9Hbv+TKt6MFV3u70ArOD2T
+m8j/gWFcUyK9mDCCFpKImRUckbp6GYJUZHXUDktQiOu5v6Jgl9pLZ2XhZXGf2TJh
+G441TScMwidYToX51VrnscRQQ6iUMSav1H43lchdh9fAThbheP/kIv6YEswT45oA
+MrxET10+iaCTdWpz+zy2GWXLO2pH9N9AjALCZA1/5QHkMhavmJgOxfitTeGzAlBQ
+JNAIs0Rx1K0CAwEAAaOCAuwwggLoMB8GA1UdIwQYMBaAFF86fBEQfgxncWHci6O1
+AANn9VccMB0GA1UdDgQWBBRDRfNBNYRlLb4V1MRTnU+bUVnvnDAOBgNVHQ8BAf8E
+BAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUH
+AwIwSQYDVR0gBEIwQDA0BgsrBgEEAbIxAQICMTAlMCMGCCsGAQUFBwIBFhdodHRw
+czovL3NlY3RpZ28uY29tL0NQUzAIBgZngQwBAgEwfQYIKwYBBQUHAQEEcTBvMEIG
+CCsGAQUFBzAChjZodHRwOi8vY3J0LnRydXN0LXByb3ZpZGVyLmNuL1RydXN0QXNp
+YVJTQURWVExTQ0FHMi5jcnQwKQYIKwYBBQUHMAGGHWh0dHA6Ly9vY3NwLnRydXN0
+LXByb3ZpZGVyLmNuMBwGA1UdEQQVMBOCEXZwbi50ZXN0LnZxaWx1LmNuMIIBfwYK
+KwYBBAHWeQIEAgSCAW8EggFrAWkAdgDPEVbu1S58r/OHW9lpLpvpGnFnSrAX7KwB
+0lt3zsw7CAAAAY0v95Z6AAAEAwBHMEUCIDbFVgzV1DDvqTq6UnYisMqAEJn1cR+d
+mc+agwaOuRbrAiEAz3W2HooNcKqADX9QyK8xQQ8r9BQKVCQzF76g9AZKeDoAdwCi
+4wrkRe+9rZt+OO1HZ3dT14JbhJTXK14bLMS5UKRH5wAAAY0v95ZkAAAEAwBIMEYC
+IQCWVxDjciJ/KMbwbqMbEZdsDq0nCrotlPhIBb5wFBurVgIhAOgnw3nqSqFYRm8y
+OL3nz8rop0V5IEtgiNarOqMfLf33AHYATnWjJ1yaEMM4W2zU3z9S6x3w4I4bjWnA
+sfpksWKaOd8AAAGNL/eWFwAABAMARzBFAiBB+V0NBebuCniZVuin5OaMYvWyNvRd
+NJ6hRmLbSKQAwwIhAKrPRrAP3An/9HSrFN/70eEK5DHT8+q8m0L5tc0+TckmMA0G
+CSqGSIb3DQEBDAUAA4IBgQCB65Q0V6Mewca0iVCxLJxczu6XYCCwsUzJiTWYjao3
+XZVe8yB4RhAimsUY+U3nXIL3RivkJydqfOO9N5APWndDgbtS4r55TFdscDUDmzsR
+S5kYCoEudbDWT89U+tHMOxzUKkb3nDA0WvJEN52CAanYO3blihnX3eX7enQMGtsM
+gfDrArcQyS+WMKUkyOlNysqGtj3XWYKssBPrX/0GqMimoeYkg+B4daBTbOVB6sKs
++USnmhI2MF3QUxn0+fC207HbSDj7s4a6npjg5KsL0zUsFrNZlMH30Tx2L0WuI1T7
+65lKHaKt8CyuL/YTjD5lAGYtJ+K9ypl5sBUFCXeW1lazTocjDa2CKv3WV+kVBhyO
+2nA2Lo4e643YXwXw98+ufU2U9yUjn1OrhsUXo3qaxETGVMumRwubtX4O2dUKnYGF
+xBxfHzXJKhZjX+U2ENIwsrm7pp3dcpIZqKxPCeowU5Ma9tvYpM7kgDhploMfsVic
+H7pWcFY99X5nMwJoDDBYomY=
+-----END CERTIFICATE-----
+
+-----BEGIN CERTIFICATE-----
+MIIFBzCCA++gAwIBAgIRALIM7VUuMaC/NDp1KHQ76aswDQYJKoZIhvcNAQELBQAw
+ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV
+BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yMjAxMTAwMDAwMDBaFw0y
+ODEyMzEyMzU5NTlaMFkxCzAJBgNVBAYTAkNOMSUwIwYDVQQKExxUcnVzdEFzaWEg
+VGVjaG5vbG9naWVzLCBJbmMuMSMwIQYDVQQDExpUcnVzdEFzaWEgUlNBIERWIFRM
+UyBDQSBHMjCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKjGDe0GSaBs
+Yl/VhMaTM6GhfR1TAt4mrhN8zfAMwEfLZth+N2ie5ULbW8YvSGzhqkDhGgSBlafm
+qq05oeESrIJQyz24j7icGeGyIZ/jIChOOvjt4M8EVi3O0Se7E6RAgVYcX+QWVp5c
+Sy+l7XrrtL/pDDL9Bngnq/DVfjCzm5ZYUb1PpyvYTP7trsV+yYOCNmmwQvB4yVjf
+IIpHC1OcsPBntMUGeH1Eja4D+qJYhGOxX9kpa+2wTCW06L8T6OhkpJWYn5JYiht5
+8exjAR7b8Zi3DeG9oZO5o6Qvhl3f8uGU8lK1j9jCUN/18mI/5vZJ76i+hsgdlfZB
+Rh5lmAQjD80M9TY+oD4MYUqB5XrigPfFAUwXFGehhlwCVw7y6+5kpbq/NpvM5Ba8
+SeQYUUuMA8RXpTtGlrrTPqJryfa55hTuX/ThhX4gcCVkbyujo0CYr+Uuc14IOyNY
+1fD0/qORbllbgV41wiy/2ZUWZQUodqHWkjT1CwIMbQOY5jmrSYGBwwIDAQABo4IB
+JjCCASIwHwYDVR0jBBgwFoAUoBEKIz6W8Qfs4q8p74Klf9AwpLQwHQYDVR0OBBYE
+FF86fBEQfgxncWHci6O1AANn9VccMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8E
+CDAGAQH/AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAiBgNVHSAE
+GzAZMA0GCysGAQQBsjEBAgIxMAgGBmeBDAECATBDBgNVHR8EPDA6MDigNqA0hjJo
+dHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNy
+bDA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9k
+b2NhLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAHMUom5cxIje2IiFU7mOCsBr2F6CY
+eU5cyfQ/Aep9kAXYUDuWsaT85721JxeXFYkf4D/cgNd9+hxT8ZeDOJrn+ysqR7NO
+2K9AdqTdIY2uZPKmvgHOkvH2gQD6jc05eSPOwdY/10IPvmpgUKaGOa/tyygL8Og4
+3tYyoHipMMnS4OiYKakDJny0XVuchIP7ZMKiP07Q3FIuSS4omzR77kmc75/6Q9dP
+v4wa90UCOn1j6r7WhMmX3eT3Gsdj3WMe9bYD0AFuqa6MDyjIeXq08mVGraXiw73s
+Zale8OMckn/BU3O/3aFNLHLfET2H2hT6Wb3nwxjpLIfXmSVcVd8A58XH0g==
+-----END CERTIFICATE-----

server/cron/clear_audit.go

@@ -0,0 +1,20 @@
+package cron
+
+import (
+	"github.com/bjdgyc/anylink/base"
+	"github.com/bjdgyc/anylink/dbdata"
+)
+
+// 清除访问审计日志
+func ClearAudit() {
+	lifeDay, timesUp := isClearTime()
+	if !timesUp {
+		return
+	}
+	// 当审计日志永久保存，则退出
+	if lifeDay <= 0 {
+		return
+	}
+	affected, err := dbdata.ClearAccessAudit(getTimeAgo(lifeDay))
+	base.Info("Cron ClearAudit: ", affected, err)
+}