yan/archived-rttys
1
0
Fork 0
mirror of https://github.com/zhaojh329/rttys.git synced 2026-02-27 09:53:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

refactor: Remove device white list support

Browse Source 
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
This commit is contained in:
Jianhui Zhao
2025-06-11 10:36:53 +08:00
parent b1e592f1fa
commit ab87db1f7d
6 changed files with 33 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api.go
+33 -73
View File
@@ -32,15 +32,6 @@ func httpLogin(cfg *config.Config, password string) bool {
return cfg.Password == "" || cfg.Password == password
}
func devInWhiteList(devid string, cfg *config.Config) bool {
if cfg.WhiteList == nil {
return true
}
_, ok := cfg.WhiteList[devid]
return ok
}
func isLocalRequest(c *gin.Context) bool {
addr, _ := net.ResolveTCPAddr("tcp", c.Request.RemoteAddr)
return addr.IP.IsLoopback()
@@ -73,24 +64,10 @@ func apiStart(br *broker) {
r.Use(gin.Recovery())
authorized := r.Group("/", func(c *gin.Context) {
devid := ""
if !cfg.LocalAuth && isLocalRequest(c) {
return
}
if strings.HasPrefix(c.Request.URL.Path, "/connect/") {
devid = c.Param("devid")
if devid == "" {
c.AbortWithStatus(http.StatusBadRequest)
return
}
if devInWhiteList(devid, cfg) {
return
}
}
if !httpAuth(cfg, c) {
c.AbortWithStatus(http.StatusUnauthorized)
return
@@ -147,25 +124,45 @@ func apiStart(br *broker) {
handleCmdReq(br, c)
})
r.Any("/web/:devid/:proto/:addr/*path", func(c *gin.Context) {
authorized.Any("/web/:devid/:proto/:addr/*path", func(c *gin.Context) {
httpProxyRedirect(br, c)
})
r.GET("/authorized/:devid", func(c *gin.Context) {
devid := c.Param("devid")
authorized := !cfg.LocalAuth && isLocalRequest(c)
if !authorized && devInWhiteList(devid, cfg) {
authorized = true
authorized.GET("/signout", func(c *gin.Context) {
cookie, err := c.Cookie("sid")
if err != nil || !httpSessions.Have(cookie) {
return
}
if !authorized && httpAuth(cfg, c) {
authorized = httpAuth(cfg, c)
}
httpSessions.Del(cookie)
c.JSON(http.StatusOK, gin.H{
"authorized": authorized,
})
c.Status(http.StatusOK)
})
authorized.GET("/file/:sid", func(c *gin.Context) {
sid := c.Param("sid")
if fp, ok := br.fileProxy.Load(sid); ok {
fp := fp.(*fileProxy)
if s, ok := br.getSession(sid); ok {
fp.Ack(s.dev, sid)
}
defer func() {
if err := recover(); err != nil {
if ne, ok := err.(*net.OpError); ok {
if se, ok := ne.Err.(*os.SyscallError); ok {
if strings.Contains(strings.ToLower(se.Error()), "broken pipe") || strings.Contains(strings.ToLower(se.Error()), "connection reset by peer") {
fp.reader.Close()
}
}
}
}
}()
c.DataFromReader(http.StatusOK, -1, "application/octet-stream", fp.reader, nil)
br.fileProxy.Delete(sid)
}
})
r.POST("/signin", func(c *gin.Context) {
@@ -204,43 +201,6 @@ func apiStart(br *broker) {
}
})
r.GET("/signout", func(c *gin.Context) {
cookie, err := c.Cookie("sid")
if err != nil || !httpSessions.Have(cookie) {
return
}
httpSessions.Del(cookie)
c.Status(http.StatusOK)
})
r.GET("/file/:sid", func(c *gin.Context) {
sid := c.Param("sid")
if fp, ok := br.fileProxy.Load(sid); ok {
fp := fp.(*fileProxy)
if s, ok := br.getSession(sid); ok {
fp.Ack(s.dev, sid)
}
defer func() {
if err := recover(); err != nil {
if ne, ok := err.(*net.OpError); ok {
if se, ok := ne.Err.(*os.SyscallError); ok {
if strings.Contains(strings.ToLower(se.Error()), "broken pipe") || strings.Contains(strings.ToLower(se.Error()), "connection reset by peer") {
fp.reader.Close()
}
}
}
}
}()
c.DataFromReader(http.StatusOK, -1, "application/octet-stream", fp.reader, nil)
br.fileProxy.Delete(sid)
}
})
r.NoRoute(func(c *gin.Context) {
fs, _ := fs.Sub(staticFs, "ui/dist")
config/config.go
-28
View File
@@ -4,7 +4,6 @@ import (
"fmt"
"os"
"strconv"
"strings"
"github.com/kylelemons/go-gypsy/yaml"
"github.com/urfave/cli/v2"
@@ -25,7 +24,6 @@ type Config struct {
WebUISslKey string
Token string
DevAuthUrl string
WhiteList map[string]bool
LocalAuth bool
SeparateSslConfig bool
Password string
@@ -71,18 +69,6 @@ func parseYamlCfg(cfg *Config, conf string) error {
getConfigOpt(yamlCfg, "token", &cfg.Token)
getConfigOpt(yamlCfg, "dev-auth-url", &cfg.DevAuthUrl)
getConfigOpt(yamlCfg, "local-auth", &cfg.LocalAuth)
val, err := yamlCfg.Get("white-list")
if err == nil {
if val != "*" && val != "\"*\"" {
cfg.WhiteList = make(map[string]bool)
for _, id := range strings.Fields(val) {
cfg.WhiteList[id] = true
}
}
}
getConfigOpt(yamlCfg, "password", &cfg.Password)
return nil
@@ -142,20 +128,6 @@ func Parse(c *cli.Context) (*Config, error) {
cfg.WebUISslKey = cfg.SslKey
}
if c.IsSet("white-list") {
whiteList := c.String("white-list")
if whiteList == "*" {
cfg.WhiteList = nil
} else {
cfg.WhiteList = make(map[string]bool)
for _, id := range strings.Fields(whiteList) {
cfg.WhiteList[id] = true
}
}
}
if cfg.SslCacert != "" {
if _, err := os.Lstat(cfg.SslCacert); err != nil {
return nil, fmt.Errorf(`SslCacert "%s" not exist`, cfg.SslCacert)
main.go
-4
View File
@@ -138,10 +138,6 @@ func main() {
Name: "dev-auth-url",
Usage: "using device auth url instead of token",
},
&cli.StringFlag{
Name: "white-list",
Usage: "white list(device IDs separated by spaces or *)",
},
&cli.BoolFlag{
Name: "local-auth",
Value: true,
rttys.conf
-7
View File
@@ -21,13 +21,6 @@
#token: a1d4cdb1a3cd6a0e94aa3599afcddcf5
#dev-auth-url: http://127.0.0.1:8080/rttys-dev-auth
# No login required to connect device.
# Values can be device IDs separated by spaces,
# or a "*" indicates that all devices do not require login
# http://localhost:5913/connect/rtty1
#white-list: "*"
#white-list: rtty1 rtty2
# Local access does not require authentication
#local-auth: false
ui/src/router/index.js
-11
View File
@@ -42,17 +42,6 @@ const router = createRouter({
})
router.beforeEach((to, from, next) => {
if (to.matched.length > 0 && to.matched[0].path === '/rtty/:devid') {
const devid = to.params['devid']
axios.get(`/authorized/${devid}`).then(r => {
if (r.data.authorized)
next()
else
next({ name: 'login' })
})
return
}
if (to.path !== '/login') {
axios.get('/alive').then(() => {
next()
ui/vite.config.js
-3
View File
@@ -40,9 +40,6 @@ export default defineConfig({
ws: true,
target: 'http://127.0.0.1:5913'
},
'^/authorized/.*': {
target: 'http://127.0.0.1:5913'
},
'^/web/*': {
target: 'http://127.0.0.1:5913'
},