From ab87db1f7ded36dcaafe16a794dc8176b7b278fd Mon Sep 17 00:00:00 2001 From: Jianhui Zhao Date: Wed, 11 Jun 2025 10:36:53 +0800 Subject: [PATCH] refactor: Remove device white list support Signed-off-by: Jianhui Zhao --- api.go | 106 +++++++++++++---------------------------- config/config.go | 28 ----------- main.go | 4 -- rttys.conf | 7 --- ui/src/router/index.js | 11 ----- ui/vite.config.js | 3 -- 6 files changed, 33 insertions(+), 126 deletions(-) diff --git a/api.go b/api.go index c8e84a0..b25151e 100644 --- a/api.go +++ b/api.go @@ -32,15 +32,6 @@ func httpLogin(cfg *config.Config, password string) bool { return cfg.Password == "" || cfg.Password == password } -func devInWhiteList(devid string, cfg *config.Config) bool { - if cfg.WhiteList == nil { - return true - } - - _, ok := cfg.WhiteList[devid] - return ok -} - func isLocalRequest(c *gin.Context) bool { addr, _ := net.ResolveTCPAddr("tcp", c.Request.RemoteAddr) return addr.IP.IsLoopback() @@ -73,24 +64,10 @@ func apiStart(br *broker) { r.Use(gin.Recovery()) authorized := r.Group("/", func(c *gin.Context) { - devid := "" - if !cfg.LocalAuth && isLocalRequest(c) { return } - if strings.HasPrefix(c.Request.URL.Path, "/connect/") { - devid = c.Param("devid") - if devid == "" { - c.AbortWithStatus(http.StatusBadRequest) - return - } - - if devInWhiteList(devid, cfg) { - return - } - } - if !httpAuth(cfg, c) { c.AbortWithStatus(http.StatusUnauthorized) return @@ -147,25 +124,45 @@ func apiStart(br *broker) { handleCmdReq(br, c) }) - r.Any("/web/:devid/:proto/:addr/*path", func(c *gin.Context) { + authorized.Any("/web/:devid/:proto/:addr/*path", func(c *gin.Context) { httpProxyRedirect(br, c) }) - r.GET("/authorized/:devid", func(c *gin.Context) { - devid := c.Param("devid") - authorized := !cfg.LocalAuth && isLocalRequest(c) - - if !authorized && devInWhiteList(devid, cfg) { - authorized = true + authorized.GET("/signout", func(c *gin.Context) { + cookie, err := c.Cookie("sid") + if err != nil || !httpSessions.Have(cookie) { + return } - if !authorized && httpAuth(cfg, c) { - authorized = httpAuth(cfg, c) - } + httpSessions.Del(cookie) - c.JSON(http.StatusOK, gin.H{ - "authorized": authorized, - }) + c.Status(http.StatusOK) + }) + + authorized.GET("/file/:sid", func(c *gin.Context) { + sid := c.Param("sid") + if fp, ok := br.fileProxy.Load(sid); ok { + fp := fp.(*fileProxy) + + if s, ok := br.getSession(sid); ok { + fp.Ack(s.dev, sid) + } + + defer func() { + if err := recover(); err != nil { + if ne, ok := err.(*net.OpError); ok { + if se, ok := ne.Err.(*os.SyscallError); ok { + if strings.Contains(strings.ToLower(se.Error()), "broken pipe") || strings.Contains(strings.ToLower(se.Error()), "connection reset by peer") { + fp.reader.Close() + } + } + } + } + }() + + c.DataFromReader(http.StatusOK, -1, "application/octet-stream", fp.reader, nil) + br.fileProxy.Delete(sid) + } }) r.POST("/signin", func(c *gin.Context) { @@ -204,43 +201,6 @@ func apiStart(br *broker) { } }) - r.GET("/signout", func(c *gin.Context) { - cookie, err := c.Cookie("sid") - if err != nil || !httpSessions.Have(cookie) { - return - } - - httpSessions.Del(cookie) - - c.Status(http.StatusOK) - }) - - r.GET("/file/:sid", func(c *gin.Context) { - sid := c.Param("sid") - if fp, ok := br.fileProxy.Load(sid); ok { - fp := fp.(*fileProxy) - - if s, ok := br.getSession(sid); ok { - fp.Ack(s.dev, sid) - } - - defer func() { - if err := recover(); err != nil { - if ne, ok := err.(*net.OpError); ok { - if se, ok := ne.Err.(*os.SyscallError); ok { - if strings.Contains(strings.ToLower(se.Error()), "broken pipe") || strings.Contains(strings.ToLower(se.Error()), "connection reset by peer") { - fp.reader.Close() - } - } - } - } - }() - - c.DataFromReader(http.StatusOK, -1, "application/octet-stream", fp.reader, nil) - br.fileProxy.Delete(sid) - } - }) - r.NoRoute(func(c *gin.Context) { fs, _ := fs.Sub(staticFs, "ui/dist") diff --git a/config/config.go b/config/config.go index 57bf5ae..b931b2d 100644 --- a/config/config.go +++ b/config/config.go @@ -4,7 +4,6 @@ import ( "fmt" "os" "strconv" - "strings" "github.com/kylelemons/go-gypsy/yaml" "github.com/urfave/cli/v2" @@ -25,7 +24,6 @@ type Config struct { WebUISslKey string Token string DevAuthUrl string - WhiteList map[string]bool LocalAuth bool SeparateSslConfig bool Password string @@ -71,18 +69,6 @@ func parseYamlCfg(cfg *Config, conf string) error { getConfigOpt(yamlCfg, "token", &cfg.Token) getConfigOpt(yamlCfg, "dev-auth-url", &cfg.DevAuthUrl) getConfigOpt(yamlCfg, "local-auth", &cfg.LocalAuth) - - val, err := yamlCfg.Get("white-list") - if err == nil { - if val != "*" && val != "\"*\"" { - cfg.WhiteList = make(map[string]bool) - - for _, id := range strings.Fields(val) { - cfg.WhiteList[id] = true - } - } - } - getConfigOpt(yamlCfg, "password", &cfg.Password) return nil @@ -142,20 +128,6 @@ func Parse(c *cli.Context) (*Config, error) { cfg.WebUISslKey = cfg.SslKey } - if c.IsSet("white-list") { - whiteList := c.String("white-list") - - if whiteList == "*" { - cfg.WhiteList = nil - } else { - cfg.WhiteList = make(map[string]bool) - - for _, id := range strings.Fields(whiteList) { - cfg.WhiteList[id] = true - } - } - } - if cfg.SslCacert != "" { if _, err := os.Lstat(cfg.SslCacert); err != nil { return nil, fmt.Errorf(`SslCacert "%s" not exist`, cfg.SslCacert) diff --git a/main.go b/main.go index d15453b..13322ca 100644 --- a/main.go +++ b/main.go @@ -138,10 +138,6 @@ func main() { Name: "dev-auth-url", Usage: "using device auth url instead of token", }, - &cli.StringFlag{ - Name: "white-list", - Usage: "white list(device IDs separated by spaces or *)", - }, &cli.BoolFlag{ Name: "local-auth", Value: true, diff --git a/rttys.conf b/rttys.conf index c33056a..935d771 100644 --- a/rttys.conf +++ b/rttys.conf @@ -21,13 +21,6 @@ #token: a1d4cdb1a3cd6a0e94aa3599afcddcf5 #dev-auth-url: http://127.0.0.1:8080/rttys-dev-auth -# No login required to connect device. -# Values can be device IDs separated by spaces, -# or a "*" indicates that all devices do not require login -# http://localhost:5913/connect/rtty1 -#white-list: "*" -#white-list: rtty1 rtty2 - # Local access does not require authentication #local-auth: false diff --git a/ui/src/router/index.js b/ui/src/router/index.js index 361e95d..6d255e3 100644 --- a/ui/src/router/index.js +++ b/ui/src/router/index.js @@ -42,17 +42,6 @@ const router = createRouter({ }) router.beforeEach((to, from, next) => { - if (to.matched.length > 0 && to.matched[0].path === '/rtty/:devid') { - const devid = to.params['devid'] - axios.get(`/authorized/${devid}`).then(r => { - if (r.data.authorized) - next() - else - next({ name: 'login' }) - }) - return - } - if (to.path !== '/login') { axios.get('/alive').then(() => { next() diff --git a/ui/vite.config.js b/ui/vite.config.js index 5d956e5..708eace 100644 --- a/ui/vite.config.js +++ b/ui/vite.config.js @@ -40,9 +40,6 @@ export default defineConfig({ ws: true, target: 'http://127.0.0.1:5913' }, - '^/authorized/.*': { - target: 'http://127.0.0.1:5913' - }, '^/web/*': { target: 'http://127.0.0.1:5913' },