277 lines
7.9 KiB
Go
277 lines
7.9 KiB
Go
package agent
|
||
|
||
import (
|
||
"crypto/sha256"
|
||
"crypto/tls"
|
||
"encoding/hex"
|
||
"encoding/json"
|
||
"encoding/pem"
|
||
"errors"
|
||
"fmt"
|
||
"net"
|
||
"net/http"
|
||
"os"
|
||
"os/exec"
|
||
"path/filepath"
|
||
"strconv"
|
||
"strings"
|
||
"time"
|
||
|
||
"github.com/fonu/fonu/internal/fsutil"
|
||
)
|
||
|
||
const httpsProxyConfigName = "fonuagent-https.conf"
|
||
|
||
type httpsProxyRequest struct {
|
||
CertPEM string `json:"cert_pem"`
|
||
KeyPEM string `json:"key_pem"`
|
||
Port int `json:"port"`
|
||
}
|
||
|
||
type httpsProxyState struct {
|
||
Port int `json:"port"`
|
||
}
|
||
|
||
func (s *Server) putHTTPSProxy(w http.ResponseWriter, r *http.Request) {
|
||
var req httpsProxyRequest
|
||
if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 2<<20)).Decode(&req); err != nil {
|
||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON"})
|
||
return
|
||
}
|
||
if req.Port <= 0 || req.Port > 65535 {
|
||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "端口需在 1-65535 之间"})
|
||
return
|
||
}
|
||
if _, err := tls.X509KeyPair([]byte(req.CertPEM), []byte(req.KeyPEM)); err != nil {
|
||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "证书或私钥格式无效"})
|
||
return
|
||
}
|
||
if probe := s.probeNginx(); probe.Missing {
|
||
writeJSON(w, http.StatusBadGateway, map[string]string{"error": "VPS 未安装 Nginx，无法启用 HTTPS 直连"})
|
||
return
|
||
}
|
||
s.mu.Lock()
|
||
defer s.mu.Unlock()
|
||
if err := s.configureHTTPSProxy(req); err != nil {
|
||
writeJSON(w, http.StatusBadGateway, map[string]string{"error": err.Error()})
|
||
return
|
||
}
|
||
writeJSON(w, http.StatusOK, map[string]any{"ok": true, "port": req.Port, "self_check": "ok"})
|
||
}
|
||
|
||
func (s *Server) deleteHTTPSProxy(w http.ResponseWriter, _ *http.Request) {
|
||
s.mu.Lock()
|
||
defer s.mu.Unlock()
|
||
if err := s.removeHTTPSProxy(); err != nil {
|
||
writeJSON(w, http.StatusBadGateway, map[string]string{"error": err.Error()})
|
||
return
|
||
}
|
||
writeJSON(w, http.StatusOK, map[string]any{"ok": true})
|
||
}
|
||
|
||
func (s *Server) configureHTTPSProxy(req httpsProxyRequest) error {
|
||
dir, err := s.ensureNginxDir()
|
||
if err != nil {
|
||
return err
|
||
}
|
||
tlsDir := "/etc/fonu-agent/tls"
|
||
if err := os.MkdirAll(tlsDir, 0o750); err != nil {
|
||
return err
|
||
}
|
||
certPath := filepath.Join(tlsDir, "agent.crt")
|
||
keyPath := filepath.Join(tlsDir, "agent.key")
|
||
if err := atomicWrite(certPath, []byte(req.CertPEM), 0o640); err != nil {
|
||
return err
|
||
}
|
||
if err := atomicWrite(keyPath, []byte(req.KeyPEM), 0o600); err != nil {
|
||
return err
|
||
}
|
||
path := filepath.Join(dir, httpsProxyConfigName)
|
||
previous, readErr := os.ReadFile(path)
|
||
if _, err := fsutil.BackupVersioned(path, 10); err != nil {
|
||
return err
|
||
}
|
||
content := renderHTTPSProxy(req.Port, certPath, keyPath)
|
||
if err := atomicWrite(path, []byte(content), 0o640); err != nil {
|
||
return err
|
||
}
|
||
if err := s.validateNginx(); err != nil {
|
||
s.restoreHTTPSConfig(path, previous, readErr)
|
||
return fmt.Errorf("nginx config rejected: %w", err)
|
||
}
|
||
if err := s.reloadNginx(); err != nil {
|
||
s.restoreHTTPSConfig(path, previous, readErr)
|
||
return err
|
||
}
|
||
pin, err := certificatePin(req.CertPEM)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
if err := s.verifyHTTPSProxy(req.Port, pin); err != nil {
|
||
s.restoreHTTPSConfig(path, previous, readErr)
|
||
return err
|
||
}
|
||
return writeHTTPSProxyState(s.cfg.DataDir, httpsProxyState{Port: req.Port})
|
||
}
|
||
|
||
func (s *Server) removeHTTPSProxy() error {
|
||
dir, err := s.ensureNginxDir()
|
||
if err != nil {
|
||
return err
|
||
}
|
||
path := filepath.Join(dir, httpsProxyConfigName)
|
||
previous, readErr := os.ReadFile(path)
|
||
if errors.Is(readErr, os.ErrNotExist) {
|
||
_ = os.Remove(httpsProxyStatePath(s.cfg.DataDir))
|
||
return nil
|
||
}
|
||
if err := os.Remove(path); err != nil && !errors.Is(err, os.ErrNotExist) {
|
||
return err
|
||
}
|
||
if err := s.validateNginx(); err != nil {
|
||
s.restoreHTTPSConfig(path, previous, readErr)
|
||
return err
|
||
}
|
||
if err := s.reloadNginx(); err != nil {
|
||
s.restoreHTTPSConfig(path, previous, readErr)
|
||
return err
|
||
}
|
||
_ = os.Remove(httpsProxyStatePath(s.cfg.DataDir))
|
||
return nil
|
||
}
|
||
|
||
func (s *Server) restoreHTTPSConfig(path string, previous []byte, readErr error) {
|
||
if readErr == nil {
|
||
_ = atomicWrite(path, previous, 0o640)
|
||
} else {
|
||
_ = os.Remove(path)
|
||
}
|
||
_ = s.reloadNginx()
|
||
}
|
||
|
||
func (s *Server) ensureNginxDir() (string, error) {
|
||
dir := strings.TrimSpace(s.cfg.NginxConfDir)
|
||
if dir != "" {
|
||
return dir, nil
|
||
}
|
||
dir, err := detectNginxConfDir(s.nginxPath())
|
||
if err != nil {
|
||
return "", err
|
||
}
|
||
s.cfg.NginxConfDir = dir
|
||
return dir, nil
|
||
}
|
||
|
||
func renderHTTPSProxy(port int, certPath, keyPath string) string {
|
||
return fmt.Sprintf(`# Managed by fonu-agent. Do not edit.
|
||
server {
|
||
listen %d ssl default_server;
|
||
server_name _;
|
||
ssl_certificate %s;
|
||
ssl_certificate_key %s;
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
|
||
location /api/v1/ {
|
||
proxy_pass http://127.0.0.1:7700;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header Authorization $http_authorization;
|
||
}
|
||
}
|
||
`, port, certPath, keyPath)
|
||
}
|
||
|
||
func certificatePin(certPEM string) (string, error) {
|
||
block, _ := pem.Decode([]byte(certPEM))
|
||
if block == nil {
|
||
return "", errors.New("证书 PEM 解码失败")
|
||
}
|
||
sum := sha256.Sum256(block.Bytes)
|
||
return hex.EncodeToString(sum[:]), nil
|
||
}
|
||
|
||
// verifyHTTPSProxy 在 reload 后从本机回环地址握手，确认 7443 上真正返回的就是刚写入的证书。
|
||
// nginx reload 是异步的，这里留出短暂重试窗口，避免旧 worker 造成的瞬时误判。
|
||
func (s *Server) verifyHTTPSProxy(port int, want string) error {
|
||
deadline := time.Now().Add(5 * time.Second)
|
||
var lastErr error
|
||
for {
|
||
lastErr = probeHTTPSPin(port, want)
|
||
if lastErr == nil {
|
||
return nil
|
||
}
|
||
if time.Now().After(deadline) {
|
||
return lastErr
|
||
}
|
||
time.Sleep(500 * time.Millisecond)
|
||
}
|
||
}
|
||
|
||
func probeHTTPSPin(port int, want string) error {
|
||
addr := net.JoinHostPort("127.0.0.1", strconv.Itoa(port))
|
||
dialer := &net.Dialer{Timeout: 3 * time.Second}
|
||
conn, err := tls.DialWithDialer(dialer, "tcp", addr, &tls.Config{InsecureSkipVerify: true, MinVersion: tls.VersionTLS12})
|
||
if err != nil {
|
||
return fmt.Errorf("本机 https://%s 自检失败：%w；%s", addr, err, portListenerHint(port))
|
||
}
|
||
defer conn.Close()
|
||
certs := conn.ConnectionState().PeerCertificates
|
||
if len(certs) == 0 {
|
||
return fmt.Errorf("本机 https://%s 未返回证书；%s", addr, portListenerHint(port))
|
||
}
|
||
sum := sha256.Sum256(certs[0].Raw)
|
||
got := hex.EncodeToString(sum[:])
|
||
if !strings.EqualFold(got, want) {
|
||
return fmt.Errorf("本机 https://%s 证书指纹不匹配：期望 %s，实际 %s；%s", addr, want, got, portListenerHint(port))
|
||
}
|
||
return nil
|
||
}
|
||
|
||
// portListenerHint 把监听该端口的进程信息带进错误里，便于区分 nginx 未生效与端口被其他服务占用。
|
||
func portListenerHint(port int) string {
|
||
out, err := exec.Command("ss", "-tlnp").CombinedOutput()
|
||
if err != nil {
|
||
return "无法读取端口监听信息"
|
||
}
|
||
suffix := ":" + strconv.Itoa(port)
|
||
lines := make([]string, 0, 2)
|
||
for _, line := range strings.Split(string(out), "\n") {
|
||
if strings.Contains(line, suffix+" ") || strings.HasSuffix(strings.TrimSpace(line), suffix) {
|
||
lines = append(lines, strings.TrimSpace(line))
|
||
}
|
||
}
|
||
if len(lines) == 0 {
|
||
return "未发现监听 " + suffix + " 的进程"
|
||
}
|
||
return "监听 " + suffix + "：" + strings.Join(lines, " | ")
|
||
}
|
||
|
||
func httpsProxyStatePath(dataDir string) string {
|
||
return filepath.Join(dataDir, "https_transport.json")
|
||
}
|
||
|
||
func writeHTTPSProxyState(dataDir string, state httpsProxyState) error {
|
||
if strings.TrimSpace(dataDir) == "" {
|
||
return nil
|
||
}
|
||
data, err := json.Marshal(state)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
return atomicWrite(httpsProxyStatePath(dataDir), data, 0o640)
|
||
}
|
||
|
||
func readHTTPSProxyState(dataDir string) (httpsProxyState, bool) {
|
||
data, err := os.ReadFile(httpsProxyStatePath(dataDir))
|
||
if err != nil {
|
||
return httpsProxyState{}, false
|
||
}
|
||
var state httpsProxyState
|
||
if err := json.Unmarshal(data, &state); err != nil || state.Port <= 0 {
|
||
return httpsProxyState{}, false
|
||
}
|
||
return state, true
|
||
}
|