fix(agent): Bearer Token 改为常量时间比较并发布 v1.2.21

internal/agent/auth_test.go

@@ -0,0 +1,54 @@
+package agent
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestServerAuthToken(t *testing.T) {
+	server := &Server{cfg: Config{Token: "secret-token"}}
+	handler := server.auth(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	})
+
+	cases := []struct {
+		name   string
+		header string
+		status int
+	}{
+		{name: "正确 Token", header: "Bearer secret-token", status: http.StatusNoContent},
+		{name: "Bearer 大小写不敏感", header: "bearer secret-token", status: http.StatusNoContent},
+		{name: "多余空白可容忍", header: "  Bearer   secret-token  ", status: http.StatusNoContent},
+		{name: "错误 Token", header: "Bearer wrong-token", status: http.StatusUnauthorized},
+		{name: "长度不同的 Token", header: "Bearer secret-token-longer", status: http.StatusUnauthorized},
+		{name: "缺少 Authorization", status: http.StatusUnauthorized},
+		{name: "认证方案错误", header: "Token secret-token", status: http.StatusUnauthorized},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, "/api/v1/ping", nil)
+			if tc.header != "" {
+				req.Header.Set("Authorization", tc.header)
+			}
+			recorder := httptest.NewRecorder()
+			handler(recorder, req)
+			if recorder.Code != tc.status {
+				t.Fatalf("期望状态 %d，实际 %d", tc.status, recorder.Code)
+			}
+		})
+	}
+}
+
+func TestSecureTokenEqual(t *testing.T) {
+	if !secureTokenEqual("same-token", "same-token") {
+		t.Fatal("相同 Token 应通过")
+	}
+	if secureTokenEqual("short", "longer-token") {
+		t.Fatal("不同 Token 不应通过")
+	}
+	if secureTokenEqual("", "non-empty") {
+		t.Fatal("空 Token 不应通过")
+	}
+}

internal/agent/server.go

@@ -6,6 +6,7 @@ import (
 	"context"
 	"crypto/rand"
 	"crypto/sha256"
+	"crypto/subtle"
 	"encoding/hex"
 	"encoding/json"
 	"errors"
@@ -48,7 +49,8 @@ import (
 // 修掉「VPS 未安装 Nginx」告警与一键安装按钮永远不出现、以及把它误报成「配置校验未通过」的问题。
 // 0.12.7：vhost 目录探测不再要求被加载文件带 .conf 后缀（Debian 的 sites-enabled/default 不带），
 // 并在失败信息里带上最后一次的具体原因与常见的显式指定目录。
-const AgentVersion = "0.12.7"
+// 0.12.8：Agent Bearer Token 改为常量时间比较，避免认证路径上的长度/内容时序泄漏。
+const AgentVersion = "0.12.8"
 
 // Config 是 fonu-agent 的运行配置。agent 只在 VPS 本地管理自己的 Nginx 片段、证书和 frps 配置。
 type Config struct {
@@ -206,7 +208,8 @@ func (s *Server) ListenAndServe(ctx context.Context) error {
 
 func (s *Server) auth(next http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		if r.Header.Get("Authorization") != "Bearer "+s.cfg.Token {
+		token := bearerToken(r)
+		if token == "" || !secureTokenEqual(token, s.cfg.Token) {
 			writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "unauthorized"})
 			return
 		}
@@ -214,6 +217,21 @@ func (s *Server) auth(next http.HandlerFunc) http.HandlerFunc {
 	}
 }
 
+// bearerToken 解析 Authorization: Bearer <token>；格式不符时返回空串。
+func bearerToken(r *http.Request) string {
+	header := strings.TrimSpace(r.Header.Get("Authorization"))
+	const prefix = "Bearer "
+	if len(header) <= len(prefix) || !strings.EqualFold(header[:len(prefix)], prefix) {
+		return ""
+	}
+	return strings.TrimSpace(header[len(prefix):])
+}
+
+// secureTokenEqual 使用常量时间比较，避免通过响应时间推测 Token 内容。
+func secureTokenEqual(got, want string) bool {
+	return subtle.ConstantTimeCompare([]byte(got), []byte(want)) == 1
+}
+
 func (s *Server) ping(w http.ResponseWriter, _ *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]any{"ok": true, "service": "fonu-agent"})
 }