mirror of
https://gitcode.com/JianFeeeee/ModelRouter.git
synced 2026-11-07 09:47:23 +00:00
7a8d97001c
问题：登录返回的 view_url 是 http://127.0.0.1:60100/vnc.html，WebUI 直接把它 嵌进 iframe。远程运维打开必白屏 —— 127.0.0.1 在客户端指向客户端自己，且 websockify/x11vnc 只绑回环，换服务器 IP 也连不上（实测 LAN IP 访问 000）。 ★ 教训：只验证"服务端截图有画面"就宣布 VNC 可用是不充分的。四层链路里 ①X 渲染 ②noVNC 客户端渲染 一直是好的，白屏真因在第④层「客户端如何拿到地址」。 内核新增通用「插件前缀代理」能力（不是为 channels 写的专用反向代理）： - plugin.http 支持 prefix = true：声明前缀路由，承接所有子路径 - handler 返回 { proxy = "http://127.0.0.1:PORT" }，内核每次请求都问一遍 ⇒ 会话停止/过期后插件不再给目标，旧地址自然失效（撤销点唯一） - 鉴权与角色门禁复用现有链路，无旁路 - statusRecorder 增加 Unwrap()，让 Hijack 穿透访问日志中间件（否则 WebSocket 升级失败） - 目标只允许带显式端口的**字面回环 IP**（用户拍板方案 A）：拒绝 https、localhost 主机名、无端口、带 userinfo/path/query；理由是主机名可能被 hosts/DNS 改写 - 拒绝跨站 Origin（WebSocket 带环境 Cookie，否则第三方网页可借管理员会话开隧道） - 不向插件后端转发 Authorization/Cookie/api_key channels 接入： - 新增 channels/browser/proxy/:session（prefix=true） - 会话代号 = seq-随机8位，防猜到活跃会话 - view_url 改为网关同源路径，noVNC 的 WebSocket 走同前缀 /websockify - 会话过期即回收浏览器栈并返回 404 判据（每条咬真实外部效应）： - 静态资源转发 - 真实 HTTP 101 升级 + 双向数据回传（只断言静态转发不够 —— 升级是白屏真考点） - 网关凭据不泄漏（在服务端断言请求头） - 非法目标全拒（公网/localhost/https/无端口/带 path、query、userinfo） - 跨站 Origin 403 - 未鉴权 401、过期会话 404、非子路径 404 回归：go test -tags luajit ./... 9 包全绿
67 lines
2.4 KiB
Go
67 lines
2.4 KiB
Go
package gateway
|
|
|
|
import (
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestPluginProxyRejectsUnsafeTargetsAndOrigin(t *testing.T) {
|
|
g, _ := gatewayWithSpy(t)
|
|
for _, target := range []string{"http://example.com:80", "http://localhost:80", "https://127.0.0.1:80", "http://127.0.0.1", "http://u:p@127.0.0.1:80", "http://127.0.0.1:80/path", "http://127.0.0.1:80/?x=1"} {
|
|
rr := httptest.NewRecorder()
|
|
g.servePluginProxy(rr, httptest.NewRequest("GET", "http://gateway/api/plugins/http/relay/s/live.js", nil), target, "/api/plugins/http/relay/s")
|
|
if rr.Code != 502 {
|
|
t.Errorf("unsafe target %q accepted: %d", target, rr.Code)
|
|
}
|
|
}
|
|
rr := httptest.NewRecorder()
|
|
req := httptest.NewRequest("GET", "http://gateway/api/plugins/http/relay/s/websockify", nil)
|
|
req.Header.Set("Origin", "https://evil.example")
|
|
g.servePluginProxy(rr, req, "http://127.0.0.1:12345", "/api/plugins/http/relay/s")
|
|
if rr.Code != 403 {
|
|
t.Fatalf("foreign origin accepted: %d", rr.Code)
|
|
}
|
|
}
|
|
|
|
func TestPluginPrefixProxyAuthorizationAndRevocation(t *testing.T) {
|
|
backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { t.Error("denied request reached backend") }))
|
|
defer backend.Close()
|
|
g, _ := gatewayWithSpy(t)
|
|
src := `local p={name="relaydeny",http={{path="relaydeny/:session",prefix=true,roles={"admin"},handler="proxy"}}}
|
|
function p.proxy(req) return {status=404,body="expired session"} end
|
|
return p`
|
|
if err := g.core.Plugins().LoadSource("relaydeny", src); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
server := httptest.NewServer(g.Handler())
|
|
defer server.Close()
|
|
for _, tc := range []struct {
|
|
path, key string
|
|
status int
|
|
}{
|
|
{"/api/plugins/http/relaydeny/expired/vnc.html", "", 401},
|
|
{"/api/plugins/http/relaydeny/expired/vnc.html", "sk-test", 404},
|
|
{"/api/plugins/http/relaydeny-not-a-child/expired/vnc.html", "sk-test", 404},
|
|
} {
|
|
req, _ := http.NewRequest("GET", server.URL+tc.path, nil)
|
|
if tc.key != "" {
|
|
req.Header.Set("Authorization", "Bearer "+tc.key)
|
|
}
|
|
resp, err := http.DefaultClient.Do(req)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
b, _ := io.ReadAll(resp.Body)
|
|
resp.Body.Close()
|
|
if resp.StatusCode != tc.status {
|
|
t.Fatalf("%s got %d %s", tc.path, resp.StatusCode, b)
|
|
}
|
|
if tc.key != "" && strings.Contains(tc.path, "/expired/") && strings.Contains(tc.path, "/relaydeny/") && string(b) != "expired session" {
|
|
t.Fatalf("revocation response=%s", b)
|
|
}
|
|
}
|
|
}
|