lin_hl
2 weeks ago
commit
256ab3ebb5
3 changed files with 313 additions and 0 deletions
@ -0,0 +1,8 @@ |
|||||
|
module memobus_relay_server |
||||
|
|
||||
|
go 1.24 |
||||
|
|
||||
|
require ( |
||||
|
github.com/golang-jwt/jwt/v5 v5.3.0 |
||||
|
github.com/hashicorp/yamux v0.1.2 |
||||
|
) |
||||
@ -0,0 +1,290 @@ |
|||||
|
// 文件名: main.go (服务端)
|
||||
|
package main |
||||
|
|
||||
|
import ( |
||||
|
"context" |
||||
|
"encoding/json" |
||||
|
"errors" |
||||
|
"fmt" |
||||
|
"log" |
||||
|
"net" |
||||
|
"net/http" |
||||
|
"net/http/httputil" |
||||
|
"os" |
||||
|
"strings" |
||||
|
"sync" |
||||
|
"time" |
||||
|
|
||||
|
"github.com/golang-jwt/jwt/v5" |
||||
|
"github.com/hashicorp/yamux" |
||||
|
) |
||||
|
|
||||
|
// ==============================================================================
|
||||
|
// 1. 密钥配置
|
||||
|
// ==============================================================================
|
||||
|
var ( |
||||
|
// 用于验证 App 请求的密钥，必须和 ibserver 的 AppAccessSecret 一致
|
||||
|
appAccessSecret = []byte(os.Getenv("APP_ACCESS_SECRET")) |
||||
|
// 用于验证设备连接的密钥，必须和旧中继服务的 RelaySecret 一致
|
||||
|
deviceRelaySecret = []byte(os.Getenv("RELAY_SECRET")) |
||||
|
) |
||||
|
|
||||
|
// ==============================================================================
|
||||
|
// 2. 结构体定义
|
||||
|
// ==============================================================================
|
||||
|
type AuthPayload struct { |
||||
|
DeviceSN string `json:"device_sn"` |
||||
|
Token string `json:"token"` |
||||
|
} |
||||
|
|
||||
|
type DeviceJWTClaims struct { |
||||
|
DeviceSN string `json:"sn"` |
||||
|
UserID string `json:"userId"` |
||||
|
jwt.RegisteredClaims |
||||
|
} |
||||
|
|
||||
|
type SessionInfo struct { |
||||
|
Session *yamux.Session |
||||
|
UserID string |
||||
|
} |
||||
|
|
||||
|
var ( |
||||
|
deviceSessions = make(map[string]*SessionInfo) |
||||
|
sessionMutex = &sync.RWMutex{} |
||||
|
) |
||||
|
|
||||
|
// ==============================================================================
|
||||
|
// 3. Main & 服务器启动逻辑
|
||||
|
// ==============================================================================
|
||||
|
func main() { |
||||
|
if len(appAccessSecret) == 0 || len(deviceRelaySecret) == 0 { |
||||
|
log.Println("WARNING: APP_ACCESS_SECRET or RELAY_SECRET environment variable not set.") |
||||
|
} |
||||
|
go listenForDevices(":7002") |
||||
|
|
||||
|
log.Println("Starting App HTTP server on :8089") |
||||
|
http.HandleFunc("/tunnel/", handleAppRequest) // 统一入口
|
||||
|
if err := http.ListenAndServe(":8089", nil); err != nil { |
||||
|
log.Fatalf("Failed to start App server: %v", err) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
func listenForDevices(addr string) { |
||||
|
log.Printf("Listening for device connections on %s\n", addr) |
||||
|
listener, err := net.Listen("tcp", addr) |
||||
|
if err != nil { |
||||
|
log.Fatalf("Failed to listen for devices: %v", err) |
||||
|
} |
||||
|
defer listener.Close() |
||||
|
|
||||
|
for { |
||||
|
conn, err := listener.Accept() |
||||
|
if err != nil { |
||||
|
log.Printf("Failed to accept device connection: %v", err) |
||||
|
continue |
||||
|
} |
||||
|
go handleDeviceSession(conn) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// ==============================================================================
|
||||
|
// 4. 设备端认证与会话管理
|
||||
|
// ==============================================================================
|
||||
|
func handleDeviceSession(conn net.Conn) { |
||||
|
defer conn.Close() |
||||
|
log.Printf("New device connected from %s, awaiting authentication...\n", conn.RemoteAddr()) |
||||
|
|
||||
|
conn.SetReadDeadline(time.Now().Add(10 * time.Second)) |
||||
|
var auth AuthPayload |
||||
|
if err := json.NewDecoder(conn).Decode(&auth); err != nil { |
||||
|
log.Printf("Authentication failed (reading payload): %v", err) |
||||
|
return |
||||
|
} |
||||
|
conn.SetReadDeadline(time.Time{}) |
||||
|
|
||||
|
claims, err := validateDeviceToken(auth.Token) |
||||
|
if err != nil { |
||||
|
log.Printf("Authentication failed for SN %s (token validation): %v", auth.DeviceSN, err) |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
if claims.DeviceSN != auth.DeviceSN { |
||||
|
log.Printf("Authentication failed (SN mismatch: token SN '%s' vs payload SN '%s')", claims.DeviceSN, auth.DeviceSN) |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
deviceSN := claims.DeviceSN |
||||
|
userID := claims.UserID |
||||
|
log.Printf("Device '%s' (user: %s) authenticated successfully.\n", deviceSN, userID) |
||||
|
|
||||
|
config := yamux.DefaultConfig() |
||||
|
config.EnableKeepAlive = true |
||||
|
config.KeepAliveInterval = 30 * time.Second |
||||
|
|
||||
|
session, err := yamux.Server(conn, config) |
||||
|
if err != nil { |
||||
|
log.Printf("Failed to start yamux session for device '%s': %v", deviceSN, err) |
||||
|
return |
||||
|
} |
||||
|
defer session.Close() |
||||
|
|
||||
|
sessionInfo := &SessionInfo{Session: session, UserID: userID} |
||||
|
sessionMutex.Lock() |
||||
|
if oldInfo, exists := deviceSessions[deviceSN]; exists { |
||||
|
log.Printf("Device '%s' already connected, closing old session.", deviceSN) |
||||
|
oldInfo.Session.Close() |
||||
|
} |
||||
|
deviceSessions[deviceSN] = sessionInfo |
||||
|
sessionMutex.Unlock() |
||||
|
log.Printf("Yamux session started for device '%s'\n", deviceSN) |
||||
|
|
||||
|
defer func() { |
||||
|
sessionMutex.Lock() |
||||
|
if currentInfo, exists := deviceSessions[deviceSN]; exists && currentInfo.Session == session { |
||||
|
delete(deviceSessions, deviceSN) |
||||
|
} |
||||
|
sessionMutex.Unlock() |
||||
|
log.Printf("Device '%s' session closed\n", deviceSN) |
||||
|
}() |
||||
|
|
||||
|
<-session.CloseChan() |
||||
|
} |
||||
|
|
||||
|
func validateDeviceToken(tokenString string) (*DeviceJWTClaims, error) { |
||||
|
if len(deviceRelaySecret) == 0 { |
||||
|
return nil, errors.New("RELAY_SECRET is not configured on the server") |
||||
|
} |
||||
|
|
||||
|
claims := &DeviceJWTClaims{} |
||||
|
token, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) { |
||||
|
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok { |
||||
|
return nil, fmt.Errorf("unexpected signing method for device token") |
||||
|
} |
||||
|
return deviceRelaySecret, nil |
||||
|
}) |
||||
|
|
||||
|
if err != nil { |
||||
|
return nil, err |
||||
|
} |
||||
|
if !token.Valid { |
||||
|
return nil, errors.New("device token is invalid") |
||||
|
} |
||||
|
return claims, nil |
||||
|
} |
||||
|
|
||||
|
// ==============================================================================
|
||||
|
// 5. App 端认证与请求处理
|
||||
|
// ==============================================================================
|
||||
|
func handleAppRequest(w http.ResponseWriter, r *http.Request) { |
||||
|
pathParts := strings.SplitN(strings.TrimPrefix(r.URL.Path, "/"), "/", 3) |
||||
|
if len(pathParts) < 2 || pathParts[0] != "tunnel" { |
||||
|
http.Error(w, "Invalid path format. Use /tunnel/{deviceSN}/...", http.StatusBadRequest) |
||||
|
return |
||||
|
} |
||||
|
deviceSN := pathParts[1] |
||||
|
|
||||
|
// --- [App 认证逻辑 - 暂时注释，需要时取消注释即可] ---
|
||||
|
/* |
||||
|
appUserID, err := authenticateAppRequest(r) |
||||
|
if err != nil { |
||||
|
log.Printf("App authentication failed for device %s: %v", deviceSN, err) |
||||
|
http.Error(w, "Unauthorized", http.StatusUnauthorized) |
||||
|
return |
||||
|
} |
||||
|
*/ |
||||
|
|
||||
|
sessionMutex.RLock() |
||||
|
sessionInfo, ok := deviceSessions[deviceSN] |
||||
|
sessionMutex.RUnlock() |
||||
|
|
||||
|
if !ok || sessionInfo.Session.IsClosed() { |
||||
|
http.Error(w, fmt.Sprintf("Device '%s' is not connected", deviceSN), http.StatusBadGateway) |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
/* --- [所有权检查 - 暂时注释] --- |
||||
|
if sessionInfo.UserID != appUserID { |
||||
|
log.Printf("Forbidden: App user '%s' attempted to access device '%s' owned by '%s'", appUserID, deviceSN, sessionInfo.UserID) |
||||
|
http.Error(w, "Forbidden: you do not own this device", http.StatusForbidden) |
||||
|
return |
||||
|
} |
||||
|
*/ |
||||
|
|
||||
|
proxy := &httputil.ReverseProxy{ |
||||
|
Director: func(req *http.Request) { |
||||
|
// Director 负责重写请求
|
||||
|
if len(pathParts) > 2 { |
||||
|
req.URL.Path = "/" + pathParts[2] |
||||
|
req.URL.RawQuery = r.URL.RawQuery // 确保查询参数也被传递
|
||||
|
} else { |
||||
|
req.URL.Path = "/" |
||||
|
} |
||||
|
req.URL.Scheme = "http" |
||||
|
req.URL.Host = r.Host // 使用原始请求的 Host
|
||||
|
req.Header.Set("X-Real-IP", r.RemoteAddr) |
||||
|
}, |
||||
|
Transport: &http.Transport{ |
||||
|
DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) { |
||||
|
// 劫持连接创建，改为打开一个 yamux 流
|
||||
|
return sessionInfo.Session.Open() |
||||
|
}, |
||||
|
// 禁用 HTTP/2，因为它与我们的隧道不兼容
|
||||
|
ForceAttemptHTTP2: false, |
||||
|
}, |
||||
|
FlushInterval: -1, // 支持流式响应
|
||||
|
ModifyResponse: func(resp *http.Response) error { |
||||
|
// 告知下游代理不要缓冲
|
||||
|
resp.Header.Set("X-Accel-Buffering", "no") |
||||
|
return nil |
||||
|
}, |
||||
|
ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) { |
||||
|
log.Printf("Reverse proxy error for device %s: %v", deviceSN, err) |
||||
|
http.Error(w, "Error forwarding request", http.StatusBadGateway) |
||||
|
}, |
||||
|
} |
||||
|
|
||||
|
log.Printf("Forwarding request for device '%s' to path '%s'", deviceSN, r.URL.Path) |
||||
|
proxy.ServeHTTP(w, r) |
||||
|
} |
||||
|
|
||||
|
// authenticateAppRequest 和 verifyAppToken 保持不变，备用
|
||||
|
func authenticateAppRequest(r *http.Request) (string, error) { |
||||
|
authHeader := r.Header.Get("Authorization") |
||||
|
if authHeader == "" { |
||||
|
return "", errors.New("missing Authorization header") |
||||
|
} |
||||
|
tokenString := strings.TrimPrefix(authHeader, "Bearer ") |
||||
|
if tokenString == authHeader { |
||||
|
return "", errors.New("authorization header format must be Bearer {token}") |
||||
|
} |
||||
|
claims, err := verifyAppToken(tokenString) |
||||
|
if err != nil { |
||||
|
return "", fmt.Errorf("app token verification failed: %w", err) |
||||
|
} |
||||
|
if userID, ok := claims["user_id"].(string); ok { |
||||
|
return userID, nil |
||||
|
} |
||||
|
return "", errors.New("user_id not found in app token claims") |
||||
|
} |
||||
|
|
||||
|
func verifyAppToken(tokenString string) (jwt.MapClaims, error) { |
||||
|
if len(tokenString) == 0 { |
||||
|
return nil, errors.New("token can not be empty") |
||||
|
} |
||||
|
if len(appAccessSecret) == 0 { |
||||
|
return nil, errors.New("APP_ACCESS_SECRET is not configured") |
||||
|
} |
||||
|
token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) { |
||||
|
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok { |
||||
|
return nil, fmt.Errorf("unexpected signing method for app token") |
||||
|
} |
||||
|
return appAccessSecret, nil |
||||
|
}) |
||||
|
if err != nil { |
||||
|
return nil, err |
||||
|
} |
||||
|
if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid { |
||||
|
return claims, nil |
||||
|
} |
||||
|
return nil, errors.New("invalid app token") |
||||
|
} |
||||
@ -0,0 +1,15 @@ |
|||||
|
GOCMD=go |
||||
|
GOBUILD=$(GOCMD) build |
||||
|
GOCLEAN=$(GOCMD) clean |
||||
|
GOTEST=$(GOCMD) test |
||||
|
GOGET=$(GOCMD) get |
||||
|
|
||||
|
BINARY_NAME=main |
||||
|
|
||||
|
all: test build |
||||
|
build: |
||||
|
@$(GOBUILD) -o $(BINARY_NAME) main.go |
||||
|
build-linux-amd64: |
||||
|
@GOOS=linux GOARCH=amd64 $(GOBUILD) -o $(BINARY_NAME) . |
||||
|
build-linux-riscv64: |
||||
|
@GOOS=linux GOARCH=riscv64 $(GOBUILD) -o $(BINARY_NAME) . |
||||
Loading…
Reference in new issue