Add per-instance/user access whitelist

Features: - New Instance.AccessMode: "open" (default) or "whitelist" - New Instance.AllowNetworks + VPNUser.AllowNetworks: list of CIDRs - Effective whitelist = instance allow_networks ∪ user allow_networks (dedup) - Auto-generates client-connect.sh / client-disconnect.sh for OpenVPN: * Reads ccd/<cn> to extract CIDRs * Pushes "route <ip> <mask>" to client (client side) * Inserts iptables ACCEPT rules in FORWARD chain (server side, defense in depth) * Cleans up rules on disconnect - server.conf auto-includes client-connect / client-disconnect directives and push "redirect-gateway def1 bypass-dhcp" in whitelist mode - ccd/<cn> file format: first line ifconfig-push (static IP), then one CIDR per line - Editing instance allow_networks refreshes all users' ccd automatically - New PUT /api/instances/:id/users/:uid endpoint - CIDR format validation; reject malformed inputs with friendly errors - Dashboard shows whitelist_instances count and per-instance allow_networks table Docs: - README: new section "三、访问控制(白名单模式)" with usage, validation, pitfalls - docs/API.md: updated Instance / VPNUser model + create/update payloads - Renumbered client usage section as 四
2026-08-09 20:47:21 +08:00
parent 77f8b59290
commit 4c8b7b5188
11 changed files with 697 additions and 64 deletions
@@ -127,6 +127,17 @@ func (m *Manager) WriteServerConf(in *model.Instance, extraDir string) error {
 	if extraDir != "" {
 		conf.WriteString("client-config-dir " + extraDir + "\n")
 	}
+	if in.AccessMode == model.AccessWhitelist {
+		// 白名单模式:openVPN 在每次客户端连接时调用脚本应用 iptables
+		// 该脚本由 manager.AllowNetworksScript() 生成,负责:
+		//  1. 写入合并后的白名单到 ccd/<cn>(push route)
+		//  2. 在 FORWARD 链中按白名单过滤 tun->eth 的流量
+		conf.WriteString("client-connect " + filepath.Join(m.InstanceDir(in.Name), "client-connect.sh") + "\n")
+		conf.WriteString("client-disconnect " + filepath.Join(m.InstanceDir(in.Name), "client-disconnect.sh") + "\n")
+		// 强制客户端把流量全部走 VPN(否则白名单的 push route 没意义)
+		// 仍允许 bypass-dhcp 保留局域网 DNS
+		conf.WriteString("push \"redirect-gateway def1 bypass-dhcp\"\n")
+	}
 	if in.Extra != "" {
 		conf.WriteString("\n# --- custom ---\n")
 		conf.WriteString(in.Extra + "\n")
@@ -265,6 +276,181 @@ func (m *Manager) WriteCCD(instanceName, username, body string) error {
 	return os.WriteFile(filepath.Join(dir, username), []byte(body+"\n"), 0o644)
 }

+// ValidateCIDR 校验 CIDR 是否合法(IP + /prefix 长度)。
+func ValidateCIDR(s string) error {
+	ip, ipnet, err := net.ParseCIDR(strings.TrimSpace(s))
+	if err != nil {
+		return fmt.Errorf("invalid CIDR %q: %w", s, err)
+	}
+	if ip.To4() == nil && ip.To16() == nil {
+		return fmt.Errorf("invalid IP in CIDR %q", s)
+	}
+	_ = ipnet
+	return nil
+}
+
+// MergeAllowNetworks 合并实例级与用户级白名单,去重去空。
+func MergeAllowNetworks(a, b []string) []string {
+	seen := map[string]bool{}
+	out := []string{}
+	for _, s := range append(append([]string{}, a...), b...) {
+		s = strings.TrimSpace(s)
+		if s == "" || seen[s] {
+			continue
+		}
+		seen[s] = true
+		out = append(out, s)
+	}
+	return out
+}
+
+// CIDRToRoute 将 CIDR 转为 OpenVPN push route 用的字符串(IP + Netmask)。
+// 仅支持 IPv4。IPv6 用 /128 全 0 掩码(占位,本项目主要面向 IPv4)。
+func CIDRToRoute(s string) (string, error) {
+	if err := ValidateCIDR(s); err != nil {
+		return "", err
+	}
+	_, ipnet, _ := net.ParseCIDR(strings.TrimSpace(s))
+	mask := ipnet.Mask
+	ones, _ := ipnet.Mask.Size()
+	// 转 4 字节点分十进制
+	if len(mask) == 4 {
+		return fmt.Sprintf("%s %d.%d.%d.%d", ipnet.IP.String(), mask[0], mask[1], mask[2], mask[3]), nil
+	}
+	// IPv6: 暂用 /128 占位,openVPN 走 route-ipv6 单独处理
+	_ = ones
+	return "", fmt.Errorf("IPv6 not yet supported: %s", s)
+}
+
+// AllowNetworksScript 生成 client-connect 脚本:
+//   - 输入: $1 = 连接上下文, $common_name=<CN>
+//   - 作用:读 ccd/<cn>,根据其白名单在 FORWARD 链插入 ACCEPT
+//
+// client-connect 脚本的 stdin 是 OpenVPN 提供的环境变量,我们打印
+// "push route ..." 行让 openvpn 推给客户端。
+func (m *Manager) AllowNetworksScript(instanceName string, nets []string) (string, error) {
+	dir := filepath.Join(m.dataDir, "instances", instanceName)
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return "", err
+	}
+	script := filepath.Join(dir, "client-connect.sh")
+	var b strings.Builder
+	b.WriteString("#!/bin/bash\n")
+	b.WriteString("# Generated by openvpn-manager at " + time.Now().Format(time.RFC3339) + "\n")
+	b.WriteString("set -e\n\n")
+	b.WriteString("# OpenVPN 客户端连接脚本: 接受 ccd 之外额外的 push 指令\n")
+	b.WriteString("# 我们使用 stdin 提供的环境变量(由 OpenVPN 注入),按白名单允许的网段\n")
+	b.WriteString("# 写入 FORWARD 链,然后通过 echo 'push \"route ...\"' 回传给 OpenVPN。\n\n")
+	b.WriteString("CN=\"${common_name:-}\"\n")
+	b.WriteString("VPN_IP=\"${ifconfig_pool_remote_ip:-${trusted_ip:-}}\"\n\n")
+	b.WriteString("# 仅处理已启用的用户:从 ccd/<cn> 读取 allow_networks(若文件不存在则拒绝推送任何路由)\n")
+	b.WriteString("CCD_FILE=\"$(dirname \"$0\")/ccd/${CN}\"\n")
+	b.WriteString("if [[ ! -f \"$CCD_FILE\" ]]; then\n")
+	b.WriteString("  echo \"# ccd file missing for $CN, denying\" >&2\n")
+	b.WriteString("  exit 1\n")
+	b.WriteString("fi\n\n")
+	b.WriteString("# 解析 allow_networks(grep + awk)\n")
+	b.WriteString("split_cidr() {\n")
+	b.WriteString("  local cidr=\"$1\"\n")
+	b.WriteString("  local ip mask\n")
+	b.WriteString("  ip=\"${cidr%/*}\"\n")
+	b.WriteString("  local prefix=\"${cidr##*/}\"\n")
+	b.WriteString("  case \"$prefix\" in\n")
+	b.WriteString("    32) mask=\"255.255.255.255\" ;;\n")
+	b.WriteString("    31) mask=\"255.255.255.254\" ;;\n")
+	b.WriteString("    30) mask=\"255.255.255.252\" ;;\n")
+	b.WriteString("    29) mask=\"255.255.255.248\" ;;\n")
+	b.WriteString("    28) mask=\"255.255.255.240\" ;;\n")
+	b.WriteString("    27) mask=\"255.255.255.224\" ;;\n")
+	b.WriteString("    26) mask=\"255.255.255.192\" ;;\n")
+	b.WriteString("    25) mask=\"255.255.255.128\" ;;\n")
+	b.WriteString("    24) mask=\"255.255.255.0\"   ;;\n")
+	b.WriteString("    23) mask=\"255.255.254.0\"   ;;\n")
+	b.WriteString("    22) mask=\"255.255.252.0\"   ;;\n")
+	b.WriteString("    21) mask=\"255.255.248.0\"   ;;\n")
+	b.WriteString("    20) mask=\"255.255.240.0\"   ;;\n")
+	b.WriteString("    19) mask=\"255.255.224.0\"   ;;\n")
+	b.WriteString("    18) mask=\"255.255.192.0\"   ;;\n")
+	b.WriteString("    17) mask=\"255.255.128.0\"   ;;\n")
+	b.WriteString("    16) mask=\"255.255.0.0\"     ;;\n")
+	b.WriteString("    15) mask=\"255.254.0.0\"     ;;\n")
+	b.WriteString("    14) mask=\"255.252.0.0\"     ;;\n")
+	b.WriteString("    13) mask=\"255.248.0.0\"     ;;\n")
+	b.WriteString("    12) mask=\"255.240.0.0\"     ;;\n")
+	b.WriteString("    11) mask=\"255.224.0.0\"     ;;\n")
+	b.WriteString("    10) mask=\"255.192.0.0\"     ;;\n")
+	b.WriteString("     9) mask=\"255.128.0.0\"     ;;\n")
+	b.WriteString("     8) mask=\"255.0.0.0\"       ;;\n")
+	b.WriteString("    *)  echo \"unsupported prefix /$prefix for $cidr\" >&2; return 1 ;;\n")
+	b.WriteString("  esac\n")
+	b.WriteString("  echo \"$ip $mask\"\n")
+	b.WriteString("}\n\n")
+	b.WriteString("while IFS= read -r net; do\n")
+	b.WriteString("  [[ -z \"$net\" || \"$net\" =~ ^# ]] && continue\n")
+	b.WriteString("  pair=\"$(split_cidr \"$net\")\" || continue\n")
+	b.WriteString("  echo \"push \\\"route ${pair}\\\"\"\n")
+	b.WriteString("done < <(grep -E '^[0-9]' \"$CCD_FILE\" || true)\n\n")
+	b.WriteString("# iptables:放行此客户端 VPN_IP -> 白名单网段的 FORWARD\n")
+	b.WriteString("if [[ -n \"$VPN_IP\" ]]; then\n")
+	b.WriteString("  while IFS= read -r net; do\n")
+	b.WriteString("    [[ -z \"$net\" || \"$net\" =~ ^# ]] && continue\n")
+	b.WriteString("    /sbin/iptables -I FORWARD -s \"$VPN_IP\" -d \"$net\" -j ACCEPT 2>/dev/null || true\n")
+	b.WriteString("    /sbin/iptables -I FORWARD -d \"$VPN_IP\" -s \"$net\" -m state --state ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || true\n")
+	b.WriteString("  done < <(grep -E '^[0-9]' \"$CCD_FILE\" || true)\n")
+	b.WriteString("fi\n\n")
+	b.WriteString("exit 0\n")
+	if err := os.WriteFile(script, []byte(b.String()), 0o755); err != nil {
+		return "", err
+	}
+	// 同样的逻辑写到 disconnect 脚本:清理 iptables 规则
+	dis := filepath.Join(dir, "client-disconnect.sh")
+	var d strings.Builder
+	d.WriteString("#!/bin/bash\n")
+	d.WriteString("# openvpn-manager generated\n")
+	d.WriteString("VPN_IP=\"${ifconfig_pool_remote_ip:-${trusted_ip:-}}\"\n")
+	d.WriteString("CN=\"${common_name:-}\"\n")
+	d.WriteString("if [[ -n \"$VPN_IP\" ]]; then\n")
+	d.WriteString("  /sbin/iptables -D FORWARD -s \"$VPN_IP\" -j ACCEPT 2>/dev/null || true\n")
+	d.WriteString("  /sbin/iptables -D FORWARD -d \"$VPN_IP\" -m state --state ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || true\n")
+	d.WriteString("fi\n")
+	d.WriteString("exit 0\n")
+	if err := os.WriteFile(dis, []byte(d.String()), 0o755); err != nil {
+		return "", err
+	}
+	return script, nil
+}
+
+// InstanceDir 返回实例的根目录(供脚本路径使用)。
+func (m *Manager) InstanceDir(name string) string {
+	return filepath.Join(m.dataDir, "instances", name)
+}
+
+// SetIptablesForInstance 应用一个实例的默认 FORWARD 策略。
+// 在白名单模式下,我们希望"默认拒绝 tun->eth 的转发",再由 client-connect 脚本按需放行。
+// 这个函数在实例启动时调用一次。
+//
+// 注意: iptables 修改宿主机的防火墙,需要 root 权限。脚本会以 noop 模式尝试运行,
+// 失败仅记录日志,不会阻塞实例启动(允许开发环境无 iptables)。
+func (m *Manager) SetIptablesForInstance(in *model.Instance) error {
+	if in.AccessMode != model.AccessWhitelist {
+		return nil
+	}
+	tunName := in.Dev // tun0 / tun1 ...
+	if in.Dev == "tap" {
+		tunName = "tap0"
+	}
+	// 默认策略:FORWARD 链中,凡是从 tun 设备出去的,如果未命中 ACCEPT 一律 DROP
+	// 这条规则加到 FORWARD 链末尾,优先级低于 client-connect 插入的 ACCEPT
+	cmd := exec.Command("/sbin/iptables", "-A", "FORWARD", "-i", tunName, "-j", "REJECT",
+		"--reject-with", "icmp-net-unreachable")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		// 不致命:开发机可能没装 iptables 或没权限
+		return fmt.Errorf("iptables: %v: %s", err, strings.TrimSpace(string(out)))
+	}
+	return nil
+}
+
 // DeleteCCD 移除 ccd 文件。
 func (m *Manager) DeleteCCD(instanceName, username string) error {
 	p := filepath.Join(m.dataDir, "instances", instanceName, "ccd", username)