7c0f8cf4d8
Fix TLS handshake: add X.509 keyUsage/EKU extensions to all certs
...
OpenVPN 2.7 + OpenSSL 3.6 strictly checks keyUsage extension.
Client log showed: 'Certificate does not have key usage extension'
→ 'VERIFY KU ERROR' → 'TLS handshake failed'.
Root cause: all certs generated via bare 'openssl req/x509 -req'
without any -extensions/-extfile, so no X.509 v3 extensions at all.
Fix: generate per-cert openssl ext config files:
CA cert (EnsureCA):
basicConstraints = critical,CA:TRUE
keyUsage = critical,keyCertSign,cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
Server cert (IssueCert, clientName=='server'):
basicConstraints = critical,CA:FALSE
keyUsage = critical,digitalSignature,keyEncipherment
extendedKeyUsage = serverAuth
Client cert (IssueCert, otherwise):
basicConstraints = critical,CA:FALSE
keyUsage = critical,digitalSignature,keyEncipherment
extendedKeyUsage = clientAuth
Also fix while here:
- .ovpn remote host: strip port from HTTP Host header with
net.SplitHostPort; prefer ?host= query param from frontend
- Replace deprecated 'persist-key' (OpenVPN 2.7 warns) with just
'persist-tun' in both server.conf and client .ovpn
- Replace 'cipher X' with 'data-ciphers X:AES-128-GCM' (OpenVPN 2.5+
negotiation) in server.conf and client .ovpn
Verified: CA/Server/Client certs all show correct keyUsage + EKU via
openssl x509 -text; .ovpn remote shows correct host:port.
2026-08-09 22:39:51 +08:00
ae02b60d67
Fix OpenVPN start: CIDR→netmask, dhcp-option DNS, ccd dir, dh none ECDHE
...
Four bugs prevented OpenVPN from actually listening on its UDP port:
1. server.conf line 'server 10.8.0.0/24' — OpenVPN 2.5 rejects CIDR.
Fix: cidrToServerDirective() converts CIDR to 'NETWORK NETMASK'
(e.g. '10.8.0.0 255.255.255.0') using net.ParseCIDR.
2. push_dns '1.1.1.1 8.8.8.8' was emitted as a single push directive
instead of multiple 'push dhcp-option DNS x' lines.
Fix: split space-separated IPs into individual push directives;
pass through if already 'dhcp-option ...' form.
3. client-config-dir referenced a ccd/ directory that was never created.
Fix: CreateInstance now MkdirAll(ccd); WriteServerConf also
defensively MkdirAll(extraDir) before writing the directive.
4. dh.pem generated with 1024-bit DH params → OpenSSL 3.0 refuses
with 'dh key too small'. Fix: use 'dh none' in server.conf so
OpenVPN 2.4+ uses ECDHE key exchange — no DH params needed at all.
Removed the slow openssl dhparam generation from EnsureCA.
Verified: instance starts, OpenVPN parses config successfully,
now fails only at TUNSETIFF (expected: requires root/CAP_NET_ADMIN).
2026-08-09 22:17:29 +08:00
09f6918aeb
Add multi-admin account management
...
Schema:
- New AdminUser model with bcrypt-hashed password (cost 10)
- Roles: admin (full) / operator (read-only ops)
- Status: active / disabled
- MustChangePassword flag forces first-login password change
Backend:
- store: Add admins [] + CRUD methods (ListAdmins strips PasswordHash)
- service: SeedDefaultAdminIfEmpty (uses env credentials on first run),
CreateAdmin, ChangePassword, ResetPassword, SetAdminStatus, DeleteAdmin
- middleware: JWT now carries user_id (UUID)
- api: login() uses bcrypt + updates last_login_at/ip, blocks disabled
- api: me() returns role + must_change_password
- api: new endpoints:
POST /api/me/password (self password change)
GET /api/admins
POST /api/admins (create)
POST /api/admins/:id/password (reset by admin)
POST /api/admins/:id/status (enable/disable)
DELETE /api/admins/:id (with self/last-admin guard)
Frontend:
- Login: must_change_password=true triggers forced change-password dialog
- Layout: admin dropdown shows role tag + 修改密码 / 退出登录
- New /admins page (admin only) with table + create/reset/status/delete
- Router guard hides /admins from non-admin accounts
- API client: Auth.changePassword, Admins.{list,create,resetPassword,setStatus,delete}
Security:
- PasswordHash stored as bcrypt $2a$10$... in db.json
- ListAdmins always returns PasswordHash=''; never leaks via API
- Login returns 403 for disabled accounts
Verified: 21/21 API tests + browser E2E (first-login forced change,
restart persistence, admin list without hash, role-based menu)
2026-08-09 21:45:41 +08:00
4c8b7b5188
Add per-instance/user access whitelist
...
Features:
- New Instance.AccessMode: "open" (default) or "whitelist"
- New Instance.AllowNetworks + VPNUser.AllowNetworks: list of CIDRs
- Effective whitelist = instance allow_networks ∪ user allow_networks (dedup)
- Auto-generates client-connect.sh / client-disconnect.sh for OpenVPN:
* Reads ccd/<cn> to extract CIDRs
* Pushes "route <ip> <mask>" to client (client side)
* Inserts iptables ACCEPT rules in FORWARD chain (server side, defense in depth)
* Cleans up rules on disconnect
- server.conf auto-includes client-connect / client-disconnect directives
and push "redirect-gateway def1 bypass-dhcp" in whitelist mode
- ccd/<cn> file format: first line ifconfig-push (static IP), then one CIDR per line
- Editing instance allow_networks refreshes all users' ccd automatically
- New PUT /api/instances/:id/users/:uid endpoint
- CIDR format validation; reject malformed inputs with friendly errors
- Dashboard shows whitelist_instances count and per-instance allow_networks table
Docs:
- README: new section "三、访问控制(白名单模式)" with usage, validation, pitfalls
- docs/API.md: updated Instance / VPNUser model + create/update payloads
- Renumbered client usage section as 四
2026-08-09 20:47:21 +08:00
77f8b59290
Initial commit: OpenVPN Manager v1.0
...
OpenVPN Web management console with multi-instance support, client cert
issuance, traffic/connection auditing, certificate expiry reminders,
auto backup/restore.
Stack:
- Backend: Go 1.21+ (Gin + JWT)
- Frontend: Vue 3 + Element Plus + ECharts + Vite
- Storage: JSON file (db.json) + filesystem (pki/, instances/, clients/, backups/)
Features:
- Multi-instance OpenVPN management (independent port/proto/subnet/PKI)
- One-click client certificate issuance with .ovpn (embedded certs)
- Certificate expiry reminders (30-day threshold)
- Connection log parsing (status-version 3)
- Auto backup/restore (tar.gz)
- Audit log for all write operations
- JWT auth (12h TTL)
- One-line install.sh for Ubuntu/Debian/RHEL/Fedora
2026-08-09 20:32:37 +08:00
cnbugs