proxy/server/fwd/fwd.go

package fwd

import (
	"bufio"
	"context"
	"encoding/binary"
	"io"
	"log/slog"
	"net"
	"proxy-server/pkg/utils"
	"proxy-server/server/fwd/socks"
	"proxy-server/server/pkg/env"
	"proxy-server/server/pkg/orm"
	"proxy-server/server/web/app/models"
	"slices"
	"strconv"
	"time"

	"github.com/pkg/errors"
)

type Config struct {
}

type Service struct {
	Config     *Config
	connMap    map[string]socks.ProxyConn
	ctrlConnWg utils.CountWaitGroup
	dataConnWg utils.CountWaitGroup
}

func New(config *Config) *Service {
	if config == nil {
		config = &Config{}
	}

	return &Service{
		Config:     config,
		connMap:    make(map[string]socks.ProxyConn),
		ctrlConnWg: utils.CountWaitGroup{},
		dataConnWg: utils.CountWaitGroup{},
	}
}

func (s *Service) Run(ctx context.Context) {
	slog.Info("启动 fwd 服务")

	// 启动工作协程
	subCtx, cancel := context.WithCancel(ctx)
	defer cancel()

	goNum := 2
	subErrCh := make(chan error, goNum)
	defer close(subErrCh)

	go s.startCtrlTun(subCtx)
	go s.startDataTun(subCtx, subErrCh)

	// 等待结束
	var firstSubErr error = nil
	for i := 0; i < goNum; i++ {
		err := <-subErrCh
		if err != nil {
			slog.Error("隧道错误关闭", "err", err)
			if firstSubErr == nil {
				firstSubErr = err
				cancel()
			}
		} else {
			slog.Info("隧道关闭")
		}
	}

	slog.Info("fwd 服务已结束")
}

func (s *Service) Close() {

}

func (s *Service) startCtrlTun(ctx context.Context) error {
	ctrlPort := env.AppCtrlPort
	slog.Debug("监听控制通道", slog.Uint64("port", uint64(ctrlPort)))

	// 监听端口
	ls, err := net.Listen("tcp", ":"+strconv.Itoa(int(ctrlPort)))
	if err != nil {
		return errors.Wrap(err, "监听控制通道失败")
	}
	defer utils.Close(ls)

	// 等待连接
	connCh := utils.ChanConnAccept(ctx, ls)
	defer close(connCh)

	// 处理连接
	for loop := true; loop; {
		select {
		case <-ctx.Done():
			slog.Debug("结束处理连接，由于上下文取消")
			loop = false
		case conn, ok := <-connCh:
			if !ok {
				slog.Debug("结束处理连接，由于获取连接失败")
				loop = false
			}
			s.ctrlConnWg.Add(1)
			go func() {
				defer s.ctrlConnWg.Done()
				defer utils.Close(conn)
				s.processCtrlConn(conn)
			}()
		}
	}

	// 等待子协程结束 todo 可配置等待时间
	s.Close()

	timeout, cancel := context.WithTimeout(context.Background(), 5*time.Second)
	defer cancel()
	procCh := utils.ChanWgWait(timeout, &s.ctrlConnWg)
	defer close(procCh)

	select {
	case <-timeout.Done():
		slog.Warn("等待控制通道子协程结束超时")
	case <-procCh:
		slog.Info("控制通道子协程结束")
	}

	slog.Debug("关闭控制通道")
	return nil
}

func (s *Service) processCtrlConn(controller net.Conn) {
	slog.Info("收到客户端控制通道连接", "addr", controller.RemoteAddr().String())

	reader := bufio.NewReader(controller)

	// 读取端口
	portBuf, err := utils.ReadBuffer(reader, 2)
	if err != nil {
		slog.Error("接收转发端口失败", "err", err)
		return
	}
	port := binary.BigEndian.Uint16(portBuf)

	// 新建代理服务
	slog.Info("新建代理服务", "port", port)
	proxy, err := socks.New(&socks.Config{
		Name: strconv.Itoa(int(port)),
		Port: port,
		AuthMethods: []socks.Authenticator{
			&UserPassAuthenticator{},
			&NoAuthAuthenticator{},
		},
	})
	defer proxy.Close()
	if err != nil {
		slog.Error("代理服务创建失败", "err", err)
		return
	}
	go func() {
		err := proxy.Run()
		if err != nil {
			slog.Error("代理服务启动失败", "err", err)
			return
		}
	}()

	// 等待用户连接
	for {
		user := <-proxy.Conn
		tag := user.Tag()
		tagBuf := make([]byte, len(tag)+1)
		tagBuf[0] = byte(len(tag))
		copy(tagBuf[1:], tag)
		_, err := controller.Write(tagBuf)
		if err != nil {
			slog.Error("写入 tag 失败", "err", err)
			utils.Close(user)
			return
		}
		s.connMap[tag] = user
	}
}

func (s *Service) startDataTun(ctx context.Context, errCh chan error) {
	dataPort := env.AppDataPort
	slog.Debug("监听数据通道", slog.Uint64("port", uint64(dataPort)))

	// 监听端口
	lData, err := net.Listen("tcp", ":"+strconv.Itoa(int(dataPort)))
	if err != nil {
		slog.Error("listen error", "err", err)
		return
	}
	defer utils.Close(lData)

	// 等待连接
	connCh := utils.ChanConnAccept(ctx, lData)
	defer close(connCh)

	// 处理连接
loop:
	for {
		select {
		case <-ctx.Done():
			slog.Debug("结束处理连接，由于上下文取消")
			break loop
		case conn, ok := <-connCh:
			if !ok {
				slog.Debug("结束处理连接，由于获取连接失败")
				break loop
			}
			s.dataConnWg.Add(1)
			go func() {
				defer s.dataConnWg.Done()
				defer utils.Close(conn)
				s.processDataConn(conn)
			}()
		}
	}

	// 等待子协程结束 todo 可配置等待时间
	timeout, cancel := context.WithTimeout(context.Background(), 5*time.Second)
	defer cancel()

	procCh := utils.ChanWgWait(timeout, &s.dataConnWg)
	defer close(procCh)

	select {
	case <-timeout.Done():
		slog.Warn("等待数据通道子协程结束超时")
	case <-procCh:
		slog.Info("数据通道子协程结束")
	}

	slog.Debug("关闭数据通道")
	errCh <- nil
}

func (s *Service) processDataConn(client net.Conn) {
	slog.Info("已建立客户端数据通道 " + client.RemoteAddr().String())

	// 读取 tag
	tagLen, err := utils.ReadByte(client)
	if err != nil {
		slog.Error("read error", "err", err)
		return
	}
	tagBuf, err := utils.ReadBuffer(client, int(tagLen))
	if err != nil {
		slog.Error("read error", "err", err)
		return
	}
	tag := string(tagBuf)

	// 找到用户连接
	data, ok := s.connMap[tag]
	if !ok {
		slog.Error("no such connection")
		return
	}

	// 响应用户
	user := data.Conn
	defer utils.Close(user)
	socks.SendSuccess(user, client)

	// 写入目标地址
	destBuf := slices.Insert([]byte(data.Dest), 0, byte(len(data.Dest)))
	_, err = client.Write(destBuf)
	if err != nil {
		slog.Error("发送目标地址失败", "err", err)
		return
	}

	// 数据转发
	slog.Info("开始数据转发 " + client.RemoteAddr().String() + " <-> " + data.Dest)

	// userPipeReader, userPipeWriter := io.Pipe()
	// defer utils.Close(userPipeWriter)
	// teeUser := io.TeeReader(user, userPipeWriter)

	errCh := make(chan error)
	go func() {
		_, err := io.Copy(client, user)
		if err != nil {
			slog.Error("processDataConn error u2c", "err", err)
		}
		errCh <- err
	}()
	// go analysis(userPipeReader)

	go func() {
		_, err := io.Copy(user, client)
		if err != nil {
			slog.Error("processDataConn error c2u", "err", err)
		}
		errCh <- err
	}()

	<-errCh
	slog.Info("数据转发结束 " + client.RemoteAddr().String() + " <-> " + data.Dest)
}

type NoAuthAuthenticator struct {
}

func (a *NoAuthAuthenticator) Method() socks.AuthMethod {
	return socks.NoAuth
}

func (a *NoAuthAuthenticator) Authenticate(ctx context.Context, reader io.Reader, writer io.Writer) (*socks.Authentication, error) {

	// 获取用户地址
	conn, ok := writer.(net.Conn)
	if !ok {
		return nil, errors.New("noAuth 认证失败，无法获取连接信息")
	}
	addr := conn.RemoteAddr().String()
	client, _, err := net.SplitHostPort(addr)
	if err != nil {
		return nil, errors.Wrap(err, "noAuth 认证失败")
	}
	slog.Debug("用户的地址为 " + client)

	// 获取服务
	server, ok := ctx.Value("service").(*socks.Server)
	if !ok {
		return nil, errors.New("noAuth 认证失败，无法获取服务信息")
	}
	node := server.Name
	slog.Debug("服务的名称为 " + server.Name)

	// 查询权限记录
	slog.Info(" 客户端 " + client + " 请求连接到 " + node)
	var channels []models.Channel
	err = orm.DB.
		Joins("INNER JOIN public.nodes n ON channels.node_id = n.id AND n.name = ?", node).
		Joins("INNER JOIN public.users u ON channels.user_id = u.id").
		Joins("INNER JOIN public.user_ips ip ON u.id = ip.user_id AND ip.ip_address = ?", client).
		Where(&models.Channel{
			AuthIp: true,
		}).
		Find(&channels).Error
	if err != nil {
		return nil, errors.New("noAuth 查询用户权限失败")
	}

	// 记录应该只有一条
	channel, err := orm.MaySingle(channels)
	if err != nil {
		return nil, errors.Wrap(err, "noAuth 没有权限")
	}

	// 检查是否需要密码认证
	if channel.AuthPass {
		return nil, errors.New("noAuth 没有权限，需要密码认证")
	}

	// 检查权限是否过期
	timeout := channel.Expiration.Sub(time.Now()).Seconds()
	slog.Info("用户剩余时间", "timeout", timeout)
	if timeout <= 0 {
		return nil, errors.New("noAuth 权限已过期")
	}
	slog.Debug("权限剩余时间", slog.Uint64("timeout", uint64(timeout)))

	return &socks.Authentication{
		Method:  socks.NoAuth,
		Timeout: uint(timeout),
		Payload: socks.Payload{
			ID: channel.UserId,
		},
	}, nil
}

type UserPassAuthenticator struct {
}

func (a *UserPassAuthenticator) Method() socks.AuthMethod {
	return socks.UserPassAuth
}

func (a *UserPassAuthenticator) Authenticate(ctx context.Context, reader io.Reader, writer io.Writer) (*socks.Authentication, error) {

	// 检查认证版本
	slog.Debug("验证认证版本")
	v, err := utils.ReadByte(reader)
	if err != nil {
		return nil, errors.Wrap(err, "读取版本号失败")
	}
	if v != socks.AuthVersion {
		_, err := writer.Write([]byte{socks.Version, socks.AuthFailure})
		if err != nil {
			return nil, errors.Wrap(err, "响应认证失败")
		}
		return nil, errors.New("认证版本参数不正确")
	}

	// 读取账号
	slog.Debug("验证用户账号")
	uLen, err := utils.ReadByte(reader)
	if err != nil {
		return nil, errors.Wrap(err, "读取用户名长度失败")
	}
	usernameBuf, err := utils.ReadBuffer(reader, int(uLen))
	if err != nil {
		return nil, errors.Wrap(err, "读取用户名失败")
	}
	username := string(usernameBuf)

	// 读取密码
	pLen, err := utils.ReadByte(reader)
	if err != nil {
		return nil, errors.Wrap(err, "读取密码长度失败")
	}
	passwordBuf, err := utils.ReadBuffer(reader, int(pLen))
	if err != nil {
		return nil, errors.Wrap(err, "读取密码失败")
	}
	password := string(passwordBuf)

	// 查询通道配置
	var channel models.Channel
	err = orm.DB.
		Where(&models.Channel{
			Username: username,
			AuthPass: true,
		}).
		First(&channel).Error
	if err != nil {
		return nil, errors.Wrap(err, "查询用户失败")
	}

	// 检查密码 todo 哈希
	if channel.Password != password {
		return nil, errors.New("密码错误")
	}

	// 检查权限是否过期
	timeout := channel.Expiration.Sub(time.Now()).Seconds()
	slog.Info("用户剩余时间", "timeout", timeout)
	if timeout <= 0 {
		return nil, errors.New("权限已过期")
	}

	// 如果用户设置了双验证则检查 ip 是否在白名单中
	if channel.AuthIp {
		slog.Debug("验证用户 ip")

		// 获取用户地址
		conn, ok := writer.(net.Conn)
		if !ok {
			return nil, errors.New("无法获取连接信息")
		}
		addr := conn.RemoteAddr().String()
		client, _, err := net.SplitHostPort(addr)
		if err != nil {
			return nil, errors.Wrap(err, "无法获取连接信息")
		}

		// 查询通道配置
		var ips []models.UserIp
		err = orm.DB.
			Where(&models.UserIp{
				UserId:    channel.UserId,
				IpAddress: client,
			}).
			Find(&ips).Error
		if err != nil {
			return nil, errors.Wrap(err, "查询用户 ip 失败")
		}

		// 检查是否在白名单中
		if len(ips) == 0 {
			return nil, errors.New("没有权限")
		}
	}

	// 响应认证成功
	_, err = writer.Write([]byte{socks.AuthVersion, socks.AuthSuccess})
	if err != nil {
		slog.Error("响应认证失败", "err", err)
		return nil, err
	}

	return &socks.Authentication{
		Method:  socks.UserPassAuth,
		Timeout: uint(timeout),
		Payload: socks.Payload{
			ID: channel.UserId,
		},
	}, nil
}