From 465648c5df196ae2fa6081ba02ecbec99187d3a5 Mon Sep 17 00:00:00 2001 From: alex Date: Mon, 6 Jul 2026 11:54:41 +0800 Subject: [PATCH] acl is enabled --- Cargo.lock | 2 +- Cargo.toml | 2 +- Makefile | 4 +- src/bin/punchnet/api/mod.rs | 115 +++++++++++++++++++----------------- src/bin/punchnet/main.rs | 91 ++++++++++++++++------------ src/utils/acl_session.rs | 1 - 6 files changed, 117 insertions(+), 98 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 726afbf..6e2dd34 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2343,7 +2343,7 @@ dependencies = [ [[package]] name = "punchnet" -version = "1.2.6" +version = "1.2.7" dependencies = [ "ahash", "arc-swap", diff --git a/Cargo.toml b/Cargo.toml index c555f35..45fa7a0 100755 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "punchnet" -version = "1.2.6" +version = "1.2.7" edition = "2021" license = "MIT" description = "punchnet client" diff --git a/Makefile b/Makefile index 9c6e454..7090e3d 100755 --- a/Makefile +++ b/Makefile @@ -35,7 +35,7 @@ libtun-musl: deb-musl: - cargo deb --target x86_64-unknown-linux-musl --deb-revision="2-static" + cargo deb --target x86_64-unknown-linux-musl --deb-revision="2-acl-static" deb: libtun-so RUSTFLAGS="-L ." cargo deb --deb-revision="1-dynamic" @@ -44,4 +44,4 @@ deb-aarch64-musl: libtun-aarch64-musl RUSTFLAGS="-L ." cargo deb --target aarch64-unknown-linux-musl --deb-revision="1-static" deb-aarch64: - cargo deb --target aarch64-unknown-linux-musl --deb-revision="2-static" + cargo deb --target aarch64-unknown-linux-musl --deb-revision="2-acl-static" diff --git a/src/bin/punchnet/api/mod.rs b/src/bin/punchnet/api/mod.rs index bf09db1..4f68fd8 100644 --- a/src/bin/punchnet/api/mod.rs +++ b/src/bin/punchnet/api/mod.rs @@ -1,12 +1,14 @@ use hmac::{Hmac, Mac as HamcMac}; -use punchnet::{CachedLoginInfo, ExitNodeConfiguration, TokenLogin, get_hostname, set_access_token}; +use md5::Md5; +use punchnet::{ + get_hostname, set_access_token, CachedLoginInfo, ExitNodeConfiguration, TokenLogin, +}; use reqwest::Client; use sdlan_sn_rs::utils::{Mac, Result, SDLanError}; use serde::{Deserialize, Serialize}; -use md5::Md5; use tracing::warn; -pub const TEST_PREFIX: &'static str = "https://root.punchsky.com/api"; +pub const TEST_PREFIX: &'static str = "https://test.punchsky.com/api"; const DIGEST_KEY: &'static str = "H6p*2RfEu4ITcL"; type HmacMd5 = Hmac; @@ -29,7 +31,7 @@ struct TokenLoginData<'a> { hostname: &'a str, } -fn do_calculate(data: &[u8]) -> Result{ +fn do_calculate(data: &[u8]) -> Result { let Ok(mut mac) = HmacMd5::new_from_slice(DIGEST_KEY.as_bytes()) else { return Err(SDLanError::IOError("failed to new hmac".to_owned())); }; @@ -38,21 +40,16 @@ fn do_calculate(data: &[u8]) -> Result{ Ok(hex::encode(result)) } -impl <'a> HMacCalculator for TokenLoginData<'a> { +impl<'a> HMacCalculator for TokenLoginData<'a> { fn calculate_hmac(&self) -> Result { - let data = format!("client_id={}&hostname={}&mac={}&system={}&token={}&version={}", - self.client_id, - self.hostname, - self.mac, - self.system, - self.token, - self.version, + let data = format!( + "client_id={}&hostname={}&mac={}&system={}&token={}&version={}", + self.client_id, self.hostname, self.mac, self.system, self.token, self.version, ); do_calculate(data.as_bytes()) } } - #[derive(Serialize)] struct UserPassLoginData<'a> { client_id: &'a str, @@ -66,7 +63,8 @@ struct UserPassLoginData<'a> { impl HMacCalculator for UserPassLoginData<'_> { fn calculate_hmac(&self) -> Result { - let data = format!("client_id={}&hostname={}&mac={}&password={}&system={}&username={}&version={}", + let data = format!( + "client_id={}&hostname={}&mac={}&password={}&system={}&username={}&version={}", self.client_id, self.hostname, self.mac, @@ -99,14 +97,15 @@ impl TryInto for LoginResponse { eprintln!("failed to save access_token"); } Ok(data) - }, - None => Err(SDLanError::IOError(format!("data is none: {}", self.message))), + } + None => Err(SDLanError::IOError(format!( + "data is none: {}", + self.message + ))), } - } } - #[derive(Debug, Deserialize)] pub struct LoginResponse { pub code: i32, @@ -134,19 +133,17 @@ pub struct LoginData { } #[derive(Deserialize, Debug)] -pub struct ExitNode{ +pub struct ExitNode { pub node_id: u32, pub node_name: String, pub gateway: String, pub target_network: String, } -async fn post_with_data( - url: &str, - data: T, -) -> Result -where T: Serialize + HMacCalculator, - R: for<'de> Deserialize<'de> +async fn post_with_data(url: &str, data: T) -> Result +where + T: Serialize + HMacCalculator, + R: for<'de> Deserialize<'de>, { let client = Client::new(); @@ -162,20 +159,21 @@ where T: Serialize + HMacCalculator, .header("X-sign", hmac.clone()) .json(&data) .send() - .await { - Ok(response) => { - response_ok = true; - response - } - Err(e) => { - retry_times += 1; - if retry_times > 3 { - return Err(SDLanError::IOError(format!("failed to do request: {}", e))); - } - warn!("retry connecting api in 5 seconds"); - tokio::time::sleep(std::time::Duration::from_secs(5)).await; - continue; + .await + { + Ok(response) => { + response_ok = true; + response + } + Err(e) => { + retry_times += 1; + if retry_times > 3 { + return Err(SDLanError::IOError(format!("failed to do request: {}", e))); } + warn!("retry connecting api in 5 seconds"); + tokio::time::sleep(std::time::Duration::from_secs(5)).await; + continue; + } }; // println!("status: {}", response.status()); @@ -183,18 +181,24 @@ where T: Serialize + HMacCalculator, let text = match response.text().await { Ok(text) => text, Err(e) => { - return Err(SDLanError::IOError(format!("failed to get response text: {}", e))) + return Err(SDLanError::IOError(format!( + "failed to get response text: {}", + e + ))) } }; let data = match serde_json::from_str(&text) { Ok(data) => data, Err(e) => { - return Err(SDLanError::IOError(format!("failed to deserialize text: {}", e))) + return Err(SDLanError::IOError(format!( + "failed to deserialize text: {}", + e + ))) } }; return Ok(data); - }; + } // println!("got test: {}", text); // let data = serde_json::from_str(&text).unwrap(); @@ -210,14 +214,15 @@ where T: Serialize + HMacCalculator, pub async fn login_with_user_pass( url_prefix: &str, - client_id: &str, - username: &str, - password: &str, + client_id: &str, + username: &str, + password: &str, mac: Mac, system: &str, version: &str, ) -> Result { - let mac = format!("{:02X}:{:02X}:{:02X}:{:02X}:{:02X}:{:02X}", + let mac = format!( + "{:02X}:{:02X}:{:02X}:{:02X}:{:02X}:{:02X}", mac[0], mac[1], mac[2], mac[3], mac[4], mac[5] ); @@ -238,13 +243,14 @@ pub async fn login_with_user_pass( pub async fn login_with_token( url_prefix: &str, - client_id: &str, + client_id: &str, token: &str, mac: Mac, system: &str, version: &str, ) -> Result { - let mac = format!("{:02X}:{:02X}:{:02X}:{:02X}:{:02X}:{:02X}", + let mac = format!( + "{:02X}:{:02X}:{:02X}:{:02X}:{:02X}:{:02X}", mac[0], mac[1], mac[2], mac[3], mac[4], mac[5] ); @@ -270,9 +276,9 @@ struct ConnectDisconnectRequest<'a> { impl HMacCalculator for ConnectDisconnectRequest<'_> { fn calculate_hmac(&self) -> Result { - let data = format!("access_token={}&client_id={}", - self.access_token, - self.client_id + let data = format!( + "access_token={}&client_id={}", + self.access_token, self.client_id ); do_calculate(data.as_bytes()) } @@ -354,10 +360,9 @@ struct GetResourceRequest<'a> { impl HMacCalculator for GetResourceRequest<'_> { fn calculate_hmac(&self) -> Result { - let data = format!("access_token={}&client_id={}&id={}", - self.access_token, - self.client_id, - self.id, + let data = format!( + "access_token={}&client_id={}&id={}", + self.access_token, self.client_id, self.id, ); do_calculate(data.as_bytes()) } @@ -394,4 +399,4 @@ pub async fn get_node_resource( let url = format!("{}/get_node_resource", url_prefix); post_with_data(&url, data).await -} \ No newline at end of file +} diff --git a/src/bin/punchnet/main.rs b/src/bin/punchnet/main.rs index a502bd9..e5d0991 100755 --- a/src/bin/punchnet/main.rs +++ b/src/bin/punchnet/main.rs @@ -8,8 +8,8 @@ use std::process; use std::time::Duration; use clap::Parser; -use punchnet::ExitNodeConfiguration; use punchnet::store_configuration; +use punchnet::ExitNodeConfiguration; use sdlan_sn_rs::utils::SDLanError; use std::env; @@ -135,7 +135,7 @@ async fn daemonize_me( let (tx, rx) = std::sync::mpsc::channel(); - let hostname = "root.punchsky.com".to_owned(); + let hostname = "test.punchsky.com".to_owned(); let host = format!("{}:80", hostname); let mut server = String::new(); if let Ok(addrs) = host.to_socket_addrs() { @@ -198,7 +198,8 @@ async fn daemonize_me( None, None, ) - .await { + .await + { panic!("failed to run_sdlan: {}", e.as_str()); }; @@ -310,28 +311,24 @@ async fn login_with_token_or_user_pass( mac: Mac, system: &str, version: &str, - token: &Option, - user: &Option, - pass: &Option -) -> Result{ + token: &Option, + user: &Option, + pass: &Option, +) -> Result { if let Some(ref tk) = token { login_with_token(TEST_PREFIX, client_id, tk, mac, system, version) - .await?.try_into() + .await? + .try_into() } else { if let (Some(ref user), Some(ref pass)) = (&user, &pass) { - login_with_user_pass( - TEST_PREFIX, - &client_id, - &user, - &pass, - mac, - system, - version, - ) - .await?.try_into() + login_with_user_pass(TEST_PREFIX, &client_id, &user, &pass, mac, system, version) + .await? + .try_into() } else { // eprintln!("invalid argument, use --help for help"); - Err(SDLanError::IOError("Invalid argument, use --help for help".to_string())) + Err(SDLanError::IOError( + "Invalid argument, use --help for help".to_string(), + )) // process::exit(-1); } } @@ -374,7 +371,17 @@ fn main() { std::process::exit(-1); } - if let Err(e) = login_with_token_or_user_pass(&client_id, mac, system, version, &user.token, &user.username, &user.password).await { + if let Err(e) = login_with_token_or_user_pass( + &client_id, + mac, + system, + version, + &user.token, + &user.username, + &user.password, + ) + .await + { eprintln!("failed to login: {}", e.as_str()); std::process::exit(-1); } @@ -382,7 +389,7 @@ fn main() { }); process::exit(0); } - /* + /* Commands::TokenLogin(tk) => { let rt = Runtime::new().unwrap(); rt.block_on(async move { @@ -395,7 +402,6 @@ fn main() { process::exit(0); } */ - Commands::ExitNode(cmd) => { let rt = Runtime::new().unwrap(); rt.block_on(async move { @@ -519,13 +525,16 @@ fn record_exit_node(connect_info: &ConnectData) { let mut local_configuration = load_configuration(); let mut temp = HashMap::new(); for node in &connect_info.exit_node { - temp.insert(node.node_id, ExitNodeConfiguration { - in_use: false, - node_id: node.node_id, - node_name: node.node_name.clone(), - gateway: node.gateway.clone(), - target_network: node.target_network.clone(), - }); + temp.insert( + node.node_id, + ExitNodeConfiguration { + in_use: false, + node_id: node.node_id, + node_name: node.node_name.clone(), + gateway: node.gateway.clone(), + target_network: node.target_network.clone(), + }, + ); } local_configuration.exit_node = temp; if let Err(e) = store_configuration(&local_configuration) { @@ -544,7 +553,6 @@ fn run_it( let rt = Runtime::new().unwrap(); match &cmd.cmd { Commands::Start(rtinfo) => rt.block_on(async move { - let remembered_token = get_access_token(); if remembered_token.is_none() { eprintln!("not logged in, should login with user/pass or token first"); @@ -570,10 +578,18 @@ fn run_it( }), Commands::AutoRun(tk) => rt.block_on(async move { loop { - let data = match login_with_token_or_user_pass(&client_id, mac, system, version, &tk.token, &tk.username, &tk.password).await { - Ok(data) => { - data - } + let data = match login_with_token_or_user_pass( + &client_id, + mac, + system, + version, + &tk.token, + &tk.username, + &tk.password, + ) + .await + { + Ok(data) => data, Err(e) => { eprintln!("failed to login: {}, will try in 10 seconds", e.as_str()); tokio::time::sleep(Duration::from_secs(10)).await; @@ -610,7 +626,6 @@ fn run_it( .await; break; } - }), _other => { @@ -620,7 +635,7 @@ fn run_it( } } -pub fn record_pid_file(pid: u32) { +pub fn record_pid_file(pid: u32) { fs::write(PID_FILE, pid.to_string()); } @@ -639,7 +654,7 @@ fn is_pid_running(pid: u32) -> bool { sys.process(sysinfo::Pid::from_u32(pid)).is_some() } -pub fn is_process_running() -> bool{ +pub fn is_process_running() -> bool { if Path::new(PID_FILE).exists() { if let Some(pid) = read_pid_file() { if !is_pid_running(pid) { @@ -651,4 +666,4 @@ pub fn is_process_running() -> bool{ } } false -} \ No newline at end of file +} diff --git a/src/utils/acl_session.rs b/src/utils/acl_session.rs index 20b7d83..654d861 100644 --- a/src/utils/acl_session.rs +++ b/src/utils/acl_session.rs @@ -162,7 +162,6 @@ impl RuleCache { if allow_routing { return (true, false); } - return (true, false); error!("is identity ok? {:?}", info); if self.session_table.process_packet(&info) {