mirror of https://github.com/ginuerzh/gost
chuchur
4 months ago
19 changed files with 395 additions and 68 deletions
@ -0,0 +1,122 @@ |
|||||
|
package gost |
||||
|
|
||||
|
import ( |
||||
|
"fmt" |
||||
|
"net" |
||||
|
"regexp" |
||||
|
"strings" |
||||
|
"sync" |
||||
|
"sync/atomic" |
||||
|
"time" |
||||
|
|
||||
|
"github.com/go-log/log" |
||||
|
) |
||||
|
|
||||
|
// 25 端口 465 和 587
|
||||
|
var mailPorts = []string{"25", "465", "587"} |
||||
|
|
||||
|
type EmailACL struct { |
||||
|
emails map[string]struct{} |
||||
|
domains map[string]struct{} |
||||
|
regex []*regexp.Regexp |
||||
|
} |
||||
|
|
||||
|
var emailACL atomic.Value |
||||
|
|
||||
|
func LoadEmailACL(list []string, regexList []string) error { |
||||
|
acl := &EmailACL{ |
||||
|
emails: map[string]struct{}{}, |
||||
|
domains: map[string]struct{}{}, |
||||
|
} |
||||
|
for _, v := range list { |
||||
|
v = strings.ToLower(strings.TrimSpace(v)) |
||||
|
if strings.HasPrefix(v, "@") { |
||||
|
domain := strings.TrimPrefix(v, "@") |
||||
|
acl.domains[domain] = struct{}{} |
||||
|
} else { |
||||
|
acl.emails[v] = struct{}{} |
||||
|
} |
||||
|
} |
||||
|
for _, r := range regexList { |
||||
|
re, err := regexp.Compile(r) |
||||
|
if err != nil { |
||||
|
return err |
||||
|
} |
||||
|
acl.regex = append(acl.regex, re) |
||||
|
} |
||||
|
emailACL.Store(acl) |
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
func IsEmailAllowed(email string) bool { |
||||
|
acl := emailACL.Load().(*EmailACL) |
||||
|
email = strings.ToLower(strings.TrimSpace(email)) |
||||
|
// 白名单为空 → 拒绝所有
|
||||
|
if len(acl.emails) == 0 && len(acl.domains) == 0 && len(acl.regex) == 0 { |
||||
|
return false |
||||
|
} |
||||
|
// 精确匹配
|
||||
|
if _, ok := acl.emails[email]; ok { |
||||
|
return true |
||||
|
} |
||||
|
// domain 匹配
|
||||
|
parts := strings.Split(email, "@") |
||||
|
if len(parts) == 2 { |
||||
|
domain := parts[1] |
||||
|
if _, ok := acl.domains[domain]; ok { |
||||
|
return true |
||||
|
} |
||||
|
} |
||||
|
// regex
|
||||
|
for _, r := range acl.regex { |
||||
|
if r.MatchString(email) { |
||||
|
return true |
||||
|
} |
||||
|
} |
||||
|
return false |
||||
|
} |
||||
|
|
||||
|
func CheckMailFrom(email string) error { |
||||
|
if !IsEmailAllowed(email) { |
||||
|
log.Logf("smtp blocked email: %s", email) |
||||
|
return fmt.Errorf("550 sender not allowed") |
||||
|
} |
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
type RateLimit struct { |
||||
|
count int |
||||
|
lastTime time.Time |
||||
|
} |
||||
|
|
||||
|
var rateLimitMap sync.Map // key: ip/user, value: *RateLimit
|
||||
|
|
||||
|
func CheckRateLimit(ip net.IP, user string, maxPerMinute int) bool { |
||||
|
|
||||
|
key := ip.String() + ":" + user |
||||
|
now := time.Now() |
||||
|
|
||||
|
v, _ := rateLimitMap.LoadOrStore(key, &RateLimit{ |
||||
|
count: 0, |
||||
|
lastTime: now, |
||||
|
}) |
||||
|
|
||||
|
rl := v.(*RateLimit) |
||||
|
|
||||
|
// 超过一分钟窗口 → 重置计数
|
||||
|
if now.Sub(rl.lastTime) > time.Minute { |
||||
|
rl.count = 0 |
||||
|
rl.lastTime = now |
||||
|
} |
||||
|
|
||||
|
if rl.count >= maxPerMinute { |
||||
|
return false |
||||
|
} |
||||
|
|
||||
|
rl.count++ |
||||
|
return true |
||||
|
} |
||||
|
|
||||
|
// if !CheckRateLimit(clientIP, username, 50) {
|
||||
|
// return fmt.Errorf("451 Too many messages, rate limit exceeded")
|
||||
|
// }
|
||||
@ -0,0 +1,65 @@ |
|||||
|
package gost |
||||
|
|
||||
|
import ( |
||||
|
"fmt" |
||||
|
"net" |
||||
|
"strings" |
||||
|
"sync/atomic" |
||||
|
) |
||||
|
|
||||
|
var whiteList atomic.Value |
||||
|
|
||||
|
type IPWhiteList struct { |
||||
|
networks []*net.IPNet |
||||
|
} |
||||
|
|
||||
|
func NewIPWhiteList(list []string) (*IPWhiteList, error) { |
||||
|
wl := &IPWhiteList{} |
||||
|
for _, item := range list { |
||||
|
if strings.Contains(item, "/") { |
||||
|
_, netw, err := net.ParseCIDR(item) |
||||
|
if err != nil { |
||||
|
return nil, err |
||||
|
} |
||||
|
wl.networks = append(wl.networks, netw) |
||||
|
} else { |
||||
|
ip := net.ParseIP(item) |
||||
|
if ip == nil { |
||||
|
return nil, fmt.Errorf("invalid ip: %s", item) |
||||
|
} |
||||
|
mask := net.CIDRMask(32, 32) |
||||
|
wl.networks = append(wl.networks, &net.IPNet{ |
||||
|
IP: ip, |
||||
|
Mask: mask, |
||||
|
}) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return wl, nil |
||||
|
} |
||||
|
|
||||
|
func (w *IPWhiteList) Contains(ip net.IP) bool { |
||||
|
if ip == nil { |
||||
|
return false |
||||
|
} |
||||
|
for _, netw := range w.networks { |
||||
|
if netw.Contains(ip) { |
||||
|
return true |
||||
|
} |
||||
|
} |
||||
|
return false |
||||
|
} |
||||
|
|
||||
|
func LoadIPWhiteList(list []string) error { |
||||
|
wl, err := NewIPWhiteList(list) |
||||
|
if err != nil { |
||||
|
return err |
||||
|
} |
||||
|
whiteList.Store(wl) |
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
func isWhiteIP(ip net.IP) bool { |
||||
|
wl := whiteList.Load().(*IPWhiteList) |
||||
|
return wl.Contains(ip) |
||||
|
} |
||||
@ -0,0 +1,23 @@ |
|||||
|
[auth] |
||||
|
#动态口令周期 (s) 600=10分钟 |
||||
|
dynamic_period = 600 |
||||
|
#时间漂移 |
||||
|
dynamic_skew = 1 |
||||
|
|
||||
|
ip_whitelist = [ |
||||
|
"198.144.184.47", |
||||
|
"108.174.48.108", |
||||
|
"23.94.205.145", |
||||
|
"108.174.48.102", |
||||
|
"198.144.184.108", |
||||
|
"198.144.184.57", |
||||
|
"198.144.184.125", |
||||
|
] |
||||
|
|
||||
|
#动态密钥 |
||||
|
secret = "&&4sg123g[]/~" |
||||
|
|
||||
|
# SMTP 发信白名单 |
||||
|
email_whitelist = ["[email protected]", "@example.com"] |
||||
|
|
||||
|
email_regex = ["^test[0-9][email protected]$"] |
||||
@ -0,0 +1,30 @@ |
|||||
|
package gost |
||||
|
|
||||
|
import ( |
||||
|
"github.com/BurntSushi/toml" |
||||
|
"github.com/go-log/log" |
||||
|
) |
||||
|
|
||||
|
type Config struct { |
||||
|
Auth struct { |
||||
|
DynamicPeriod int64 `toml:"dynamic_period"` |
||||
|
IPWhiteList []string `toml:"ip_whitelist"` |
||||
|
EmailWhiteList []string `toml:"email_whitelist"` |
||||
|
EmailRegWhiteList []string `toml:"email_regex"` |
||||
|
DynamicSkew int `toml:"dynamic_skew"` |
||||
|
Secret string `toml:"secret"` |
||||
|
} `toml:"auth"` |
||||
|
} |
||||
|
|
||||
|
var config Config |
||||
|
|
||||
|
func LoadAuthConfig() { |
||||
|
|
||||
|
_, err := toml.DecodeFile("auth.toml", &config) |
||||
|
if err != nil { |
||||
|
log.Log("not found auth.toml", err) |
||||
|
} |
||||
|
|
||||
|
LoadIPWhiteList(config.Auth.IPWhiteList) |
||||
|
LoadEmailACL(config.Auth.EmailWhiteList, config.Auth.EmailRegWhiteList) |
||||
|
} |
||||
@ -0,0 +1,72 @@ |
|||||
|
package gost |
||||
|
|
||||
|
import ( |
||||
|
"crypto/hmac" |
||||
|
"crypto/sha1" |
||||
|
"crypto/sha256" |
||||
|
"encoding/binary" |
||||
|
"encoding/hex" |
||||
|
"fmt" |
||||
|
"time" |
||||
|
) |
||||
|
|
||||
|
func VerifyOTP(secret, pass string) bool { |
||||
|
now := time.Now().UTC().Unix() |
||||
|
skew := config.Auth.DynamicSkew |
||||
|
period := config.Auth.DynamicPeriod |
||||
|
|
||||
|
for i := -skew; i <= skew; i++ { |
||||
|
|
||||
|
t := (now / period) + int64(i) |
||||
|
|
||||
|
code := generateTOTP(secret, t) |
||||
|
|
||||
|
if code == pass { |
||||
|
return true |
||||
|
} |
||||
|
} |
||||
|
return false |
||||
|
} |
||||
|
|
||||
|
func generateTOTP(secret string, counter int64) string { |
||||
|
key := []byte(secret) |
||||
|
var buf [8]byte |
||||
|
binary.BigEndian.PutUint64(buf[:], uint64(counter)) |
||||
|
h := hmac.New(sha1.New, key) |
||||
|
h.Write(buf[:]) |
||||
|
hash := h.Sum(nil) |
||||
|
offset := hash[len(hash)-1] & 0x0f |
||||
|
truncated := |
||||
|
(binary.BigEndian.Uint32(hash[offset:offset+4]) & 0x7fffffff) % 1000000 |
||||
|
return fmt.Sprintf("%06d", truncated) |
||||
|
} |
||||
|
|
||||
|
func generateSecret(ip, user string) string { |
||||
|
src := ip + ":" + user + ":" + config.Auth.Secret |
||||
|
hash := sha256.Sum256([]byte(src)) |
||||
|
return hex.EncodeToString(hash[:]) |
||||
|
} |
||||
|
|
||||
|
func verifyOTP(secret, pass string) (bool, int64) { |
||||
|
now := time.Now().UTC().Unix() |
||||
|
skew := config.Auth.DynamicSkew |
||||
|
period := config.Auth.DynamicPeriod |
||||
|
|
||||
|
for i := -skew; i <= skew; i++ { |
||||
|
counter := (now / period) + int64(i) |
||||
|
code := generateTOTP(secret, counter) |
||||
|
if code == pass { |
||||
|
return true, counter |
||||
|
} |
||||
|
} |
||||
|
return false, 0 |
||||
|
} |
||||
|
|
||||
|
func GeneratePassword(ip, user string) string { |
||||
|
src := ip + user + config.Auth.Secret |
||||
|
hash := sha256.New() |
||||
|
hash.Write([]byte(src)) |
||||
|
hashedSrc := hash.Sum(nil) |
||||
|
hashedSrcHex := hex.EncodeToString(hashedSrc) |
||||
|
return hashedSrcHex |
||||
|
} |
||||
Loading…
Reference in new issue