diff --git a/CHANGELOG b/CHANGELOG index 3d6cf01..a8bce68 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,6 +1,7 @@ proxy更新日志 v3.6 -1.http(s),socks代理,认证增加了外部api认证,可以通过外部api对用户名和密码进行认证. +1.http(s),socks代理,集成了外部HTTP API认证,可以通过外部API对用户名和密码进行认证. +2.手册http(s),socks代理认证部分增加了集成外部hHTTP API认证的使用说明. v3.5 1.优化了kcp参数,速度有所提升. diff --git a/README.md b/README.md index fe1182b..e036578 100644 --- a/README.md +++ b/README.md @@ -26,7 +26,8 @@ Proxy是golang实现的高性能http,https,websocket,tcp,udp,socks5代理服务 - ...   -本页是v3.5手册,其他版本手册请点击下面链接查看. +本页是v3.6手册,其他版本手册请点击下面链接查看. +- [v3.5手册](https://github.com/snail007/goproxy/tree/v3.5) - [v3.4手册](https://github.com/snail007/goproxy/tree/v3.4) - [v3.3手册](https://github.com/snail007/goproxy/tree/v3.3) - [v3.2手册](https://github.com/snail007/goproxy/tree/v3.2) @@ -118,7 +119,7 @@ wget https://github.com/reddec/monexec/releases/download/v0.1.1/monexec_0.1.1_li 下载地址:https://github.com/snail007/goproxy/releases ```shell cd /root/proxy/ -wget https://github.com/snail007/goproxy/releases/download/v3.5/proxy-linux-amd64.tar.gz +wget https://github.com/snail007/goproxy/releases/download/v3.6/proxy-linux-amd64.tar.gz ``` #### **3.下载自动安装脚本** ```shell @@ -203,9 +204,23 @@ http,tcp,udp代理过程会和上级通讯,为了安全我们采用加密通讯, `./proxy http -t tcp -p ":33080" -a "user1:pass1" -a "user2:pass2"` 多个用户,重复-a参数即可. 也可以放在文件中,格式是一行一个"用户名:密码",然后用-F指定. -`./proxy http -t tcp -p ":33080" -F auth-file.txt` -如果没有-a或-F参数,就是关闭Basic认证. +`./proxy http -t tcp -p ":33080" -F auth-file.txt` +另外,http(s)代理还集成了外部HTTP API认证,我们可以通过--auth-url参数指定一个http url接口地址, +然后有用户连接的时候,proxy会GET方式请求这url,带上下面四个参数,如果返回HTTP状态码204,代表认证成功 +其它情况认为认证失败. +比如: +`./proxy http -t tcp -p ":33080" --auth-url "http://test.com/auth.php"` +用户连接的时候,proxy会GET方式请求这url("http://test.com/auth.php"), +带上user,pass,ip,target四个参数: +http://test.com/auth.php?user={USER}&pass={PASS}&ip={IP}&target={TARGET} +user:用户名 +pass:密码 +ip:用户的IP,比如:192.168.1.200 +target:用户访问的URL,比如:http://demo.com:80/1.html或https://www.baidu.com:80 + +如果没有-a或-F或--auth-url参数,就是关闭Basic认证. + #### **1.6.HTTP代理流量强制走上级HTTP代理** 默认情况下,proxy会智能判断一个网站域名是否无法访问,如果无法访问才走上级HTTP代理.通过--always可以使全部HTTP代理流量强制走上级HTTP代理. `./proxy http --always -t tls -p ":28080" -T tls -P "22.22.22.22:38080" -C proxy.crt -K proxy.key` @@ -511,7 +526,20 @@ server连接到bridge的时候,如果同时有多个client连接到同一个brid 多个用户,重复-a参数即可. 也可以放在文件中,格式是一行一个"用户名:密码",然后用-F指定. `./proxy socks -t tcp -p ":33080" -F auth-file.txt` -如果没有-a或-F参数,就是关闭认证. + +另外,socks5代理还集成了外部HTTP API认证,我们可以通过--auth-url参数指定一个http url接口地址, +然后有用户连接的时候,proxy会GET方式请求这url,带上下面四个参数,如果返回HTTP状态码204,代表认证成功 +其它情况认为认证失败. +比如: +`./proxy socks -t tcp -p ":33080" --auth-url "http://test.com/auth.php"` +用户连接的时候,proxy会GET方式请求这url("http://test.com/auth.php"), +带上user,pass,ip,三个参数: +http://test.com/auth.php?user={USER}&pass={PASS}&ip={IP} +user:用户名 +pass:密码 +ip:用户的IP,比如:192.168.1.200 + +如果没有-a或-F或--auth-url参数,就是关闭认证. #### **5.8.KCP协议传输** KCP协议需要-B参数设置一个密码用于加密解密数据 diff --git a/config.go b/config.go index 2e5cb0e..0c9d939 100755 --- a/config.go +++ b/config.go @@ -145,7 +145,7 @@ func initConfig() (err error) { socksArgs.AuthURL = socks.Flag("auth-url", "auth username and password will send to this url,response http code equal to 'auth-code' means ok,others means fail.").Default("").String() socksArgs.AuthURLTimeout = socks.Flag("auth-timeout", "access 'auth-url' timeout milliseconds").Default("3000").Int() socksArgs.AuthURLOkCode = socks.Flag("auth-code", "access 'auth-url' success http code").Default("204").Int() - socksArgs.AuthURLRetry = socks.Flag("auth-retry", "access 'auth-url' fail and retry count").Default("1").Int() + socksArgs.AuthURLRetry = socks.Flag("auth-retry", "access 'auth-url' fail and retry count").Default("0").Int() //parse args serviceName := kingpin.MustParse(app.Parse(os.Args[1:])) diff --git a/install_auto.sh b/install_auto.sh index 6823b15..d29444d 100755 --- a/install_auto.sh +++ b/install_auto.sh @@ -6,7 +6,7 @@ fi mkdir /tmp/proxy cd /tmp/proxy wget https://github.com/reddec/monexec/releases/download/v0.1.1/monexec_0.1.1_linux_amd64.tar.gz -wget https://github.com/snail007/goproxy/releases/download/v3.5/proxy-linux-amd64.tar.gz +wget https://github.com/snail007/goproxy/releases/download/v3.6/proxy-linux-amd64.tar.gz # install monexec tar zxvf monexec_0.1.1_linux_amd64.tar.gz diff --git a/services/socks.go b/services/socks.go index 7bc4fee..9953666 100644 --- a/services/socks.go +++ b/services/socks.go @@ -355,7 +355,7 @@ func (s *Socks) socksConnCallback(inConn net.Conn) { //log.Printf("user:%s,pass:%s", user, pass) //auth _addr := strings.Split(inConn.RemoteAddr().String(), ":") - if s.basicAuth.CheckUserPass(user, pass, _addr[0]) { + if s.basicAuth.CheckUserPass(user, pass, _addr[0], "") { inConn.Write([]byte{0x01, 0x00}) } else { inConn.Write([]byte{0x01, 0x01}) diff --git a/utils/structs.go b/utils/structs.go index 5caf8de..9e5fe9e 100644 --- a/utils/structs.go +++ b/utils/structs.go @@ -223,18 +223,18 @@ func (ba *BasicAuth) Add(userpassArr []string) (n int) { } return } -func (ba *BasicAuth) CheckUserPass(user, pass, ip string) (ok bool) { +func (ba *BasicAuth) CheckUserPass(user, pass, ip, target string) (ok bool) { - return ba.Check(user+":"+pass, ip) + return ba.Check(user+":"+pass, ip, target) } -func (ba *BasicAuth) Check(userpass string, ip string) (ok bool) { +func (ba *BasicAuth) Check(userpass string, ip, target string) (ok bool) { u := strings.Split(strings.Trim(userpass, " "), ":") if len(u) == 2 { if p, _ok := ba.data.Get(u[0]); _ok { return p.(string) == u[1] } if ba.authURL != "" { - err := ba.checkFromURL(userpass, ip) + err := ba.checkFromURL(userpass, ip, target) if err == nil { return true } @@ -244,7 +244,7 @@ func (ba *BasicAuth) Check(userpass string, ip string) (ok bool) { } return } -func (ba *BasicAuth) checkFromURL(userpass, ip string) (err error) { +func (ba *BasicAuth) checkFromURL(userpass, ip, target string) (err error) { u := strings.Split(strings.Trim(userpass, " "), ":") if len(u) != 2 { return @@ -255,7 +255,7 @@ func (ba *BasicAuth) checkFromURL(userpass, ip string) (err error) { } else { URL += "?" } - URL += fmt.Sprintf("user=%s&pass=%s&ip=%s", u[0], u[1], ip) + URL += fmt.Sprintf("user=%s&pass=%s&ip=%s&target=%s", u[0], u[1], ip, target) var code int var tryCount = 0 var body []byte @@ -405,7 +405,13 @@ func (req *HTTPRequest) BasicAuth() (err error) { return } addr := strings.Split((*req.conn).RemoteAddr().String(), ":") - authOk := (*req.basicAuth).Check(string(user), addr[0]) + URL := "" + if req.IsHTTPS() { + URL = "https://" + req.Host + } else { + URL, _ = req.getHTTPURL() + } + authOk := (*req.basicAuth).Check(string(user), addr[0], URL) //log.Printf("auth %s,%v", string(user), authOk) if !authOk { fmt.Fprint((*req.conn), "HTTP/1.1 401 Unauthorized\r\n\r\nUnauthorized")