mm_os 3.3.1 → 4.0.1

package/middleware/ip_firewall/index.js

@@ -1,476 +0,0 @@
-/**
- * IP防火墙中间件
- * 合并了IP过滤和WAF IP防火墙的功能
- * 支持黑白名单、频率限制、自动黑名单等功能
- */
-class IpFirewallMiddleware {
-    constructor() {
-        this.default = {
-            // 基础功能配置
-            enable: true,
-            mode: 'blacklist',
-            blacklist: [],
-            whitelist: [],
-            ignore_paths: [],
-            log: true,
-            block_status_code: 403,
-            block_message: 'Forbidden: Access denied',
-            enable_cidr: true,
-            trust_proxy: false,
-            
-            // 频率限制配置
-            request_limit: 1000,
-            request_duration: 60000,
-            request_block: true,
-            blacklist_expire_time: 86400000,
-            persist_blacklist: true
-        };
-    }
-}
-
-IpFirewallMiddleware.prototype.init = function(config) {
-    this.config = Object.assign({}, this.default, config || {});
-    
-    // 初始化持久化黑名单
-    if (this.config.persist_blacklist) {
-        this._initBlacklist();
-    }
-    
-    return this;
-};
-
-IpFirewallMiddleware.prototype.run = async function(ctx, next) {
-    const config = this.config;
-    
-    if (!config.enable) {
-        return await next();
-    }
-    
-    // 检查是否应该忽略该路径
-    const path = ctx.path;
-    if (config.ignore_paths.some(p => path.startsWith(p))) {
-        return await next();
-    }
-    
-    // 获取客户端IP
-    const client_ip = this._getClientIp(ctx);
-    
-    // 检查基础IP过滤
-    if (!(await this._isIpAllowed(client_ip, config))) {
-        if (config.log) {
-            this._logBlockedAccess(ctx, client_ip, 'basic_filter');
-        }
-        
-        ctx.status = config.block_status_code;
-        ctx.body = {
-            code: config.block_status_code,
-            msg: config.block_message
-        };
-        return;
-    }
-    
-    // 检查频率限制
-    if (!(await this._checkRateLimit(client_ip, config))) {
-        if (config.log) {
-            this._logBlockedAccess(ctx, client_ip, 'rate_limit');
-        }
-        
-        ctx.status = 429;
-        ctx.body = '请求频率过高，请稍后再试。';
-        return;
-    }
-    
-    await next();
-};
-
-IpFirewallMiddleware.prototype._getClientIp = function(ctx) {
-    let ip = ctx.ip;
-    
-    // 如果信任代理，则从X-Forwarded-For头获取真实IP
-    if (this.config.trust_proxy) {
-        const forwarded_for = ctx.get('X-Forwarded-For');
-        if (forwarded_for) {
-            // 取第一个IP（最原始的客户端IP）
-            ip = forwarded_for.split(',')[0].trim();
-        }
-    }
-    
-    // 处理IPv6格式
-    if (ip.startsWith('::ffff:')) {
-        ip = ip.substring(7);
-    }
-    
-    // 移除可能的端口号
-    if (ip && ip.includes(':')) {
-        ip = ip.split(':')[0];
-    }
-    
-    // 处理IPv6本地地址
-    if (ip === '::1' || ip === '::ffff:127.0.0.1') {
-        ip = '127.0.0.1';
-    }
-    
-    return ip;
-};
-
-IpFirewallMiddleware.prototype._isIpAllowed = async function(ip, config) {
-    // 优先使用全局IP管理器
-    try {
-        var { is_ip_in_whitelist, is_ip_in_blacklist } = require('../../tools/ip_manager/ip.manager.global.js');
-        
-        if (config.mode === 'whitelist') {
-            // 白名单模式：只有在白名单中的IP才允许访问
-            if (await is_ip_in_whitelist(ip)) {
-                return true;
-            }
-        } else {
-            // 黑名单模式：只有在黑名单中的IP才被阻止
-            if (await is_ip_in_blacklist(ip)) {
-                return false;
-            }
-        }
-    } catch (error) {
-        // 如果全局IP管理器不可用，使用本地配置
-        if ($.log && $.log.warn) {
-            $.log.warn('全局IP管理器不可用，使用本地IP过滤配置');
-        }
-    }
-    
-    // 使用本地配置作为备用
-    if (config.mode === 'whitelist') {
-        return this._isIpInList(ip, config.whitelist);
-    } else {
-        return !this._isIpInList(ip, config.blacklist);
-    }
-};
-
-IpFirewallMiddleware.prototype._isIpInList = function(ip, ip_list) {
-    if (!ip_list || !Array.isArray(ip_list)) {
-        return false;
-    }
-    
-    // 检查精确匹配
-    if (ip_list.includes(ip)) {
-        return true;
-    }
-    
-    // 检查CIDR格式匹配
-    if (this.config.enable_cidr) {
-        for (const cidr of ip_list) {
-            if (this._isIpInCidr(ip, cidr)) {
-                return true;
-            }
-        }
-    }
-    
-    return false;
-};
-
-IpFirewallMiddleware.prototype._isIpInCidr = function(ip, cidr) {
-    try {
-        // 简单的CIDR匹配实现
-        if (!cidr.includes('/')) {
-            return false;
-        }
-        
-        const [network, prefix_length] = cidr.split('/');
-        const prefix = parseInt(prefix_length, 10);
-        
-        // 将IP地址转换为数字
-        const ip_num = this._ipToNumber(ip);
-        const network_num = this._ipToNumber(network);
-        
-        if (isNaN(ip_num) || isNaN(network_num)) {
-            return false;
-        }
-        
-        // 计算掩码
-        const mask = this._getMask(prefix);
-        
-        // 检查IP是否在CIDR范围内
-        return (ip_num & mask) === (network_num & mask);
-    } catch (error) {
-        return false;
-    }
-};
-
-IpFirewallMiddleware.prototype._ipToNumber = function(ip) {
-    const parts = ip.split('.');
-    if (parts.length !== 4) {
-        return NaN;
-    }
-    
-    return parts.reduce((num, part) => {
-        return (num << 8) + parseInt(part, 10);
-    }, 0) >>> 0;
-};
-
-IpFirewallMiddleware.prototype._getMask = function(prefix) {
-    return (0xffffffff << (32 - prefix)) >>> 0;
-};
-
-IpFirewallMiddleware.prototype._checkRateLimit = async function(ip, config) {
-    if (!config.request_limit || !config.request_duration) {
-        return true;
-    }
-    
-    try {
-        // 检查是否已被黑名单
-        const is_blacklisted = await $.cache.get(`blacklist_${ip}`);
-        if (is_blacklisted) {
-            return false;
-        }
-        
-        var num = 1;
-        var now = new Date();
-        var date = now.toStr('yyyy-MM-dd');
-        var time;
-        var json;
-        
-        var str = await $.cache.get("ip_" + ip);
-        if (str) {
-            if (typeof (str) === "string") {
-                try {
-                    json = JSON.parse(str);
-                } catch (jsonError) {
-                    if ($.log && $.log.error) {
-                        $.log.error('IP防火墙JSON解析错误:', jsonError);
-                    }
-                    json = null;
-                }
-            } else {
-                json = str;
-            }
-            
-            if (json) {
-                if (json.date !== date) {
-                    num = 1;
-                } else {
-                    // 判断时间间隔是否在范围外
-                    if (typeof json.time === 'string') {
-                        const savedTime = new Date(json.time);
-                        if (!isNaN(savedTime.getTime()) && (now - savedTime) > config.request_duration) {
-                            num = 1;
-                        } else {
-                            num = json.num + 1;
-                            if (num > config.request_limit) {
-                                // 超出上限禁止访问，并加入黑名单
-                                if (config.request_block) {
-                                    await this._addToBlacklist(ip, config);
-                                }
-                                return false;
-                            }
-                        }
-                    } else {
-                        num = 1;
-                    }
-                }
-            }
-        }
-        
-        if (!time) {
-            time = now.toStr('yyyy-MM-dd hh:mm:ss');
-        }
-        
-        await $.cache.set("ip_" + ip, JSON.stringify({
-            date,
-            time,
-            num
-        }), config.request_duration);
-        
-        return true;
-    } catch (error) {
-        if ($.log && $.log.error) {
-            $.log.error('IP防火墙频率检查错误:', error);
-        }
-        return true; // 出错时默认允许通过
-    }
-};
-
-IpFirewallMiddleware.prototype._addToBlacklist = async function(ip, config) {
-    const { exec } = require('child_process');
-    const platform = require('os').platform();
-    
-    // 检查是否已在黑名单中
-    const blacklistKey = `blacklist_${ip}`;
-    try {
-        const is_blacklisted = await $.cache.get(blacklistKey);
-        if (is_blacklisted) {
-            if ($.log && $.log.info) {
-                $.log.info(`IP ${ip} 已在黑名单中，无需重复添加`);
-            }
-            return;
-        }
-    } catch (error) {
-        if ($.log && $.log.error) {
-            $.log.error('检查黑名单缓存错误:', error);
-        }
-    }
-    
-    var cmd;
-    if (platform == "win32") {
-        cmd = `netsh advfirewall firewall add rule name="Blacklist ${ip}" dir=in action=block remoteip="${ip}" protocol=any`;
-    } else {
-        cmd = `iptables -A INPUT -s ${ip} -j DROP`;
-    }
-    
-    try {
-        await new Promise((resolve, reject) => {
-            exec(cmd, (error, stdout, stderr) => {
-                if (error) {
-                    reject(error);
-                    return;
-                }
-                if ($.log && $.log.info) {
-                    $.log.info(`IP ${ip} 已加入防火墙黑名单`);
-                }
-                resolve();
-            });
-        });
-        
-        // 记录到缓存，支持黑名单过期时间
-        const expire_time = config.blacklist_expire_time || 86400000;
-        await $.cache.set(blacklistKey, true, expire_time);
-        
-        // 记录黑名单IP，便于管理
-        const blacklistIPsKey = 'blacklisted_ips';
-        let blacklist_ips = [];
-        try {
-            const existing = await $.cache.get(blacklistIPsKey);
-            if (existing) {
-                blacklist_ips = typeof existing === 'string' ? JSON.parse(existing) : existing;
-            }
-            if (!Array.isArray(blacklist_ips)) {
-                blacklist_ips = [];
-            }
-            if (!blacklist_ips.includes(ip)) {
-                blacklist_ips.push(ip);
-                await $.cache.set(blacklistIPsKey, blacklist_ips, 0); // 永不过期
-            }
-        } catch (cacheError) {
-            if ($.log && $.log.error) {
-                $.log.error('保存黑名单IP列表错误:', cacheError);
-            }
-        }
-    } catch (error) {
-        if ($.log && $.log.error) {
-            $.log.error(`添加IP ${ip} 到黑名单失败:`, error);
-        }
-    }
-};
-
-IpFirewallMiddleware.prototype._removeFromBlacklist = async function(ip) {
-    const { exec } = require('child_process');
-    const platform = require('os').platform();
-    
-    var cmd;
-    if (platform == "win32") {
-        cmd = `netsh advfirewall firewall delete rule name="Blacklist ${ip}"`;
-    } else {
-        cmd = `iptables -D INPUT -s ${ip} -j DROP`;
-    }
-    
-    try {
-        await new Promise((resolve, reject) => {
-            exec(cmd, (error, stdout, stderr) => {
-                if (error) {
-                    if (platform !== "win32") {
-                        reject(error);
-                        return;
-                    }
-                }
-                if ($.log && $.log.info) {
-                    $.log.info(`IP ${ip} 已从防火墙黑名单中移除`);
-                }
-                resolve();
-            });
-        });
-        
-        // 从缓存中移除
-        await $.cache.del(`blacklist_${ip}`);
-        
-        // 从黑名单列表中移除
-        const blacklistIPsKey = 'blacklisted_ips';
-        try {
-            const existing = await $.cache.get(blacklistIPsKey);
-            if (existing) {
-                let blacklist_ips = typeof existing === 'string' ? JSON.parse(existing) : existing;
-                if (Array.isArray(blacklist_ips)) {
-                    blacklist_ips = blacklist_ips.filter(ip_item => ip_item !== ip);
-                    await $.cache.set(blacklistIPsKey, blacklist_ips, 0);
-                }
-            }
-        } catch (cacheError) {
-            if ($.log && $.log.error) {
-                $.log.error('更新黑名单IP列表错误:', cacheError);
-            }
-        }
-    } catch (error) {
-        if ($.log && $.log.error) {
-            $.log.error(`移除IP ${ip} 从黑名单失败:`, error);
-        }
-    }
-};
-
-IpFirewallMiddleware.prototype._initBlacklist = async function() {
-    if (!this.config.persist_blacklist) return;
-    
-    try {
-        const blacklistIPsKey = 'blacklisted_ips';
-        const existing = await $.cache.get(blacklistIPsKey);
-        if (existing) {
-            let blacklist_ips = typeof existing === 'string' ? JSON.parse(existing) : existing;
-            if (Array.isArray(blacklist_ips) && blacklist_ips.length > 0) {
-                if ($.log && $.log.info) {
-                    $.log.info(`正在应用 ${blacklist_ips.length} 个持久化的黑名单IP规则...`);
-                }
-                for (const ip of blacklist_ips) {
-                    // 重新应用黑名单规则
-                    await this._addToBlacklist(ip, this.config);
-                }
-            }
-        }
-    } catch (error) {
-        if ($.log && $.log.error) {
-            $.log.error('初始化持久化黑名单失败:', error);
-        }
-    }
-};
-
-IpFirewallMiddleware.prototype._logBlockedAccess = function(ctx, ip, reason) {
-    if ($.log && $.log.warn) {
-        $.log.warn(`IP访问被阻止: IP=${ip}, 路径=${ctx.path}, 方法=${ctx.method}, 原因=${reason}`);
-    }
-};
-
-// 创建中间件实例
-const middleware = new IpFirewallMiddleware();
-
-// 导出符合系统期望的函数
-exports = module.exports = async function(server, config) {
-    // 初始化中间件
-    middleware.init(config);
-    
-    // 注册中间件到服务器
-    server.use(middleware.run.bind(middleware));
-    
-    // 记录中间件初始化信息
-    if ($.log && $.log.info) {
-        $.log.info(`IP防火墙中间件已加载: 启用=${middleware.config.enable}, 模式=${middleware.config.mode}, 频率限制=${middleware.config.request_limit}/${middleware.config.request_duration}ms`);
-    }
-    
-    // 提供手动管理黑名单的API方法
-    if (!$.ip_firewall) {
-        $.ip_firewall = {
-            addBlacklist: middleware._addToBlacklist.bind(middleware),
-            removeBlacklist: middleware._removeFromBlacklist.bind(middleware),
-            getClientIP: middleware._getClientIp.bind(middleware),
-            isInWhitelist: middleware._isIpInList.bind(middleware)
-        };
-    }
-    
-    return server;
-};
-
-// 保留原始实例，以便其他方式调用
-exports.middleware = middleware;

package/middleware/ip_firewall/middleware.json

@@ -1,109 +0,0 @@
-{
-  "name": "ip_firewall",
-  "title": "IP防火墙中间件",
-  "description": "合并了IP过滤和WAF IP防火墙的功能，支持黑白名单、频率限制、自动黑名单等功能",
-  "version": "2.0",
-  "mode": "web",
-  "process_type": "common_before",
-  "sort": 10,
-  "state": 1,
-  "config": {
-    "enable": {
-      "type": "boolean",
-      "title": "启用IP防火墙",
-      "description": "是否启用IP防火墙功能",
-      "value": true
-    },
-    "mode": {
-      "type": "select",
-      "title": "过滤模式",
-      "description": "选择IP过滤模式：黑名单模式或白名单模式",
-      "options": [
-        {"label": "黑名单模式", "value": "blacklist"},
-        {"label": "白名单模式", "value": "whitelist"}
-      ],
-      "value": "blacklist"
-    },
-    "blacklist": {
-      "type": "array",
-      "title": "黑名单IP列表",
-      "description": "在黑名单模式下的禁止访问IP列表，支持CIDR格式",
-      "value": []
-    },
-    "whitelist": {
-      "type": "array",
-      "title": "白名单IP列表",
-      "description": "在白名单模式下的允许访问IP列表，支持CIDR格式",
-      "value": ["127.0.0.1"]
-    },
-    "ignore_paths": {
-      "type": "array",
-      "title": "忽略路径",
-      "description": "在这些路径下不进行IP过滤",
-      "value": []
-    },
-    "log": {
-      "type": "boolean",
-      "title": "记录日志",
-      "description": "是否记录被阻止的访问日志",
-      "value": true
-    },
-    "block_status_code": {
-      "type": "number",
-      "title": "阻止状态码",
-      "description": "IP被阻止时返回的HTTP状态码",
-      "value": 403
-    },
-    "block_message": {
-      "type": "string",
-      "title": "阻止消息",
-      "description": "IP被阻止时返回的消息",
-      "value": "Forbidden: Access denied"
-    },
-    "enable_cidr": {
-      "type": "boolean",
-      "title": "启用CIDR支持",
-      "description": "是否支持CIDR格式的IP段匹配",
-      "value": true
-    },
-    "trust_proxy": {
-      "type": "boolean",
-      "title": "信任代理",
-      "description": "是否信任X-Forwarded-For头获取真实IP",
-      "value": false
-    },
-    "request_limit": {
-      "type": "number",
-      "title": "请求限制数量",
-      "description": "在指定时间内允许的最大请求数",
-      "value": 1000,
-      "placeholder": "请输入数字"
-    },
-    "request_duration": {
-      "type": "number",
-      "title": "统计时间窗口（毫秒）",
-      "description": "请求计数的时间窗口，单位为毫秒",
-      "value": 60000,
-      "placeholder": "请输入毫秒数"
-    },
-    "request_block": {
-      "type": "boolean",
-      "title": "启用黑名单封禁",
-      "description": "是否将超限IP添加到系统防火墙黑名单",
-      "value": true
-    },
-    "blacklist_expire_time": {
-      "type": "number",
-      "title": "黑名单过期时间（毫秒）",
-      "description": "IP被添加到黑名单后自动失效的时间，单位为毫秒",
-      "value": 86400000,
-      "placeholder": "请输入毫秒数"
-    },
-    "persist_blacklist": {
-      "type": "boolean",
-      "title": "持久化黑名单",
-      "description": "系统重启后是否自动重新应用已保存的黑名单规则",
-      "value": true
-    }
-  }
-}

package/middleware/mqtt_base/index.js

@@ -1,10 +0,0 @@
-const MQTT = require('mm_mqtt');
-
-/**
- * MQTT基础
- * @param {Object} server 服务
- * @param {Object} config 配置参数
- */
-module.exports = function(server, config) {
-	return server;
-};

package/middleware/mqtt_base/middleware.json

@@ -1,11 +0,0 @@
-{
-	"mode": "mqtt",
-	"name": "mqtt_base",
-	"title": "MQTT通讯器",
-	"description": "用于MQTT通讯",
-	"version": "1.0",
-	"type": "web",
-	"process_type": "common_before",
-	"sort": 30,
-	"state": 1
-}