mirror of
https://github.com/MengMengCode/CLICD.git
synced 2026-08-05 05:36:07 +08:00
MengMengCode
38debab1aa
- Implement tests for custom KVM and LXC image creation, ensuring invalid sources and architecture mismatches are rejected. - Introduce access policy management in CLI, allowing configuration of allowed sources and trusted proxies. - Add NAT network configuration with validation for RFC1918 compliance and subnet parsing. - Create panel access policy management, including normalization and evaluation of access decisions based on client IPs and forwarded headers. - Develop middleware for enforcing access policies in the server, returning appropriate responses for allowed and denied requests. - Enhance custom image downloading and validation, ensuring integrity and security of downloaded root filesystem archives. - Include comprehensive tests for all new functionalities to ensure reliability and correctness.
87 lines
2.6 KiB
Go
87 lines
2.6 KiB
Go
package cli
|
|
|
|
import (
|
|
"flag"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"clicd/internal/config"
|
|
)
|
|
|
|
// RunAccessPolicyCommand manages the panel source policy without requiring the
|
|
// interactive menu. It is intended to remain usable over SSH as a recovery path.
|
|
func RunAccessPolicyCommand(args []string) error {
|
|
action := "show"
|
|
if len(args) > 0 {
|
|
action = strings.ToLower(strings.TrimSpace(args[0]))
|
|
args = args[1:]
|
|
}
|
|
|
|
switch action {
|
|
case "show":
|
|
printPanelAccessPolicy(config.AppConfig.PanelAccessPolicy)
|
|
return nil
|
|
case "disable", "off":
|
|
next := config.AppConfig.PanelAccessPolicy
|
|
next.Enabled = false
|
|
if err := savePanelAccessPolicy(next); err != nil {
|
|
return err
|
|
}
|
|
fmt.Println("Panel access allowlist disabled.")
|
|
return reloadPanelAfterAccessPolicyCommand()
|
|
case "set", "enable":
|
|
flags := flag.NewFlagSet("clicd access-policy set", flag.ContinueOnError)
|
|
flags.SetOutput(new(strings.Builder))
|
|
var allowed string
|
|
var trusted string
|
|
flags.StringVar(&allowed, "allow", "", "comma-separated allowed IP/CIDR values")
|
|
flags.StringVar(&trusted, "trusted-proxy", "", "comma-separated trusted proxy IP/CIDR values")
|
|
if err := flags.Parse(args); err != nil {
|
|
return fmt.Errorf("invalid access-policy arguments: %w", err)
|
|
}
|
|
next := config.PanelAccessPolicy{
|
|
Enabled: true,
|
|
AllowedSources: splitPanelAccessEntries(allowed),
|
|
TrustedProxies: splitPanelAccessEntries(trusted),
|
|
}
|
|
if err := savePanelAccessPolicy(next); err != nil {
|
|
return err
|
|
}
|
|
fmt.Println("Panel access allowlist saved.")
|
|
printPanelAccessPolicy(config.AppConfig.PanelAccessPolicy)
|
|
return reloadPanelAfterAccessPolicyCommand()
|
|
default:
|
|
return fmt.Errorf("unknown access-policy action %q; use show, set, or disable", action)
|
|
}
|
|
}
|
|
|
|
func savePanelAccessPolicy(policy config.PanelAccessPolicy) error {
|
|
normalized, err := config.NormalizePanelAccessPolicy(policy)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
previous := config.AppConfig.PanelAccessPolicy
|
|
config.AppConfig.PanelAccessPolicy = normalized
|
|
if err := config.SaveConfig(); err != nil {
|
|
config.AppConfig.PanelAccessPolicy = previous
|
|
return fmt.Errorf("save panel access policy: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func reloadPanelAfterAccessPolicyCommand() error {
|
|
if !isWebPanelRunning() {
|
|
return nil
|
|
}
|
|
if err := restartService("clicd"); err != nil {
|
|
return fmt.Errorf("policy was saved but clicd service restart failed: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func printPanelAccessPolicy(policy config.PanelAccessPolicy) {
|
|
fmt.Printf("Enabled: %t\n", policy.Enabled)
|
|
fmt.Printf("Allowed sources: %s\n", strings.Join(policy.AllowedSources, ", "))
|
|
fmt.Printf("Trusted proxies: %s\n", strings.Join(policy.TrustedProxies, ", "))
|
|
}
|