mirror of
https://github.com/Buriburizaem0n/nezha_domains.git
synced 2026-11-04 08:40:20 +00:00
xvkong233
3ad985f36e
The initial selective strip covered only the Authorization header, but the dashboard also accepts its JWT via the ?token= query parameter and the nz-jwt cookie (jwt.go TokenLookup channels). A dashboard credential arriving through those channels would still reach a NAT backend. Apply the same classify-then-strip rule to all three channels at NAT ingress: values verified as dashboard-issued are removed, foreign values are preserved byte-for-byte. Adds a ServeNAT flow test exercising the live classifier and a wiring test pinning the gate injection in main().
31 lines
1000 B
Go
31 lines
1000 B
Go
//go:build !agentcompat
|
|
|
|
package rpc
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/nezhahq/nezha/model"
|
|
serviceRPC "github.com/nezhahq/nezha/service/rpc"
|
|
)
|
|
|
|
type natCapabilityLease struct {
|
|
active bool
|
|
publicationOwned bool
|
|
streamLease *serviceRPC.AgentCompatNATStreamLease
|
|
access serviceRPC.AgentCompatCapabilityAccess
|
|
handle serviceRPC.AgentCompatNATPublishHandle
|
|
}
|
|
|
|
func prepareNATCapability(request *http.Request, _ *model.NAT) (natCapabilityLease, error) {
|
|
// The default build has no capability protocol: every request takes the
|
|
// legacy NAT path, so any dashboard-issued credential (panel JWT or panel
|
|
// PAT) carried by the Authorization header, the ?token= query parameter or
|
|
// the nz-jwt cookie is stripped before the request is tunneled to the
|
|
// agent. Foreign values are ordinary request data and stay put.
|
|
stripDashboardCredentials(request)
|
|
return natCapabilityLease{}, nil
|
|
}
|
|
|
|
func (lease natCapabilityLease) cleanup(*serviceRPC.NezhaHandler) {}
|