opensource/SamWaf
3
0
Fork 0
mirror of https://gitee.com/samwaf/SamWaf.git synced 2026-10-30 17:51:44 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add dns check time

Browse Source 
Add log output
Remove old env
This commit is contained in:
lvshujun
2026-03-25 18:24:26 +08:00
parent 9aa827560c
commit 38e242e5c7
3 changed files with 97 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
utils/ssl/ssl.go
+57 -11
View File
@@ -1,6 +1,7 @@
package ssl
import (
"SamWaf/common/zlog"
"SamWaf/model"
"SamWaf/utils"
"crypto"
@@ -93,18 +94,23 @@ func RegistrationSSL(order model.SslOrder, savePath string, caServerAddress stri
// because we aren't running as root and can't bind a listener to port 80 and 443
// (used later when we attempt to pass challenges). Keep in mind that you still
// need to proxy challenge traffic to port 5002 and 5001.
if order.ApplyMethod == "http01" {
switch order.ApplyMethod {
case "http01":
provider, err := webroot.NewHTTPProvider(savePath)
if err != nil {
return order, err
}
err = client.Challenge.SetHTTP01Provider(provider)
} else if order.ApplyMethod == "dns01" {
case "dns01":
dnsProvider, err := GetDnsProvider(order.ApplyDns)
if err != nil {
zlog.Error(fmt.Sprintf("Failed to initialize DNS provider `%s`: %v", order.ApplyDns, err))
return order, err
}
err = setDNS01ProviderWithRetry(client, dnsProvider, order.SkipDNSVerify)
if err != nil {
zlog.Error(fmt.Sprintf("Failed to set DNS-01 provider: %v", err))
}
}
if err != nil {
@@ -134,6 +140,11 @@ func RegistrationSSL(order model.SslOrder, savePath string, caServerAddress stri
certificates := &certificate.Resource{}
if !isIpSSL {
// 诊断域名权威 NS
if order.ApplyMethod == "dns01" {
DiagnoseDomainNS(order.ApplyDomain)
}
request := certificate.ObtainRequest{
Domains: strings.Split(order.ApplyDomain, ","),
Bundle: true,
@@ -187,7 +198,6 @@ func RegistrationSSL(order model.SslOrder, savePath string, caServerAddress stri
}
// Each certificate comes back with the cert bytes, the bytes of the client's
// private key, and a certificate URL. SAVE THESE TO DISK.
fmt.Printf("%#v\n", certificates)
order.ResultPrivateKey = certificates.PrivateKey
order.ResultCertificate = certificates.Certificate
@@ -270,9 +280,13 @@ func ReNewSSL(order model.SslOrder, savePath string, caServerAddress string, app
} else if order.ApplyMethod == "dns01" {
dnsProvider, err := GetDnsProvider(order.ApplyDns)
if err != nil {
zlog.Error(fmt.Sprintf("Failed to initialize DNS provider `%s`: %v", order.ApplyDns, err))
return order, err
}
err = setDNS01ProviderWithRetry(client, dnsProvider, order.SkipDNSVerify)
if err != nil {
zlog.Error(fmt.Sprintf("Failed to set DNS-01 provider: %v", err))
}
}
if err != nil {
@@ -303,6 +317,11 @@ func ReNewSSL(order model.SslOrder, savePath string, caServerAddress string, app
certificates := &certificate.Resource{}
if !isIpSSL {
// 诊断域名权威 NS
if order.ApplyMethod == "dns01" {
DiagnoseDomainNS(order.ApplyDomain)
}
// 域名证书：使用续期方式
certRes := certificate.Resource{
Domain: order.ResultDomain,
@@ -365,7 +384,6 @@ func ReNewSSL(order model.SslOrder, savePath string, caServerAddress string, app
// Each certificate comes back with the cert bytes, the bytes of the client's
// private key, and a certificate URL. SAVE THESE TO DISK.
fmt.Printf("%#v\n", certificates)
order.ResultPrivateKey = certificates.PrivateKey
order.ResultCertificate = certificates.Certificate
@@ -431,13 +449,10 @@ func GetDnsProvider(dnsName string) (challenge.Provider, error) {
case "huaweicloud":
return huaweicloud.NewDNSProvider()
case "tencentcloud":
return tencentcloud.NewDNSProvider()
case "cloudflare":
return cloudflare.NewDNSProvider()
case "baiducloud":
return baiducloud.NewDNSProvider()
default:
return nil, fmt.Errorf("unrecognized DNS provider: %s", dnsName)
@@ -445,13 +460,16 @@ func GetDnsProvider(dnsName string) (challenge.Provider, error) {
}
func setDNS01ProviderWithRetry(client *lego.Client, dnsProvider challenge.Provider, skipDNSVerify int64) error {
// 默认重试3次，每次间隔15秒
dnsPrecheckRetry := 3
dnsPrecheckRetryInterval := 15 * time.Second
// 默认重试10次，每次间隔30秒
dnsPrecheckRetry := 10
dnsPrecheckRetryInterval := 30 * time.Second
// DNS 传播等待时间：300秒（3分钟）
propagationTimeout := 180 * time.Second
if skipDNSVerify == 1 {
// 跳过本地DNS传播校验：固定等待后直接通知CA进行验证
return client.Challenge.SetDNS01Provider(dnsProvider, dns01.PropagationWait(60*time.Second, true))
return client.Challenge.SetDNS01Provider(dnsProvider, dns01.PropagationWait(propagationTimeout, true))
}
// 默认执行本地DNS传播校验，并增加重试机制
@@ -476,3 +494,31 @@ func setDNS01ProviderWithRetry(client *lego.Client, dnsProvider challenge.Provid
}),
)
}
// DiagnoseDomainNS 诊断域名的权威 NS 服务器
func DiagnoseDomainNS(domain string) error {
zlog.Info(fmt.Sprintf("Checking authoritative nameservers for domain: %s", domain))
// 查询域名的权威 NS 记录
nameServers, err := net.LookupNS(domain)
if err != nil {
zlog.Warn(fmt.Sprintf("Failed to lookup NS records for %s: %v", domain, err))
return err
}
// 检查是否是预期的 DNS 提供商
nsStr := strings.ToLower(fmt.Sprintf("%v", nameServers))
if strings.Contains(nsStr, "dnspod") || strings.Contains(nsStr, "tencent") {
zlog.Info(fmt.Sprintf("Domain %s is managed by Tencent Cloud DNSPod", domain))
} else if strings.Contains(nsStr, "alidns") || strings.Contains(nsStr, "alibaba") {
zlog.Warn(fmt.Sprintf("Domain %s appears to be managed by Alibaba Cloud (not Tencent Cloud)", domain))
} else if strings.Contains(nsStr, "huawei") {
zlog.Warn(fmt.Sprintf("Domain %s appears to be managed by Huawei Cloud (not Tencent Cloud)", domain))
} else if strings.Contains(nsStr, "cloudflare") {
zlog.Warn(fmt.Sprintf("Domain %s appears to be managed by Cloudflare (not Tencent Cloud)", domain))
} else {
zlog.Warn(fmt.Sprintf("Domain %s's authoritative NS is not recognized. Make sure NS records point to your DNS provider", domain))
}
return nil
}
wafenginecore/sslorder.go
+1
View File
@@ -31,6 +31,7 @@ func (waf *WafEngine) ApplySSLOrder(chanType int, bean model.SslOrder) {
//加载环境变量
privateGroupName := bean.PrivateGroupName
privateGroupBelongCloud := bean.ApplyDns
zlog.Debug(fmt.Sprintf("Loading DNS provider env info - Group: `%s`, Cloud: `%s` for domain: %s", privateGroupName, privateGroupBelongCloud, bean.ApplyDomain))
//查询环境变量信息
wafssl.LoadDnsProviderEnvInfo(privateGroupName, privateGroupBelongCloud)
}
wafssl/wafssl.go
+39 -12
View File
@@ -11,19 +11,46 @@ import (
// LoadDnsProviderEnvInfo 初始化dns所需要的参数信息
func LoadDnsProviderEnvInfo(groupName string, belongCloud string) {
privateInfos, _, err := waf_service.WafPrivateInfoServiceApp.GetListByGroupAndBelongCloudPureApi(groupName, belongCloud)
if err == nil {
for _, info := range privateInfos {
err := os.Setenv(info.PrivateKey, info.PrivateValue)
if err != nil {
return
} else {
zlog.Info(fmt.Sprintf("Cloud `%s` Group `%s` ENV `%s` LOADED", belongCloud, groupName, info.PrivateKey))
}
}
// 清除旧的 DNS provider 相关环境变量，防止污染
dnsEnvKeys := []string{
// Tencent Cloud
"TENCENTCLOUD_SECRET_ID", "TENCENTCLOUD_SECRET_KEY", "TENCENTCLOUD_REGION",
// Alibaba Cloud
"ALICLOUD_ACCESS_KEY", "ALICLOUD_SECRET_KEY", "ALICLOUD_REGION_ID",
// Huawei Cloud
"HUAWEICLOUD_DOMAIN_NAME", "HUAWEICLOUD_ACCESS_KEY_ID", "HUAWEICLOUD_ACCESS_KEY_SECRET", "HUAWEICLOUD_REGION",
// Cloudflare
"CLOUDFLARE_API_TOKEN", "CLOUDFLARE_API_KEY", "CLOUDFLARE_ACCOUNT_ID",
// Baidu Cloud
"BAIDUCLOUD_ACCESS_KEY", "BAIDUCLOUD_SECRET_ACCESS_KEY", "BAIDUCLOUD_REGION",
}
for _, key := range dnsEnvKeys {
os.Unsetenv(key)
}
privateInfos, _, err := waf_service.WafPrivateInfoServiceApp.GetListByGroupAndBelongCloudPureApi(groupName, belongCloud)
if err != nil {
zlog.Error(fmt.Sprintf("Failed to load DNS provider env info for cloud `%s` group `%s`: %v", belongCloud, groupName, err))
return
}
if len(privateInfos) == 0 {
zlog.Warn(fmt.Sprintf("No DNS credentials found in DB for cloud `%s` group `%s` - DNS provider will have no auth", belongCloud, groupName))
return
}
for _, info := range privateInfos {
err := os.Setenv(info.PrivateKey, info.PrivateValue)
if err != nil {
zlog.Error(fmt.Sprintf("Failed to set env var `%s`: %v", info.PrivateKey, err))
return
}
zlog.Info(fmt.Sprintf("Cloud `%s` Group `%s` ENV `%s` LOADED", belongCloud, groupName, info.PrivateKey))
}
zlog.Info(fmt.Sprintf("Successfully loaded %d credentials for cloud `%s` group `%s`", len(privateInfos), belongCloud, groupName))
if global.GWAF_RELEASE == "false" {
fmt.Println("当前环境变量：")
zlog.Debug("Current DNS-related environment variables:")
for _, env := range os.Environ() {
parts := strings.SplitN(env, "=", 2)
key := parts[0]
@@ -31,7 +58,7 @@ func LoadDnsProviderEnvInfo(groupName string, belongCloud string) {
if len(parts) > 1 {
value = parts[1]
}
fmt.Printf("%s = %s\n", key, value)
zlog.Debug(fmt.Sprintf("%s = %s", key, value))
}
}
}