quick <端口>
免域名模式，一键穿透，Ctrl+C 退出自动清理
+
quick <端口> --auth user:pass
免域名模式 + 密码保护，访问需登录验证
init
初始化配置，输入 API Token 和 Account ID
create <名称>
创建 Cloudflare Tunnel
add <名> <端口>
添加路由，自动创建 DNS CNAME 记录
+
add <名> <端口> --auth user:pass
添加路由 + 密码保护
remove <名称>
删除路由，同步清理 DNS 记录
up / down
启动 / 停止 cloudflared 守护进程
diff --git a/internal/authproxy/login.html b/internal/authproxy/login.html
new file mode 100644
index 0000000..856da1e
--- /dev/null
+++ b/internal/authproxy/login.html
@@ -0,0 +1,74 @@
+
+
+
+
+
+
cftunnel - 访问验证
+
+
+
+
+
cftunnel
+
此服务需要身份验证
+
用户名或密码错误
+
+
+
+
+
+
diff --git a/internal/authproxy/port.go b/internal/authproxy/port.go
new file mode 100644
index 0000000..25f6c57
--- /dev/null
+++ b/internal/authproxy/port.go
@@ -0,0 +1,19 @@
+package authproxy
+
+import (
+ "fmt"
+ "net"
+ "strconv"
+)
+
+// FindAvailableListener 从 startPort 开始探测，返回第一个可用的 listener
+// 直接返回 listener 而非端口号，避免 TOCTOU 竞态
+func FindAvailableListener(startPort int) (net.Listener, error) {
+ for p := startPort; p < startPort+100; p++ {
+ ln, err := net.Listen("tcp", "127.0.0.1:"+strconv.Itoa(p))
+ if err == nil {
+ return ln, nil
+ }
+ }
+ return nil, fmt.Errorf("在 %d-%d 范围内未找到可用端口", startPort, startPort+99)
+}
diff --git a/internal/authproxy/proxy.go b/internal/authproxy/proxy.go
new file mode 100644
index 0000000..7c7a172
--- /dev/null
+++ b/internal/authproxy/proxy.go
@@ -0,0 +1,189 @@
+package authproxy
+
+import (
+ "context"
+ "crypto/hmac"
+ "crypto/rand"
+ "crypto/sha256"
+ _ "embed"
+ "encoding/hex"
+ "fmt"
+ "net"
+ "net/http"
+ "net/http/httputil"
+ "net/url"
+ "strconv"
+ "strings"
+ "time"
+)
+
+//go:embed login.html
+var loginHTML []byte
+
+const cookieName = "__cftunnel_auth"
+const loginPath = "/___auth/login"
+
+// RandomKey 生成 32 字节随机签名密钥
+func RandomKey() []byte {
+ key := make([]byte, 32)
+ rand.Read(key)
+ return key
+}
+
+// Config 鉴权代理配置
+type Config struct {
+ Username string
+ Password string
+ TargetPort string
+ SigningKey []byte
+ CookieTTL time.Duration
+}
+
+// Proxy 鉴权反向代理
+type Proxy struct {
+ cfg Config
+ listener net.Listener
+ server *http.Server
+ reverse *httputil.ReverseProxy
+}
+
+// New 创建鉴权代理实例，自动探测可用端口
+func New(cfg Config) (*Proxy, error) {
+ port, _ := strconv.Atoi(cfg.TargetPort)
+ ln, err := FindAvailableListener(port + 1)
+ if err != nil {
+ return nil, err
+ }
+
+ target, _ := url.Parse("http://127.0.0.1:" + cfg.TargetPort)
+ rp := httputil.NewSingleHostReverseProxy(target)
+
+ if cfg.CookieTTL == 0 {
+ cfg.CookieTTL = 24 * time.Hour
+ }
+
+ p := &Proxy{
+ cfg: cfg,
+ listener: ln,
+ reverse: rp,
+ }
+ p.server = &http.Server{Handler: p}
+ return p, nil
+}
+
+// ListenPort 返回代理实际监听的端口
+func (p *Proxy) ListenPort() int {
+ return p.listener.Addr().(*net.TCPAddr).Port
+}
+
+// Start 非阻塞启动代理
+func (p *Proxy) Start() error {
+ go p.server.Serve(p.listener)
+ return nil
+}
+
+// Stop 优雅关闭代理
+func (p *Proxy) Stop() error {
+ ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+ defer cancel()
+ return p.server.Shutdown(ctx)
+}
+
+// ServeHTTP 核心路由逻辑
+func (p *Proxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+ // WebSocket 升级请求直接透传
+ if isWebSocket(r) {
+ p.reverse.ServeHTTP(w, r)
+ return
+ }
+
+ // 登录表单提交
+ if r.Method == http.MethodPost && r.URL.Path == loginPath {
+ p.handleLogin(w, r)
+ return
+ }
+
+ // 检查 Cookie 鉴权
+ if p.checkAuth(r) {
+ p.reverse.ServeHTTP(w, r)
+ return
+ }
+
+ // 未认证，返回登录页
+ w.Header().Set("Content-Type", "text/html; charset=utf-8")
+ w.WriteHeader(http.StatusOK)
+ w.Write(loginHTML)
+}
+
+// handleLogin 处理登录表单提交
+func (p *Proxy) handleLogin(w http.ResponseWriter, r *http.Request) {
+ username := r.FormValue("username")
+ password := r.FormValue("password")
+
+ if username != p.cfg.Username || password != p.cfg.Password {
+ http.Redirect(w, r, "/?error=1", http.StatusSeeOther)
+ return
+ }
+
+ // 签发 Cookie
+ expiry := time.Now().Add(p.cfg.CookieTTL).Unix()
+ payload := fmt.Sprintf("%s:%x", username, expiry)
+ sig := signPayload(p.cfg.SigningKey, payload)
+ value := payload + "." + sig
+
+ http.SetCookie(w, &http.Cookie{
+ Name: cookieName,
+ Value: value,
+ Path: "/",
+ MaxAge: int(p.cfg.CookieTTL.Seconds()),
+ HttpOnly: true,
+ Secure: true,
+ SameSite: http.SameSiteLaxMode,
+ })
+ http.Redirect(w, r, "/", http.StatusSeeOther)
+}
+
+// checkAuth 校验请求中的鉴权 Cookie
+func (p *Proxy) checkAuth(r *http.Request) bool {
+ cookie, err := r.Cookie(cookieName)
+ if err != nil {
+ return false
+ }
+
+ // 格式：username:expiry_hex.hmac_hex
+ dotIdx := strings.LastIndex(cookie.Value, ".")
+ if dotIdx < 0 {
+ return false
+ }
+ payload := cookie.Value[:dotIdx]
+ sig := cookie.Value[dotIdx+1:]
+
+ // 验证签名
+ if signPayload(p.cfg.SigningKey, payload) != sig {
+ return false
+ }
+
+ // 验证过期时间
+ colonIdx := strings.LastIndex(payload, ":")
+ if colonIdx < 0 {
+ return false
+ }
+ expiryHex := payload[colonIdx+1:]
+ expiry, err := strconv.ParseInt(expiryHex, 16, 64)
+ if err != nil {
+ return false
+ }
+ return time.Now().Unix() < expiry
+}
+
+// signPayload 使用 HMAC-SHA256 签名
+func signPayload(key []byte, payload string) string {
+ mac := hmac.New(sha256.New, key)
+ mac.Write([]byte(payload))
+ return hex.EncodeToString(mac.Sum(nil))
+}
+
+// isWebSocket 检测是否为 WebSocket 升级请求
+func isWebSocket(r *http.Request) bool {
+ return strings.EqualFold(r.Header.Get("Upgrade"), "websocket")
+}
diff --git a/internal/config/config.go b/internal/config/config.go
index a5eeb2f..929bcb4 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -29,11 +29,28 @@ type TunnelConfig struct {
}
type RouteConfig struct {
- Name string `yaml:"name"`
- Hostname string `yaml:"hostname"`
- Service string `yaml:"service"`
- ZoneID string `yaml:"zone_id"`
- DNSRecordID string `yaml:"dns_record_id"`
+ Name string `yaml:"name"`
+ Hostname string `yaml:"hostname"`
+ Service string `yaml:"service"`
+ ZoneID string `yaml:"zone_id"`
+ DNSRecordID string `yaml:"dns_record_id"`
+ Auth *AuthProxy `yaml:"auth,omitempty"`
+}
+
+// AuthProxy 鉴权代理配置
+type AuthProxy struct {
+ Username string `yaml:"username"`
+ Password string `yaml:"password"`
+ SigningKey string `yaml:"signing_key,omitempty"`
+ CookieTTL int `yaml:"cookie_ttl,omitempty"` // 秒，默认 86400
+}
+
+// CookieTTLOrDefault 返回 Cookie 有效期（秒），默认 86400
+func (a *AuthProxy) CookieTTLOrDefault() int {
+ if a.CookieTTL > 0 {
+ return a.CookieTTL
+ }
+ return 86400
}
type CloudflaredConfig struct {
diff --git a/internal/daemon/quick.go b/internal/daemon/quick.go
index 20b99eb..4f9783b 100644
--- a/internal/daemon/quick.go
+++ b/internal/daemon/quick.go
@@ -8,6 +8,9 @@ import (
"os/exec"
"os/signal"
"strings"
+ "time"
+
+ "github.com/qingchencloud/cftunnel/internal/authproxy"
)
// StartQuick 启动免域名模式（前台运行，Ctrl+C 退出）
@@ -78,3 +81,65 @@ func extractURL(line string) string {
}
return ""
}
+
+// StartQuickWithAuth 启动带鉴权代理的免域名模式
+func StartQuickWithAuth(port, username, password string) error {
+ binPath, err := EnsureCloudflared()
+ if err != nil {
+ return err
+ }
+ if Running() {
+ return fmt.Errorf("cloudflared 已在运行，请先执行 cftunnel down")
+ }
+
+ // 启动鉴权代理
+ proxy, err := authproxy.New(authproxy.Config{
+ Username: username,
+ Password: password,
+ TargetPort: port,
+ SigningKey: authproxy.RandomKey(),
+ CookieTTL: 24 * time.Hour,
+ })
+ if err != nil {
+ return fmt.Errorf("启动鉴权代理失败: %w", err)
+ }
+ if err := proxy.Start(); err != nil {
+ return fmt.Errorf("启动鉴权代理失败: %w", err)
+ }
+ defer proxy.Stop()
+
+ proxyPort := fmt.Sprintf("%d", proxy.ListenPort())
+ fmt.Printf("鉴权代理已启动 127.0.0.1:%s → 127.0.0.1:%s\n", proxyPort, port)
+
+ // cloudflared 指向代理端口
+ cmd := exec.Command(binPath, "tunnel", "--url", "http://localhost:"+proxyPort)
+
+ stderr, err := cmd.StderrPipe()
+ if err != nil {
+ return err
+ }
+ cmd.Stdout = os.Stdout
+
+ if err := cmd.Start(); err != nil {
+ return fmt.Errorf("启动 cloudflared 失败: %w", err)
+ }
+
+ go scanForURL(stderr)
+
+ sig := make(chan os.Signal, 1)
+ signal.Notify(sig, os.Interrupt)
+
+ done := make(chan error, 1)
+ go func() { done <- cmd.Wait() }()
+
+ select {
+ case <-sig:
+ stopChildProcess(cmd)
+ <-done
+ case err := <-done:
+ if err != nil {
+ return fmt.Errorf("cloudflared 异常退出: %w", err)
+ }
+ }
+ return nil
+}