Binbim
b8788c239e
MCP Docker / build-and-push (push) Has been cancelled
- Remove telemetry: disabled all phone-home (installation notify, false positives, behavior tracking, upgrade tips) - Version branding: removed 'ce-' prefix, product name changed to '长亭雷池 WAF' - Detection engine enhancement: strict preset enables all 17 modules with aggressive configs - Multi-user RBAC: admin/operator/viewer roles with password + TOTP 2FA - Rate limiting: nginx limit_req per website (RPS, burst, action) - JS Challenge: browser fingerprint verification page with cookie-based bypass - Security fixes: removed InsecureSkipVerify, hardcoded credentials, NO_AUTH backdoor
75 lines
2.0 KiB
Go
75 lines
2.0 KiB
Go
package cmd
|
|
|
|
import (
|
|
"crypto/x509/pkix"
|
|
"path/filepath"
|
|
|
|
"chaitin.cn/patronus/safeline-2/management/webserver/pkg/config"
|
|
"chaitin.cn/patronus/safeline-2/management/webserver/pkg/constants"
|
|
"chaitin.cn/patronus/safeline-2/management/webserver/utils"
|
|
)
|
|
|
|
func GenCerts() error {
|
|
if err := genServerCert(); err != nil {
|
|
return err
|
|
}
|
|
if err := genClientCACert(); err != nil {
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func genServerCert() error {
|
|
certPath := filepath.Join(config.GlobalConfig.MgtResDir, constants.CertsPath, "server.crt")
|
|
keyPath := filepath.Join(config.GlobalConfig.MgtResDir, constants.CertsPath, "server.key")
|
|
if err := utils.WriteCertIfNotExist(
|
|
certPath,
|
|
keyPath,
|
|
func() ([]byte, []byte, error) {
|
|
return utils.GenerateCert(
|
|
[]string{},
|
|
3650,
|
|
4096,
|
|
&pkix.Name{
|
|
Country: []string{"CN"},
|
|
Province: []string{"Beijing"},
|
|
Locality: []string{"Beijing"},
|
|
Organization: []string{"Beijing WAF Technology Co., Ltd."},
|
|
OrganizationalUnit: []string{"Service Infrastructure Department"},
|
|
CommonName: "WAF Management Server",
|
|
},
|
|
false,
|
|
)
|
|
}); err != nil {
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func genClientCACert() error {
|
|
certPath := filepath.Join(config.GlobalConfig.MgtResDir, constants.CertsPath, "client_ca.crt")
|
|
keyPath := filepath.Join(config.GlobalConfig.MgtResDir, constants.CertsPath, "client_ca.key")
|
|
if err := utils.WriteCertIfNotExist(
|
|
certPath,
|
|
keyPath,
|
|
func() ([]byte, []byte, error) {
|
|
return utils.GenerateCert(
|
|
[]string{},
|
|
3650,
|
|
4096,
|
|
&pkix.Name{
|
|
Country: []string{"CN"},
|
|
Province: []string{"Beijing"},
|
|
Locality: []string{"Beijing"},
|
|
Organization: []string{"Beijing WAF Technology Co., Ltd."},
|
|
OrganizationalUnit: []string{"Service Infrastructure Department"},
|
|
CommonName: "WAF Client Certificate Authority",
|
|
},
|
|
true,
|
|
)
|
|
}); err != nil {
|
|
return err
|
|
}
|
|
return nil
|
|
}
|