feat(server): trust configured Unix socket requests

internal/bootstrap/run.go

@@ -170,7 +170,11 @@ func Start() {
 	if conf.Conf.Scheme.UnixFile != "" {
 		fmt.Printf("start unix server @ %s\n", conf.Conf.Scheme.UnixFile)
 		utils.Log.Infof("start unix server @ %s", conf.Conf.Scheme.UnixFile)
-		unixSrv = &http.Server{Handler: httpHandler}
+		unixHandler := httpHandler
+		if conf.Conf.Scheme.UnixFileTrusted {
+			unixHandler = middlewares.UnixFileTrusted(unixHandler)
+		}
+		unixSrv = &http.Server{Handler: unixHandler}
 		go func() {
 			listener, err := net.Listen("unix", conf.Conf.Scheme.UnixFile)
 			if err != nil {

internal/conf/config.go

@@ -26,16 +26,17 @@ type Meilisearch struct {
 }
 
 type Scheme struct {
-	Address      string `json:"address" env:"ADDR"`
-	HttpPort     int    `json:"http_port" env:"HTTP_PORT"`
-	HttpsPort    int    `json:"https_port" env:"HTTPS_PORT"`
-	ForceHttps   bool   `json:"force_https" env:"FORCE_HTTPS"`
-	CertFile     string `json:"cert_file" env:"CERT_FILE"`
-	KeyFile      string `json:"key_file" env:"KEY_FILE"`
-	UnixFile     string `json:"unix_file" env:"UNIX_FILE"`
-	UnixFilePerm string `json:"unix_file_perm" env:"UNIX_FILE_PERM"`
-	EnableH2c    bool   `json:"enable_h2c" env:"ENABLE_H2C"`
-	EnableH3     bool   `json:"enable_h3" env:"ENABLE_H3"`
+	Address         string `json:"address" env:"ADDR"`
+	HttpPort        int    `json:"http_port" env:"HTTP_PORT"`
+	HttpsPort       int    `json:"https_port" env:"HTTPS_PORT"`
+	ForceHttps      bool   `json:"force_https" env:"FORCE_HTTPS"`
+	CertFile        string `json:"cert_file" env:"CERT_FILE"`
+	KeyFile         string `json:"key_file" env:"KEY_FILE"`
+	UnixFile        string `json:"unix_file" env:"UNIX_FILE"`
+	UnixFileTrusted bool   `json:"unix_file_trusted" env:"UNIX_FILE_TRUSTED"`
+	UnixFilePerm    string `json:"unix_file_perm" env:"UNIX_FILE_PERM"`
+	EnableH2c       bool   `json:"enable_h2c" env:"ENABLE_H2C"`
+	EnableH3        bool   `json:"enable_h3" env:"ENABLE_H3"`
 }
 
 type LogConfig struct {

server/middlewares/auth.go

@@ -1,7 +1,9 @@
 package middlewares
 
 import (
+	"context"
 	"crypto/subtle"
+	"net/http"
 
 	"github.com/OpenListTeam/OpenList/v4/internal/conf"
 	"github.com/OpenListTeam/OpenList/v4/internal/model"
@@ -16,6 +18,9 @@ import (
 // if token is empty, set user to guest
 func Auth(allowDisabledGuest bool) func(c *gin.Context) {
 	return func(c *gin.Context) {
+		if authenticateUnixFileTrusted(c) {
+			return
+		}
 		token := c.GetHeader("Authorization")
 		if subtle.ConstantTimeCompare([]byte(token), []byte(setting.GetStr(conf.Token))) == 1 {
 			admin, err := op.GetAdmin()
@@ -76,6 +81,9 @@ func Auth(allowDisabledGuest bool) func(c *gin.Context) {
 }
 
 func Authn(c *gin.Context) {
+	if authenticateUnixFileTrusted(c) {
+		return
+	}
 	token := c.GetHeader("Authorization")
 	if subtle.ConstantTimeCompare([]byte(token), []byte(setting.GetStr(conf.Token))) == 1 {
 		admin, err := op.GetAdmin()
@@ -129,6 +137,36 @@ func Authn(c *gin.Context) {
 	c.Next()
 }
 
+func authenticateUnixFileTrusted(c *gin.Context) bool {
+	if !IsUnixFileTrusted(c) {
+		return false
+	}
+	admin, err := op.GetAdmin()
+	if err != nil {
+		common.ErrorResp(c, err, 500)
+		c.Abort()
+		return true
+	}
+	common.GinAppendValues(c, conf.UserKey, admin)
+	log.Debug("use admin identity for trusted Unix socket request")
+	c.Next()
+	return true
+}
+
+type unixFileTrustedKey struct{}
+
+func UnixFileTrusted(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ctx := context.WithValue(r.Context(), unixFileTrustedKey{}, true)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+func IsUnixFileTrusted(c *gin.Context) bool {
+	trusted, _ := c.Request.Context().Value(unixFileTrustedKey{}).(bool)
+	return conf.Conf.Scheme.UnixFileTrusted && trusted
+}
+
 func AuthNotGuest(c *gin.Context) {
 	user := c.Request.Context().Value(conf.UserKey).(*model.User)
 	if user.IsGuest() {

server/middlewares/down.go

@@ -31,7 +31,7 @@ func Down(verifyFunc func(string, string) error) func(c *gin.Context) {
 		}
 		common.GinAppendValues(c, conf.MetaKey, meta)
 		// verify sign
-		if needSign(meta, rawPath) {
+		if !IsUnixFileTrusted(c) && needSign(meta, rawPath) {
 			s := c.Query("sign")
 			err = verifyFunc(rawPath, strings.TrimSuffix(s, "/"))
 			if err != nil {

server/webdav.go

@@ -48,6 +48,17 @@ func ServeWebDAV(c *gin.Context) {
 }
 
 func WebDAVAuth(c *gin.Context) {
+	if middlewares.IsUnixFileTrusted(c) {
+		admin, err := op.GetAdmin()
+		if err != nil {
+			common.ErrorResp(c, err, http.StatusInternalServerError)
+			c.Abort()
+			return
+		}
+		common.GinAppendValues(c, conf.UserKey, admin)
+		c.Next()
+		return
+	}
 	// check count of login
 	ip := c.ClientIP()
 	guest, _ := op.GetGuest()