mirror of
https://github.com/clash-verge-rev/clash-verge-rev.git
synced 2026-01-29 08:45:41 +08:00
feat: add authenticated service IPC communication
This commit is contained in:
wonfen
484
src-tauri/src/core/service_ipc.rs
Normal file
484
src-tauri/src/core/service_ipc.rs
Normal file
@@ -0,0 +1,484 @@
|
||||
use crate::logging;
|
||||
use crate::utils::logging::Type;
|
||||
use anyhow::{bail, Context, Result};
|
||||
use hmac::{Hmac, Mac};
|
||||
use serde::{Deserialize, Serialize};
|
||||
use sha2::{Digest, Sha256};
|
||||
use std::time::{SystemTime, UNIX_EPOCH};
|
||||
|
||||
const IPC_SOCKET_NAME: &str = if cfg!(windows) {
|
||||
r"\\.\pipe\clash-verge-service"
|
||||
} else {
|
||||
"/tmp/clash-verge-service.sock"
|
||||
};
|
||||
|
||||
// 定义命令类型
|
||||
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
|
||||
pub enum IpcCommand {
|
||||
GetClash,
|
||||
GetVersion,
|
||||
StartClash,
|
||||
StopClash,
|
||||
}
|
||||
|
||||
// IPC消息格式
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct IpcRequest {
|
||||
pub id: String,
|
||||
pub timestamp: u64,
|
||||
pub command: IpcCommand,
|
||||
pub payload: serde_json::Value,
|
||||
pub signature: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct IpcResponse {
|
||||
pub id: String,
|
||||
pub success: bool,
|
||||
pub data: Option<serde_json::Value>,
|
||||
pub error: Option<String>,
|
||||
pub signature: String,
|
||||
}
|
||||
|
||||
// 密钥派生函数
|
||||
fn derive_secret_key() -> Vec<u8> {
|
||||
// to do
|
||||
// 从系统安全存储中获取或从程序安装时生成的密钥文件中读取
|
||||
let unique_app_id = "clash-verge-app-secret-fuck-me-until-daylight";
|
||||
let mut hasher = Sha256::new();
|
||||
hasher.update(unique_app_id.as_bytes());
|
||||
hasher.finalize().to_vec()
|
||||
}
|
||||
|
||||
// 创建带签名的请求
|
||||
pub fn create_signed_request(
|
||||
command: IpcCommand,
|
||||
payload: serde_json::Value,
|
||||
) -> Result<IpcRequest> {
|
||||
let id = nanoid::nanoid!(32);
|
||||
|
||||
let timestamp = SystemTime::now()
|
||||
.duration_since(UNIX_EPOCH)
|
||||
.unwrap_or_default()
|
||||
.as_secs();
|
||||
|
||||
let unsigned_request = IpcRequest {
|
||||
id: id.clone(),
|
||||
timestamp,
|
||||
command: command.clone(),
|
||||
payload: payload.clone(),
|
||||
signature: String::new(),
|
||||
};
|
||||
|
||||
let unsigned_json = serde_json::to_string(&unsigned_request)?;
|
||||
let signature = sign_message(&unsigned_json)?;
|
||||
|
||||
Ok(IpcRequest {
|
||||
id,
|
||||
timestamp,
|
||||
command,
|
||||
payload,
|
||||
signature,
|
||||
})
|
||||
}
|
||||
|
||||
// 签名消息
|
||||
fn sign_message(message: &str) -> Result<String> {
|
||||
type HmacSha256 = Hmac<Sha256>;
|
||||
|
||||
let secret_key = derive_secret_key();
|
||||
let mut mac = HmacSha256::new_from_slice(&secret_key).context("HMAC初始化失败")?;
|
||||
|
||||
mac.update(message.as_bytes());
|
||||
let result = mac.finalize();
|
||||
let signature = hex::encode(result.into_bytes());
|
||||
|
||||
Ok(signature)
|
||||
}
|
||||
|
||||
// 验证响应签名
|
||||
pub fn verify_response_signature(response: &IpcResponse) -> Result<bool> {
|
||||
let verification_response = IpcResponse {
|
||||
id: response.id.clone(),
|
||||
success: response.success,
|
||||
data: response.data.clone(),
|
||||
error: response.error.clone(),
|
||||
signature: String::new(),
|
||||
};
|
||||
|
||||
let message = serde_json::to_string(&verification_response)?;
|
||||
let expected_signature = sign_message(&message)?;
|
||||
|
||||
Ok(expected_signature == response.signature)
|
||||
}
|
||||
|
||||
// IPC连接管理-win
|
||||
#[cfg(target_os = "windows")]
|
||||
pub async fn send_ipc_request(
|
||||
command: IpcCommand,
|
||||
payload: serde_json::Value,
|
||||
) -> Result<IpcResponse> {
|
||||
use std::ffi::CString;
|
||||
use std::fs::File;
|
||||
use std::io::{Read, Write};
|
||||
use std::os::windows::io::{FromRawHandle, RawHandle};
|
||||
use std::ptr;
|
||||
use winapi::um::fileapi::CreateFileA;
|
||||
use winapi::um::winbase::{PIPE_READMODE_MESSAGE, PIPE_TYPE_MESSAGE, PIPE_WAIT};
|
||||
use winapi::um::winnt::OPEN_EXISTING;
|
||||
use winapi::um::winnt::{
|
||||
FILE_SHARE_READ, FILE_SHARE_WRITE, GENERIC_READ, GENERIC_WRITE, HANDLE,
|
||||
};
|
||||
|
||||
logging!(
|
||||
info,
|
||||
Type::Service,
|
||||
true,
|
||||
"准备发送IPC请求到Windows命名管道: {}",
|
||||
IPC_SOCKET_NAME
|
||||
);
|
||||
logging!(
|
||||
debug,
|
||||
Type::Service,
|
||||
true,
|
||||
"IPC请求: 命令={:?}, 数据大小={}字节",
|
||||
command,
|
||||
serde_json::to_string(&payload)?.len()
|
||||
);
|
||||
|
||||
let command_type = format!("{:?}", command);
|
||||
|
||||
let request = match create_signed_request(command, payload) {
|
||||
Ok(req) => {
|
||||
logging!(
|
||||
debug,
|
||||
Type::Service,
|
||||
true,
|
||||
"创建签名请求成功: ID={}",
|
||||
req.id
|
||||
);
|
||||
req
|
||||
}
|
||||
Err(e) => {
|
||||
logging!(error, Type::Service, true, "创建签名请求失败: {}", e);
|
||||
return Err(e);
|
||||
}
|
||||
};
|
||||
|
||||
let request_json = serde_json::to_string(&request)?;
|
||||
logging!(
|
||||
debug,
|
||||
Type::Service,
|
||||
true,
|
||||
"请求JSON大小: {}字节",
|
||||
request_json.len()
|
||||
);
|
||||
logging!(debug, Type::Service, true, "尝试连接Windows命名管道...");
|
||||
|
||||
let result = tokio::task::spawn_blocking(move || -> Result<IpcResponse> {
|
||||
let c_pipe_name = match CString::new(IPC_SOCKET_NAME) {
|
||||
Ok(name) => name,
|
||||
Err(e) => {
|
||||
logging!(error, Type::Service, true, "创建CString失败: {}", e);
|
||||
return Err(anyhow::anyhow!("创建CString失败: {}", e));
|
||||
}
|
||||
};
|
||||
|
||||
let handle = unsafe {
|
||||
CreateFileA(
|
||||
c_pipe_name.as_ptr(),
|
||||
GENERIC_READ | GENERIC_WRITE,
|
||||
FILE_SHARE_READ | FILE_SHARE_WRITE,
|
||||
ptr::null_mut(),
|
||||
OPEN_EXISTING,
|
||||
0,
|
||||
ptr::null_mut(),
|
||||
)
|
||||
};
|
||||
|
||||
if handle == winapi::um::handleapi::INVALID_HANDLE_VALUE {
|
||||
let error = std::io::Error::last_os_error();
|
||||
logging!(error, Type::Service, true, "连接到命名管道失败: {}", error);
|
||||
return Err(anyhow::anyhow!("无法连接到服务命名管道: {}", error));
|
||||
}
|
||||
|
||||
let mut pipe = unsafe { File::from_raw_handle(handle as RawHandle) };
|
||||
logging!(info, Type::Service, true, "成功连接到Windows命名管道");
|
||||
|
||||
let request_bytes = request_json.as_bytes();
|
||||
let len_bytes = (request_bytes.len() as u32).to_be_bytes();
|
||||
|
||||
logging!(debug, Type::Service, true, "发送IPC请求...");
|
||||
|
||||
if let Err(e) = pipe.write_all(&len_bytes) {
|
||||
logging!(error, Type::Service, true, "写入请求长度失败: {}", e);
|
||||
return Err(anyhow::anyhow!("写入请求长度失败: {}", e));
|
||||
}
|
||||
|
||||
if let Err(e) = pipe.write_all(request_bytes) {
|
||||
logging!(error, Type::Service, true, "写入请求内容失败: {}", e);
|
||||
return Err(anyhow::anyhow!("写入请求内容失败: {}", e));
|
||||
}
|
||||
|
||||
logging!(debug, Type::Service, true, "请求已发送，等待响应...");
|
||||
|
||||
if let Err(e) = pipe.flush() {
|
||||
logging!(error, Type::Service, true, "刷新管道失败: {}", e);
|
||||
return Err(anyhow::anyhow!("刷新管道失败: {}", e));
|
||||
}
|
||||
|
||||
let mut response_len_bytes = [0u8; 4];
|
||||
if let Err(e) = pipe.read_exact(&mut response_len_bytes) {
|
||||
logging!(error, Type::Service, true, "读取响应长度失败: {}", e);
|
||||
return Err(anyhow::anyhow!("读取响应长度失败: {}", e));
|
||||
}
|
||||
|
||||
let response_len = u32::from_be_bytes(response_len_bytes) as usize;
|
||||
logging!(
|
||||
debug,
|
||||
Type::Service,
|
||||
true,
|
||||
"收到响应长度: {}字节",
|
||||
response_len
|
||||
);
|
||||
|
||||
let mut response_bytes = vec![0u8; response_len];
|
||||
if let Err(e) = pipe.read_exact(&mut response_bytes) {
|
||||
logging!(error, Type::Service, true, "读取响应内容失败: {}", e);
|
||||
return Err(anyhow::anyhow!("读取响应内容失败: {}", e));
|
||||
}
|
||||
|
||||
logging!(
|
||||
debug,
|
||||
Type::Service,
|
||||
true,
|
||||
"成功接收响应: {}字节",
|
||||
response_bytes.len()
|
||||
);
|
||||
|
||||
let response: IpcResponse = match serde_json::from_slice::<IpcResponse>(&response_bytes) {
|
||||
Ok(r) => {
|
||||
logging!(
|
||||
debug,
|
||||
Type::Service,
|
||||
true,
|
||||
"响应解析成功: success={}",
|
||||
r.success
|
||||
);
|
||||
r
|
||||
}
|
||||
Err(e) => {
|
||||
logging!(
|
||||
error,
|
||||
Type::Service,
|
||||
true,
|
||||
"解析响应失败: {}, 原始数据: {:?}",
|
||||
e,
|
||||
String::from_utf8_lossy(
|
||||
&response_bytes[..std::cmp::min(100, response_bytes.len())]
|
||||
)
|
||||
);
|
||||
return Err(anyhow::anyhow!("解析响应失败: {}", e));
|
||||
}
|
||||
};
|
||||
|
||||
match verify_response_signature(&response) {
|
||||
Ok(valid) => {
|
||||
if !valid {
|
||||
logging!(error, Type::Service, true, "服务响应签名验证失败");
|
||||
bail!("服务响应签名验证失败");
|
||||
}
|
||||
logging!(debug, Type::Service, true, "响应签名验证成功");
|
||||
}
|
||||
Err(e) => {
|
||||
logging!(error, Type::Service, true, "验证响应签名时出错: {}", e);
|
||||
return Err(e);
|
||||
}
|
||||
}
|
||||
|
||||
logging!(
|
||||
info,
|
||||
Type::Service,
|
||||
true,
|
||||
"IPC请求完成: 命令={}, 成功={}",
|
||||
command_type,
|
||||
response.success
|
||||
);
|
||||
Ok(response)
|
||||
})
|
||||
.await?;
|
||||
|
||||
Ok(result)
|
||||
}
|
||||
|
||||
// IPC连接管理-unix
|
||||
#[cfg(target_family = "unix")]
|
||||
pub async fn send_ipc_request(
|
||||
command: IpcCommand,
|
||||
payload: serde_json::Value,
|
||||
) -> Result<IpcResponse> {
|
||||
use std::os::unix::net::UnixStream;
|
||||
|
||||
logging!(
|
||||
info,
|
||||
Type::Service,
|
||||
true,
|
||||
"准备发送IPC请求到Unix套接字: {}",
|
||||
IPC_SOCKET_NAME
|
||||
);
|
||||
logging!(
|
||||
debug,
|
||||
Type::Service,
|
||||
true,
|
||||
"IPC请求: 命令={:?}, 数据大小={}字节",
|
||||
command,
|
||||
serde_json::to_string(&payload)?.len()
|
||||
);
|
||||
|
||||
let command_type = format!("{:?}", command);
|
||||
|
||||
let request = match create_signed_request(command, payload) {
|
||||
Ok(req) => {
|
||||
logging!(
|
||||
debug,
|
||||
Type::Service,
|
||||
true,
|
||||
"创建签名请求成功: ID={}",
|
||||
req.id
|
||||
);
|
||||
req
|
||||
}
|
||||
Err(e) => {
|
||||
logging!(error, Type::Service, true, "创建签名请求失败: {}", e);
|
||||
return Err(e);
|
||||
}
|
||||
};
|
||||
|
||||
let request_json = serde_json::to_string(&request)?;
|
||||
logging!(
|
||||
debug,
|
||||
Type::Service,
|
||||
true,
|
||||
"请求JSON大小: {}字节",
|
||||
request_json.len()
|
||||
);
|
||||
|
||||
logging!(debug, Type::Service, true, "尝试连接Unix套接字...");
|
||||
|
||||
let socket_exists = std::path::Path::new(IPC_SOCKET_NAME).exists();
|
||||
logging!(
|
||||
debug,
|
||||
Type::Service,
|
||||
true,
|
||||
"Unix套接字文件 {} 是否存在: {}",
|
||||
IPC_SOCKET_NAME,
|
||||
socket_exists
|
||||
);
|
||||
|
||||
let mut stream = match UnixStream::connect(IPC_SOCKET_NAME) {
|
||||
Ok(s) => {
|
||||
logging!(info, Type::Service, true, "成功连接到Unix套接字");
|
||||
s
|
||||
}
|
||||
Err(e) => {
|
||||
logging!(error, Type::Service, true, "连接到Unix套接字失败: {}", e);
|
||||
return Err(anyhow::anyhow!("无法连接到服务Unix套接字: {}", e));
|
||||
}
|
||||
};
|
||||
|
||||
let request_bytes = request_json.as_bytes();
|
||||
let len_bytes = (request_bytes.len() as u32).to_be_bytes();
|
||||
|
||||
logging!(debug, Type::Service, true, "发送IPC请求...");
|
||||
|
||||
if let Err(e) = std::io::Write::write_all(&mut stream, &len_bytes) {
|
||||
logging!(error, Type::Service, true, "写入请求长度失败: {}", e);
|
||||
return Err(anyhow::anyhow!("写入请求长度失败: {}", e));
|
||||
}
|
||||
|
||||
if let Err(e) = std::io::Write::write_all(&mut stream, request_bytes) {
|
||||
logging!(error, Type::Service, true, "写入请求内容失败: {}", e);
|
||||
return Err(anyhow::anyhow!("写入请求内容失败: {}", e));
|
||||
}
|
||||
|
||||
logging!(debug, Type::Service, true, "请求已发送，等待响应...");
|
||||
|
||||
let mut response_len_bytes = [0u8; 4];
|
||||
if let Err(e) = std::io::Read::read_exact(&mut stream, &mut response_len_bytes) {
|
||||
logging!(error, Type::Service, true, "读取响应长度失败: {}", e);
|
||||
return Err(anyhow::anyhow!("读取响应长度失败: {}", e));
|
||||
}
|
||||
|
||||
let response_len = u32::from_be_bytes(response_len_bytes) as usize;
|
||||
logging!(
|
||||
debug,
|
||||
Type::Service,
|
||||
true,
|
||||
"收到响应长度: {}字节",
|
||||
response_len
|
||||
);
|
||||
|
||||
let mut response_bytes = vec![0u8; response_len];
|
||||
if let Err(e) = std::io::Read::read_exact(&mut stream, &mut response_bytes) {
|
||||
logging!(error, Type::Service, true, "读取响应内容失败: {}", e);
|
||||
return Err(anyhow::anyhow!("读取响应内容失败: {}", e));
|
||||
}
|
||||
|
||||
logging!(
|
||||
debug,
|
||||
Type::Service,
|
||||
true,
|
||||
"成功接收响应: {}字节",
|
||||
response_bytes.len()
|
||||
);
|
||||
|
||||
let response: IpcResponse = match serde_json::from_slice::<IpcResponse>(&response_bytes) {
|
||||
Ok(r) => {
|
||||
logging!(
|
||||
debug,
|
||||
Type::Service,
|
||||
true,
|
||||
"响应解析成功: success={}",
|
||||
r.success
|
||||
);
|
||||
r
|
||||
}
|
||||
Err(e) => {
|
||||
logging!(
|
||||
error,
|
||||
Type::Service,
|
||||
true,
|
||||
"解析响应失败: {}, 原始数据: {:?}",
|
||||
e,
|
||||
String::from_utf8_lossy(
|
||||
&response_bytes[..std::cmp::min(100, response_bytes.len())]
|
||||
)
|
||||
);
|
||||
return Err(anyhow::anyhow!("解析响应失败: {}", e));
|
||||
}
|
||||
};
|
||||
|
||||
match verify_response_signature(&response) {
|
||||
Ok(valid) => {
|
||||
if !valid {
|
||||
logging!(error, Type::Service, true, "服务响应签名验证失败");
|
||||
bail!("服务响应签名验证失败");
|
||||
}
|
||||
logging!(debug, Type::Service, true, "响应签名验证成功");
|
||||
}
|
||||
Err(e) => {
|
||||
logging!(error, Type::Service, true, "验证响应签名时出错: {}", e);
|
||||
return Err(e);
|
||||
}
|
||||
}
|
||||
|
||||
logging!(
|
||||
info,
|
||||
Type::Service,
|
||||
true,
|
||||
"IPC请求完成: 命令={}, 成功={}",
|
||||
command_type,
|
||||
response.success
|
||||
);
|
||||
Ok(response)
|
||||
}
|
||||
Reference in New Issue
Block a user