qing
407ce3c366
拓扑：waf:443 → ca:8443（认证+前置转发）→ gateway:8445（仅 loopback 纯转发）， WAF upstream 不变，core/dnfs2/前端零改动。 ca v1.0.0（新模块）： - 认证资产逐字搬迁自 gateway v0.8.0（9 条认证路由、Token 双轨吊销、 PBKDF2、限流、WS 代理鉴权、wrapperHttp、优雅关闭） - handleForward 前置转发层：固定上游 gateway:8445；无 Target-Url 公开直转， 有则本地验签后注入 X-Auth-User/X-Auth-Admin/Authorization（strip-then-set） - is_special_header 新增剥离 x-auth-user/x-auth-admin；上游不可达统一 502 - confs/configs/ca.ini 新增（[Upstream] gateway + UPSTREAM_GATEWAY env） gateway v0.9.0（2470→约 560 行）： - 删除全部认证代码，退居 127.0.0.1:8445 - 启动 loopback 强制自检（非 loopback 拒绝启动） - X-Auth-User 存在性不变量：显式 Target-Url 无该头一律 401 - gateway.ini 精简至 [Server]/[Proxy]/[Downstream db] 验收：黑盒 34 断言对 8443 原样全绿（32 passed/2 skipped，与基线一致）； 探针实测伪造 X-Auth-User 经 CA 被剥离（echo 实证）、直连 8445 无头 401、 白名单外 403、gateway 宕机 CA 502。core/init.txt 加入 ca/_run.sh。
75 lines
658 B
Plaintext
75 lines
658 B
Plaintext
#PRJ
|
|
*.db
|
|
*.crt
|
|
*.key
|
|
|
|
# Prerequisites
|
|
*.d
|
|
|
|
# Compiled Object files
|
|
*.slo
|
|
*.lo
|
|
*.o
|
|
*.obj
|
|
|
|
# Precompiled Headers
|
|
*.gch
|
|
*.pch
|
|
|
|
# Linker files
|
|
*.ilk
|
|
|
|
# Debugger Files
|
|
*.pdb
|
|
|
|
# Compiled Dynamic libraries
|
|
*.so
|
|
*.dylib
|
|
*.dll
|
|
*.so.*
|
|
|
|
|
|
# Fortran module files
|
|
*.mod
|
|
*.smod
|
|
|
|
# Compiled Static libraries
|
|
*.lai
|
|
*.la
|
|
*.a
|
|
*.lib
|
|
|
|
# Executables
|
|
*.exe
|
|
*.out
|
|
*.app
|
|
|
|
# Build directories
|
|
build/
|
|
Build/
|
|
build-*/
|
|
|
|
# CMake generated files
|
|
CMakeFiles/
|
|
CMakeCache.txt
|
|
cmake_install.cmake
|
|
#Makefile
|
|
install_manifest.txt
|
|
compile_commands.json
|
|
|
|
# Temporary files
|
|
*.tmp
|
|
*.log
|
|
*.bak
|
|
*.swp
|
|
|
|
# vcpkg
|
|
vcpkg_installed/
|
|
|
|
# debug information files
|
|
*.dwo
|
|
|
|
# test output & cache
|
|
Testing/
|
|
.cache/
|