Extensive refactor, trying to keep the main request handling function relatively simple.

This commit is contained in:
Solderpunk 2020-06-30 22:25:37 +02:00
parent fd31094cb6
commit 68398ef0be
4 changed files with 242 additions and 199 deletions

63
certificate.go Normal file
View File

@ -0,0 +1,63 @@
package main
import (
"crypto/sha256"
"crypto/x509"
"encoding/hex"
"net"
"net/url"
"regexp"
"time"
)
func enforceCertificateValidity(clientCerts []*x509.Certificate, conn net.Conn, log *LogEntry) {
// This will fail if any of multiple certs are invalid
// Maybe we should just require one valid?
now := time.Now()
for _, cert := range clientCerts {
if now.Before(cert.NotBefore) {
conn.Write([]byte("64 Client certificate not yet valid!\r\n"))
log.Status = 64
return
} else if now.After(cert.NotAfter) {
conn.Write([]byte("65 Client certificate has expired!\r\n"))
log.Status = 65
return
}
}
}
func handleCertificateZones(URL *url.URL, clientCerts []*x509.Certificate, config Config, conn net.Conn, log *LogEntry) {
authorised := true
for zone, allowedFingerprints := range config.CertificateZones {
matched, err := regexp.Match(zone, []byte(URL.Path))
if !matched || err != nil {
continue
}
authorised = false
for _, clientCert := range clientCerts {
for _, allowedFingerprint := range allowedFingerprints {
if getCertFingerprint(clientCert) == allowedFingerprint {
authorised = true
break
}
}
}
}
if !authorised {
if len(clientCerts) > 0 {
conn.Write([]byte("61 Provided certificate not authorised for this resource\r\n"))
log.Status = 61
} else {
conn.Write([]byte("60 A pre-authorised certificate is required to access this resource\r\n"))
log.Status = 60
}
return
}
}
func getCertFingerprint(cert *x509.Certificate) string {
hash := sha256.Sum256(cert.Raw)
fingerprint := hex.EncodeToString(hash[:])
return fingerprint
}

115
dirlist.go Normal file
View File

@ -0,0 +1,115 @@
package main
import (
"bufio"
"fmt"
"io/ioutil"
"log"
"net/url"
"os"
"path/filepath"
"sort"
"strings"
)
func generateDirectoryListing(URL *url.URL, path string, config Config) string {
var listing string
files, err := ioutil.ReadDir(path)
if err != nil {
log.Fatal(err)
}
listing = "# Directory listing\n\n"
// Override with .mollyhead file
header_path := filepath.Join(path, ".mollyhead")
_, err = os.Stat(header_path)
if err == nil {
header, err := ioutil.ReadFile(header_path)
if err == nil {
listing = string(header)
}
}
// Do "up" link first
if URL.Path != "/" {
if strings.HasSuffix(URL.Path, "/") {
URL.Path = URL.Path[:len(URL.Path)-1]
}
up := filepath.Dir(URL.Path)
listing += fmt.Sprintf("=> %s %s\n", up, "..")
}
// Sort files
sort.SliceStable(files, func(i, j int) bool {
if config.DirectoryReverse {
i, j = j, i
}
if config.DirectorySort == "Name" {
return files[i].Name() < files[j].Name()
} else if config.DirectorySort == "Size" {
return files[i].Size() < files[j].Size()
} else if config.DirectorySort == "Time" {
return files[i].ModTime().Before(files[j].ModTime())
}
return false // Should not happen
})
// Format lines
for _, file := range files {
// Skip dotfiles
if strings.HasPrefix(file.Name(), ".") {
continue
}
// Only list world readable files
if uint64(file.Mode().Perm())&0444 != 0444 {
continue
}
listing += fmt.Sprintf("=> %s %s\n", url.PathEscape(file.Name()), generatePrettyFileLabel(file, path, config))
}
return listing
}
func generatePrettyFileLabel(info os.FileInfo, path string, config Config) string {
var size string
if info.IsDir() {
size = " "
} else if info.Size() < 1024 {
size = fmt.Sprintf("%4d B", info.Size())
} else if info.Size() < (1024 << 10) {
size = fmt.Sprintf("%4d KiB", info.Size()>>10)
} else if info.Size() < 1024<<20 {
size = fmt.Sprintf("%4d MiB", info.Size()>>20)
} else if info.Size() < 1024<<30 {
size = fmt.Sprintf("%4d GiB", info.Size()>>30)
} else if info.Size() < 1024<<40 {
size = fmt.Sprintf("%4d TiB", info.Size()>>40)
} else {
size = "GIGANTIC"
}
name := info.Name()
if config.DirectoryTitles && filepath.Ext(name) == "."+config.GeminiExt {
name = readHeading(path, info)
}
if len(name) > 40 {
name = info.Name()[:36] + "..."
}
if info.IsDir() {
name += "/"
}
return fmt.Sprintf("%-40s %s %v", name, size, info.ModTime().Format("Jan _2 2006"))
}
func readHeading(path string, info os.FileInfo) string {
filePath := filepath.Join(path, info.Name())
file, err := os.Open(filePath)
if err != nil {
return info.Name()
}
defer file.Close()
scanner := bufio.NewScanner(file)
for scanner.Scan() {
line := scanner.Text()
if strings.HasPrefix(line, "# ") {
return strings.TrimSpace(line[1:])
}
}
return info.Name()
}

View File

@ -3,13 +3,11 @@ package main
import ( import (
"bufio" "bufio"
"context" "context"
"crypto/sha256"
"crypto/tls" "crypto/tls"
"crypto/x509"
"encoding/hex"
"io" "io"
"net" "net"
"net/url" "net/url"
"os"
"os/exec" "os/exec"
"strconv" "strconv"
"strings" "strings"
@ -17,6 +15,12 @@ import (
) )
func handleCGI(config Config, path string, URL *url.URL, log *LogEntry, errorLog chan string, conn net.Conn) { func handleCGI(config Config, path string, URL *url.URL, log *LogEntry, errorLog chan string, conn net.Conn) {
// Make sure file is executable
info, err := os.Stat(path)
if info.Mode().Perm()&0111 != 0111 {
return
}
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel() defer cancel()
cmd := exec.CommandContext(ctx, path) cmd := exec.CommandContext(ctx, path)
@ -156,9 +160,3 @@ func prepareGatewayVariables(config Config, URL *url.URL, conn net.Conn) map[str
} }
return vars return vars
} }
func getCertFingerprint(cert *x509.Certificate) string {
hash := sha256.Sum256(cert.Raw)
fingerprint := hex.EncodeToString(hash[:])
return fingerprint
}

View File

@ -7,14 +7,12 @@ import (
"fmt" "fmt"
"github.com/BurntSushi/toml" "github.com/BurntSushi/toml"
"io/ioutil" "io/ioutil"
"log"
"mime" "mime"
"net" "net"
"net/url" "net/url"
"os" "os"
"path/filepath" "path/filepath"
"regexp" "regexp"
"sort"
"strconv" "strconv"
"strings" "strings"
"time" "time"
@ -36,21 +34,11 @@ func handleGeminiRequest(conn net.Conn, config Config, accessLogEntries chan Log
return return
} }
// Enforce client certificate validity
clientCerts := tlsConn.ConnectionState().PeerCertificates clientCerts := tlsConn.ConnectionState().PeerCertificates
// Check validity enforceCertificateValidity(clientCerts, conn, &log)
// This will fail if any of multiple certs are invalid if log.Status != 0 {
// Maybe we should just require one valid? return
now := time.Now()
for _, cert := range clientCerts {
if now.Before(cert.NotBefore) {
conn.Write([]byte("64 Client certificate not yet valid!\r\n"))
log.Status = 64
return
} else if now.After(cert.NotAfter) {
conn.Write([]byte("65 Client certificate has expired!\r\n"))
log.Status = 65
return
}
} }
// Reject non-gemini schemes // Reject non-gemini schemes
@ -77,69 +65,39 @@ func handleGeminiRequest(conn net.Conn, config Config, accessLogEntries chan Log
// Resolve URI path to actual filesystem path // Resolve URI path to actual filesystem path
path := resolvePath(URL.Path, config) path := resolvePath(URL.Path, config)
// Paranoid security measures:
// Fail ASAP if the URL has mapped to a sensitive file
if path == config.CertPath || path == config.KeyPath || path == config.AccessLog || path == config.ErrorLog {
conn.Write([]byte("51 Not found!\r\n"))
log.Status = 51
return
}
// Read Molly files // Read Molly files
if config.ReadMollyFiles { if config.ReadMollyFiles {
parseMollyFiles(path, &config, errorLogEntries) parseMollyFiles(path, &config, errorLogEntries)
} }
// Check for redirects // Check for redirects
for src, dst := range config.TempRedirects { handleRedirects(URL, config, conn, &log)
if URL.Path == src { if log.Status != 0 {
URL.Path = dst return
conn.Write([]byte("30 " + URL.String() + "\r\n"))
log.Status = 30
return
}
}
for src, dst := range config.PermRedirects {
if URL.Path == src {
URL.Path = dst
conn.Write([]byte("31 " + URL.String() + "\r\n"))
log.Status = 31
return
}
} }
// Check whether this URL is in a certificate zone // Check whether this URL is in a certificate zone
authorised := true handleCertificateZones(URL, clientCerts, config, conn, &log)
for zone, allowedFingerprints := range config.CertificateZones { if log.Status != 0 {
matched, err := regexp.Match(zone, []byte(URL.Path))
if !matched || err != nil {
continue
}
authorised = false
for _, clientCert := range clientCerts {
for _, allowedFingerprint := range allowedFingerprints {
if getCertFingerprint(clientCert) == allowedFingerprint {
authorised = true
break
}
}
}
}
if !authorised {
if len(clientCerts) > 0 {
conn.Write([]byte("61 Provided certificate not authorised for this resource\r\n"))
log.Status = 61
} else {
conn.Write([]byte("60 A pre-authorised certificate is required to access this resource\r\n"))
log.Status = 60
}
return return
} }
// Check whether this URL is in a configured CGI path // Check whether this URL is in a configured CGI path
for _, cgiPath := range config.CGIPaths { for _, cgiPath := range config.CGIPaths {
inCGIPath, err := regexp.Match(cgiPath, []byte(path)) inCGIPath, err := regexp.Match(cgiPath, []byte(path))
if err != nil || !inCGIPath { if err == nil && inCGIPath {
continue
}
info, err := os.Stat(path)
if err != nil {
continue
}
if info.Mode().Perm()&0111 == 0111 {
handleCGI(config, path, URL, &log, errorLogEntries, conn) handleCGI(config, path, URL, &log, errorLogEntries, conn)
return if log.Status != 0 {
return
}
} }
} }
@ -168,48 +126,19 @@ func handleGeminiRequest(conn net.Conn, config Config, accessLogEntries chan Log
return return
} }
// Paranoid security measure:
// Fail if the URL has mapped to our TLS files or the log
if path == config.CertPath || path == config.KeyPath || path == config.AccessLog || path == config.ErrorLog {
conn.Write([]byte("51 Not found!\r\n"))
log.Status = 51
return
}
// Don't serve Molly files // Don't serve Molly files
if !info.IsDir() && filepath.Base(path) == ".molly" { if filepath.Base(path) == ".molly" {
conn.Write([]byte("51 Not found!\r\n")) conn.Write([]byte("51 Not found!\r\n"))
log.Status = 51 log.Status = 51
return return
} }
// Handle directories // Finally, serve the file or directory
if info.IsDir() { if info.IsDir() {
// Redirect to add trailing slash if missing serveDirectory(URL, path, &log, conn, config, errorLogEntries)
// (otherwise relative links don't work properly) } else {
if !strings.HasSuffix(URL.Path, "/") { serveFile(path, &log, conn, config, errorLogEntries)
conn.Write([]byte(fmt.Sprintf("31 %s\r\n", URL.String()+"/")))
log.Status = 31
return
}
// Check for index.gmi if path is a directory
index_path := filepath.Join(path, "index."+config.GeminiExt)
index_info, err := os.Stat(index_path)
if err == nil && uint64(index_info.Mode().Perm())&0444 == 0444 {
serveFile(index_path, &log, conn, config, errorLogEntries)
// Serve a generated listing
} else {
conn.Write([]byte("20 text/gemini\r\n"))
log.Status = 20
conn.Write([]byte(generateDirectoryListing(URL, path, config)))
}
return
} }
// Otherwise, serve the file contents
serveFile(path, &log, conn, config, errorLogEntries)
return
} }
func readRequest(conn net.Conn, log *LogEntry, errorLog chan string) (*url.URL, error) { func readRequest(conn net.Conn, log *LogEntry, errorLog chan string) (*url.URL, error) {
@ -318,106 +247,44 @@ func parseMollyFiles(path string, config *Config, errorLogEntries chan string) {
} }
} }
func generateDirectoryListing(URL *url.URL, path string, config Config) string { func handleRedirects(URL *url.URL, config Config, conn net.Conn, log *LogEntry) {
var listing string for src, dst := range config.TempRedirects {
files, err := ioutil.ReadDir(path) if URL.Path == src {
if err != nil { URL.Path = dst
log.Fatal(err) conn.Write([]byte("30 " + URL.String() + "\r\n"))
} log.Status = 30
listing = "# Directory listing\n\n" return
// Override with .mollyhead file
header_path := filepath.Join(path, ".mollyhead")
_, err = os.Stat(header_path)
if err == nil {
header, err := ioutil.ReadFile(header_path)
if err == nil {
listing = string(header)
} }
} }
// Do "up" link first for src, dst := range config.PermRedirects {
if URL.Path != "/" { if URL.Path == src {
if strings.HasSuffix(URL.Path, "/") { URL.Path = dst
URL.Path = URL.Path[:len(URL.Path)-1] conn.Write([]byte("31 " + URL.String() + "\r\n"))
log.Status = 31
return
} }
up := filepath.Dir(URL.Path)
listing += fmt.Sprintf("=> %s %s\n", up, "..")
} }
// Sort files
sort.SliceStable(files, func(i, j int) bool {
if config.DirectoryReverse {
i, j = j, i
}
if config.DirectorySort == "Name" {
return files[i].Name() < files[j].Name()
} else if config.DirectorySort == "Size" {
return files[i].Size() < files[j].Size()
} else if config.DirectorySort == "Time" {
return files[i].ModTime().Before(files[j].ModTime())
}
return false // Should not happen
})
// Format lines
for _, file := range files {
// Skip dotfiles
if strings.HasPrefix(file.Name(), ".") {
continue
}
// Only list world readable files
if uint64(file.Mode().Perm())&0444 != 0444 {
continue
}
listing += fmt.Sprintf("=> %s %s\n", url.PathEscape(file.Name()), generatePrettyFileLabel(file, path, config))
}
return listing
} }
func generatePrettyFileLabel(info os.FileInfo, path string, config Config) string { func serveDirectory(URL *url.URL, path string, log *LogEntry, conn net.Conn, config Config, errorLogEntries chan string) {
var size string // Redirect to add trailing slash if missing
if info.IsDir() { // (otherwise relative links don't work properly)
size = " " if !strings.HasSuffix(URL.Path, "/") {
} else if info.Size() < 1024 { conn.Write([]byte(fmt.Sprintf("31 %s\r\n", URL.String()+"/")))
size = fmt.Sprintf("%4d B", info.Size()) log.Status = 31
} else if info.Size() < (1024 << 10) { return
size = fmt.Sprintf("%4d KiB", info.Size()>>10) }
} else if info.Size() < 1024<<20 { // Check for index.gmi if path is a directory
size = fmt.Sprintf("%4d MiB", info.Size()>>20) index_path := filepath.Join(path, "index."+config.GeminiExt)
} else if info.Size() < 1024<<30 { index_info, err := os.Stat(index_path)
size = fmt.Sprintf("%4d GiB", info.Size()>>30) if err == nil && uint64(index_info.Mode().Perm())&0444 == 0444 {
} else if info.Size() < 1024<<40 { serveFile(index_path, log, conn, config, errorLogEntries)
size = fmt.Sprintf("%4d TiB", info.Size()>>40) // Serve a generated listing
} else { } else {
size = "GIGANTIC" conn.Write([]byte("20 text/gemini\r\n"))
log.Status = 20
conn.Write([]byte(generateDirectoryListing(URL, path, config)))
} }
name := info.Name()
if config.DirectoryTitles && filepath.Ext(name) == "."+config.GeminiExt {
name = readHeading(path, info)
}
if len(name) > 40 {
name = info.Name()[:36] + "..."
}
if info.IsDir() {
name += "/"
}
return fmt.Sprintf("%-40s %s %v", name, size, info.ModTime().Format("Jan _2 2006"))
}
func readHeading(path string, info os.FileInfo) string {
filePath := filepath.Join(path, info.Name())
file, err := os.Open(filePath)
if err != nil {
return info.Name()
}
defer file.Close()
scanner := bufio.NewScanner(file)
for scanner.Scan() {
line := scanner.Text()
if strings.HasPrefix(line, "# ") {
return strings.TrimSpace(line[1:])
}
}
return info.Name()
} }
func serveFile(path string, log *LogEntry, conn net.Conn, config Config, errorLog chan string) { func serveFile(path string, log *LogEntry, conn net.Conn, config Config, errorLog chan string) {