@synopackageland/cli 0.14.1 → 0.15.0

package/assets/go/gateway/gateway.go

@@ -1,412 +0,0 @@
-package main
-
-// The gateway is the only door to a package's container. DSM runs it as the
-// package account's CGI behind the DSM web server, so a request reaches the
-// container only after DSM's own session check, the access rule of the
-// package, and (for state-changing methods) a SynoToken.
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"net/http/httputil"
-	"net/url"
-	"regexp"
-	"slices"
-	"strconv"
-	"strings"
-	"time"
-)
-
-const (
-	accessUsers  = "users"
-	accessAdmins = "admins"
-	accessGroups = "groups"
-
-	adminGroup = "administrators"
-
-	// gatewayScript is the CGI file name; what follows it in the URL path is the
-	// path inside the container.
-	gatewayScript = "/gateway.cgi"
-
-	// keepErrorBodyHeader is the request header with which an app asks that its own error replies reach it
-	// whole: see keepErrorBody.
-	keepErrorBodyHeader = "X-Synopkgland-Keep-Error-Body"
-
-	defaultMaxBodyBytes    = 64 << 20
-	defaultResponseTimeout = 60 * time.Second
-)
-
-type config struct {
-	// Upstream is the container's published loopback address, host:port.
-	Upstream string `json:"upstream"`
-	// Access is users (any signed-in DSM user), admins or groups.
-	Access string   `json:"access"`
-	Groups []string `json:"groups,omitempty"`
-
-	MaxBodyBytes          int64 `json:"maxBodyBytes,omitempty"`
-	ResponseTimeoutMillis int   `json:"responseTimeoutMillis,omitempty"`
-}
-
-var groupName = regexp.MustCompile(`^(?:[A-Za-z0-9._-]{1,64}|[A-Za-z0-9._-]{1,64}\\[A-Za-z0-9._-](?:[A-Za-z0-9._ -]{0,126}[A-Za-z0-9._-])?|[A-Za-z0-9._-](?:[A-Za-z0-9._ -]{0,126}[A-Za-z0-9._-])?@[A-Za-z0-9._-]{1,64})$`)
-
-func (c config) validate() error {
-	host, port, err := net.SplitHostPort(c.Upstream)
-	if err != nil || (host != "127.0.0.1" && host != "::1") {
-		return fmt.Errorf("upstream %q must be a loopback host:port", c.Upstream)
-	}
-	if n, err := strconv.Atoi(port); err != nil || n < 1 || n > 65535 {
-		return fmt.Errorf("upstream port %q is invalid", port)
-	}
-	switch c.Access {
-	case accessUsers, accessAdmins:
-	case accessGroups:
-		if len(c.Groups) == 0 {
-			return errors.New("access groups needs at least one group")
-		}
-		for _, g := range c.Groups {
-			if !groupName.MatchString(g) {
-				return fmt.Errorf("group %q is invalid", g)
-			}
-		}
-	default:
-		return fmt.Errorf("access %q must be users, admins or groups", c.Access)
-	}
-	return nil
-}
-
-type gateway struct {
-	cfg   config
-	auth  authenticator
-	proxy *httputil.ReverseProxy
-}
-
-// newGateway refuses an unusable configuration or a missing authenticator, so
-// a mistake fails at startup instead of opening the door.
-func newGateway(cfg config, auth authenticator) (*gateway, error) {
-	if auth == nil {
-		return nil, errors.New("newGateway needs an authenticator")
-	}
-	if err := cfg.validate(); err != nil {
-		return nil, err
-	}
-	if cfg.MaxBodyBytes <= 0 {
-		cfg.MaxBodyBytes = defaultMaxBodyBytes
-	}
-	timeout := defaultResponseTimeout
-	if cfg.ResponseTimeoutMillis > 0 {
-		timeout = time.Duration(cfg.ResponseTimeoutMillis) * time.Millisecond
-	}
-	g := &gateway{cfg: cfg, auth: auth}
-	g.proxy = &httputil.ReverseProxy{
-		Rewrite:        g.rewrite,
-		ModifyResponse: g.modifyResponse,
-		ErrorHandler:   g.proxyError,
-		Transport: &http.Transport{
-			Proxy:                 nil,
-			DialContext:           (&net.Dialer{Timeout: 3 * time.Second}).DialContext,
-			ResponseHeaderTimeout: timeout,
-			DisableKeepAlives:     true,
-		},
-	}
-	return g, nil
-}
-
-type ctxKey struct{}
-
-// gatewayRequest is what ServeHTTP worked out before handing over to the proxy.
-type gatewayRequest struct {
-	prefix string // escaped URL path up to and including the CGI file name
-	rest   string // escaped path inside the container, starting with "/"
-	id     identity
-	// keepErrorBody: the app asked for DSM-safe statuses on the container's own error replies.
-	keepErrorBody bool
-}
-
-func (g *gateway) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	// DSM's CGI gateway cuts the reply short if the CGI exits with request
-	// bytes unread, so drain whatever the handling below did not consume.
-	defer io.Copy(io.Discard, io.LimitReader(r.Body, g.cfg.MaxBodyBytes))
-
-	prefix, rest, ok := splitGatewayPath(r.URL.EscapedPath())
-	if !ok {
-		reply(w, http.StatusNotFound, "not_found", "Not a gateway path.")
-		return
-	}
-	id, err := g.auth.Authenticate(r)
-	switch {
-	case errors.Is(err, errNoSession):
-		reply(w, http.StatusUnauthorized, "session_required", "Sign in to DSM to open this app.")
-		return
-	case err != nil:
-		reply(w, http.StatusInternalServerError, "auth_unavailable", "DSM could not verify the session.")
-		return
-	}
-	if !g.permits(id) {
-		reply(w, http.StatusForbidden, "forbidden", "Your DSM account is not allowed to open this app.")
-		return
-	}
-	if !safeMethod(r.Method) {
-		if !wellFormedToken(r.Header.Get("X-SYNO-TOKEN")) {
-			reply(w, http.StatusForbidden, "token_required", "State-changing requests need the DSM SynoToken.")
-			return
-		}
-		if !sameOrigin(r) {
-			reply(w, http.StatusForbidden, "cross_site_blocked", "State-changing requests must come from this DSM's own pages.")
-			return
-		}
-	}
-	if isUpgrade(r) {
-		switch {
-		case !isWebSocket(r):
-			reply(w, http.StatusNotImplemented, "upgrade_unsupported", "Only WebSocket upgrades pass through the DSM gateway.")
-			return
-		case !sameOrigin(r):
-			// A browser cannot add the SynoToken header to a WebSocket handshake, so the same-origin evidence
-			// (the rule state-changing requests use) is what keeps another site from opening a socket with the user's DSM cookie.
-			reply(w, http.StatusForbidden, "cross_site_blocked", "The WebSocket must be opened from this DSM's own pages.")
-			return
-		}
-	}
-	if rest == "" {
-		// Relative links in the app only resolve under a trailing slash.
-		location := strings.TrimPrefix(gatewayScript, "/") + "/"
-		if r.URL.RawQuery != "" {
-			location += "?" + r.URL.RawQuery
-		}
-		w.Header().Set("Location", location)
-		reply(w, http.StatusPermanentRedirect, "redirect", "Open the app with a trailing slash.")
-		return
-	}
-	if !safeContainerPath(rest) {
-		reply(w, http.StatusBadRequest, "bad_path", "The path is not allowed.")
-		return
-	}
-	r.Body = http.MaxBytesReader(w, r.Body, g.cfg.MaxBodyBytes)
-	g.proxy.ServeHTTP(w, r.WithContext(context.WithValue(r.Context(), ctxKey{}, gatewayRequest{prefix: prefix, rest: rest, id: id, keepErrorBody: r.Header.Get(keepErrorBodyHeader) == "1"})))
-}
-
-func (g *gateway) permits(id identity) bool {
-	switch g.cfg.Access {
-	case accessUsers:
-		return true
-	case accessAdmins:
-		return slices.Contains(id.Groups, adminGroup)
-	default:
-		return slices.ContainsFunc(id.Groups, func(group string) bool { return slices.Contains(g.cfg.Groups, group) })
-	}
-}
-
-func splitGatewayPath(escaped string) (prefix, rest string, ok bool) {
-	i := strings.Index(escaped, gatewayScript)
-	if i < 0 {
-		return "", "", false
-	}
-	end := i + len(gatewayScript)
-	rest = escaped[end:]
-	if rest != "" && rest[0] != '/' {
-		return "", "", false
-	}
-	return escaped[:end], rest, true
-}
-
-// safeContainerPath keeps the request inside the container's own URL space:
-// no dot segments, no authority-looking "//", no NUL, no backslash.
-func safeContainerPath(escaped string) bool {
-	decoded, err := url.PathUnescape(escaped)
-	if err != nil || strings.HasPrefix(decoded, "//") || strings.ContainsAny(decoded, "\x00\\") {
-		return false
-	}
-	return !slices.Contains(strings.Split(decoded, "/"), "..") && !slices.Contains(strings.Split(decoded, "/"), ".")
-}
-
-func safeMethod(method string) bool {
-	return method == http.MethodGet || method == http.MethodHead || method == http.MethodOptions
-}
-
-func isUpgrade(r *http.Request) bool {
-	if r.Header.Get("Upgrade") != "" {
-		return true
-	}
-	for _, v := range r.Header.Values("Connection") {
-		for _, token := range strings.Split(v, ",") {
-			if strings.EqualFold(strings.TrimSpace(token), "upgrade") {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-func isWebSocket(r *http.Request) bool {
-	return strings.EqualFold(strings.TrimSpace(r.Header.Get("Upgrade")), "websocket")
-}
-
-// Inbound headers that carry or imitate identity, session or proxy state. The
-// container trusts only the X-Syno-User and X-Syno-Admin the gateway sets
-// after DSM verified the session, so the client's own copies never get through.
-var droppedExact = map[string]bool{"Cookie": true, "Remote-User": true, "Remote-Groups": true, "Remote-Email": true, "Remote-Name": true, "Forwarded": true}
-
-func dropsHeader(name string) bool {
-	canonical := http.CanonicalHeaderKey(name)
-	if droppedExact[canonical] {
-		return true
-	}
-	for _, prefix := range []string{"X-Syno-", "X-Forwarded-", "X-Remote-", "X-Auth", "X-Real-", "Remote-"} {
-		if strings.HasPrefix(canonical, prefix) {
-			return true
-		}
-	}
-	return false
-}
-
-func (g *gateway) rewrite(pr *httputil.ProxyRequest) {
-	gr := pr.In.Context().Value(ctxKey{}).(gatewayRequest)
-	decoded, _ := url.PathUnescape(gr.rest)
-	pr.Out.URL = &url.URL{Scheme: "http", Host: g.cfg.Upstream, Path: decoded, RawPath: gr.rest, RawQuery: withoutSynoToken(pr.In.URL.RawQuery)}
-	pr.Out.Host = g.cfg.Upstream
-	if isUpgrade(pr.In) {
-		// The Origin was checked against this host; the container's own same-origin check needs to see it too.
-		pr.Out.Host = pr.In.Host
-	}
-	for name := range pr.Out.Header {
-		if dropsHeader(name) {
-			pr.Out.Header.Del(name)
-		}
-	}
-	pr.Out.Header.Set("X-Syno-User", gr.id.User)
-	pr.Out.Header.Set("X-Syno-Admin", strconv.FormatBool(slices.Contains(gr.id.Groups, adminGroup)))
-}
-
-// withoutSynoToken keeps the CSRF token out of the container's logs.
-func withoutSynoToken(rawQuery string) string {
-	if rawQuery == "" {
-		return ""
-	}
-	var kept []string
-	for _, pair := range strings.Split(rawQuery, "&") {
-		key, _, _ := strings.Cut(pair, "=")
-		if k, err := url.QueryUnescape(key); err == nil && k == "SynoToken" {
-			continue
-		}
-		kept = append(kept, pair)
-	}
-	return strings.Join(kept, "&")
-}
-
-func (g *gateway) modifyResponse(resp *http.Response) error {
-	gr := resp.Request.Context().Value(ctxKey{}).(gatewayRequest)
-	// The container shares DSM's origin; it must not be able to set or clear
-	// DSM's own cookies.
-	resp.Header.Del("Set-Cookie")
-	if resp.StatusCode != http.StatusSwitchingProtocols {
-		resp.Header.Set("Cache-Control", privateCacheControl(resp.Header.Get("Cache-Control")))
-		resp.Header.Add("Vary", "Cookie")
-	}
-	if location := resp.Header.Get("Location"); location != "" {
-		resp.Header.Set("Location", g.rewriteLocation(location, gr.prefix))
-	}
-	if gr.keepErrorBody {
-		keepErrorBody(resp)
-	}
-	return nil
-}
-
-// keepErrorBody swaps a container status that DSM would replace for its stand-in, so the body and headers
-// the container sent reach the app. Opt-in per request: the app then reads X-Synopkgland-Status for the
-// status the container really sent. Without it the container's own status goes out untouched.
-func keepErrorBody(resp *http.Response) {
-	if safe := dsmSafeStatus(resp.StatusCode); safe != resp.StatusCode {
-		resp.Header.Set("X-Synopkgland-Status", strconv.Itoa(resp.StatusCode))
-		resp.StatusCode, resp.Status = safe, strconv.Itoa(safe)+" "+http.StatusText(safe)
-	}
-}
-
-func privateCacheControl(value string) string {
-	kept := []string{"private"}
-	for _, directive := range strings.Split(value, ",") {
-		directive = strings.TrimSpace(directive)
-		name, _, _ := strings.Cut(strings.ToLower(directive), "=")
-		if directive != "" && name != "public" && name != "private" && name != "s-maxage" {
-			kept = append(kept, directive)
-		}
-	}
-	return strings.Join(kept, ", ")
-}
-
-// rewriteLocation points root-relative and container-absolute redirects back
-// under the gateway path; relative and foreign locations pass through.
-func (g *gateway) rewriteLocation(location, prefix string) string {
-	u, err := url.Parse(location)
-	if err != nil {
-		return location
-	}
-	switch {
-	case u.Host == g.cfg.Upstream && (u.Scheme == "http" || u.Scheme == "https"):
-		u.Scheme, u.Host = "", ""
-	case u.Scheme != "" || u.Host != "":
-		return location
-	}
-	if !strings.HasPrefix(u.EscapedPath(), "/") {
-		return location
-	}
-	u.Path, u.RawPath = "", prefix+u.EscapedPath()
-	u.Path, _ = url.PathUnescape(u.RawPath)
-	return u.String()
-}
-
-func (g *gateway) proxyError(w http.ResponseWriter, r *http.Request, err error) {
-	var tooLarge *http.MaxBytesError
-	var netErr net.Error
-	var opErr *net.OpError
-	switch {
-	case errors.As(err, &tooLarge):
-		reply(w, http.StatusRequestEntityTooLarge, "body_too_large", "The request body is too large.")
-	case errors.Is(err, context.DeadlineExceeded) || (errors.As(err, &netErr) && netErr.Timeout()):
-		reply(w, http.StatusGatewayTimeout, "upstream_timeout", "The app did not answer in time.")
-	case errors.As(err, &opErr) && opErr.Op == "dial":
-		w.Header().Set("Retry-After", "5")
-		reply(w, http.StatusServiceUnavailable, "upstream_unavailable", "The app is not running. Start the package in Package Center and try again.")
-	default:
-		reply(w, http.StatusBadGateway, "bad_gateway", "The app returned an invalid response.")
-	}
-}
-
-// DSM's nginx runs `scgi_intercept_errors on` with `error_page 403 404 500 502 503 504`, so a CGI reply with
-// one of these statuses loses its body and headers to DSM's generic error page (measured on DSM 7.4-90069;
-// every other status, 4xx and 5xx alike, passes with body and headers intact). Each replaced status has a
-// stand-in the app can read; the status the reply would have had travels in X-Synopkgland-Status.
-var dsmReplacedStatus = map[int]int{
-	http.StatusForbidden:           http.StatusUnauthorized,
-	http.StatusNotFound:            http.StatusGone,
-	http.StatusInternalServerError: 520, // unregistered (Cloudflare "unknown error"); clients treat it as 500
-	http.StatusBadGateway:          520,
-	http.StatusServiceUnavailable:  521, // unregistered (Cloudflare "web server is down")
-	http.StatusGatewayTimeout:      524, // unregistered (Cloudflare "a timeout occurred")
-}
-
-func dsmSafeStatus(status int) int {
-	if safe, replaced := dsmReplacedStatus[status]; replaced {
-		return safe
-	}
-	return status
-}
-
-// reply answers with one of the gateway's own errors. `intended` is the status the error means; the status
-// sent is the one DSM lets through, and X-Synopkgland-Error carries the machine-readable code.
-func reply(w http.ResponseWriter, intended int, code, message string) {
-	status := dsmSafeStatus(intended)
-	h := w.Header()
-	h.Set("Content-Type", "text/plain; charset=utf-8")
-	h.Set("Cache-Control", "no-store")
-	h.Set("X-Content-Type-Options", "nosniff")
-	h.Set("X-Synopkgland-Error", code)
-	if status != intended {
-		h.Set("X-Synopkgland-Status", strconv.Itoa(intended))
-	}
-	w.WriteHeader(status)
-	fmt.Fprintf(w, "%s\n%s\n", code, message)
-}