serverless-ircd 0.1.0 → 0.2.0

package/webircgateway/pkg/webircgateway/config.go

@@ -0,0 +1,385 @@
+package webircgateway
+
+import (
+	"errors"
+	"net"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/gobwas/glob"
+	"gopkg.in/ini.v1"
+)
+
+// ConfigUpstream - An upstream config
+type ConfigUpstream struct {
+	// Plugins may assign an arbitary address to an upstream network
+	NetworkCommonAddress string
+	Hostname             string
+	Port                 int
+	TLS                  bool
+	Timeout              int
+	Throttle             int
+	WebircPassword       string
+	ServerPassword       string
+	GatewayName          string
+	Proxy                *ConfigProxy
+	Protocol             string
+	LocalAddr            string
+}
+
+// ConfigServer - A web server config
+type ConfigServer struct {
+	LocalAddr           string
+	BindMode            os.FileMode
+	Port                int
+	TLS                 bool
+	CertFile            string
+	KeyFile             string
+	LetsEncryptCacheDir string
+}
+
+type ConfigProxy struct {
+	Type      string
+	Hostname  string
+	Port      int
+	TLS       bool
+	Username  string
+	Interface string
+}
+
+// Config - Config options for the running app
+type Config struct {
+	gateway               *Gateway
+	ConfigFile            string
+	LogLevel              int
+	Gateway               bool
+	GatewayName           string
+	GatewayWhitelist      []glob.Glob
+	GatewayThrottle       int
+	GatewayTimeout        int
+	GatewayWebircPassword map[string]string
+	GatewayProtocol       string
+	GatewayLocalAddr      string
+	Proxy                 ConfigServer
+	Upstreams             []ConfigUpstream
+	Servers               []ConfigServer
+	ServerTransports      []string
+	RemoteOrigins         []glob.Glob
+	ReverseProxies        []net.IPNet
+	Webroot               string
+	ClientRealname        string
+	ClientUsername        string
+	ClientHostname        string
+	Identd                bool
+	RequiresVerification  bool
+	SendQuitOnClientClose string
+	ReCaptchaURL          string
+	ReCaptchaSecret       string
+	ReCaptchaKey          string
+	Secret                string
+	Plugins               []string
+	DnsblServers          []string
+	// DnsblAction - "deny" = deny the connection. "verify" = require verification
+	DnsblAction string
+}
+
+func NewConfig(gateway *Gateway) *Config {
+	return &Config{gateway: gateway}
+}
+
+// ConfigResolvePath - If relative, resolve a path to it's full absolute path relative to the config file
+func (c *Config) ResolvePath(path string) string {
+	// Absolute paths should stay as they are
+	if path[0:1] == "/" {
+		return path
+	}
+
+	resolved := filepath.Dir(c.ConfigFile)
+	resolved = filepath.Clean(resolved + "/" + path)
+	return resolved
+}
+
+func (c *Config) SetConfigFile(configFile string) {
+	// Config paths starting with $ is executed rather than treated as a path
+	if strings.HasPrefix(configFile, "$ ") {
+		c.ConfigFile = configFile
+	} else {
+		c.ConfigFile, _ = filepath.Abs(configFile)
+	}
+}
+
+// CurrentConfigFile - Return the full path or command for the config file in use
+func (c *Config) CurrentConfigFile() string {
+	return c.ConfigFile
+}
+
+func (c *Config) Load() error {
+	var configSrc interface{}
+
+	if strings.HasPrefix(c.ConfigFile, "$ ") {
+		cmdRawOut, err := exec.Command("sh", "-c", c.ConfigFile[2:]).Output()
+		if err != nil {
+			return err
+		}
+
+		configSrc = cmdRawOut
+	} else {
+		configSrc = c.ConfigFile
+	}
+
+	cfg, err := ini.LoadSources(ini.LoadOptions{AllowBooleanKeys: true, SpaceBeforeInlineComment: true}, configSrc)
+	if err != nil {
+		return err
+	}
+
+	// Clear the existing config
+	c.Gateway = false
+	c.GatewayWebircPassword = make(map[string]string)
+	c.Proxy = ConfigServer{}
+	c.Upstreams = []ConfigUpstream{}
+	c.Servers = []ConfigServer{}
+	c.ServerTransports = []string{}
+	c.RemoteOrigins = []glob.Glob{}
+	c.GatewayWhitelist = []glob.Glob{}
+	c.ReverseProxies = []net.IPNet{}
+	c.Webroot = ""
+	c.ReCaptchaURL = ""
+	c.ReCaptchaSecret = ""
+	c.ReCaptchaKey = ""
+	c.RequiresVerification = false
+	c.Secret = ""
+	c.SendQuitOnClientClose = ""
+	c.ClientRealname = ""
+	c.ClientUsername = ""
+	c.ClientHostname = ""
+	c.DnsblServers = []string{}
+	c.DnsblAction = ""
+
+	for _, section := range cfg.Sections() {
+		if strings.Index(section.Name(), "DEFAULT") == 0 {
+			c.LogLevel = section.Key("logLevel").MustInt(3)
+			if c.LogLevel < 1 || c.LogLevel > 3 {
+				c.gateway.Log(3, "Config option logLevel must be between 1-3. Setting default value of 3.")
+				c.LogLevel = 3
+			}
+
+			c.Identd = section.Key("identd").MustBool(false)
+
+			c.GatewayName = section.Key("gateway_name").MustString("")
+			if strings.Contains(c.GatewayName, " ") {
+				c.gateway.Log(3, "Config option gateway_name must not contain spaces")
+				c.GatewayName = ""
+			}
+
+			c.Secret = section.Key("secret").MustString("")
+			c.SendQuitOnClientClose = section.Key("send_quit_on_client_close").MustString("Connection closed")
+		}
+
+		if section.Name() == "verify" {
+			captchaSecret := section.Key("recaptcha_secret").MustString("")
+			captchaKey := section.Key("recaptcha_key").MustString("")
+			if captchaSecret != "" && captchaKey != "" {
+				c.RequiresVerification = section.Key("required").MustBool(false)
+				c.ReCaptchaSecret = captchaSecret
+			}
+			c.ReCaptchaURL = section.Key("recaptcha_url").MustString("https://www.google.com/recaptcha/api/siteverify")
+		}
+
+		if section.Name() == "dnsbl" {
+			c.DnsblAction = section.Key("action").MustString("")
+		}
+
+		if section.Name() == "dnsbl.servers" {
+			c.DnsblServers = append(c.DnsblServers, section.KeyStrings()...)
+		}
+
+		if section.Name() == "gateway" {
+			c.Gateway = section.Key("enabled").MustBool(false)
+			c.GatewayTimeout = section.Key("timeout").MustInt(10)
+			c.GatewayThrottle = section.Key("throttle").MustInt(2)
+
+			validProtocols := []string{"tcp", "tcp4", "tcp6"}
+			c.GatewayProtocol = stringInSliceOrDefault(section.Key("protocol").MustString(""), "tcp", validProtocols)
+			c.GatewayLocalAddr = section.Key("localaddr").MustString("")
+		}
+
+		if section.Name() == "gateway.webirc" {
+			for _, serverAddr := range section.KeyStrings() {
+				c.GatewayWebircPassword[serverAddr] = section.Key(serverAddr).MustString("")
+			}
+		}
+
+		if strings.Index(section.Name(), "clients") == 0 {
+			c.ClientUsername = section.Key("username").MustString("")
+			c.ClientRealname = section.Key("realname").MustString("")
+			c.ClientHostname = section.Key("hostname").MustString("")
+		}
+
+		if strings.Index(section.Name(), "fileserving") == 0 {
+			if section.Key("enabled").MustBool(false) {
+				c.Webroot = section.Key("webroot").MustString("")
+			}
+		}
+
+		if strings.Index(section.Name(), "server.") == 0 {
+			server := ConfigServer{}
+			server.LocalAddr = confKeyAsString(section.Key("bind"), "127.0.0.1")
+			rawMode := confKeyAsString(section.Key("bind_mode"), "")
+			mode, err := strconv.ParseInt(rawMode, 8, 32)
+			if err != nil {
+				mode = 0755
+			}
+			server.BindMode = os.FileMode(mode)
+			server.Port = confKeyAsInt(section.Key("port"), 80)
+			server.TLS = confKeyAsBool(section.Key("tls"), false)
+			server.CertFile = confKeyAsString(section.Key("cert"), "")
+			server.KeyFile = confKeyAsString(section.Key("key"), "")
+			server.LetsEncryptCacheDir = confKeyAsString(section.Key("letsencrypt_cache"), "")
+
+			if strings.HasSuffix(server.LetsEncryptCacheDir, ".cache") {
+				return errors.New("Syntax has changed. Please update letsencrypt_cache to a directory path (eg ./cache)")
+			}
+
+			c.Servers = append(c.Servers, server)
+		}
+
+		if section.Name() == "proxy" {
+			server := ConfigServer{}
+			server.LocalAddr = confKeyAsString(section.Key("bind"), "0.0.0.0")
+			server.Port = confKeyAsInt(section.Key("port"), 7999)
+			c.Proxy = server
+		}
+
+		if strings.Index(section.Name(), "upstream.") == 0 {
+			upstream := ConfigUpstream{}
+
+			validProtocols := []string{"tcp", "tcp4", "tcp6", "unix"}
+			upstream.Protocol = stringInSliceOrDefault(section.Key("protocol").MustString(""), "tcp", validProtocols)
+
+			hostname := section.Key("hostname").MustString("127.0.0.1")
+			if strings.HasPrefix(strings.ToLower(hostname), "unix:") {
+				upstream.Protocol = "unix"
+				upstream.Hostname = hostname[5:]
+			} else {
+				upstream.Hostname = hostname
+				upstream.Port = section.Key("port").MustInt(6667)
+				upstream.TLS = section.Key("tls").MustBool(false)
+			}
+
+			upstream.Timeout = section.Key("timeout").MustInt(10)
+			upstream.Throttle = section.Key("throttle").MustInt(2)
+			upstream.WebircPassword = section.Key("webirc").MustString("")
+			upstream.ServerPassword = section.Key("serverpassword").MustString("")
+			upstream.LocalAddr = section.Key("localaddr").MustString("")
+
+			upstream.GatewayName = section.Key("gateway_name").MustString("")
+			if strings.Contains(upstream.GatewayName, " ") {
+				c.gateway.Log(3, "Config option gateway_name must not contain spaces")
+				upstream.GatewayName = ""
+			}
+
+			upstream.NetworkCommonAddress = section.Key("network_common_address").MustString("")
+
+			c.Upstreams = append(c.Upstreams, upstream)
+		}
+
+		// "engines" is now legacy naming
+		if section.Name() == "engines" || section.Name() == "transports" {
+			for _, transport := range section.KeyStrings() {
+				c.ServerTransports = append(c.ServerTransports, strings.Trim(transport, "\n"))
+			}
+		}
+
+		if strings.Index(section.Name(), "plugins") == 0 {
+			for _, plugin := range section.KeyStrings() {
+				c.Plugins = append(c.Plugins, strings.Trim(plugin, "\n"))
+			}
+		}
+
+		if strings.Index(section.Name(), "allowed_origins") == 0 {
+			for _, origin := range section.KeyStrings() {
+				match, err := glob.Compile(origin)
+				if err != nil {
+					c.gateway.Log(3, "Config section allowed_origins has invalid match, "+origin)
+					continue
+				}
+				c.RemoteOrigins = append(c.RemoteOrigins, match)
+			}
+		}
+
+		if strings.Index(section.Name(), "gateway.whitelist") == 0 {
+			for _, origin := range section.KeyStrings() {
+				match, err := glob.Compile(origin)
+				if err != nil {
+					c.gateway.Log(3, "Config section gateway.whitelist has invalid match, "+origin)
+					continue
+				}
+				c.GatewayWhitelist = append(c.GatewayWhitelist, match)
+			}
+		}
+
+		if strings.Index(section.Name(), "reverse_proxies") == 0 {
+			for _, cidrRange := range section.KeyStrings() {
+				_, validRange, cidrErr := net.ParseCIDR(cidrRange)
+				if cidrErr != nil {
+					c.gateway.Log(3, "Config section reverse_proxies has invalid entry, "+cidrRange)
+					continue
+				}
+				c.ReverseProxies = append(c.ReverseProxies, *validRange)
+			}
+		}
+	}
+
+	return nil
+}
+
+func confKeyAsString(key *ini.Key, def string) string {
+	val := def
+
+	str := key.String()
+	if len(str) > 1 && str[:1] == "$" {
+		val = os.Getenv(str[1:])
+	} else {
+		val = key.MustString(def)
+	}
+
+	return val
+}
+
+func confKeyAsInt(key *ini.Key, def int) int {
+	val := def
+
+	str := key.String()
+	if len(str) > 1 && str[:1] == "$" {
+		envVal := os.Getenv(str[1:])
+		envValInt, err := strconv.Atoi(envVal)
+		if err == nil {
+			val = envValInt
+		}
+	} else {
+		val = key.MustInt(def)
+	}
+
+	return val
+}
+
+func confKeyAsBool(key *ini.Key, def bool) bool {
+	val := def
+
+	str := key.String()
+	if len(str) > 1 && str[:1] == "$" {
+		envVal := os.Getenv(str[1:])
+		if envVal == "0" || envVal == "false" || envVal == "no" {
+			val = false
+		} else {
+			val = true
+		}
+	} else {
+		val = key.MustBool(def)
+	}
+
+	return val
+}

package/webircgateway/pkg/webircgateway/gateway.go

@@ -0,0 +1,278 @@
+package webircgateway
+
+import (
+	"crypto/tls"
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+
+	"errors"
+
+	"github.com/kiwiirc/webircgateway/pkg/identd"
+	"github.com/kiwiirc/webircgateway/pkg/proxy"
+	cmap "github.com/orcaman/concurrent-map"
+)
+
+var (
+	Version = "-"
+)
+
+type Gateway struct {
+	Config      *Config
+	HttpRouter  *http.ServeMux
+	LogOutput   chan string
+	messageTags *MessageTagManager
+	identdServ  identd.Server
+	Clients     cmap.ConcurrentMap
+	Acme        *LEManager
+	Function    string
+	httpSrvs    []*http.Server
+	httpSrvsMu  sync.Mutex
+	closeWg     sync.WaitGroup
+}
+
+func NewGateway(function string) *Gateway {
+	s := &Gateway{}
+	s.Function = function
+	s.Config = NewConfig(s)
+	s.HttpRouter = http.NewServeMux()
+	s.LogOutput = make(chan string, 5)
+	s.identdServ = identd.NewIdentdServer()
+	s.messageTags = NewMessageTagManager()
+	// Clients hold a map lookup for all the connected clients
+	s.Clients = cmap.New()
+	s.Acme = NewLetsEncryptManager(s)
+
+	return s
+}
+
+func (s *Gateway) Log(level int, format string, args ...interface{}) {
+	if level < s.Config.LogLevel {
+		return
+	}
+
+	levels := [...]string{"L_DEBUG", "L_INFO", "L_WARN"}
+	line := fmt.Sprintf(levels[level-1]+" "+format, args...)
+	s.LogOutput <- line
+}
+
+func (s *Gateway) Start() {
+	s.closeWg.Add(1)
+
+	if s.Function == "gateway" {
+		s.maybeStartStaticFileServer()
+		s.initHttpRoutes()
+		s.maybeStartIdentd()
+
+		for _, serverConfig := range s.Config.Servers {
+			go s.startServer(serverConfig)
+		}
+	}
+
+	if s.Function == "proxy" {
+		proxy.Start(fmt.Sprintf("%s:%d", s.Config.Proxy.LocalAddr, s.Config.Proxy.Port))
+	}
+}
+
+func (s *Gateway) Close() {
+	hook := HookGatewayClosing{}
+	hook.Dispatch("gateway.closing")
+
+	defer s.closeWg.Done()
+
+	s.httpSrvsMu.Lock()
+	defer s.httpSrvsMu.Unlock()
+
+	for _, httpSrv := range s.httpSrvs {
+		httpSrv.Close()
+	}
+}
+
+func (s *Gateway) WaitClose() {
+	s.closeWg.Wait()
+}
+
+func (s *Gateway) maybeStartStaticFileServer() {
+	if s.Config.Webroot != "" {
+		webroot := s.Config.ResolvePath(s.Config.Webroot)
+		s.Log(2, "Serving files from %s", webroot)
+		s.HttpRouter.Handle("/", http.FileServer(http.Dir(webroot)))
+	}
+}
+
+func (s *Gateway) initHttpRoutes() error {
+	// Add all the transport routes
+	engineConfigured := false
+	for _, transport := range s.Config.ServerTransports {
+		switch transport {
+		case "kiwiirc":
+			t := &TransportKiwiirc{}
+			t.Init(s)
+			engineConfigured = true
+		case "websocket":
+			t := &TransportWebsocket{}
+			t.Init(s)
+			engineConfigured = true
+		case "sockjs":
+			t := &TransportSockjs{}
+			t.Init(s)
+			engineConfigured = true
+		default:
+			s.Log(3, "Invalid server engine: '%s'", transport)
+		}
+	}
+
+	if !engineConfigured {
+		s.Log(3, "No server engines configured")
+		return errors.New("No server engines configured")
+	}
+
+	// Add some general server info about this webircgateway instance
+	s.HttpRouter.HandleFunc("/webirc/info", func(w http.ResponseWriter, r *http.Request) {
+		out, _ := json.Marshal(map[string]interface{}{
+			"name":    "webircgateway",
+			"version": Version,
+		})
+
+		w.Write(out)
+	})
+
+	s.HttpRouter.HandleFunc("/webirc/_status", func(w http.ResponseWriter, r *http.Request) {
+		if !isPrivateIP(s.GetRemoteAddressFromRequest(r)) {
+			w.WriteHeader(403)
+			return
+		}
+
+		out := ""
+		for item := range s.Clients.IterBuffered() {
+			c := item.Val.(*Client)
+			line := fmt.Sprintf(
+				"%s:%d %s %s!%s %s %s",
+				c.UpstreamConfig.Hostname,
+				c.UpstreamConfig.Port,
+				c.State,
+				c.IrcState.Nick,
+				c.IrcState.Username,
+				c.RemoteAddr,
+				c.RemoteHostname,
+			)
+
+			// Allow plugins to add their own status data
+			hook := HookStatus{}
+			hook.Client = c
+			hook.Line = line
+			hook.Dispatch("status.client")
+			if !hook.Halt {
+				out += hook.Line + "\n"
+			}
+
+		}
+
+		w.Write([]byte(out))
+	})
+
+	return nil
+}
+
+func (s *Gateway) maybeStartIdentd() {
+	if s.Config.Identd {
+		err := s.identdServ.Run()
+		if err != nil {
+			s.Log(3, "Error starting identd server: %s", err.Error())
+		} else {
+			s.Log(2, "Identd server started")
+		}
+	}
+}
+
+func (s *Gateway) startServer(conf ConfigServer) {
+	addr := fmt.Sprintf("%s:%d", conf.LocalAddr, conf.Port)
+
+	if strings.HasPrefix(strings.ToLower(conf.LocalAddr), "tcp:") {
+		t := &TransportTcp{}
+		t.Init(s)
+		t.Start(conf.LocalAddr[4:] + ":" + strconv.Itoa(conf.Port))
+	} else if conf.TLS && conf.LetsEncryptCacheDir == "" {
+		if conf.CertFile == "" || conf.KeyFile == "" {
+			s.Log(3, "'cert' and 'key' options must be set for TLS servers")
+			return
+		}
+
+		tlsCert := s.Config.ResolvePath(conf.CertFile)
+		tlsKey := s.Config.ResolvePath(conf.KeyFile)
+
+		s.Log(2, "Listening with TLS on %s", addr)
+		keyPair, keyPairErr := tls.LoadX509KeyPair(tlsCert, tlsKey)
+		if keyPairErr != nil {
+			s.Log(3, "Failed to listen with TLS, certificate error: %s", keyPairErr.Error())
+			return
+		}
+		srv := &http.Server{
+			Addr: addr,
+			TLSConfig: &tls.Config{
+				Certificates: []tls.Certificate{keyPair},
+			},
+			Handler: s.HttpRouter,
+		}
+		s.httpSrvsMu.Lock()
+		s.httpSrvs = append(s.httpSrvs, srv)
+		s.httpSrvsMu.Unlock()
+
+		// Don't use HTTP2 since it doesn't support websockets
+		srv.TLSNextProto = make(map[string]func(*http.Server, *tls.Conn, http.Handler))
+
+		err := srv.ListenAndServeTLS("", "")
+		if err != nil && err != http.ErrServerClosed {
+			s.Log(3, "Failed to listen with TLS: %s", err.Error())
+		}
+	} else if conf.TLS && conf.LetsEncryptCacheDir != "" {
+		s.Log(2, "Listening with letsencrypt TLS on %s", addr)
+		leManager := s.Acme.Get(conf.LetsEncryptCacheDir)
+		srv := &http.Server{
+			Addr: addr,
+			TLSConfig: &tls.Config{
+				GetCertificate: leManager.GetCertificate,
+			},
+			Handler: s.HttpRouter,
+		}
+		s.httpSrvsMu.Lock()
+		s.httpSrvs = append(s.httpSrvs, srv)
+		s.httpSrvsMu.Unlock()
+
+		// Don't use HTTP2 since it doesn't support websockets
+		srv.TLSNextProto = make(map[string]func(*http.Server, *tls.Conn, http.Handler))
+
+		err := srv.ListenAndServeTLS("", "")
+		if err != nil && err != http.ErrServerClosed {
+			s.Log(3, "Listening with letsencrypt failed: %s", err.Error())
+		}
+	} else if strings.HasPrefix(strings.ToLower(conf.LocalAddr), "unix:") {
+		socketFile := conf.LocalAddr[5:]
+		s.Log(2, "Listening on %s", socketFile)
+		os.Remove(socketFile)
+		server, serverErr := net.Listen("unix", socketFile)
+		if serverErr != nil {
+			s.Log(3, serverErr.Error())
+			return
+		}
+		os.Chmod(socketFile, conf.BindMode)
+		http.Serve(server, s.HttpRouter)
+	} else {
+		s.Log(2, "Listening on %s", addr)
+		srv := &http.Server{Addr: addr, Handler: s.HttpRouter}
+
+		s.httpSrvsMu.Lock()
+		s.httpSrvs = append(s.httpSrvs, srv)
+		s.httpSrvsMu.Unlock()
+
+		err := srv.ListenAndServe()
+		if err != nil && err != http.ErrServerClosed {
+			s.Log(3, err.Error())
+		}
+	}
+}