serverless-ircd 0.1.0 → 0.2.0

package/webircgateway/pkg/webircgateway/gateway_utils.go

@@ -0,0 +1,133 @@
+package webircgateway
+
+import (
+	"errors"
+	"math/rand"
+	"net"
+	"net/http"
+	"strings"
+)
+
+var v4LoopbackAddr = net.ParseIP("127.0.0.1")
+
+func (s *Gateway) NewClient() *Client {
+	return NewClient(s)
+}
+
+func (s *Gateway) IsClientOriginAllowed(originHeader string) bool {
+	// Empty list of origins = all origins allowed
+	if len(s.Config.RemoteOrigins) == 0 {
+		return true
+	}
+
+	// No origin header = running on the same page
+	if originHeader == "" {
+		return true
+	}
+
+	foundMatch := false
+
+	for _, originMatch := range s.Config.RemoteOrigins {
+		if originMatch.Match(originHeader) {
+			foundMatch = true
+			break
+		}
+	}
+
+	return foundMatch
+}
+
+func (s *Gateway) isIrcAddressAllowed(addr string) bool {
+	// Empty whitelist = all destinations allowed
+	if len(s.Config.GatewayWhitelist) == 0 {
+		return true
+	}
+
+	foundMatch := false
+
+	for _, addrMatch := range s.Config.GatewayWhitelist {
+		if addrMatch.Match(addr) {
+			foundMatch = true
+			break
+		}
+	}
+
+	return foundMatch
+}
+
+func (s *Gateway) findUpstream() (ConfigUpstream, error) {
+	var ret ConfigUpstream
+
+	if len(s.Config.Upstreams) == 0 {
+		return ret, errors.New("No upstreams available")
+	}
+
+	randIdx := rand.Intn(len(s.Config.Upstreams))
+	ret = s.Config.Upstreams[randIdx]
+
+	return ret, nil
+}
+
+func (s *Gateway) findWebircPassword(ircHost string) string {
+	pass, exists := s.Config.GatewayWebircPassword[strings.ToLower(ircHost)]
+	if !exists {
+		pass = ""
+	}
+
+	return pass
+}
+
+func (s *Gateway) GetRemoteAddressFromRequest(req *http.Request) net.IP {
+	remoteIP := remoteIPFromRequest(req)
+
+	// If the remoteIP is not in a whitelisted reverse proxy range, don't trust
+	// the headers and use the remoteIP as the users IP
+	if !s.isTrustedProxy(remoteIP) {
+		return remoteIP
+	}
+
+	headerVal := req.Header.Get("x-forwarded-for")
+	ips := strings.Split(headerVal, ",")
+	ipStr := strings.Trim(ips[0], " ")
+	if ipStr != "" {
+		ip := net.ParseIP(ipStr)
+		if ip != nil {
+			remoteIP = ip
+		}
+	}
+
+	return remoteIP
+
+}
+
+func (s *Gateway) isRequestSecure(req *http.Request) bool {
+	remoteIP := remoteIPFromRequest(req)
+
+	// If the remoteIP is not in a whitelisted reverse proxy range, don't trust
+	// the headers and check the request directly
+	if !s.isTrustedProxy(remoteIP) {
+		return req.TLS != nil
+	}
+
+	fwdProto := req.Header.Get("x-forwarded-proto")
+	return strings.EqualFold(fwdProto, "https")
+}
+
+func (s *Gateway) isTrustedProxy(remoteIP net.IP) bool {
+	for _, cidrRange := range s.Config.ReverseProxies {
+		if cidrRange.Contains(remoteIP) {
+			return true
+		}
+	}
+	return false
+}
+
+func remoteIPFromRequest(req *http.Request) net.IP {
+	if req.RemoteAddr == "@" {
+		// remote address is unix socket, treat it as loopback interface
+		return v4LoopbackAddr
+	}
+
+	remoteAddr, _, _ := net.SplitHostPort(req.RemoteAddr)
+	return net.ParseIP(remoteAddr)
+}

package/webircgateway/pkg/webircgateway/hooks.go

@@ -0,0 +1,152 @@
+package webircgateway
+
+import "github.com/kiwiirc/webircgateway/pkg/irc"
+
+var hooksRegistered map[string][]interface{}
+
+func init() {
+	hooksRegistered = make(map[string][]interface{})
+}
+
+func HookRegister(hookName string, p interface{}) {
+	_, exists := hooksRegistered[hookName]
+	if !exists {
+		hooksRegistered[hookName] = make([]interface{}, 0)
+	}
+
+	hooksRegistered[hookName] = append(hooksRegistered[hookName], p)
+}
+
+type Hook struct {
+	ID   string
+	Halt bool
+}
+
+func (h *Hook) getCallbacks(eventType string) []interface{} {
+	var f []interface{}
+	f = make([]interface{}, 0)
+
+	callbacks, exists := hooksRegistered[eventType]
+	if exists {
+		f = callbacks
+	}
+
+	return f
+}
+
+/**
+ * HookIrcConnectionPre
+ * Dispatched just before an IRC connection is attempted
+ * Types: irc.connection.pre
+ */
+type HookIrcConnectionPre struct {
+	Hook
+	Client         *Client
+	UpstreamConfig *ConfigUpstream
+}
+
+func (h *HookIrcConnectionPre) Dispatch(eventType string) {
+	for _, p := range h.getCallbacks(eventType) {
+		if f, ok := p.(func(*HookIrcConnectionPre)); ok {
+			f(h)
+		}
+	}
+}
+
+/**
+ * HookIrcLine
+ * Dispatched when either:
+ *   * A line arrives from the IRCd, before sending to the client
+ *   * A line arrives from the client, before sending to the IRCd
+ * Types: irc.line
+ */
+type HookIrcLine struct {
+	Hook
+	Client         *Client
+	UpstreamConfig *ConfigUpstream
+	Line           string
+	Message        *irc.Message
+	ToServer       bool
+}
+
+func (h *HookIrcLine) Dispatch(eventType string) {
+	for _, p := range h.getCallbacks(eventType) {
+		if f, ok := p.(func(*HookIrcLine)); ok {
+			f(h)
+		}
+	}
+}
+
+/**
+ * HookClientState
+ * Dispatched after a client connects or disconnects
+ * Types: client.state
+ */
+type HookClientState struct {
+	Hook
+	Client    *Client
+	Connected bool
+}
+
+func (h *HookClientState) Dispatch(eventType string) {
+	for _, p := range h.getCallbacks(eventType) {
+		if f, ok := p.(func(*HookClientState)); ok {
+			f(h)
+		}
+	}
+}
+
+/**
+ * HookClientInit
+ * Dispatched directly after a new Client instance has been created
+ * Types: client.init
+ */
+type HookClientInit struct {
+	Hook
+	Client    *Client
+	Connected bool
+}
+
+func (h *HookClientInit) Dispatch(eventType string) {
+	for _, p := range h.getCallbacks(eventType) {
+		if f, ok := p.(func(*HookClientInit)); ok {
+			f(h)
+		}
+	}
+}
+
+/**
+ * HookStatus
+ * Dispatched for each line output of the _status HTTP request
+ * Types: status.client
+ */
+type HookStatus struct {
+	Hook
+	Client *Client
+	Line   string
+}
+
+func (h *HookStatus) Dispatch(eventType string) {
+	for _, p := range h.getCallbacks(eventType) {
+		if f, ok := p.(func(*HookStatus)); ok {
+			f(h)
+		}
+	}
+}
+
+/**
+ * HookGatewayClosing
+ * Dispatched when the gateway has been told to shutdown
+ * Types: gateway.closing
+ */
+type HookGatewayClosing struct {
+	Hook
+}
+
+func (h *HookGatewayClosing) Dispatch(eventType string) {
+	for _, p := range h.getCallbacks(eventType) {
+		if f, ok := p.(func(*HookGatewayClosing)); ok {
+			f(h)
+		}
+	}
+}

package/webircgateway/pkg/webircgateway/letsencrypt.go

@@ -0,0 +1,41 @@
+package webircgateway
+
+import (
+	"context"
+	"strings"
+	"sync"
+
+	"golang.org/x/crypto/acme/autocert"
+)
+
+type LEManager struct {
+	// ensure only one instance of the manager and handler is running
+	// while allowing multiple listeners to use it
+	Mutex   sync.Mutex
+	Manager *autocert.Manager
+	gateway *Gateway
+}
+
+func NewLetsEncryptManager(gateway *Gateway) *LEManager {
+	return &LEManager{gateway: gateway}
+}
+
+func (le *LEManager) Get(certCacheDir string) *autocert.Manager {
+	le.Mutex.Lock()
+	defer le.Mutex.Unlock()
+
+	// Create it if it doesn't already exist
+	if le.Manager == nil {
+		le.Manager = &autocert.Manager{
+			Prompt: autocert.AcceptTOS,
+			Cache:  autocert.DirCache(strings.TrimRight(certCacheDir, "/")),
+			HostPolicy: func(ctx context.Context, host string) error {
+				le.gateway.Log(2, "Automatically requesting a HTTPS certificate for %s", host)
+				return nil
+			},
+		}
+		le.gateway.HttpRouter.Handle("/.well-known/", le.Manager.HTTPHandler(nil))
+	}
+
+	return le.Manager
+}

package/webircgateway/pkg/webircgateway/messagetags.go

@@ -0,0 +1,103 @@
+package webircgateway
+
+import (
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/OneOfOne/xxhash"
+	"github.com/kiwiirc/webircgateway/pkg/irc"
+)
+
+type MessageTagManager struct {
+	Mutex     sync.Mutex
+	knownTags map[uint64]MessageTags
+	gcTimes   map[uint64]time.Time
+}
+type MessageTags struct {
+	Tags map[string]string
+}
+
+func NewMessageTagManager() *MessageTagManager {
+	tm := &MessageTagManager{
+		knownTags: make(map[uint64]MessageTags),
+		gcTimes:   make(map[uint64]time.Time),
+	}
+
+	go tm.RunGarbageCollectionLoop()
+	return tm
+}
+
+func (tags *MessageTagManager) CanMessageContainClientTags(msg *irc.Message) bool {
+	return stringInSlice(msg.Command, []string{
+		"PRIVMSG",
+		"NOTICE",
+		"TAGMSG",
+	})
+}
+
+func (tags *MessageTagManager) RunGarbageCollectionLoop() {
+	for {
+		tags.Mutex.Lock()
+		for messageHash, timeCreated := range tags.gcTimes {
+			if timeCreated.Add(time.Second * 30).After(time.Now()) {
+				delete(tags.knownTags, messageHash)
+			}
+
+		}
+		tags.Mutex.Unlock()
+
+		time.Sleep(time.Second * 30)
+	}
+}
+
+func (tags *MessageTagManager) AddTagsFromMessage(client *Client, fromNick string, msg *irc.Message) {
+	if !tags.CanMessageContainClientTags(msg) {
+		return
+	}
+
+	clientTags := MessageTags{
+		Tags: make(map[string]string),
+	}
+	for tagName, tagVal := range msg.Tags {
+		if len(tagName) > 0 && tagName[0] == '+' {
+			clientTags.Tags[tagName] = tagVal
+		}
+	}
+
+	if len(clientTags.Tags) > 0 {
+		tags.Mutex.Lock()
+		msgHash := tags.messageHash(client, fromNick, msg)
+		tags.knownTags[msgHash] = clientTags
+		tags.gcTimes[msgHash] = time.Now()
+		tags.Mutex.Unlock()
+	}
+}
+
+func (tags *MessageTagManager) GetTagsFromMessage(client *Client, fromNick string, msg *irc.Message) (MessageTags, bool) {
+	if !tags.CanMessageContainClientTags(msg) {
+		return MessageTags{}, false
+	}
+
+	msgHash := tags.messageHash(client, fromNick, msg)
+
+	tags.Mutex.Lock()
+	defer tags.Mutex.Unlock()
+
+	clientTags, tagsExist := tags.knownTags[msgHash]
+	if !tagsExist {
+		return clientTags, false
+	}
+
+	return clientTags, true
+}
+
+func (tags *MessageTagManager) messageHash(client *Client, fromNick string, msg *irc.Message) uint64 {
+	h := xxhash.New64()
+	h.WriteString(strings.ToLower(client.UpstreamConfig.Hostname))
+	h.WriteString(strings.ToLower(fromNick))
+	// make target case insensitive
+	h.WriteString(strings.ToLower(msg.GetParam(0, "")))
+	h.WriteString(msg.GetParam(1, ""))
+	return h.Sum64()
+}

package/webircgateway/pkg/webircgateway/transport_kiwiirc.go

@@ -0,0 +1,206 @@
+package webircgateway
+
+import (
+	"fmt"
+	"log"
+	"net"
+	"net/http"
+	"runtime/debug"
+	"strings"
+	"sync"
+
+	"github.com/gorilla/websocket"
+	"github.com/igm/sockjs-go/v3/sockjs"
+	cmap "github.com/orcaman/concurrent-map"
+)
+
+type TransportKiwiirc struct {
+	gateway *Gateway
+}
+
+func (t *TransportKiwiirc) Init(g *Gateway) {
+	t.gateway = g
+	sockjsOptions := sockjs.DefaultOptions
+	sockjsOptions.WebsocketUpgrader = &websocket.Upgrader{
+		// Origin is checked within the session handler
+		CheckOrigin: func(_ *http.Request) bool { return true },
+	}
+	handler := sockjs.NewHandler("/webirc/kiwiirc", sockjsOptions, t.sessionHandler)
+	t.gateway.HttpRouter.Handle("/webirc/kiwiirc/", handler)
+}
+
+func (t *TransportKiwiirc) makeChannel(chanID string, ws sockjs.Session) *TransportKiwiircChannel {
+	client := t.gateway.NewClient()
+
+	originHeader := strings.ToLower(ws.Request().Header.Get("Origin"))
+	if !t.gateway.IsClientOriginAllowed(originHeader) {
+		client.Log(2, "Origin %s not allowed. Closing connection", originHeader)
+		ws.Close(0, "Origin not allowed")
+		return nil
+	}
+
+	client.RemoteAddr = t.gateway.GetRemoteAddressFromRequest(ws.Request()).String()
+
+	clientHostnames, err := net.LookupAddr(client.RemoteAddr)
+	if err != nil || len(clientHostnames) == 0 {
+		client.RemoteHostname = client.RemoteAddr
+	} else {
+		// FQDNs include a . at the end. Strip it out
+		potentialHostname := strings.Trim(clientHostnames[0], ".")
+
+		// Must check that the resolved hostname also resolves back to the users IP
+		addr, err := net.LookupIP(potentialHostname)
+		if err == nil && len(addr) == 1 && addr[0].String() == client.RemoteAddr {
+			client.RemoteHostname = potentialHostname
+		} else {
+			client.RemoteHostname = client.RemoteAddr
+		}
+	}
+
+	if t.gateway.isRequestSecure(ws.Request()) {
+		client.Tags["secure"] = ""
+	}
+
+	// This doesn't make sense to have since the remote port may change between requests. Only
+	// here for testing purposes for now.
+	_, remoteAddrPort, _ := net.SplitHostPort(ws.Request().RemoteAddr)
+	client.Tags["remote-port"] = remoteAddrPort
+
+	client.Log(2, "New kiwiirc channel on %s from %s %s", ws.Request().Host, client.RemoteAddr, client.RemoteHostname)
+	client.Ready()
+
+	channel := &TransportKiwiircChannel{
+		Id:           chanID,
+		Client:       client,
+		Conn:         ws,
+		waitForClose: make(chan bool),
+		Closed:       false,
+	}
+
+	go channel.listenForSignals()
+
+	return channel
+}
+
+func (t *TransportKiwiirc) sessionHandler(session sockjs.Session) {
+	// Don't let a single users error kill the entire service for everyone
+	defer func() {
+		if r := recover(); r != nil {
+			log.Printf("[ERROR] Recovered from %s\n%s", r, debug.Stack())
+		}
+	}()
+
+	channels := cmap.New()
+
+	// Read from sockjs
+	go func() {
+		for {
+			msg, err := session.Recv()
+			if err == nil && len(msg) > 0 {
+				idEnd := strings.Index(msg, " ")
+				if idEnd == -1 {
+					// msg is in the form of ":chanId"
+					chanID := msg[1:]
+
+					c, channelExists := channels.Get(chanID)
+					if channelExists {
+						channel := c.(*TransportKiwiircChannel)
+						channel.close()
+					}
+
+					if !channelExists {
+						channel := t.makeChannel(chanID, session)
+						if channel == nil {
+							continue
+						}
+						channels.Set(chanID, channel)
+
+						// When the channel closes, remove it from the map again
+						go func() {
+							<-channel.waitForClose
+							channel.Client.Log(2, "Removing channel from connection")
+							channels.Remove(chanID)
+						}()
+					}
+
+					session.Send(":" + chanID)
+
+				} else {
+					// msg is in the form of ":chanId data"
+					chanID := msg[1:idEnd]
+					data := msg[idEnd+1:]
+
+					channel, channelExists := channels.Get(chanID)
+					if channelExists {
+						c := channel.(*TransportKiwiircChannel)
+						c.handleIncomingLine(data)
+					}
+				}
+			} else if err != nil {
+				t.gateway.Log(1, "kiwi connection closed (%s)", err.Error())
+				break
+			}
+		}
+
+		for channel := range channels.IterBuffered() {
+			c := channel.Val.(*TransportKiwiircChannel)
+			c.Closed = true
+			c.Client.StartShutdown("client_closed")
+		}
+	}()
+}
+
+type TransportKiwiircChannel struct {
+	Conn         sockjs.Session
+	Client       *Client
+	Id           string
+	waitForClose chan bool
+	ClosedLock   sync.Mutex
+	Closed       bool
+}
+
+func (c *TransportKiwiircChannel) listenForSignals() {
+	for {
+		signal, ok := <-c.Client.Signals
+		if !ok {
+			break
+		}
+		c.Client.Log(1, "signal:%s %s", signal[0], signal[1])
+		if signal[0] == "state" {
+			if signal[1] == "connected" {
+				c.Conn.Send(fmt.Sprintf(":%s control connected", c.Id))
+			} else if signal[1] == "closed" {
+				c.Conn.Send(fmt.Sprintf(":%s control closed %s", c.Id, signal[2]))
+			}
+		}
+
+		if signal[0] == "data" {
+			toSend := strings.Trim(signal[1], "\r\n")
+			c.Conn.Send(fmt.Sprintf(":%s %s", c.Id, toSend))
+		}
+	}
+
+	c.ClosedLock.Lock()
+
+	c.Closed = true
+	close(c.Client.Recv)
+	close(c.waitForClose)
+
+	c.ClosedLock.Unlock()
+}
+
+func (c *TransportKiwiircChannel) handleIncomingLine(line string) {
+	c.ClosedLock.Lock()
+
+	if !c.Closed {
+		c.Client.Recv <- line
+	}
+
+	c.ClosedLock.Unlock()
+}
+
+func (c *TransportKiwiircChannel) close() {
+	if c.Client.upstream != nil {
+		c.Client.upstream.Close()
+	}
+}