Create updated service

1 files changed, 302 insertions, 164 deletions

diff --git a/main.go b/main.go
index 2c99e0e..d883754 100644
--- a/main.go
+++ b/main.go
@@ -1,236 +1,374 @@
 package main
 
 import (
-        "bytes"
+        "encoding/base64"
         "encoding/json"
-        "errors"
         "fmt"
-        "github.com/miekg/dns"
         "io/ioutil"
+        "log"
+        "net"
         "net/http"
+        "net/url"
+        "regexp"
         "strings"
-        "text/template"
-        "time"
+
+        "code.crute.me/mcrute/go_ddns_manager/bind"
+        "code.crute.me/mcrute/go_ddns_manager/dns"
+        "github.com/gin-gonic/gin"
+)
+
+const (
+        ACME_AUTH_KEY = "ACMEAuthContext"
+        DDNS_AUTH_KEY = "DDNSAuthZone"
 )
 
-type Zone struct {
-        Name string
-        View string
+var (
+        cfg      *bind.BINDConfig
+        secrets  *Secrets
+        ipRegexp = regexp.MustCompile(`(?:\[([0-9a-f:]+)\]|(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})):\d+`)
+)
+
+func init() {
+        var err error
+        cfg, err = bind.ParseBINDConfig("zones.conf")
+        if err != nil {
+                panic(err)
+        }
+
+        fd, err := ioutil.ReadFile("secrets.json")
+        if err != nil {
+                panic(err)
+        }
+
+        secrets = &Secrets{}
+        if err = json.Unmarshal(fd, secrets); err != nil {
+                panic(err)
+        }
+}
+
+type Secrets struct {
+        DDNS map[string]string
+        ACME map[string]map[string]int
+}
+
+type DDNSUpdateRequest struct {
+        Key string `form:"key" binding:"required"`
 }
 
-type TSIGSecrets struct {
-        secrets   map[string]map[string]TSIGSecret
-        viewzones map[string][]string
+type ACMEChallenge struct {
+        Zone      string `json:"zone" binding:"required"`
+        Challenge string `json:"challenge" binding:"required"`
 }
 
-func NewTSIGSecrets() *TSIGSecrets {
-        return &TSIGSecrets{
-                secrets:   make(map[string]map[string]TSIGSecret),
-                viewzones: make(map[string][]string),
+type ACMEChallengeID struct {
+        Zone      string
+        Prefix    string
+        Challenge string
+}
+
+func joinDomainParts(parts ...string) string {
+        p := []string{}
+        for _, i := range parts {
+                if strings.TrimSpace(i) != "" {
+                        p = append(p, i)
+                }
         }
+        return strings.Join(p, ".")
 }
 
-func (t *TSIGSecrets) GetViews() []string {
-        r := make([]string, 0, len(t.viewzones))
-        for k := range t.viewzones {
-                r = append(r, k)
+// Find the closest zone that we manage by striping dotted components off the
+// front of the domain until one matches. If there is a match return the zone
+// that matched and any prefix components, if any, as a dotted string. If none
+// match then return nil.
+func findClosestZone(cfg *bind.BINDConfig, zoneIn, view string) (*bind.Zone, string) {
+        suffix := ""
+        prefix := []string{}
+
+        zc := strings.Split(zoneIn, ".")
+        for i := 0; i <= len(zc)-2; i++ {
+                prefix, suffix = zc[:i], strings.Join(zc[i:], ".")
+                if zone := cfg.Zone(view, suffix); zone != nil {
+                        return zone, strings.Join(prefix, ".")
+                }
         }
-        return r
+
+        return nil, ""
 }
 
-func (t *TSIGSecrets) GetViewZones() map[string][]string {
-        return t.viewzones
+func makeURL(r *http.Request, path string, subs ...interface{}) *url.URL {
+        scheme := "https"
+
+        if r.TLS == nil {
+                scheme = "http"
+        }
+
+        // Always defer to whatever the proxy told us it was doing because this
+        // could be a mullet-VIP in either direction.
+        if fwProto := r.Header.Get("X-Forwarded-Proto"); fwProto != "" {
+                scheme = fwProto
+        }
+
+        return &url.URL{
+                Scheme: scheme,
+                Host:   r.Host,
+                Path:   fmt.Sprintf(path, subs...),
+        }
 }
 
-func (t *TSIGSecrets) UnmarshalJSON(d []byte) error {
-        v := make(map[string]map[string]string)
+func createAcmeChallenge(c *gin.Context) {
+        dc := dns.DNSClient{Server: "172.16.18.52:53"}
 
-        if err := json.Unmarshal(d, &v); err != nil {
-                return err
+        var ch ACMEChallenge
+        if err := c.ShouldBindJSON(&ch); err != nil {
+                c.JSON(http.StatusBadRequest, gin.H{
+                        "error": err.Error(),
+                })
+                return
         }
 
-        for k, v := range v {
-                o := strings.Split(k, "-")
-                view := o[len(o)-1]
+        zone, prefix := findClosestZone(cfg, ch.Zone, "external")
+        if zone == nil {
+                c.JSON(http.StatusNotFound, gin.H{
+                        "error": "Zone not found",
+                })
+                return
+        }
 
-                d := make([]string, len(o))
-                copy(d, o[:len(o)-1])
-                dn := strings.Join(d, ".")
+        if v, ok := c.Get(ACME_AUTH_KEY); !ok || v.(map[string]int)[zone.Name] != 1 {
+                c.JSON(http.StatusForbidden, gin.H{
+                        "error": "Zone update not allowed",
+                })
+                return
+        }
 
-                a, ok := v["algorithm"]
-                if !ok {
-                        a = "hmac-sha256."
-                }
+        // Do this first, in-case it fails (even though it should never fail)
+        id, err := json.Marshal(ACMEChallengeID{
+                Zone:      zone.Name,
+                Prefix:    prefix,
+                Challenge: ch.Challenge,
+        })
+        if err != nil {
+                log.Printf("error: %s", err)
+                c.JSON(http.StatusInternalServerError, gin.H{
+                        "error": "error encoding ID",
+                })
+                return
+        }
 
-                if !strings.HasSuffix(a, ".") {
-                        a = fmt.Sprintf("%s.", a)
-                }
+        url := makeURL(c.Request, "/acme/%s", base64.URLEncoding.EncodeToString(id))
 
-                if _, ok := t.viewzones[view]; !ok {
-                        t.viewzones[view] = make([]string, 1)
-                        t.viewzones[view] = append(t.viewzones[view], dn)
-                } else {
-                        t.viewzones[view] = append(t.viewzones[view], dn)
-                }
+        t := &dns.TXT{
+                Name: joinDomainParts("_acme-challenge", prefix),
+                Ttl:  5,
+                Txt:  []string{ch.Challenge},
+        }
 
-                if _, ok := t.secrets[view]; !ok {
-                        t.secrets[view] = make(map[string]TSIGSecret)
-                }
+        log.Printf("%+v %+v '%s'", zone, t, t.Name)
 
-                if !strings.HasSuffix(k, ".") {
-                        k = fmt.Sprintf("%s.", k)
-                }
+        // Cleanup any old challenges before adding a new one
+        if err := dc.RemoveAll(zone, t); err != nil {
+                log.Printf("error RemoveAll: %s", err)
+                c.JSON(http.StatusInternalServerError, gin.H{
+                        "error": err.Error(),
+                })
+                return
+        }
 
-                t.secrets[view][dn] = TSIGSecret{
-                        KeyName:   k,
-                        Algorithm: a,
-                        Secret:    v["secret"],
-                }
+        if err := dc.Insert(zone, t); err != nil {
+                log.Printf("error Insert: %s", err)
+                c.JSON(http.StatusInternalServerError, gin.H{
+                        "error": err.Error(),
+                })
+                return
         }
 
-        return nil
+        c.Writer.Header()["Location"] = []string{url.String()}
+        c.JSON(http.StatusCreated, gin.H{
+                "created": url.String(),
+        })
 }
 
-func (t *TSIGSecrets) GetSecret(zone, view string) (*TSIGSecret, error) {
-        if !strings.HasSuffix(zone, ".") {
-                zone = fmt.Sprintf("%s.", zone)
+func deleteAcmeChallenge(c *gin.Context) {
+        dc := dns.DNSClient{Server: "172.16.18.52:53"}
+
+        rid, err := base64.URLEncoding.DecodeString(c.Param("id"))
+        if err != nil {
+                c.JSON(http.StatusBadRequest, gin.H{
+                        "error": "unable to decode ID",
+                })
+                return
         }
 
-        if _, ok := t.secrets[view]; !ok {
-                return nil, errors.New("No keys for requested zone")
+        var id ACMEChallengeID
+        if err = json.Unmarshal(rid, &id); err != nil {
+                c.JSON(http.StatusBadRequest, gin.H{
+                        "error": "unable to decode ID",
+                })
+                return
         }
 
-        key, ok := t.secrets[view][zone]
-        if !ok {
-                return nil, errors.New("No keys for requested view of zone")
+        zone := cfg.Zone("external", id.Zone)
+        if zone == nil {
+                c.JSON(http.StatusNotFound, gin.H{
+                        "error": "Zone not found",
+                })
+                return
         }
 
-        return &key, nil
-}
+        if v, ok := c.Get(ACME_AUTH_KEY); !ok || v.(map[string]int)[zone.Name] != 1 {
+                c.JSON(http.StatusForbidden, gin.H{
+                        "error": "Zone update not allowed",
+                })
+                return
+        }
 
-type Signable interface {
-        SetTsig(string, string, uint16, int64) *dns.Msg
-}
+        t := &dns.TXT{
+                Name: joinDomainParts("_acme-challenge", id.Prefix),
+                Ttl:  5,
+                Txt:  []string{id.Challenge},
+        }
 
-// TODO: Name and Algorithm end with dot (.)
-type TSIGSecret struct {
-        KeyName   string
-        Algorithm string `json:"algorithm"`
-        Secret    string `json:"secret"`
-}
+        if err := dc.Remove(zone, t); err != nil {
+                log.Printf("error Remove: %s", err)
+                c.JSON(http.StatusInternalServerError, gin.H{
+                        "error": err.Error(),
+                })
+                return
+        }
 
-func (t *TSIGSecret) Sign(r Signable) {
-        r.SetTsig(t.KeyName, t.Algorithm, 300, time.Now().Unix())
+        c.JSON(http.StatusNoContent, gin.H{})
 }
 
-func (t *TSIGSecret) AsMap() map[string]string {
-        return map[string]string{
-                t.KeyName: t.Secret,
+func updateDynamicDNS(c *gin.Context) {
+        dc := dns.DNSClient{Server: "172.16.18.52:53"}
+
+        res, ok := c.GetString(DDNS_AUTH_KEY)
+        if !ok {
+                log.Println("ddns: Unable to get auth key")
+                c.AbortWithStatus(http.StatusForbidden)
+                return
         }
-}
 
-func getValue(v interface{}) string {
-        switch i := v.(type) {
-        case *dns.SOA:
-                return fmt.Sprintf("%s %s %d %d %d %d %d", i.Ns, i.Mbox, i.Serial, i.Refresh, i.Retry, i.Expire, i.Minttl)
-        case *dns.A:
-                return fmt.Sprintf("%s", i.A)
-        case *dns.CNAME:
-                return fmt.Sprintf("%s", i.Target)
-        case *dns.AAAA:
-                return fmt.Sprintf("%s", i.AAAA)
-        case *dns.MX:
-                return fmt.Sprintf("%d %s", i.Preference, i.Mx)
-        case *dns.TXT:
-                b := &bytes.Buffer{}
-                for _, t := range i.Txt {
-                        fmt.Fprintf(b, "\"%s\"", t) // []
-                }
-                return b.String()
-        case *dns.PTR:
-                return fmt.Sprintf("%s", i.Ptr)
-        case *dns.NS:
-                return fmt.Sprintf("%s", i.Ns)
-        case *dns.SRV:
-                return fmt.Sprintf("%d %d %d %s", i.Priority, i.Weight, i.Port, i.Target)
-        case *dns.SPF:
-                b := &bytes.Buffer{}
-                for _, t := range i.Txt {
-                        fmt.Fprintf(b, "\"%s\"", t) // []
-                }
-                return b.String()
-        default:
-                return "UNKNOWN"
+        zone, part := findClosestZone(cfg, res, "external")
+        if zone == nil {
+                log.Println("ddns: Unable to locate zone")
+                c.AbortWithStatus(http.StatusNotFound)
+                return
+        }
+
+        inip := net.ParseIP(strings.Split(c.Request.RemoteAddr, ":")[0])
+        xff := c.Request.Header.Get("X-Forwarded-For")
+        if xff != "" {
+                inip = net.ParseIP(xff)
         }
-}
 
-func getDns(sm *TSIGSecrets) chan *dns.Envelope {
-        s, _ := sm.GetSecret("crute.us", "external")
+        if inip == nil {
+                log.Println("ddns: Unable to parse IP")
+                c.AbortWithStatus(http.StatusInternalServerError)
+                return
+        }
 
-        c := &dns.Transfer{}
-        c.TsigSecret = s.AsMap()
+        t := &dns.A{
+                Name: part,
+                Ttl:  60,
+                A:    inip,
+        }
 
-        m := &dns.Msg{}
-        m.SetAxfr("crute.us.")
-        s.Sign(m)
+        // Cleanup any old records before adding the new one
+        if err := dc.RemoveAll(zone, t); err != nil {
+                log.Printf("ddns RemoveAll: %s", err)
+                c.AbortWithStatus(http.StatusInternalServerError)
+                return
+        }
 
-        in, err := c.In(m, "172.16.18.52:53")
-        if err != nil {
-                fmt.Printf("Error: %s\n", err.Error())
-                return nil
+        if err := dc.Insert(zone, t); err != nil {
+                log.Printf("ddns Insert: %s", err)
+                c.AbortWithStatus(http.StatusInternalServerError)
+                return
         }
 
-        return in
+        c.String(http.StatusAccepted, "")
 }
 
-func dnsClass(rrh *dns.RR_Header) string {
-        return dns.Class(rrh.Class).String()
-}
+func reflectIP(c *gin.Context) {
+        myIp := c.Request.RemoteAddr
+        xff := c.Request.Header.Get("X-Forwarded-For")
+        if xff != "" {
+                myIp = xff
+        }
+
+        ips := ipRegexp.FindStringSubmatch(myIp)
+        if ips == nil {
+                c.AbortWithStatus(http.StatusInternalServerError)
+                return
+        }
 
-func dnsType(rrh *dns.RR_Header) string {
-        return dns.Type(rrh.Rrtype).String()
+        v6, v4 := ips[1], ips[2]
+        if v6 != "" {
+                c.String(http.StatusOK, v6)
+        } else if v4 != "" {
+                c.String(http.StatusOK, v4)
+        } else {
+                c.AbortWithStatus(http.StatusInternalServerError)
+        }
 }
 
-func dnsTTL(rrh *dns.RR_Header) string {
-        t := rrh.Ttl
+func acmeAuth(c *gin.Context) {
+        _, pwd, ok := c.Request.BasicAuth()
+        if !ok {
+                c.Request.Header["WWW-Authenticate"] = []string{`Basic realm="closed site"`}
+                c.AbortWithStatus(http.StatusUnauthorized)
+                return
+        }
 
-        if t/86400 > 1 {
-                return fmt.Sprintf("%d days", t/86400)
-        } else if t/3600 > 1 {
-                return fmt.Sprintf("%d hours", t/3600)
-        } else if t/60 > 1 {
-                return fmt.Sprintf("%d minutes", t/60)
+        allowed, ok := secrets.ACME[pwd]
+        if !ok {
+                c.AbortWithStatus(http.StatusForbidden)
+                return
         } else {
-                return fmt.Sprintf("%d seconds", t)
+                c.Set(ACME_AUTH_KEY, allowed)
         }
+
+        c.Next()
 }
 
-func handler(w http.ResponseWriter, r *http.Request) {
-        fm := template.FuncMap{
-                "getValue": getValue,
-                "dnsClass": dnsClass,
-                "dnsType":  dnsType,
-                "dnsTTL":   dnsTTL,
+func ddnsAuth(c *gin.Context) {
+        var req DDNSUpdateRequest
+        if err := c.ShouldBind(&req); err != nil {
+                log.Println("ddnsAuth: No key in request")
+                c.AbortWithStatus(http.StatusNotFound)
+                return
+        }
+
+        res, ok := secrets.DDNS[req.Key]
+        if !ok {
+                log.Println("ddnsAuth: Unknown secret")
+                c.AbortWithStatus(http.StatusNotFound)
+                return
+        } else {
+                c.Set(DDNS_AUTH_KEY, res)
         }
-        t, _ := template.New("").Funcs(fm).ParseFiles("dns.html")
-        t.ExecuteTemplate(w, "dns.html", getDns(nil))
+
+        c.Next()
 }
 
 func main() {
-        /*
-                http.HandleFunc("/", handler)
-                http.ListenAndServe(":8080", nil)
-        */
-
-        c, _ := ioutil.ReadFile("secrets.json")
-        k := NewTSIGSecrets()
-        json.Unmarshal(c, k)
-
-        //fmt.Printf("%+v\n", k)
-        for r := range getDns(k) {
-                for _, rr := range r.RR {
-                        /* hlen := len(rr.Header().String())
-                           fmt.Printf("%+v\n", rr.String()[hlen:]) */
-                }
+        router := gin.Default()
+
+        router.GET("/reflect-ip", reflectIP)
+
+        ddns := router.Group("/dynamic-dns")
+        ddns.Use(ddnsAuth)
+        {
+                ddns.POST("", updateDynamicDNS)
         }
+
+        acme := router.Group("/acme")
+        acme.Use(acmeAuth)
+        {
+                acme.POST("", createAcmeChallenge)
+                acme.DELETE("/:id", deleteAcmeChallenge)
+        }
+
+        router.Run()
 }