Refactor into an application

8 files changed, 510 insertions, 0 deletions

diff --git a/web/config.go b/web/config.go
new file mode 100644
index 0000000..01b6f47
--- /dev/null
+++ b/web/config.go
@@ -0,0 +1,75 @@
+package web
+
+import (
+        "encoding/json"
+        "io/ioutil"
+        "log"
+        "strings"
+
+        "code.crute.me/mcrute/go_ddns_manager/bind"
+        "code.crute.me/mcrute/go_ddns_manager/dns"
+)
+
+type ServerConfig struct {
+        BindConfig     *bind.BINDConfig
+        DNSClient      *dns.DNSClient
+        AcmeView       string
+        DynamicDnsView string
+        DDNSSecrets    map[string]string         `json:"DDNS"`
+        AcmeSecrets    map[string]map[string]int `json:"ACME"`
+}
+
+func LoadServerConfig(zonesFile, secretsFile, server, view string) (*ServerConfig, error) {
+        scfg := &ServerConfig{
+                DNSClient:      &dns.DNSClient{Server: server},
+                AcmeView:       view,
+                DynamicDnsView: view,
+        }
+
+        cfg, err := bind.ParseBINDConfig(zonesFile)
+        if err != nil {
+                return nil, err
+        }
+        scfg.BindConfig = cfg
+
+        fd, err := ioutil.ReadFile(secretsFile)
+        if err != nil {
+                return nil, err
+        }
+
+        if err = json.Unmarshal(fd, scfg); err != nil {
+                return nil, err
+        }
+
+        return scfg, nil
+}
+
+func (s *ServerConfig) GetDDNSZoneName(k string) string {
+        log.Printf("%#v", s.DDNSSecrets)
+        v, _ := s.DDNSSecrets[k]
+        return v
+}
+
+func (s *ServerConfig) AcmeSecretExists(k string) bool {
+        _, ok := s.AcmeSecrets[k]
+        return ok
+}
+
+func (s *ServerConfig) IsAcmeClientAllowed(key, zone string) bool {
+        u, ok := s.AcmeSecrets[key]
+        if !ok {
+                return false
+        }
+
+        p, ok := u[zone]
+        if ok && p == 1 {
+                return true
+        }
+
+        p, ok = u[strings.TrimRight(zone, ".")]
+        if ok && p == 1 {
+                return true
+        }
+
+        return false
+}
diff --git a/web/controllers/acme.go b/web/controllers/acme.go
new file mode 100644
index 0000000..f40b2ec
--- /dev/null
+++ b/web/controllers/acme.go
@@ -0,0 +1,149 @@
+package controllers
+
+import (
+        "encoding/base64"
+        "encoding/json"
+        "log"
+        "net/http"
+        "strings"
+
+        "github.com/gin-gonic/gin"
+
+        "code.crute.me/mcrute/go_ddns_manager/dns"
+        "code.crute.me/mcrute/go_ddns_manager/web"
+        "code.crute.me/mcrute/go_ddns_manager/web/middleware"
+)
+
+type AcmeChallenge struct {
+        Zone      string `json:"zone" binding:"required"`
+        Challenge string `json:"challenge" binding:"required"`
+}
+
+type AcmeChallengeID struct {
+        Zone      string
+        Prefix    string
+        Challenge string
+}
+
+func DecodeAcmeChallengeID(v string) *AcmeChallengeID {
+        rid, err := base64.URLEncoding.DecodeString(v)
+        if err != nil {
+                return nil
+        }
+
+        var id AcmeChallengeID
+        if err = json.Unmarshal(rid, &id); err != nil {
+                return nil
+        }
+
+        return &id
+}
+
+func (i AcmeChallengeID) Encode() string {
+        id, err := json.Marshal(i)
+        if err != nil {
+                return ""
+        }
+
+        return base64.URLEncoding.EncodeToString(id)
+}
+
+func joinDomainParts(parts ...string) string {
+        p := []string{}
+        for _, i := range parts {
+                if strings.TrimSpace(i) != "" {
+                        p = append(p, i)
+                }
+        }
+        return strings.Join(p, ".")
+}
+
+func jsonError(c *gin.Context, status int, msg interface{}) {
+        var o string
+
+        switch msg := msg.(type) {
+        case string:
+                o = msg
+        case error:
+                o = msg.Error()
+        }
+
+        c.JSON(status, gin.H{"error": o})
+}
+
+func CreateAcmeChallenge(c *gin.Context) {
+        cfg := middleware.GetServerConfig(c)
+
+        var ch AcmeChallenge
+        if err := c.ShouldBindJSON(&ch); err != nil {
+                jsonError(c, http.StatusBadRequest, err)
+                return
+        }
+
+        zone, prefix := cfg.BindConfig.FindClosestZone(ch.Zone, cfg.AcmeView)
+        if zone == nil {
+                jsonError(c, http.StatusNotFound, "Zone not found")
+                return
+        }
+
+        if !cfg.IsAcmeClientAllowed(middleware.GetAcmeAuthContext(c), zone.Name) {
+                jsonError(c, http.StatusForbidden, "Zone update not allowed")
+                return
+        }
+
+        txn := cfg.DNSClient.StartUpdate(zone).Upsert(&dns.TXT{
+                Name: joinDomainParts("_acme-challenge", prefix),
+                Ttl:  5,
+                Txt:  []string{ch.Challenge},
+        })
+
+        if err := cfg.DNSClient.SendUpdate(txn); err != nil {
+                log.Printf("error Insert: %s", err)
+                jsonError(c, http.StatusInternalServerError, err)
+                return
+        }
+
+        url := web.MakeURL(c.Request, "/acme/%s", AcmeChallengeID{
+                Zone:      zone.Name,
+                Prefix:    prefix,
+                Challenge: ch.Challenge,
+        }.Encode()).String()
+
+        c.Writer.Header().Set("Location", url)
+        c.JSON(http.StatusCreated, gin.H{"created": url})
+}
+
+func DeleteAcmeChallenge(c *gin.Context) {
+        cfg := middleware.GetServerConfig(c)
+
+        id := DecodeAcmeChallengeID(c.Param("id"))
+        if id == nil {
+                jsonError(c, http.StatusBadRequest, "unable to decode ID")
+                return
+        }
+
+        zone := cfg.BindConfig.Zone(cfg.AcmeView, id.Zone)
+        if zone == nil {
+                jsonError(c, http.StatusNotFound, "Zone not found")
+                return
+        }
+
+        if !cfg.IsAcmeClientAllowed(middleware.GetAcmeAuthContext(c), zone.Name) {
+                jsonError(c, http.StatusForbidden, "Zone update not allowed")
+                return
+        }
+
+        txn := cfg.DNSClient.StartUpdate(zone).Remove(&dns.TXT{
+                Name: joinDomainParts("_acme-challenge", id.Prefix),
+                Ttl:  5,
+                Txt:  []string{id.Challenge},
+        })
+
+        if err := cfg.DNSClient.SendUpdate(txn); err != nil {
+                log.Printf("error Remove: %s", err)
+                jsonError(c, http.StatusInternalServerError, err)
+                return
+        }
+
+        c.String(http.StatusNoContent, "")
+}
diff --git a/web/controllers/ddns.go b/web/controllers/ddns.go
new file mode 100644
index 0000000..7300989
--- /dev/null
+++ b/web/controllers/ddns.go
@@ -0,0 +1,51 @@
+package controllers
+
+import (
+        "log"
+        "net/http"
+
+        "github.com/gin-gonic/gin"
+
+        "code.crute.me/mcrute/go_ddns_manager/dns"
+        "code.crute.me/mcrute/go_ddns_manager/web"
+        "code.crute.me/mcrute/go_ddns_manager/web/middleware"
+)
+
+func UpdateDynamicDNS(c *gin.Context) {
+        cfg := middleware.GetServerConfig(c)
+
+        res := middleware.GetDDNSAuthKey(c)
+        if res == "" {
+                log.Println("ddns: Unable to get auth key")
+                c.AbortWithStatus(http.StatusForbidden)
+                return
+        }
+
+        zone, part := cfg.BindConfig.FindClosestZone(res, cfg.DynamicDnsView)
+        if zone == nil {
+                log.Println("ddns: Unable to locate zone")
+                c.AbortWithStatus(http.StatusNotFound)
+                return
+        }
+
+        inip := web.GetRequestIP(c)
+        if inip == nil {
+                log.Println("ddns: Unable to parse IP")
+                c.AbortWithStatus(http.StatusInternalServerError)
+                return
+        }
+
+        txn := cfg.DNSClient.StartUpdate(zone).Upsert(&dns.A{
+                Name: part,
+                Ttl:  60,
+                A:    inip,
+        })
+
+        if err := cfg.DNSClient.SendUpdate(txn); err != nil {
+                log.Printf("ddns: %s", err)
+                c.AbortWithStatus(http.StatusInternalServerError)
+                return
+        }
+
+        c.String(http.StatusAccepted, "")
+}
diff --git a/web/controllers/reflect_ip.go b/web/controllers/reflect_ip.go
new file mode 100644
index 0000000..d04b98c
--- /dev/null
+++ b/web/controllers/reflect_ip.go
@@ -0,0 +1,19 @@
+package controllers
+
+import (
+        "net/http"
+
+        "github.com/gin-gonic/gin"
+
+        "code.crute.me/mcrute/go_ddns_manager/web"
+)
+
+func ReflectIP(c *gin.Context) {
+        ip := web.GetRequestIP(c)
+        if ip == nil {
+                c.String(http.StatusInternalServerError, "")
+                return
+        }
+
+        c.String(http.StatusOK, ip.String())
+}
diff --git a/web/middleware/acme.go b/web/middleware/acme.go
new file mode 100644
index 0000000..54a4dfc
--- /dev/null
+++ b/web/middleware/acme.go
@@ -0,0 +1,33 @@
+package middleware
+
+import (
+        "net/http"
+
+        "github.com/gin-gonic/gin"
+)
+
+const acmeUserId = "ACMEAuthUserID"
+
+func AcmeAuthMiddleware(c *gin.Context) {
+        cfg := GetServerConfig(c)
+
+        _, pwd, ok := c.Request.BasicAuth()
+        if !ok {
+                c.Request.Header.Set("WWW-Authenticate", `Basic realm="closed site"`)
+                c.AbortWithStatus(http.StatusUnauthorized)
+                return
+        }
+
+        if !cfg.AcmeSecretExists(pwd) {
+                c.AbortWithStatus(http.StatusForbidden)
+                return
+        } else {
+                c.Set(acmeUserId, pwd)
+        }
+
+        c.Next()
+}
+
+func GetAcmeAuthContext(c *gin.Context) string {
+        return c.GetString(acmeUserId)
+}
diff --git a/web/middleware/config_context.go b/web/middleware/config_context.go
new file mode 100644
index 0000000..d474022
--- /dev/null
+++ b/web/middleware/config_context.go
@@ -0,0 +1,26 @@
+package middleware
+
+import (
+        "github.com/gin-gonic/gin"
+
+        "code.crute.me/mcrute/go_ddns_manager/web"
+)
+
+const serverConfig = "ServerConfig"
+
+func ConfigContextMiddleware(cfg *web.ServerConfig) func(*gin.Context) {
+        return func(c *gin.Context) {
+                c.Set(serverConfig, cfg)
+                c.Next()
+        }
+}
+
+func GetServerConfig(c *gin.Context) *web.ServerConfig {
+        v, ok := c.Get(serverConfig)
+        if !ok {
+                // This should never happen if the config context middlware is in place
+                panic("Unable to get config from request")
+        }
+
+        return v.(*web.ServerConfig)
+}
diff --git a/web/middleware/ddns.go b/web/middleware/ddns.go
new file mode 100644
index 0000000..b213926
--- /dev/null
+++ b/web/middleware/ddns.go
@@ -0,0 +1,40 @@
+package middleware
+
+import (
+        "log"
+        "net/http"
+
+        "github.com/gin-gonic/gin"
+)
+
+const DDNS_AUTH_KEY = "DDNSAuthZone"
+
+type DDNSUpdateRequest struct {
+        Key string `form:"key" binding:"required"`
+}
+
+func DDNSAuthMiddleware(c *gin.Context) {
+        cfg := GetServerConfig(c)
+
+        var req DDNSUpdateRequest
+        if err := c.ShouldBind(&req); err != nil {
+                log.Println("ddnsAuthMiddleware: No key in request")
+                c.AbortWithStatus(http.StatusNotFound)
+                return
+        }
+
+        res := cfg.GetDDNSZoneName(req.Key)
+        if res == "" {
+                log.Println("ddnsAuthMiddleware: Unknown secret")
+                c.AbortWithStatus(http.StatusNotFound)
+                return
+        } else {
+                c.Set(DDNS_AUTH_KEY, res)
+        }
+
+        c.Next()
+}
+
+func GetDDNSAuthKey(c *gin.Context) string {
+        return c.GetString(DDNS_AUTH_KEY)
+}
diff --git a/web/utils.go b/web/utils.go
new file mode 100644
index 0000000..5467132
--- /dev/null
+++ b/web/utils.go
@@ -0,0 +1,117 @@
+package web
+
+import (
+        "context"
+        "fmt"
+        "log"
+        "net"
+        "net/http"
+        "net/url"
+        "os"
+        "os/signal"
+        "regexp"
+
+        "github.com/gin-gonic/gin"
+)
+
+// Parses an IPv4 or IPv6 address with an optional port on the end. Returns
+// match groups for the addresses. The first match is the IPv6 address and the
+// second the IPv4 address.
+var ipRegexp = regexp.MustCompile(`(?:\[([0-9a-f:]+)\]|(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))(?::\d+)?`)
+
+// TODO: use from a common package
+func ParseIP(s string) net.IP {
+        ips := ipRegexp.FindStringSubmatch(s)
+        if ips == nil {
+                return nil
+        }
+
+        if v6, v4 := ips[1], ips[2]; v6 != "" {
+                return net.ParseIP(v6)
+        } else {
+                return net.ParseIP(v4)
+        }
+}
+
+// TODO: use from a common package
+func GetRequestIP(c *gin.Context) net.IP {
+        if xff := c.Request.Header.Get("X-Forwarded-For"); xff != "" {
+                return ParseIP(xff)
+        }
+        return ParseIP(c.Request.RemoteAddr)
+}
+
+// TODO: use from a common package
+func MakeURL(r *http.Request, path string, subs ...interface{}) *url.URL {
+        scheme := "https"
+        if r.TLS == nil {
+                scheme = "http"
+        }
+
+        // Always defer to whatever the proxy told us it was doing because this
+        // could be a mullet-VIP in either direction.
+        if fwProto := r.Header.Get("X-Forwarded-Proto"); fwProto != "" {
+                scheme = fwProto
+        }
+
+        return &url.URL{
+                Scheme: scheme,
+                Host:   r.Host,
+                Path:   fmt.Sprintf(path, subs...),
+        }
+}
+
+// TODO: use from a common package
+// Copied from: https://github.com/gin-gonic/gin/blob/59ab588bf597f9f41faee4f217b5659893c2e925/utils.go#L137
+func resolveAddress(addr []string) string {
+        switch len(addr) {
+        case 0:
+                if port := os.Getenv("PORT"); port != "" {
+                        log.Printf("Environment variable PORT=\"%s\"", port)
+                        return ":" + port
+                }
+                log.Printf("Environment variable PORT is undefined. Using port :8080 by default")
+                return ":8080"
+        case 1:
+                return addr[0]
+        default:
+                panic("too many parameters")
+        }
+}
+
+// TODO: use from a common package
+// Runs a gin.Engine instance in a way that can be canceled by an SIGINT
+func GinRun(e *gin.Engine, debug bool, a ...string) {
+        if debug {
+                gin.SetMode(gin.DebugMode)
+        } else {
+                gin.SetMode(gin.ReleaseMode)
+        }
+
+        srv := &http.Server{
+                Addr:    resolveAddress(a),
+                Handler: e,
+        }
+
+        idleConnsClosed := make(chan struct{})
+
+        go func() {
+                sigint := make(chan os.Signal, 1)
+                signal.Notify(sigint, os.Interrupt)
+                <-sigint
+
+                log.Println("Caught SIGINT, shutting down")
+                if err := srv.Shutdown(context.Background()); err != nil {
+                        log.Printf("HTTP server Shutdown: %v", err)
+                }
+
+                close(idleConnsClosed)
+        }()
+
+        log.Printf("Listening and serving HTTP on %s\n", srv.Addr)
+        if err := srv.ListenAndServe(); err != http.ErrServerClosed {
+                log.Fatalf("HTTP server ListenAndServe: %v", err)
+        }
+
+        <-idleConnsClosed
+}