source: code/trunk/server.go@ 372

Last change on this file since 372 was 370, checked in by contact, 5 years ago

Add accept-proxy-ip config directive

This allows to set the list of IPs allowed to act as a proxy. This is
only used for WebSockets right now, but will be expanded to TCP as well
once the PROXY protocol is supported.

File size: 3.7 KB
Line 
1package soju
2
3import (
4 "fmt"
5 "log"
6 "net"
7 "net/http"
8 "sync"
9 "sync/atomic"
10 "time"
11
12 "gopkg.in/irc.v3"
13 "nhooyr.io/websocket"
14
15 "git.sr.ht/~emersion/soju/config"
16)
17
18// TODO: make configurable
19var retryConnectMinDelay = time.Minute
20var connectTimeout = 15 * time.Second
21var writeTimeout = 10 * time.Second
22
23type Logger interface {
24 Print(v ...interface{})
25 Printf(format string, v ...interface{})
26}
27
28type prefixLogger struct {
29 logger Logger
30 prefix string
31}
32
33var _ Logger = (*prefixLogger)(nil)
34
35func (l *prefixLogger) Print(v ...interface{}) {
36 v = append([]interface{}{l.prefix}, v...)
37 l.logger.Print(v...)
38}
39
40func (l *prefixLogger) Printf(format string, v ...interface{}) {
41 v = append([]interface{}{l.prefix}, v...)
42 l.logger.Printf("%v"+format, v...)
43}
44
45type Server struct {
46 Hostname string
47 Logger Logger
48 RingCap int
49 HistoryLimit int
50 LogPath string
51 Debug bool
52 HTTPOrigins []string
53 AcceptProxyIPs config.IPSet
54
55 db *DB
56
57 lock sync.Mutex
58 users map[string]*user
59}
60
61func NewServer(db *DB) *Server {
62 return &Server{
63 Logger: log.New(log.Writer(), "", log.LstdFlags),
64 RingCap: 4096,
65 HistoryLimit: 1000,
66 users: make(map[string]*user),
67 db: db,
68 }
69}
70
71func (s *Server) prefix() *irc.Prefix {
72 return &irc.Prefix{Name: s.Hostname}
73}
74
75func (s *Server) Run() error {
76 users, err := s.db.ListUsers()
77 if err != nil {
78 return err
79 }
80
81 s.lock.Lock()
82 for _, record := range users {
83 s.Logger.Printf("starting bouncer for user %q", record.Username)
84 u := newUser(s, &record)
85 s.users[u.Username] = u
86
87 go u.run()
88 }
89 s.lock.Unlock()
90
91 select {}
92}
93
94func (s *Server) createUser(user *User) (*user, error) {
95 s.lock.Lock()
96 defer s.lock.Unlock()
97
98 if _, ok := s.users[user.Username]; ok {
99 return nil, fmt.Errorf("user %q already exists", user.Username)
100 }
101
102 err := s.db.StoreUser(user)
103 if err != nil {
104 return nil, fmt.Errorf("could not create user in db: %v", err)
105 }
106
107 s.Logger.Printf("starting bouncer for new user %q", user.Username)
108 u := newUser(s, user)
109 s.users[u.Username] = u
110 go u.run()
111 return u, nil
112}
113
114func (s *Server) getUser(name string) *user {
115 s.lock.Lock()
116 u := s.users[name]
117 s.lock.Unlock()
118 return u
119}
120
121var lastDownstreamID uint64 = 0
122
123func (s *Server) handle(ic ircConn) {
124 id := atomic.AddUint64(&lastDownstreamID, 1)
125 dc := newDownstreamConn(s, ic, id)
126 if err := dc.runUntilRegistered(); err != nil {
127 dc.logger.Print(err)
128 } else {
129 dc.user.events <- eventDownstreamConnected{dc}
130 if err := dc.readMessages(dc.user.events); err != nil {
131 dc.logger.Print(err)
132 }
133 dc.user.events <- eventDownstreamDisconnected{dc}
134 }
135 dc.Close()
136}
137
138func (s *Server) Serve(ln net.Listener) error {
139 for {
140 conn, err := ln.Accept()
141 if err != nil {
142 return fmt.Errorf("failed to accept connection: %v", err)
143 }
144
145 go s.handle(newNetIRCConn(conn))
146 }
147}
148
149func (s *Server) ServeHTTP(w http.ResponseWriter, req *http.Request) {
150 conn, err := websocket.Accept(w, req, &websocket.AcceptOptions{
151 OriginPatterns: s.HTTPOrigins,
152 Subprotocols: []string{"irc"},
153 })
154 if err != nil {
155 s.Logger.Printf("failed to serve HTTP connection: %v", err)
156 return
157 }
158
159 isProxy := false
160 if host, _, err := net.SplitHostPort(req.RemoteAddr); err == nil {
161 if ip := net.ParseIP(host); ip != nil {
162 isProxy = s.AcceptProxyIPs.Contains(ip)
163 }
164 }
165
166 // Only trust X-Forwarded-* header fields if this is a trusted proxy IP
167 // to prevent users from spoofing the remote address
168 remoteAddr := req.RemoteAddr
169 forwardedHost := req.Header.Get("X-Forwarded-For")
170 forwardedPort := req.Header.Get("X-Forwarded-Port")
171 if isProxy && forwardedHost != "" && forwardedPort != "" {
172 remoteAddr = net.JoinHostPort(forwardedHost, forwardedPort)
173 }
174
175 s.handle(newWebsocketIRCConn(conn, remoteAddr))
176}
Note: See TracBrowser for help on using the repository browser.