diff options
Diffstat (limited to 'internal/hole')
| -rw-r--r-- | internal/hole/hole.go | 1412 |
1 files changed, 25 insertions, 1387 deletions
diff --git a/internal/hole/hole.go b/internal/hole/hole.go index 3b9a54d..3749f9b 100644 --- a/internal/hole/hole.go +++ b/internal/hole/hole.go @@ -16,422 +16,31 @@ // License along with roseh.moe. If not, see // <https://www.gnu.org/licenses/>. -package main +package hole import ( "archive/tar" - "bytes" "cmp" "compress/gzip" - "context" - "crypto" - "crypto/ecdsa" "crypto/hkdf" - "crypto/hmac" "crypto/rand" - "crypto/rsa" "crypto/sha256" - "crypto/x509" - "embed" - "encoding/base64" "encoding/binary" - "encoding/json" - "encoding/xml" "errors" - "flag" "fmt" - "html/template" "io" "io/fs" "log" "mime/multipart" - "net/http" - "net/http/cgi" - "net/http/httputil" - "net/url" "os" - "path" - "path/filepath" - "slices" - "strconv" "strings" - "sync" "time" - "unicode" - "github.com/skip2/go-qrcode" "roseh.moe/pkg/oae2" "roseh.moe/pkg/wordlist" ) -var ( - selfURL = urlFlag("url", "http://localhost:42069", "base URL of the server") - secretsFile = flag.String("secrets", "secrets.xml", "secrets file") - configFile = flag.String("config", "config.xml", "configuration file (XML, baby!!)") - https = flag.String("https", "", "directory containing cert.pem and key.pem, or empty string to use unencrypted http") - httpRedirect = flag.String("http-redirect", "", "port to serve HTTP redirect") - holeTempDir = flag.String("hole-temp-dir", "/tmp/hole", "directory to store temporary files for the wormhole") - nezuko = flag.String("nezuko", "/mnt/nezuko", "nezuko partition") - cgit = flag.String("cgit", "", "directory containing cgit.cgi") - cgitConfig = flag.String("cgit-config", "", "cgit config file") - v = flag.Bool("v", true, "verbose") -) - -type urlValue struct { - URL *url.URL -} - -func (v urlValue) String() string { - if v.URL != nil { - return v.URL.String() - } - return "" -} - -func (v urlValue) Set(s string) error { - u, err := url.Parse(s) - if err != nil { - return err - } - *v.URL = *u - return nil -} - -func urlFlag(name, def, doc string) *url.URL { - u, err := url.Parse(def) - if err != nil { - panic(err) - } - flag.Var(urlValue{u}, name, doc) - return u -} - -func sigVerifier(keyBytes []byte) (func(msg, sig []byte) bool, error) { - key, err := x509.ParsePKIXPublicKey(keyBytes) - if err != nil { - return nil, err - } - switch key := key.(type) { - case *ecdsa.PublicKey: - return func(msg, sig []byte) bool { - hash := sha256.Sum256(msg) - return ecdsa.VerifyASN1(key, hash[:], sig) - }, nil - case *rsa.PublicKey: - return func(msg, sig []byte) bool { - hash := sha256.Sum256(msg) - return rsa.VerifyPKCS1v15(key, crypto.SHA256, hash[:], sig) == nil - }, nil - default: - return nil, fmt.Errorf("unsupported key type") - } -} - -func verifyPubKey(pubKey, msg, sig []byte) error { - verify, err := sigVerifier(pubKey) - if err != nil { - return err - } - if !verify(msg, sig) { - return fmt.Errorf("message failed validation") - } - return nil -} - -var secretKey []byte - -func loadSecrets() error { - fileBytes, err := os.ReadFile(*secretsFile) - if err != nil { - return err - } - var secretsConfig struct { - SecretKey string `xml:",attr"` - } - if err := xml.Unmarshal(fileBytes, &secretsConfig); err != nil { - return fmt.Errorf("%s: %s", *secretsFile, err) - } - if secretsConfig.SecretKey == "" { - return fmt.Errorf("%s: missing SecretKey", *secretsFile) - } - if secretKey, err = base64.StdEncoding.DecodeString(secretsConfig.SecretKey); err != nil { - return fmt.Errorf("%s: bad SecretKey (try base64)", *secretsFile) - } - return nil -} - -type packageConfig struct { - Name string `xml:",attr"` - URL string `xml:",attr"` - Source string `xml:",attr"` - Description string `xml:",attr"` -} - -type commandConfig struct { - Name string `xml:",attr"` - URL string `xml:",attr"` - Source string `xml:",attr"` - Description string `xml:",attr"` - Multi bool `xml:",attr"` -} - -type passkey struct { - ID string `xml:",attr"` - Key string `xml:",attr"` -} - -type serviceConfiguration struct { - PackageRedirects []packageConfig `xml:"Redirects>Package"` - CommandRedirects []commandConfig `xml:"Redirects>Command"` - Passkey []passkey - passkeys map[string][]byte -} - -var ( - serviceConfigMu sync.Mutex - serviceConfig *serviceConfiguration - serviceConfigLastModified time.Time -) - -func loadConfig() (*serviceConfiguration, error) { - stat, err := os.Stat(*configFile) - if err != nil { - return nil, err - } - serviceConfigMu.Lock() - oldConfig := serviceConfig - configLastModified := serviceConfigLastModified - serviceConfigMu.Unlock() - newModTime := stat.ModTime() - if !newModTime.After(configLastModified) { - return oldConfig, nil - } - log.Printf("Reloading config file...") - fileBytes, err := os.ReadFile(*configFile) - if err != nil { - return nil, err - } - config := new(serviceConfiguration) - if err := xml.Unmarshal(fileBytes, config); err != nil { - return nil, err - } - names := make(map[string]bool) - config.passkeys = make(map[string][]byte) - namesByID := make(map[string]string) - for _, passkey := range config.Passkey { - if names[passkey.ID] { - return nil, fmt.Errorf("%s: duplicate name %q", *configFile, passkey.ID) - } - names[passkey.ID] = true - keyBytes, err := base64.RawURLEncoding.DecodeString(strings.Map(func(r rune) rune { - if unicode.IsSpace(r) { - return -1 - } - return r - }, passkey.Key)) - if err != nil { - return nil, fmt.Errorf("%s: invalid key for passkey %q: %s", *configFile, passkey.ID, err) - } - if len(keyBytes) < 16 { - return nil, fmt.Errorf("%s: invalid key for passkey %q: bad user ID: too short", *configFile, passkey.ID) - } - id, key := keyBytes[:16], keyBytes[16:] - if _, err := sigVerifier(key); err != nil { - return nil, fmt.Errorf("%s: invalid key for passkey %q: %s", *configFile, passkey.ID, err) - } - if _, ok := config.passkeys[string(id)]; ok { - return nil, fmt.Errorf("%s: passkeys %q and %q have duplicate ID %d", *configFile, namesByID[string(id)], passkey.ID, id) - } - config.passkeys[string(id)] = key - namesByID[string(id)] = passkey.ID - } - slices.SortFunc(config.PackageRedirects, func(x, y packageConfig) int { return strings.Compare(x.Name, y.Name) }) - slices.SortFunc(config.CommandRedirects, func(x, y commandConfig) int { return strings.Compare(x.Name, y.Name) }) - serviceConfigMu.Lock() - serviceConfig = config - serviceConfigLastModified = newModTime - serviceConfigMu.Unlock() - return config, nil -} - -func makeETag(content io.Reader) (string, error) { - h := sha256.New() - if _, err := io.Copy(h, content); err != nil { - return "", err - } - return `W/"` + base64.RawURLEncoding.EncodeToString(h.Sum(nil)[:8]) + `"`, nil -} - -var ( - //go:embed templates/outline.html.template - outlineString string - outlineTemplate = template.Must(template.New("outline").Funcs(template.FuncMap{ - "host": func() string { - return selfURL.Host - }, - "xmlEscape": func(s string) string { - buf := new(strings.Builder) - xml.EscapeText(buf, []byte(s)) - return buf.String() - }, - }).Parse(outlineString)) -) - -func outlinedTemplate(s string) (*template.Template, error) { - outline, err := outlineTemplate.Clone() - if err != nil { - return nil, err - } - t, err := outline.New("body").Parse(s) - if err != nil { - return nil, err - } - return t.Lookup("outline"), nil -} - -type staticHandler struct { - content, eTag string -} - -func (h *staticHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { - w.Header().Set("ETag", h.eTag) - http.ServeContent(w, r, "", time.Time{}, strings.NewReader(h.content)) -} - -func staticTemplate(tmpl *template.Template) (*staticHandler, error) { - buf := new(strings.Builder) - if err := tmpl.Execute(buf, nil); err != nil { - return nil, err - } - content := buf.String() - eTag, err := makeETag(strings.NewReader(content)) - if err != nil { - return nil, err - } - return &staticHandler{ - content: buf.String(), - eTag: eTag, - }, nil -} - -var ( - //go:embed templates/404.html.template - notFoundString string - notFoundTemplate = template.Must(template.New("notFound").Parse(notFoundString)) -) - -func notFound(w http.ResponseWriter, r *http.Request) { - w.WriteHeader(http.StatusNotFound) - type args struct { - Path string - } - if err := notFoundTemplate.Execute(w, args{Path: r.URL.Path}); err != nil { - log.Printf("Warning: notFound: %s", err) - } -} - -//go:embed templates/index.html.template -var indexString string - -//go:embed templates/games/index.html.template -var gamesIndexString string - -//go:embed templates/games/pong.html.template -var pongString string - -//go:embed templates/games/rms.html.template -var stallmanShooterString string - -//go:embed static -var staticFiles embed.FS - -var staticFileHashes = buildStaticFileHashes() - -func buildStaticFileHashes() map[string]string { - hashMap := make(map[string]string) - if err := fs.WalkDir(staticFiles, ".", func(path string, d fs.DirEntry, err error) error { - if err != nil || d.IsDir() { - return err - } - f, err := staticFiles.Open(path) - if err != nil { - return err - } - defer f.Close() - if hashMap[path], err = makeETag(f); err != nil { - return err - } - return nil - }); err != nil { - panic(fmt.Sprintf("Build static file hash map: %s", err)) - } - return hashMap -} - -func serveStaticFile(w http.ResponseWriter, r *http.Request, path string) { - if eTag, ok := staticFileHashes[path]; ok { - w.Header().Set("ETag", eTag) - } - http.ServeFileFS(w, r, staticFiles, path) -} - -func static(w http.ResponseWriter, r *http.Request) { - serveStaticFile(w, r, path.Clean(strings.TrimPrefix(r.URL.Path, "/"))) -} - -func favicon(w http.ResponseWriter, r *http.Request) { - serveStaticFile(w, r, "static/favicon.ico") -} - -func sharedFileHandler(w http.ResponseWriter, r *http.Request) { - fp, err := filepath.Localize(path.Clean(strings.TrimPrefix(r.URL.Path, "/"))) - if err != nil { - notFound(w, r) - return - } - f, err := os.OpenInRoot(filepath.Join(*nezuko, "www"), fp) - if err != nil { - notFound(w, r) - return - } - defer f.Close() - stat, err := f.Stat() - if err != nil { - log.Printf("Warning: sharedFileHandler: %s", err) - notFound(w, r) - return - } - if stat.IsDir() { - notFound(w, r) - return - } - http.ServeContent(w, r, fp, stat.ModTime(), f) -} - -func qrHandler(w http.ResponseWriter, r *http.Request) { - text, ok := verifyHMAC(r.FormValue("t"), "qr") - if !ok { - http.Error(w, "Bad signature", http.StatusBadRequest) - return - } - qr, err := qrcode.Encode(text, qrcode.Medium, 200) - if err != nil { - log.Printf("Error: failed to encode QR code: %s", err) - http.Error(w, "Failed to encode QR code", http.StatusInternalServerError) - return - } - http.ServeContent(w, r, "qr.png", time.Time{}, bytes.NewReader(qr)) -} - -var ( - //go:embed templates/wormhole.html.template - wormholeTemplateString string - wormholeTemplate = template.Must(outlinedTemplate(wormholeTemplateString)) -) - -type wormholeTemplateArgs struct { - Err string -} +var HoleTempDir string func makeHole() string { const nWords = 10 @@ -461,7 +70,7 @@ func writeHoleFile(filename string) (_ string, _ *holeFileWriter, err error) { if err != nil { return "", nil, err } - f, err := os.Create(fmt.Sprintf("%s/%x", *holeTempDir, primaryKey)) + f, err := os.Create(fmt.Sprintf("%s/%x", HoleTempDir, primaryKey)) if err != nil { return "", nil, err } @@ -495,26 +104,26 @@ func (r *offsetReader) Seek(offset int64, whence int) (int64, error) { return n - int64(r.offset), err } -type holeFileReader struct { +type HoleFileReader struct { *offsetReader - f *os.File + F *os.File } -func (r *holeFileReader) Close() error { - return r.f.Close() +func (r *HoleFileReader) Close() error { + return r.F.Close() } -var errNoHole = errors.New("no such hole") +var ErrNoHole = errors.New("no such hole") -func openHoleFile(hole string) (_ string, _ *holeFileReader, err error) { +func Open(hole string) (_ string, _ *HoleFileReader, err error) { primaryKey, err := hkdf.Key(sha256.New, []byte(hole), nil, "", 32) if err != nil { return "", nil, err } - f, err := os.Open(fmt.Sprintf("%s/%x", *holeTempDir, primaryKey)) + f, err := os.Open(fmt.Sprintf("%s/%x", HoleTempDir, primaryKey)) if err != nil { if errors.Is(err, fs.ErrNotExist) { - return "", nil, errNoHole + return "", nil, ErrNoHole } return "", nil, err } @@ -533,32 +142,11 @@ func openHoleFile(hole string) (_ string, _ *holeFileReader, err error) { if _, err := io.ReadFull(r, fileName); err != nil { return "", nil, err } - return string(fileName), &holeFileReader{&offsetReader{r, 8 + int(fileNameLen)}, f}, nil -} - -func readHoleFile(w http.ResponseWriter, req *http.Request, hole string) error { - fileName, r, err := openHoleFile(hole) - if err != nil { - return err - } - defer r.Close() - w.Header().Set("Content-Disposition", "attachment; filename*=UTF-8''"+fileName) - var modTime time.Time - if stat, err := r.f.Stat(); err == nil { - modTime = stat.ModTime() - } - http.ServeContent(w, req, fileName, modTime, r) - return nil -} - -func wormhole(w http.ResponseWriter, r *http.Request) { - if err := wormholeTemplate.Execute(w, wormholeTemplateArgs{}); err != nil { - log.Printf("Warning: wormhole: %s", err) - } + return string(fileName), &HoleFileReader{&offsetReader{r, 8 + int(fileNameLen)}, f}, nil } func writeHoleFileToTarFile(tarWriter *tar.Writer, hole string, now time.Time) error { - fileName, f, err := openHoleFile(hole) + fileName, f, err := Open(hole) if err != nil { return fmt.Errorf("read back hole file: %s", err) } @@ -579,9 +167,9 @@ func writeHoleFileToTarFile(tarWriter *tar.Writer, hole string, now time.Time) e return nil } -var errNoFile = errors.New("no file") +var ErrNoFile = errors.New("no file") -func uploadWormhole(reader *multipart.Reader) (string, error) { +func Upload(reader *multipart.Reader) (string, error) { var holes []string for { part, err := reader.NextPart() @@ -591,14 +179,14 @@ func uploadWormhole(reader *multipart.Reader) (string, error) { if part.FormName() != "file" || part.FileName() == "" { continue } - hole, err := writeSingleHoleFile(part.FileName(), part) + hole, err := WriteSingleFile(part.FileName(), part) if err != nil { return "", err } holes = append(holes, hole) } if len(holes) == 0 { - return "", errNoFile + return "", ErrNoFile } if len(holes) == 1 { return holes[0], nil @@ -634,46 +222,7 @@ func uploadWormhole(reader *multipart.Reader) (string, error) { return tarFileHole, nil } -var ( - //go:embed templates/wormhole-success.html.template - wormholeSuccessTemplateString string - wormholeSuccessTemplate = template.Must(outlinedTemplate(wormholeSuccessTemplateString)) -) - -type wormholeSuccessTemplateArgs struct { - URL string - QR string -} - -func wormholeUpload(w http.ResponseWriter, r *http.Request) { - reader, err := r.MultipartReader() - if err != nil { - http.Error(w, fmt.Sprintf("Not a multipart/form-data request: %s", err), http.StatusBadRequest) - return - } - hole, err := uploadWormhole(reader) - if err != nil { - if err == errNoFile { - w.WriteHeader(http.StatusBadRequest) - if err := wormholeTemplate.Execute(w, wormholeTemplateArgs{Err: "don't forget to pick a file"}); err != nil { - log.Printf("Warning: wormholeTemplate: %s", err) - } - return - } - log.Printf("Error: failed to upload hole file: %s", err) - http.Error(w, "Internal error", http.StatusInternalServerError) - return - } - downloadURL := selfURL.String() + "/wormhole/" + hole - if err := wormholeSuccessTemplate.Execute(w, wormholeSuccessTemplateArgs{ - URL: downloadURL, - QR: "/qr.png?t=" + url.QueryEscape(signMsg(downloadURL, "qr")), - }); err != nil { - log.Printf("Warning: wormholeSend: %s", err) - } -} - -func writeSingleHoleFile(filename string, r io.Reader) (string, error) { +func WriteSingleFile(filename string, r io.Reader) (string, error) { hole, holeWriter, err := writeHoleFile(filename) if err != nil { return "", fmt.Errorf("write hole file: %s", err) @@ -688,35 +237,9 @@ func writeSingleHoleFile(filename string, r io.Reader) (string, error) { return hole, nil } -func wormholeAPIUpload(w http.ResponseWriter, r *http.Request) { - hole, err := writeSingleHoleFile(r.PathValue("name"), r.Body) - if err != nil { - log.Printf("Error: failed to write hole file: %s", err) - http.Error(w, "Failed to write hole file", http.StatusInternalServerError) - return - } - resultURL := fmt.Sprintf("%s/wormhole/%s", selfURL, hole) - w.Header().Set("Content-Type", "text/plain") - w.Header().Set("Location", resultURL) - w.WriteHeader(http.StatusCreated) - fmt.Fprintln(w, resultURL) -} - -func wormholeDownload(w http.ResponseWriter, r *http.Request) { - if err := readHoleFile(w, r, r.PathValue("hole")); err != nil { - if err == errNoHole { - notFound(w, r) - return - } - log.Printf("Error: failed to read hole file: %s", err) - http.Error(w, "Failed to read hole file", http.StatusInternalServerError) - return - } -} - -func cleanHole() error { +func Clean() error { log.Printf("Cleaning hole...") - holeDir, err := os.Open(*holeTempDir) + holeDir, err := os.Open(HoleTempDir) if err != nil { return err } @@ -733,7 +256,7 @@ func cleanHole() error { if !stat.ModTime().Before(deadline) { continue } - if err := os.Remove(*holeTempDir + "/" + file.Name()); err != nil { + if err := os.Remove(HoleTempDir + "/" + file.Name()); err != nil { log.Printf("Error: clean hole: %s", err) continue } @@ -747,894 +270,9 @@ func cleanHole() error { } } -func mac(msg []byte, purpose string) []byte { - mac := hmac.New(sha256.New, secretKey) - io.WriteString(mac, purpose) - io.WriteString(mac, ":") - mac.Write(msg) - return mac.Sum(nil) -} - -func signMsg(msg, purpose string) string { - return msg + base64.RawURLEncoding.EncodeToString(mac([]byte(msg), purpose)) -} - -func verifyHMAC(signedMsg, purpose string) (string, bool) { - macSize := base64.RawURLEncoding.EncodedLen(sha256.Size) - if len(signedMsg) < macSize { - return "", false - } - msg, msgMAC := signedMsg[:len(signedMsg)-macSize], signedMsg[len(signedMsg)-macSize:] - expectedMAC := base64.RawURLEncoding.EncodeToString(mac([]byte(msg), purpose)) - if !hmac.Equal([]byte(msgMAC), []byte(expectedMAC)) { - return "", false - } - return msg, true -} - -const ( - authVersion = "authv3" - authCookieName = "__Secure-a" -) - -func makeHTTPCookie(token string, expiry time.Time) *http.Cookie { - return &http.Cookie{ - Name: authCookieName, - Value: token, - Path: "/", - Domain: selfURL.Hostname(), - Expires: expiry, - Secure: true, - HttpOnly: true, - SameSite: http.SameSiteStrictMode, - Partitioned: true, - } -} - -type authToken struct { - expiry time.Time - userID []byte -} - -func attachCookie(w http.ResponseWriter, tok *authToken) { - buf := binary.AppendVarint(nil, tok.expiry.Unix()) - buf = append(buf, tok.userID...) - token := signMsg(base64.RawURLEncoding.EncodeToString(buf), authVersion) - http.SetCookie(w, makeHTTPCookie(token, tok.expiry)) -} - -func cookieAuth(r *http.Request) bool { - cookie, err := r.Cookie(authCookieName) - if err != nil { - return false - } - msg, ok := verifyHMAC(cookie.Value, authVersion) - if !ok { - return false - } - msgBytes, err := base64.RawURLEncoding.DecodeString(msg) - if err != nil { - return false - } - expiryUnix, n := binary.Varint(msgBytes) - if n <= 0 { - return false - } - msgBytes = msgBytes[n:] - expiry := time.Unix(expiryUnix, 0) - if time.Now().After(expiry) { - return false - } - if len(msgBytes) > 0 { - if len(msgBytes) < 16 { - return false - } - userID := msgBytes - config, err := loadConfig() - if err != nil { - log.Printf("Error: failed to load config: %s", err) - return false - } - if _, ok := config.passkeys[string(userID)]; !ok { - return false - } - } - return true -} - -func verifyRedirect(redirect string) bool { - u, err := url.Parse(redirect) - if err != nil { - return false - } - switch u.Host { - case - "cinema." + selfURL.Host, - "downloads." + selfURL.Host, - selfURL.Host: - - return true - } - return false -} - -const challengeExpiry = 10 * time.Minute - -var ( - challengeMu sync.Mutex - challenges = make(map[string]time.Time) -) - -var ( - //go:embed templates/login.html.template - loginTemplateString string - loginTemplate = template.Must(template.New("login").Parse(loginTemplateString)) -) - -type loginTemplateArgs struct { - Challenge string -} - -func serveLogin(w http.ResponseWriter, r *http.Request) { - if cookieAuth(r) { - redirect := r.FormValue("redirect") - if !verifyRedirect(redirect) { - redirect = "/" - } - http.Redirect(w, r, redirect, http.StatusSeeOther) - return - } - buf := make([]byte, 32) - rand.Read(buf) - now := time.Now() - challengeMu.Lock() - if len(challenges) >= 100 { - challengeMu.Unlock() - http.Error(w, "Too many active requests", http.StatusTooManyRequests) - return - } - challenges[string(buf)] = now - challengeMu.Unlock() - if err := loginTemplate.Execute(w, loginTemplateArgs{ - Challenge: base64.StdEncoding.EncodeToString(buf), - }); err != nil { - log.Printf("Warning: login: %s", err) - } -} - -func login(w http.ResponseWriter, r *http.Request) { - user, err := base64.StdEncoding.DecodeString(r.FormValue("user")) - if err != nil { - http.Error(w, "Bad user", http.StatusBadRequest) - return - } - authData, err := base64.StdEncoding.DecodeString(r.FormValue("auth-data")) - if err != nil { - http.Error(w, "Bad auth data", http.StatusBadRequest) - return - } - clientData, err := base64.StdEncoding.DecodeString(r.FormValue("client-data")) - if err != nil { - http.Error(w, "Bad client data: invalid base64", http.StatusBadRequest) - return - } - sig, err := base64.StdEncoding.DecodeString(r.FormValue("sig")) - if err != nil { - http.Error(w, "Bad sig", http.StatusBadRequest) - return - } - config, err := loadConfig() - if err != nil { - log.Printf("Error: failed to load config: %s", err) - http.Error(w, "Internal error", http.StatusInternalServerError) - return - } - pubKey, ok := config.passkeys[string(user)] - if !ok { - http.Error(w, "No user with the given ID", http.StatusBadRequest) - return - } - clientDataHash := sha256.Sum256(clientData) - if err := verifyPubKey(pubKey, slices.Concat(authData, clientDataHash[:]), sig); err != nil { - http.Error(w, "Challenge failed", http.StatusBadRequest) - return - } - var cd struct { - Type string `json:"type"` - Challenge string `json:"challenge"` - Origin string `json:"origin"` - CrossOrigin bool `json:"crossOrigin"` - } - if err := json.Unmarshal(clientData, &cd); err != nil { - http.Error(w, "Bad client data: invalid JSON", http.StatusBadRequest) - return - } - challenge, err := base64.RawURLEncoding.DecodeString(cd.Challenge) - if err != nil { - http.Error(w, "Bad client data: bad challenge", http.StatusBadRequest) - return - } - challengeMu.Lock() - initiated, ok := challenges[string(challenge)] - delete(challenges, string(challenge)) - challengeMu.Unlock() - if !ok { - http.Error(w, "Request already consumed", http.StatusConflict) - return - } - if time.Since(initiated) > challengeExpiry { - http.Error(w, "Challenge is too old. Please try again", http.StatusConflict) - return - } - if cd.Type != "webauthn.get" || cd.Origin != selfURL.String() || cd.CrossOrigin { - http.Error(w, "Bad client data", http.StatusBadRequest) - return - } - expectedRPHash := sha256.Sum256([]byte(selfURL.Hostname())) - const flagUserPresence, flagUserVerification = 0x01, 0x04 - if len(authData) < 37 || !bytes.Equal(authData[:32], expectedRPHash[:]) || authData[32]&(flagUserPresence|flagUserVerification) != (flagUserPresence|flagUserVerification) { - http.Error(w, "Bad authenticator data", http.StatusBadRequest) - return - } - attachCookie(w, &authToken{ - expiry: time.Now().Add(30 * 24 * time.Hour), - userID: user, - }) - redirect := r.FormValue("redirect") - if !verifyRedirect(redirect) { - redirect = "/" - } - http.Redirect(w, r, redirect, http.StatusSeeOther) -} - -var ( - //go:embed templates/register/register.html.template - registerTemplateString string - registerTemplate = template.Must(outlinedTemplate(registerTemplateString)) -) - -type registerTemplateArgs struct { - ID string - Challenge string -} - -func serveRegister(w http.ResponseWriter, r *http.Request) { - buf := make([]byte, 32+16) - rand.Read(buf) - challenge, userID := buf[:32], buf[32:] - if err := registerTemplate.Execute(w, registerTemplateArgs{ - ID: base64.StdEncoding.EncodeToString(userID), - Challenge: base64.StdEncoding.EncodeToString(challenge), - }); err != nil { - log.Printf("Warning: serveRegister: %s", err) - } -} - -func wrap(s string) string { - out := new(strings.Builder) - for s != "" { - if out.Len() > 0 { - out.WriteString("\n\t ") - } - n := min(50, len(s)) - out.WriteString(s[:n]) - s = s[n:] - } - return out.String() -} - -var ( - //go:embed templates/register/register-success.html.template - registerSuccessTemplateString string - registerSuccessTemplate = template.Must(outlinedTemplate(registerSuccessTemplateString)) -) - -type registerSuccessTemplateArgs struct { - ID string - Key string -} - -func register(w http.ResponseWriter, r *http.Request) { - username := r.FormValue("name") - if username == "" { - http.Error(w, "Passkey name is required", http.StatusBadRequest) - return - } - userID, err := base64.StdEncoding.DecodeString(r.FormValue("id")) - if err != nil { - http.Error(w, "Invalid user ID", http.StatusBadRequest) - return - } - key, err := base64.StdEncoding.DecodeString(r.FormValue("key")) - if err != nil { - http.Error(w, "Invalid key", http.StatusBadRequest) - return - } - if err := registerSuccessTemplate.Execute(w, registerSuccessTemplateArgs{ - ID: r.FormValue("name"), - Key: wrap(base64.RawURLEncoding.EncodeToString(slices.Concat(userID, key))), - }); err != nil { - log.Printf("Warning: register: %s", err) - } -} - -var ( - otpMu sync.Mutex - otpLink string - otpGenerated time.Time -) - -var ( - //go:embed templates/otp.html.template - otpTemplateString string - otpTemplate = template.Must(outlinedTemplate(otpTemplateString)) -) - -type otpTemplateArgs struct { - URL string - QR string -} - -func serveOTP(w http.ResponseWriter, r *http.Request) { - const nWords = 5 - buf := make([]byte, 2*nWords) - rand.Read(buf) - words := make([]string, nWords) - for i := range len(buf) / 2 { - words[i] = wordlist.Words[binary.NativeEndian.Uint16(buf[2*i:])&0x1fff] - } - l := strings.Join(words, "-") - otpMu.Lock() - otpLink = l - otpGenerated = time.Now() - otpMu.Unlock() - otpURL := selfURL.String() + "/otp/" + l - if err := otpTemplate.Execute(w, otpTemplateArgs{ - URL: otpURL, - QR: "/qr.png?t=" + url.QueryEscape(signMsg(otpURL, "qr")), - }); err != nil { - log.Printf("Warning: serveOTP: %s", err) - } -} - -func otpLogin(w http.ResponseWriter, r *http.Request) { - otpMu.Lock() - myOTP := otpLink - otpLink = "" - generated := otpGenerated - otpMu.Unlock() - reqOTP := r.PathValue("otp") - if reqOTP == "" { - notFound(w, r) - return - } - myOTPHash := sha256.Sum256([]byte(myOTP)) - reqOTPHash := sha256.Sum256([]byte(reqOTP)) - if !hmac.Equal(myOTPHash[:], reqOTPHash[:]) { - notFound(w, r) - return - } - if time.Since(generated) > 10*time.Minute { - http.Error(w, "OTP is too old. Please generate a new link", http.StatusConflict) - return - } - attachCookie(w, &authToken{expiry: time.Now().Add(24 * time.Hour)}) - fmt.Fprintf(w, "Temporary 24 hour token issued. You are now logged in.\n") -} - -func logout(w http.ResponseWriter, r *http.Request) { - http.SetCookie(w, makeHTTPCookie("!", time.Now())) - fmt.Fprintf(w, "You are now logged out.\n") -} - -var ( - //go:embed templates/note.html.template - notepadString string - notepadTemplate = template.Must(outlinedTemplate(notepadString)) - - notepadContentsMu sync.Mutex - notepadContents string -) - -type notepadTemplateArgs struct { - Content string -} - -func notepad(w http.ResponseWriter, r *http.Request) { - notepadContentsMu.Lock() - currentContent := notepadContents - notepadContentsMu.Unlock() - if err := notepadTemplate.Execute(w, notepadTemplateArgs{Content: currentContent}); err != nil { - log.Printf("Warning: notepad: %s", err) - } -} - -func autosave(w http.ResponseWriter, r *http.Request) { - newContent := r.FormValue("content") - notepadContentsMu.Lock() - notepadContents = newContent - notepadContentsMu.Unlock() - if err := notepadTemplate.ExecuteTemplate(w, "saveIndicator", "Saved ✓"); err != nil { - log.Printf("Warning: autosave: %s", err) - } -} - -func cmd(w http.ResponseWriter, r *http.Request) { - serviceConfig, err := loadConfig() - if err != nil { - log.Printf("Error: failed to load config: %s", err) - http.Error(w, "Failed to load config", http.StatusInternalServerError) - return - } - sourceIdx, ok := slices.BinarySearchFunc(serviceConfig.CommandRedirects, r.PathValue("cmd"), func(cmd commandConfig, name string) int { return strings.Compare(cmd.Name, name) }) - if !ok { - notFound(w, r) - return - } - if r.FormValue("go-get") == "1" { - fmt.Fprintf(w, "<meta name=\"go-import\" content=\"roseh.moe/cmd/%s %s\">\n", - r.PathValue("cmd"), - serviceConfig.CommandRedirects[sourceIdx].URL) - if source := serviceConfig.CommandRedirects[sourceIdx].Source; source != "" { - fmt.Fprintf(w, "<meta name=\"go-source\" content=\"roseh.moe/cmd/%s %s\">\n", - r.PathValue("cmd"), - source) - } - } else { - http.Redirect(w, r, "https://pkg.go.dev/roseh.moe/cmd/"+r.PathValue("cmd"), http.StatusMovedPermanently) - } -} - -var ( - //go:embed templates/pkg-index.html.template - pkgIndexString string - pkgIndexTemplate = template.Must(outlinedTemplate(pkgIndexString)) -) - -type pkgIndexTemplateArgs struct { - Packages []packageConfig -} - -func pkgIndex(w http.ResponseWriter, r *http.Request) { - serviceConfig, err := loadConfig() - if err != nil { - log.Printf("Error: failed to load config: %s", err) - http.Error(w, "Failed to load config", http.StatusInternalServerError) - return - } - if err := pkgIndexTemplate.Execute(w, pkgIndexTemplateArgs{Packages: serviceConfig.PackageRedirects}); err != nil { - log.Printf("Warning: pkgIndex: %s", err) - } -} - -var ( - //go:embed templates/cmd-index.html.template - cmdIndexString string - cmdIndexTemplate = template.Must(outlinedTemplate(cmdIndexString)) -) - -type cmdIndexTemplateArgs struct { - Commands []commandConfig -} - -func cmdIndex(w http.ResponseWriter, r *http.Request) { - serviceConfig, err := loadConfig() - if err != nil { - log.Printf("Error: failed to load config: %s", err) - http.Error(w, "Failed to load config", http.StatusInternalServerError) - return - } - if err := cmdIndexTemplate.Execute(w, cmdIndexTemplateArgs{Commands: serviceConfig.CommandRedirects}); err != nil { - log.Printf("Warning: pkgIndex: %s", err) - } -} - -func pkg(w http.ResponseWriter, r *http.Request) { - serviceConfig, err := loadConfig() - if err != nil { - log.Printf("Error: failed to load config: %s", err) - http.Error(w, "Failed to load config", http.StatusInternalServerError) - return - } - sourceIdx, ok := slices.BinarySearchFunc(serviceConfig.PackageRedirects, r.PathValue("pkg"), func(pkg packageConfig, name string) int { return strings.Compare(pkg.Name, name) }) - if !ok { - notFound(w, r) - return - } - if r.FormValue("go-get") == "1" { - fmt.Fprintf(w, "<meta name=\"go-import\" content=\"roseh.moe/pkg/%s %s\">\n", r.PathValue("pkg"), serviceConfig.PackageRedirects[sourceIdx].URL) - if source := serviceConfig.PackageRedirects[sourceIdx].Source; source != "" { - fmt.Fprintf(w, "<meta name=\"go-source\" content=\"roseh.moe/pkg/%s %s\">\n", - r.PathValue("pkg"), - source) - } - } else { - http.Redirect(w, r, "https://pkg.go.dev/roseh.moe/pkg/"+r.PathValue("pkg"), http.StatusMovedPermanently) - } -} - -type nopCloser struct { - io.Writer -} - -func (nopCloser) Close() error { return nil } - -func (w nopCloser) ReadFrom(r io.Reader) (int64, error) { - return io.Copy(w.Writer, r) -} - -type gzipResponseWriter struct { - http.ResponseWriter - - w io.WriteCloser - buf []byte - code int -} - -func (w *gzipResponseWriter) Unwrap() http.ResponseWriter { - return w.ResponseWriter -} - -func shouldGzip(w http.ResponseWriter) bool { - disposition, _, _ := strings.Cut(w.Header().Get("Content-Disposition"), ";") - length, lengthErr := strconv.Atoi(w.Header().Get("Content-Length")) - return strings.HasPrefix(w.Header().Get("Content-Type"), "text/") && - !(disposition == "attachment" && w.Header().Get("Accept-Ranges") != "" || - w.Header().Get("Content-Encoding") != "" || - lengthErr == nil && length < 512) -} - -func (w *gzipResponseWriter) ReadFrom(r io.Reader) (int64, error) { - if w.w != nil { - return io.Copy(w.w, r) - } - var nn int64 - if len(w.Header().Values("Content-Type")) == 0 { - if w.buf == nil { - w.buf = make([]byte, 0, 512) - } - n, err := io.ReadFull(r, w.buf[len(w.buf):cap(w.buf)]) - w.buf = w.buf[:len(w.buf)+n] - nn += int64(n) - if err != nil && err != io.EOF && err != io.ErrUnexpectedEOF { - return nn, err - } - if len(w.buf) < 512 { - return nn, nil - } - contentType := http.DetectContentType(w.buf) - w.Header().Set("Content-Type", contentType) - } - if shouldGzip(w.ResponseWriter) { - var err error - w.w, err = gzip.NewWriterLevel(w.ResponseWriter, gzip.BestSpeed) - if err != nil { - return nn, err - } - w.Header().Set("Content-Encoding", "gzip") - w.Header().Del("Content-Length") - w.Header().Del("Accept-Ranges") - } else { - w.w = nopCloser{w.ResponseWriter} - } - if w.code != 0 { - w.ResponseWriter.WriteHeader(w.code) - } - if len(w.buf) > 0 { - if n, err := w.w.Write(w.buf); err != nil { - return max(int64(n)-(512-nn), 0), err - } - } - n, err := io.Copy(w.w, r) - nn += n - return nn, err -} - -func (w *gzipResponseWriter) Write(p []byte) (int, error) { - n, err := w.ReadFrom(bytes.NewReader(p)) - return int(n), err -} - -func (w *gzipResponseWriter) WriteHeader(statusCode int) { - w.code = statusCode -} - -func (w *gzipResponseWriter) close() { - if w.w == nil { - if w.code != 0 { - w.ResponseWriter.WriteHeader(w.code) - } - w.ResponseWriter.Write(w.buf) - } else { - w.w.Close() - } -} - -type gzipHandler struct { - h http.Handler -} - -func (h *gzipHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { - if len(r.Header.Values("Range")) == 0 { - for _, hdr := range r.Header.Values("Accept-Encoding") { - for encoding := range strings.FieldsFuncSeq(hdr, func(r rune) bool { return r == ',' || unicode.IsSpace(r) }) { - encoding, _, _ := strings.Cut(encoding, ";") - if encoding == "gzip" { - gzipWriter := &gzipResponseWriter{ResponseWriter: w} - h.h.ServeHTTP(gzipWriter, r) - gzipWriter.close() - return - } - } - } - } - h.h.ServeHTTP(w, r) -} - -type authHandler struct { - h http.Handler - noRedirect bool -} - -func (h *authHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { - if !cookieAuth(r) { - if h.noRedirect { - http.Error(w, "not logged in", http.StatusUnauthorized) - } else { - u := *r.URL - u.Host = r.Host - u.Scheme = selfURL.Scheme - http.Redirect(w, r, "//"+selfURL.Host+"/login?redirect="+url.QueryEscape(u.String()), http.StatusSeeOther) - } - return - } - h.h.ServeHTTP(w, r) -} - -type timeoutHandler struct { - h http.Handler - timeout time.Duration -} - -func (h *timeoutHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { - ctx := r.Context() - rc := http.NewResponseController(w) - deadline := time.Now().Add(h.timeout) - if err := rc.SetReadDeadline(deadline); err != nil { - log.Printf("Error: set read deadline: %s", err) - } - // Give some extra time to write the error - writeDeadline := deadline.Add(time.Minute) - if err := rc.SetWriteDeadline(writeDeadline); err != nil { - log.Printf("Error: set write deadline: %s", err) - } - ctx, cancel := context.WithDeadline(ctx, deadline) - defer cancel() - h.h.ServeHTTP(w, r.WithContext(ctx)) -} - -type loggingHandler struct { - h http.Handler -} - -func (h *loggingHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { - if *v { - log.Printf("%q from %q", r.Method+" "+r.Host+r.URL.String(), r.RemoteAddr) - } - h.h.ServeHTTP(w, r) -} - -type removeAuthCookieHandler struct { - h http.Handler -} - -type hstsHandler struct { - h http.Handler -} - -func (h *hstsHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { - if *https != "" { - w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains") - } - h.h.ServeHTTP(w, r) -} - -func (h *removeAuthCookieHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { - var cookies []*http.Cookie - for _, c := range r.Cookies() { - if c.Name != authCookieName { - cookies = append(cookies, c) - } - } - r.Header.Del("Cookie") - for _, c := range cookies { - r.AddCookie(c) - } - h.h.ServeHTTP(w, r) -} - -func main() { - flag.Parse() - - if err := loadSecrets(); err != nil { - log.Fatal(err) - } - - if err := os.MkdirAll(*holeTempDir, 0700); err != nil { - log.Fatal(err) - } - - go func() { - for range time.NewTicker(2 * time.Hour).C { - if err := cleanHole(); err != nil { - log.Printf("Error: clean hole: %s", err) - } - } - }() - - go func() { - for now := range time.NewTicker(time.Hour).C { - log.Printf("Cleaning expired challenges") - challengeMu.Lock() - for challenge, initiated := range challenges { - if now.Sub(initiated) > challengeExpiry { - delete(challenges, challenge) - } - } - challengeMu.Unlock() - } - }() - - mux := http.NewServeMux() - indexTemplate, err := outlinedTemplate(indexString) - if err != nil { - log.Fatal(err) - } - indexHandler, err := staticTemplate(indexTemplate) - if err != nil { - log.Fatal(err) - } - mux.Handle("GET /{$}", &timeoutHandler{h: indexHandler, timeout: 5 * time.Minute}) - gamesIndexTemplate, err := outlinedTemplate(gamesIndexString) - if err != nil { - log.Fatal(err) - } - gamesIndexHandler, err := staticTemplate(gamesIndexTemplate) - if err != nil { - log.Fatal(err) - } - mux.Handle("GET /games/{$}", &timeoutHandler{h: gamesIndexHandler, timeout: 5 * time.Minute}) - pongTemplate, err := template.New("pong").Parse(pongString) - if err != nil { - log.Fatal(err) - } - pongHandler, err := staticTemplate(pongTemplate) - if err != nil { - log.Fatal(err) - } - mux.Handle("GET /games/pong", &timeoutHandler{h: pongHandler, timeout: 5 * time.Minute}) - stallmanShooterTemplate, err := outlinedTemplate(stallmanShooterString) - if err != nil { - log.Fatal(err) - } - stallmanShooterHandler, err := staticTemplate(stallmanShooterTemplate) - if err != nil { - log.Fatal(err) - } - mux.Handle("GET /games/rms", &timeoutHandler{h: stallmanShooterHandler, timeout: 5 * time.Minute}) - mux.Handle("GET /qr.png", &timeoutHandler{h: http.HandlerFunc(qrHandler), timeout: 5 * time.Minute}) - mux.Handle("GET /wormhole", &timeoutHandler{h: http.HandlerFunc(wormhole), timeout: 5 * time.Minute}) - mux.HandleFunc("POST /wormhole", wormholeUpload) - mux.HandleFunc("GET /wormhole/{hole}", wormholeDownload) - mux.Handle("GET /login", &timeoutHandler{h: http.HandlerFunc(serveLogin), timeout: 5 * time.Minute}) - mux.Handle("POST /login", &timeoutHandler{h: http.HandlerFunc(login), timeout: 5 * time.Minute}) - mux.Handle("GET /logout", &timeoutHandler{h: http.HandlerFunc(logout), timeout: 5 * time.Minute}) - mux.Handle("GET /register", &timeoutHandler{h: http.HandlerFunc(serveRegister), timeout: 5 * time.Minute}) - mux.Handle("POST /register", &timeoutHandler{h: http.HandlerFunc(register), timeout: 5 * time.Minute}) - mux.Handle("GET /otp", &timeoutHandler{h: &authHandler{h: http.HandlerFunc(serveOTP)}, timeout: 5 * time.Minute}) - mux.Handle("GET /otp/{otp}", &timeoutHandler{h: http.HandlerFunc(otpLogin), timeout: 5 * time.Minute}) - mux.Handle("GET /notepad", &timeoutHandler{h: &authHandler{h: http.HandlerFunc(notepad)}, timeout: 5 * time.Minute}) - mux.Handle("POST /notepad", &timeoutHandler{h: &authHandler{h: http.HandlerFunc(autosave), noRedirect: true}, timeout: 5 * time.Minute}) - mux.Handle("GET /cmd/{$}", &timeoutHandler{h: http.HandlerFunc(cmdIndex), timeout: 5 * time.Minute}) - mux.Handle("GET /cmd/{cmd}", &timeoutHandler{h: http.HandlerFunc(cmd), timeout: 5 * time.Minute}) - mux.Handle("GET /pkg/{$}", &timeoutHandler{h: http.HandlerFunc(pkgIndex), timeout: 5 * time.Minute}) - mux.Handle("GET /pkg/{pkg}", &timeoutHandler{h: http.HandlerFunc(pkg), timeout: 5 * time.Minute}) - mux.Handle("GET /nezuko/", &timeoutHandler{h: &authHandler{h: http.StripPrefix("/nezuko/", http.FileServer(http.Dir(*nezuko)))}, timeout: 10 * time.Minute}) - mux.Handle("GET /static/", &timeoutHandler{h: http.HandlerFunc(static), timeout: 5 * time.Minute}) - mux.Handle("GET /favicon.ico", &timeoutHandler{h: http.HandlerFunc(favicon), timeout: 5 * time.Minute}) - apiMux := http.NewServeMux() - apiMux.HandleFunc("PUT /api/wormhole/{name}", wormholeAPIUpload) - mux.Handle("/api/", apiMux) - mux.Handle("/", &timeoutHandler{h: http.HandlerFunc(sharedFileHandler), timeout: 5 * time.Minute}) - serverMux := http.NewServeMux() - serverMux.Handle(selfURL.Hostname()+"/", &gzipHandler{mux}) - jellyfinURL, err := url.Parse("http://127.0.0.1:8096") - if err != nil { - log.Fatal(err) - } - serverMux.Handle("cinema."+selfURL.Hostname()+"/", &authHandler{h: &removeAuthCookieHandler{&httputil.ReverseProxy{ - Rewrite: func(r *httputil.ProxyRequest) { - r.SetURL(jellyfinURL) - r.SetXForwarded() - }, - }}}) - codeMux := http.NewServeMux() - cgitStaticFiles := http.FileServer(http.Dir(*cgit)) - codeMux.Handle("/cgit.css", &timeoutHandler{h: cgitStaticFiles, timeout: 5 * time.Minute}) - codeMux.Handle("/cgit.js", &timeoutHandler{h: cgitStaticFiles, timeout: 5 * time.Minute}) - codeMux.Handle("/robots.txt", &timeoutHandler{h: cgitStaticFiles, timeout: 5 * time.Minute}) - codeMux.Handle("/favicon.ico", &timeoutHandler{h: http.HandlerFunc(favicon), timeout: 5 * time.Minute}) - cgitConfigAbsPath, err := filepath.Abs(*cgitConfig) - if err != nil { - log.Fatal(err) - } - cgitCGI := &cgi.Handler{ - Path: filepath.Join(*cgit, "cgit.cgi"), - Env: []string{"CGIT_CONFIG=" + cgitConfigAbsPath}, - } - cgitCGI.PathLocationHandler = cgitCGI - codeMux.Handle("/", &timeoutHandler{h: &removeAuthCookieHandler{cgitCGI}, timeout: 5 * time.Minute}) - serverMux.Handle("code."+selfURL.Hostname()+"/", &gzipHandler{codeMux}) - transmissionURL, err := url.Parse("http://127.0.0.1:9091") - if err != nil { - log.Fatal(err) - } - serverMux.Handle("downloads."+selfURL.Hostname()+"/", &authHandler{h: &removeAuthCookieHandler{&httputil.ReverseProxy{ - Rewrite: func(r *httputil.ProxyRequest) { - r.SetURL(transmissionURL) - r.SetXForwarded() - }, - }}}) - server := &http.Server{ - Handler: &loggingHandler{http.NewCrossOriginProtection().Handler(&hstsHandler{serverMux})}, - - ReadHeaderTimeout: 5 * time.Minute, - IdleTimeout: 10 * time.Minute, - } - - if *httpRedirect != "" { - go func() { - mux := http.NewServeMux() - mux.Handle("GET /.well-known/acme-challenge/", &timeoutHandler{ - h: http.FileServer(http.Dir("/var/lib/acme/acme-challenge")), - timeout: 5 * time.Minute, - }) - mux.Handle("/", &timeoutHandler{ - h: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - u := *r.URL - u.Scheme = selfURL.Scheme - u.Host, _, _ = strings.Cut(r.Host, ":") - if port := selfURL.Port(); port != "" { - u.Host += ":" + port - } - http.Redirect(w, r, u.String(), http.StatusMovedPermanently) - }), - timeout: time.Minute, - }) - httpSrv := &http.Server{ - Addr: ":" + *httpRedirect, - Handler: &loggingHandler{mux}, - ReadHeaderTimeout: 5 * time.Minute, - IdleTimeout: 10 * time.Minute, - } - log.Printf("Serving HTTP redirect on %q", httpSrv.Addr) - err := httpSrv.ListenAndServe() - log.Printf("Error: HTTP redirect failed: %s", err) - }() - } - - port := selfURL.Port() - if port == "" { - port = "80" - if *https != "" { - port = "443" - } - } - server.Addr = ":" + port - log.Printf("Listening on %q", server.Addr) - if *https != "" { - log.Fatal(server.ListenAndServeTLS(*https+"/cert.pem", *https+"/key.pem")) - } else { - log.Fatal(server.ListenAndServe()) +func Init() error { + if err := os.MkdirAll(HoleTempDir, 0700); err != nil { + return err } + return nil } |