mirror of
https://github.com/jech/galene.git
synced 2024-11-08 17:55:59 +01:00
716 lines
14 KiB
Go
716 lines
14 KiB
Go
package webserver
|
|
|
|
import (
|
|
"context"
|
|
"crypto/tls"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"html"
|
|
"io"
|
|
"log"
|
|
"net"
|
|
"net/http"
|
|
"net/url"
|
|
"os"
|
|
"path"
|
|
"path/filepath"
|
|
"sort"
|
|
"strings"
|
|
"sync/atomic"
|
|
"time"
|
|
|
|
"github.com/gorilla/websocket"
|
|
|
|
"github.com/jech/cert"
|
|
"github.com/jech/galene/diskwriter"
|
|
"github.com/jech/galene/group"
|
|
"github.com/jech/galene/rtpconn"
|
|
"github.com/jech/galene/stats"
|
|
)
|
|
|
|
var server atomic.Value
|
|
|
|
var StaticRoot string
|
|
|
|
var Insecure bool
|
|
|
|
func Serve(address string, dataDir string) error {
|
|
http.Handle("/", &fileHandler{http.Dir(StaticRoot)})
|
|
http.HandleFunc("/group/", groupHandler)
|
|
http.HandleFunc("/recordings",
|
|
func(w http.ResponseWriter, r *http.Request) {
|
|
http.Redirect(w, r,
|
|
"/recordings/", http.StatusPermanentRedirect)
|
|
})
|
|
http.HandleFunc("/recordings/", recordingsHandler)
|
|
http.HandleFunc("/ws", wsHandler)
|
|
http.HandleFunc("/public-groups.json", publicHandler)
|
|
http.HandleFunc("/stats.json",
|
|
func(w http.ResponseWriter, r *http.Request) {
|
|
statsHandler(w, r, dataDir)
|
|
})
|
|
|
|
s := &http.Server{
|
|
Addr: address,
|
|
ReadHeaderTimeout: 60 * time.Second,
|
|
IdleTimeout: 120 * time.Second,
|
|
}
|
|
if !Insecure {
|
|
certificate := cert.New(
|
|
filepath.Join(dataDir, "cert.pem"),
|
|
filepath.Join(dataDir, "key.pem"),
|
|
)
|
|
s.TLSConfig = &tls.Config{
|
|
GetCertificate: func(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
|
|
return certificate.Get()
|
|
},
|
|
}
|
|
}
|
|
s.RegisterOnShutdown(func() {
|
|
group.Shutdown("server is shutting down")
|
|
})
|
|
|
|
server.Store(s)
|
|
|
|
proto := "tcp"
|
|
if strings.HasPrefix(address, "/") {
|
|
proto = "unix"
|
|
}
|
|
|
|
listener, err := net.Listen(proto, address)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer listener.Close()
|
|
|
|
if !Insecure {
|
|
err = s.ServeTLS(listener, "", "")
|
|
} else {
|
|
err = s.Serve(listener)
|
|
}
|
|
|
|
if err == http.ErrServerClosed {
|
|
return nil
|
|
}
|
|
return err
|
|
}
|
|
|
|
func cspHeader(w http.ResponseWriter, connect string) {
|
|
c := "connect-src ws: wss: 'self';"
|
|
if connect != "" {
|
|
c = "connect-src " + connect + " ws: wss: 'self';"
|
|
}
|
|
w.Header().Add("Content-Security-Policy",
|
|
c+" img-src data: 'self'; media-src blob: 'self'; default-src 'self'")
|
|
}
|
|
|
|
func notFound(w http.ResponseWriter) {
|
|
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
w.WriteHeader(http.StatusNotFound)
|
|
|
|
f, err := os.Open(path.Join(StaticRoot, "404.html"))
|
|
if err != nil {
|
|
fmt.Fprintln(w, "<p>Not found</p>")
|
|
return
|
|
}
|
|
defer f.Close()
|
|
|
|
io.Copy(w, f)
|
|
}
|
|
|
|
var ErrIsDirectory = errors.New("is a directory")
|
|
|
|
func httpError(w http.ResponseWriter, err error) {
|
|
if os.IsNotExist(err) {
|
|
notFound(w)
|
|
return
|
|
}
|
|
if os.IsPermission(err) {
|
|
http.Error(w, "403 forbidden", http.StatusForbidden)
|
|
return
|
|
}
|
|
log.Printf("HTTP server error: %v", err)
|
|
http.Error(w, "500 Internal Server Error",
|
|
http.StatusInternalServerError)
|
|
}
|
|
|
|
const (
|
|
normalCacheControl = "max-age=1800"
|
|
veryCachableCacheControl = "max-age=86400"
|
|
)
|
|
|
|
func redirect(w http.ResponseWriter, r *http.Request) bool {
|
|
conf, err := group.GetConfiguration()
|
|
if err != nil || conf.CanonicalHost == "" {
|
|
return false
|
|
}
|
|
|
|
if strings.EqualFold(r.Host, conf.CanonicalHost) {
|
|
return false
|
|
}
|
|
|
|
u := url.URL{
|
|
Scheme: "https",
|
|
Host: conf.CanonicalHost,
|
|
Path: r.URL.Path,
|
|
}
|
|
http.Redirect(w, r, u.String(), http.StatusMovedPermanently)
|
|
return true
|
|
}
|
|
|
|
func makeCachable(w http.ResponseWriter, p string, fi os.FileInfo, cachable bool) {
|
|
etag := fmt.Sprintf("\"%v-%v\"", fi.Size(), fi.ModTime().UnixNano())
|
|
w.Header().Set("ETag", etag)
|
|
if !cachable {
|
|
w.Header().Set("cache-control", "no-cache")
|
|
return
|
|
}
|
|
|
|
cc := normalCacheControl
|
|
if strings.HasPrefix(p, "/external/") {
|
|
cc = veryCachableCacheControl
|
|
}
|
|
|
|
w.Header().Set("Cache-Control", cc)
|
|
}
|
|
|
|
// fileHandler is our custom reimplementation of http.FileServer
|
|
type fileHandler struct {
|
|
root http.FileSystem
|
|
}
|
|
|
|
func (fh *fileHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
|
if redirect(w, r) {
|
|
return
|
|
}
|
|
|
|
cspHeader(w, "")
|
|
p := r.URL.Path
|
|
// this ensures any leading .. are removed by path.Clean below
|
|
if !strings.HasPrefix(p, "/") {
|
|
p = "/" + p
|
|
r.URL.Path = p
|
|
}
|
|
p = path.Clean(p)
|
|
|
|
f, err := fh.root.Open(p)
|
|
if err != nil {
|
|
httpError(w, err)
|
|
return
|
|
}
|
|
defer f.Close()
|
|
fi, err := f.Stat()
|
|
if err != nil {
|
|
httpError(w, err)
|
|
return
|
|
}
|
|
|
|
if fi.IsDir() {
|
|
u := r.URL.Path
|
|
if u[len(u)-1] != '/' {
|
|
http.Redirect(w, r, u+"/", http.StatusPermanentRedirect)
|
|
return
|
|
}
|
|
|
|
index := path.Join(p, "index.html")
|
|
ff, err := fh.root.Open(index)
|
|
if err != nil {
|
|
// return 403 if index.html doesn't exist
|
|
if os.IsNotExist(err) {
|
|
err = os.ErrPermission
|
|
}
|
|
httpError(w, err)
|
|
return
|
|
}
|
|
defer ff.Close()
|
|
dd, err := ff.Stat()
|
|
if err != nil {
|
|
httpError(w, err)
|
|
return
|
|
}
|
|
if dd.IsDir() {
|
|
httpError(w, ErrIsDirectory)
|
|
return
|
|
}
|
|
f, fi = ff, dd
|
|
p = index
|
|
}
|
|
|
|
makeCachable(w, p, fi, true)
|
|
http.ServeContent(w, r, fi.Name(), fi.ModTime(), f)
|
|
}
|
|
|
|
// serveFile is similar to http.ServeFile, except that it doesn't check
|
|
// for .. and adds cachability headers.
|
|
func serveFile(w http.ResponseWriter, r *http.Request, p string) {
|
|
f, err := os.Open(p)
|
|
if err != nil {
|
|
httpError(w, err)
|
|
return
|
|
}
|
|
defer f.Close()
|
|
fi, err := f.Stat()
|
|
if err != nil {
|
|
httpError(w, err)
|
|
return
|
|
}
|
|
|
|
if fi.IsDir() {
|
|
httpError(w, ErrIsDirectory)
|
|
return
|
|
}
|
|
|
|
makeCachable(w, p, fi, true)
|
|
http.ServeContent(w, r, fi.Name(), fi.ModTime(), f)
|
|
}
|
|
|
|
func parseGroupName(prefix string, p string) string {
|
|
if !strings.HasPrefix(p, prefix) {
|
|
return ""
|
|
}
|
|
|
|
name := p[len(prefix):]
|
|
if name == "" {
|
|
return ""
|
|
}
|
|
|
|
if name[0] == '.' {
|
|
return ""
|
|
}
|
|
|
|
if filepath.Separator != '/' &&
|
|
strings.ContainsRune(name, filepath.Separator) {
|
|
return ""
|
|
}
|
|
|
|
name = path.Clean("/" + name)
|
|
return name[1:]
|
|
}
|
|
|
|
func groupHandler(w http.ResponseWriter, r *http.Request) {
|
|
if redirect(w, r) {
|
|
return
|
|
}
|
|
|
|
if strings.HasSuffix(r.URL.Path, "/.status.json") {
|
|
groupStatusHandler(w, r)
|
|
return
|
|
}
|
|
|
|
name := parseGroupName("/group/", r.URL.Path)
|
|
if name == "" {
|
|
notFound(w)
|
|
return
|
|
}
|
|
|
|
g, err := group.Add(name, nil)
|
|
if err != nil {
|
|
if os.IsNotExist(err) {
|
|
notFound(w)
|
|
} else {
|
|
log.Printf("group.Add: %v", err)
|
|
http.Error(w, "Internal server error",
|
|
http.StatusInternalServerError)
|
|
}
|
|
return
|
|
}
|
|
|
|
if r.URL.Path != "/group/"+name+"/" {
|
|
http.Redirect(w, r, "/group/"+name+"/",
|
|
http.StatusPermanentRedirect)
|
|
return
|
|
}
|
|
|
|
if redirect := g.Description().Redirect; redirect != "" {
|
|
http.Redirect(w, r, redirect, http.StatusPermanentRedirect)
|
|
return
|
|
}
|
|
|
|
status := g.Status(false, "")
|
|
cspHeader(w, status.AuthServer)
|
|
serveFile(w, r, filepath.Join(StaticRoot, "galene.html"))
|
|
}
|
|
|
|
func groupBase(r *http.Request) (string, error) {
|
|
conf, err := group.GetConfiguration()
|
|
if err != nil {
|
|
return "", nil
|
|
}
|
|
if conf.ProxyURL != "" {
|
|
u, err := url.Parse(conf.ProxyURL)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
base := url.URL{
|
|
Scheme: u.Scheme,
|
|
Host: u.Host,
|
|
Path: path.Join(u.Path, "/group/"),
|
|
}
|
|
return base.String(), nil
|
|
}
|
|
scheme := "https"
|
|
if r.TLS == nil {
|
|
scheme = "http"
|
|
}
|
|
base := url.URL{
|
|
Scheme: scheme,
|
|
Host: r.Host,
|
|
Path: "/group/",
|
|
}
|
|
return base.String(), nil
|
|
}
|
|
|
|
func groupStatusHandler(w http.ResponseWriter, r *http.Request) {
|
|
pth := path.Dir(r.URL.Path)
|
|
name := parseGroupName("/group/", pth)
|
|
if name == "" {
|
|
notFound(w)
|
|
return
|
|
}
|
|
|
|
g, err := group.Add(name, nil)
|
|
if err != nil {
|
|
if os.IsNotExist(err) {
|
|
notFound(w)
|
|
} else {
|
|
http.Error(w, "Internal server error",
|
|
http.StatusInternalServerError)
|
|
}
|
|
return
|
|
}
|
|
|
|
base, err := groupBase(r)
|
|
if err != nil {
|
|
http.Error(w, "Internal server error",
|
|
http.StatusInternalServerError)
|
|
return
|
|
}
|
|
d := g.Status(false, base)
|
|
w.Header().Set("content-type", "application/json")
|
|
w.Header().Set("cache-control", "no-cache")
|
|
|
|
if r.Method == "HEAD" {
|
|
return
|
|
}
|
|
|
|
e := json.NewEncoder(w)
|
|
e.Encode(d)
|
|
}
|
|
|
|
func publicHandler(w http.ResponseWriter, r *http.Request) {
|
|
base, err := groupBase(r)
|
|
if err != nil {
|
|
log.Printf("couldn't determine group base: %v", err)
|
|
http.Error(w, "Internal server error",
|
|
http.StatusInternalServerError)
|
|
return
|
|
}
|
|
w.Header().Set("content-type", "application/json")
|
|
w.Header().Set("cache-control", "no-cache")
|
|
|
|
if r.Method == "HEAD" {
|
|
return
|
|
}
|
|
|
|
g := group.GetPublic(base)
|
|
e := json.NewEncoder(w)
|
|
e.Encode(g)
|
|
}
|
|
|
|
func adminMatch(username, password string) (bool, error) {
|
|
conf, err := group.GetConfiguration()
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
for _, cred := range conf.Admin {
|
|
if cred.Username == "" || cred.Username == username {
|
|
if ok, _ := cred.Password.Match(password); ok {
|
|
return true, nil
|
|
}
|
|
}
|
|
}
|
|
return false, nil
|
|
}
|
|
|
|
func failAuthentication(w http.ResponseWriter, realm string) {
|
|
w.Header().Set("www-authenticate",
|
|
fmt.Sprintf("basic realm=\"%v\"", realm))
|
|
http.Error(w, "Haha!", http.StatusUnauthorized)
|
|
}
|
|
|
|
func statsHandler(w http.ResponseWriter, r *http.Request, dataDir string) {
|
|
username, password, ok := r.BasicAuth()
|
|
if !ok {
|
|
failAuthentication(w, "stats")
|
|
return
|
|
}
|
|
|
|
if ok, err := adminMatch(username, password); !ok {
|
|
if err != nil {
|
|
log.Printf("Administrator password: %v", err)
|
|
}
|
|
failAuthentication(w, "stats")
|
|
return
|
|
}
|
|
|
|
w.Header().Set("content-type", "application/json")
|
|
w.Header().Set("cache-control", "no-cache")
|
|
if r.Method == "HEAD" {
|
|
return
|
|
}
|
|
|
|
ss := stats.GetGroups()
|
|
e := json.NewEncoder(w)
|
|
err := e.Encode(ss)
|
|
if err != nil {
|
|
log.Printf("stats.json: %v", err)
|
|
}
|
|
}
|
|
|
|
var wsUpgrader = websocket.Upgrader{
|
|
HandshakeTimeout: 30 * time.Second,
|
|
}
|
|
|
|
func wsHandler(w http.ResponseWriter, r *http.Request) {
|
|
conn, err := wsUpgrader.Upgrade(w, r, nil)
|
|
if err != nil {
|
|
log.Printf("Websocket upgrade: %v", err)
|
|
return
|
|
}
|
|
go func() {
|
|
err := rtpconn.StartClient(conn)
|
|
if err != nil {
|
|
log.Printf("client: %v", err)
|
|
}
|
|
}()
|
|
}
|
|
|
|
func recordingsHandler(w http.ResponseWriter, r *http.Request) {
|
|
if redirect(w, r) {
|
|
return
|
|
}
|
|
|
|
if len(r.URL.Path) < 12 || r.URL.Path[:12] != "/recordings/" {
|
|
http.Error(w, "server error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
p := "/" + r.URL.Path[12:]
|
|
|
|
if filepath.Separator != '/' &&
|
|
strings.ContainsRune(p, filepath.Separator) {
|
|
http.Error(w, "bad character in filename",
|
|
http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
p = path.Clean(p)
|
|
|
|
if p == "/" {
|
|
http.Error(w, "nothing to see", http.StatusForbidden)
|
|
return
|
|
}
|
|
|
|
f, err := os.Open(filepath.Join(diskwriter.Directory, p))
|
|
if err != nil {
|
|
httpError(w, err)
|
|
return
|
|
}
|
|
defer f.Close()
|
|
|
|
fi, err := f.Stat()
|
|
if err != nil {
|
|
httpError(w, err)
|
|
return
|
|
}
|
|
|
|
var group, filename string
|
|
if fi.IsDir() {
|
|
for len(p) > 0 && p[len(p)-1] == '/' {
|
|
p = p[:len(p)-1]
|
|
}
|
|
group = parseGroupName("/", p)
|
|
if group == "" {
|
|
http.Error(w, "bad group name", http.StatusBadRequest)
|
|
return
|
|
}
|
|
} else {
|
|
if p[len(p)-1] == '/' {
|
|
http.Error(w, "bad group name", http.StatusBadRequest)
|
|
return
|
|
}
|
|
group, filename = path.Split(p)
|
|
group = parseGroupName("/", group)
|
|
if group == "" {
|
|
http.Error(w, "bad group name", http.StatusBadRequest)
|
|
return
|
|
}
|
|
}
|
|
|
|
u := "/recordings/" + group + "/" + filename
|
|
if r.URL.Path != u {
|
|
http.Redirect(w, r, u, http.StatusPermanentRedirect)
|
|
return
|
|
}
|
|
|
|
ok := checkGroupPermissions(w, r, group)
|
|
if !ok {
|
|
failAuthentication(w, "recordings/"+group)
|
|
return
|
|
}
|
|
|
|
if filename == "" {
|
|
if r.Method == "POST" {
|
|
handleGroupAction(w, r, group)
|
|
} else {
|
|
serveGroupRecordings(w, r, f, group)
|
|
}
|
|
return
|
|
}
|
|
|
|
// Ensure the file is uncachable if it's still recording
|
|
cachable := time.Since(fi.ModTime()) > time.Minute
|
|
makeCachable(w, path.Join("/recordings/", p), fi, cachable)
|
|
http.ServeContent(w, r, fi.Name(), fi.ModTime(), f)
|
|
}
|
|
|
|
func handleGroupAction(w http.ResponseWriter, r *http.Request, group string) {
|
|
if r.Method != "POST" {
|
|
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
|
return
|
|
}
|
|
|
|
err := r.ParseForm()
|
|
if err != nil {
|
|
http.Error(w, "couldn't parse request", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
q := r.Form.Get("q")
|
|
|
|
switch q {
|
|
case "delete":
|
|
filename := r.Form.Get("filename")
|
|
if group == "" || filename == "" {
|
|
http.Error(w, "no filename provided",
|
|
http.StatusBadRequest)
|
|
return
|
|
}
|
|
if strings.ContainsRune(filename, '/') ||
|
|
strings.ContainsRune(filename, filepath.Separator) {
|
|
http.Error(w, "bad character in filename",
|
|
http.StatusBadRequest)
|
|
return
|
|
}
|
|
err := os.Remove(
|
|
filepath.Join(diskwriter.Directory,
|
|
filepath.Join(group,
|
|
path.Clean("/"+filename),
|
|
),
|
|
),
|
|
)
|
|
if err != nil {
|
|
httpError(w, err)
|
|
return
|
|
}
|
|
http.Redirect(w, r, "/recordings/"+group+"/",
|
|
http.StatusSeeOther)
|
|
return
|
|
default:
|
|
http.Error(w, "unknown query", http.StatusBadRequest)
|
|
}
|
|
}
|
|
|
|
func checkGroupPermissions(w http.ResponseWriter, r *http.Request, groupname string) bool {
|
|
user, pass, ok := r.BasicAuth()
|
|
if !ok {
|
|
return false
|
|
}
|
|
|
|
g := group.Get(groupname)
|
|
if g == nil {
|
|
return false
|
|
}
|
|
|
|
_, p, err := g.GetPermission(
|
|
group.ClientCredentials{
|
|
Username: user,
|
|
Password: pass,
|
|
},
|
|
)
|
|
record := false
|
|
if err == nil {
|
|
for _, v := range p {
|
|
if v == "record" {
|
|
record = true
|
|
break
|
|
}
|
|
}
|
|
}
|
|
if err != nil || !record {
|
|
if err == group.ErrNotAuthorised {
|
|
time.Sleep(200 * time.Millisecond)
|
|
}
|
|
return false
|
|
}
|
|
|
|
return true
|
|
}
|
|
|
|
func serveGroupRecordings(w http.ResponseWriter, r *http.Request, f *os.File, group string) {
|
|
// read early, so we return permission errors to HEAD
|
|
fis, err := f.Readdir(-1)
|
|
if err != nil {
|
|
http.Error(w, "server error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
sort.Slice(fis, func(i, j int) bool {
|
|
return fis[i].Name() < fis[j].Name()
|
|
})
|
|
|
|
w.Header().Set("content-type", "text/html; charset=utf-8")
|
|
w.Header().Set("cache-control", "no-cache")
|
|
|
|
if r.Method == "HEAD" {
|
|
return
|
|
}
|
|
|
|
fmt.Fprintf(w, "<!DOCTYPE html>\n<html><head>\n")
|
|
fmt.Fprintf(w, "<title>Recordings for group %v</title>\n", group)
|
|
fmt.Fprintf(w, "<link rel=\"stylesheet\" type=\"text/css\" href=\"/common.css\"/>")
|
|
fmt.Fprintf(w, "</head><body>\n")
|
|
|
|
fmt.Fprintf(w, "<table>\n")
|
|
for _, fi := range fis {
|
|
if fi.IsDir() {
|
|
continue
|
|
}
|
|
fmt.Fprintf(w, "<tr><td><a href=\"./%v\">%v</a></td><td>%d</td>",
|
|
html.EscapeString(fi.Name()),
|
|
html.EscapeString(fi.Name()),
|
|
fi.Size(),
|
|
)
|
|
fmt.Fprintf(w,
|
|
"<td><form action=\"/recordings/%v/\" method=\"post\">"+
|
|
"<input type=\"hidden\" name=\"filename\" value=\"%v\">"+
|
|
"<button type=\"submit\" name=\"q\" value=\"delete\">Delete</button>"+
|
|
"</form></td></tr>\n",
|
|
url.PathEscape(group), fi.Name())
|
|
}
|
|
fmt.Fprintf(w, "</table>\n")
|
|
fmt.Fprintf(w, "</body></html>\n")
|
|
}
|
|
|
|
func Shutdown() {
|
|
v := server.Load()
|
|
if v == nil {
|
|
return
|
|
}
|
|
s := v.(*http.Server)
|
|
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
|
|
defer cancel()
|
|
s.Shutdown(ctx)
|
|
}
|