352 lines
12 KiB
Python
352 lines
12 KiB
Python
import abc
|
|
import http
|
|
import http.server
|
|
import io
|
|
import logging
|
|
import os
|
|
import pathlib
|
|
import re
|
|
import tarfile
|
|
import typing
|
|
|
|
from . import STAPLER_ASCII, logs, project
|
|
from .data_dir import DataDir
|
|
|
|
if typing.TYPE_CHECKING:
|
|
from .cert_manager import CertManager
|
|
from .params import Parameters
|
|
from .registry import Registry
|
|
from .token_manager import TokenManager
|
|
|
|
|
|
class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
|
|
@typing.override
|
|
def __init__(
|
|
self,
|
|
*args: typing.Any,
|
|
params: Parameters,
|
|
**kwargs: dict[str, typing.Any],
|
|
) -> None:
|
|
self.logger: logging.Logger = logging.getLogger(self.__class__.__name__)
|
|
self.default_host: str = params.host.split(":", maxsplit=2)[0]
|
|
self.out_size: int = 0
|
|
self._host: str | None = None
|
|
self._in_size: int | None = None
|
|
super().__init__(*args, **kwargs)
|
|
|
|
@typing.override
|
|
def send_error(
|
|
self,
|
|
code: int,
|
|
message: str | None = None,
|
|
explain: str | None = None,
|
|
) -> None:
|
|
shortmsg, longmsg = self.responses[code]
|
|
if message is None:
|
|
message = shortmsg # pragma: no cover
|
|
if explain is None:
|
|
explain = longmsg
|
|
if "text/" in self._get_header("Accept"):
|
|
self.send_basic_body(
|
|
f"{code} {message}\n{explain}\n\n{self.server_signature()}",
|
|
code=code,
|
|
message=message,
|
|
)
|
|
else:
|
|
self.send_status_only(code, message)
|
|
|
|
@typing.override
|
|
def log_message(self, format: str, *args: typing.Any) -> None: # pragma: no cover
|
|
fmt = "%s - " + format
|
|
self.logger.info(fmt, self.address_string(), *args)
|
|
|
|
@typing.override
|
|
def log_error(self, format: str, *args: typing.Any) -> None: # pragma: no cover
|
|
fmt = "%s - " + format
|
|
self.logger.error(fmt, self.address_string(), *args)
|
|
|
|
@typing.override
|
|
def log_request(self, code: str = "?", size: str = "-") -> None: # ty:ignore[invalid-method-override] # pragma: no cover
|
|
if isinstance(code, http.HTTPStatus):
|
|
color = logs.TermColor.RED
|
|
if 100 <= code < 200:
|
|
color = logs.TermColor.CYAN
|
|
if 200 <= code < 300:
|
|
color = logs.TermColor.GREEN
|
|
elif 300 <= code < 400:
|
|
color = logs.TermColor.BLUE
|
|
elif 400 <= code < 500:
|
|
color = logs.TermColor.YELLOW
|
|
code = color + str(code.value) + logs.TermColor.RESET
|
|
if size == "" and self.out_size > 0:
|
|
size = str(self.out_size)
|
|
args = (code, self.address_string(), self.host, self.requestline)
|
|
fmt = "→ %s - %s - %s - %s"
|
|
if size != "":
|
|
args = (*args, size)
|
|
fmt += " - %s"
|
|
self.logger.info(fmt, *args)
|
|
|
|
def send_basic_body(
|
|
self,
|
|
body: str,
|
|
content_type: str = "text/plain",
|
|
code: int = http.HTTPStatus.OK,
|
|
message: str | None = None,
|
|
headers: dict[str, str] | None = None,
|
|
) -> None:
|
|
if headers is None:
|
|
headers = {}
|
|
encoded: bytes = body.encode()
|
|
self.out_size = len(encoded)
|
|
self.send_response(code, message)
|
|
self.send_header("Content-type", f"{content_type}; charset=UTF-8")
|
|
self.send_header("Content-Length", str(len(encoded)))
|
|
for header, value in headers.items():
|
|
self.send_header(header, value) # pragma: no cover
|
|
self.end_headers()
|
|
self.wfile.write(encoded)
|
|
self.close_connection = True
|
|
|
|
def send_status_only(
|
|
self,
|
|
code: int,
|
|
message: str | None = None,
|
|
headers: dict[str, str] | None = None,
|
|
) -> None:
|
|
if headers is None:
|
|
headers = {}
|
|
self.send_response(code, message)
|
|
self.send_header("Content-Length", "0")
|
|
for header, value in headers.items():
|
|
self.send_header(header, value)
|
|
self.end_headers()
|
|
self.close_connection = True
|
|
|
|
@property
|
|
def host(self) -> str:
|
|
if self._host is None:
|
|
self._host = self._get_host()
|
|
return self._host
|
|
|
|
def _get_host(self) -> str:
|
|
host = self._get_header("Host", self.default_host)
|
|
return host.split(":", maxsplit=2)[0]
|
|
|
|
@property
|
|
def in_size(self) -> int:
|
|
if self._in_size is None:
|
|
self._in_size = self._get_length()
|
|
return self._in_size
|
|
|
|
def _get_length(self) -> int:
|
|
return int(self._get_header("Content-Length", "0"))
|
|
|
|
def _get_header(self, key: str, default_value: str = "") -> str:
|
|
if self._has_header(key):
|
|
return self.headers[key]
|
|
return default_value
|
|
|
|
def _has_header(self, key: str) -> bool:
|
|
return (
|
|
hasattr(self, "headers")
|
|
and key in self.headers
|
|
and len(self.headers[key]) > 0
|
|
)
|
|
|
|
def _pre_log_request(self) -> None: # pragma: no cover
|
|
args = ("...", self.address_string(), self.host, self.requestline)
|
|
fmt = "← %s - %s - %s - %s"
|
|
if self.in_size > 0:
|
|
args = (*args, self.in_size)
|
|
fmt += " - %s"
|
|
self.logger.debug(fmt, *args)
|
|
|
|
def server_signature(self) -> str:
|
|
return self.server_version + "\n\n" + STAPLER_ASCII + "\n"
|
|
|
|
|
|
class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
|
|
protocol_version = "HTTP/2.0"
|
|
server_version = "StaplerServer/" + project.get_version()
|
|
CERTBOT_CHALLENGE_PATH = "/.well-known/acme-challenge"
|
|
UPDATE_PATH_REGEX = re.compile(r"^\/([\w-]+)\/?$")
|
|
GET_PATH_REGEX = re.compile(r"^\/([\w-]+)\/")
|
|
HOST_PART_REGEX = re.compile(r"^([a-z0-9]|[a-z0-9][a-z0-9-]{,61}[a-z0-9])$")
|
|
AUTHORIZED_PATHS: typing.ClassVar[list[str]] = ["/favicon.ico"]
|
|
TOKEN_HEADER = "X-Token" # noqa: S105
|
|
HOST_HEADER = "X-Host"
|
|
|
|
@typing.override
|
|
def __init__(
|
|
self,
|
|
*args: typing.Any,
|
|
params: Parameters,
|
|
registry: Registry,
|
|
cert_manager: CertManager,
|
|
token_manager: TokenManager,
|
|
**kwargs: dict[str, typing.Any],
|
|
) -> None:
|
|
self.logger: logging.Logger = logging.getLogger(self.__class__.__name__)
|
|
self.token_manager: TokenManager = token_manager
|
|
self.data_dir: DataDir = DataDir(params.data_dir)
|
|
self.max_size_bytes: int = params.max_size_bytes
|
|
self.registry: Registry = registry
|
|
self.cert_manager: CertManager = cert_manager
|
|
self.certbot_www: str = os.path.realpath(params.certbot_www)
|
|
self._token: str | None = None
|
|
self._target_host: str | None = None
|
|
super().__init__(*args, directory=params.data_dir, **kwargs, params=params) # ty:ignore[unknown-argument]
|
|
|
|
@property
|
|
def token(self) -> str:
|
|
if self._token is None:
|
|
self._token = self._get_header(self.TOKEN_HEADER)
|
|
return self._token
|
|
|
|
@property
|
|
def target_host(self) -> str:
|
|
if self._target_host is None:
|
|
self._target_host = self._get_header(self.HOST_HEADER).lower()
|
|
return self._target_host
|
|
|
|
@property
|
|
def has_target_host(self) -> bool:
|
|
return len(self.target_host) > 0
|
|
|
|
@typing.override
|
|
def do_HEAD(self) -> None:
|
|
self._pre_log_request()
|
|
super().do_HEAD()
|
|
|
|
@typing.override
|
|
def do_GET(self) -> None:
|
|
self._pre_log_request()
|
|
if self.path == "/" and self.host == self.default_host:
|
|
return self.send_basic_body(self.server_signature())
|
|
super().do_GET()
|
|
return None
|
|
|
|
def do_PUT(self) -> None:
|
|
self._pre_log_request()
|
|
if (sub_path := self.__check_update_request()) is None:
|
|
return None
|
|
if self.has_target_host and not self.__valid_host(self.target_host):
|
|
return self.send_error(
|
|
http.HTTPStatus.BAD_REQUEST, "Invalid requested host"
|
|
)
|
|
if (
|
|
self.has_target_host
|
|
and (page := self.registry.get_from_host(self.target_host)) is not None
|
|
and page.path != sub_path
|
|
):
|
|
return self.send_error(http.HTTPStatus.FORBIDDEN, "Host already taken")
|
|
if self.in_size == 0:
|
|
return self.send_error(http.HTTPStatus.LENGTH_REQUIRED, "No body found")
|
|
if self.in_size > self.max_size_bytes:
|
|
return self.send_error(
|
|
http.HTTPStatus.CONTENT_TOO_LARGE,
|
|
"Archive too large",
|
|
)
|
|
try:
|
|
file_bytes = io.BytesIO(self.rfile.read(self.in_size))
|
|
self.data_dir.extract_tar_bytes(sub_path, file_bytes)
|
|
except tarfile.TarError:
|
|
return self.send_error(http.HTTPStatus.BAD_REQUEST, "Invalid tar archive")
|
|
except Exception as e:
|
|
return self.send_error(http.HTTPStatus.INTERNAL_SERVER_ERROR, str(e))
|
|
self.send_status_only(
|
|
http.HTTPStatus.CREATED,
|
|
f"Resource /{sub_path}/ updated",
|
|
)
|
|
self.registry.add(sub_path)
|
|
self.token_manager.set_token(self.token, sub_path)
|
|
if self.has_target_host and self.cert_manager.create_or_update(
|
|
self.target_host
|
|
):
|
|
self.registry.set_host(sub_path, self.target_host)
|
|
return None
|
|
|
|
def do_DELETE(self) -> None:
|
|
self._pre_log_request()
|
|
if (sub_path := self.__check_update_request()) is None:
|
|
return None
|
|
if not self.data_dir.exists(sub_path):
|
|
self.send_error(http.HTTPStatus.NOT_FOUND, "Not found")
|
|
return None
|
|
try:
|
|
self.data_dir.remove(sub_path)
|
|
except Exception as e:
|
|
return self.send_error(http.HTTPStatus.INTERNAL_SERVER_ERROR, str(e))
|
|
self.send_status_only(
|
|
http.HTTPStatus.NO_CONTENT,
|
|
f"Resource /{sub_path}/ removed",
|
|
)
|
|
self.registry.remove(sub_path)
|
|
return None
|
|
|
|
@typing.override
|
|
def list_directory(self, *_: typing.Any, **__: typing.Any) -> None:
|
|
"""Disable default directory listing."""
|
|
self.send_error(http.HTTPStatus.NOT_FOUND, "File not found")
|
|
|
|
@typing.override
|
|
def translate_path(self, path: str) -> str:
|
|
if path.startswith(self.CERTBOT_CHALLENGE_PATH):
|
|
return self.certbot_www + path
|
|
if (
|
|
self.host != self.default_host
|
|
and (page := self.registry.get_from_host(self.host)) is not None
|
|
):
|
|
path = f"/{page.path}" + path
|
|
elif self.host != self.default_host:
|
|
return ""
|
|
elif (
|
|
path not in self.AUTHORIZED_PATHS
|
|
and self.__get_subpath(path, self.GET_PATH_REGEX) is None
|
|
): # not a valid path
|
|
return ""
|
|
if pathlib.Path(path).name.startswith("."): # hidden files
|
|
return ""
|
|
return super().translate_path(path)
|
|
|
|
def __check_update_request(self) -> str | None:
|
|
if not self._has_header(self.TOKEN_HEADER):
|
|
self.send_error(http.HTTPStatus.BAD_REQUEST, "No X-Token header in request")
|
|
return None
|
|
if not self.token_manager.is_valid(self.token):
|
|
self.send_error(http.HTTPStatus.UNAUTHORIZED, "Invalid token")
|
|
return None
|
|
if (sub_path := self.__get_subpath(self.path, self.UPDATE_PATH_REGEX)) is None:
|
|
self.send_error(http.HTTPStatus.BAD_REQUEST, "Invalid path")
|
|
return None
|
|
if not self.token_manager.is_valid_for_path(self.token, sub_path):
|
|
self.send_error(http.HTTPStatus.FORBIDDEN, "Path forbidden for this token")
|
|
return None
|
|
return sub_path
|
|
|
|
def __get_subpath(self, path: str, regex: re.Pattern) -> str | None:
|
|
if (match := regex.match(path.lower())) is not None:
|
|
return match.group(1)
|
|
return None
|
|
|
|
def __valid_host(self, host: str) -> bool:
|
|
return (
|
|
all(self.HOST_PART_REGEX.fullmatch(part) for part in host.split("."))
|
|
and len(host) < 256
|
|
)
|
|
|
|
|
|
class UpgradeHandler(BaseHandler):
|
|
server_version = "StaplerUpgradeServer/" + project.get_version()
|
|
|
|
def do_HEAD(self) -> None:
|
|
self._pre_log_request()
|
|
self.send_status_only(
|
|
http.HTTPStatus.MOVED_PERMANENTLY,
|
|
headers={"Location": f"https://{self.host}{self.path.lower()}"},
|
|
)
|
|
|
|
def do_GET(self) -> None:
|
|
self.do_HEAD()
|