2020-10-24 19:15:32 +00:00
|
|
|
package gemini
|
2020-09-22 02:09:50 +00:00
|
|
|
|
|
|
|
import (
|
2020-09-24 04:30:21 +00:00
|
|
|
"bufio"
|
2020-09-22 02:09:50 +00:00
|
|
|
"crypto/tls"
|
2020-09-25 23:53:50 +00:00
|
|
|
"crypto/x509"
|
2020-10-27 23:21:33 +00:00
|
|
|
"net"
|
2020-10-28 02:12:10 +00:00
|
|
|
"net/url"
|
2020-10-28 20:02:04 +00:00
|
|
|
"path"
|
2020-10-28 17:40:25 +00:00
|
|
|
"strings"
|
2020-11-01 00:55:56 +00:00
|
|
|
"time"
|
2020-09-22 02:09:50 +00:00
|
|
|
)
|
|
|
|
|
2020-10-28 17:40:25 +00:00
|
|
|
// Client is a Gemini client.
|
2020-09-26 03:06:54 +00:00
|
|
|
type Client struct {
|
2020-10-28 17:40:25 +00:00
|
|
|
// KnownHosts is a list of known hosts.
|
2020-09-27 18:18:30 +00:00
|
|
|
KnownHosts KnownHosts
|
2020-09-26 03:06:54 +00:00
|
|
|
|
2020-10-28 17:40:25 +00:00
|
|
|
// Certificates stores client-side certificates.
|
|
|
|
Certificates CertificateStore
|
2020-09-26 19:14:34 +00:00
|
|
|
|
2020-11-01 00:55:56 +00:00
|
|
|
// Timeout specifies a time limit for requests made by this
|
|
|
|
// Client. The timeout includes connection time and reading
|
|
|
|
// the response body. The timer remains running after
|
|
|
|
// Get and Do return and will interrupt reading of the Response.Body.
|
|
|
|
//
|
|
|
|
// A Timeout of zero means no timeout.
|
|
|
|
Timeout time.Duration
|
|
|
|
|
2020-11-01 03:41:30 +00:00
|
|
|
// InsecureSkipTrust specifies whether the client should trust
|
2020-11-01 02:50:42 +00:00
|
|
|
// any certificate it receives without checking KnownHosts
|
2020-11-01 02:45:21 +00:00
|
|
|
// or calling TrustCertificate.
|
|
|
|
// Use with caution.
|
2020-11-01 03:41:30 +00:00
|
|
|
InsecureSkipTrust bool
|
2020-11-01 02:45:21 +00:00
|
|
|
|
2020-10-28 17:40:25 +00:00
|
|
|
// GetInput is called to retrieve input when the server requests it.
|
|
|
|
// If GetInput is nil or returns false, no input will be sent and
|
|
|
|
// the response will be returned.
|
|
|
|
GetInput func(prompt string, sensitive bool) (input string, ok bool)
|
|
|
|
|
|
|
|
// CheckRedirect determines whether to follow a redirect.
|
2020-10-28 02:12:10 +00:00
|
|
|
// If CheckRedirect is nil, a default policy of no more than 5 consecutive
|
|
|
|
// redirects will be enforced.
|
|
|
|
CheckRedirect func(req *Request, via []*Request) error
|
|
|
|
|
2020-10-28 17:40:25 +00:00
|
|
|
// CreateCertificate is called to generate a certificate upon
|
|
|
|
// the request of a server.
|
|
|
|
// If CreateCertificate is nil or the returned error is not nil,
|
|
|
|
// the request will not be sent again and the response will be returned.
|
|
|
|
CreateCertificate func(hostname, path string) (tls.Certificate, error)
|
|
|
|
|
2020-11-01 02:34:51 +00:00
|
|
|
// TrustCertificate is called to determine whether the client
|
|
|
|
// should trust a certificate it has not seen before.
|
2020-11-01 03:05:31 +00:00
|
|
|
// If TrustCertificate is nil, the certificate will not be trusted
|
|
|
|
// and the connection will be aborted.
|
|
|
|
//
|
|
|
|
// If TrustCertificate returns TrustOnce, the certificate will be added
|
|
|
|
// to the client's list of known hosts.
|
|
|
|
// If TrustCertificate returns TrustAlways, the certificate will also be
|
|
|
|
// written to the known hosts file.
|
2020-11-01 02:34:51 +00:00
|
|
|
TrustCertificate func(hostname string, cert *x509.Certificate) Trust
|
2020-09-25 23:53:50 +00:00
|
|
|
}
|
|
|
|
|
2020-10-27 23:21:33 +00:00
|
|
|
// Get performs a Gemini request for the given url.
|
|
|
|
func (c *Client) Get(url string) (*Response, error) {
|
|
|
|
req, err := NewRequest(url)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return c.Do(req)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Do performs a Gemini request and returns a Gemini response.
|
|
|
|
func (c *Client) Do(req *Request) (*Response, error) {
|
2020-10-28 02:12:10 +00:00
|
|
|
return c.do(req, nil)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Client) do(req *Request, via []*Request) (*Response, error) {
|
2020-09-25 23:53:50 +00:00
|
|
|
// Connect to the host
|
|
|
|
config := &tls.Config{
|
|
|
|
InsecureSkipVerify: true,
|
2020-09-26 04:31:16 +00:00
|
|
|
MinVersion: tls.VersionTLS12,
|
2020-10-28 17:40:25 +00:00
|
|
|
GetClientCertificate: func(_ *tls.CertificateRequestInfo) (*tls.Certificate, error) {
|
|
|
|
return c.getClientCertificate(req)
|
2020-09-26 19:14:34 +00:00
|
|
|
},
|
2020-10-13 20:44:46 +00:00
|
|
|
VerifyConnection: func(cs tls.ConnectionState) error {
|
2020-10-28 17:40:25 +00:00
|
|
|
return c.verifyConnection(req, cs)
|
2020-09-25 23:53:50 +00:00
|
|
|
},
|
|
|
|
}
|
|
|
|
conn, err := tls.Dial("tcp", req.Host, config)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2020-11-01 00:55:56 +00:00
|
|
|
// Set connection deadline
|
2020-11-01 01:07:02 +00:00
|
|
|
if d := c.Timeout; d != 0 {
|
|
|
|
conn.SetDeadline(time.Now().Add(d))
|
2020-11-01 00:55:56 +00:00
|
|
|
}
|
2020-09-25 23:53:50 +00:00
|
|
|
|
|
|
|
// Write the request
|
|
|
|
w := bufio.NewWriter(conn)
|
|
|
|
req.write(w)
|
|
|
|
if err := w.Flush(); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Read the response
|
|
|
|
resp := &Response{}
|
2020-10-27 23:16:55 +00:00
|
|
|
if err := resp.read(conn); err != nil {
|
2020-09-25 23:53:50 +00:00
|
|
|
return nil, err
|
|
|
|
}
|
2020-10-28 17:40:25 +00:00
|
|
|
// Store connection state
|
2020-09-27 23:56:33 +00:00
|
|
|
resp.TLS = conn.ConnectionState()
|
2020-09-28 03:58:45 +00:00
|
|
|
|
2020-10-28 17:40:25 +00:00
|
|
|
switch {
|
|
|
|
case resp.Status == StatusCertificateRequired:
|
2020-09-28 03:58:45 +00:00
|
|
|
// Check to see if a certificate was already provided to prevent an infinite loop
|
|
|
|
if req.Certificate != nil {
|
|
|
|
return resp, nil
|
|
|
|
}
|
2020-10-28 17:40:25 +00:00
|
|
|
|
|
|
|
hostname, path := req.URL.Hostname(), strings.TrimSuffix(req.URL.Path, "/")
|
|
|
|
if c.CreateCertificate != nil {
|
|
|
|
cert, err := c.CreateCertificate(hostname, path)
|
|
|
|
if err != nil {
|
|
|
|
return resp, err
|
2020-09-28 03:58:45 +00:00
|
|
|
}
|
2020-10-28 17:40:25 +00:00
|
|
|
c.Certificates.Add(hostname+path, cert)
|
2020-11-02 18:47:07 +00:00
|
|
|
req.Certificate = &cert
|
2020-10-28 17:40:25 +00:00
|
|
|
return c.do(req, via)
|
2020-09-28 03:58:45 +00:00
|
|
|
}
|
2020-10-28 05:06:08 +00:00
|
|
|
return resp, ErrCertificateRequired
|
2020-10-28 17:40:25 +00:00
|
|
|
|
|
|
|
case resp.Status.Class() == StatusClassInput:
|
|
|
|
if c.GetInput != nil {
|
|
|
|
input, ok := c.GetInput(resp.Meta, resp.Status == StatusSensitiveInput)
|
|
|
|
if ok {
|
|
|
|
req.URL.ForceQuery = true
|
|
|
|
req.URL.RawQuery = url.QueryEscape(input)
|
|
|
|
return c.do(req, via)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return resp, ErrInputRequired
|
|
|
|
|
|
|
|
case resp.Status.Class() == StatusClassRedirect:
|
2020-10-28 02:12:10 +00:00
|
|
|
if via == nil {
|
|
|
|
via = []*Request{}
|
|
|
|
}
|
|
|
|
via = append(via, req)
|
|
|
|
|
|
|
|
target, err := url.Parse(resp.Meta)
|
|
|
|
if err != nil {
|
|
|
|
return resp, err
|
|
|
|
}
|
|
|
|
target = req.URL.ResolveReference(target)
|
|
|
|
redirect, err := NewRequestFromURL(target)
|
|
|
|
if err != nil {
|
|
|
|
return resp, err
|
|
|
|
}
|
|
|
|
|
|
|
|
if c.CheckRedirect != nil {
|
|
|
|
if err := c.CheckRedirect(redirect, via); err != nil {
|
|
|
|
return resp, err
|
|
|
|
}
|
|
|
|
} else if len(via) > 5 {
|
|
|
|
// Default policy of no more than 5 redirects
|
|
|
|
return resp, ErrTooManyRedirects
|
|
|
|
}
|
|
|
|
return c.do(redirect, via)
|
2020-09-28 03:58:45 +00:00
|
|
|
}
|
2020-10-28 03:35:22 +00:00
|
|
|
|
2020-10-28 04:21:27 +00:00
|
|
|
resp.Request = req
|
2020-09-25 23:53:50 +00:00
|
|
|
return resp, nil
|
2020-09-24 04:30:21 +00:00
|
|
|
}
|
2020-10-27 23:21:33 +00:00
|
|
|
|
2020-10-28 17:40:25 +00:00
|
|
|
func (c *Client) getClientCertificate(req *Request) (*tls.Certificate, error) {
|
|
|
|
// Request certificates have the highest precedence
|
|
|
|
if req.Certificate != nil {
|
|
|
|
return req.Certificate, nil
|
|
|
|
}
|
2020-10-28 20:02:04 +00:00
|
|
|
|
|
|
|
// Search recursively for the certificate
|
|
|
|
scope := req.URL.Hostname() + strings.TrimSuffix(req.URL.Path, "/")
|
|
|
|
for {
|
|
|
|
cert, err := c.Certificates.Lookup(scope)
|
|
|
|
if err == nil {
|
2020-11-01 20:14:56 +00:00
|
|
|
// Store the certificate
|
|
|
|
req.Certificate = cert
|
2020-10-28 20:02:04 +00:00
|
|
|
return cert, err
|
|
|
|
}
|
|
|
|
if err == ErrCertificateExpired {
|
|
|
|
break
|
|
|
|
}
|
|
|
|
scope = path.Dir(scope)
|
|
|
|
if scope == "." {
|
|
|
|
break
|
|
|
|
}
|
2020-10-28 17:40:25 +00:00
|
|
|
}
|
2020-10-28 20:02:04 +00:00
|
|
|
|
2020-10-28 17:40:25 +00:00
|
|
|
return &tls.Certificate{}, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Client) verifyConnection(req *Request, cs tls.ConnectionState) error {
|
|
|
|
// Verify the hostname
|
|
|
|
var hostname string
|
|
|
|
if host, _, err := net.SplitHostPort(req.Host); err == nil {
|
|
|
|
hostname = host
|
|
|
|
} else {
|
|
|
|
hostname = req.Host
|
|
|
|
}
|
|
|
|
cert := cs.PeerCertificates[0]
|
|
|
|
if err := verifyHostname(cert, hostname); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2020-11-01 03:41:30 +00:00
|
|
|
if c.InsecureSkipTrust {
|
2020-11-01 02:45:21 +00:00
|
|
|
return nil
|
|
|
|
}
|
2020-11-01 02:34:51 +00:00
|
|
|
// Check the known hosts
|
|
|
|
err := c.KnownHosts.Lookup(hostname, cert)
|
|
|
|
switch err {
|
|
|
|
case ErrCertificateExpired, ErrCertificateNotFound:
|
2020-11-01 02:45:21 +00:00
|
|
|
// See if the client trusts the certificate
|
|
|
|
if c.TrustCertificate != nil {
|
|
|
|
switch c.TrustCertificate(hostname, cert) {
|
|
|
|
case TrustOnce:
|
|
|
|
c.KnownHosts.AddTemporary(hostname, cert)
|
|
|
|
return nil
|
|
|
|
case TrustAlways:
|
|
|
|
c.KnownHosts.Add(hostname, cert)
|
|
|
|
return nil
|
|
|
|
}
|
2020-11-01 02:34:51 +00:00
|
|
|
}
|
2020-11-01 02:45:21 +00:00
|
|
|
return ErrCertificateNotTrusted
|
2020-10-27 23:21:33 +00:00
|
|
|
}
|
2020-10-28 17:40:25 +00:00
|
|
|
return err
|
2020-10-27 23:21:33 +00:00
|
|
|
}
|