skeleton [CI SKIP]

.dockerignore

@@ -1,4 +1,5 @@
 .*
+target/rls
 target/*/deps
 target/*/build
 target/*/.fingerprint

.drone.yml

@@ -3,8 +3,9 @@ name: default
 
 steps:
  - name: build
-   image: rust:1.37.0
+   image: rust:1.37.0-buster
    commands:
+    - apt update && apt install git clang make pkg-config nettle-dev libssl-dev capnproto libsqlite3-dev -y
     - cargo test
     - rustup target add x86_64-unknown-linux-musl
     - cargo build --release --target x86_64-unknown-linux-musl

Cargo.toml

@@ -4,15 +4,19 @@ version = "0.1.0"
 authors = ["shim_ <shimun@shimun.net>"]
 edition = "2018"
 
+[profile.release]
+opt-level = 'z'
+panic = 'abort'
+
 [dependencies]
-
 snap = "0.1"
-
 rustc-serialize = "0.3.19"
-
-iron = "0.6.0"
-
 rand = "0.4.2"
-
 byteorder = "1.3.2"
 chrono = "0.4.9"
+sequoia-openpgp = "0.9.0"
+c2-chacha = "0.2.2"
+sha2 = "0.8.0"
+hex = "0.3.2"
+tower-web = "0.3.7"
+tokio = "0.1.22"

Dockerfile

@@ -1,9 +1,9 @@
-FROM scratch
+FROM debian:buster-slim
 
 VOLUME /snips
 
 EXPOSE 3000
 
-COPY target/x86_64-unknown-linux-musl/release/brownpaper /bin/
+COPY target/release/brownpaper /bin/
 
-ENTRYPOINT [ "/bin/brownpaper" ]
+ENTRYPOINT [ "/bin/brownpaper" ]

src/chacha_io.rs

@@ -0,0 +1,44 @@
+use c2_chacha::stream_cipher::{NewStreamCipher, SyncStreamCipher};
+use c2_chacha::ChaCha20;
+use std::io::{Read, Result, Write};
+
+pub struct ChaChaReader<'a>(ChaCha20, &'a mut dyn Read);
+
+impl<'a> ChaChaReader<'a> {
+    pub fn new(key: &[u8], nonce: &[u8], source: &'a mut dyn Read) -> ChaChaReader<'a> {
+        ChaChaReader(ChaCha20::new_var(key, nonce).unwrap(), source)
+    }
+}
+
+impl<'a> Read for ChaChaReader<'a> {
+    fn read(&mut self, buf: &mut [u8]) -> Result<usize> {
+        let red = self.1.read(buf)?;
+        self.0.apply_keystream(buf);
+        Ok(red)
+    }
+}
+
+pub struct ChaChaWriter<'a>(ChaCha20, &'a mut dyn Write);
+
+impl<'a> ChaChaWriter<'a> {
+    pub fn new(key: &[u8], nonce: &[u8], sink: &'a mut dyn Write) -> ChaChaWriter<'a> {
+        ChaChaWriter(ChaCha20::new_var(key, nonce).unwrap(), sink)
+    }
+}
+
+impl<'a> Write for ChaChaWriter<'a> {
+    fn write(&mut self, buf: &[u8]) -> Result<usize> {
+        let mut cipher_text = [0u8; 256];
+        let mut written = 0usize;
+        for chunk in buf.chunks(cipher_text.len()) {
+            cipher_text[0..chunk.len()].copy_from_slice(&chunk);
+            self.0.apply_keystream(&mut cipher_text[0..chunk.len()]);
+            written += self.1.write(&cipher_text[0..chunk.len()])?;
+        }
+        Ok(written)
+    }
+
+    fn flush(&mut self) -> Result<()> {
+        self.1.flush()
+    }
+}

src/main.rs

@@ -1,211 +1,13 @@
-extern crate chrono;
-extern crate iron;
-extern crate rand;
-extern crate snap;
-
-use byteorder::{BigEndian, ReadBytesExt, WriteBytesExt};
-use chrono::*;
-use iron::method::Method;
-use iron::modifiers::Redirect;
-use iron::prelude::*;
-use iron::url::Url;
-use rand::Rng;
-use std::fs;
-use std::fs::File;
-use std::io;
-use std::io::prelude::*;
-use std::iter::Iterator;
-use std::path::{Path, PathBuf};
-
-struct Snippet<'a> {
-    id: String,
-    storage: &'a SnippetStorage<'a>,
-}
-
-#[allow(dead_code)]
-struct SnippetMeta {
-    created: DateTime<Utc>,
-    compression: Option<String>,
-}
-
-struct SnippetStorage<'a> {
-    directory: &'a Path,
-}
-
-impl<'a> Snippet<'a> {
-    pub fn random(storage: &'a SnippetStorage) -> Snippet<'a> {
-        Snippet::new(
-            &rand::thread_rng()
-                .gen_ascii_chars()
-                .take(6)
-                .collect::<String>(),
-            storage,
-        )
-    }
-
-    pub fn new(id: &str, storage: &'a SnippetStorage) -> Snippet<'a> {
-        Snippet {
-            id: id.to_string(),
-            storage,
-        }
-    }
-
-    pub fn path(&self) -> PathBuf {
-        self.storage.directory.join(&self.id)
-    }
-
-    pub fn metadata(&self) -> Result<SnippetMeta, io::Error> {
-        let mut file = File::open(self.path())?;
-        self.metadata_via_handle(&mut file)
-    }
-
-    fn metadata_via_handle(&self, hdl: &mut impl Read) -> Result<SnippetMeta, io::Error> {
-        let timestamp = hdl.read_i64::<BigEndian>()?;
-        let comp_len = hdl.read_u16::<BigEndian>()? as usize;
-        let mut comp = Vec::with_capacity(comp_len);
-        comp.resize(comp_len, 0u8);
-        hdl.read_exact(&mut comp)?;
-        let comp = String::from_utf8(comp).unwrap();
-        Ok(SnippetMeta {
-            created: Utc.timestamp_millis(timestamp),
-            compression: Some(comp).filter(|_| comp_len > 0),
-        })
-    }
-
-    fn contents(&self) -> Result<String, io::Error> {
-        let mut file = File::open(self.path())?;
-        let meta = self.metadata_via_handle(&mut file)?;
-        fn read_string(r: &mut impl Read) -> Result<String, io::Error> {
-            let mut text = String::new();
-            r.read_to_string(&mut text)?;
-            Ok(text)
-        }
-        dbg!((&meta.compression, &meta.created));
-        match meta.compression {
-            Some(ref comp) if comp == "snap" => {
-                let mut r = snap::Reader::new(&mut file);
-                read_string(&mut r)
-            }
-            _ => read_string(&mut file),
-        }
-    }
-
-    fn write(self, content: &str) -> Result<Snippet<'a>, io::Error> {
-        let mut file = File::create(self.path())?;
-        file.write_i64::<BigEndian>(Utc::now().timestamp())?;
-        let comp = if content.len() > 2048 {
-            Some("snap")
-        } else {
-            None
-        };
-        file.write_u16::<BigEndian>(comp.map(|s| s.len() as u16).unwrap_or(0u16))?;
-        file.write(comp.map(|s| s.as_bytes()).unwrap_or(&[0u8; 0]))?;
-        match comp {
-            Some(ref comp) if comp == &"snap" => {
-                let mut w = snap::Writer::new(&mut file);
-                w.write_all(content.as_bytes())?
-            }
-            _ => file.write_all(content.as_bytes())?,
-        };
-        Ok(Snippet::new(&self.id, self.storage))
-    }
-}
-
-impl<'a> SnippetStorage<'a> {
-    pub fn new(directory: &'a Path) -> SnippetStorage<'a> {
-        SnippetStorage {
-            directory: directory,
-        }
-    }
-
-    fn has(&self, id: &str) -> bool {
-        self.directory.join(id).exists()
-    }
-
-    fn open(&self, id: &str) -> Option<Snippet> {
-        if self.has(id) {
-            Some(Snippet::new(id, self))
-        } else {
-            None
-        }
-    }
-}
-
-#[cfg(not(debug_assertions))]
-const STORAGE_DIR: &str = "/snips";
-
-#[cfg(debug_assertions)]
-const STORAGE_DIR: &str = "/tmp";
-
-const VERSION: &str = env!("CARGO_PKG_VERSION");
-
-fn handle(req: &mut Request) -> IronResult<Response> {
-    println!("{}", req.url);
-    let storage = SnippetStorage::new(&Path::new(STORAGE_DIR));
-    let segments: Vec<&str> = req.url.path();
-    match (&req.method, segments.first()) {
-        (Method::Get, Some(&"version")) => Ok(Response::with((iron::status::Ok, VERSION))),
-        (Method::Post, Some(path)) => {
-            if path == &"new" {
-                let snip = {
-                    let text: String = {
-                        let bytes = ((&mut req.body).bytes().take(1024 * 512).collect::<Result<
-                            Vec<u8>,
-                            io::Error,
-                        >>(
-                        ))
-                        .map_err(|err| IronError::new(err, ""))?;
-                        String::from_utf8(bytes)
-                            .map_err(|err| IronError::new(err, "Invalid utf8"))?
-                    };
-                    Snippet::random(&storage).write(&*text).map_err(|err| {
-                        let msg = format!("Failed to save snippet: {:?}", &err);
-                        IronError::new(err, msg)
-                    })
-                };
-                snip.map(|snip| {
-                    let mut snip_url: Url = req.url.clone().into();
-                    snip_url.set_path(&*("/".to_string() + &*snip.id));
-                    Response::with((
-                        iron::status::TemporaryRedirect,
-                        Redirect(iron::Url::from_generic_url(snip_url).unwrap()),
-                    ))
-                    /*Response::with((
-                        iron::status::Ok,
-                        format!(
-                            "<meta http-equiv=\"refresh\" content=\"0; url={}/\" />",
-                            snip_url
-                        ),
-                    ))*/
-                })
-            } else {
-                Ok(Response::with((
-                    iron::status::BadRequest,
-                    "Post to /new or die",
-                )))
-            }
-        }
-        (Method::Get, Some(id)) => {
-            let att = storage.open(&id).map(|snip| snip.contents()).map(|res| {
-                Response::with(
-                    match res.map(|text| (iron::status::Ok, text)).map_err(|err| {
-                        let msg = format!("Failed to load snippet: {:?}", &err);
-                        msg
-                    }) {
-                        Ok(res) => res,
-                        Err(e) => (iron::status::InternalServerError, e),
-                    },
-                )
-            });
-            Ok(att.unwrap_or(Response::with((iron::status::NotFound, "Not here sry"))))
-        }
-        (Method::Get, _) => Ok(Response::with((iron::status::NotFound, "Wrong path pal"))),
-        _ => Ok(Response::with((iron::status::BadRequest, "Give or take"))),
-    }
-}
+#[macro_use]
+extern crate tower_web;
+#[macro_use]
+extern crate lazy_static;
+extern crate sequoia_openpgp as openpgp;
+mod chacha_io;
+mod pgp;
+mod server;
+mod snippet;
 
 fn main() {
-    let chain = Chain::new(handle);
-    println!("Starting brownpaper: {}", STORAGE_DIR);
-    Iron::new(chain).http("0.0.0.0:3000").unwrap();
+    server::run();
 }

src/pgp.rs

@@ -0,0 +1,52 @@
+use crate::snippet::*;
+use openpgp::parse::stream::*;
+use openpgp::parse::Parse;
+use openpgp::*;
+use std::fs;
+use std::io;
+use std::io::prelude::*;
+use std::path::Path;
+
+#[derive(Debug, Clone)]
+pub struct KnownKeys {
+    keys: Vec<openpgp::TPK>,
+}
+impl VerificationHelper for &KnownKeys {
+    fn get_public_keys(&mut self, _ids: &[KeyID]) -> Result<Vec<TPK>> {
+        Ok(self.keys.clone())
+    }
+    fn check(&mut self, structure: &MessageStructure) -> Result<()> {
+        Ok(()) // Implement your verification policy here.
+    }
+}
+
+impl KnownKeys {
+    pub fn load_dir(dir: impl AsRef<Path>) -> io::Result<KnownKeys> {
+        let mut keys: Vec<openpgp::TPK> = Vec::with_capacity(3);
+        for f in fs::read_dir(dir)? {
+            let f = f?;
+            if f.metadata()?.is_dir() {
+                continue;
+            }
+            let tpk = openpgp::TPK::from_file(f.path()).unwrap();
+            println!("Fingerprint: {}", tpk.fingerprint());
+            keys.push(tpk);
+        }
+        Ok(KnownKeys { keys: keys })
+    }
+
+    pub fn verify(&mut self, r: impl Read) -> io::Result<Vec<u8>> {
+        let mut content = Vec::with_capacity(2048);
+        let helper = &*self;
+        let mut v = Verifier::<&KnownKeys>::from_reader(r, helper, None).map_err(|e| {
+            io::Error::new(io::ErrorKind::InvalidData, "Failed to verify signature")
+        })?;
+        if v.read_to_end(&mut content).is_err() {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                "Signature Mismatch",
+            ));
+        }
+        Ok(content)
+    }
+}

src/server.rs

@@ -0,0 +1,53 @@
+use crate::pgp::KnownKeys;
+use crate::snippet::*;
+use std::path::Path;
+use std::sync::Mutex;
+use tokio::prelude::*;
+use tower_web::ServiceBuilder;
+use tower_web::{derive_resource_impl, impl_web};
+
+#[derive(Debug)]
+struct Brownpaper {
+    storage: SnippetStorage,
+    known_keys: Mutex<KnownKeys>,
+}
+
+impl_web! {
+    impl Brownpaper {
+        #[get("/")]
+        async fn root(&self) -> &'static str {
+            "Post /new, Get /<id>"
+        }
+
+        #[post("/new")]
+        async fn new(&self) -> Result<> {}
+
+        #[get("/:id")]
+        async fn snipptet(&self, id: String) -> Result<> {}
+
+        #[get("/file/:file_id")]
+        async fn snipptet_file(&self, file_id: String) -> Result<> {}
+    }
+}
+
+#[cfg(not(debug_assertions))]
+const STORAGE_DIR: &str = "/snips";
+
+#[cfg(debug_assertions)]
+const STORAGE_DIR: &str = "/tmp";
+
+pub fn run() {
+    let addr = "0.0.0.0:3000".parse().expect("Invalid address");
+    println!("Listening on http://{}", addr);
+
+    ServiceBuilder::new()
+        .resource(Brownpaper {
+            storage: SnippetStorage::new(Path::new(STORAGE_DIR)),
+            known_keys: Mutex::new(
+                KnownKeys::load_dir([STORAGE_DIR, "keys"].join("/"))
+                    .expect("Failed to load PGP Keys"),
+            ),
+        })
+        .run(&addr)
+        .unwrap();
+}

src/snippet.rs

@@ -0,0 +1,153 @@
+use crate::chacha_io::{ChaChaReader, ChaChaWriter};
+use byteorder::{BigEndian, ReadBytesExt, WriteBytesExt};
+use chrono::*;
+use rand::Rng;
+use sha2::{Digest, Sha256};
+use std::convert::TryInto;
+use std::fs::File;
+use std::io;
+use std::io::prelude::*;
+use std::iter::Iterator;
+use std::path::{Path, PathBuf};
+
+#[derive(Debug)]
+pub struct Snippet<'a> {
+    pub id: String,
+    pub storage: &'a SnippetStorage,
+}
+
+#[allow(dead_code)]
+#[derive(Debug)]
+pub struct SnippetMeta {
+    created: DateTime<Utc>,
+    compression: Option<String>,
+}
+
+#[derive(Debug)]
+pub struct SnippetStorage {
+    directory: PathBuf,
+}
+
+impl<'a> Snippet<'a> {
+    pub fn random(storage: &'a SnippetStorage) -> Snippet<'a> {
+        Snippet::new(
+            &rand::thread_rng()
+                .gen_ascii_chars()
+                .take(8)
+                .collect::<String>(),
+            storage,
+        )
+    }
+
+    pub fn new(id: &str, storage: &'a SnippetStorage) -> Snippet<'a> {
+        Snippet {
+            id: id.to_string(),
+            storage,
+        }
+    }
+
+    pub fn file_id(&self) -> String {
+        SnippetStorage::file_id(&self.id)
+    }
+
+    pub fn passphrase(&self) -> ([u8; 8], [u8; 32]) {
+        let mut hasher = Sha256::new();
+        hasher.input(self.id.as_bytes());
+        let res = hasher.result();
+        let nonce: [u8; 8] = res[0..8].try_into().unwrap();
+        let mut hasher = Sha256::new();
+        hasher.input(self.id.as_bytes());
+        hasher.input(b"pass");
+        let pass: [u8; 32] = res[0..32].try_into().unwrap();
+        (nonce, pass)
+    }
+
+    pub fn path(&self) -> PathBuf {
+        self.storage.directory.join(&self.file_id())
+    }
+
+    pub fn metadata(&self) -> Result<SnippetMeta, io::Error> {
+        let mut file = File::open(self.path())?;
+        let (nonce, key) = self.passphrase();
+        self.metadata_via_handle(&mut ChaChaReader::new(&key, &nonce, &mut file))
+    }
+
+    fn metadata_via_handle(&self, hdl: &mut impl Read) -> Result<SnippetMeta, io::Error> {
+        let timestamp = hdl.read_i64::<BigEndian>()?;
+        let comp_len = hdl.read_u16::<BigEndian>()? as usize;
+        let mut comp = Vec::with_capacity(comp_len);
+        comp.resize(comp_len, 0u8);
+        hdl.read_exact(&mut comp)?;
+        let comp = String::from_utf8(comp).unwrap();
+        Ok(SnippetMeta {
+            created: Utc.timestamp_millis(timestamp),
+            compression: Some(comp).filter(|_| comp_len > 0),
+        })
+    }
+
+    pub fn contents(&self) -> Result<String, io::Error> {
+        let mut file = File::open(self.path())?;
+        let (nonce, key) = self.passphrase();
+        let mut reader = ChaChaReader::new(&key, &nonce, &mut file);
+        let meta = self.metadata_via_handle(&mut reader)?;
+        fn read_string(r: &mut impl Read) -> Result<String, io::Error> {
+            let mut text = String::new();
+            r.read_to_string(&mut text)?;
+            Ok(text)
+        }
+        dbg!((&meta.compression, &meta.created, self.file_id()));
+        match meta.compression {
+            Some(ref comp) if comp == "snap" => {
+                let mut r = snap::Reader::new(&mut reader);
+                read_string(&mut r)
+            }
+            _ => read_string(&mut reader),
+        }
+    }
+
+    pub fn write(self, content: &str) -> Result<Snippet<'a>, io::Error> {
+        let mut file = File::create(self.path())?;
+        let (nonce, key) = self.passphrase();
+        let mut writer = ChaChaWriter::new(&key, &nonce, &mut file);
+        writer.write_i64::<BigEndian>(Utc::now().timestamp())?;
+        let comp = if content.len() > 2048 {
+            Some("snap")
+        } else {
+            None
+        };
+        writer.write_u16::<BigEndian>(comp.map(|s| s.len() as u16).unwrap_or(0u16))?;
+        writer.write(comp.map(|s| s.as_bytes()).unwrap_or(&[0u8; 0]))?;
+        match comp {
+            Some(ref comp) if comp == &"snap" => {
+                let mut w = snap::Writer::new(&mut writer);
+                w.write_all(content.as_bytes())?
+            }
+            _ => writer.write_all(content.as_bytes())?,
+        };
+        Ok(Snippet::new(&self.id, self.storage))
+    }
+}
+
+impl SnippetStorage {
+    pub fn new(directory: impl Into<PathBuf>) -> SnippetStorage {
+        SnippetStorage {
+            directory: directory.into(),
+        }
+    }
+    pub fn file_id(id: &str) -> String {
+        let mut hasher = Sha256::new();
+        hasher.input(id.as_bytes());
+        hex::encode(&hasher.result()[0..12])
+    }
+    fn has(&self, id: &str) -> bool {
+        self.directory.join(Self::file_id(id)).exists()
+    }
+
+    pub fn open(&self, id: &str) -> Option<Snippet> {
+        if self.has(id) {
+            Some(Snippet::new(id, self))
+        } else {
+            None
+        }
+    }
+}