1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
|
// SPDX-License-Identifier: BSD-2-Clause
// SPDX-FileCopyrightText: Copyright (c) 2025 Runxi Yu <https://runxiyu.org>
package main
import (
"crypto/sha256"
"crypto/subtle"
"encoding/base64"
"errors"
"log"
"net/http"
"strings"
)
type tparams struct {
Identifier string
Message string
Global any
}
func main() {
log.Fatal(http.ListenAndServe(listenAddr, http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
if strings.HasPrefix(request.URL.Path, "/.powxy/") {
http.StripPrefix("/.powxy/", http.FileServer(http.FS(resourcesFS))).ServeHTTP(writer, request)
return
}
cookie, err := request.Cookie("powxy")
if err != nil {
if !errors.Is(err, http.ErrNoCookie) {
log.Println("COOKIE_ERR", getRemoteIP(request), request.RequestURI, request.Header.Get("User-Agent"))
http.Error(writer, "error fetching cookie", http.StatusInternalServerError)
return
}
}
identifier, expectedMAC := makeIdentifierMAC(request)
if validateCookie(cookie, expectedMAC) {
log.Println("PROXY", getRemoteIP(request), request.RequestURI, request.Header.Get("User-Agent"))
proxyRequest(writer, request)
return
}
authPage := func(message string) {
err := tmpl.Execute(writer, tparams{
Identifier: base64.StdEncoding.EncodeToString(identifier),
Message: message,
Global: global,
})
if err != nil {
log.Println("Error executing template:", err)
}
}
if request.ParseForm() != nil {
log.Println("MALFORMED", getRemoteIP(request), request.RequestURI, request.Header.Get("User-Agent"))
authPage("You submitted a malformed form.")
return
}
formValues, ok := request.PostForm["powxy"]
if !ok {
log.Println("CHALLENGE", getRemoteIP(request), request.RequestURI, request.Header.Get("User-Agent"))
authPage("")
return
} else if len(formValues) != 1 {
log.Println("FORM_VALUES", getRemoteIP(request), request.RequestURI, request.Header.Get("User-Agent"))
authPage("You submitted an invalid number of form values.")
return
}
nonce, err := base64.StdEncoding.DecodeString(formValues[0])
if err != nil {
log.Println("BASE64", getRemoteIP(request), request.RequestURI, request.Header.Get("User-Agent"))
authPage("Your submission was improperly encoded.")
return
}
if len(nonce) > 32 {
log.Println("TOO_LONG", getRemoteIP(request), request.RequestURI, request.Header.Get("User-Agent"))
authPage("Your submission was too long.")
return
}
h := sha256.New()
h.Write(identifier)
h.Write(nonce)
ck := h.Sum(nil)
if !validateBitZeros(ck, global.NeedBits) {
log.Println("WRONG", getRemoteIP(request), request.RequestURI, request.Header.Get("User-Agent"))
authPage("Your submission was incorrect, or your session has expired while submitting.")
return
}
http.SetCookie(writer, &http.Cookie{
Name: "powxy",
Value: base64.StdEncoding.EncodeToString(expectedMAC),
Secure: true,
HttpOnly: true,
})
log.Println("ACCEPTED", getRemoteIP(request), request.RequestURI, request.Header.Get("User-Agent"))
http.Redirect(writer, request, "", http.StatusSeeOther)
})))
}
func validateCookie(cookie *http.Cookie, expectedMAC []byte) bool {
if cookie == nil {
return false
}
gotMAC, err := base64.StdEncoding.DecodeString(cookie.Value)
if err != nil {
return false
}
return subtle.ConstantTimeCompare(gotMAC, expectedMAC) == 1
}
func getRemoteIP(request *http.Request) (remoteIP string) {
if secondary {
remoteIP, _, _ = strings.Cut(request.Header.Get("X-Forwarded-For"), ",")
}
if remoteIP == "" {
remoteIP = request.RemoteAddr
index := strings.LastIndex(remoteIP, ":")
if index != -1 {
remoteIP = remoteIP[:index]
}
}
return
}
|
