main.go

package main

import (
	"crypto/tls"
	"crypto/x509"
	"flag"
	"fmt"
	"log"
	"net/http"
	"os/user"
	"strconv"
	"syscall"

	"github.com/prometheus/client_golang/prometheus"
	"github.com/prometheus/client_golang/prometheus/promhttp"
)

var pkgVersion = "dev"

type cmdOptions struct {
	opnsenseConfig string
	httpBind       string
	httpPath       string
	tlsServerCert  string
	tlsClientCA    string
	user           string
	version        bool
}

func parseCmdOptions() cmdOptions {
	o := cmdOptions{opnsenseConfig: "/conf/config.xml", httpBind: ":8080", httpPath: "/metrics"}
	flag.StringVar(&o.opnsenseConfig, "opnsense.config", o.opnsenseConfig,
		"path to OPNsense's config.xml")
	flag.StringVar(&o.httpBind, "http.bind", o.httpBind,
		"address and port on which to bind")
	flag.StringVar(&o.httpPath, "http.path", o.httpPath,
		"http path on which to serve")
	flag.StringVar(&o.tlsServerCert, "tls.server-cert", o.tlsServerCert,
		"TLS server certificate (/opnsense/cert/refid in the OPNsense config)")
	flag.StringVar(&o.tlsClientCA, "tls.client-ca", o.tlsClientCA,
		"Trusted CA of client certificates (/opnsense/ca/refid in the OPNsense config)")
	flag.StringVar(&o.user, "user", o.user,
		"If not empty, switch to this user immediate after parsing the config file")
	flag.BoolVar(&o.version, "version", false, "print version")
	flag.Parse()
	return o
}

func switchUser(targetUser string) error {
	if targetUser == "" {
		return nil
	}

	us, err := user.Lookup(targetUser)
	if err != nil {
		return err
	}

	if gid, err := strconv.Atoi(us.Gid); err != nil {
		return fmt.Errorf("invalid Gid: %v", us.Gid)
	} else if err := syscall.Setgid(gid); err != nil {
		return fmt.Errorf("setgid(%v) failed: %w", gid, err)
	}

	sgroups, err := us.GroupIds()
	if err != nil {
		return err
	}
	sgids := make([]int, len(sgroups))
	for i, sgroup := range sgroups {
		if sgid, err := strconv.Atoi(sgroup); err != nil {
			return fmt.Errorf("invalid Gid: %v", sgroup)
		} else {
			sgids[i] = sgid
		}
	}
	if err := syscall.Setgroups(sgids); err != nil {
		return fmt.Errorf("setgroups(%v) failed: %w", sgids, err)
	}

	if uid, err := strconv.Atoi(us.Uid); err != nil {
		return fmt.Errorf("invalid Uid: %v", us.Uid)
	} else if err := syscall.Setuid(uid); err != nil {
		return fmt.Errorf("setuid(%v) failed: %w", uid, err)
	}

	log.Printf("Switched to user %v (uid=%v gid=%v sgids=%v)", targetUser, us.Uid, us.Gid, sgids)
	return nil
}

func registerMetrics(opnConf *OPNsenseConfig) {
	ifaceEnableGauges := prometheus.NewGaugeVec(prometheus.GaugeOpts{
		Namespace: PromNamespace,
		Subsystem: "interface",
		Name:      "enable",
		Help:      "Whether an interface is enabled or not",
	}, []string{"interface", "desc"})
	ifaceToDesc := make(map[string]string)
	for _, iface := range opnConf.ListInterfaces() {
		enableGauge := ifaceEnableGauges.WithLabelValues(iface.If, iface.Descr)
		if iface.Enable {
			enableGauge.Set(1)
			ifaceToDesc[iface.If] = iface.Descr
			log.Printf("Interface: %s -> %s", iface.If, iface.Descr)
		} else {
			enableGauge.Set(0)
			log.Printf("Interface (disabled): %s -> %s", iface.If, iface.Descr)
		}
	}

	prometheus.MustRegister(ifaceEnableGauges)
	prometheus.MustRegister(NewPfStatsCollector(ifaceToDesc))
}

func runServer(options *cmdOptions, opnConf *OPNsenseConfig) {
	http.Handle(options.httpPath, promhttp.Handler())

	server := http.Server{Addr: options.httpBind}
	if options.tlsServerCert != "" {
		certPem, keyPem, descr, err := opnConf.GetCertPairPem(options.tlsServerCert)
		if err != nil {
			log.Fatalf("Failed to load server certificate '%s': %v", options.tlsServerCert, err)
		}
		cert, err := tls.X509KeyPair(certPem, keyPem)
		if err != nil {
			log.Fatalf("Failed to load server certificate '%s': %v", options.tlsServerCert, err)
		}
		server.TLSConfig = &tls.Config{
			Certificates: []tls.Certificate{cert},
			NextProtos:   []string{"h2"},
		}
		log.Printf("Using server certificate '%s' (%s)", descr, options.tlsServerCert)
	}
	if options.tlsClientCA != "" {
		if server.TLSConfig == nil {
			log.Fatal("Server certificate not specified for client authentication")
		}
		caPem, descr, err := opnConf.GetCACertPem(options.tlsClientCA)
		if err != nil {
			log.Fatalf("Failed to load client CA '%s': %v", options.tlsClientCA, err)
		}
		server.TLSConfig.ClientCAs = x509.NewCertPool()
		if !server.TLSConfig.ClientCAs.AppendCertsFromPEM(caPem) {
			log.Fatalf("Failed to load client CA '%s'", options.tlsClientCA)
		}
		server.TLSConfig.ClientAuth = tls.RequireAndVerifyClientCert
		log.Printf("Verifying client certificates using '%s' (%s)", descr, options.tlsClientCA)
	}

	log.Printf("Serve at %s%s", options.httpBind, options.httpPath)
	if server.TLSConfig != nil {
		log.Fatal(server.ListenAndServeTLS("", ""))
	} else {
		log.Fatal(server.ListenAndServe())
	}
}

func main() {
	options := parseCmdOptions()
	if options.version {
		println(pkgVersion)
		return
	}
	log.SetFlags(LoggerFlags)

	if options.opnsenseConfig == "" {
		log.Panic("OPNsense config file not specified")
	}
	opnConf, err := ParseOPNsenseConfig(options.opnsenseConfig)
	if err != nil {
		log.Panicf("Failed to parse %s: %v", options.opnsenseConfig, err)
	}
	if err := switchUser(options.user); err != nil {
		log.Panicf("Failed to switch to user %v: %v", options.user, err)
	}

	registerMetrics(opnConf)
	runServer(&options, opnConf)
}