fix #1107

irc/authscript.go

@@ -0,0 +1,109 @@
+// Copyright (c) 2020 Shivaram Lingamneni
+// released under the MIT license
+
+package irc
+
+import (
+	"bufio"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os/exec"
+	"syscall"
+	"time"
+)
+
+// JSON-serializable input and output types for the script
+type AuthScriptInput struct {
+	AccountName string
+	Passphrase  string
+	Certfp      string
+}
+
+type AuthScriptOutput struct {
+	AccountName string
+	Success     bool
+	Error       string
+}
+
+// internal tupling of output and error for passing over a channel
+type authScriptResponse struct {
+	output AuthScriptOutput
+	err    error
+}
+
+func CheckAuthScript(config AuthScriptConfig, input AuthScriptInput) (output AuthScriptOutput, err error) {
+	inputBytes, err := json.Marshal(input)
+	if err != nil {
+		return
+	}
+	cmd := exec.Command(config.Command, config.Args...)
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		return
+	}
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return
+	}
+
+	channel := make(chan authScriptResponse, 1)
+	err = cmd.Start()
+	if err != nil {
+		return
+	}
+	stdin.Write(inputBytes)
+	stdin.Write([]byte{'\n'})
+
+	// lots of potential race conditions here. we want to ensure that Wait()
+	// will be called, and will return, on the other goroutine, no matter
+	// where it is blocked. If it's blocked on ReadBytes(), we will kill it
+	// (first with SIGTERM, then with SIGKILL) and ReadBytes will return
+	// with EOF. If it's blocked on Wait(), then one of the kill signals
+	// will succeed and unblock it.
+	go processAuthScriptOutput(cmd, stdout, channel)
+	outputTimer := time.NewTimer(config.Timeout)
+	select {
+	case response := <-channel:
+		return response.output, response.err
+	case <-outputTimer.C:
+	}
+
+	err = errTimedOut
+	cmd.Process.Signal(syscall.SIGTERM)
+	termTimer := time.NewTimer(config.Timeout)
+	select {
+	case <-channel:
+		return
+	case <-termTimer.C:
+	}
+
+	cmd.Process.Kill()
+	return
+}
+
+func processAuthScriptOutput(cmd *exec.Cmd, stdout io.Reader, channel chan authScriptResponse) {
+	var response authScriptResponse
+	var out AuthScriptOutput
+
+	reader := bufio.NewReader(stdout)
+	outBytes, err := reader.ReadBytes('\n')
+	if err == nil {
+		err = json.Unmarshal(outBytes, &out)
+		if err == nil {
+			response.output = out
+			if out.Error != "" {
+				err = fmt.Errorf("Authentication process reported error: %s", out.Error)
+			}
+		}
+	}
+	response.err = err
+
+	// always call Wait() to ensure resource cleanup
+	err = cmd.Wait()
+	if err != nil {
+		response.err = err
+	}
+
+	channel <- response
+}