Initial commit. At least it works.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 Gonçalo Valério
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,8 @@
+# Worker DDNS
+
+Workers as a proxy in a DDNS setup that uses the cloudflare API.
+
+Both scripts, `worker.js` and `agent.py` don't require any extra dependencies,
+so it is very simple to deploy/setup. Just copy the files and you're done.
+
+More detailed documentation will be added soon.

agent.py

@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+"""
+Simple agent script that collects the public IP address of the machine it is
+running on and then updates a Cloudflare Worker.
+
+All requests are signed using a pre-shared key to ensure the integrity of the
+message and authenticate the source.
+"""
+import os
+import sys
+import hmac
+import json
+import logging
+import random
+from datetime import datetime
+from urllib import request, parse, error
+
+
+logger = logging.getLogger(__name__)
+
+IP_SOURCES = [
+    "https://api.ipify.org/",
+    "https://icanhazip.com/",
+    "https://ifconfig.me/",
+]
+
+# For some reason the default urllib User-Agent is blocked
+FAKE_USER_AGENT = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"
+
+
+def setup_logger() -> None:
+    form = logging.Formatter("%(asctime)s | %(levelname)s | %(message)s")
+
+    handler = logging.StreamHandler(sys.stdout)
+    handler.setLevel(logging.INFO)
+    handler.setFormatter(form)
+
+    logger.setLevel(logging.INFO)
+    logger.addHandler(handler)
+
+
+def get_ip_address() -> str:
+    url = random.choice(IP_SOURCES)
+    res = request.urlopen(url)
+    return res.read().decode("utf8").strip()
+
+
+def sign_message(message: bytes, key: bytes) -> str:
+    message_hmac = hmac.new(key, message, digestmod="sha256")
+    return message_hmac.hexdigest()
+
+
+def update_dns_record(url: str, key: str):
+    ip_addr = get_ip_address()
+    timestamp = int(datetime.now().timestamp())
+    payload = json.dumps({"addr": ip_addr, "timestamp": timestamp}).encode("utf8")
+    signature = sign_message(payload, key.encode("utf8"))
+
+    req = request.Request(f"https://{url}")
+    req.add_header("Content-Type", "application/json; charset=utf-8")
+    req.add_header("User-Agent", FAKE_USER_AGENT)
+    req.add_header("Authorization", signature)
+    req.add_header("Content-Length", len(payload))
+    request.urlopen(req, payload)
+    logger.info("DNS Record updated successfully")
+
+
+if __name__ == "__main__":
+    setup_logger()
+    key = os.environ.get("SHARED_KEY")
+    url = os.environ.get("WORKER_URL")
+    if key and url:
+        try:
+            update_dns_record(url, key)
+        except (error.URLError, error.HTTPError) as err:
+            logger.exception("Failed to update DNS record")
+    else:
+        logger.error("Cannot find configs. Aborting DNS update")

worker.js

@@ -0,0 +1,137 @@
+/**
+ * This handled a request to update a given DNS record.
+ * The request should have the following format:
+ *
+ * { "addr": "<ipv4_addr>", "timestamp": <unix_timestamp> }
+ *
+ * The request must be made by the machine that the record will be pointed to
+ * and contain the HMAC (of the request body) in the "Authorization" header
+ */
+addEventListener("fetch", (event) => {
+  event.respondWith(handleRequest(event.request));
+});
+
+/**
+ * Handles the request and validates if changes should be made or not
+ * @param {Request} request
+ */
+async function handleRequest(request) {
+  if (request.method === "POST") {
+    let valid_request = await is_valid(request);
+    if (valid_request) {
+      const addr = request.headers.get("cf-connecting-ip");
+      await updateRecord(addr);
+      return new Response("Não há gente como a gente", { status: 200 });
+    }
+  }
+  return new Response("Por cima", { status: 401 });
+}
+
+/**
+ * Checks if it is a valid and authentic request
+ * @param {Request} request
+ */
+async function is_valid(request) {
+  const window = 300; // 5 minutes in seconds
+  const rawBody = await request.text();
+  let bodyContent = {};
+  try {
+    bodyContent = JSON.parse(rawBody);
+  } catch (e) {
+    return false;
+  }
+
+  const sourceAddr = request.headers.get("cf-connecting-ip");
+  const signature = request.headers.get("authorization");
+  if (!signature || !bodyContent.addr || sourceAddr != bodyContent.addr) {
+    return false;
+  }
+
+  const valid_hmac = await verifyHMAC(signature, rawBody);
+  if (!valid_hmac) {
+    return false;
+  }
+
+  const now = Math.floor(Date.now() / 1000);
+  if (now - bodyContent.timestamp > window) {
+    return false;
+  }
+  return true;
+}
+
+/**
+ * Verifies the provided HMAC matches the message
+ * @param {String} signature
+ * @param {String} message
+ */
+async function verifyHMAC(signature, message) {
+  let encoder = new TextEncoder();
+  let key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(SHARED_KEY),
+    { name: "HMAC", hash: { name: "SHA-256" } },
+    false,
+    ["verify"]
+  );
+
+  result = await crypto.subtle.verify(
+    "HMAC",
+    key,
+    hexToArrayBuffer(signature),
+    encoder.encode(message)
+  );
+  return result;
+}
+
+/**
+ * Updates the DNS record with the provided IP
+ * @param {String} addr
+ */
+async function updateRecord(addr) {
+  const base = "https://api.cloudflare.com/client/v4/zones";
+  const init = { headers: { Authorization: `Bearer ${CF_API_TOKEN}` } };
+  let record;
+
+  let record_res = await fetch(
+    `${base}/${ZONE}/dns_records?name=${DNS_RECORD}`,
+    init
+  );
+  if (record_res.ok) {
+    record = (await record_res.json()).result[0];
+  } else {
+    console.log("Get record failed");
+    return;
+  }
+
+  if (record.content != addr) {
+    init.method = "PATCH";
+    init.body = JSON.stringify({ content: addr });
+    await fetch(`${base}/${ZONE}/dns_records/${record.id}`, init);
+    console.log("Updated record");
+  } else {
+    console.log("Record content is the same, skipping update");
+  }
+}
+
+/**
+ * Transforms an HEX string into an ArrayBuffer
+ * Original work of: https://github.com/LinusU/hex-to-array-buffer
+ * @param {String} hex
+ */
+function hexToArrayBuffer(hex) {
+  if (typeof hex !== "string") {
+    throw new TypeError("Expected input to be a string");
+  }
+
+  if (hex.length % 2 !== 0) {
+    throw new RangeError("Expected string to be an even number of characters");
+  }
+
+  var view = new Uint8Array(hex.length / 2);
+
+  for (var i = 0; i < hex.length; i += 2) {
+    view[i / 2] = parseInt(hex.substring(i, i + 2), 16);
+  }
+
+  return view.buffer;
+}