mirror of
https://github.com/genuinetools/reg.git
synced 2024-08-21 14:20:23 -04:00
208 lines
5.8 KiB
Go
208 lines
5.8 KiB
Go
![]() |
package client
|
||
|
|
||
|
import (
|
||
|
"bufio"
|
||
|
"crypto/tls"
|
||
|
"fmt"
|
||
|
"net"
|
||
|
"net/http"
|
||
|
"net/http/httputil"
|
||
|
"net/url"
|
||
|
"strings"
|
||
|
"time"
|
||
|
|
||
|
"github.com/docker/docker/api/types"
|
||
|
"github.com/docker/go-connections/sockets"
|
||
|
"github.com/pkg/errors"
|
||
|
"golang.org/x/net/context"
|
||
|
)
|
||
|
|
||
|
// tlsClientCon holds tls information and a dialed connection.
|
||
|
type tlsClientCon struct {
|
||
|
*tls.Conn
|
||
|
rawConn net.Conn
|
||
|
}
|
||
|
|
||
|
func (c *tlsClientCon) CloseWrite() error {
|
||
|
// Go standard tls.Conn doesn't provide the CloseWrite() method so we do it
|
||
|
// on its underlying connection.
|
||
|
if conn, ok := c.rawConn.(types.CloseWriter); ok {
|
||
|
return conn.CloseWrite()
|
||
|
}
|
||
|
return nil
|
||
|
}
|
||
|
|
||
|
// postHijacked sends a POST request and hijacks the connection.
|
||
|
func (cli *Client) postHijacked(ctx context.Context, path string, query url.Values, body interface{}, headers map[string][]string) (types.HijackedResponse, error) {
|
||
|
bodyEncoded, err := encodeData(body)
|
||
|
if err != nil {
|
||
|
return types.HijackedResponse{}, err
|
||
|
}
|
||
|
|
||
|
apiPath := cli.getAPIPath(path, query)
|
||
|
req, err := http.NewRequest("POST", apiPath, bodyEncoded)
|
||
|
if err != nil {
|
||
|
return types.HijackedResponse{}, err
|
||
|
}
|
||
|
req = cli.addHeaders(req, headers)
|
||
|
|
||
|
conn, err := cli.setupHijackConn(req, "tcp")
|
||
|
if err != nil {
|
||
|
return types.HijackedResponse{}, err
|
||
|
}
|
||
|
|
||
|
return types.HijackedResponse{Conn: conn, Reader: bufio.NewReader(conn)}, err
|
||
|
}
|
||
|
|
||
|
func tlsDial(network, addr string, config *tls.Config) (net.Conn, error) {
|
||
|
return tlsDialWithDialer(new(net.Dialer), network, addr, config)
|
||
|
}
|
||
|
|
||
|
// We need to copy Go's implementation of tls.Dial (pkg/cryptor/tls/tls.go) in
|
||
|
// order to return our custom tlsClientCon struct which holds both the tls.Conn
|
||
|
// object _and_ its underlying raw connection. The rationale for this is that
|
||
|
// we need to be able to close the write end of the connection when attaching,
|
||
|
// which tls.Conn does not provide.
|
||
|
func tlsDialWithDialer(dialer *net.Dialer, network, addr string, config *tls.Config) (net.Conn, error) {
|
||
|
// We want the Timeout and Deadline values from dialer to cover the
|
||
|
// whole process: TCP connection and TLS handshake. This means that we
|
||
|
// also need to start our own timers now.
|
||
|
timeout := dialer.Timeout
|
||
|
|
||
|
if !dialer.Deadline.IsZero() {
|
||
|
deadlineTimeout := time.Until(dialer.Deadline)
|
||
|
if timeout == 0 || deadlineTimeout < timeout {
|
||
|
timeout = deadlineTimeout
|
||
|
}
|
||
|
}
|
||
|
|
||
|
var errChannel chan error
|
||
|
|
||
|
if timeout != 0 {
|
||
|
errChannel = make(chan error, 2)
|
||
|
time.AfterFunc(timeout, func() {
|
||
|
errChannel <- errors.New("")
|
||
|
})
|
||
|
}
|
||
|
|
||
|
proxyDialer, err := sockets.DialerFromEnvironment(dialer)
|
||
|
if err != nil {
|
||
|
return nil, err
|
||
|
}
|
||
|
|
||
|
rawConn, err := proxyDialer.Dial(network, addr)
|
||
|
if err != nil {
|
||
|
return nil, err
|
||
|
}
|
||
|
// When we set up a TCP connection for hijack, there could be long periods
|
||
|
// of inactivity (a long running command with no output) that in certain
|
||
|
// network setups may cause ECONNTIMEOUT, leaving the client in an unknown
|
||
|
// state. Setting TCP KeepAlive on the socket connection will prohibit
|
||
|
// ECONNTIMEOUT unless the socket connection truly is broken
|
||
|
if tcpConn, ok := rawConn.(*net.TCPConn); ok {
|
||
|
tcpConn.SetKeepAlive(true)
|
||
|
tcpConn.SetKeepAlivePeriod(30 * time.Second)
|
||
|
}
|
||
|
|
||
|
colonPos := strings.LastIndex(addr, ":")
|
||
|
if colonPos == -1 {
|
||
|
colonPos = len(addr)
|
||
|
}
|
||
|
hostname := addr[:colonPos]
|
||
|
|
||
|
// If no ServerName is set, infer the ServerName
|
||
|
// from the hostname we're connecting to.
|
||
|
if config.ServerName == "" {
|
||
|
// Make a copy to avoid polluting argument or default.
|
||
|
config = tlsConfigClone(config)
|
||
|
config.ServerName = hostname
|
||
|
}
|
||
|
|
||
|
conn := tls.Client(rawConn, config)
|
||
|
|
||
|
if timeout == 0 {
|
||
|
err = conn.Handshake()
|
||
|
} else {
|
||
|
go func() {
|
||
|
errChannel <- conn.Handshake()
|
||
|
}()
|
||
|
|
||
|
err = <-errChannel
|
||
|
}
|
||
|
|
||
|
if err != nil {
|
||
|
rawConn.Close()
|
||
|
return nil, err
|
||
|
}
|
||
|
|
||
|
// This is Docker difference with standard's crypto/tls package: returned a
|
||
|
// wrapper which holds both the TLS and raw connections.
|
||
|
return &tlsClientCon{conn, rawConn}, nil
|
||
|
}
|
||
|
|
||
|
func dial(proto, addr string, tlsConfig *tls.Config) (net.Conn, error) {
|
||
|
if tlsConfig != nil && proto != "unix" && proto != "npipe" {
|
||
|
// Notice this isn't Go standard's tls.Dial function
|
||
|
return tlsDial(proto, addr, tlsConfig)
|
||
|
}
|
||
|
if proto == "npipe" {
|
||
|
return sockets.DialPipe(addr, 32*time.Second)
|
||
|
}
|
||
|
return net.Dial(proto, addr)
|
||
|
}
|
||
|
|
||
|
func (cli *Client) setupHijackConn(req *http.Request, proto string) (net.Conn, error) {
|
||
|
req.Host = cli.addr
|
||
|
req.Header.Set("Connection", "Upgrade")
|
||
|
req.Header.Set("Upgrade", proto)
|
||
|
|
||
|
conn, err := dial(cli.proto, cli.addr, resolveTLSConfig(cli.client.Transport))
|
||
|
if err != nil {
|
||
|
return nil, errors.Wrap(err, "cannot connect to the Docker daemon. Is 'docker daemon' running on this host?")
|
||
|
}
|
||
|
|
||
|
// When we set up a TCP connection for hijack, there could be long periods
|
||
|
// of inactivity (a long running command with no output) that in certain
|
||
|
// network setups may cause ECONNTIMEOUT, leaving the client in an unknown
|
||
|
// state. Setting TCP KeepAlive on the socket connection will prohibit
|
||
|
// ECONNTIMEOUT unless the socket connection truly is broken
|
||
|
if tcpConn, ok := conn.(*net.TCPConn); ok {
|
||
|
tcpConn.SetKeepAlive(true)
|
||
|
tcpConn.SetKeepAlivePeriod(30 * time.Second)
|
||
|
}
|
||
|
|
||
|
clientconn := httputil.NewClientConn(conn, nil)
|
||
|
defer clientconn.Close()
|
||
|
|
||
|
// Server hijacks the connection, error 'connection closed' expected
|
||
|
resp, err := clientconn.Do(req)
|
||
|
if err != httputil.ErrPersistEOF {
|
||
|
if err != nil {
|
||
|
return nil, err
|
||
|
}
|
||
|
if resp.StatusCode != http.StatusSwitchingProtocols {
|
||
|
resp.Body.Close()
|
||
|
return nil, fmt.Errorf("unable to upgrade to %s, received %d", proto, resp.StatusCode)
|
||
|
}
|
||
|
}
|
||
|
|
||
|
c, br := clientconn.Hijack()
|
||
|
if br.Buffered() > 0 {
|
||
|
// If there is buffered content, wrap the connection
|
||
|
c = &hijackedConn{c, br}
|
||
|
} else {
|
||
|
br.Reset(nil)
|
||
|
}
|
||
|
|
||
|
return c, nil
|
||
|
}
|
||
|
|
||
|
type hijackedConn struct {
|
||
|
net.Conn
|
||
|
r *bufio.Reader
|
||
|
}
|
||
|
|
||
|
func (c *hijackedConn) Read(b []byte) (int, error) {
|
||
|
return c.r.Read(b)
|
||
|
}
|