mirror of
https://github.com/genuinetools/reg.git
synced 2024-08-21 06:10:23 -04:00
192 lines
5.2 KiB
Go
192 lines
5.2 KiB
Go
![]() |
// Package registry contains client primitives to interact with a remote Docker registry.
|
||
|
package registry
|
||
|
|
||
|
import (
|
||
|
"crypto/tls"
|
||
|
"errors"
|
||
|
"fmt"
|
||
|
"io/ioutil"
|
||
|
"net"
|
||
|
"net/http"
|
||
|
"os"
|
||
|
"path/filepath"
|
||
|
"strings"
|
||
|
"time"
|
||
|
|
||
|
"github.com/docker/distribution/registry/client/transport"
|
||
|
"github.com/docker/go-connections/sockets"
|
||
|
"github.com/docker/go-connections/tlsconfig"
|
||
|
"github.com/sirupsen/logrus"
|
||
|
)
|
||
|
|
||
|
var (
|
||
|
// ErrAlreadyExists is an error returned if an image being pushed
|
||
|
// already exists on the remote side
|
||
|
ErrAlreadyExists = errors.New("Image already exists")
|
||
|
)
|
||
|
|
||
|
func newTLSConfig(hostname string, isSecure bool) (*tls.Config, error) {
|
||
|
// PreferredServerCipherSuites should have no effect
|
||
|
tlsConfig := tlsconfig.ServerDefault()
|
||
|
|
||
|
tlsConfig.InsecureSkipVerify = !isSecure
|
||
|
|
||
|
if isSecure && CertsDir != "" {
|
||
|
hostDir := filepath.Join(CertsDir, cleanPath(hostname))
|
||
|
logrus.Debugf("hostDir: %s", hostDir)
|
||
|
if err := ReadCertsDirectory(tlsConfig, hostDir); err != nil {
|
||
|
return nil, err
|
||
|
}
|
||
|
}
|
||
|
|
||
|
return tlsConfig, nil
|
||
|
}
|
||
|
|
||
|
func hasFile(files []os.FileInfo, name string) bool {
|
||
|
for _, f := range files {
|
||
|
if f.Name() == name {
|
||
|
return true
|
||
|
}
|
||
|
}
|
||
|
return false
|
||
|
}
|
||
|
|
||
|
// ReadCertsDirectory reads the directory for TLS certificates
|
||
|
// including roots and certificate pairs and updates the
|
||
|
// provided TLS configuration.
|
||
|
func ReadCertsDirectory(tlsConfig *tls.Config, directory string) error {
|
||
|
fs, err := ioutil.ReadDir(directory)
|
||
|
if err != nil && !os.IsNotExist(err) {
|
||
|
return err
|
||
|
}
|
||
|
|
||
|
for _, f := range fs {
|
||
|
if strings.HasSuffix(f.Name(), ".crt") {
|
||
|
if tlsConfig.RootCAs == nil {
|
||
|
systemPool, err := tlsconfig.SystemCertPool()
|
||
|
if err != nil {
|
||
|
return fmt.Errorf("unable to get system cert pool: %v", err)
|
||
|
}
|
||
|
tlsConfig.RootCAs = systemPool
|
||
|
}
|
||
|
logrus.Debugf("crt: %s", filepath.Join(directory, f.Name()))
|
||
|
data, err := ioutil.ReadFile(filepath.Join(directory, f.Name()))
|
||
|
if err != nil {
|
||
|
return err
|
||
|
}
|
||
|
tlsConfig.RootCAs.AppendCertsFromPEM(data)
|
||
|
}
|
||
|
if strings.HasSuffix(f.Name(), ".cert") {
|
||
|
certName := f.Name()
|
||
|
keyName := certName[:len(certName)-5] + ".key"
|
||
|
logrus.Debugf("cert: %s", filepath.Join(directory, f.Name()))
|
||
|
if !hasFile(fs, keyName) {
|
||
|
return fmt.Errorf("missing key %s for client certificate %s. Note that CA certificates should use the extension .crt", keyName, certName)
|
||
|
}
|
||
|
cert, err := tls.LoadX509KeyPair(filepath.Join(directory, certName), filepath.Join(directory, keyName))
|
||
|
if err != nil {
|
||
|
return err
|
||
|
}
|
||
|
tlsConfig.Certificates = append(tlsConfig.Certificates, cert)
|
||
|
}
|
||
|
if strings.HasSuffix(f.Name(), ".key") {
|
||
|
keyName := f.Name()
|
||
|
certName := keyName[:len(keyName)-4] + ".cert"
|
||
|
logrus.Debugf("key: %s", filepath.Join(directory, f.Name()))
|
||
|
if !hasFile(fs, certName) {
|
||
|
return fmt.Errorf("Missing client certificate %s for key %s", certName, keyName)
|
||
|
}
|
||
|
}
|
||
|
}
|
||
|
|
||
|
return nil
|
||
|
}
|
||
|
|
||
|
// Headers returns request modifiers with a User-Agent and metaHeaders
|
||
|
func Headers(userAgent string, metaHeaders http.Header) []transport.RequestModifier {
|
||
|
modifiers := []transport.RequestModifier{}
|
||
|
if userAgent != "" {
|
||
|
modifiers = append(modifiers, transport.NewHeaderRequestModifier(http.Header{
|
||
|
"User-Agent": []string{userAgent},
|
||
|
}))
|
||
|
}
|
||
|
if metaHeaders != nil {
|
||
|
modifiers = append(modifiers, transport.NewHeaderRequestModifier(metaHeaders))
|
||
|
}
|
||
|
return modifiers
|
||
|
}
|
||
|
|
||
|
// HTTPClient returns an HTTP client structure which uses the given transport
|
||
|
// and contains the necessary headers for redirected requests
|
||
|
func HTTPClient(transport http.RoundTripper) *http.Client {
|
||
|
return &http.Client{
|
||
|
Transport: transport,
|
||
|
CheckRedirect: addRequiredHeadersToRedirectedRequests,
|
||
|
}
|
||
|
}
|
||
|
|
||
|
func trustedLocation(req *http.Request) bool {
|
||
|
var (
|
||
|
trusteds = []string{"docker.com", "docker.io"}
|
||
|
hostname = strings.SplitN(req.Host, ":", 2)[0]
|
||
|
)
|
||
|
if req.URL.Scheme != "https" {
|
||
|
return false
|
||
|
}
|
||
|
|
||
|
for _, trusted := range trusteds {
|
||
|
if hostname == trusted || strings.HasSuffix(hostname, "."+trusted) {
|
||
|
return true
|
||
|
}
|
||
|
}
|
||
|
return false
|
||
|
}
|
||
|
|
||
|
// addRequiredHeadersToRedirectedRequests adds the necessary redirection headers
|
||
|
// for redirected requests
|
||
|
func addRequiredHeadersToRedirectedRequests(req *http.Request, via []*http.Request) error {
|
||
|
if via != nil && via[0] != nil {
|
||
|
if trustedLocation(req) && trustedLocation(via[0]) {
|
||
|
req.Header = via[0].Header
|
||
|
return nil
|
||
|
}
|
||
|
for k, v := range via[0].Header {
|
||
|
if k != "Authorization" {
|
||
|
for _, vv := range v {
|
||
|
req.Header.Add(k, vv)
|
||
|
}
|
||
|
}
|
||
|
}
|
||
|
}
|
||
|
return nil
|
||
|
}
|
||
|
|
||
|
// NewTransport returns a new HTTP transport. If tlsConfig is nil, it uses the
|
||
|
// default TLS configuration.
|
||
|
func NewTransport(tlsConfig *tls.Config) *http.Transport {
|
||
|
if tlsConfig == nil {
|
||
|
tlsConfig = tlsconfig.ServerDefault()
|
||
|
}
|
||
|
|
||
|
direct := &net.Dialer{
|
||
|
Timeout: 30 * time.Second,
|
||
|
KeepAlive: 30 * time.Second,
|
||
|
DualStack: true,
|
||
|
}
|
||
|
|
||
|
base := &http.Transport{
|
||
|
Proxy: http.ProxyFromEnvironment,
|
||
|
Dial: direct.Dial,
|
||
|
TLSHandshakeTimeout: 10 * time.Second,
|
||
|
TLSClientConfig: tlsConfig,
|
||
|
// TODO(dmcgowan): Call close idle connections when complete and use keep alive
|
||
|
DisableKeepAlives: true,
|
||
|
}
|
||
|
|
||
|
proxyDialer, err := sockets.DialerFromEnvironment(direct)
|
||
|
if err == nil {
|
||
|
base.Dial = proxyDialer.Dial
|
||
|
}
|
||
|
return base
|
||
|
}
|