2018-06-11 13:13:19 +00:00
|
|
|
package websocket
|
2016-08-03 03:11:09 +00:00
|
|
|
|
|
|
|
import (
|
2018-05-06 07:15:57 +00:00
|
|
|
"bufio"
|
2016-08-03 03:11:09 +00:00
|
|
|
"bytes"
|
|
|
|
"crypto/tls"
|
|
|
|
"encoding/json"
|
|
|
|
"fmt"
|
|
|
|
"net"
|
|
|
|
"net/http"
|
|
|
|
"net/http/httputil"
|
2016-12-18 05:21:29 +00:00
|
|
|
"net/url"
|
2016-08-03 03:11:09 +00:00
|
|
|
"time"
|
2016-12-25 20:34:02 +00:00
|
|
|
|
2018-06-18 09:56:31 +00:00
|
|
|
"github.com/asaskevich/govalidator"
|
2018-05-06 07:15:57 +00:00
|
|
|
"github.com/gorilla/websocket"
|
|
|
|
"github.com/koding/websocketproxy"
|
2018-09-10 10:01:38 +00:00
|
|
|
httperror "github.com/portainer/libhttp/error"
|
|
|
|
"github.com/portainer/libhttp/request"
|
2017-03-12 16:24:15 +00:00
|
|
|
"github.com/portainer/portainer"
|
2017-05-23 18:56:10 +00:00
|
|
|
"github.com/portainer/portainer/crypto"
|
2016-08-03 03:11:09 +00:00
|
|
|
)
|
|
|
|
|
2018-06-11 13:13:19 +00:00
|
|
|
type webSocketExecRequestParams struct {
|
|
|
|
execID string
|
|
|
|
nodeName string
|
|
|
|
endpoint *portainer.Endpoint
|
|
|
|
}
|
2016-12-18 05:21:29 +00:00
|
|
|
|
2018-06-11 13:13:19 +00:00
|
|
|
type execStartOperationPayload struct {
|
|
|
|
Tty bool
|
|
|
|
Detach bool
|
2016-12-18 05:21:29 +00:00
|
|
|
}
|
|
|
|
|
2018-06-18 09:56:31 +00:00
|
|
|
// websocketExec handles GET requests on /websocket/exec?id=<execID>&endpointId=<endpointID>&nodeName=<nodeName>&token=<token>
|
2018-05-06 07:15:57 +00:00
|
|
|
// If the nodeName query parameter is present, the request will be proxied to the underlying agent endpoint.
|
|
|
|
// If the nodeName query parameter is not specified, the request will be upgraded to the websocket protocol and
|
|
|
|
// an ExecStart operation HTTP request will be created and hijacked.
|
2018-06-18 09:56:31 +00:00
|
|
|
// Authentication and access is controled via the mandatory token query parameter.
|
2018-06-11 13:13:19 +00:00
|
|
|
func (handler *Handler) websocketExec(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
|
|
|
|
execID, err := request.RetrieveQueryParameter(r, "id", false)
|
|
|
|
if err != nil {
|
|
|
|
return &httperror.HandlerError{http.StatusBadRequest, "Invalid query parameter: id", err}
|
2017-03-12 16:24:15 +00:00
|
|
|
}
|
2018-06-18 09:56:31 +00:00
|
|
|
if !govalidator.IsHexadecimal(execID) {
|
|
|
|
return &httperror.HandlerError{http.StatusBadRequest, "Invalid query parameter: id (must be hexadecimal identifier)", err}
|
|
|
|
}
|
2017-03-12 16:24:15 +00:00
|
|
|
|
2018-06-11 13:13:19 +00:00
|
|
|
endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", false)
|
2017-03-12 16:24:15 +00:00
|
|
|
if err != nil {
|
2018-06-11 13:13:19 +00:00
|
|
|
return &httperror.HandlerError{http.StatusBadRequest, "Invalid query parameter: endpointId", err}
|
2017-03-12 16:24:15 +00:00
|
|
|
}
|
|
|
|
|
2018-05-06 07:15:57 +00:00
|
|
|
endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
|
2018-06-19 11:15:10 +00:00
|
|
|
if err == portainer.ErrObjectNotFound {
|
2018-06-11 13:13:19 +00:00
|
|
|
return &httperror.HandlerError{http.StatusNotFound, "Unable to find the endpoint associated to the stack inside the database", err}
|
|
|
|
} else if err != nil {
|
|
|
|
return &httperror.HandlerError{http.StatusInternalServerError, "Unable to find the endpoint associated to the stack inside the database", err}
|
2016-12-18 05:21:29 +00:00
|
|
|
}
|
|
|
|
|
2018-06-18 09:56:31 +00:00
|
|
|
err = handler.requestBouncer.EndpointAccess(r, endpoint)
|
|
|
|
if err != nil {
|
|
|
|
return &httperror.HandlerError{http.StatusForbidden, "Permission denied to access endpoint", portainer.ErrEndpointAccessDenied}
|
|
|
|
}
|
|
|
|
|
2018-05-06 07:15:57 +00:00
|
|
|
params := &webSocketExecRequestParams{
|
|
|
|
endpoint: endpoint,
|
2018-06-11 13:13:19 +00:00
|
|
|
execID: execID,
|
2018-05-06 07:15:57 +00:00
|
|
|
nodeName: r.FormValue("nodeName"),
|
2016-12-18 05:21:29 +00:00
|
|
|
}
|
|
|
|
|
2018-05-06 07:15:57 +00:00
|
|
|
err = handler.handleRequest(w, r, params)
|
|
|
|
if err != nil {
|
2018-06-11 13:13:19 +00:00
|
|
|
return &httperror.HandlerError{http.StatusInternalServerError, "An error occured during websocket exec operation", err}
|
2016-12-18 05:21:29 +00:00
|
|
|
}
|
2018-06-11 13:13:19 +00:00
|
|
|
|
|
|
|
return nil
|
2016-12-18 05:21:29 +00:00
|
|
|
}
|
|
|
|
|
2018-06-11 13:13:19 +00:00
|
|
|
func (handler *Handler) handleRequest(w http.ResponseWriter, r *http.Request, params *webSocketExecRequestParams) error {
|
2018-05-16 07:13:46 +00:00
|
|
|
r.Header.Del("Origin")
|
|
|
|
|
2018-07-23 14:07:18 +00:00
|
|
|
if params.nodeName != "" || params.endpoint.Type == portainer.AgentOnDockerEnvironment {
|
2018-05-06 07:15:57 +00:00
|
|
|
return handler.proxyWebsocketRequest(w, r, params)
|
2016-08-03 03:11:09 +00:00
|
|
|
}
|
|
|
|
|
2018-05-06 07:15:57 +00:00
|
|
|
websocketConn, err := handler.connectionUpgrader.Upgrade(w, r, nil)
|
2016-08-03 03:11:09 +00:00
|
|
|
if err != nil {
|
2018-05-06 07:15:57 +00:00
|
|
|
return err
|
2016-08-03 03:11:09 +00:00
|
|
|
}
|
2018-05-06 07:15:57 +00:00
|
|
|
defer websocketConn.Close()
|
2016-08-03 03:11:09 +00:00
|
|
|
|
2018-05-06 07:15:57 +00:00
|
|
|
return hijackExecStartOperation(websocketConn, params.endpoint, params.execID)
|
|
|
|
}
|
2016-08-03 03:11:09 +00:00
|
|
|
|
2018-06-11 13:13:19 +00:00
|
|
|
func (handler *Handler) proxyWebsocketRequest(w http.ResponseWriter, r *http.Request, params *webSocketExecRequestParams) error {
|
2018-05-06 07:15:57 +00:00
|
|
|
agentURL, err := url.Parse(params.endpoint.URL)
|
2016-08-03 03:11:09 +00:00
|
|
|
if err != nil {
|
2018-05-06 07:15:57 +00:00
|
|
|
return err
|
2016-08-03 03:11:09 +00:00
|
|
|
}
|
|
|
|
|
2018-05-06 07:15:57 +00:00
|
|
|
agentURL.Scheme = "ws"
|
|
|
|
proxy := websocketproxy.NewProxy(agentURL)
|
2016-08-03 03:11:09 +00:00
|
|
|
|
2018-05-06 07:15:57 +00:00
|
|
|
if params.endpoint.TLSConfig.TLS || params.endpoint.TLSConfig.TLSSkipVerify {
|
|
|
|
agentURL.Scheme = "wss"
|
|
|
|
proxy.Dialer = &websocket.Dialer{
|
|
|
|
TLSClientConfig: &tls.Config{
|
|
|
|
InsecureSkipVerify: params.endpoint.TLSConfig.TLSSkipVerify,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
2016-08-03 03:11:09 +00:00
|
|
|
|
2018-11-22 22:46:51 +00:00
|
|
|
signature, err := handler.SignatureService.CreateSignature()
|
2018-05-06 07:15:57 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
2016-08-03 03:11:09 +00:00
|
|
|
}
|
|
|
|
|
2018-05-06 07:15:57 +00:00
|
|
|
proxy.Director = func(incoming *http.Request, out http.Header) {
|
2018-11-22 22:46:51 +00:00
|
|
|
out.Set(portainer.PortainerAgentPublicKeyHeader, handler.SignatureService.EncodedPublicKey())
|
2018-05-06 07:15:57 +00:00
|
|
|
out.Set(portainer.PortainerAgentSignatureHeader, signature)
|
|
|
|
out.Set(portainer.PortainerAgentTargetHeader, params.nodeName)
|
|
|
|
}
|
|
|
|
|
|
|
|
proxy.ServeHTTP(w, r)
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func hijackExecStartOperation(websocketConn *websocket.Conn, endpoint *portainer.Endpoint, execID string) error {
|
2018-07-23 14:49:04 +00:00
|
|
|
dial, err := initDial(endpoint)
|
2018-05-06 07:15:57 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
2016-08-03 03:11:09 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// When we set up a TCP connection for hijack, there could be long periods
|
|
|
|
// of inactivity (a long running command with no output) that in certain
|
|
|
|
// network setups may cause ECONNTIMEOUT, leaving the client in an unknown
|
|
|
|
// state. Setting TCP KeepAlive on the socket connection will prohibit
|
|
|
|
// ECONNTIMEOUT unless the socket connection truly is broken
|
|
|
|
if tcpConn, ok := dial.(*net.TCPConn); ok {
|
|
|
|
tcpConn.SetKeepAlive(true)
|
|
|
|
tcpConn.SetKeepAlivePeriod(30 * time.Second)
|
|
|
|
}
|
2018-05-06 07:15:57 +00:00
|
|
|
|
|
|
|
httpConn := httputil.NewClientConn(dial, nil)
|
|
|
|
defer httpConn.Close()
|
|
|
|
|
|
|
|
execStartRequest, err := createExecStartRequest(execID)
|
2016-08-03 03:11:09 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2018-05-06 07:15:57 +00:00
|
|
|
err = hijackRequest(websocketConn, httpConn, execStartRequest)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
2016-08-03 03:11:09 +00:00
|
|
|
|
2018-07-23 14:49:04 +00:00
|
|
|
func initDial(endpoint *portainer.Endpoint) (net.Conn, error) {
|
2018-05-06 07:15:57 +00:00
|
|
|
url, err := url.Parse(endpoint.URL)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2016-08-03 03:11:09 +00:00
|
|
|
|
2018-07-20 09:02:06 +00:00
|
|
|
host := url.Host
|
|
|
|
|
|
|
|
if url.Scheme == "unix" || url.Scheme == "npipe" {
|
2018-05-06 07:15:57 +00:00
|
|
|
host = url.Path
|
2016-08-03 03:11:09 +00:00
|
|
|
}
|
|
|
|
|
2018-05-06 07:15:57 +00:00
|
|
|
if endpoint.TLSConfig.TLS {
|
2018-05-19 14:25:11 +00:00
|
|
|
tlsConfig, err := crypto.CreateTLSConfigurationFromDisk(endpoint.TLSConfig.TLSCACertPath, endpoint.TLSConfig.TLSCertPath, endpoint.TLSConfig.TLSKeyPath, endpoint.TLSConfig.TLSSkipVerify)
|
2018-05-06 07:15:57 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2018-07-23 14:49:04 +00:00
|
|
|
|
|
|
|
return tls.Dial(url.Scheme, host, tlsConfig)
|
2018-05-06 07:15:57 +00:00
|
|
|
}
|
2016-08-03 03:11:09 +00:00
|
|
|
|
2018-07-23 14:49:04 +00:00
|
|
|
return createDial(url.Scheme, host)
|
2018-05-06 07:15:57 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func createExecStartRequest(execID string) (*http.Request, error) {
|
|
|
|
execStartOperationPayload := &execStartOperationPayload{
|
|
|
|
Tty: true,
|
|
|
|
Detach: false,
|
|
|
|
}
|
|
|
|
|
|
|
|
encodedBody := bytes.NewBuffer(nil)
|
|
|
|
err := json.NewEncoder(encodedBody).Encode(execStartOperationPayload)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
2016-08-03 03:11:09 +00:00
|
|
|
}
|
|
|
|
|
2018-05-06 07:15:57 +00:00
|
|
|
request, err := http.NewRequest("POST", "/exec/"+execID+"/start", encodedBody)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
request.Header.Set("Content-Type", "application/json")
|
|
|
|
request.Header.Set("Connection", "Upgrade")
|
|
|
|
request.Header.Set("Upgrade", "tcp")
|
|
|
|
|
|
|
|
return request, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func hijackRequest(websocketConn *websocket.Conn, httpConn *httputil.ClientConn, request *http.Request) error {
|
|
|
|
// Server hijacks the connection, error 'connection closed' expected
|
|
|
|
resp, err := httpConn.Do(request)
|
|
|
|
if err != httputil.ErrPersistEOF {
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if resp.StatusCode != http.StatusSwitchingProtocols {
|
|
|
|
resp.Body.Close()
|
|
|
|
return fmt.Errorf("unable to upgrade to tcp, received %d", resp.StatusCode)
|
2016-08-03 03:11:09 +00:00
|
|
|
}
|
2018-05-06 07:15:57 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
tcpConn, brw := httpConn.Hijack()
|
|
|
|
defer tcpConn.Close()
|
|
|
|
|
|
|
|
errorChan := make(chan error, 1)
|
|
|
|
go streamFromTCPConnToWebsocketConn(websocketConn, brw, errorChan)
|
|
|
|
go streamFromWebsocketConnToTCPConn(websocketConn, tcpConn, errorChan)
|
|
|
|
|
|
|
|
err = <-errorChan
|
|
|
|
if websocket.IsUnexpectedCloseError(err, websocket.CloseGoingAway, websocket.CloseNoStatusReceived) {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
2016-08-03 03:11:09 +00:00
|
|
|
|
2018-05-06 07:15:57 +00:00
|
|
|
func streamFromWebsocketConnToTCPConn(websocketConn *websocket.Conn, tcpConn net.Conn, errorChan chan error) {
|
|
|
|
for {
|
|
|
|
_, in, err := websocketConn.ReadMessage()
|
|
|
|
if err != nil {
|
|
|
|
errorChan <- err
|
|
|
|
break
|
2016-08-03 03:11:09 +00:00
|
|
|
}
|
|
|
|
|
2018-05-06 07:15:57 +00:00
|
|
|
_, err = tcpConn.Write(in)
|
|
|
|
if err != nil {
|
|
|
|
errorChan <- err
|
|
|
|
break
|
2016-08-03 03:11:09 +00:00
|
|
|
}
|
|
|
|
}
|
2018-05-06 07:15:57 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func streamFromTCPConnToWebsocketConn(websocketConn *websocket.Conn, br *bufio.Reader, errorChan chan error) {
|
|
|
|
for {
|
2018-09-07 09:24:18 +00:00
|
|
|
out := make([]byte, 2048)
|
2018-05-06 07:15:57 +00:00
|
|
|
_, err := br.Read(out)
|
|
|
|
if err != nil {
|
|
|
|
errorChan <- err
|
|
|
|
break
|
2016-08-03 03:11:09 +00:00
|
|
|
}
|
|
|
|
|
2018-05-06 07:15:57 +00:00
|
|
|
err = websocketConn.WriteMessage(websocket.TextMessage, out)
|
|
|
|
if err != nil {
|
|
|
|
errorChan <- err
|
|
|
|
break
|
|
|
|
}
|
|
|
|
}
|
2016-08-03 03:11:09 +00:00
|
|
|
}
|