portainer/api/http/handler/websocket/websocket_exec.go

279 lines
7.7 KiB
Go
Raw Normal View History

package websocket
import (
2018-05-06 07:15:57 +00:00
"bufio"
"bytes"
"crypto/tls"
"encoding/json"
"fmt"
"net"
"net/http"
"net/http/httputil"
2016-12-18 05:21:29 +00:00
"net/url"
"time"
"github.com/asaskevich/govalidator"
2018-05-06 07:15:57 +00:00
"github.com/gorilla/websocket"
"github.com/koding/websocketproxy"
"github.com/portainer/portainer"
"github.com/portainer/portainer/crypto"
2018-05-06 07:15:57 +00:00
httperror "github.com/portainer/portainer/http/error"
"github.com/portainer/portainer/http/request"
)
type webSocketExecRequestParams struct {
execID string
nodeName string
endpoint *portainer.Endpoint
}
2016-12-18 05:21:29 +00:00
type execStartOperationPayload struct {
Tty bool
Detach bool
2016-12-18 05:21:29 +00:00
}
// websocketExec handles GET requests on /websocket/exec?id=<execID>&endpointId=<endpointID>&nodeName=<nodeName>&token=<token>
2018-05-06 07:15:57 +00:00
// If the nodeName query parameter is present, the request will be proxied to the underlying agent endpoint.
// If the nodeName query parameter is not specified, the request will be upgraded to the websocket protocol and
// an ExecStart operation HTTP request will be created and hijacked.
// Authentication and access is controled via the mandatory token query parameter.
func (handler *Handler) websocketExec(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
execID, err := request.RetrieveQueryParameter(r, "id", false)
if err != nil {
return &httperror.HandlerError{http.StatusBadRequest, "Invalid query parameter: id", err}
}
if !govalidator.IsHexadecimal(execID) {
return &httperror.HandlerError{http.StatusBadRequest, "Invalid query parameter: id (must be hexadecimal identifier)", err}
}
endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", false)
if err != nil {
return &httperror.HandlerError{http.StatusBadRequest, "Invalid query parameter: endpointId", err}
}
2018-05-06 07:15:57 +00:00
endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
if err == portainer.ErrObjectNotFound {
return &httperror.HandlerError{http.StatusNotFound, "Unable to find the endpoint associated to the stack inside the database", err}
} else if err != nil {
return &httperror.HandlerError{http.StatusInternalServerError, "Unable to find the endpoint associated to the stack inside the database", err}
2016-12-18 05:21:29 +00:00
}
err = handler.requestBouncer.EndpointAccess(r, endpoint)
if err != nil {
return &httperror.HandlerError{http.StatusForbidden, "Permission denied to access endpoint", portainer.ErrEndpointAccessDenied}
}
2018-05-06 07:15:57 +00:00
params := &webSocketExecRequestParams{
endpoint: endpoint,
execID: execID,
2018-05-06 07:15:57 +00:00
nodeName: r.FormValue("nodeName"),
2016-12-18 05:21:29 +00:00
}
2018-05-06 07:15:57 +00:00
err = handler.handleRequest(w, r, params)
if err != nil {
return &httperror.HandlerError{http.StatusInternalServerError, "An error occured during websocket exec operation", err}
2016-12-18 05:21:29 +00:00
}
return nil
2016-12-18 05:21:29 +00:00
}
func (handler *Handler) handleRequest(w http.ResponseWriter, r *http.Request, params *webSocketExecRequestParams) error {
r.Header.Del("Origin")
if params.nodeName != "" || params.endpoint.Type == portainer.AgentOnDockerEnvironment {
2018-05-06 07:15:57 +00:00
return handler.proxyWebsocketRequest(w, r, params)
}
2018-05-06 07:15:57 +00:00
websocketConn, err := handler.connectionUpgrader.Upgrade(w, r, nil)
if err != nil {
2018-05-06 07:15:57 +00:00
return err
}
2018-05-06 07:15:57 +00:00
defer websocketConn.Close()
2018-05-06 07:15:57 +00:00
return hijackExecStartOperation(websocketConn, params.endpoint, params.execID)
}
func (handler *Handler) proxyWebsocketRequest(w http.ResponseWriter, r *http.Request, params *webSocketExecRequestParams) error {
2018-05-06 07:15:57 +00:00
agentURL, err := url.Parse(params.endpoint.URL)
if err != nil {
2018-05-06 07:15:57 +00:00
return err
}
2018-05-06 07:15:57 +00:00
agentURL.Scheme = "ws"
proxy := websocketproxy.NewProxy(agentURL)
2018-05-06 07:15:57 +00:00
if params.endpoint.TLSConfig.TLS || params.endpoint.TLSConfig.TLSSkipVerify {
agentURL.Scheme = "wss"
proxy.Dialer = &websocket.Dialer{
TLSClientConfig: &tls.Config{
InsecureSkipVerify: params.endpoint.TLSConfig.TLSSkipVerify,
},
}
}
2018-05-06 07:15:57 +00:00
signature, err := handler.SignatureService.Sign(portainer.PortainerAgentSignatureMessage)
if err != nil {
return err
}
2018-05-06 07:15:57 +00:00
proxy.Director = func(incoming *http.Request, out http.Header) {
out.Set(portainer.PortainerAgentSignatureHeader, signature)
out.Set(portainer.PortainerAgentTargetHeader, params.nodeName)
}
proxy.ServeHTTP(w, r)
return nil
}
func hijackExecStartOperation(websocketConn *websocket.Conn, endpoint *portainer.Endpoint, execID string) error {
dial, err := createDial(endpoint)
if err != nil {
return err
}
// When we set up a TCP connection for hijack, there could be long periods
// of inactivity (a long running command with no output) that in certain
// network setups may cause ECONNTIMEOUT, leaving the client in an unknown
// state. Setting TCP KeepAlive on the socket connection will prohibit
// ECONNTIMEOUT unless the socket connection truly is broken
if tcpConn, ok := dial.(*net.TCPConn); ok {
tcpConn.SetKeepAlive(true)
tcpConn.SetKeepAlivePeriod(30 * time.Second)
}
2018-05-06 07:15:57 +00:00
httpConn := httputil.NewClientConn(dial, nil)
defer httpConn.Close()
execStartRequest, err := createExecStartRequest(execID)
if err != nil {
return err
}
2018-05-06 07:15:57 +00:00
err = hijackRequest(websocketConn, httpConn, execStartRequest)
if err != nil {
return err
}
return nil
}
2018-05-06 07:15:57 +00:00
func createDial(endpoint *portainer.Endpoint) (net.Conn, error) {
url, err := url.Parse(endpoint.URL)
if err != nil {
return nil, err
}
2018-07-20 09:02:06 +00:00
host := url.Host
if url.Scheme == "unix" || url.Scheme == "npipe" {
2018-05-06 07:15:57 +00:00
host = url.Path
}
2018-07-20 09:02:06 +00:00
var (
dial net.Conn
dialErr error
)
2018-05-06 07:15:57 +00:00
if endpoint.TLSConfig.TLS {
tlsConfig, err := crypto.CreateTLSConfigurationFromDisk(endpoint.TLSConfig.TLSCACertPath, endpoint.TLSConfig.TLSCertPath, endpoint.TLSConfig.TLSKeyPath, endpoint.TLSConfig.TLSSkipVerify)
2018-05-06 07:15:57 +00:00
if err != nil {
return nil, err
}
2018-07-20 09:02:06 +00:00
dial, dialErr = tls.Dial(url.Scheme, host, tlsConfig)
} else {
if url.Scheme == "npipe" {
dial, dialErr = createWinDial(host)
} else {
dial, dialErr = net.Dial(url.Scheme, host)
}
2018-05-06 07:15:57 +00:00
}
2018-07-20 09:02:06 +00:00
return dial, dialErr
2018-05-06 07:15:57 +00:00
}
func createExecStartRequest(execID string) (*http.Request, error) {
execStartOperationPayload := &execStartOperationPayload{
Tty: true,
Detach: false,
}
encodedBody := bytes.NewBuffer(nil)
err := json.NewEncoder(encodedBody).Encode(execStartOperationPayload)
if err != nil {
return nil, err
}
2018-05-06 07:15:57 +00:00
request, err := http.NewRequest("POST", "/exec/"+execID+"/start", encodedBody)
if err != nil {
return nil, err
}
request.Header.Set("Content-Type", "application/json")
request.Header.Set("Connection", "Upgrade")
request.Header.Set("Upgrade", "tcp")
return request, nil
}
func hijackRequest(websocketConn *websocket.Conn, httpConn *httputil.ClientConn, request *http.Request) error {
// Server hijacks the connection, error 'connection closed' expected
resp, err := httpConn.Do(request)
if err != httputil.ErrPersistEOF {
if err != nil {
return err
}
if resp.StatusCode != http.StatusSwitchingProtocols {
resp.Body.Close()
return fmt.Errorf("unable to upgrade to tcp, received %d", resp.StatusCode)
}
2018-05-06 07:15:57 +00:00
}
tcpConn, brw := httpConn.Hijack()
defer tcpConn.Close()
errorChan := make(chan error, 1)
go streamFromTCPConnToWebsocketConn(websocketConn, brw, errorChan)
go streamFromWebsocketConnToTCPConn(websocketConn, tcpConn, errorChan)
err = <-errorChan
if websocket.IsUnexpectedCloseError(err, websocket.CloseGoingAway, websocket.CloseNoStatusReceived) {
return err
}
return nil
}
2018-05-06 07:15:57 +00:00
func streamFromWebsocketConnToTCPConn(websocketConn *websocket.Conn, tcpConn net.Conn, errorChan chan error) {
for {
_, in, err := websocketConn.ReadMessage()
if err != nil {
errorChan <- err
break
}
2018-05-06 07:15:57 +00:00
_, err = tcpConn.Write(in)
if err != nil {
errorChan <- err
break
}
}
2018-05-06 07:15:57 +00:00
}
func streamFromTCPConnToWebsocketConn(websocketConn *websocket.Conn, br *bufio.Reader, errorChan chan error) {
for {
out := make([]byte, 1024)
_, err := br.Read(out)
if err != nil {
errorChan <- err
break
}
2018-05-06 07:15:57 +00:00
err = websocketConn.WriteMessage(websocket.TextMessage, out)
if err != nil {
errorChan <- err
break
}
}
}