unkin-agent
3b69b58ba3
- set Cache-Control no-store and Vary on rewritten responses - accept only http/https X-Forwarded-Proto - reject invalid Host headers and JSON-escape the injected base URL - route remote HEAD and serve rewritten HEAD via the GET path - classify snupkg, readme and icon as immutable
326 lines
9.7 KiB
Go
326 lines
9.7 KiB
Go
package v1
|
|
|
|
import (
|
|
"bytes"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"log/slog"
|
|
"net"
|
|
"net/http"
|
|
"strconv"
|
|
"strings"
|
|
|
|
"github.com/go-chi/chi/v5"
|
|
|
|
v2 "git.unkin.net/unkin/artifactapi/internal/api/v2"
|
|
"git.unkin.net/unkin/artifactapi/internal/database"
|
|
"git.unkin.net/unkin/artifactapi/internal/provider"
|
|
"git.unkin.net/unkin/artifactapi/internal/proxy"
|
|
"git.unkin.net/unkin/artifactapi/internal/storage"
|
|
"git.unkin.net/unkin/artifactapi/internal/virtual"
|
|
"git.unkin.net/unkin/artifactapi/pkg/models"
|
|
)
|
|
|
|
type ProxyHandler struct {
|
|
engine *proxy.Engine
|
|
virtualEngine *virtual.Engine
|
|
db *database.DB
|
|
store *storage.S3
|
|
local *v2.LocalHandler
|
|
cas *storage.CAS
|
|
}
|
|
|
|
func NewProxyHandler(engine *proxy.Engine, virtualEngine *virtual.Engine, db *database.DB, store *storage.S3, local *v2.LocalHandler) *ProxyHandler {
|
|
return &ProxyHandler{
|
|
engine: engine,
|
|
virtualEngine: virtualEngine,
|
|
db: db,
|
|
store: store,
|
|
local: local,
|
|
cas: storage.NewCAS(store),
|
|
}
|
|
}
|
|
|
|
func (h *ProxyHandler) Routes() chi.Router {
|
|
r := chi.NewRouter()
|
|
r.Get("/remote/{remoteName}/*", h.handleProxy)
|
|
r.Head("/remote/{remoteName}/*", h.handleProxyHead)
|
|
r.Get("/local/{localName}/*", h.handleLocal)
|
|
r.Get("/virtual/{virtualName}/*", h.handleVirtual)
|
|
return r
|
|
}
|
|
|
|
// DockerV2Routes mounts the Docker Registry HTTP API V2. Reads (GET/HEAD)
|
|
// dispatch to a local registry implementation for local docker repos and fall
|
|
// through to the upstream proxy otherwise; writes (POST/PATCH/PUT/DELETE) are
|
|
// only valid for local docker repos and drive push.
|
|
func (h *ProxyHandler) DockerV2Routes() chi.Router {
|
|
r := chi.NewRouter()
|
|
r.Get("/", h.handleDockerPing)
|
|
r.Head("/", h.handleDockerPing)
|
|
r.Get("/{remoteName}/*", h.dockerGet)
|
|
r.Head("/{remoteName}/*", h.dockerHead)
|
|
r.Post("/{remoteName}/*", h.dockerPost)
|
|
r.Patch("/{remoteName}/*", h.dockerPatch)
|
|
r.Put("/{remoteName}/*", h.dockerPut)
|
|
r.Delete("/{remoteName}/*", h.dockerDelete)
|
|
return r
|
|
}
|
|
|
|
func (h *ProxyHandler) handleDockerPing(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Docker-Distribution-Api-Version", "registry/2.0")
|
|
w.WriteHeader(http.StatusOK)
|
|
}
|
|
|
|
func (h *ProxyHandler) handleProxy(w http.ResponseWriter, r *http.Request) {
|
|
remoteName := chi.URLParam(r, "remoteName")
|
|
path := chi.URLParam(r, "*")
|
|
|
|
remote, err := h.db.GetRemote(r.Context(), remoteName)
|
|
if err != nil {
|
|
http.Error(w, fmt.Sprintf("remote %q not found", remoteName), http.StatusNotFound)
|
|
return
|
|
}
|
|
|
|
prov, err := provider.Get(remote.PackageType)
|
|
if err != nil {
|
|
http.Error(w, fmt.Sprintf("no provider for %q", remote.PackageType), http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
// Metadata-only remotes (e.g. github_rpm) synthesize their own responses and
|
|
// redirect package downloads to a backend remote instead of proxying bytes.
|
|
if rs, ok := prov.(provider.RemoteServer); ok {
|
|
proxyBaseURL := fmt.Sprintf("%s://%s", scheme(r), r.Host)
|
|
if rs.ServeRemote(w, r, *remote, path, proxyBaseURL, h.db) {
|
|
return
|
|
}
|
|
}
|
|
|
|
result, err := h.engine.Fetch(r.Context(), *remote, path, prov, r.Header)
|
|
if err != nil {
|
|
var proxyErr *proxy.ProxyError
|
|
if errors.As(err, &proxyErr) {
|
|
http.Error(w, proxyErr.Message, proxyErr.Status)
|
|
return
|
|
}
|
|
slog.Error("proxy fetch failed", "remote", remoteName, "path", path, "error", err)
|
|
http.Error(w, "bad gateway", http.StatusBadGateway)
|
|
return
|
|
}
|
|
defer result.Reader.Close()
|
|
|
|
var body io.Reader = result.Reader
|
|
if sr, ok := serveRewriter(prov, path); ok {
|
|
raw, ok := rewriteServed(w, r, sr, *remote, result.Reader)
|
|
if !ok {
|
|
return
|
|
}
|
|
body, result.Size = bytes.NewReader(raw), int64(len(raw))
|
|
}
|
|
|
|
w.Header().Set("Content-Type", result.ContentType)
|
|
w.Header().Set("X-Artifact-Source", result.Source)
|
|
if result.Size > 0 {
|
|
w.Header().Set("X-Artifact-Size", fmt.Sprintf("%d", result.Size))
|
|
}
|
|
w.WriteHeader(http.StatusOK)
|
|
io.Copy(w, body)
|
|
}
|
|
|
|
func (h *ProxyHandler) handleProxyHead(w http.ResponseWriter, r *http.Request) {
|
|
remoteName := chi.URLParam(r, "remoteName")
|
|
path := chi.URLParam(r, "*")
|
|
|
|
remote, err := h.db.GetRemote(r.Context(), remoteName)
|
|
if err != nil {
|
|
http.Error(w, fmt.Sprintf("remote %q not found", remoteName), http.StatusNotFound)
|
|
return
|
|
}
|
|
|
|
prov, err := provider.Get(remote.PackageType)
|
|
if err != nil {
|
|
http.Error(w, fmt.Sprintf("no provider for %q", remote.PackageType), http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
// Rewritten bodies differ in size from the cached object, so HEAD takes the
|
|
// GET path; net/http discards the body for HEAD.
|
|
if _, ok := serveRewriter(prov, path); ok {
|
|
h.handleProxy(w, r)
|
|
return
|
|
}
|
|
|
|
result, err := h.engine.Head(r.Context(), *remote, path, prov)
|
|
if err != nil {
|
|
var proxyErr *proxy.ProxyError
|
|
if errors.As(err, &proxyErr) {
|
|
http.Error(w, proxyErr.Message, proxyErr.Status)
|
|
return
|
|
}
|
|
slog.Error("proxy head failed", "remote", remoteName, "path", path, "error", err)
|
|
http.Error(w, "bad gateway", http.StatusBadGateway)
|
|
return
|
|
}
|
|
|
|
w.Header().Set("Content-Type", result.ContentType)
|
|
w.Header().Set("X-Artifact-Source", result.Source)
|
|
if result.Size > 0 {
|
|
w.Header().Set("Content-Length", fmt.Sprintf("%d", result.Size))
|
|
}
|
|
w.WriteHeader(http.StatusOK)
|
|
}
|
|
|
|
func (h *ProxyHandler) handleVirtual(w http.ResponseWriter, r *http.Request) {
|
|
virtualName := chi.URLParam(r, "virtualName")
|
|
path := chi.URLParam(r, "*")
|
|
|
|
virt, err := h.db.GetVirtual(r.Context(), virtualName)
|
|
if err != nil {
|
|
http.Error(w, fmt.Sprintf("virtual %q not found", virtualName), http.StatusNotFound)
|
|
return
|
|
}
|
|
|
|
proxyBaseURL := fmt.Sprintf("%s://%s", scheme(r), r.Host)
|
|
|
|
loc, ok, err := h.virtualEngine.MemberRedirect(r.Context(), *virt, path, r.URL.RawQuery, proxyBaseURL)
|
|
if err != nil {
|
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
|
return
|
|
}
|
|
if ok {
|
|
http.Redirect(w, r, loc, http.StatusFound)
|
|
return
|
|
}
|
|
|
|
body, contentType, err := h.virtualEngine.Fetch(r.Context(), *virt, path, proxyBaseURL)
|
|
if errors.Is(err, virtual.ErrNotFound) {
|
|
http.Error(w, "not found", http.StatusNotFound)
|
|
return
|
|
}
|
|
if err != nil {
|
|
slog.Error("virtual fetch failed", "virtual", virtualName, "path", path, "error", err)
|
|
http.Error(w, "bad gateway", http.StatusBadGateway)
|
|
return
|
|
}
|
|
|
|
w.Header().Set("Content-Type", contentType)
|
|
w.Header().Set("X-Artifact-Source", "virtual")
|
|
w.WriteHeader(http.StatusOK)
|
|
w.Write(body)
|
|
}
|
|
|
|
func (h *ProxyHandler) handleLocal(w http.ResponseWriter, r *http.Request) {
|
|
localName := chi.URLParam(r, "localName")
|
|
path := chi.URLParam(r, "*")
|
|
|
|
remote, err := h.db.GetRemote(r.Context(), localName)
|
|
if err != nil {
|
|
http.Error(w, fmt.Sprintf("local %q not found", localName), http.StatusNotFound)
|
|
return
|
|
}
|
|
|
|
prov, _ := provider.Get(remote.PackageType)
|
|
if indexer, ok := prov.(provider.LocalIndexer); ok {
|
|
if indexer.ServeLocalIndex(w, r, h.db, remote.Name, path) {
|
|
return
|
|
}
|
|
}
|
|
|
|
h.serveLocalFile(w, r, localName, path)
|
|
}
|
|
|
|
func (h *ProxyHandler) serveLocalFile(w http.ResponseWriter, r *http.Request, repoName, path string) {
|
|
file, err := h.db.GetLocalFile(r.Context(), repoName, path)
|
|
if err != nil {
|
|
slog.Error("local file lookup failed", "repo", repoName, "path", path, "error", err)
|
|
http.Error(w, "internal error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
if file == nil {
|
|
http.Error(w, "not found", http.StatusNotFound)
|
|
return
|
|
}
|
|
|
|
s3Key := storage.BlobKey(file.ContentHash[len("sha256:"):])
|
|
reader, info, err := h.store.Download(r.Context(), s3Key)
|
|
if err != nil {
|
|
slog.Error("local file download failed", "repo", repoName, "path", path, "error", err)
|
|
http.Error(w, "internal error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
defer reader.Close()
|
|
|
|
w.Header().Set("Content-Type", info.ContentType)
|
|
w.Header().Set("Content-Length", fmt.Sprintf("%d", info.Size))
|
|
w.Header().Set("X-Artifact-Source", "local")
|
|
w.WriteHeader(http.StatusOK)
|
|
io.Copy(w, reader)
|
|
}
|
|
|
|
func scheme(r *http.Request) string {
|
|
if r.TLS != nil {
|
|
return "https"
|
|
}
|
|
if fwd := r.Header.Get("X-Forwarded-Proto"); fwd == "http" || fwd == "https" {
|
|
return fwd
|
|
}
|
|
return "http"
|
|
}
|
|
|
|
// rewriteServed rewrites a cached body for the requesting host and marks the
|
|
// response uncacheable by shared caches, since it varies per Host.
|
|
func rewriteServed(w http.ResponseWriter, r *http.Request, sr provider.ServeRewriter, remote models.Remote, src io.Reader) ([]byte, bool) {
|
|
if !validHost(r.Host) {
|
|
http.Error(w, "invalid host header", http.StatusBadRequest)
|
|
return nil, false
|
|
}
|
|
raw, err := io.ReadAll(src)
|
|
if err != nil {
|
|
http.Error(w, "bad gateway", http.StatusBadGateway)
|
|
return nil, false
|
|
}
|
|
raw = sr.RewriteServed(raw, remote, fmt.Sprintf("%s://%s", scheme(r), r.Host))
|
|
w.Header().Set("Cache-Control", "no-store")
|
|
w.Header().Set("Vary", "Host, X-Forwarded-Proto")
|
|
w.Header().Set("Content-Length", strconv.Itoa(len(raw)))
|
|
return raw, true
|
|
}
|
|
|
|
func serveRewriter(prov provider.Provider, path string) (provider.ServeRewriter, bool) {
|
|
sr, ok := prov.(provider.ServeRewriter)
|
|
return sr, ok && prov.Classify(path) == provider.Mutable
|
|
}
|
|
|
|
// validHost accepts host[:port] where host is a DNS name or IP literal.
|
|
func validHost(hostport string) bool {
|
|
host, port := hostport, ""
|
|
if h, p, err := net.SplitHostPort(hostport); err == nil {
|
|
host, port = h, p
|
|
} else if strings.HasPrefix(hostport, "[") {
|
|
return strings.HasSuffix(hostport, "]") && net.ParseIP(hostport[1:len(hostport)-1]) != nil
|
|
}
|
|
if port != "" {
|
|
if n, err := strconv.Atoi(port); err != nil || n < 1 || n > 65535 {
|
|
return false
|
|
}
|
|
}
|
|
if net.ParseIP(host) != nil {
|
|
return true
|
|
}
|
|
if strings.HasPrefix(hostport, "[") {
|
|
return false
|
|
}
|
|
if host == "" || len(host) > 253 {
|
|
return false
|
|
}
|
|
for _, label := range strings.Split(strings.TrimSuffix(host, "."), ".") {
|
|
if label == "" || len(label) > 63 || label[0] == '-' || label[len(label)-1] == '-' ||
|
|
strings.Trim(strings.ToLower(label), "abcdefghijklmnopqrstuvwxyz0123456789-_") != "" {
|
|
return false
|
|
}
|
|
}
|
|
return true
|
|
}
|