mirror of
https://github.com/yusing/godoxy.git
synced 2026-03-25 10:31:30 +01:00
feat(socket-proxy): implement Docker socket proxy and related configurations
- Updated Dockerfile and Makefile for socket-proxy build. - Modified go.mod to include necessary dependencies. - Updated CI workflows for socket-proxy integration. - Better module isolation - Code refactor
This commit is contained in:
yusing
@@ -1,13 +1,13 @@
|
||||
package handler
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
"github.com/yusing/go-proxy/internal/net/gphttp"
|
||||
"github.com/yusing/go-proxy/internal/watcher/health"
|
||||
"github.com/yusing/go-proxy/internal/watcher/health/monitor"
|
||||
)
|
||||
@@ -73,5 +73,7 @@ func CheckHealth(w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
gphttp.RespondJSON(w, r, result)
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.WriteHeader(http.StatusOK)
|
||||
json.NewEncoder(w).Encode(result)
|
||||
}
|
||||
|
||||
@@ -1,414 +0,0 @@
|
||||
package handler
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
|
||||
"github.com/yusing/go-proxy/agent/pkg/env"
|
||||
)
|
||||
|
||||
func TestNewDockerHandler(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
method string
|
||||
path string
|
||||
envSetup func()
|
||||
wantStatusCode int
|
||||
}{
|
||||
{
|
||||
name: "GET _ping allowed by default",
|
||||
method: http.MethodGet,
|
||||
path: "/_ping",
|
||||
envSetup: func() {},
|
||||
wantStatusCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "GET version allowed by default",
|
||||
method: http.MethodGet,
|
||||
path: "/version",
|
||||
envSetup: func() {},
|
||||
wantStatusCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "GET containers allowed when enabled",
|
||||
method: http.MethodGet,
|
||||
path: "/containers",
|
||||
envSetup: func() {
|
||||
env.DockerContainers = true
|
||||
},
|
||||
wantStatusCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "GET containers not allowed when disabled",
|
||||
method: http.MethodGet,
|
||||
path: "/containers",
|
||||
envSetup: func() {
|
||||
env.DockerContainers = false
|
||||
},
|
||||
wantStatusCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
name: "POST not allowed by default",
|
||||
method: http.MethodPost,
|
||||
path: "/_ping",
|
||||
envSetup: func() {
|
||||
env.DockerPost = false
|
||||
},
|
||||
wantStatusCode: http.StatusMethodNotAllowed,
|
||||
},
|
||||
{
|
||||
name: "POST allowed when enabled",
|
||||
method: http.MethodPost,
|
||||
path: "/_ping",
|
||||
envSetup: func() {
|
||||
env.DockerPost = true
|
||||
env.DockerPing = true
|
||||
},
|
||||
wantStatusCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "Container restart not allowed when disabled",
|
||||
method: http.MethodPost,
|
||||
path: "/containers/test-container/restart",
|
||||
envSetup: func() {
|
||||
env.DockerPost = true
|
||||
env.DockerContainers = true
|
||||
env.DockerRestarts = false
|
||||
},
|
||||
wantStatusCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
name: "Container restart allowed when enabled",
|
||||
method: http.MethodPost,
|
||||
path: "/containers/test-container/restart",
|
||||
envSetup: func() {
|
||||
env.DockerPost = true
|
||||
env.DockerContainers = true
|
||||
env.DockerRestarts = true
|
||||
},
|
||||
wantStatusCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "Container start not allowed when disabled",
|
||||
method: http.MethodPost,
|
||||
path: "/containers/test-container/start",
|
||||
envSetup: func() {
|
||||
env.DockerPost = true
|
||||
env.DockerContainers = true
|
||||
env.DockerStart = false
|
||||
},
|
||||
wantStatusCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
name: "Container start allowed when enabled",
|
||||
method: http.MethodPost,
|
||||
path: "/containers/test-container/start",
|
||||
envSetup: func() {
|
||||
env.DockerPost = true
|
||||
env.DockerContainers = true
|
||||
env.DockerStart = true
|
||||
},
|
||||
wantStatusCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "Container stop not allowed when disabled",
|
||||
method: http.MethodPost,
|
||||
path: "/containers/test-container/stop",
|
||||
envSetup: func() {
|
||||
env.DockerPost = true
|
||||
env.DockerContainers = true
|
||||
env.DockerStop = false
|
||||
},
|
||||
wantStatusCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
name: "Container stop allowed when enabled",
|
||||
method: http.MethodPost,
|
||||
path: "/containers/test-container/stop",
|
||||
envSetup: func() {
|
||||
env.DockerPost = true
|
||||
env.DockerContainers = true
|
||||
env.DockerStop = true
|
||||
},
|
||||
wantStatusCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "Versioned API paths work",
|
||||
method: http.MethodGet,
|
||||
path: "/v1.41/version",
|
||||
envSetup: func() {
|
||||
env.DockerVersion = true
|
||||
},
|
||||
wantStatusCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "PUT method not allowed",
|
||||
method: http.MethodPut,
|
||||
path: "/version",
|
||||
envSetup: func() {
|
||||
env.DockerVersion = true
|
||||
},
|
||||
wantStatusCode: http.StatusMethodNotAllowed,
|
||||
},
|
||||
{
|
||||
name: "DELETE method not allowed",
|
||||
method: http.MethodDelete,
|
||||
path: "/version",
|
||||
envSetup: func() {
|
||||
env.DockerVersion = true
|
||||
},
|
||||
wantStatusCode: http.StatusMethodNotAllowed,
|
||||
},
|
||||
}
|
||||
|
||||
// Save original env values to restore after tests
|
||||
originalContainers := env.DockerContainers
|
||||
originalRestarts := env.DockerRestarts
|
||||
originalStart := env.DockerStart
|
||||
originalStop := env.DockerStop
|
||||
originalPost := env.DockerPost
|
||||
originalPing := env.DockerPing
|
||||
originalVersion := env.DockerVersion
|
||||
|
||||
defer func() {
|
||||
// Restore original values
|
||||
env.DockerContainers = originalContainers
|
||||
env.DockerRestarts = originalRestarts
|
||||
env.DockerStart = originalStart
|
||||
env.DockerStop = originalStop
|
||||
env.DockerPost = originalPost
|
||||
env.DockerPing = originalPing
|
||||
env.DockerVersion = originalVersion
|
||||
}()
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
// Setup environment for this test
|
||||
tt.envSetup()
|
||||
|
||||
// Create test handler that will record the response for verification
|
||||
dockerHandler := NewDockerHandler()
|
||||
|
||||
// Test server to capture the response
|
||||
recorder := httptest.NewRecorder()
|
||||
|
||||
// Create request
|
||||
req, err := http.NewRequest(tt.method, tt.path, nil)
|
||||
if err != nil {
|
||||
t.Fatalf("Failed to create request: %v", err)
|
||||
}
|
||||
|
||||
// Process the request
|
||||
dockerHandler.ServeHTTP(recorder, req)
|
||||
|
||||
// Check response
|
||||
if recorder.Code != tt.wantStatusCode {
|
||||
t.Errorf("Expected status code %d, got %d",
|
||||
tt.wantStatusCode, recorder.Code)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// This test focuses on checking that all the path prefix handling works correctly
|
||||
func TestNewDockerHandler_PathHandling(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
path string
|
||||
envVarName string
|
||||
envVarValue bool
|
||||
method string
|
||||
wantAllowed bool
|
||||
}{
|
||||
{"Container path", "/containers/json", "DockerContainers", true, http.MethodGet, true},
|
||||
{"Container path disabled", "/containers/json", "DockerContainers", false, http.MethodGet, false},
|
||||
|
||||
{"Auth path", "/auth", "DockerAuth", true, http.MethodGet, true},
|
||||
{"Auth path disabled", "/auth", "DockerAuth", false, http.MethodGet, false},
|
||||
|
||||
{"Build path", "/build", "DockerBuild", true, http.MethodGet, true},
|
||||
{"Build path disabled", "/build", "DockerBuild", false, http.MethodGet, false},
|
||||
|
||||
{"Commit path", "/commit", "DockerCommit", true, http.MethodGet, true},
|
||||
{"Commit path disabled", "/commit", "DockerCommit", false, http.MethodGet, false},
|
||||
|
||||
{"Configs path", "/configs", "DockerConfigs", true, http.MethodGet, true},
|
||||
{"Configs path disabled", "/configs", "DockerConfigs", false, http.MethodGet, false},
|
||||
|
||||
{"Distribution path", "/distribution", "DockerDistribution", true, http.MethodGet, true},
|
||||
{"Distribution path disabled", "/distribution", "DockerDistribution", false, http.MethodGet, false},
|
||||
|
||||
{"Events path", "/events", "DockerEvents", true, http.MethodGet, true},
|
||||
{"Events path disabled", "/events", "DockerEvents", false, http.MethodGet, false},
|
||||
|
||||
{"Exec path", "/exec", "DockerExec", true, http.MethodGet, true},
|
||||
{"Exec path disabled", "/exec", "DockerExec", false, http.MethodGet, false},
|
||||
|
||||
{"Grpc path", "/grpc", "DockerGrpc", true, http.MethodGet, true},
|
||||
{"Grpc path disabled", "/grpc", "DockerGrpc", false, http.MethodGet, false},
|
||||
|
||||
{"Images path", "/images", "DockerImages", true, http.MethodGet, true},
|
||||
{"Images path disabled", "/images", "DockerImages", false, http.MethodGet, false},
|
||||
|
||||
{"Info path", "/info", "DockerInfo", true, http.MethodGet, true},
|
||||
{"Info path disabled", "/info", "DockerInfo", false, http.MethodGet, false},
|
||||
|
||||
{"Networks path", "/networks", "DockerNetworks", true, http.MethodGet, true},
|
||||
{"Networks path disabled", "/networks", "DockerNetworks", false, http.MethodGet, false},
|
||||
|
||||
{"Nodes path", "/nodes", "DockerNodes", true, http.MethodGet, true},
|
||||
{"Nodes path disabled", "/nodes", "DockerNodes", false, http.MethodGet, false},
|
||||
|
||||
{"Plugins path", "/plugins", "DockerPlugins", true, http.MethodGet, true},
|
||||
{"Plugins path disabled", "/plugins", "DockerPlugins", false, http.MethodGet, false},
|
||||
|
||||
{"Secrets path", "/secrets", "DockerSecrets", true, http.MethodGet, true},
|
||||
{"Secrets path disabled", "/secrets", "DockerSecrets", false, http.MethodGet, false},
|
||||
|
||||
{"Services path", "/services", "DockerServices", true, http.MethodGet, true},
|
||||
{"Services path disabled", "/services", "DockerServices", false, http.MethodGet, false},
|
||||
|
||||
{"Session path", "/session", "DockerSession", true, http.MethodGet, true},
|
||||
{"Session path disabled", "/session", "DockerSession", false, http.MethodGet, false},
|
||||
|
||||
{"Swarm path", "/swarm", "DockerSwarm", true, http.MethodGet, true},
|
||||
{"Swarm path disabled", "/swarm", "DockerSwarm", false, http.MethodGet, false},
|
||||
|
||||
{"System path", "/system", "DockerSystem", true, http.MethodGet, true},
|
||||
{"System path disabled", "/system", "DockerSystem", false, http.MethodGet, false},
|
||||
|
||||
{"Tasks path", "/tasks", "DockerTasks", true, http.MethodGet, true},
|
||||
{"Tasks path disabled", "/tasks", "DockerTasks", false, http.MethodGet, false},
|
||||
|
||||
{"Volumes path", "/volumes", "DockerVolumes", true, http.MethodGet, true},
|
||||
{"Volumes path disabled", "/volumes", "DockerVolumes", false, http.MethodGet, false},
|
||||
|
||||
// Test versioned paths
|
||||
{"Versioned auth", "/v1.41/auth", "DockerAuth", true, http.MethodGet, true},
|
||||
{"Versioned auth disabled", "/v1.41/auth", "DockerAuth", false, http.MethodGet, false},
|
||||
}
|
||||
|
||||
defer func() {
|
||||
// Restore original env values
|
||||
env.Load()
|
||||
}()
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
// Reset all Docker* env vars to false for this test
|
||||
env.Load()
|
||||
|
||||
// Enable POST for all these tests
|
||||
env.DockerPost = true
|
||||
|
||||
// Set the specific env var for this test
|
||||
switch tt.envVarName {
|
||||
case "DockerContainers":
|
||||
env.DockerContainers = tt.envVarValue
|
||||
case "DockerRestarts":
|
||||
env.DockerRestarts = tt.envVarValue
|
||||
case "DockerStart":
|
||||
env.DockerStart = tt.envVarValue
|
||||
case "DockerStop":
|
||||
env.DockerStop = tt.envVarValue
|
||||
case "DockerAuth":
|
||||
env.DockerAuth = tt.envVarValue
|
||||
case "DockerBuild":
|
||||
env.DockerBuild = tt.envVarValue
|
||||
case "DockerCommit":
|
||||
env.DockerCommit = tt.envVarValue
|
||||
case "DockerConfigs":
|
||||
env.DockerConfigs = tt.envVarValue
|
||||
case "DockerDistribution":
|
||||
env.DockerDistribution = tt.envVarValue
|
||||
case "DockerEvents":
|
||||
env.DockerEvents = tt.envVarValue
|
||||
case "DockerExec":
|
||||
env.DockerExec = tt.envVarValue
|
||||
case "DockerGrpc":
|
||||
env.DockerGrpc = tt.envVarValue
|
||||
case "DockerImages":
|
||||
env.DockerImages = tt.envVarValue
|
||||
case "DockerInfo":
|
||||
env.DockerInfo = tt.envVarValue
|
||||
case "DockerNetworks":
|
||||
env.DockerNetworks = tt.envVarValue
|
||||
case "DockerNodes":
|
||||
env.DockerNodes = tt.envVarValue
|
||||
case "DockerPlugins":
|
||||
env.DockerPlugins = tt.envVarValue
|
||||
case "DockerSecrets":
|
||||
env.DockerSecrets = tt.envVarValue
|
||||
case "DockerServices":
|
||||
env.DockerServices = tt.envVarValue
|
||||
case "DockerSession":
|
||||
env.DockerSession = tt.envVarValue
|
||||
case "DockerSwarm":
|
||||
env.DockerSwarm = tt.envVarValue
|
||||
case "DockerSystem":
|
||||
env.DockerSystem = tt.envVarValue
|
||||
case "DockerTasks":
|
||||
env.DockerTasks = tt.envVarValue
|
||||
case "DockerVolumes":
|
||||
env.DockerVolumes = tt.envVarValue
|
||||
default:
|
||||
t.Fatalf("Unknown env var: %s", tt.envVarName)
|
||||
}
|
||||
|
||||
// Create test handler
|
||||
dockerHandler := NewDockerHandler()
|
||||
|
||||
// Test server to capture the response
|
||||
recorder := httptest.NewRecorder()
|
||||
|
||||
// Create request
|
||||
req, err := http.NewRequest(tt.method, tt.path, nil)
|
||||
if err != nil {
|
||||
t.Fatalf("Failed to create request: %v", err)
|
||||
}
|
||||
|
||||
// Process the request
|
||||
dockerHandler.ServeHTTP(recorder, req)
|
||||
|
||||
// Check if the status indicates if the path is allowed or not
|
||||
isAllowed := recorder.Code != http.StatusForbidden
|
||||
if isAllowed != tt.wantAllowed {
|
||||
t.Errorf("Path %s with env %s=%v: got allowed=%v, want allowed=%v (status=%d)",
|
||||
tt.path, tt.envVarName, tt.envVarValue, isAllowed, tt.wantAllowed, recorder.Code)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestNewDockerHandlerWithMockDocker mocks the Docker API to test the actual HTTP handler behavior
|
||||
// This is a more comprehensive test that verifies the full request/response chain
|
||||
func TestNewDockerHandlerWithMockDocker(t *testing.T) {
|
||||
// Set up environment
|
||||
env.DockerContainers = true
|
||||
env.DockerPost = true
|
||||
|
||||
// Create the handler
|
||||
handler := NewDockerHandler()
|
||||
|
||||
// Test a valid request
|
||||
req, _ := http.NewRequest(http.MethodGet, "/containers", nil)
|
||||
recorder := httptest.NewRecorder()
|
||||
handler.ServeHTTP(recorder, req)
|
||||
|
||||
if recorder.Code != http.StatusOK {
|
||||
t.Errorf("Expected status OK for /containers, got %d", recorder.Code)
|
||||
}
|
||||
|
||||
// Test a disallowed path
|
||||
env.DockerContainers = false
|
||||
handler = NewDockerHandler() // recreate with new env
|
||||
|
||||
req, _ = http.NewRequest(http.MethodGet, "/containers", nil)
|
||||
recorder = httptest.NewRecorder()
|
||||
handler.ServeHTTP(recorder, req)
|
||||
|
||||
if recorder.Code != http.StatusForbidden {
|
||||
t.Errorf("Expected status Forbidden for /containers when disabled, got %d", recorder.Code)
|
||||
}
|
||||
}
|
||||
@@ -1,38 +0,0 @@
|
||||
package handler
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"net/url"
|
||||
|
||||
"github.com/docker/docker/client"
|
||||
"github.com/yusing/go-proxy/internal/common"
|
||||
"github.com/yusing/go-proxy/internal/docker"
|
||||
"github.com/yusing/go-proxy/internal/logging"
|
||||
"github.com/yusing/go-proxy/internal/net/gphttp/reverseproxy"
|
||||
"github.com/yusing/go-proxy/internal/net/types"
|
||||
)
|
||||
|
||||
func serviceUnavailable(w http.ResponseWriter, r *http.Request) {
|
||||
http.Error(w, "docker socket is not available", http.StatusServiceUnavailable)
|
||||
}
|
||||
|
||||
func mockDockerSocketHandler() http.HandlerFunc {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.WriteHeader(http.StatusOK)
|
||||
w.Write([]byte("mock docker response"))
|
||||
})
|
||||
}
|
||||
|
||||
func DockerSocketHandler() http.HandlerFunc {
|
||||
dockerClient, err := docker.NewClient(common.DockerHostFromEnv)
|
||||
if err != nil {
|
||||
logging.Warn().Err(err).Msg("failed to connect to docker client")
|
||||
return serviceUnavailable
|
||||
}
|
||||
rp := reverseproxy.NewReverseProxy("docker", types.NewURL(&url.URL{
|
||||
Scheme: "http",
|
||||
Host: client.DummyHost,
|
||||
}), dockerClient.HTTPClient().Transport)
|
||||
|
||||
return rp.ServeHTTP
|
||||
}
|
||||
@@ -2,201 +2,35 @@ package handler
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"strings"
|
||||
|
||||
"github.com/gorilla/mux"
|
||||
"github.com/yusing/go-proxy/agent/pkg/agent"
|
||||
"github.com/yusing/go-proxy/agent/pkg/env"
|
||||
"github.com/yusing/go-proxy/internal/common"
|
||||
"github.com/yusing/go-proxy/internal/logging/memlogger"
|
||||
"github.com/yusing/go-proxy/internal/metrics/systeminfo"
|
||||
"github.com/yusing/go-proxy/internal/utils/strutils"
|
||||
"github.com/yusing/go-proxy/pkg"
|
||||
socketproxy "github.com/yusing/go-proxy/socketproxy/pkg"
|
||||
)
|
||||
|
||||
type ServeMux struct{ *http.ServeMux }
|
||||
|
||||
func (mux ServeMux) HandleMethods(methods, endpoint string, handler http.HandlerFunc) {
|
||||
for _, m := range strutils.CommaSeperatedList(methods) {
|
||||
mux.ServeMux.HandleFunc(m+" "+agent.APIEndpointBase+endpoint, handler)
|
||||
}
|
||||
func (mux ServeMux) HandleEndpoint(method, endpoint string, handler http.HandlerFunc) {
|
||||
mux.ServeMux.HandleFunc(method+" "+agent.APIEndpointBase+endpoint, handler)
|
||||
}
|
||||
|
||||
func (mux ServeMux) HandleFunc(endpoint string, handler http.HandlerFunc) {
|
||||
mux.ServeMux.HandleFunc(agent.APIEndpointBase+endpoint, handler)
|
||||
}
|
||||
|
||||
type NopWriteCloser struct {
|
||||
io.Writer
|
||||
}
|
||||
|
||||
func (NopWriteCloser) Close() error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func NewAgentHandler() http.Handler {
|
||||
mux := ServeMux{http.NewServeMux()}
|
||||
|
||||
mux.HandleFunc(agent.EndpointProxyHTTP+"/{path...}", ProxyHTTP)
|
||||
mux.HandleMethods("GET", agent.EndpointVersion, pkg.GetVersionHTTPHandler())
|
||||
mux.HandleMethods("GET", agent.EndpointName, func(w http.ResponseWriter, r *http.Request) {
|
||||
mux.HandleEndpoint("GET", agent.EndpointVersion, pkg.GetVersionHTTPHandler())
|
||||
mux.HandleEndpoint("GET", agent.EndpointName, func(w http.ResponseWriter, r *http.Request) {
|
||||
fmt.Fprint(w, env.AgentName)
|
||||
})
|
||||
mux.HandleMethods("GET", agent.EndpointHealth, CheckHealth)
|
||||
mux.HandleMethods("GET", agent.EndpointLogs, memlogger.HandlerFunc())
|
||||
mux.HandleMethods("GET", agent.EndpointSystemInfo, systeminfo.Poller.ServeHTTP)
|
||||
mux.ServeMux.HandleFunc("/", DockerSocketHandler())
|
||||
mux.HandleEndpoint("GET", agent.EndpointHealth, CheckHealth)
|
||||
mux.HandleEndpoint("GET", agent.EndpointSystemInfo, systeminfo.Poller.ServeHTTP)
|
||||
mux.ServeMux.HandleFunc("/", socketproxy.DockerSocketHandler())
|
||||
return mux
|
||||
}
|
||||
|
||||
func endpointNotAllowed(w http.ResponseWriter, _ *http.Request) {
|
||||
http.Error(w, "Endpoint not allowed", http.StatusForbidden)
|
||||
}
|
||||
|
||||
// ref: https://github.com/Tecnativa/docker-socket-proxy/blob/master/haproxy.cfg
|
||||
func NewDockerHandler() http.Handler {
|
||||
r := mux.NewRouter()
|
||||
var socketHandler http.HandlerFunc
|
||||
if common.IsTest {
|
||||
socketHandler = mockDockerSocketHandler()
|
||||
} else {
|
||||
socketHandler = DockerSocketHandler()
|
||||
}
|
||||
|
||||
const apiVersionPrefix = `/{version:(?:v[\d\.]+)?}`
|
||||
const containerPath = "/containers/{id:[a-zA-Z0-9_.-]+}"
|
||||
|
||||
allowedPaths := []string{}
|
||||
deniedPaths := []string{}
|
||||
|
||||
if env.DockerContainers {
|
||||
allowedPaths = append(allowedPaths, "/containers")
|
||||
if !env.DockerRestarts {
|
||||
deniedPaths = append(deniedPaths, containerPath+"/stop")
|
||||
deniedPaths = append(deniedPaths, containerPath+"/restart")
|
||||
deniedPaths = append(deniedPaths, containerPath+"/kill")
|
||||
}
|
||||
if !env.DockerStart {
|
||||
deniedPaths = append(deniedPaths, containerPath+"/start")
|
||||
}
|
||||
if !env.DockerStop && env.DockerRestarts {
|
||||
deniedPaths = append(deniedPaths, containerPath+"/stop")
|
||||
}
|
||||
}
|
||||
if env.DockerAuth {
|
||||
allowedPaths = append(allowedPaths, "/auth")
|
||||
}
|
||||
if env.DockerBuild {
|
||||
allowedPaths = append(allowedPaths, "/build")
|
||||
}
|
||||
if env.DockerCommit {
|
||||
allowedPaths = append(allowedPaths, "/commit")
|
||||
}
|
||||
if env.DockerConfigs {
|
||||
allowedPaths = append(allowedPaths, "/configs")
|
||||
}
|
||||
if env.DockerDistribution {
|
||||
allowedPaths = append(allowedPaths, "/distribution")
|
||||
}
|
||||
if env.DockerEvents {
|
||||
allowedPaths = append(allowedPaths, "/events")
|
||||
}
|
||||
if env.DockerExec {
|
||||
allowedPaths = append(allowedPaths, "/exec")
|
||||
}
|
||||
if env.DockerGrpc {
|
||||
allowedPaths = append(allowedPaths, "/grpc")
|
||||
}
|
||||
if env.DockerImages {
|
||||
allowedPaths = append(allowedPaths, "/images")
|
||||
}
|
||||
if env.DockerInfo {
|
||||
allowedPaths = append(allowedPaths, "/info")
|
||||
}
|
||||
if env.DockerNetworks {
|
||||
allowedPaths = append(allowedPaths, "/networks")
|
||||
}
|
||||
if env.DockerNodes {
|
||||
allowedPaths = append(allowedPaths, "/nodes")
|
||||
}
|
||||
if env.DockerPing {
|
||||
allowedPaths = append(allowedPaths, "/_ping")
|
||||
}
|
||||
if env.DockerPlugins {
|
||||
allowedPaths = append(allowedPaths, "/plugins")
|
||||
}
|
||||
if env.DockerSecrets {
|
||||
allowedPaths = append(allowedPaths, "/secrets")
|
||||
}
|
||||
if env.DockerServices {
|
||||
allowedPaths = append(allowedPaths, "/services")
|
||||
}
|
||||
if env.DockerSession {
|
||||
allowedPaths = append(allowedPaths, "/session")
|
||||
}
|
||||
if env.DockerSwarm {
|
||||
allowedPaths = append(allowedPaths, "/swarm")
|
||||
}
|
||||
if env.DockerSystem {
|
||||
allowedPaths = append(allowedPaths, "/system")
|
||||
}
|
||||
if env.DockerTasks {
|
||||
allowedPaths = append(allowedPaths, "/tasks")
|
||||
}
|
||||
if env.DockerVersion {
|
||||
allowedPaths = append(allowedPaths, "/version")
|
||||
}
|
||||
if env.DockerVolumes {
|
||||
allowedPaths = append(allowedPaths, "/volumes")
|
||||
}
|
||||
|
||||
// Helper to determine if a path should be treated as a prefix
|
||||
isPrefixPath := func(path string) bool {
|
||||
return strings.Count(path, "/") == 1
|
||||
}
|
||||
|
||||
// 1. Register Denied Paths (specific)
|
||||
for _, path := range deniedPaths {
|
||||
// Handle with version prefix
|
||||
r.HandleFunc(apiVersionPrefix+path, endpointNotAllowed)
|
||||
// Handle without version prefix
|
||||
r.HandleFunc(path, endpointNotAllowed)
|
||||
}
|
||||
|
||||
// 2. Register Allowed Paths
|
||||
for _, p := range allowedPaths {
|
||||
fullPathWithVersion := apiVersionPrefix + p
|
||||
if isPrefixPath(p) {
|
||||
r.PathPrefix(fullPathWithVersion).Handler(socketHandler)
|
||||
r.PathPrefix(p).Handler(socketHandler)
|
||||
} else {
|
||||
r.HandleFunc(fullPathWithVersion, socketHandler)
|
||||
r.HandleFunc(p, socketHandler)
|
||||
}
|
||||
}
|
||||
|
||||
// 3. Add fallback for any other routes
|
||||
r.PathPrefix("/").HandlerFunc(endpointNotAllowed)
|
||||
|
||||
// HTTP method filtering
|
||||
if !env.DockerPost {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
|
||||
switch req.Method {
|
||||
case http.MethodGet:
|
||||
r.ServeHTTP(w, req)
|
||||
default:
|
||||
http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
|
||||
}
|
||||
})
|
||||
}
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
|
||||
switch req.Method {
|
||||
case http.MethodPost, http.MethodGet:
|
||||
r.ServeHTTP(w, req)
|
||||
default:
|
||||
http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
@@ -3,18 +3,26 @@ package handler
|
||||
import (
|
||||
"crypto/tls"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"net/http/httputil"
|
||||
"strconv"
|
||||
"time"
|
||||
|
||||
"github.com/yusing/go-proxy/agent/pkg/agent"
|
||||
"github.com/yusing/go-proxy/agent/pkg/agentproxy"
|
||||
"github.com/yusing/go-proxy/internal/logging"
|
||||
"github.com/yusing/go-proxy/internal/net/gphttp"
|
||||
"github.com/yusing/go-proxy/internal/net/gphttp/reverseproxy"
|
||||
"github.com/yusing/go-proxy/internal/net/types"
|
||||
)
|
||||
|
||||
func NewTransport() *http.Transport {
|
||||
return &http.Transport{
|
||||
MaxIdleConnsPerHost: 100,
|
||||
IdleConnTimeout: 90 * time.Second,
|
||||
TLSHandshakeTimeout: 10 * time.Second,
|
||||
ExpectContinueTimeout: 1 * time.Second,
|
||||
ResponseHeaderTimeout: 60 * time.Second,
|
||||
WriteBufferSize: 16 * 1024, // 16KB
|
||||
ReadBufferSize: 16 * 1024, // 16KB
|
||||
}
|
||||
}
|
||||
|
||||
func ProxyHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
host := r.Header.Get(agentproxy.HeaderXProxyHost)
|
||||
isHTTPS, _ := strconv.ParseBool(r.Header.Get(agentproxy.HeaderXProxyHTTPS))
|
||||
@@ -34,11 +42,9 @@ func ProxyHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
scheme = "https"
|
||||
}
|
||||
|
||||
var transport *http.Transport
|
||||
transport := NewTransport()
|
||||
if skipTLSVerify {
|
||||
transport = gphttp.NewTransportWithTLSConfig(&tls.Config{InsecureSkipVerify: true})
|
||||
} else {
|
||||
transport = gphttp.NewTransport()
|
||||
transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
|
||||
}
|
||||
|
||||
if responseHeaderTimeout > 0 {
|
||||
@@ -49,14 +55,13 @@ func ProxyHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
r.URL.Host = ""
|
||||
r.URL.Path = r.URL.Path[agent.HTTPProxyURLPrefixLen:] // strip the {API_BASE}/proxy/http prefix
|
||||
r.RequestURI = r.URL.String()
|
||||
r.URL.Host = host
|
||||
r.URL.Scheme = scheme
|
||||
|
||||
logging.Debug().Msgf("proxy http request: %s %s", r.Method, r.URL.String())
|
||||
|
||||
rp := reverseproxy.NewReverseProxy("agent", types.NewURL(&url.URL{
|
||||
Scheme: scheme,
|
||||
Host: host,
|
||||
}), transport)
|
||||
rp := &httputil.ReverseProxy{
|
||||
Director: func(r *http.Request) {
|
||||
r.URL.Scheme = scheme
|
||||
r.URL.Host = host
|
||||
},
|
||||
Transport: transport,
|
||||
}
|
||||
rp.ServeHTTP(w, r)
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user