mirror of
https://github.com/portainer/portainer.git
synced 2025-07-22 06:49:40 +02:00
feat(containers): add support docker attach (#2842)
* #592 feat(container-details): split websocket backend code into more files and add attach handler
* #592 feat(container-details): rename console to exec and add attach console
* Revert "#592 feat(container-details): rename console to exec and add attach console"
This reverts commit f2deaee1
* #592 feat(container-details): add attach to containerconsole
* #592 feat(container-details): catch more errors
* #592 feat(container-details): use less vars
* #592 feat(container-details): error message is more verbose
* #592 feat(container-details): go fmt
* #592 feat(container-details): unpack netdial
* #592 feat(container-details): reformat service
* #592 feat(container-details): fix go compiler bugs
* #592 feat(container-details): refactor services
* #592 feat(container-details): fix windows dial
* #592 feat(container-details): gofmt dial_windows.go
* #592 feat(container-details): split console into two views and fix breadcrumbs
* #592 feat(container-details): swap exec and attach action
* #592 feat(container-details): add some warnings
* #592 feat(container-details): refresh view more
* #592 feat(container-details): use less functions for connecting/disconnecting
* #592 feat(container-details): move link replacements into initTerm
* #592 feat(container-details): disable attach/exec button if container is not running
* #592 feat(container-details): fix typo
* #592 feat(container-details): autoconnect attach view
* #592 feat(container-details): fix first draw after attach + reformat code
* #592 feat(container-details): remove init-helper-div
* #592 feat(container-details): console resize code and remove padding
* #592 feat(container-details): swap height and width arguments in container tty resize restcall
* #592 feat(container-details): swap height and width arguments in exec tty resize restcall
* #592 feat(container-details): remove css unit
* #592 feat(container-details): remove loaded state from states object
* #592 feat(container-details): reword Disattach to Detach
* #592 feat(container-details): remove unloaded state from states object
* #592 feat(container-details): remove useless code
* #592 feat(container-details): clearer state-check
* #592 feat(container-details): fixed resize bugs by using xterms col attribute
This commit is contained in:
mrdrogdrog
Anthony Lapenna
parent
dc9a3de88f
commit
1af9fb4490
20 changed files with 647 additions and 305 deletions
|
|
@ -1,269 +0,0 @@
|
|||
package websocket
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"bytes"
|
||||
"crypto/tls"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/http/httputil"
|
||||
"net/url"
|
||||
"time"
|
||||
|
||||
"github.com/asaskevich/govalidator"
|
||||
"github.com/gorilla/websocket"
|
||||
"github.com/koding/websocketproxy"
|
||||
httperror "github.com/portainer/libhttp/error"
|
||||
"github.com/portainer/libhttp/request"
|
||||
"github.com/portainer/portainer/api"
|
||||
"github.com/portainer/portainer/api/crypto"
|
||||
)
|
||||
|
||||
type webSocketExecRequestParams struct {
|
||||
execID string
|
||||
nodeName string
|
||||
endpoint *portainer.Endpoint
|
||||
}
|
||||
|
||||
type execStartOperationPayload struct {
|
||||
Tty bool
|
||||
Detach bool
|
||||
}
|
||||
|
||||
// websocketExec handles GET requests on /websocket/exec?id=<execID>&endpointId=<endpointID>&nodeName=<nodeName>&token=<token>
|
||||
// If the nodeName query parameter is present, the request will be proxied to the underlying agent endpoint.
|
||||
// If the nodeName query parameter is not specified, the request will be upgraded to the websocket protocol and
|
||||
// an ExecStart operation HTTP request will be created and hijacked.
|
||||
// Authentication and access is controled via the mandatory token query parameter.
|
||||
func (handler *Handler) websocketExec(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
|
||||
execID, err := request.RetrieveQueryParameter(r, "id", false)
|
||||
if err != nil {
|
||||
return &httperror.HandlerError{http.StatusBadRequest, "Invalid query parameter: id", err}
|
||||
}
|
||||
if !govalidator.IsHexadecimal(execID) {
|
||||
return &httperror.HandlerError{http.StatusBadRequest, "Invalid query parameter: id (must be hexadecimal identifier)", err}
|
||||
}
|
||||
|
||||
endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", false)
|
||||
if err != nil {
|
||||
return &httperror.HandlerError{http.StatusBadRequest, "Invalid query parameter: endpointId", err}
|
||||
}
|
||||
|
||||
endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
|
||||
if err == portainer.ErrObjectNotFound {
|
||||
return &httperror.HandlerError{http.StatusNotFound, "Unable to find the endpoint associated to the stack inside the database", err}
|
||||
} else if err != nil {
|
||||
return &httperror.HandlerError{http.StatusInternalServerError, "Unable to find the endpoint associated to the stack inside the database", err}
|
||||
}
|
||||
|
||||
err = handler.requestBouncer.EndpointAccess(r, endpoint)
|
||||
if err != nil {
|
||||
return &httperror.HandlerError{http.StatusForbidden, "Permission denied to access endpoint", portainer.ErrEndpointAccessDenied}
|
||||
}
|
||||
|
||||
params := &webSocketExecRequestParams{
|
||||
endpoint: endpoint,
|
||||
execID: execID,
|
||||
nodeName: r.FormValue("nodeName"),
|
||||
}
|
||||
|
||||
err = handler.handleRequest(w, r, params)
|
||||
if err != nil {
|
||||
return &httperror.HandlerError{http.StatusInternalServerError, "An error occured during websocket exec operation", err}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func (handler *Handler) handleRequest(w http.ResponseWriter, r *http.Request, params *webSocketExecRequestParams) error {
|
||||
r.Header.Del("Origin")
|
||||
|
||||
if params.nodeName != "" || params.endpoint.Type == portainer.AgentOnDockerEnvironment {
|
||||
return handler.proxyWebsocketRequest(w, r, params)
|
||||
}
|
||||
|
||||
websocketConn, err := handler.connectionUpgrader.Upgrade(w, r, nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer websocketConn.Close()
|
||||
|
||||
return hijackExecStartOperation(websocketConn, params.endpoint, params.execID)
|
||||
}
|
||||
|
||||
func (handler *Handler) proxyWebsocketRequest(w http.ResponseWriter, r *http.Request, params *webSocketExecRequestParams) error {
|
||||
agentURL, err := url.Parse(params.endpoint.URL)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
agentURL.Scheme = "ws"
|
||||
proxy := websocketproxy.NewProxy(agentURL)
|
||||
|
||||
if params.endpoint.TLSConfig.TLS || params.endpoint.TLSConfig.TLSSkipVerify {
|
||||
agentURL.Scheme = "wss"
|
||||
proxy.Dialer = &websocket.Dialer{
|
||||
TLSClientConfig: &tls.Config{
|
||||
InsecureSkipVerify: params.endpoint.TLSConfig.TLSSkipVerify,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
signature, err := handler.SignatureService.CreateSignature(portainer.PortainerAgentSignatureMessage)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
proxy.Director = func(incoming *http.Request, out http.Header) {
|
||||
out.Set(portainer.PortainerAgentPublicKeyHeader, handler.SignatureService.EncodedPublicKey())
|
||||
out.Set(portainer.PortainerAgentSignatureHeader, signature)
|
||||
out.Set(portainer.PortainerAgentTargetHeader, params.nodeName)
|
||||
}
|
||||
|
||||
proxy.ServeHTTP(w, r)
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func hijackExecStartOperation(websocketConn *websocket.Conn, endpoint *portainer.Endpoint, execID string) error {
|
||||
dial, err := initDial(endpoint)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// When we set up a TCP connection for hijack, there could be long periods
|
||||
// of inactivity (a long running command with no output) that in certain
|
||||
// network setups may cause ECONNTIMEOUT, leaving the client in an unknown
|
||||
// state. Setting TCP KeepAlive on the socket connection will prohibit
|
||||
// ECONNTIMEOUT unless the socket connection truly is broken
|
||||
if tcpConn, ok := dial.(*net.TCPConn); ok {
|
||||
tcpConn.SetKeepAlive(true)
|
||||
tcpConn.SetKeepAlivePeriod(30 * time.Second)
|
||||
}
|
||||
|
||||
httpConn := httputil.NewClientConn(dial, nil)
|
||||
defer httpConn.Close()
|
||||
|
||||
execStartRequest, err := createExecStartRequest(execID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
err = hijackRequest(websocketConn, httpConn, execStartRequest)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func initDial(endpoint *portainer.Endpoint) (net.Conn, error) {
|
||||
url, err := url.Parse(endpoint.URL)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
host := url.Host
|
||||
|
||||
if url.Scheme == "unix" || url.Scheme == "npipe" {
|
||||
host = url.Path
|
||||
}
|
||||
|
||||
if endpoint.TLSConfig.TLS {
|
||||
tlsConfig, err := crypto.CreateTLSConfigurationFromDisk(endpoint.TLSConfig.TLSCACertPath, endpoint.TLSConfig.TLSCertPath, endpoint.TLSConfig.TLSKeyPath, endpoint.TLSConfig.TLSSkipVerify)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return tls.Dial(url.Scheme, host, tlsConfig)
|
||||
}
|
||||
|
||||
return createDial(url.Scheme, host)
|
||||
}
|
||||
|
||||
func createExecStartRequest(execID string) (*http.Request, error) {
|
||||
execStartOperationPayload := &execStartOperationPayload{
|
||||
Tty: true,
|
||||
Detach: false,
|
||||
}
|
||||
|
||||
encodedBody := bytes.NewBuffer(nil)
|
||||
err := json.NewEncoder(encodedBody).Encode(execStartOperationPayload)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
request, err := http.NewRequest("POST", "/exec/"+execID+"/start", encodedBody)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
request.Header.Set("Content-Type", "application/json")
|
||||
request.Header.Set("Connection", "Upgrade")
|
||||
request.Header.Set("Upgrade", "tcp")
|
||||
|
||||
return request, nil
|
||||
}
|
||||
|
||||
func hijackRequest(websocketConn *websocket.Conn, httpConn *httputil.ClientConn, request *http.Request) error {
|
||||
// Server hijacks the connection, error 'connection closed' expected
|
||||
resp, err := httpConn.Do(request)
|
||||
if err != httputil.ErrPersistEOF {
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if resp.StatusCode != http.StatusSwitchingProtocols {
|
||||
resp.Body.Close()
|
||||
return fmt.Errorf("unable to upgrade to tcp, received %d", resp.StatusCode)
|
||||
}
|
||||
}
|
||||
|
||||
tcpConn, brw := httpConn.Hijack()
|
||||
defer tcpConn.Close()
|
||||
|
||||
errorChan := make(chan error, 1)
|
||||
go streamFromTCPConnToWebsocketConn(websocketConn, brw, errorChan)
|
||||
go streamFromWebsocketConnToTCPConn(websocketConn, tcpConn, errorChan)
|
||||
|
||||
err = <-errorChan
|
||||
if websocket.IsUnexpectedCloseError(err, websocket.CloseGoingAway, websocket.CloseNoStatusReceived) {
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func streamFromWebsocketConnToTCPConn(websocketConn *websocket.Conn, tcpConn net.Conn, errorChan chan error) {
|
||||
for {
|
||||
_, in, err := websocketConn.ReadMessage()
|
||||
if err != nil {
|
||||
errorChan <- err
|
||||
break
|
||||
}
|
||||
|
||||
_, err = tcpConn.Write(in)
|
||||
if err != nil {
|
||||
errorChan <- err
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func streamFromTCPConnToWebsocketConn(websocketConn *websocket.Conn, br *bufio.Reader, errorChan chan error) {
|
||||
for {
|
||||
out := make([]byte, 2048)
|
||||
_, err := br.Read(out)
|
||||
if err != nil {
|
||||
errorChan <- err
|
||||
break
|
||||
}
|
||||
|
||||
err = websocketConn.WriteMessage(websocket.TextMessage, out)
|
||||
if err != nil {
|
||||
errorChan <- err
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue