Skip to content

Commit 43aa484

Browse files
runcomruncom
committed
docker: mimic docker upstream registry authentication
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
1 parent 93a9f23 commit 43aa484

5 files changed

Lines changed: 135 additions & 98 deletions

File tree

‎docker/docker_client.go‎

Lines changed: 58 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"io/ioutil"
1010
"net"
1111
"net/http"
12+
"net/url"
1213
"os"
1314
"path/filepath"
1415
"strings"
@@ -45,14 +46,14 @@ var ErrV1NotSupported = errors.New("can't talk to a V1 docker registry")
4546

4647
// dockerClient is configuration for dealing with a single Docker registry.
4748
type dockerClient struct {
48-
ctx *types.SystemContext
49-
registry string
50-
username string
51-
password string
52-
wwwAuthenticate string // Cache of a value set by ping() if scheme is not empty
53-
scheme string // Cache of a value returned by a successful ping() if not empty
54-
client *http.Client
55-
signatureBase signatureStorageBase
49+
ctx *types.SystemContext
50+
registry string
51+
username string
52+
password string
53+
scheme string // Cache of a value returned by a successful ping() if not empty
54+
client *http.Client
55+
signatureBase signatureStorageBase
56+
challenges map[string][]challenge
5657
}
5758

5859
// this is cloned from docker/go-connections because upstream docker has changed
@@ -184,30 +185,35 @@ func newDockerClient(ctx *types.SystemContext, ref dockerReference, write bool)
184185
password: password,
185186
client: client,
186187
signatureBase: sigBase,
188+
challenges: make(map[string][]challenge),
187189
}, nil
188190
}
189191

192+
type requestOptions struct {
193+
remoteName string
194+
actions string
195+
}
196+
190197
// makeRequest creates and executes a http.Request with the specified parameters, adding authentication and TLS options for the Docker client.
191198
// url is NOT an absolute URL, but a path relative to the /v2/ top-level API path. The host name and schema is taken from the client or autodetected.
192-
func (c *dockerClient) makeRequest(method, url string, headers map[string][]string, stream io.Reader) (*http.Response, error) {
199+
func (c *dockerClient) makeRequest(method, url string, headers map[string][]string, stream io.Reader, opts requestOptions) (*http.Response, error) {
193200
if c.scheme == "" {
194201
pr, err := c.ping()
195202
if err != nil {
196203
return nil, err
197204
}
198-
c.wwwAuthenticate = pr.WWWAuthenticate
199205
c.scheme = pr.scheme
200206
}
201207

202208
url = fmt.Sprintf(baseURL, c.scheme, c.registry) + url
203-
return c.makeRequestToResolvedURL(method, url, headers, stream, -1, true)
209+
return c.makeRequestToResolvedURL(method, url, headers, stream, -1, true, opts)
204210
}
205211

206212
// makeRequestToResolvedURL creates and executes a http.Request with the specified parameters, adding authentication and TLS options for the Docker client.
207213
// streamLen, if not -1, specifies the length of the data expected on stream.
208214
// makeRequest should generally be preferred.
209215
// TODO(runcom): too many arguments here, use a struct
210-
func (c *dockerClient) makeRequestToResolvedURL(method, url string, headers map[string][]string, stream io.Reader, streamLen int64, sendAuth bool) (*http.Response, error) {
216+
func (c *dockerClient) makeRequestToResolvedURL(method, url string, headers map[string][]string, stream io.Reader, streamLen int64, sendAuth bool, opts requestOptions) (*http.Response, error) {
211217
req, err := http.NewRequest(method, url, stream)
212218
if err != nil {
213219
return nil, err
@@ -224,8 +230,8 @@ func (c *dockerClient) makeRequestToResolvedURL(method, url string, headers map[
224230
if c.ctx != nil && c.ctx.DockerRegistryUserAgent != "" {
225231
req.Header.Add("User-Agent", c.ctx.DockerRegistryUserAgent)
226232
}
227-
if c.wwwAuthenticate != "" && sendAuth {
228-
if err := c.setupRequestAuth(req); err != nil {
233+
if sendAuth {
234+
if err := c.setupRequestAuth(req, opts.remoteName, opts.actions); err != nil {
229235
return nil, err
230236
}
231237
}
@@ -237,87 +243,32 @@ func (c *dockerClient) makeRequestToResolvedURL(method, url string, headers map[
237243
return res, nil
238244
}
239245

240-
func (c *dockerClient) setupRequestAuth(req *http.Request) error {
241-
tokens := strings.SplitN(strings.TrimSpace(c.wwwAuthenticate), " ", 2)
242-
if len(tokens) != 2 {
243-
return errors.Errorf("expected 2 tokens in WWW-Authenticate: %d, %s", len(tokens), c.wwwAuthenticate)
246+
func (c *dockerClient) setupRequestAuth(req *http.Request, remoteName, actions string) error {
247+
chs := c.getChallenges(req)
248+
if chs == nil || len(chs) == 0 {
249+
return nil
244250
}
245-
switch tokens[0] {
246-
case "Basic":
251+
// assume just one...
252+
challenge := chs[0]
253+
switch challenge.Scheme {
254+
case "basic":
247255
req.SetBasicAuth(c.username, c.password)
248256
return nil
249-
case "Bearer":
250-
// FIXME? This gets a new token for every API request;
251-
// we may be easily able to reuse a previous token, e.g.
252-
// for OpenShift the token only identifies the user and does not vary
253-
// across operations. Should we just try the request first, and
254-
// only get a new token on failure?
255-
// OTOH what to do with the single-use body stream in that case?
256-
257-
// Try performing the request, expecting it to fail.
258-
testReq := *req
259-
// Do not use the body stream, or we couldn't reuse it for the "real" call later.
260-
testReq.Body = nil
261-
testReq.ContentLength = 0
262-
res, err := c.client.Do(&testReq)
263-
if err != nil {
264-
return err
265-
}
266-
chs := parseAuthHeader(res.Header)
267-
// We could end up in this "if" statement if the /v2/ call (during ping)
268-
// returned 401 with a valid WWW-Authenticate=Bearer header.
269-
// That doesn't **always** mean, however, that the specific API request
270-
// (different from /v2/) actually needs to be authorized.
271-
// One example of this _weird_ scenario happens with GCR.io docker
272-
// registries.
273-
if res.StatusCode != http.StatusUnauthorized || chs == nil || len(chs) == 0 {
274-
// With gcr.io, the /v2/ call returns a 401 with a valid WWW-Authenticate=Bearer
275-
// header but the repository could be _public_ (no authorization is needed).
276-
// Hence, the registry response contains no challenges and the status
277-
// code is not 401.
278-
// We just skip this case as it's not standard on docker/distribution
279-
// registries (https://github.com/docker/distribution/blob/master/docs/spec/api.md#api-version-check)
280-
if res.StatusCode != http.StatusUnauthorized {
281-
return nil
282-
}
283-
// gcr.io private repositories pull instead requires us to send user:pass pair in
284-
// order to retrieve a token and setup the correct Bearer token.
285-
// try again one last time with Basic Auth
286-
testReq2 := *req
287-
// Do not use the body stream, or we couldn't reuse it for the "real" call later.
288-
testReq2.Body = nil
289-
testReq2.ContentLength = 0
290-
testReq2.SetBasicAuth(c.username, c.password)
291-
res, err := c.client.Do(&testReq2)
292-
if err != nil {
293-
return err
294-
}
295-
chs = parseAuthHeader(res.Header)
296-
if res.StatusCode != http.StatusUnauthorized || chs == nil || len(chs) == 0 {
297-
// no need for bearer? wtf?
298-
return nil
299-
}
300-
}
301-
// Arbitrarily use the first challenge, there is no reason to expect more than one.
302-
challenge := chs[0]
303-
if challenge.Scheme != "bearer" { // Another artifact of trying to handle WWW-Authenticate before it actually happens.
304-
return errors.Errorf("Unimplemented: WWW-Authenticate Bearer replaced by %#v", challenge.Scheme)
305-
}
257+
case "bearer":
306258
realm, ok := challenge.Parameters["realm"]
307259
if !ok {
308260
return errors.Errorf("missing realm in bearer auth challenge")
309261
}
310262
service, _ := challenge.Parameters["service"] // Will be "" if not present
311-
scope, _ := challenge.Parameters["scope"] // Will be "" if not present
263+
scope := fmt.Sprintf("repository:%s:%s", remoteName, actions)
312264
token, err := c.getBearerToken(realm, service, scope)
313265
if err != nil {
314266
return err
315267
}
316268
req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
317269
return nil
318270
}
319-
return errors.Errorf("no handler for %s authentication", tokens[0])
320-
// support docker bearer with authconfig's Auth string? see docker2aci
271+
return errors.Errorf("no handler for %s authentication", challenge.Scheme)
321272
}
322273

323274
func (c *dockerClient) getBearerToken(realm, service, scope string) (string, error) {
@@ -428,15 +379,34 @@ func getAuth(ctx *types.SystemContext, registry string) (string, string, error)
428379
}
429380

430381
type pingResponse struct {
431-
WWWAuthenticate string
432-
APIVersion string
433-
scheme string
382+
APIVersion string
383+
scheme string
384+
}
385+
386+
func (c *dockerClient) saveChallenges(chs []challenge, u *url.URL) {
387+
urlCopy := url.URL{
388+
Path: u.Path,
389+
Host: u.Host,
390+
Scheme: u.Scheme,
391+
}
392+
normalizeURL(&urlCopy)
393+
c.challenges[urlCopy.String()] = chs
394+
}
395+
396+
func (c *dockerClient) getChallenges(req *http.Request) []challenge {
397+
ping := url.URL{
398+
Host: req.URL.Host,
399+
Scheme: req.URL.Scheme,
400+
Path: "/v2/",
401+
}
402+
normalizeURL(&ping)
403+
return c.challenges[ping.String()]
434404
}
435405

436406
func (c *dockerClient) ping() (*pingResponse, error) {
437407
ping := func(scheme string) (*pingResponse, error) {
438408
url := fmt.Sprintf(baseURL, scheme, c.registry)
439-
resp, err := c.makeRequestToResolvedURL("GET", url, nil, nil, -1, true)
409+
resp, err := c.makeRequestToResolvedURL("GET", url, nil, nil, -1, true, requestOptions{})
440410
logrus.Debugf("Ping %s err %#v", url, err)
441411
if err != nil {
442412
return nil, err
@@ -446,8 +416,10 @@ func (c *dockerClient) ping() (*pingResponse, error) {
446416
if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusUnauthorized {
447417
return nil, errors.Errorf("error pinging repository, response code %d", resp.StatusCode)
448418
}
419+
chs := parseAuthHeader(resp.Header)
420+
c.saveChallenges(chs, resp.Request.URL)
421+
449422
pr := &pingResponse{}
450-
pr.WWWAuthenticate = resp.Header.Get("WWW-Authenticate")
451423
pr.APIVersion = resp.Header.Get("Docker-Distribution-Api-Version")
452424
pr.scheme = scheme
453425
return pr, nil
@@ -464,7 +436,7 @@ func (c *dockerClient) ping() (*pingResponse, error) {
464436
// best effort to understand if we're talking to a V1 registry
465437
pingV1 := func(scheme string) bool {
466438
url := fmt.Sprintf(baseURLV1, scheme, c.registry)
467-
resp, err := c.makeRequestToResolvedURL("GET", url, nil, nil, -1, true)
439+
resp, err := c.makeRequestToResolvedURL("GET", url, nil, nil, -1, true, requestOptions{})
468440
logrus.Debugf("Ping %s err %#v", url, err)
469441
if err != nil {
470442
return false

‎docker/docker_image.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,11 @@ func (i *Image) SourceRefFullName() string {
4040
// GetRepositoryTags list all tags available in the repository. Note that this has no connection with the tag(s) used for this specific image, if any.
4141
func (i *Image) GetRepositoryTags() ([]string, error) {
4242
url := fmt.Sprintf(tagsURL, i.src.ref.ref.RemoteName())
43-
res, err := i.src.c.makeRequest("GET", url, nil, nil)
43+
opts := requestOptions{
44+
remoteName: i.src.ref.ref.RemoteName(),
45+
actions: "pull",
46+
}
47+
res, err := i.src.c.makeRequest("GET", url, nil, nil, opts)
4448
if err != nil {
4549
return nil, err
4650
}

‎docker/docker_image_dest.go‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,11 @@ func (d *dockerImageDestination) PutBlob(stream io.Reader, inputInfo types.BlobI
9191
checkURL := fmt.Sprintf(blobsURL, d.ref.ref.RemoteName(), inputInfo.Digest.String())
9292

9393
logrus.Debugf("Checking %s", checkURL)
94-
res, err := d.c.makeRequest("HEAD", checkURL, nil, nil)
94+
opts := requestOptions{
95+
remoteName: d.ref.ref.RemoteName(),
96+
actions: "push",
97+
}
98+
res, err := d.c.makeRequest("HEAD", checkURL, nil, nil, opts)
9599
if err != nil {
96100
return types.BlobInfo{}, err
97101
}
@@ -114,7 +118,11 @@ func (d *dockerImageDestination) PutBlob(stream io.Reader, inputInfo types.BlobI
114118
// FIXME? Chunked upload, progress reporting, etc.
115119
uploadURL := fmt.Sprintf(blobUploadURL, d.ref.ref.RemoteName())
116120
logrus.Debugf("Uploading %s", uploadURL)
117-
res, err := d.c.makeRequest("POST", uploadURL, nil, nil)
121+
opts := requestOptions{
122+
remoteName: d.ref.ref.RemoteName(),
123+
actions: "push",
124+
}
125+
res, err := d.c.makeRequest("POST", uploadURL, nil, nil, opts)
118126
if err != nil {
119127
return types.BlobInfo{}, err
120128
}
@@ -131,7 +139,7 @@ func (d *dockerImageDestination) PutBlob(stream io.Reader, inputInfo types.BlobI
131139
digester := digest.Canonical.Digester()
132140
sizeCounter := &sizeCounter{}
133141
tee := io.TeeReader(stream, io.MultiWriter(digester.Hash(), sizeCounter))
134-
res, err = d.c.makeRequestToResolvedURL("PATCH", uploadLocation.String(), map[string][]string{"Content-Type": {"application/octet-stream"}}, tee, inputInfo.Size, true)
142+
res, err = d.c.makeRequestToResolvedURL("PATCH", uploadLocation.String(), map[string][]string{"Content-Type": {"application/octet-stream"}}, tee, inputInfo.Size, true, opts)
135143
if err != nil {
136144
logrus.Debugf("Error uploading layer chunked, response %#v", *res)
137145
return types.BlobInfo{}, err
@@ -150,7 +158,7 @@ func (d *dockerImageDestination) PutBlob(stream io.Reader, inputInfo types.BlobI
150158
// TODO: check inputInfo.Digest == computedDigest https://github.com/containers/image/pull/70#discussion_r77646717
151159
locationQuery.Set("digest", computedDigest.String())
152160
uploadLocation.RawQuery = locationQuery.Encode()
153-
res, err = d.c.makeRequestToResolvedURL("PUT", uploadLocation.String(), map[string][]string{"Content-Type": {"application/octet-stream"}}, nil, -1, true)
161+
res, err = d.c.makeRequestToResolvedURL("PUT", uploadLocation.String(), map[string][]string{"Content-Type": {"application/octet-stream"}}, nil, -1, true, opts)
154162
if err != nil {
155163
return types.BlobInfo{}, err
156164
}
@@ -171,7 +179,11 @@ func (d *dockerImageDestination) HasBlob(info types.BlobInfo) (bool, int64, erro
171179
checkURL := fmt.Sprintf(blobsURL, d.ref.ref.RemoteName(), info.Digest.String())
172180

173181
logrus.Debugf("Checking %s", checkURL)
174-
res, err := d.c.makeRequest("HEAD", checkURL, nil, nil)
182+
opts := requestOptions{
183+
remoteName: d.ref.ref.RemoteName(),
184+
actions: "push",
185+
}
186+
res, err := d.c.makeRequest("HEAD", checkURL, nil, nil, opts)
175187
if err != nil {
176188
return false, -1, err
177189
}
@@ -215,7 +227,11 @@ func (d *dockerImageDestination) PutManifest(m []byte) error {
215227
if mimeType != "" {
216228
headers["Content-Type"] = []string{mimeType}
217229
}
218-
res, err := d.c.makeRequest("PUT", url, headers, bytes.NewReader(m))
230+
opts := requestOptions{
231+
remoteName: d.ref.ref.RemoteName(),
232+
actions: "push",
233+
}
234+
res, err := d.c.makeRequest("PUT", url, headers, bytes.NewReader(m), opts)
219235
if err != nil {
220236
return err
221237
}

‎docker/docker_image_src.go‎

Lines changed: 23 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -81,9 +81,15 @@ func (s *dockerImageSource) GetManifest() ([]byte, string, error) {
8181

8282
func (s *dockerImageSource) fetchManifest(tagOrDigest string) ([]byte, string, error) {
8383
url := fmt.Sprintf(manifestURL, s.ref.ref.RemoteName(), tagOrDigest)
84+
//fmt.Println(s.ref.ref.RemoteName())
85+
//return nil, "", errors.New("FUCK")
8486
headers := make(map[string][]string)
8587
headers["Accept"] = s.requestedManifestMIMETypes
86-
res, err := s.c.makeRequest("GET", url, headers, nil)
88+
opts := requestOptions{
89+
remoteName: s.ref.ref.RemoteName(),
90+
actions: "pull",
91+
}
92+
res, err := s.c.makeRequest("GET", url, headers, nil, opts)
8793
if err != nil {
8894
return nil, "", err
8995
}
@@ -135,9 +141,13 @@ func (s *dockerImageSource) getExternalBlob(urls []string) (io.ReadCloser, int64
135141
var (
136142
resp *http.Response
137143
err error
144+
opts = requestOptions{
145+
remoteName: s.ref.ref.RemoteName(),
146+
actions: "pull",
147+
}
138148
)
139149
for _, url := range urls {
140-
resp, err = s.c.makeRequestToResolvedURL("GET", url, nil, nil, -1, false)
150+
resp, err = s.c.makeRequestToResolvedURL("GET", url, nil, nil, -1, false, opts)
141151
if err == nil {
142152
if resp.StatusCode != http.StatusOK {
143153
err = errors.Errorf("error fetching external blob from %q: %d", url, resp.StatusCode)
@@ -168,7 +178,11 @@ func (s *dockerImageSource) GetBlob(info types.BlobInfo) (io.ReadCloser, int64,
168178

169179
url := fmt.Sprintf(blobsURL, s.ref.ref.RemoteName(), info.Digest.String())
170180
logrus.Debugf("Downloading %s", url)
171-
res, err := s.c.makeRequest("GET", url, nil, nil)
181+
opts := requestOptions{
182+
remoteName: s.ref.ref.RemoteName(),
183+
actions: "pull",
184+
}
185+
res, err := s.c.makeRequest("GET", url, nil, nil, opts)
172186
if err != nil {
173187
return nil, 0, err
174188
}
@@ -265,7 +279,11 @@ func deleteImage(ctx *types.SystemContext, ref dockerReference) error {
265279
return err
266280
}
267281
getURL := fmt.Sprintf(manifestURL, ref.ref.RemoteName(), reference)
268-
get, err := c.makeRequest("GET", getURL, headers, nil)
282+
opts := requestOptions{
283+
remoteName: ref.ref.RemoteName(),
284+
actions: "pull",
285+
}
286+
get, err := c.makeRequest("GET", getURL, headers, nil, opts)
269287
if err != nil {
270288
return err
271289
}
@@ -287,7 +305,7 @@ func deleteImage(ctx *types.SystemContext, ref dockerReference) error {
287305

288306
// When retrieving the digest from a registry >= 2.3 use the following header:
289307
// "Accept": "application/vnd.docker.distribution.manifest.v2+json"
290-
delete, err := c.makeRequest("DELETE", deleteURL, headers, nil)
308+
delete, err := c.makeRequest("DELETE", deleteURL, headers, nil, opts)
291309
if err != nil {
292310
return err
293311
}

0 commit comments

Comments
 (0)