containers
/
podman
mirror of https://github.com/containers/podman.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6918 from skorhone/fix/hijacked_connection_handling 

Fix: Correct connection counters for hijacked connections
This commit is contained in:
OpenShift Merge Robot 2020-07-10 22:03:56 +02:00 committed by GitHub
parent 2ac8c69534 324a02ec60
commit 1d7175314c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 148 additions and 92 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

79
pkg/api/handlers/compat/containers_attach.go
View File

@ -1,23 +1,22 @@
package compat
import (
"bufio"
"fmt"
"io"
"net"
"net/http"
"strings"
"github.com/containers/libpod/v2/libpod"
"github.com/containers/libpod/v2/libpod/define"
"github.com/containers/libpod/v2/pkg/api/handlers/utils"
"github.com/containers/libpod/v2/pkg/api/server/idletracker"
"github.com/gorilla/schema"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
)
// AttachHeader is the literal header sent for upgraded/hijacked connections for
// attach, sourced from Docker at:
// https://raw.githubusercontent.com/moby/moby/b95fad8e51bd064be4f4e58a996924f343846c85/api/server/router/container/container_routes.go
// Using literally to ensure compatibility with existing clients.
const AttachHeader = "HTTP/1.1 101 UPGRADED\r\nContent-Type: application/vnd.docker.raw-stream\r\nConnection: Upgrade\r\nUpgrade: tcp\r\n\r\n"
func AttachContainer(w http.ResponseWriter, r *http.Request) {
runtime := r.Context().Value("runtime").(*libpod.Runtime)
decoder := r.Context().Value("decoder").(*schema.Decoder)
@ -98,21 +97,11 @@ func AttachContainer(w http.ResponseWriter, r *http.Request) {
return
}
// Hijack the connection
hijacker, ok := w.(http.Hijacker)
if !ok {
utils.InternalServerError(w, errors.Errorf("unable to hijack connection"))
return
}
connection, buffer, err := hijacker.Hijack()
connection, buffer, err := AttachConnection(w, r)
if err != nil {
utils.InternalServerError(w, errors.Wrapf(err, "error hijacking connection"))
utils.InternalServerError(w, err)
return
}
fmt.Fprintf(connection, AttachHeader)
logrus.Debugf("Hijack for attach of container %s successful", ctr.ID())
// Perform HTTP attach.
@ -126,3 +115,57 @@ func AttachContainer(w http.ResponseWriter, r *http.Request) {
logrus.Debugf("Attach for container %s completed successfully", ctr.ID())
}
type HijackedConnection struct {
net.Conn // Connection
idleTracker *idletracker.IdleTracker // Connection tracker
}
func (c HijackedConnection) Close() error {
logrus.Debugf("Hijacked connection closed")
c.idleTracker.TrackHijackedClosed()
return c.Conn.Close()
}
func AttachConnection(w http.ResponseWriter, r *http.Request) (net.Conn, *bufio.ReadWriter, error) {
idleTracker := r.Context().Value("idletracker").(*idletracker.IdleTracker)
// Hijack the connection
hijacker, ok := w.(http.Hijacker)
if !ok {
return nil, nil, errors.Errorf("unable to hijack connection")
}
connection, buffer, err := hijacker.Hijack()
if err != nil {
return nil, nil, errors.Wrapf(err, "error hijacking connection")
}
trackedConnection := HijackedConnection{
Conn: connection,
idleTracker: idleTracker,
}
WriteAttachHeaders(r, trackedConnection)
return trackedConnection, buffer, nil
}
func WriteAttachHeaders(r *http.Request, connection io.Writer) {
// AttachHeader is the literal header sent for upgraded/hijacked connections for
// attach, sourced from Docker at:
// https://raw.githubusercontent.com/moby/moby/b95fad8e51bd064be4f4e58a996924f343846c85/api/server/router/container/container_routes.go
// Using literally to ensure compatibility with existing clients.
c := r.Header.Get("Connection")
proto := r.Header.Get("Upgrade")
if len(proto) == 0 || !strings.EqualFold(c, "Upgrade") {
// OK - can't upgrade if not requested or protocol is not specified
fmt.Fprintf(connection,
"HTTP/1.1 200 OK\r\nContent-Type: application/vnd.docker.raw-stream\r\n\r\n")
} else {
// Upraded
fmt.Fprintf(connection,
"HTTP/1.1 101 UPGRADED\r\nContent-Type: application/vnd.docker.raw-stream\r\nConnection: Upgrade\r\nUpgrade: %s\r\n\r\n",
proto)
}
}

14
pkg/api/handlers/compat/exec.go
View File

@ -173,21 +173,11 @@ func ExecStartHandler(w http.ResponseWriter, r *http.Request) {
return
}
// Hijack the connection
hijacker, ok := w.(http.Hijacker)
if !ok {
utils.InternalServerError(w, errors.Errorf("unable to hijack connection"))
return
}
connection, buffer, err := hijacker.Hijack()
connection, buffer, err := AttachConnection(w, r)
if err != nil {
utils.InternalServerError(w, errors.Wrapf(err, "error hijacking connection"))
utils.InternalServerError(w, err)
return
}
fmt.Fprintf(connection, AttachHeader)
logrus.Debugf("Hijack for attach of container %s exec session %s successful", sessionCtr.ID(), sessionID)
if err := sessionCtr.ExecHTTPStartAndAttach(sessionID, connection, buffer, nil, nil, nil); err != nil {

1
pkg/api/server/handler_api.go
View File

@ -37,6 +37,7 @@ func (s *APIServer) APIHandler(h http.HandlerFunc) http.HandlerFunc {
c := context.WithValue(r.Context(), "decoder", s.Decoder) //nolint
c = context.WithValue(c, "runtime", s.Runtime) //nolint
c = context.WithValue(c, "shutdownFunc", s.Shutdown) //nolint
c = context.WithValue(c, "idletracker", s.idleTracker) //nolint
r = r.WithContext(c)
h(w, r)

74
pkg/api/server/idletracker/idletracker.go Normal file
View File

@ -0,0 +1,74 @@
package idletracker
import (
"net"
"net/http"
"sync"
"time"
"github.com/sirupsen/logrus"
)
type IdleTracker struct {
http map[net.Conn]struct{}
hijacked int
total int
mux sync.Mutex
timer *time.Timer
Duration time.Duration
}
func NewIdleTracker(idle time.Duration) *IdleTracker {
return &IdleTracker{
http: make(map[net.Conn]struct{}),
Duration: idle,
timer: time.NewTimer(idle),
}
}
func (t *IdleTracker) ConnState(conn net.Conn, state http.ConnState) {
t.mux.Lock()
defer t.mux.Unlock()
oldActive := t.ActiveConnections()
logrus.Debugf("IdleTracker %p:%v %d/%d connection(s)", conn, state, oldActive, t.TotalConnections())
switch state {
case http.StateNew, http.StateActive:
t.http[conn] = struct{}{}
// stop the timer if we transitioned from idle
if oldActive == 0 {
t.timer.Stop()
}
t.total++
case http.StateHijacked:
// hijacked connections are handled elsewhere
delete(t.http, conn)
t.hijacked++
case http.StateIdle, http.StateClosed:
delete(t.http, conn)
// Restart the timer if we've become idle
if oldActive > 0 && len(t.http) == 0 {
t.timer.Stop()
t.timer.Reset(t.Duration)
}
}
}
func (t *IdleTracker) TrackHijackedClosed() {
t.mux.Lock()
defer t.mux.Unlock()
t.hijacked--
}
func (t *IdleTracker) ActiveConnections() int {
return len(t.http) + t.hijacked
}
func (t *IdleTracker) TotalConnections() int {
return t.total
}
func (t *IdleTracker) Done() <-chan time.Time {
return t.timer.C
}

72
pkg/api/server/server.go
View File

@ -10,12 +10,12 @@ import (
"runtime"
goRuntime "runtime"
"strings"
"sync"
"syscall"
"time"
"github.com/containers/libpod/v2/libpod"
"github.com/containers/libpod/v2/pkg/api/handlers"
"github.com/containers/libpod/v2/pkg/api/server/idletracker"
"github.com/coreos/go-systemd/v22/activation"
"github.com/gorilla/mux"
"github.com/gorilla/schema"
@ -24,14 +24,14 @@ import (
)
type APIServer struct {
http.Server // The HTTP work happens here
*schema.Decoder // Decoder for Query parameters to structs
context.Context // Context to carry objects to handlers
*libpod.Runtime // Where the real work happens
net.Listener // mux for routing HTTP API calls to libpod routines
context.CancelFunc // Stop APIServer
idleTracker *IdleTracker // Track connections to support idle shutdown
pprof *http.Server // Sidecar http server for providing performance data
http.Server // The HTTP work happens here
*schema.Decoder // Decoder for Query parameters to structs
context.Context // Context to carry objects to handlers
*libpod.Runtime // Where the real work happens
net.Listener // mux for routing HTTP API calls to libpod routines
context.CancelFunc // Stop APIServer
idleTracker *idletracker.IdleTracker // Track connections to support idle shutdown
pprof *http.Server // Sidecar http server for providing performance data
}
// Number of seconds to wait for next request, if exceeded shutdown server
@ -68,7 +68,7 @@ func newServer(runtime *libpod.Runtime, duration time.Duration, listener *net.Li
}
router := mux.NewRouter().UseEncodedPath()
idle := NewIdleTracker(duration)
idle := idletracker.NewIdleTracker(duration)
server := APIServer{
Server: http.Server{
@ -231,55 +231,3 @@ func (s *APIServer) Shutdown() error {
func (s *APIServer) Close() error {
return s.Server.Close()
}
type IdleTracker struct {
active map[net.Conn]struct{}
total int
mux sync.Mutex
timer *time.Timer
Duration time.Duration
}
func NewIdleTracker(idle time.Duration) *IdleTracker {
return &IdleTracker{
active: make(map[net.Conn]struct{}),
Duration: idle,
timer: time.NewTimer(idle),
}
}
func (t *IdleTracker) ConnState(conn net.Conn, state http.ConnState) {
t.mux.Lock()
defer t.mux.Unlock()
oldActive := len(t.active)
logrus.Debugf("IdleTracker %p:%v %d/%d connection(s)", conn, state, t.ActiveConnections(), t.TotalConnections())
switch state {
case http.StateNew, http.StateActive, http.StateHijacked:
t.active[conn] = struct{}{}
// stop the timer if we transitioned from idle
if oldActive == 0 {
t.timer.Stop()
}
t.total++
case http.StateIdle, http.StateClosed:
delete(t.active, conn)
// Restart the timer if we've become idle
if oldActive > 0 && len(t.active) == 0 {
t.timer.Stop()
t.timer.Reset(t.Duration)
}
}
}
func (t *IdleTracker) ActiveConnections() int {
return len(t.active)
}
func (t *IdleTracker) TotalConnections() int {
return t.total
}
func (t *IdleTracker) Done() <-chan time.Time {
return t.timer.C
}