forked from canonical/lxd
-
Notifications
You must be signed in to change notification settings - Fork 0
/
connection.go
199 lines (160 loc) · 5.28 KB
/
connection.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
package lxd
import (
"net/http"
"net/url"
"os"
"path/filepath"
"github.com/lxc/lxd/shared/logger"
"github.com/lxc/lxd/shared/simplestreams"
"gopkg.in/macaroon-bakery.v2/httpbakery"
)
// ConnectionArgs represents a set of common connection properties
type ConnectionArgs struct {
// TLS certificate of the remote server. If not specified, the system CA is used.
TLSServerCert string
// TLS certificate to use for client authentication.
TLSClientCert string
// TLS key to use for client authentication.
TLSClientKey string
// TLS CA to validate against when in PKI mode.
TLSCA string
// User agent string
UserAgent string
// Authentication type
AuthType string
// Authentication interactor
AuthInteractor httpbakery.Interactor
// Custom proxy
Proxy func(*http.Request) (*url.URL, error)
// Custom HTTP Client (used as base for the connection)
HTTPClient *http.Client
// Controls whether a client verifies the server's certificate chain and host name.
InsecureSkipVerify bool
// Cookie jar
CookieJar http.CookieJar
// Skip automatic GetServer request upon connection
SkipGetServer bool
}
// ConnectLXD lets you connect to a remote LXD daemon over HTTPs.
//
// A client certificate (TLSClientCert) and key (TLSClientKey) must be provided.
//
// If connecting to a LXD daemon running in PKI mode, the PKI CA (TLSCA) must also be provided.
//
// Unless the remote server is trusted by the system CA, the remote certificate must be provided (TLSServerCert).
func ConnectLXD(url string, args *ConnectionArgs) (ContainerServer, error) {
logger.Debugf("Connecting to a remote LXD over HTTPs")
return httpsLXD(url, args)
}
// ConnectLXDUnix lets you connect to a remote LXD daemon over a local unix socket.
//
// If the path argument is empty, then $LXD_DIR/unix.socket will be used.
// If that one isn't set either, then the path will default to /var/lib/lxd/unix.socket.
func ConnectLXDUnix(path string, args *ConnectionArgs) (ContainerServer, error) {
logger.Debugf("Connecting to a local LXD over a Unix socket")
// Use empty args if not specified
if args == nil {
args = &ConnectionArgs{}
}
// Initialize the client struct
server := ProtocolLXD{
httpHost: "http://unix.socket",
httpProtocol: "unix",
httpUserAgent: args.UserAgent,
}
// Determine the socket path
if path == "" {
lxdDir := os.Getenv("LXD_DIR")
if lxdDir == "" {
lxdDir = "/var/lib/lxd"
}
path = filepath.Join(lxdDir, "unix.socket")
}
// Setup the HTTP client
httpClient, err := unixHTTPClient(args.HTTPClient, path)
if err != nil {
return nil, err
}
server.http = httpClient
// Test the connection and seed the server information
if !args.SkipGetServer {
serverStatus, _, err := server.GetServer()
if err != nil {
return nil, err
}
// Record the server certificate
server.httpCertificate = serverStatus.Environment.Certificate
}
return &server, nil
}
// ConnectPublicLXD lets you connect to a remote public LXD daemon over HTTPs.
//
// Unless the remote server is trusted by the system CA, the remote certificate must be provided (TLSServerCert).
func ConnectPublicLXD(url string, args *ConnectionArgs) (ImageServer, error) {
logger.Debugf("Connecting to a remote public LXD over HTTPs")
return httpsLXD(url, args)
}
// ConnectSimpleStreams lets you connect to a remote SimpleStreams image server over HTTPs.
//
// Unless the remote server is trusted by the system CA, the remote certificate must be provided (TLSServerCert).
func ConnectSimpleStreams(url string, args *ConnectionArgs) (ImageServer, error) {
logger.Debugf("Connecting to a remote simplestreams server")
// Use empty args if not specified
if args == nil {
args = &ConnectionArgs{}
}
// Initialize the client struct
server := ProtocolSimpleStreams{
httpHost: url,
httpUserAgent: args.UserAgent,
httpCertificate: args.TLSServerCert,
}
// Setup the HTTP client
httpClient, err := tlsHTTPClient(args.HTTPClient, args.TLSClientCert, args.TLSClientKey, args.TLSCA, args.TLSServerCert, args.InsecureSkipVerify, args.Proxy)
if err != nil {
return nil, err
}
server.http = httpClient
// Get simplestreams client
ssClient := simplestreams.NewClient(url, *httpClient, args.UserAgent)
server.ssClient = ssClient
return &server, nil
}
// Internal function called by ConnectLXD and ConnectPublicLXD
func httpsLXD(url string, args *ConnectionArgs) (ContainerServer, error) {
// Use empty args if not specified
if args == nil {
args = &ConnectionArgs{}
}
// Initialize the client struct
server := ProtocolLXD{
httpCertificate: args.TLSServerCert,
httpHost: url,
httpProtocol: "https",
httpUserAgent: args.UserAgent,
bakeryInteractor: args.AuthInteractor,
}
if args.AuthType == "macaroons" {
server.RequireAuthenticated(true)
}
// Setup the HTTP client
httpClient, err := tlsHTTPClient(args.HTTPClient, args.TLSClientCert, args.TLSClientKey, args.TLSCA, args.TLSServerCert, args.InsecureSkipVerify, args.Proxy)
if err != nil {
return nil, err
}
if args.CookieJar != nil {
httpClient.Jar = args.CookieJar
}
server.http = httpClient
if args.AuthType == "macaroons" {
server.setupBakeryClient()
}
// Test the connection and seed the server information
if !args.SkipGetServer {
_, _, err := server.GetServer()
if err != nil {
return nil, err
}
}
return &server, nil
}