forked from canonical/lxd
-
Notifications
You must be signed in to change notification settings - Fork 0
/
connection.go
286 lines (228 loc) · 7.19 KB
/
connection.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
package lxd
import (
"crypto/sha256"
"fmt"
"net/http"
"net/url"
"os"
"path/filepath"
"strings"
"time"
"gopkg.in/macaroon-bakery.v2/httpbakery"
"github.com/lxc/lxd/shared"
"github.com/lxc/lxd/shared/logger"
"github.com/lxc/lxd/shared/simplestreams"
)
// ConnectionArgs represents a set of common connection properties
type ConnectionArgs struct {
// TLS certificate of the remote server. If not specified, the system CA is used.
TLSServerCert string
// TLS certificate to use for client authentication.
TLSClientCert string
// TLS key to use for client authentication.
TLSClientKey string
// TLS CA to validate against when in PKI mode.
TLSCA string
// User agent string
UserAgent string
// Authentication type
AuthType string
// Authentication interactor
AuthInteractor []httpbakery.Interactor
// Custom proxy
Proxy func(*http.Request) (*url.URL, error)
// Custom HTTP Client (used as base for the connection)
HTTPClient *http.Client
// Controls whether a client verifies the server's certificate chain and host name.
InsecureSkipVerify bool
// Cookie jar
CookieJar http.CookieJar
// Skip automatic GetServer request upon connection
SkipGetServer bool
// Caching support for image servers
CachePath string
CacheExpiry time.Duration
}
// ConnectLXD lets you connect to a remote LXD daemon over HTTPs.
//
// A client certificate (TLSClientCert) and key (TLSClientKey) must be provided.
//
// If connecting to a LXD daemon running in PKI mode, the PKI CA (TLSCA) must also be provided.
//
// Unless the remote server is trusted by the system CA, the remote certificate must be provided (TLSServerCert).
func ConnectLXD(url string, args *ConnectionArgs) (InstanceServer, error) {
logger.Debugf("Connecting to a remote LXD over HTTPs")
// Cleanup URL
url = strings.TrimSuffix(url, "/")
return httpsLXD(url, args)
}
// ConnectLXDHTTP lets you connect to a VM agent over a VM socket.
func ConnectLXDHTTP(args *ConnectionArgs, client *http.Client) (InstanceServer, error) {
logger.Debugf("Connecting to a VM agent over a VM socket")
// Use empty args if not specified
if args == nil {
args = &ConnectionArgs{}
}
// Initialize the client struct
server := ProtocolLXD{
httpHost: "https://custom.socket",
httpProtocol: "custom",
httpUserAgent: args.UserAgent,
chConnected: make(chan struct{}, 1),
}
// Setup the HTTP client
server.http = client
// Test the connection and seed the server information
if !args.SkipGetServer {
serverStatus, _, err := server.GetServer()
if err != nil {
return nil, err
}
// Record the server certificate
server.httpCertificate = serverStatus.Environment.Certificate
}
return &server, nil
}
// ConnectLXDUnix lets you connect to a remote LXD daemon over a local unix socket.
//
// If the path argument is empty, then $LXD_SOCKET will be used, if
// unset $LXD_DIR/unix.socket will be used and if that one isn't set
// either, then the path will default to /var/lib/lxd/unix.socket.
func ConnectLXDUnix(path string, args *ConnectionArgs) (InstanceServer, error) {
logger.Debugf("Connecting to a local LXD over a Unix socket")
// Use empty args if not specified
if args == nil {
args = &ConnectionArgs{}
}
// Initialize the client struct
server := ProtocolLXD{
httpHost: "http://unix.socket",
httpUnixPath: path,
httpProtocol: "unix",
httpUserAgent: args.UserAgent,
chConnected: make(chan struct{}, 1),
}
// Determine the socket path
if path == "" {
path = os.Getenv("LXD_SOCKET")
if path == "" {
lxdDir := os.Getenv("LXD_DIR")
if lxdDir == "" {
lxdDir = "/var/lib/lxd"
}
path = filepath.Join(lxdDir, "unix.socket")
}
}
path = shared.HostPath(path)
// Setup the HTTP client
httpClient, err := unixHTTPClient(args.HTTPClient, path)
if err != nil {
return nil, err
}
server.http = httpClient
// Test the connection and seed the server information
if !args.SkipGetServer {
serverStatus, _, err := server.GetServer()
if err != nil {
return nil, err
}
// Record the server certificate
server.httpCertificate = serverStatus.Environment.Certificate
}
return &server, nil
}
// ConnectPublicLXD lets you connect to a remote public LXD daemon over HTTPs.
//
// Unless the remote server is trusted by the system CA, the remote certificate must be provided (TLSServerCert).
func ConnectPublicLXD(url string, args *ConnectionArgs) (ImageServer, error) {
logger.Debugf("Connecting to a remote public LXD over HTTPs")
// Cleanup URL
url = strings.TrimSuffix(url, "/")
return httpsLXD(url, args)
}
// ConnectSimpleStreams lets you connect to a remote SimpleStreams image server over HTTPs.
//
// Unless the remote server is trusted by the system CA, the remote certificate must be provided (TLSServerCert).
func ConnectSimpleStreams(url string, args *ConnectionArgs) (ImageServer, error) {
logger.Debugf("Connecting to a remote simplestreams server")
// Cleanup URL
url = strings.TrimSuffix(url, "/")
// Use empty args if not specified
if args == nil {
args = &ConnectionArgs{}
}
// Initialize the client struct
server := ProtocolSimpleStreams{
httpHost: url,
httpUserAgent: args.UserAgent,
httpCertificate: args.TLSServerCert,
}
// Setup the HTTP client
httpClient, err := tlsHTTPClient(args.HTTPClient, args.TLSClientCert, args.TLSClientKey, args.TLSCA, args.TLSServerCert, args.InsecureSkipVerify, args.Proxy)
if err != nil {
return nil, err
}
server.http = httpClient
// Get simplestreams client
ssClient := simplestreams.NewClient(url, *httpClient, args.UserAgent)
server.ssClient = ssClient
// Setup the cache
if args.CachePath != "" {
if !shared.PathExists(args.CachePath) {
return nil, fmt.Errorf("Cache directory '%s' doesn't exist", args.CachePath)
}
hashedURL := fmt.Sprintf("%x", sha256.Sum256([]byte(url)))
cachePath := filepath.Join(args.CachePath, hashedURL)
cacheExpiry := args.CacheExpiry
if cacheExpiry == 0 {
cacheExpiry = time.Hour
}
if !shared.PathExists(cachePath) {
err := os.Mkdir(cachePath, 0755)
if err != nil {
return nil, err
}
}
ssClient.SetCache(cachePath, cacheExpiry)
}
return &server, nil
}
// Internal function called by ConnectLXD and ConnectPublicLXD
func httpsLXD(url string, args *ConnectionArgs) (InstanceServer, error) {
// Use empty args if not specified
if args == nil {
args = &ConnectionArgs{}
}
// Initialize the client struct
server := ProtocolLXD{
httpCertificate: args.TLSServerCert,
httpHost: url,
httpProtocol: "https",
httpUserAgent: args.UserAgent,
bakeryInteractor: args.AuthInteractor,
chConnected: make(chan struct{}, 1),
}
if args.AuthType == "candid" {
server.RequireAuthenticated(true)
}
// Setup the HTTP client
httpClient, err := tlsHTTPClient(args.HTTPClient, args.TLSClientCert, args.TLSClientKey, args.TLSCA, args.TLSServerCert, args.InsecureSkipVerify, args.Proxy)
if err != nil {
return nil, err
}
if args.CookieJar != nil {
httpClient.Jar = args.CookieJar
}
server.http = httpClient
if args.AuthType == "candid" {
server.setupBakeryClient()
}
// Test the connection and seed the server information
if !args.SkipGetServer {
_, _, err := server.GetServer()
if err != nil {
return nil, err
}
}
return &server, nil
}