v0.25.1
This commit is contained in:
Mateusz Gruszczyński committed
1 parent
87e571c170
commit
fa7abc9e53
308 files changed
+49746
-50237
No files matched your search
@@ -0,0 +1,136 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"crypto/ecdsa"
|
||||
"crypto/elliptic"
|
||||
"crypto/rand"
|
||||
"crypto/sha256"
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"crypto/x509/pkix"
|
||||
"encoding/hex"
|
||||
"encoding/pem"
|
||||
"errors"
|
||||
"fmt"
|
||||
"math/big"
|
||||
"net"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"time"
|
||||
)
|
||||
|
||||
func certificateFingerprintDER(der []byte) string {
|
||||
sum := sha256.Sum256(der)
|
||||
return hex.EncodeToString(sum[:])
|
||||
}
|
||||
|
||||
func certificateFingerprint(certFile string) (string, error) {
|
||||
raw, err := os.ReadFile(certFile)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
block, _ := pem.Decode(raw)
|
||||
if block == nil || block.Type != "CERTIFICATE" {
|
||||
return "", fmt.Errorf("%s does not contain a PEM certificate", certFile)
|
||||
}
|
||||
cert, err := x509.ParseCertificate(block.Bytes)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("parse certificate: %w", err)
|
||||
}
|
||||
return certificateFingerprintDER(cert.Raw), nil
|
||||
}
|
||||
|
||||
func atomicWrite(path string, data []byte, mode os.FileMode) error {
|
||||
dir := filepath.Dir(path)
|
||||
if err := os.MkdirAll(dir, 0750); err != nil {
|
||||
return err
|
||||
}
|
||||
tmp, err := os.CreateTemp(dir, ".rustproxy-agent-*")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
tmpName := tmp.Name()
|
||||
defer os.Remove(tmpName)
|
||||
if err := tmp.Chmod(mode); err != nil {
|
||||
tmp.Close()
|
||||
return err
|
||||
}
|
||||
if _, err := tmp.Write(data); err != nil {
|
||||
tmp.Close()
|
||||
return err
|
||||
}
|
||||
if err := tmp.Sync(); err != nil {
|
||||
tmp.Close()
|
||||
return err
|
||||
}
|
||||
if err := tmp.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
return os.Rename(tmpName, path)
|
||||
}
|
||||
|
||||
func ensureSelfSignedCertificate(certFile, keyFile, hostname string) (string, bool, error) {
|
||||
certInfo, certErr := os.Stat(certFile)
|
||||
keyInfo, keyErr := os.Stat(keyFile)
|
||||
if certErr == nil && keyErr == nil {
|
||||
if certInfo.IsDir() || keyInfo.IsDir() {
|
||||
return "", false, errors.New("TLS certificate/key path points to a directory")
|
||||
}
|
||||
if _, err := tls.LoadX509KeyPair(certFile, keyFile); err != nil {
|
||||
return "", false, fmt.Errorf("load TLS certificate/key: %w", err)
|
||||
}
|
||||
fp, err := certificateFingerprint(certFile)
|
||||
return fp, false, err
|
||||
}
|
||||
if (certErr == nil) != (keyErr == nil) {
|
||||
return "", false, errors.New("only one TLS certificate/key file exists; refusing to replace the other")
|
||||
}
|
||||
if certErr != nil && !os.IsNotExist(certErr) {
|
||||
return "", false, certErr
|
||||
}
|
||||
if keyErr != nil && !os.IsNotExist(keyErr) {
|
||||
return "", false, keyErr
|
||||
}
|
||||
privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
|
||||
if err != nil {
|
||||
return "", false, fmt.Errorf("generate TLS key: %w", err)
|
||||
}
|
||||
serialLimit := new(big.Int).Lsh(big.NewInt(1), 128)
|
||||
serial, err := rand.Int(rand.Reader, serialLimit)
|
||||
if err != nil {
|
||||
return "", false, fmt.Errorf("generate TLS serial: %w", err)
|
||||
}
|
||||
now := time.Now().UTC()
|
||||
template := &x509.Certificate{
|
||||
SerialNumber: serial,
|
||||
Subject: pkix.Name{CommonName: hostname, Organization: []string{"RustProxy Docker Agent"}},
|
||||
NotBefore: now.Add(-5 * time.Minute),
|
||||
NotAfter: now.AddDate(10, 0, 0),
|
||||
KeyUsage: x509.KeyUsageDigitalSignature,
|
||||
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
|
||||
BasicConstraintsValid: true,
|
||||
}
|
||||
if hostname != "" {
|
||||
if ip := net.ParseIP(hostname); ip != nil {
|
||||
template.IPAddresses = append(template.IPAddresses, ip)
|
||||
} else {
|
||||
template.DNSNames = append(template.DNSNames, hostname)
|
||||
}
|
||||
}
|
||||
der, err := x509.CreateCertificate(rand.Reader, template, template, &privateKey.PublicKey, privateKey)
|
||||
if err != nil {
|
||||
return "", false, fmt.Errorf("create TLS certificate: %w", err)
|
||||
}
|
||||
keyDER, err := x509.MarshalPKCS8PrivateKey(privateKey)
|
||||
if err != nil {
|
||||
return "", false, fmt.Errorf("marshal TLS key: %w", err)
|
||||
}
|
||||
if err := atomicWrite(keyFile, pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: keyDER}), 0600); err != nil {
|
||||
return "", false, fmt.Errorf("write TLS key: %w", err)
|
||||
}
|
||||
if err := atomicWrite(certFile, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}), 0644); err != nil {
|
||||
_ = os.Remove(keyFile)
|
||||
return "", false, fmt.Errorf("write TLS certificate: %w", err)
|
||||
}
|
||||
return certificateFingerprintDER(der), true, nil
|
||||
}
|
||||
@@ -0,0 +1,167 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net"
|
||||
"net/http"
|
||||
"sort"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
type unixRoundTripper struct{ sock string }
|
||||
|
||||
func (u unixRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
|
||||
transport := &http.Transport{
|
||||
DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
|
||||
var d net.Dialer
|
||||
return d.DialContext(ctx, "unix", u.sock)
|
||||
},
|
||||
DisableKeepAlives: false,
|
||||
}
|
||||
clone := req.Clone(req.Context())
|
||||
clone.URL.Scheme = "http"
|
||||
clone.URL.Host = "docker"
|
||||
return transport.RoundTrip(clone)
|
||||
}
|
||||
|
||||
func dockerContainers(ctx context.Context, sock string) ([]dockerContainer, error) {
|
||||
client := &http.Client{Transport: unixRoundTripper{sock: sock}, Timeout: 4 * time.Second}
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, "http://docker/containers/json?all=0", nil)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("docker API: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
body, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
|
||||
return nil, fmt.Errorf("docker API returned %s: %s", resp.Status, strings.TrimSpace(string(body)))
|
||||
}
|
||||
var items []dockerContainer
|
||||
dec := json.NewDecoder(io.LimitReader(resp.Body, 4<<20))
|
||||
if err := dec.Decode(&items); err != nil {
|
||||
return nil, fmt.Errorf("decode Docker response: %w", err)
|
||||
}
|
||||
return items, nil
|
||||
}
|
||||
|
||||
func cleanName(names []string) string {
|
||||
if len(names) == 0 {
|
||||
return "container"
|
||||
}
|
||||
name := strings.TrimPrefix(names[0], "/")
|
||||
if name == "" {
|
||||
return "container"
|
||||
}
|
||||
return name
|
||||
}
|
||||
|
||||
func dnsLabel(value string) string {
|
||||
value = strings.ToLower(value)
|
||||
var b strings.Builder
|
||||
dash := false
|
||||
for _, r := range value {
|
||||
ok := (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9')
|
||||
if ok {
|
||||
b.WriteRune(r)
|
||||
dash = false
|
||||
} else if b.Len() > 0 && !dash {
|
||||
b.WriteByte('-')
|
||||
dash = true
|
||||
}
|
||||
}
|
||||
out := strings.Trim(b.String(), "-")
|
||||
if out == "" {
|
||||
out = "app"
|
||||
}
|
||||
if len(out) > 48 {
|
||||
out = strings.Trim(out[:48], "-")
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func serviceIdentity(c dockerContainer, p dockerPort) (key, technical string) {
|
||||
name := cleanName(c.Names)
|
||||
project := c.Labels["com.docker.compose.project"]
|
||||
composeService := c.Labels["com.docker.compose.service"]
|
||||
replica := c.Labels["com.docker.compose.container-number"]
|
||||
suffix := strconv.Itoa(int(p.PrivatePort))
|
||||
if project != "" && composeService != "" {
|
||||
if replica == "" {
|
||||
replica = name
|
||||
}
|
||||
key = fmt.Sprintf("compose:%s/%s/%s:%d/%s", project, composeService, replica, p.PrivatePort, p.Type)
|
||||
technicalBase := project + "-" + composeService
|
||||
if replica != "1" {
|
||||
technicalBase += "-" + replica
|
||||
}
|
||||
technical = dnsLabel(technicalBase + "-" + suffix)
|
||||
} else {
|
||||
key = fmt.Sprintf("container:%s:%d/%s", name, p.PrivatePort, p.Type)
|
||||
technical = dnsLabel(name + "-" + suffix)
|
||||
}
|
||||
return key, technical
|
||||
}
|
||||
|
||||
func servicesFrom(containers []dockerContainer) []service {
|
||||
byKey := make(map[string]*service)
|
||||
bindingSeen := make(map[string]map[string]struct{})
|
||||
for _, c := range containers {
|
||||
name := cleanName(c.Names)
|
||||
for _, p := range c.Ports {
|
||||
if p.PublicPort == 0 || p.Type != "tcp" {
|
||||
continue
|
||||
}
|
||||
if bind := net.ParseIP(strings.TrimSpace(p.IP)); bind != nil && bind.IsLoopback() {
|
||||
continue
|
||||
}
|
||||
key, technical := serviceIdentity(c, p)
|
||||
item := byKey[key]
|
||||
if item == nil {
|
||||
id := c.ID
|
||||
if len(id) > 12 {
|
||||
id = id[:12]
|
||||
}
|
||||
item = &service{
|
||||
Key: key, TechnicalName: technical, ContainerID: id, ContainerName: name,
|
||||
Image: c.Image, PrivatePort: p.PrivatePort, Protocol: p.Type,
|
||||
}
|
||||
byKey[key] = item
|
||||
bindingSeen[key] = make(map[string]struct{})
|
||||
}
|
||||
bindIP := strings.TrimSpace(p.IP)
|
||||
dedupe := bindIP + "|" + strconv.Itoa(int(p.PublicPort))
|
||||
if _, ok := bindingSeen[key][dedupe]; ok {
|
||||
continue
|
||||
}
|
||||
bindingSeen[key][dedupe] = struct{}{}
|
||||
item.Bindings = append(item.Bindings, binding{BindIP: bindIP, PublicPort: p.PublicPort})
|
||||
}
|
||||
}
|
||||
out := make([]service, 0, len(byKey))
|
||||
for _, item := range byKey {
|
||||
sort.Slice(item.Bindings, func(i, j int) bool {
|
||||
left := net.ParseIP(strings.TrimSpace(item.Bindings[i].BindIP))
|
||||
right := net.ParseIP(strings.TrimSpace(item.Bindings[j].BindIP))
|
||||
leftWildcard := left == nil || left.IsUnspecified()
|
||||
rightWildcard := right == nil || right.IsUnspecified()
|
||||
if leftWildcard != rightWildcard {
|
||||
return !leftWildcard
|
||||
}
|
||||
if item.Bindings[i].BindIP != item.Bindings[j].BindIP {
|
||||
return item.Bindings[i].BindIP < item.Bindings[j].BindIP
|
||||
}
|
||||
return item.Bindings[i].PublicPort < item.Bindings[j].PublicPort
|
||||
})
|
||||
out = append(out, *item)
|
||||
}
|
||||
sort.Slice(out, func(i, j int) bool { return out[i].Key < out[j].Key })
|
||||
return out
|
||||
}
|
||||
@@ -2,602 +2,20 @@ package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/ecdsa"
|
||||
"crypto/elliptic"
|
||||
"crypto/rand"
|
||||
"crypto/sha256"
|
||||
"crypto/subtle"
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"crypto/x509/pkix"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"encoding/pem"
|
||||
"errors"
|
||||
"flag"
|
||||
"fmt"
|
||||
"io"
|
||||
"log"
|
||||
"math/big"
|
||||
"net"
|
||||
"net/http"
|
||||
"os"
|
||||
"os/signal"
|
||||
"path/filepath"
|
||||
"sort"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
"syscall"
|
||||
"time"
|
||||
)
|
||||
|
||||
const version = "0.25.0"
|
||||
|
||||
type config struct {
|
||||
Listen string
|
||||
Token string
|
||||
DockerSock string
|
||||
AdvertiseIP string
|
||||
PublicIPURL string
|
||||
Hostname string
|
||||
TLS bool
|
||||
CertFile string
|
||||
KeyFile string
|
||||
Fingerprint string
|
||||
}
|
||||
|
||||
type dockerPort struct {
|
||||
IP string `json:"IP"`
|
||||
PrivatePort uint16 `json:"PrivatePort"`
|
||||
PublicPort uint16 `json:"PublicPort"`
|
||||
Type string `json:"Type"`
|
||||
}
|
||||
|
||||
type dockerContainer struct {
|
||||
ID string `json:"Id"`
|
||||
Names []string `json:"Names"`
|
||||
Image string `json:"Image"`
|
||||
Labels map[string]string `json:"Labels"`
|
||||
Ports []dockerPort `json:"Ports"`
|
||||
}
|
||||
|
||||
type binding struct {
|
||||
BindIP string `json:"bind_ip"`
|
||||
PublicPort uint16 `json:"public_port"`
|
||||
}
|
||||
|
||||
type service struct {
|
||||
Key string `json:"key"`
|
||||
TechnicalName string `json:"technical_name"`
|
||||
ContainerID string `json:"container_id"`
|
||||
ContainerName string `json:"container_name"`
|
||||
Image string `json:"image"`
|
||||
PrivatePort uint16 `json:"private_port"`
|
||||
Protocol string `json:"protocol"`
|
||||
Bindings []binding `json:"bindings"`
|
||||
}
|
||||
|
||||
type hostAddress struct {
|
||||
IP string `json:"ip"`
|
||||
Source string `json:"source"`
|
||||
Interface string `json:"interface,omitempty"`
|
||||
Scope string `json:"scope"`
|
||||
}
|
||||
|
||||
type inventory struct {
|
||||
AgentVersion string `json:"agent_version"`
|
||||
Hostname string `json:"hostname"`
|
||||
PublicIP string `json:"public_ip"`
|
||||
PublicIPSource string `json:"public_ip_source"`
|
||||
CertificateSHA256 string `json:"certificate_sha256"`
|
||||
Addresses []hostAddress `json:"addresses"`
|
||||
ObservedAt string `json:"observed_at"`
|
||||
Services []service `json:"services"`
|
||||
}
|
||||
|
||||
type unixRoundTripper struct{ sock string }
|
||||
|
||||
func (u unixRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
|
||||
transport := &http.Transport{
|
||||
DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
|
||||
var d net.Dialer
|
||||
return d.DialContext(ctx, "unix", u.sock)
|
||||
},
|
||||
DisableKeepAlives: false,
|
||||
}
|
||||
clone := req.Clone(req.Context())
|
||||
clone.URL.Scheme = "http"
|
||||
clone.URL.Host = "docker"
|
||||
return transport.RoundTrip(clone)
|
||||
}
|
||||
|
||||
func dockerContainers(ctx context.Context, sock string) ([]dockerContainer, error) {
|
||||
client := &http.Client{Transport: unixRoundTripper{sock: sock}, Timeout: 4 * time.Second}
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, "http://docker/containers/json?all=0", nil)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("docker API: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
body, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
|
||||
return nil, fmt.Errorf("docker API returned %s: %s", resp.Status, strings.TrimSpace(string(body)))
|
||||
}
|
||||
var items []dockerContainer
|
||||
dec := json.NewDecoder(io.LimitReader(resp.Body, 4<<20))
|
||||
if err := dec.Decode(&items); err != nil {
|
||||
return nil, fmt.Errorf("decode Docker response: %w", err)
|
||||
}
|
||||
return items, nil
|
||||
}
|
||||
|
||||
func cleanName(names []string) string {
|
||||
if len(names) == 0 {
|
||||
return "container"
|
||||
}
|
||||
name := strings.TrimPrefix(names[0], "/")
|
||||
if name == "" {
|
||||
return "container"
|
||||
}
|
||||
return name
|
||||
}
|
||||
|
||||
func dnsLabel(value string) string {
|
||||
value = strings.ToLower(value)
|
||||
var b strings.Builder
|
||||
dash := false
|
||||
for _, r := range value {
|
||||
ok := (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9')
|
||||
if ok {
|
||||
b.WriteRune(r)
|
||||
dash = false
|
||||
} else if b.Len() > 0 && !dash {
|
||||
b.WriteByte('-')
|
||||
dash = true
|
||||
}
|
||||
}
|
||||
out := strings.Trim(b.String(), "-")
|
||||
if out == "" {
|
||||
out = "app"
|
||||
}
|
||||
if len(out) > 48 {
|
||||
out = strings.Trim(out[:48], "-")
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func serviceIdentity(c dockerContainer, p dockerPort) (key, technical string) {
|
||||
name := cleanName(c.Names)
|
||||
project := c.Labels["com.docker.compose.project"]
|
||||
composeService := c.Labels["com.docker.compose.service"]
|
||||
replica := c.Labels["com.docker.compose.container-number"]
|
||||
suffix := strconv.Itoa(int(p.PrivatePort))
|
||||
if project != "" && composeService != "" {
|
||||
if replica == "" {
|
||||
replica = name
|
||||
}
|
||||
key = fmt.Sprintf("compose:%s/%s/%s:%d/%s", project, composeService, replica, p.PrivatePort, p.Type)
|
||||
technicalBase := project + "-" + composeService
|
||||
if replica != "1" {
|
||||
technicalBase += "-" + replica
|
||||
}
|
||||
technical = dnsLabel(technicalBase + "-" + suffix)
|
||||
} else {
|
||||
key = fmt.Sprintf("container:%s:%d/%s", name, p.PrivatePort, p.Type)
|
||||
technical = dnsLabel(name + "-" + suffix)
|
||||
}
|
||||
return key, technical
|
||||
}
|
||||
|
||||
func validIP(raw string) string {
|
||||
ip := net.ParseIP(strings.TrimSpace(raw))
|
||||
if ip == nil || ip.IsUnspecified() || ip.IsLoopback() || ip.IsMulticast() || ip.IsLinkLocalUnicast() {
|
||||
return ""
|
||||
}
|
||||
return ip.String()
|
||||
}
|
||||
|
||||
func servicesFrom(containers []dockerContainer) []service {
|
||||
byKey := make(map[string]*service)
|
||||
bindingSeen := make(map[string]map[string]struct{})
|
||||
for _, c := range containers {
|
||||
name := cleanName(c.Names)
|
||||
for _, p := range c.Ports {
|
||||
if p.PublicPort == 0 || p.Type != "tcp" {
|
||||
continue
|
||||
}
|
||||
if bind := net.ParseIP(strings.TrimSpace(p.IP)); bind != nil && bind.IsLoopback() {
|
||||
continue
|
||||
}
|
||||
key, technical := serviceIdentity(c, p)
|
||||
item := byKey[key]
|
||||
if item == nil {
|
||||
id := c.ID
|
||||
if len(id) > 12 {
|
||||
id = id[:12]
|
||||
}
|
||||
item = &service{
|
||||
Key: key, TechnicalName: technical, ContainerID: id, ContainerName: name,
|
||||
Image: c.Image, PrivatePort: p.PrivatePort, Protocol: p.Type,
|
||||
}
|
||||
byKey[key] = item
|
||||
bindingSeen[key] = make(map[string]struct{})
|
||||
}
|
||||
bindIP := strings.TrimSpace(p.IP)
|
||||
dedupe := bindIP + "|" + strconv.Itoa(int(p.PublicPort))
|
||||
if _, ok := bindingSeen[key][dedupe]; ok {
|
||||
continue
|
||||
}
|
||||
bindingSeen[key][dedupe] = struct{}{}
|
||||
item.Bindings = append(item.Bindings, binding{BindIP: bindIP, PublicPort: p.PublicPort})
|
||||
}
|
||||
}
|
||||
out := make([]service, 0, len(byKey))
|
||||
for _, item := range byKey {
|
||||
sort.Slice(item.Bindings, func(i, j int) bool {
|
||||
left := net.ParseIP(strings.TrimSpace(item.Bindings[i].BindIP))
|
||||
right := net.ParseIP(strings.TrimSpace(item.Bindings[j].BindIP))
|
||||
leftWildcard := left == nil || left.IsUnspecified()
|
||||
rightWildcard := right == nil || right.IsUnspecified()
|
||||
if leftWildcard != rightWildcard {
|
||||
return !leftWildcard
|
||||
}
|
||||
if item.Bindings[i].BindIP != item.Bindings[j].BindIP {
|
||||
return item.Bindings[i].BindIP < item.Bindings[j].BindIP
|
||||
}
|
||||
return item.Bindings[i].PublicPort < item.Bindings[j].PublicPort
|
||||
})
|
||||
out = append(out, *item)
|
||||
}
|
||||
sort.Slice(out, func(i, j int) bool { return out[i].Key < out[j].Key })
|
||||
return out
|
||||
}
|
||||
|
||||
func publicIPFromURL(ctx context.Context, rawURL string) string {
|
||||
if rawURL == "" {
|
||||
return ""
|
||||
}
|
||||
client := &http.Client{Timeout: 2 * time.Second}
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, rawURL, nil)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return ""
|
||||
}
|
||||
body, err := io.ReadAll(io.LimitReader(resp.Body, 128))
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
return validIP(string(body))
|
||||
}
|
||||
|
||||
func routeIP() string {
|
||||
conn, err := net.DialTimeout("udp", "1.1.1.1:53", time.Second)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
defer conn.Close()
|
||||
if addr, ok := conn.LocalAddr().(*net.UDPAddr); ok {
|
||||
return validIP(addr.IP.String())
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func ipScope(ip net.IP) string {
|
||||
switch {
|
||||
case ip.IsPrivate():
|
||||
return "private"
|
||||
case ip.IsLinkLocalUnicast():
|
||||
return "link_local"
|
||||
default:
|
||||
return "public"
|
||||
}
|
||||
}
|
||||
|
||||
func skipInterface(name string) bool {
|
||||
name = strings.ToLower(strings.TrimSpace(name))
|
||||
return name == "docker0" || strings.HasPrefix(name, "docker") || strings.HasPrefix(name, "veth") || strings.HasPrefix(name, "br-") || strings.HasPrefix(name, "virbr")
|
||||
}
|
||||
|
||||
func localHostAddresses() []hostAddress {
|
||||
interfaces, err := net.Interfaces()
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
out := make([]hostAddress, 0)
|
||||
for _, iface := range interfaces {
|
||||
if iface.Flags&net.FlagUp == 0 || iface.Flags&net.FlagLoopback != 0 || skipInterface(iface.Name) {
|
||||
continue
|
||||
}
|
||||
addrs, err := iface.Addrs()
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
for _, addr := range addrs {
|
||||
raw := addr.String()
|
||||
if host, _, err := net.ParseCIDR(raw); err == nil {
|
||||
raw = host.String()
|
||||
} else if host, _, err := net.SplitHostPort(raw); err == nil {
|
||||
raw = host
|
||||
}
|
||||
clean := validIP(raw)
|
||||
if clean == "" {
|
||||
continue
|
||||
}
|
||||
ip := net.ParseIP(clean)
|
||||
out = append(out, hostAddress{IP: clean, Source: "interface", Interface: iface.Name, Scope: ipScope(ip)})
|
||||
}
|
||||
}
|
||||
sort.Slice(out, func(i, j int) bool {
|
||||
if out[i].Interface != out[j].Interface {
|
||||
return out[i].Interface < out[j].Interface
|
||||
}
|
||||
return out[i].IP < out[j].IP
|
||||
})
|
||||
return out
|
||||
}
|
||||
|
||||
type ipDetector struct {
|
||||
mu sync.Mutex
|
||||
publicIP string
|
||||
expires time.Time
|
||||
}
|
||||
|
||||
func (d *ipDetector) public(ctx context.Context, rawURL string) string {
|
||||
if rawURL == "" {
|
||||
return ""
|
||||
}
|
||||
d.mu.Lock()
|
||||
defer d.mu.Unlock()
|
||||
if time.Now().Before(d.expires) {
|
||||
return d.publicIP
|
||||
}
|
||||
d.publicIP = publicIPFromURL(ctx, rawURL)
|
||||
d.expires = time.Now().Add(5 * time.Minute)
|
||||
if d.publicIP == "" {
|
||||
d.expires = time.Now().Add(30 * time.Second)
|
||||
}
|
||||
return d.publicIP
|
||||
}
|
||||
|
||||
func mergeHostAddress(out *[]hostAddress, index map[string]int, candidate hostAddress) {
|
||||
candidate.IP = validIP(candidate.IP)
|
||||
if candidate.IP == "" {
|
||||
return
|
||||
}
|
||||
if candidate.Scope == "" {
|
||||
candidate.Scope = ipScope(net.ParseIP(candidate.IP))
|
||||
}
|
||||
if pos, ok := index[candidate.IP]; ok {
|
||||
existing := &(*out)[pos]
|
||||
if candidate.Interface != "" && existing.Interface == "" {
|
||||
existing.Interface = candidate.Interface
|
||||
}
|
||||
if candidate.Source != "" && !strings.Contains(existing.Source, candidate.Source) {
|
||||
if existing.Source == "" {
|
||||
existing.Source = candidate.Source
|
||||
} else {
|
||||
existing.Source += "," + candidate.Source
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
index[candidate.IP] = len(*out)
|
||||
*out = append(*out, candidate)
|
||||
}
|
||||
|
||||
func detectedAddresses(ctx context.Context, cfg config, detector *ipDetector) ([]hostAddress, string, string) {
|
||||
out := make([]hostAddress, 0, 8)
|
||||
index := make(map[string]int)
|
||||
for _, item := range localHostAddresses() {
|
||||
mergeHostAddress(&out, index, item)
|
||||
}
|
||||
routed := routeIP()
|
||||
if routed != "" {
|
||||
mergeHostAddress(&out, index, hostAddress{IP: routed, Source: "route"})
|
||||
}
|
||||
public := detector.public(ctx, cfg.PublicIPURL)
|
||||
if public != "" {
|
||||
mergeHostAddress(&out, index, hostAddress{IP: public, Source: "public_api"})
|
||||
}
|
||||
advertised := validIP(cfg.AdvertiseIP)
|
||||
if advertised != "" {
|
||||
mergeHostAddress(&out, index, hostAddress{IP: advertised, Source: "override"})
|
||||
}
|
||||
|
||||
switch {
|
||||
case advertised != "":
|
||||
return out, advertised, "override"
|
||||
case routed != "":
|
||||
return out, routed, "route"
|
||||
case public != "":
|
||||
return out, public, "public_api"
|
||||
case len(out) > 0:
|
||||
return out, out[0].IP, out[0].Source
|
||||
default:
|
||||
return out, "", "unavailable"
|
||||
}
|
||||
}
|
||||
|
||||
func certificateFingerprintDER(der []byte) string {
|
||||
sum := sha256.Sum256(der)
|
||||
return hex.EncodeToString(sum[:])
|
||||
}
|
||||
|
||||
func certificateFingerprint(certFile string) (string, error) {
|
||||
raw, err := os.ReadFile(certFile)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
block, _ := pem.Decode(raw)
|
||||
if block == nil || block.Type != "CERTIFICATE" {
|
||||
return "", fmt.Errorf("%s does not contain a PEM certificate", certFile)
|
||||
}
|
||||
cert, err := x509.ParseCertificate(block.Bytes)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("parse certificate: %w", err)
|
||||
}
|
||||
return certificateFingerprintDER(cert.Raw), nil
|
||||
}
|
||||
|
||||
func atomicWrite(path string, data []byte, mode os.FileMode) error {
|
||||
dir := filepath.Dir(path)
|
||||
if err := os.MkdirAll(dir, 0750); err != nil {
|
||||
return err
|
||||
}
|
||||
tmp, err := os.CreateTemp(dir, ".rustproxy-agent-*")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
tmpName := tmp.Name()
|
||||
defer os.Remove(tmpName)
|
||||
if err := tmp.Chmod(mode); err != nil {
|
||||
tmp.Close()
|
||||
return err
|
||||
}
|
||||
if _, err := tmp.Write(data); err != nil {
|
||||
tmp.Close()
|
||||
return err
|
||||
}
|
||||
if err := tmp.Sync(); err != nil {
|
||||
tmp.Close()
|
||||
return err
|
||||
}
|
||||
if err := tmp.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
return os.Rename(tmpName, path)
|
||||
}
|
||||
|
||||
func ensureSelfSignedCertificate(certFile, keyFile, hostname string) (string, bool, error) {
|
||||
certInfo, certErr := os.Stat(certFile)
|
||||
keyInfo, keyErr := os.Stat(keyFile)
|
||||
if certErr == nil && keyErr == nil {
|
||||
if certInfo.IsDir() || keyInfo.IsDir() {
|
||||
return "", false, errors.New("TLS certificate/key path points to a directory")
|
||||
}
|
||||
if _, err := tls.LoadX509KeyPair(certFile, keyFile); err != nil {
|
||||
return "", false, fmt.Errorf("load TLS certificate/key: %w", err)
|
||||
}
|
||||
fp, err := certificateFingerprint(certFile)
|
||||
return fp, false, err
|
||||
}
|
||||
if (certErr == nil) != (keyErr == nil) {
|
||||
return "", false, errors.New("only one TLS certificate/key file exists; refusing to replace the other")
|
||||
}
|
||||
if certErr != nil && !os.IsNotExist(certErr) {
|
||||
return "", false, certErr
|
||||
}
|
||||
if keyErr != nil && !os.IsNotExist(keyErr) {
|
||||
return "", false, keyErr
|
||||
}
|
||||
privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
|
||||
if err != nil {
|
||||
return "", false, fmt.Errorf("generate TLS key: %w", err)
|
||||
}
|
||||
serialLimit := new(big.Int).Lsh(big.NewInt(1), 128)
|
||||
serial, err := rand.Int(rand.Reader, serialLimit)
|
||||
if err != nil {
|
||||
return "", false, fmt.Errorf("generate TLS serial: %w", err)
|
||||
}
|
||||
now := time.Now().UTC()
|
||||
template := &x509.Certificate{
|
||||
SerialNumber: serial,
|
||||
Subject: pkix.Name{CommonName: hostname, Organization: []string{"RustProxy Docker Agent"}},
|
||||
NotBefore: now.Add(-5 * time.Minute),
|
||||
NotAfter: now.AddDate(10, 0, 0),
|
||||
KeyUsage: x509.KeyUsageDigitalSignature,
|
||||
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
|
||||
BasicConstraintsValid: true,
|
||||
}
|
||||
if hostname != "" {
|
||||
if ip := net.ParseIP(hostname); ip != nil {
|
||||
template.IPAddresses = append(template.IPAddresses, ip)
|
||||
} else {
|
||||
template.DNSNames = append(template.DNSNames, hostname)
|
||||
}
|
||||
}
|
||||
der, err := x509.CreateCertificate(rand.Reader, template, template, &privateKey.PublicKey, privateKey)
|
||||
if err != nil {
|
||||
return "", false, fmt.Errorf("create TLS certificate: %w", err)
|
||||
}
|
||||
keyDER, err := x509.MarshalPKCS8PrivateKey(privateKey)
|
||||
if err != nil {
|
||||
return "", false, fmt.Errorf("marshal TLS key: %w", err)
|
||||
}
|
||||
if err := atomicWrite(keyFile, pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: keyDER}), 0600); err != nil {
|
||||
return "", false, fmt.Errorf("write TLS key: %w", err)
|
||||
}
|
||||
if err := atomicWrite(certFile, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}), 0644); err != nil {
|
||||
_ = os.Remove(keyFile)
|
||||
return "", false, fmt.Errorf("write TLS certificate: %w", err)
|
||||
}
|
||||
return certificateFingerprintDER(der), true, nil
|
||||
}
|
||||
|
||||
func tokenOK(got, expected string) bool {
|
||||
if expected == "" || len(got) != len(expected) {
|
||||
return false
|
||||
}
|
||||
return subtle.ConstantTimeCompare([]byte(got), []byte(expected)) == 1
|
||||
}
|
||||
|
||||
func handler(cfg config) http.Handler {
|
||||
mux := http.NewServeMux()
|
||||
detector := &ipDetector{}
|
||||
mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
|
||||
if r.Method != http.MethodGet {
|
||||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||||
return
|
||||
}
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.Header().Set("Cache-Control", "no-store")
|
||||
if cfg.Fingerprint != "" {
|
||||
w.Header().Set("X-RustProxy-Agent-Certificate-SHA256", cfg.Fingerprint)
|
||||
}
|
||||
_, _ = io.WriteString(w, `{"status":"ok"}`)
|
||||
})
|
||||
mux.HandleFunc("/v1/inventory", func(w http.ResponseWriter, r *http.Request) {
|
||||
if r.Method != http.MethodGet {
|
||||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||||
return
|
||||
}
|
||||
auth := strings.TrimSpace(r.Header.Get("Authorization"))
|
||||
const prefix = "Bearer "
|
||||
if !strings.HasPrefix(auth, prefix) || !tokenOK(strings.TrimSpace(strings.TrimPrefix(auth, prefix)), cfg.Token) {
|
||||
w.Header().Set("WWW-Authenticate", "Bearer")
|
||||
http.Error(w, "unauthorized", http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
containers, err := dockerContainers(r.Context(), cfg.DockerSock)
|
||||
if err != nil {
|
||||
http.Error(w, err.Error(), http.StatusBadGateway)
|
||||
return
|
||||
}
|
||||
addresses, primaryIP, primarySource := detectedAddresses(r.Context(), cfg, detector)
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.Header().Set("Cache-Control", "no-store")
|
||||
if cfg.Fingerprint != "" {
|
||||
w.Header().Set("X-RustProxy-Agent-Certificate-SHA256", cfg.Fingerprint)
|
||||
}
|
||||
_ = json.NewEncoder(w).Encode(inventory{
|
||||
AgentVersion: version, Hostname: cfg.Hostname, PublicIP: primaryIP, PublicIPSource: primarySource, CertificateSHA256: cfg.Fingerprint,
|
||||
Addresses: addresses, ObservedAt: time.Now().UTC().Format(time.RFC3339), Services: servicesFrom(containers),
|
||||
})
|
||||
})
|
||||
return mux
|
||||
}
|
||||
|
||||
func envOr(name, fallback string) string {
|
||||
if value := strings.TrimSpace(os.Getenv(name)); value != "" {
|
||||
return value
|
||||
|
||||
@@ -0,0 +1,65 @@
|
||||
package main
|
||||
|
||||
const version = "0.25.1"
|
||||
|
||||
type config struct {
|
||||
Listen string
|
||||
Token string
|
||||
DockerSock string
|
||||
AdvertiseIP string
|
||||
PublicIPURL string
|
||||
Hostname string
|
||||
TLS bool
|
||||
CertFile string
|
||||
KeyFile string
|
||||
Fingerprint string
|
||||
}
|
||||
|
||||
type dockerPort struct {
|
||||
IP string `json:"IP"`
|
||||
PrivatePort uint16 `json:"PrivatePort"`
|
||||
PublicPort uint16 `json:"PublicPort"`
|
||||
Type string `json:"Type"`
|
||||
}
|
||||
|
||||
type dockerContainer struct {
|
||||
ID string `json:"Id"`
|
||||
Names []string `json:"Names"`
|
||||
Image string `json:"Image"`
|
||||
Labels map[string]string `json:"Labels"`
|
||||
Ports []dockerPort `json:"Ports"`
|
||||
}
|
||||
|
||||
type binding struct {
|
||||
BindIP string `json:"bind_ip"`
|
||||
PublicPort uint16 `json:"public_port"`
|
||||
}
|
||||
|
||||
type service struct {
|
||||
Key string `json:"key"`
|
||||
TechnicalName string `json:"technical_name"`
|
||||
ContainerID string `json:"container_id"`
|
||||
ContainerName string `json:"container_name"`
|
||||
Image string `json:"image"`
|
||||
PrivatePort uint16 `json:"private_port"`
|
||||
Protocol string `json:"protocol"`
|
||||
Bindings []binding `json:"bindings"`
|
||||
}
|
||||
|
||||
type hostAddress struct {
|
||||
IP string `json:"ip"`
|
||||
Source string `json:"source"`
|
||||
Interface string `json:"interface,omitempty"`
|
||||
Scope string `json:"scope"`
|
||||
}
|
||||
|
||||
type inventory struct {
|
||||
AgentVersion string `json:"agent_version"`
|
||||
Hostname string `json:"hostname"`
|
||||
PublicIP string `json:"public_ip"`
|
||||
PublicIPSource string `json:"public_ip_source"`
|
||||
CertificateSHA256 string `json:"certificate_sha256"`
|
||||
Addresses []hostAddress `json:"addresses"`
|
||||
ObservedAt string `json:"observed_at"`
|
||||
Services []service `json:"services"`
|
||||
}
|
||||
@@ -0,0 +1,192 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"io"
|
||||
"net"
|
||||
"net/http"
|
||||
"sort"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
)
|
||||
|
||||
func validIP(raw string) string {
|
||||
ip := net.ParseIP(strings.TrimSpace(raw))
|
||||
if ip == nil || ip.IsUnspecified() || ip.IsLoopback() || ip.IsMulticast() || ip.IsLinkLocalUnicast() {
|
||||
return ""
|
||||
}
|
||||
return ip.String()
|
||||
}
|
||||
|
||||
func publicIPFromURL(ctx context.Context, rawURL string) string {
|
||||
if rawURL == "" {
|
||||
return ""
|
||||
}
|
||||
client := &http.Client{Timeout: 2 * time.Second}
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, rawURL, nil)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return ""
|
||||
}
|
||||
body, err := io.ReadAll(io.LimitReader(resp.Body, 128))
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
return validIP(string(body))
|
||||
}
|
||||
|
||||
func routeIP() string {
|
||||
conn, err := net.DialTimeout("udp", "1.1.1.1:53", time.Second)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
defer conn.Close()
|
||||
if addr, ok := conn.LocalAddr().(*net.UDPAddr); ok {
|
||||
return validIP(addr.IP.String())
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func ipScope(ip net.IP) string {
|
||||
switch {
|
||||
case ip.IsPrivate():
|
||||
return "private"
|
||||
case ip.IsLinkLocalUnicast():
|
||||
return "link_local"
|
||||
default:
|
||||
return "public"
|
||||
}
|
||||
}
|
||||
|
||||
func skipInterface(name string) bool {
|
||||
name = strings.ToLower(strings.TrimSpace(name))
|
||||
return name == "docker0" || strings.HasPrefix(name, "docker") || strings.HasPrefix(name, "veth") || strings.HasPrefix(name, "br-") || strings.HasPrefix(name, "virbr")
|
||||
}
|
||||
|
||||
func localHostAddresses() []hostAddress {
|
||||
interfaces, err := net.Interfaces()
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
out := make([]hostAddress, 0)
|
||||
for _, iface := range interfaces {
|
||||
if iface.Flags&net.FlagUp == 0 || iface.Flags&net.FlagLoopback != 0 || skipInterface(iface.Name) {
|
||||
continue
|
||||
}
|
||||
addrs, err := iface.Addrs()
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
for _, addr := range addrs {
|
||||
raw := addr.String()
|
||||
if host, _, err := net.ParseCIDR(raw); err == nil {
|
||||
raw = host.String()
|
||||
} else if host, _, err := net.SplitHostPort(raw); err == nil {
|
||||
raw = host
|
||||
}
|
||||
clean := validIP(raw)
|
||||
if clean == "" {
|
||||
continue
|
||||
}
|
||||
ip := net.ParseIP(clean)
|
||||
out = append(out, hostAddress{IP: clean, Source: "interface", Interface: iface.Name, Scope: ipScope(ip)})
|
||||
}
|
||||
}
|
||||
sort.Slice(out, func(i, j int) bool {
|
||||
if out[i].Interface != out[j].Interface {
|
||||
return out[i].Interface < out[j].Interface
|
||||
}
|
||||
return out[i].IP < out[j].IP
|
||||
})
|
||||
return out
|
||||
}
|
||||
|
||||
type ipDetector struct {
|
||||
mu sync.Mutex
|
||||
publicIP string
|
||||
expires time.Time
|
||||
}
|
||||
|
||||
func (d *ipDetector) public(ctx context.Context, rawURL string) string {
|
||||
if rawURL == "" {
|
||||
return ""
|
||||
}
|
||||
d.mu.Lock()
|
||||
defer d.mu.Unlock()
|
||||
if time.Now().Before(d.expires) {
|
||||
return d.publicIP
|
||||
}
|
||||
d.publicIP = publicIPFromURL(ctx, rawURL)
|
||||
d.expires = time.Now().Add(5 * time.Minute)
|
||||
if d.publicIP == "" {
|
||||
d.expires = time.Now().Add(30 * time.Second)
|
||||
}
|
||||
return d.publicIP
|
||||
}
|
||||
|
||||
func mergeHostAddress(out *[]hostAddress, index map[string]int, candidate hostAddress) {
|
||||
candidate.IP = validIP(candidate.IP)
|
||||
if candidate.IP == "" {
|
||||
return
|
||||
}
|
||||
if candidate.Scope == "" {
|
||||
candidate.Scope = ipScope(net.ParseIP(candidate.IP))
|
||||
}
|
||||
if pos, ok := index[candidate.IP]; ok {
|
||||
existing := &(*out)[pos]
|
||||
if candidate.Interface != "" && existing.Interface == "" {
|
||||
existing.Interface = candidate.Interface
|
||||
}
|
||||
if candidate.Source != "" && !strings.Contains(existing.Source, candidate.Source) {
|
||||
if existing.Source == "" {
|
||||
existing.Source = candidate.Source
|
||||
} else {
|
||||
existing.Source += "," + candidate.Source
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
index[candidate.IP] = len(*out)
|
||||
*out = append(*out, candidate)
|
||||
}
|
||||
|
||||
func detectedAddresses(ctx context.Context, cfg config, detector *ipDetector) ([]hostAddress, string, string) {
|
||||
out := make([]hostAddress, 0, 8)
|
||||
index := make(map[string]int)
|
||||
for _, item := range localHostAddresses() {
|
||||
mergeHostAddress(&out, index, item)
|
||||
}
|
||||
routed := routeIP()
|
||||
if routed != "" {
|
||||
mergeHostAddress(&out, index, hostAddress{IP: routed, Source: "route"})
|
||||
}
|
||||
public := detector.public(ctx, cfg.PublicIPURL)
|
||||
if public != "" {
|
||||
mergeHostAddress(&out, index, hostAddress{IP: public, Source: "public_api"})
|
||||
}
|
||||
advertised := validIP(cfg.AdvertiseIP)
|
||||
if advertised != "" {
|
||||
mergeHostAddress(&out, index, hostAddress{IP: advertised, Source: "override"})
|
||||
}
|
||||
|
||||
switch {
|
||||
case advertised != "":
|
||||
return out, advertised, "override"
|
||||
case routed != "":
|
||||
return out, routed, "route"
|
||||
case public != "":
|
||||
return out, public, "public_api"
|
||||
case len(out) > 0:
|
||||
return out, out[0].IP, out[0].Source
|
||||
default:
|
||||
return out, "", "unavailable"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,63 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"crypto/subtle"
|
||||
"encoding/json"
|
||||
"io"
|
||||
"net/http"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
func tokenOK(got, expected string) bool {
|
||||
if expected == "" || len(got) != len(expected) {
|
||||
return false
|
||||
}
|
||||
return subtle.ConstantTimeCompare([]byte(got), []byte(expected)) == 1
|
||||
}
|
||||
|
||||
func handler(cfg config) http.Handler {
|
||||
mux := http.NewServeMux()
|
||||
detector := &ipDetector{}
|
||||
mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
|
||||
if r.Method != http.MethodGet {
|
||||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||||
return
|
||||
}
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.Header().Set("Cache-Control", "no-store")
|
||||
if cfg.Fingerprint != "" {
|
||||
w.Header().Set("X-RustProxy-Agent-Certificate-SHA256", cfg.Fingerprint)
|
||||
}
|
||||
_, _ = io.WriteString(w, `{"status":"ok"}`)
|
||||
})
|
||||
mux.HandleFunc("/v1/inventory", func(w http.ResponseWriter, r *http.Request) {
|
||||
if r.Method != http.MethodGet {
|
||||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||||
return
|
||||
}
|
||||
auth := strings.TrimSpace(r.Header.Get("Authorization"))
|
||||
const prefix = "Bearer "
|
||||
if !strings.HasPrefix(auth, prefix) || !tokenOK(strings.TrimSpace(strings.TrimPrefix(auth, prefix)), cfg.Token) {
|
||||
w.Header().Set("WWW-Authenticate", "Bearer")
|
||||
http.Error(w, "unauthorized", http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
containers, err := dockerContainers(r.Context(), cfg.DockerSock)
|
||||
if err != nil {
|
||||
http.Error(w, err.Error(), http.StatusBadGateway)
|
||||
return
|
||||
}
|
||||
addresses, primaryIP, primarySource := detectedAddresses(r.Context(), cfg, detector)
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.Header().Set("Cache-Control", "no-store")
|
||||
if cfg.Fingerprint != "" {
|
||||
w.Header().Set("X-RustProxy-Agent-Certificate-SHA256", cfg.Fingerprint)
|
||||
}
|
||||
_ = json.NewEncoder(w).Encode(inventory{
|
||||
AgentVersion: version, Hostname: cfg.Hostname, PublicIP: primaryIP, PublicIPSource: primarySource, CertificateSHA256: cfg.Fingerprint,
|
||||
Addresses: addresses, ObservedAt: time.Now().UTC().Format(time.RFC3339), Services: servicesFrom(containers),
|
||||
})
|
||||
})
|
||||
return mux
|
||||
}
|
||||
Reference in new issue
Block a user