lib/controller/federation.go

   1 // Copyright (C) The Arvados Authors. All rights reserved.
   2 //
   3 // SPDX-License-Identifier: AGPL-3.0
   4
   5 package controller
   6
   7 import (
   8         "bytes"
   9         "database/sql"
  10         "io/ioutil"
  11         "net/http"
  12         "net/url"
  13         "regexp"
  14
  15         "git.curoverse.com/arvados.git/sdk/go/arvados"
  16         "git.curoverse.com/arvados.git/sdk/go/auth"
  17         "git.curoverse.com/arvados.git/sdk/go/httpserver"
  18 )
  19
  20 var wfRe = regexp.MustCompile(`^/arvados/v1/workflows/([0-9a-z]{5})-[^/]+$`)
  21
  22 func (h *Handler) proxyRemoteCluster(w http.ResponseWriter, req *http.Request, next http.Handler) {
  23         m := wfRe.FindStringSubmatch(req.URL.Path)
  24         if len(m) < 2 || m[1] == h.Cluster.ClusterID {
  25                 next.ServeHTTP(w, req)
  26                 return
  27         }
  28         remoteID := m[1]
  29         remote, ok := h.Cluster.RemoteClusters[remoteID]
  30         if !ok {
  31                 httpserver.Error(w, "no proxy available for cluster "+remoteID, http.StatusNotFound)
  32                 return
  33         }
  34         scheme := remote.Scheme
  35         if scheme == "" {
  36                 scheme = "https"
  37         }
  38         err := h.saltAuthToken(req, remoteID)
  39         if err != nil {
  40                 httpserver.Error(w, err.Error(), http.StatusBadRequest)
  41                 return
  42         }
  43         urlOut := &url.URL{
  44                 Scheme:   scheme,
  45                 Host:     remote.Host,
  46                 Path:     req.URL.Path,
  47                 RawPath:  req.URL.RawPath,
  48                 RawQuery: req.URL.RawQuery,
  49         }
  50         client := h.secureClient
  51         if remote.Insecure {
  52                 client = h.insecureClient
  53         }
  54         h.proxy.Do(w, req, urlOut, client)
  55 }
  56
  57 // Extract the auth token supplied in req, and replace it with a
  58 // salted token for the remote cluster.
  59 func (h *Handler) saltAuthToken(req *http.Request, remote string) error {
  60         creds := auth.NewCredentials()
  61         creds.LoadTokensFromHTTPRequest(req)
  62         if len(creds.Tokens) == 0 && req.Header.Get("Content-Type") == "application/x-www-form-encoded" {
  63                 // Override ParseForm's 10MiB limit by ensuring
  64                 // req.Body is a *http.maxBytesReader.
  65                 req.Body = http.MaxBytesReader(nil, req.Body, 1<<28) // 256MiB. TODO: use MaxRequestSize from discovery doc or config.
  66                 if err := creds.LoadTokensFromHTTPRequestBody(req); err != nil {
  67                         return err
  68                 }
  69                 // Replace req.Body with a buffer that re-encodes the
  70                 // form without api_token, in case we end up
  71                 // forwarding the request.
  72                 if req.PostForm != nil {
  73                         req.PostForm.Del("api_token")
  74                 }
  75                 req.Body = ioutil.NopCloser(bytes.NewBufferString(req.PostForm.Encode()))
  76         }
  77         if len(creds.Tokens) == 0 {
  78                 return nil
  79         }
  80         token, err := auth.SaltToken(creds.Tokens[0], remote)
  81         if err == auth.ErrObsoleteToken {
  82                 // If the token exists in our own database, salt it
  83                 // for the remote. Otherwise, assume it was issued by
  84                 // the remote, and pass it through unmodified.
  85                 db, err := h.db(req)
  86                 if err != nil {
  87                         return err
  88                 }
  89                 aca := arvados.APIClientAuthorization{APIToken: creds.Tokens[0]}
  90                 err = db.QueryRowContext(req.Context(), `SELECT uuid FROM api_client_authorizations WHERE api_token=$1 AND (expires_at IS NULL OR expires_at > current_timestamp) LIMIT 1`, aca.APIToken).Scan(&aca.UUID)
  91                 if err == sql.ErrNoRows {
  92                         // Not ours; pass through unmodified.
  93                         token = aca.APIToken
  94                 } else if err != nil {
  95                         return err
  96                 } else {
  97                         // Found; make V2 version and salt it.
  98                         token, err = auth.SaltToken(aca.TokenV2(), remote)
  99                         if err != nil {
 100                                 return err
 101                         }
 102                 }
 103         } else if err != nil {
 104                 return err
 105         }
 106         req.Header.Set("Authorization", "Bearer "+token)
 107
 108         // Remove api_token=... from the the query string, in case we
 109         // end up forwarding the request.
 110         if values, err := url.ParseQuery(req.URL.RawQuery); err != nil {
 111                 return err
 112         } else if _, ok := values["api_token"]; ok {
 113                 delete(values, "api_token")
 114                 req.URL.RawQuery = values.Encode()
 115         }
 116         return nil
 117 }