1 // Copyright (C) The Arvados Authors. All rights reserved.
3 // SPDX-License-Identifier: AGPL-3.0
26 "git.arvados.org/arvados.git/lib/controller/rpc"
27 "git.arvados.org/arvados.git/lib/selfsigned"
28 "git.arvados.org/arvados.git/lib/webdavfs"
29 "git.arvados.org/arvados.git/sdk/go/arvados"
30 "git.arvados.org/arvados.git/sdk/go/auth"
31 "git.arvados.org/arvados.git/sdk/go/ctxlog"
32 "git.arvados.org/arvados.git/sdk/go/httpserver"
33 "github.com/creack/pty"
34 "github.com/google/shlex"
35 "github.com/hashicorp/yamux"
36 "golang.org/x/crypto/ssh"
37 "golang.org/x/net/webdav"
40 type GatewayTarget interface {
41 // Command that will execute cmd inside the container
42 InjectCommand(ctx context.Context, detachKeys, username string, usingTTY bool, cmd []string) (*exec.Cmd, error)
44 // IP address inside container
45 IPAddress() (string, error)
48 type GatewayTargetStub struct{}
50 func (GatewayTargetStub) IPAddress() (string, error) { return "127.0.0.1", nil }
51 func (GatewayTargetStub) InjectCommand(ctx context.Context, detachKeys, username string, usingTTY bool, cmd []string) (*exec.Cmd, error) {
52 return exec.CommandContext(ctx, cmd[0], cmd[1:]...), nil
57 // Caller should set Address to "", or "host:0" or "host:port"
58 // where host is a known external IP address; port is a
59 // desired port number to listen on; and ":0" chooses an
60 // available dynamic port.
62 // If Address is "", Start() listens only on the loopback
63 // interface (and changes Address to "127.0.0.1:port").
64 // Otherwise it listens on all interfaces.
66 // If Address is "host:0", Start() updates Address to
72 Printf(fmt string, args ...interface{})
74 // If non-nil, set up a ContainerGatewayTunnel, so that the
75 // controller can connect to us even if our external IP
76 // address is unknown or not routable from controller.
77 ArvadosClient *arvados.Client
79 // When a tunnel is connected or reconnected, this func (if
80 // not nil) will be called with the InternalURL of the
81 // controller process at the other end of the tunnel.
82 UpdateTunnelURL func(url string)
84 // Source for serving WebDAV requests at
85 // /arvados/v1/containers/{uuid}/log/
86 LogCollection arvados.CollectionFileSystem
88 sshConfig ssh.ServerConfig
94 // Start starts an http server that allows authenticated clients to open an
95 // interactive "docker exec" session and (in future) connect to tcp ports
96 // inside the docker container.
97 func (gw *Gateway) Start() error {
98 gw.sshConfig = ssh.ServerConfig{
100 PasswordCallback: func(c ssh.ConnMetadata, pass []byte) (*ssh.Permissions, error) {
104 return nil, fmt.Errorf("cannot specify user %q via ssh client", c.User())
106 PublicKeyCallback: func(c ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error) {
108 return &ssh.Permissions{
109 Extensions: map[string]string{
110 "pubkey-fp": ssh.FingerprintSHA256(pubKey),
114 return nil, fmt.Errorf("cannot specify user %q via ssh client", c.User())
117 pvt, err := rsa.GenerateKey(rand.Reader, 2048)
125 signer, err := ssh.NewSignerFromKey(pvt)
129 gw.sshConfig.AddHostKey(signer)
131 // Address (typically provided by arvados-dispatch-cloud) is
132 // HOST:PORT where HOST is our IP address or hostname as seen
133 // from arvados-controller, and PORT is either the desired
134 // port where we should run our gateway server, or "0" if we
135 // should choose an available port.
136 extAddr := gw.Address
137 // Generally we can't know which local interface corresponds
138 // to an externally reachable IP address, so if we expect to
139 // be reachable by external hosts, we listen on all
143 // If the dispatcher doesn't tell us our external IP
144 // address, controller will only be able to connect
145 // through the tunnel (see runTunnel), so our gateway
146 // server only needs to listen on the loopback
148 extAddr = "127.0.0.1:0"
149 listenHost = "127.0.0.1"
151 extHost, extPort, err := net.SplitHostPort(extAddr)
155 cert, err := selfsigned.CertGenerator{}.Generate()
159 h := hmac.New(sha256.New, []byte(gw.AuthSecret))
160 h.Write(cert.Certificate[0])
161 gw.requestAuth = fmt.Sprintf("%x", h.Sum(nil))
163 h.Write([]byte(gw.requestAuth))
164 gw.respondAuth = fmt.Sprintf("%x", h.Sum(nil))
166 gw.logPath = "/arvados/v1/containers/" + gw.ContainerUUID + "/log"
168 srv := &httpserver.Server{
171 TLSConfig: &tls.Config{
172 Certificates: []tls.Certificate{cert},
175 Addr: net.JoinHostPort(listenHost, extPort),
183 gw.Log.Printf("gateway server stopped: %s", err)
185 // Get the port number we are listening on (extPort might be
186 // "0" or a port name, in which case this will be different).
187 _, listenPort, err := net.SplitHostPort(srv.Addr)
191 // When changing state to Running, the caller will want to set
192 // gateway_address to a "HOST:PORT" that, if controller
193 // connects to it, will reach this gateway server.
195 // The most likely thing to work is: HOST is our external
196 // hostname/IP as provided by the caller
197 // (arvados-dispatch-cloud) or 127.0.0.1 to indicate
198 // non-tunnel connections aren't available; and PORT is the
199 // port number we are listening on.
200 gw.Address = net.JoinHostPort(extHost, listenPort)
201 gw.Log.Printf("gateway server listening at %s", gw.Address)
202 if gw.ArvadosClient != nil {
203 go gw.maintainTunnel(gw.Address)
208 func (gw *Gateway) maintainTunnel(addr string) {
209 for ; ; time.Sleep(5 * time.Second) {
210 err := gw.runTunnel(addr)
211 gw.Log.Printf("runTunnel: %s", err)
215 // runTunnel connects to controller and sets up a tunnel through
216 // which controller can connect to the gateway server at the given
218 func (gw *Gateway) runTunnel(addr string) error {
219 ctx := auth.NewContext(context.Background(), auth.NewCredentials(gw.ArvadosClient.AuthToken))
220 arpc := rpc.NewConn("", &url.URL{Scheme: "https", Host: gw.ArvadosClient.APIHost}, gw.ArvadosClient.Insecure, rpc.PassthroughTokenProvider)
221 tun, err := arpc.ContainerGatewayTunnel(ctx, arvados.ContainerGatewayTunnelOptions{
222 UUID: gw.ContainerUUID,
223 AuthSecret: gw.AuthSecret,
226 return fmt.Errorf("error creating gateway tunnel: %s", err)
228 mux, err := yamux.Client(tun.Conn, nil)
230 return fmt.Errorf("error setting up mux client end: %s", err)
232 if url := tun.Header.Get("X-Arvados-Internal-Url"); url != "" && gw.UpdateTunnelURL != nil {
233 gw.UpdateTunnelURL(url)
236 muxconn, err := mux.AcceptStream()
240 gw.Log.Printf("tunnel connection %d started", muxconn.StreamID())
242 defer muxconn.Close()
243 gwconn, err := net.Dial("tcp", addr)
245 gw.Log.Printf("tunnel connection %d: error connecting to %s: %s", muxconn.StreamID(), addr, err)
249 var wg sync.WaitGroup
253 _, err := io.Copy(gwconn, muxconn)
255 gw.Log.Printf("tunnel connection %d: mux end: %s", muxconn.StreamID(), err)
261 _, err := io.Copy(muxconn, gwconn)
263 gw.Log.Printf("tunnel connection %d: gateway end: %s", muxconn.StreamID(), err)
268 gw.Log.Printf("tunnel connection %d finished", muxconn.StreamID())
273 var webdavMethod = map[string]bool{
279 func (gw *Gateway) ServeHTTP(w http.ResponseWriter, req *http.Request) {
280 reqUUID := req.Header.Get("X-Arvados-Container-Gateway-Uuid")
282 // older controller versions only send UUID as query param
284 reqUUID = req.Form.Get("uuid")
286 if reqUUID != gw.ContainerUUID {
287 http.Error(w, fmt.Sprintf("misdirected request: meant for %q but received by crunch-run %q", reqUUID, gw.ContainerUUID), http.StatusBadGateway)
290 if req.Header.Get("X-Arvados-Authorization") != gw.requestAuth {
291 http.Error(w, "bad X-Arvados-Authorization header", http.StatusUnauthorized)
294 w.Header().Set("X-Arvados-Authorization-Response", gw.respondAuth)
296 case req.Method == "POST" && req.Header.Get("Upgrade") == "ssh":
298 case req.URL.Path == gw.logPath || strings.HasPrefix(req.URL.Path, gw.logPath):
299 if !webdavMethod[req.Method] {
300 http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
303 gw.handleLogsWebDAV(w, req)
305 http.Error(w, "path not found", http.StatusNotFound)
309 func (gw *Gateway) handleLogsWebDAV(w http.ResponseWriter, r *http.Request) {
310 if gw.LogCollection == nil {
311 http.Error(w, "Not found", http.StatusNotFound)
314 wh := webdav.Handler{
316 FileSystem: &webdavfs.FS{
317 FileSystem: gw.LogCollection,
320 AlwaysReadEOF: r.Method == "PROPFIND",
322 LockSystem: webdavfs.NoLockSystem,
323 Logger: gw.webdavLogger,
328 func (gw *Gateway) webdavLogger(r *http.Request, err error) {
329 if err != nil && !os.IsNotExist(err) {
330 ctxlog.FromContext(r.Context()).WithError(err).Info("error reported by webdav handler")
332 ctxlog.FromContext(r.Context()).WithError(err).Debug("webdav request log")
336 // handleSSH connects to an SSH server that allows the caller to run
337 // interactive commands as root (or any other desired user) inside the
338 // container. The tunnel itself can only be created by an
339 // authenticated caller, so the SSH server itself is wide open (any
340 // password or key will be accepted).
342 // Requests must have path "/ssh" and the following headers:
344 // Connection: upgrade
346 // X-Arvados-Target-Uuid: uuid of container
347 // X-Arvados-Authorization: must match
348 // hmac(AuthSecret,certfingerprint) (this prevents other containers
349 // and shell nodes from connecting directly)
353 // X-Arvados-Detach-Keys: argument to "docker exec --detach-keys",
354 // e.g., "ctrl-p,ctrl-q"
355 // X-Arvados-Login-Username: argument to "docker exec --user": account
356 // used to run command(s) inside the container.
357 func (gw *Gateway) handleSSH(w http.ResponseWriter, req *http.Request) {
359 detachKeys := req.Form.Get("detach_keys")
360 username := req.Form.Get("login_username")
364 hj, ok := w.(http.Hijacker)
366 http.Error(w, "ResponseWriter does not support connection upgrade", http.StatusInternalServerError)
369 netconn, _, err := hj.Hijack()
371 http.Error(w, err.Error(), http.StatusInternalServerError)
374 defer netconn.Close()
375 w.Header().Set("Connection", "upgrade")
376 w.Header().Set("Upgrade", "ssh")
377 netconn.Write([]byte("HTTP/1.1 101 Switching Protocols\r\n"))
378 w.Header().Write(netconn)
379 netconn.Write([]byte("\r\n"))
383 conn, newchans, reqs, err := ssh.NewServerConn(netconn, &gw.sshConfig)
386 } else if err != nil {
387 gw.Log.Printf("ssh.NewServerConn: %s", err)
391 go ssh.DiscardRequests(reqs)
392 for newch := range newchans {
393 switch newch.ChannelType() {
395 go gw.handleDirectTCPIP(ctx, newch)
397 go gw.handleSession(ctx, newch, detachKeys, username)
399 go newch.Reject(ssh.UnknownChannelType, fmt.Sprintf("unsupported channel type %q", newch.ChannelType()))
404 func (gw *Gateway) handleDirectTCPIP(ctx context.Context, newch ssh.NewChannel) {
405 ch, reqs, err := newch.Accept()
407 gw.Log.Printf("accept direct-tcpip channel: %s", err)
411 go ssh.DiscardRequests(reqs)
413 // RFC 4254 7.2 (copy of channelOpenDirectMsg in
414 // golang.org/x/crypto/ssh)
421 err = ssh.Unmarshal(newch.ExtraData(), &msg)
423 fmt.Fprintf(ch.Stderr(), "unmarshal direct-tcpip extradata: %s\n", err)
427 case "localhost", "0.0.0.0", "127.0.0.1", "::1", "::":
429 fmt.Fprintf(ch.Stderr(), "cannot forward to ports on %q, only localhost\n", msg.Raddr)
433 dstaddr, err := gw.Target.IPAddress()
435 fmt.Fprintf(ch.Stderr(), "container has no IP address: %s\n", err)
437 } else if dstaddr == "" {
438 fmt.Fprintf(ch.Stderr(), "container has no IP address\n")
442 dst := net.JoinHostPort(dstaddr, fmt.Sprintf("%d", msg.Rport))
443 tcpconn, err := net.Dial("tcp", dst)
445 fmt.Fprintf(ch.Stderr(), "%s: %s\n", dst, err)
449 n, _ := io.Copy(ch, tcpconn)
450 ctxlog.FromContext(ctx).Debugf("tcpip: sent %d bytes\n", n)
453 n, _ := io.Copy(tcpconn, ch)
454 ctxlog.FromContext(ctx).Debugf("tcpip: received %d bytes\n", n)
457 func (gw *Gateway) handleSession(ctx context.Context, newch ssh.NewChannel, detachKeys, username string) {
458 ch, reqs, err := newch.Accept()
460 gw.Log.Printf("error accepting session channel: %s", err)
465 var pty0, tty0 *os.File
466 // Where to send errors/messages for the client to see
467 logw := io.Writer(ch.Stderr())
468 // How to end lines when sending errors/messages to the client
469 // (changes to \r\n when using a pty)
471 // Env vars to add to child process
472 termEnv := []string(nil)
475 wantClose := make(chan struct{})
479 case r, ok := <-reqs:
489 case "shell", "exec":
490 if started++; started != 1 {
491 // RFC 4254 6.5: "Only one of these
492 // requests can succeed per channel."
499 ssh.Unmarshal(req.Payload, &payload)
500 execargs, err := shlex.Split(payload.Command)
502 fmt.Fprintf(logw, "error parsing supplied command: %s"+eol, err)
505 if len(execargs) == 0 {
506 execargs = []string{"/bin/bash", "-login"}
513 ch.SendRequest("exit-status", false, ssh.Marshal(&resp))
517 cmd, err := gw.Target.InjectCommand(ctx, detachKeys, username, tty0 != nil, execargs)
519 fmt.Fprintln(ch.Stderr(), err)
530 // Send our own debug messages to tty as well.
533 // StdinPipe may seem
534 // superfluous here, but it's
535 // not: it causes cmd.Run() to
536 // return when the subprocess
537 // exits. Without it, Run()
538 // waits for stdin to close,
539 // which causes "ssh ... echo
540 // ok" (with the client's
541 // stdin connected to a
542 // terminal or something) to
544 stdin, err := cmd.StdinPipe()
546 fmt.Fprintln(ch.Stderr(), err)
556 cmd.Stderr = ch.Stderr()
558 cmd.SysProcAttr = &syscall.SysProcAttr{
559 Setctty: tty0 != nil,
562 cmd.Env = append(os.Environ(), termEnv...)
564 if exiterr, ok := err.(*exec.ExitError); ok {
565 if status, ok := exiterr.Sys().(syscall.WaitStatus); ok {
566 resp.Status = uint32(status.ExitStatus())
568 } else if err != nil {
569 // Propagate errors like `exec: "docker": executable file not found in $PATH`
570 fmt.Fprintln(ch.Stderr(), err)
572 errClose := ch.CloseWrite()
573 if resp.Status == 0 && (err != nil || errClose != nil) {
579 p, t, err := pty.Open()
581 fmt.Fprintf(ch.Stderr(), "pty failed: %s"+eol, err)
595 ssh.Unmarshal(req.Payload, &payload)
596 termEnv = []string{"TERM=" + payload.Term, "USE_TTY=1"}
597 err = pty.Setsize(pty0, &pty.Winsize{Rows: uint16(payload.Rows), Cols: uint16(payload.Cols), X: uint16(payload.X), Y: uint16(payload.Y)})
599 fmt.Fprintf(logw, "pty-req: setsize failed: %s"+eol, err)
601 case "window-change":
608 ssh.Unmarshal(req.Payload, &payload)
609 err := pty.Setsize(pty0, &pty.Winsize{Rows: uint16(payload.Rows), Cols: uint16(payload.Cols), X: uint16(payload.X), Y: uint16(payload.Y)})
611 fmt.Fprintf(logw, "window-change: setsize failed: %s"+eol, err)
616 // TODO: implement "env"
617 // requests by setting env
618 // vars in the docker-exec
619 // command (not docker-exec's
620 // own environment, which
621 // would be a gaping security
624 // fmt.Fprintf(logw, "declined request %q on ssh channel"+eol, req.Type)