lib/controller/handler.go

   1 // Copyright (C) The Arvados Authors. All rights reserved.
   2 //
   3 // SPDX-License-Identifier: AGPL-3.0
   4
   5 package controller
   6
   7 import (
   8         "context"
   9         "io"
  10         "net"
  11         "net/http"
  12         "net/url"
  13         "strings"
  14         "sync"
  15         "time"
  16
  17         "git.curoverse.com/arvados.git/sdk/go/arvados"
  18         "git.curoverse.com/arvados.git/sdk/go/health"
  19         "git.curoverse.com/arvados.git/sdk/go/httpserver"
  20 )
  21
  22 type Handler struct {
  23         Cluster     *arvados.Cluster
  24         NodeProfile *arvados.NodeProfile
  25
  26         setupOnce    sync.Once
  27         handlerStack http.Handler
  28         proxyClient  *arvados.Client
  29 }
  30
  31 func (h *Handler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
  32         h.setupOnce.Do(h.setup)
  33         if req.Method != "GET" && req.Method != "HEAD" {
  34                 // http.ServeMux returns 301 with a cleaned path if
  35                 // the incoming request has a double slash. Some
  36                 // clients (including the Go standard library) change
  37                 // the request method to GET when following a 301
  38                 // redirect if the original method was not HEAD
  39                 // (RFC7231 6.4.2 specifically allows this in the case
  40                 // of POST). Thus "POST //foo" gets misdirected to
  41                 // "GET /foo". To avoid this, eliminate double slashes
  42                 // before passing the request to ServeMux.
  43                 for strings.Contains(req.URL.Path, "//") {
  44                         req.URL.Path = strings.Replace(req.URL.Path, "//", "/", -1)
  45                 }
  46         }
  47         h.handlerStack.ServeHTTP(w, req)
  48 }
  49
  50 func (h *Handler) CheckHealth() error {
  51         h.setupOnce.Do(h.setup)
  52         _, err := findRailsAPI(h.Cluster, h.NodeProfile)
  53         return err
  54 }
  55
  56 func (h *Handler) setup() {
  57         mux := http.NewServeMux()
  58         mux.Handle("/_health/", &health.Handler{
  59                 Token:  h.Cluster.ManagementToken,
  60                 Prefix: "/_health/",
  61         })
  62         mux.Handle("/", http.HandlerFunc(h.proxyRailsAPI))
  63         h.handlerStack = mux
  64
  65         // Changing the global isn't the right way to do this, but a
  66         // proper solution would conflict with an impending 13493
  67         // merge anyway, so this will do for now.
  68         arvados.InsecureHTTPClient.CheckRedirect = func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }
  69 }
  70
  71 // headers that shouldn't be forwarded when proxying. See
  72 // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
  73 var dropHeaders = map[string]bool{
  74         "Connection":          true,
  75         "Keep-Alive":          true,
  76         "Proxy-Authenticate":  true,
  77         "Proxy-Authorization": true,
  78         "TE":                true,
  79         "Trailer":           true,
  80         "Transfer-Encoding": true,
  81         "Upgrade":           true,
  82 }
  83
  84 func (h *Handler) proxyRailsAPI(w http.ResponseWriter, reqIn *http.Request) {
  85         urlOut, err := findRailsAPI(h.Cluster, h.NodeProfile)
  86         if err != nil {
  87                 httpserver.Error(w, err.Error(), http.StatusInternalServerError)
  88                 return
  89         }
  90         urlOut = &url.URL{
  91                 Scheme:   urlOut.Scheme,
  92                 Host:     urlOut.Host,
  93                 Path:     reqIn.URL.Path,
  94                 RawPath:  reqIn.URL.RawPath,
  95                 RawQuery: reqIn.URL.RawQuery,
  96         }
  97
  98         // Copy headers from incoming request, then add/replace proxy
  99         // headers like Via and X-Forwarded-For.
 100         hdrOut := http.Header{}
 101         for k, v := range reqIn.Header {
 102                 if !dropHeaders[k] {
 103                         hdrOut[k] = v
 104                 }
 105         }
 106         xff := reqIn.RemoteAddr
 107         if xffIn := reqIn.Header.Get("X-Forwarded-For"); xffIn != "" {
 108                 xff = xffIn + "," + xff
 109         }
 110         hdrOut.Set("X-Forwarded-For", xff)
 111         if hdrOut.Get("X-Forwarded-Proto") == "" {
 112                 hdrOut.Set("X-Forwarded-Proto", reqIn.URL.Scheme)
 113         }
 114         hdrOut.Add("Via", reqIn.Proto+" arvados-controller")
 115
 116         ctx := reqIn.Context()
 117         if timeout := h.Cluster.HTTPRequestTimeout; timeout > 0 {
 118                 var cancel context.CancelFunc
 119                 ctx, cancel = context.WithDeadline(ctx, time.Now().Add(time.Duration(timeout)))
 120                 defer cancel()
 121         }
 122
 123         reqOut := (&http.Request{
 124                 Method: reqIn.Method,
 125                 URL:    urlOut,
 126                 Host:   reqIn.Host,
 127                 Header: hdrOut,
 128                 Body:   reqIn.Body,
 129         }).WithContext(ctx)
 130         resp, err := arvados.InsecureHTTPClient.Do(reqOut)
 131         if err != nil {
 132                 httpserver.Error(w, err.Error(), http.StatusInternalServerError)
 133                 return
 134         }
 135         for k, v := range resp.Header {
 136                 for _, v := range v {
 137                         w.Header().Add(k, v)
 138                 }
 139         }
 140         w.WriteHeader(resp.StatusCode)
 141         n, err := io.Copy(w, resp.Body)
 142         if err != nil {
 143                 httpserver.Logger(reqIn).WithError(err).WithField("bytesCopied", n).Error("error copying response body")
 144         }
 145 }
 146
 147 // For now, findRailsAPI always uses the rails API running on this
 148 // node.
 149 func findRailsAPI(cluster *arvados.Cluster, np *arvados.NodeProfile) (*url.URL, error) {
 150         hostport := np.RailsAPI.Listen
 151         if len(hostport) > 1 && hostport[0] == ':' && strings.TrimRight(hostport[1:], "0123456789") == "" {
 152                 // ":12345" => connect to indicated port on localhost
 153                 hostport = "localhost" + hostport
 154         } else if _, _, err := net.SplitHostPort(hostport); err == nil {
 155                 // "[::1]:12345" => connect to indicated address & port
 156         } else {
 157                 return nil, err
 158         }
 159         proto := "http"
 160         if np.RailsAPI.TLS {
 161                 proto = "https"
 162         }
 163         return url.Parse(proto + "://" + hostport)
 164 }