1 // Copyright (C) The Arvados Authors. All rights reserved.
3 // SPDX-License-Identifier: AGPL-3.0
17 "git.curoverse.com/arvados.git/sdk/go/arvados"
18 "git.curoverse.com/arvados.git/sdk/go/arvadosclient"
19 "git.curoverse.com/arvados.git/sdk/go/auth"
20 "git.curoverse.com/arvados.git/sdk/go/keepclient"
23 type remoteProxy struct {
24 clients map[string]*keepclient.KeepClient
28 func (rp *remoteProxy) Get(ctx context.Context, w http.ResponseWriter, r *http.Request, cluster *arvados.Cluster) {
29 // Intervening proxies must not return a cached GET response
30 // to a prior request if a X-Keep-Signature request header has
31 // been added or changed.
32 w.Header().Add("Vary", "X-Keep-Signature")
34 token := GetAPIToken(r)
36 http.Error(w, "no token provided in Authorization header", http.StatusUnauthorized)
39 if sign := r.Header.Get("X-Keep-Signature"); sign != "" {
40 buf, err := getBufferWithContext(ctx, bufs, BlockSize)
42 http.Error(w, err.Error(), http.StatusServiceUnavailable)
46 rrc := &remoteResponseCacher{
47 Locator: r.URL.Path[1:],
55 var remoteClient *keepclient.KeepClient
57 for i, part := range strings.Split(r.URL.Path[1:], "+") {
60 // don't try to parse hash part as hint
61 case strings.HasPrefix(part, "A"):
62 // drop local permission hint
64 case len(part) > 7 && part[0] == 'R' && part[6] == '-':
66 remote, ok := cluster.RemoteClusters[remoteID]
68 http.Error(w, "remote cluster not configured", http.StatusBadGateway)
71 kc, err := rp.remoteClient(remoteID, remote, token)
72 if err == auth.ErrObsoleteToken {
73 http.Error(w, err.Error(), http.StatusBadRequest)
75 } else if err != nil {
76 http.Error(w, err.Error(), http.StatusInternalServerError)
82 parts = append(parts, part)
84 if remoteClient == nil {
85 http.Error(w, "bad request", http.StatusBadRequest)
88 locator := strings.Join(parts, "+")
89 rdr, _, _, err := remoteClient.Get(locator)
94 case *keepclient.ErrNotFound:
95 http.Error(w, err.Error(), http.StatusNotFound)
97 http.Error(w, err.Error(), http.StatusBadGateway)
101 func (rp *remoteProxy) remoteClient(remoteID string, remoteCluster arvados.RemoteCluster, token string) (*keepclient.KeepClient, error) {
103 kc, ok := rp.clients[remoteID]
106 c := &arvados.Client{
107 APIHost: remoteCluster.Host,
109 Insecure: remoteCluster.Insecure,
111 ac, err := arvadosclient.New(c)
115 kc, err = keepclient.MakeKeepClient(ac)
121 if rp.clients == nil {
122 rp.clients = map[string]*keepclient.KeepClient{remoteID: kc}
124 rp.clients[remoteID] = kc
128 accopy := *kc.Arvados
129 accopy.ApiToken = token
131 kccopy.Arvados = &accopy
132 token, err := auth.SaltToken(token, remoteID)
136 kccopy.Arvados.ApiToken = token
140 var localOrRemoteSignature = regexp.MustCompile(`\+[AR][^\+]*`)
142 // remoteResponseCacher wraps http.ResponseWriter. It buffers the
143 // response data in the provided buffer, writes/touches a copy on a
144 // local volume, adds a response header with a locally-signed locator,
145 // and finally writes the data through.
146 type remoteResponseCacher struct {
154 func (rrc *remoteResponseCacher) Write(p []byte) (int, error) {
155 if len(rrc.Buffer)+len(p) > cap(rrc.Buffer) {
156 return 0, errors.New("buffer full")
158 rrc.Buffer = append(rrc.Buffer, p...)
162 func (rrc *remoteResponseCacher) WriteHeader(statusCode int) {
163 rrc.statusCode = statusCode
166 func (rrc *remoteResponseCacher) Flush(ctx context.Context) {
167 if rrc.statusCode == 0 {
168 rrc.statusCode = http.StatusOK
169 } else if rrc.statusCode != http.StatusOK {
170 rrc.ResponseWriter.WriteHeader(rrc.statusCode)
171 rrc.ResponseWriter.Write(rrc.Buffer)
174 _, err := PutBlock(ctx, rrc.Buffer, rrc.Locator[:32])
175 if err == RequestHashError {
176 http.Error(rrc.ResponseWriter, "checksum mismatch in remote response", http.StatusBadGateway)
179 if err, ok := err.(*KeepError); ok {
180 http.Error(rrc.ResponseWriter, err.Error(), err.HTTPCode)
184 http.Error(rrc.ResponseWriter, err.Error(), http.StatusBadGateway)
188 unsigned := localOrRemoteSignature.ReplaceAllLiteralString(rrc.Locator, "")
189 signed := SignLocator(unsigned, rrc.Token, time.Now().Add(theConfig.BlobSignatureTTL.Duration()))
190 if signed == unsigned {
191 http.Error(rrc.ResponseWriter, "could not sign locator", http.StatusInternalServerError)
194 rrc.Header().Set("X-Keep-Locator", signed)
195 rrc.ResponseWriter.WriteHeader(rrc.statusCode)
196 rrc.ResponseWriter.Write(rrc.Buffer)