X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/224f384d411bb1b4cccc7165c55bb64fd5c695ad..0561bd0c3c07257fd58ded6c7cfa5feeae97af57:/sdk/go/arvadosclient/arvadosclient.go

diff --git a/sdk/go/arvadosclient/arvadosclient.go b/sdk/go/arvadosclient/arvadosclient.go
index 5f24c7107d..9247bc4a33 100644
--- a/sdk/go/arvadosclient/arvadosclient.go
+++ b/sdk/go/arvadosclient/arvadosclient.go
@@ -1,3 +1,7 @@
+// Copyright (C) The Arvados Authors. All rights reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+
 /* Simple Arvados Go SDK for communicating with API server. */
 
 package arvadosclient
@@ -5,15 +9,19 @@ package arvadosclient
 import (
 	"bytes"
 	"crypto/tls"
+	"crypto/x509"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
+	"io/ioutil"
+	"log"
 	"net/http"
 	"net/url"
 	"os"
 	"regexp"
 	"strings"
+	"sync"
 	"time"
 
 	"git.curoverse.com/arvados.git/sdk/go/arvados"
@@ -36,6 +44,12 @@ var MaxIdleConnectionDuration = 30 * time.Second
 
 var RetryDelay = 2 * time.Second
 
+var (
+	defaultInsecureHTTPClient *http.Client
+	defaultSecureHTTPClient   *http.Client
+	defaultHTTPClientMtx      sync.Mutex
+)
+
 // Indicates an error that was returned by the API server.
 type APIServerError struct {
 	// Address of server returning error, of the form "host:port".
@@ -64,6 +78,13 @@ func (e APIServerError) Error() string {
 	}
 }
 
+// StringBool tests whether s is suggestive of true. It returns true
+// if s is a mixed/uppoer/lower-case variant of "1", "yes", or "true".
+func StringBool(s string) bool {
+	s = strings.ToLower(s)
+	return s == "1" || s == "yes" || s == "true"
+}
+
 // Helper type so we don't have to write out 'map[string]interface{}' every time.
 type Dict map[string]interface{}
 
@@ -103,22 +124,61 @@ type ArvadosClient struct {
 	Retries int
 }
 
+var CertFiles = []string{
+	"/etc/arvados/ca-certificates.crt",
+	"/etc/ssl/certs/ca-certificates.crt", // Debian/Ubuntu/Gentoo etc.
+	"/etc/pki/tls/certs/ca-bundle.crt",   // Fedora/RHEL
+}
+
+// MakeTLSConfig sets up TLS configuration for communicating with
+// Arvados and Keep services.
+func MakeTLSConfig(insecure bool) *tls.Config {
+	tlsconfig := tls.Config{InsecureSkipVerify: insecure}
+
+	if !insecure {
+		// Use the first entry in CertFiles that we can read
+		// certificates from. If none of those work out, use
+		// the Go defaults.
+		certs := x509.NewCertPool()
+		for _, file := range CertFiles {
+			data, err := ioutil.ReadFile(file)
+			if err != nil {
+				if !os.IsNotExist(err) {
+					log.Printf("error reading %q: %s", file, err)
+				}
+				continue
+			}
+			if !certs.AppendCertsFromPEM(data) {
+				log.Printf("unable to load any certificates from %v", file)
+				continue
+			}
+			tlsconfig.RootCAs = certs
+			break
+		}
+	}
+
+	return &tlsconfig
+}
+
 // New returns an ArvadosClient using the given arvados.Client
 // configuration. This is useful for callers who load arvados.Client
 // fields from configuration files but still need to use the
 // arvadosclient.ArvadosClient package.
 func New(c *arvados.Client) (*ArvadosClient, error) {
-	return &ArvadosClient{
+	ac := &ArvadosClient{
 		Scheme:      "https",
 		ApiServer:   c.APIHost,
 		ApiToken:    c.AuthToken,
 		ApiInsecure: c.Insecure,
 		Client: &http.Client{Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: c.Insecure}}},
+			TLSClientConfig: MakeTLSConfig(c.Insecure)}},
 		External:          false,
 		Retries:           2,
+		KeepServiceURIs:   c.KeepServiceURIs,
 		lastClosedIdlesAt: time.Now(),
-	}, nil
+	}
+
+	return ac, nil
 }
 
 // MakeArvadosClient creates a new ArvadosClient using the standard
@@ -126,42 +186,12 @@ func New(c *arvados.Client) (*ArvadosClient, error) {
 // ARVADOS_API_HOST_INSECURE, ARVADOS_EXTERNAL_CLIENT, and
 // ARVADOS_KEEP_SERVICES.
 func MakeArvadosClient() (ac *ArvadosClient, err error) {
-	var matchTrue = regexp.MustCompile("^(?i:1|yes|true)$")
-	insecure := matchTrue.MatchString(os.Getenv("ARVADOS_API_HOST_INSECURE"))
-	external := matchTrue.MatchString(os.Getenv("ARVADOS_EXTERNAL_CLIENT"))
-
-	ac = &ArvadosClient{
-		Scheme:      "https",
-		ApiServer:   os.Getenv("ARVADOS_API_HOST"),
-		ApiToken:    os.Getenv("ARVADOS_API_TOKEN"),
-		ApiInsecure: insecure,
-		Client: &http.Client{Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: insecure}}},
-		External: external,
-		Retries:  2}
-
-	for _, s := range strings.Split(os.Getenv("ARVADOS_KEEP_SERVICES"), " ") {
-		if s == "" {
-			continue
-		}
-		if u, err := url.Parse(s); err != nil {
-			return ac, fmt.Errorf("ARVADOS_KEEP_SERVICES: %q: %s", s, err)
-		} else if !u.IsAbs() {
-			return ac, fmt.Errorf("ARVADOS_KEEP_SERVICES: %q: not an absolute URI", s)
-		}
-		ac.KeepServiceURIs = append(ac.KeepServiceURIs, s)
-	}
-
-	if ac.ApiServer == "" {
-		return ac, MissingArvadosApiHost
-	}
-	if ac.ApiToken == "" {
-		return ac, MissingArvadosApiToken
+	ac, err = New(arvados.NewClientFromEnv())
+	if err != nil {
+		return
 	}
-
-	ac.lastClosedIdlesAt = time.Now()
-
-	return ac, err
+	ac.External = StringBool(os.Getenv("ARVADOS_EXTERNAL_CLIENT"))
+	return
 }
 
 // CallRaw is the same as Call() but returns a Reader that reads the
@@ -385,3 +415,20 @@ func (c *ArvadosClient) Discovery(parameter string) (value interface{}, err erro
 		return value, ErrInvalidArgument
 	}
 }
+
+func (ac *ArvadosClient) httpClient() *http.Client {
+	if ac.Client != nil {
+		return ac.Client
+	}
+	c := &defaultSecureHTTPClient
+	if ac.ApiInsecure {
+		c = &defaultInsecureHTTPClient
+	}
+	if *c == nil {
+		defaultHTTPClientMtx.Lock()
+		defer defaultHTTPClientMtx.Unlock()
+		*c = &http.Client{Transport: &http.Transport{
+			TLSClientConfig: MakeTLSConfig(ac.ApiInsecure)}}
+	}
+	return *c
+}