X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/e31f6c9eb427302eb48150d431afcc962954b061..0eb72b526bf8bbb011551ecf019f604e17a534f1:/sdk/go/arvadosclient/arvadosclient.go diff --git a/sdk/go/arvadosclient/arvadosclient.go b/sdk/go/arvadosclient/arvadosclient.go index aeb81f9317..9247bc4a33 100644 --- a/sdk/go/arvadosclient/arvadosclient.go +++ b/sdk/go/arvadosclient/arvadosclient.go @@ -1,3 +1,7 @@ +// Copyright (C) The Arvados Authors. All rights reserved. +// +// SPDX-License-Identifier: Apache-2.0 + /* Simple Arvados Go SDK for communicating with API server. */ package arvadosclient @@ -5,16 +9,22 @@ package arvadosclient import ( "bytes" "crypto/tls" + "crypto/x509" "encoding/json" "errors" "fmt" "io" + "io/ioutil" + "log" "net/http" "net/url" "os" "regexp" "strings" + "sync" "time" + + "git.curoverse.com/arvados.git/sdk/go/arvados" ) type StringMatcher func(string) bool @@ -34,6 +44,12 @@ var MaxIdleConnectionDuration = 30 * time.Second var RetryDelay = 2 * time.Second +var ( + defaultInsecureHTTPClient *http.Client + defaultSecureHTTPClient *http.Client + defaultHTTPClientMtx sync.Mutex +) + // Indicates an error that was returned by the API server. type APIServerError struct { // Address of server returning error, of the form "host:port". @@ -62,6 +78,13 @@ func (e APIServerError) Error() string { } } +// StringBool tests whether s is suggestive of true. It returns true +// if s is a mixed/uppoer/lower-case variant of "1", "yes", or "true". +func StringBool(s string) bool { + s = strings.ToLower(s) + return s == "1" || s == "yes" || s == "true" +} + // Helper type so we don't have to write out 'map[string]interface{}' every time. type Dict map[string]interface{} @@ -101,52 +124,79 @@ type ArvadosClient struct { Retries int } -// MakeArvadosClient creates a new ArvadosClient using the standard -// environment variables ARVADOS_API_HOST, ARVADOS_API_TOKEN, -// ARVADOS_API_HOST_INSECURE, ARVADOS_EXTERNAL_CLIENT, and -// ARVADOS_KEEP_SERVICES. -func MakeArvadosClient() (ac ArvadosClient, err error) { - var matchTrue = regexp.MustCompile("^(?i:1|yes|true)$") - insecure := matchTrue.MatchString(os.Getenv("ARVADOS_API_HOST_INSECURE")) - external := matchTrue.MatchString(os.Getenv("ARVADOS_EXTERNAL_CLIENT")) - - ac = ArvadosClient{ - Scheme: "https", - ApiServer: os.Getenv("ARVADOS_API_HOST"), - ApiToken: os.Getenv("ARVADOS_API_TOKEN"), - ApiInsecure: insecure, - Client: &http.Client{Transport: &http.Transport{ - TLSClientConfig: &tls.Config{InsecureSkipVerify: insecure}}}, - External: external, - Retries: 2} +var CertFiles = []string{ + "/etc/arvados/ca-certificates.crt", + "/etc/ssl/certs/ca-certificates.crt", // Debian/Ubuntu/Gentoo etc. + "/etc/pki/tls/certs/ca-bundle.crt", // Fedora/RHEL +} - for _, s := range strings.Split(os.Getenv("ARVADOS_KEEP_SERVICES"), " ") { - if s == "" { - continue - } - if u, err := url.Parse(s); err != nil { - return ac, fmt.Errorf("ARVADOS_KEEP_SERVICES: %q: %s", s, err) - } else if !u.IsAbs() { - return ac, fmt.Errorf("ARVADOS_KEEP_SERVICES: %q: not an absolute URI", s) +// MakeTLSConfig sets up TLS configuration for communicating with +// Arvados and Keep services. +func MakeTLSConfig(insecure bool) *tls.Config { + tlsconfig := tls.Config{InsecureSkipVerify: insecure} + + if !insecure { + // Use the first entry in CertFiles that we can read + // certificates from. If none of those work out, use + // the Go defaults. + certs := x509.NewCertPool() + for _, file := range CertFiles { + data, err := ioutil.ReadFile(file) + if err != nil { + if !os.IsNotExist(err) { + log.Printf("error reading %q: %s", file, err) + } + continue + } + if !certs.AppendCertsFromPEM(data) { + log.Printf("unable to load any certificates from %v", file) + continue + } + tlsconfig.RootCAs = certs + break } - ac.KeepServiceURIs = append(ac.KeepServiceURIs, s) } - if ac.ApiServer == "" { - return ac, MissingArvadosApiHost - } - if ac.ApiToken == "" { - return ac, MissingArvadosApiToken + return &tlsconfig +} + +// New returns an ArvadosClient using the given arvados.Client +// configuration. This is useful for callers who load arvados.Client +// fields from configuration files but still need to use the +// arvadosclient.ArvadosClient package. +func New(c *arvados.Client) (*ArvadosClient, error) { + ac := &ArvadosClient{ + Scheme: "https", + ApiServer: c.APIHost, + ApiToken: c.AuthToken, + ApiInsecure: c.Insecure, + Client: &http.Client{Transport: &http.Transport{ + TLSClientConfig: MakeTLSConfig(c.Insecure)}}, + External: false, + Retries: 2, + KeepServiceURIs: c.KeepServiceURIs, + lastClosedIdlesAt: time.Now(), } - ac.lastClosedIdlesAt = time.Now() + return ac, nil +} - return ac, err +// MakeArvadosClient creates a new ArvadosClient using the standard +// environment variables ARVADOS_API_HOST, ARVADOS_API_TOKEN, +// ARVADOS_API_HOST_INSECURE, ARVADOS_EXTERNAL_CLIENT, and +// ARVADOS_KEEP_SERVICES. +func MakeArvadosClient() (ac *ArvadosClient, err error) { + ac, err = New(arvados.NewClientFromEnv()) + if err != nil { + return + } + ac.External = StringBool(os.Getenv("ARVADOS_EXTERNAL_CLIENT")) + return } // CallRaw is the same as Call() but returns a Reader that reads the // response body, instead of taking an output object. -func (c ArvadosClient) CallRaw(method string, resourceType string, uuid string, action string, parameters Dict) (reader io.ReadCloser, err error) { +func (c *ArvadosClient) CallRaw(method string, resourceType string, uuid string, action string, parameters Dict) (reader io.ReadCloser, err error) { scheme := c.Scheme if scheme == "" { scheme = "https" @@ -292,7 +342,7 @@ func newAPIServerError(ServerAddress string, resp *http.Response) APIServerError // Returns a non-nil error if an error occurs making the API call, the // API responds with a non-successful HTTP status, or an error occurs // parsing the response body. -func (c ArvadosClient) Call(method, resourceType, uuid, action string, parameters Dict, output interface{}) error { +func (c *ArvadosClient) Call(method, resourceType, uuid, action string, parameters Dict, output interface{}) error { reader, err := c.CallRaw(method, resourceType, uuid, action, parameters) if reader != nil { defer reader.Close() @@ -311,22 +361,22 @@ func (c ArvadosClient) Call(method, resourceType, uuid, action string, parameter } // Create a new resource. See Call for argument descriptions. -func (c ArvadosClient) Create(resourceType string, parameters Dict, output interface{}) error { +func (c *ArvadosClient) Create(resourceType string, parameters Dict, output interface{}) error { return c.Call("POST", resourceType, "", "", parameters, output) } // Delete a resource. See Call for argument descriptions. -func (c ArvadosClient) Delete(resource string, uuid string, parameters Dict, output interface{}) (err error) { +func (c *ArvadosClient) Delete(resource string, uuid string, parameters Dict, output interface{}) (err error) { return c.Call("DELETE", resource, uuid, "", parameters, output) } // Modify attributes of a resource. See Call for argument descriptions. -func (c ArvadosClient) Update(resourceType string, uuid string, parameters Dict, output interface{}) (err error) { +func (c *ArvadosClient) Update(resourceType string, uuid string, parameters Dict, output interface{}) (err error) { return c.Call("PUT", resourceType, uuid, "", parameters, output) } // Get a resource. See Call for argument descriptions. -func (c ArvadosClient) Get(resourceType string, uuid string, parameters Dict, output interface{}) (err error) { +func (c *ArvadosClient) Get(resourceType string, uuid string, parameters Dict, output interface{}) (err error) { if !UUIDMatch(uuid) && !(resourceType == "collections" && PDHMatch(uuid)) { // No object has uuid == "": there is no need to make // an API call. Furthermore, the HTTP request for such @@ -338,7 +388,7 @@ func (c ArvadosClient) Get(resourceType string, uuid string, parameters Dict, ou } // List resources of a given type. See Call for argument descriptions. -func (c ArvadosClient) List(resource string, parameters Dict, output interface{}) (err error) { +func (c *ArvadosClient) List(resource string, parameters Dict, output interface{}) (err error) { return c.Call("GET", resource, "", "", parameters, output) } @@ -365,3 +415,20 @@ func (c *ArvadosClient) Discovery(parameter string) (value interface{}, err erro return value, ErrInvalidArgument } } + +func (ac *ArvadosClient) httpClient() *http.Client { + if ac.Client != nil { + return ac.Client + } + c := &defaultSecureHTTPClient + if ac.ApiInsecure { + c = &defaultInsecureHTTPClient + } + if *c == nil { + defaultHTTPClientMtx.Lock() + defer defaultHTTPClientMtx.Unlock() + *c = &http.Client{Transport: &http.Transport{ + TLSClientConfig: MakeTLSConfig(ac.ApiInsecure)}} + } + return *c +}