From 935303a476554ec58aace42e1391a4adfecbf62c Mon Sep 17 00:00:00 2001 From: wang yan Date: Wed, 15 Jan 2020 17:45:27 +0800 Subject: [PATCH] move readonly middleware to new v2 handler Signed-off-by: wang yan --- src/internal/error/errors.go | 3 ++ src/server/middleware/readonly.go | 27 ++++++++++++++ src/server/middleware/readonly_test.go | 50 ++++++++++++++++++++++++++ src/server/registry/blob/blob.go | 22 ++++++++++++ src/server/registry/blob/blob_test.go | 1 + src/server/registry/handler.go | 16 ++++++--- 6 files changed, 115 insertions(+), 4 deletions(-) create mode 100644 src/server/middleware/readonly.go create mode 100644 src/server/middleware/readonly_test.go create mode 100644 src/server/registry/blob/blob.go create mode 100644 src/server/registry/blob/blob_test.go diff --git a/src/internal/error/errors.go b/src/internal/error/errors.go index 9bab36bf1..4b4d36131 100644 --- a/src/internal/error/errors.go +++ b/src/internal/error/errors.go @@ -89,6 +89,9 @@ const ( PreconditionCode = "PRECONDITION" // GeneralCode ... GeneralCode = "UNKNOWN" + + // DENIED it's used by middleware(readonly, vul and content trust) and returned to docker client to index the request is denied. + DENIED = "DENIED" ) // New ... diff --git a/src/server/middleware/readonly.go b/src/server/middleware/readonly.go new file mode 100644 index 000000000..b9ecd4c2e --- /dev/null +++ b/src/server/middleware/readonly.go @@ -0,0 +1,27 @@ +package middleware + +import ( + "github.com/goharbor/harbor/src/common/utils/log" + "github.com/goharbor/harbor/src/core/config" + internal_errors "github.com/goharbor/harbor/src/internal/error" + "net/http" +) + +type readonlyHandler struct { + next http.Handler +} + +// ReadOnly middleware reject request when harbor set to readonly +func ReadOnly() func(http.Handler) http.Handler { + return func(next http.Handler) http.Handler { + return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) { + if config.ReadOnly() { + log.Warningf("The request is prohibited in readonly mode, url is: %s", req.URL.Path) + pkgE := internal_errors.New(nil).WithCode(internal_errors.DENIED).WithMessage("The system is in read only mode. Any modification is prohibited.") + http.Error(rw, internal_errors.NewErrs(pkgE).Error(), http.StatusForbidden) + return + } + next.ServeHTTP(rw, req) + }) + } +} diff --git a/src/server/middleware/readonly_test.go b/src/server/middleware/readonly_test.go new file mode 100644 index 000000000..96369ce5e --- /dev/null +++ b/src/server/middleware/readonly_test.go @@ -0,0 +1,50 @@ +package middleware + +import ( + "github.com/goharbor/harbor/src/common" + config2 "github.com/goharbor/harbor/src/common/config" + "github.com/goharbor/harbor/src/core/config" + "net/http" + "net/http/httptest" + "os" + "testing" + + "github.com/stretchr/testify/assert" +) + +func TestMain(m *testing.M) { + conf := map[string]interface{}{ + common.ReadOnly: "true", + } + kp := &config2.PresetKeyProvider{Key: "naa4JtarA1Zsc3uY"} + config.InitWithSettings(conf, kp) + result := m.Run() + if result != 0 { + os.Exit(result) + } +} + +func TestReadOnly(t *testing.T) { + assert := assert.New(t) + + next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.WriteHeader(200) + }) + + // delete + req := httptest.NewRequest(http.MethodDelete, "/readonly1", nil) + rec := httptest.NewRecorder() + ReadOnly()(next).ServeHTTP(rec, req) + assert.Equal(rec.Code, http.StatusForbidden) + + update := map[string]interface{}{ + common.ReadOnly: "false", + } + config.GetCfgManager().UpdateConfig(update) + + req2 := httptest.NewRequest(http.MethodDelete, "/readonly2", nil) + rec2 := httptest.NewRecorder() + ReadOnly()(next).ServeHTTP(rec2, req2) + assert.Equal(rec2.Code, http.StatusOK) + +} diff --git a/src/server/registry/blob/blob.go b/src/server/registry/blob/blob.go new file mode 100644 index 000000000..f963c4621 --- /dev/null +++ b/src/server/registry/blob/blob.go @@ -0,0 +1,22 @@ +package blob + +import ( + "net/http" + "net/http/httputil" +) + +// NewHandler returns the handler to handler catalog request +func NewHandler(proxy *httputil.ReverseProxy) http.Handler { + return &handler{ + proxy: proxy, + } +} + +type handler struct { + proxy *httputil.ReverseProxy +} + +// ServeHTTP ... +func (h *handler) ServeHTTP(w http.ResponseWriter, req *http.Request) { + h.proxy.ServeHTTP(w, req) +} diff --git a/src/server/registry/blob/blob_test.go b/src/server/registry/blob/blob_test.go new file mode 100644 index 000000000..f3a8cab65 --- /dev/null +++ b/src/server/registry/blob/blob_test.go @@ -0,0 +1 @@ +package blob diff --git a/src/server/registry/handler.go b/src/server/registry/handler.go index 3b7fc300f..8229f9fe5 100644 --- a/src/server/registry/handler.go +++ b/src/server/registry/handler.go @@ -16,6 +16,8 @@ package registry import ( "github.com/goharbor/harbor/src/pkg/project" + "github.com/goharbor/harbor/src/server/middleware" + "github.com/goharbor/harbor/src/server/registry/blob" "net/http" "net/http/httputil" "net/url" @@ -45,14 +47,20 @@ func New(url *url.URL) http.Handler { // handle manifest // TODO maybe we should split it into several sub routers based on the method manifestRouter := rootRouter.Path("/v2/{name:.*}/manifests/{reference}").Subrouter() - manifestRouter.NewRoute().Methods(http.MethodGet, http.MethodHead, http.MethodPut, http.MethodDelete). - Handler(manifest.NewHandler(project.Mgr, proxy)) + manifestRouter.NewRoute().Methods(http.MethodGet).Handler(manifest.NewHandler(project.Mgr, proxy)) + manifestRouter.NewRoute().Methods(http.MethodHead).Handler(manifest.NewHandler(project.Mgr, proxy)) + manifestRouter.NewRoute().Methods(http.MethodPut).Handler(middleware.WithMiddlewares(manifest.NewHandler(project.Mgr, proxy), middleware.ReadOnly())) + manifestRouter.NewRoute().Methods(http.MethodDelete).Handler(middleware.WithMiddlewares(manifest.NewHandler(project.Mgr, proxy), middleware.ReadOnly())) // handle blob // as we need to apply middleware to the blob requests, so create a sub router to handle the blob APIs blobRouter := rootRouter.PathPrefix("/v2/{name:.*}/blobs/").Subrouter() - blobRouter.NewRoute().Methods(http.MethodGet, http.MethodHead, http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete). - Handler(proxy) + blobRouter.NewRoute().Methods(http.MethodGet).Handler(blob.NewHandler(proxy)) + blobRouter.NewRoute().Methods(http.MethodHead).Handler(blob.NewHandler(proxy)) + blobRouter.NewRoute().Methods(http.MethodPost).Handler(middleware.WithMiddlewares(blob.NewHandler(proxy), middleware.ReadOnly())) + blobRouter.NewRoute().Methods(http.MethodPut).Handler(middleware.WithMiddlewares(blob.NewHandler(proxy), middleware.ReadOnly())) + blobRouter.NewRoute().Methods(http.MethodPatch).Handler(middleware.WithMiddlewares(blob.NewHandler(proxy), middleware.ReadOnly())) + blobRouter.NewRoute().Methods(http.MethodDelete).Handler(middleware.WithMiddlewares(blob.NewHandler(proxy), middleware.ReadOnly())) // all other APIs are proxy to the backend docker registry rootRouter.PathPrefix("/").Handler(proxy)