Commit c0ebf1b2 authored by Jacob Vosmaer's avatar Jacob Vosmaer

Replace "auth request" with middleware

This gives us the flexibility we need to also handle regular
downloads and uploads in gitlab-workhorse.
parent ed976a2f
PREFIX=/usr/local PREFIX=/usr/local
VERSION=$(shell git describe)-$(shell date -u +%Y%m%d.%H%M%S) VERSION=$(shell git describe)-$(shell date -u +%Y%m%d.%H%M%S)
gitlab-workhorse: main.go githandler.go archive.go git-http.go helpers.go gitlab-workhorse: main.go upstream.go archive.go git-http.go helpers.go
go build -ldflags "-X main.Version ${VERSION}" -o gitlab-workhorse go build -ldflags "-X main.Version ${VERSION}" -o gitlab-workhorse
install: gitlab-workhorse install: gitlab-workhorse
......
...@@ -9,7 +9,7 @@ backend (for authentication and authorization) and local disk access ...@@ -9,7 +9,7 @@ backend (for authentication and authorization) and local disk access
to Git repositories managed by GitLab. In GitLab, this role was previously to Git repositories managed by GitLab. In GitLab, this role was previously
performed by gitlab-grack. performed by gitlab-grack.
In this file we start the web server and hand off to the gitHandler type. In this file we start the web server and hand off to the upstream type.
*/ */
package main package main
...@@ -92,6 +92,6 @@ func main() { ...@@ -92,6 +92,6 @@ func main() {
// Because net/http/pprof installs itself in the DefaultServeMux // Because net/http/pprof installs itself in the DefaultServeMux
// we create a fresh one for the Git server. // we create a fresh one for the Git server.
serveMux := http.NewServeMux() serveMux := http.NewServeMux()
serveMux.Handle("/", newGitHandler(*authBackend, authTransport)) serveMux.Handle("/", newUpstream(*authBackend, authTransport))
log.Fatal(http.Serve(listener, serveMux)) log.Fatal(http.Serve(listener, serveMux))
} }
...@@ -269,7 +269,7 @@ func testAuthServer(code int, body string) *httptest.Server { ...@@ -269,7 +269,7 @@ func testAuthServer(code int, body string) *httptest.Server {
} }
func startServerOrFail(t *testing.T, ts *httptest.Server) *exec.Cmd { func startServerOrFail(t *testing.T, ts *httptest.Server) *exec.Cmd {
cmd := exec.Command("go", "run", "main.go", "githandler.go", "archive.go", "git-http.go", "helpers.go", fmt.Sprintf("-authBackend=%s", ts.URL), fmt.Sprintf("-listenAddr=%s", servAddr)) cmd := exec.Command("go", "run", "main.go", "upstream.go", "archive.go", "git-http.go", "helpers.go", fmt.Sprintf("-authBackend=%s", ts.URL), fmt.Sprintf("-listenAddr=%s", servAddr))
cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true} cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
cmd.Stdout = os.Stdout cmd.Stdout = os.Stdout
cmd.Stderr = os.Stderr cmd.Stderr = os.Stderr
......
/* /*
The gitHandler type implements http.Handler. The upstream type implements http.Handler.
In this file we handle request routing and interaction with the authBackend. In this file we handle request routing and interaction with the authBackend.
*/ */
...@@ -17,7 +17,7 @@ import ( ...@@ -17,7 +17,7 @@ import (
"strings" "strings"
) )
type gitHandler struct { type upstream struct {
httpClient *http.Client httpClient *http.Client
authBackend string authBackend string
} }
...@@ -25,6 +25,7 @@ type gitHandler struct { ...@@ -25,6 +25,7 @@ type gitHandler struct {
type gitService struct { type gitService struct {
method string method string
regex *regexp.Regexp regex *regexp.Regexp
middlewareFunc func(u *upstream, w http.ResponseWriter, r *http.Request, handleFunc func(w http.ResponseWriter, r *gitRequest, rpc string), rpc string)
handleFunc func(w http.ResponseWriter, r *gitRequest, rpc string) handleFunc func(w http.ResponseWriter, r *gitRequest, rpc string)
rpc string rpc string
} }
...@@ -52,21 +53,21 @@ type gitRequest struct { ...@@ -52,21 +53,21 @@ type gitRequest struct {
// Routing table // Routing table
var gitServices = [...]gitService{ var gitServices = [...]gitService{
gitService{"GET", regexp.MustCompile(`/info/refs\z`), handleGetInfoRefs, ""}, gitService{"GET", regexp.MustCompile(`/info/refs\z`), repoPreAuth, handleGetInfoRefs, ""},
gitService{"POST", regexp.MustCompile(`/git-upload-pack\z`), handlePostRPC, "git-upload-pack"}, gitService{"POST", regexp.MustCompile(`/git-upload-pack\z`), repoPreAuth, handlePostRPC, "git-upload-pack"},
gitService{"POST", regexp.MustCompile(`/git-receive-pack\z`), handlePostRPC, "git-receive-pack"}, gitService{"POST", regexp.MustCompile(`/git-receive-pack\z`), repoPreAuth, handlePostRPC, "git-receive-pack"},
gitService{"GET", regexp.MustCompile(`/repository/archive\z`), handleGetArchive, "tar.gz"}, gitService{"GET", regexp.MustCompile(`/repository/archive\z`), repoPreAuth, handleGetArchive, "tar.gz"},
gitService{"GET", regexp.MustCompile(`/repository/archive.zip\z`), handleGetArchive, "zip"}, gitService{"GET", regexp.MustCompile(`/repository/archive.zip\z`), repoPreAuth, handleGetArchive, "zip"},
gitService{"GET", regexp.MustCompile(`/repository/archive.tar\z`), handleGetArchive, "tar"}, gitService{"GET", regexp.MustCompile(`/repository/archive.tar\z`), repoPreAuth, handleGetArchive, "tar"},
gitService{"GET", regexp.MustCompile(`/repository/archive.tar.gz\z`), handleGetArchive, "tar.gz"}, gitService{"GET", regexp.MustCompile(`/repository/archive.tar.gz\z`), repoPreAuth, handleGetArchive, "tar.gz"},
gitService{"GET", regexp.MustCompile(`/repository/archive.tar.bz2\z`), handleGetArchive, "tar.bz2"}, gitService{"GET", regexp.MustCompile(`/repository/archive.tar.bz2\z`), repoPreAuth, handleGetArchive, "tar.bz2"},
} }
func newGitHandler(authBackend string, authTransport http.RoundTripper) *gitHandler { func newUpstream(authBackend string, authTransport http.RoundTripper) *upstream {
return &gitHandler{&http.Client{Transport: authTransport}, authBackend} return &upstream{&http.Client{Transport: authTransport}, authBackend}
} }
func (h *gitHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { func (u *upstream) ServeHTTP(w http.ResponseWriter, r *http.Request) {
var g gitService var g gitService
log.Printf("%s %q", r.Method, r.URL) log.Printf("%s %q", r.Method, r.URL)
...@@ -86,9 +87,31 @@ func (h *gitHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { ...@@ -86,9 +87,31 @@ func (h *gitHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
return return
} }
// Ask the auth backend if the request is allowed, and what the g.middlewareFunc(u, w, r, g.handleFunc, g.rpc)
// user ID (GL_ID) is. }
authResponse, err := h.doAuthRequest(r)
func repoPreAuth(u *upstream, w http.ResponseWriter, r *http.Request, handleFunc func(w http.ResponseWriter, r *gitRequest, rpc string), rpc string) {
url := u.authBackend + r.URL.RequestURI()
authReq, err := http.NewRequest(r.Method, url, nil)
if err != nil {
fail500(w, "doAuthRequest", err)
return
}
// Forward all headers from our client to the auth backend. This includes
// HTTP Basic authentication credentials (the 'Authorization' header).
for k, v := range r.Header {
authReq.Header[k] = v
}
// Also forward the Host header, which is excluded from the Header map by the http libary.
// This allows the Host header received by the backend to be consistent with other
// requests not going through gitlab-workhorse.
authReq.Host = r.Host
// Set a custom header for the request. This can be used in some
// configurations (Passenger) to solve auth request routing problems.
authReq.Header.Set("GitLab-Git-HTTP-Server", Version)
authResponse, err := u.httpClient.Do(authReq)
if err != nil { if err != nil {
fail500(w, "doAuthRequest", err) fail500(w, "doAuthRequest", err)
return return
...@@ -139,7 +162,7 @@ func (h *gitHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { ...@@ -139,7 +162,7 @@ func (h *gitHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
return return
} }
g.handleFunc(w, gitReq, g.rpc) handleFunc(w, gitReq, rpc)
} }
func looksLikeRepo(p string) bool { func looksLikeRepo(p string) bool {
...@@ -151,24 +174,3 @@ func looksLikeRepo(p string) bool { ...@@ -151,24 +174,3 @@ func looksLikeRepo(p string) bool {
} }
return true return true
} }
func (h *gitHandler) doAuthRequest(r *http.Request) (result *http.Response, err error) {
url := h.authBackend + r.URL.RequestURI()
authReq, err := http.NewRequest(r.Method, url, nil)
if err != nil {
return nil, err
}
// Forward all headers from our client to the auth backend. This includes
// HTTP Basic authentication credentials (the 'Authorization' header).
for k, v := range r.Header {
authReq.Header[k] = v
}
// Also forward the Host header, which is excluded from the Header map by the http libary.
// This allows the Host header received by the backend to be consistent with other
// requests not going through gitlab-workhorse.
authReq.Host = r.Host
// Set a custom header for the request. This can be used in some
// configurations (Passenger) to solve auth request routing problems.
authReq.Header.Set("GitLab-Git-HTTP-Server", Version)
return h.httpClient.Do(authReq)
}
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment