8000 Handle unresolvable domain names in isSecure to allow HTTP proxies to work as expected by tiborvass · Pull Request #9735 · moby/moby · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Handle unresolvable domain names in isSecure to allow HTTP proxies to work as expected #9735

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Dec 19, 2014
Merged

Handle unresolvable domain names in isSecure to allow HTTP proxies to work as expected #9735

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a70d7aa
registry: add tests for unresolvable domain names in isSecure
tiborvass Dec 19, 2014
ff4bfcc
registry: handle unresolvable domain names in isSecure
tiborvass Dec 19, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 19 additions & 15 deletions registry/endpoint.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,7 +163,10 @@ func (e Endpoint) Ping() (RegistryInfo, error) {
// If the subnet contains one of the IPs of the registry specified by hostname, the latter is considered
// insecure.
//
// hostname should be a URL.Host (`host:port` or `host`)
// hostname should be a URL.Host (`host:port` or `host`) where the `host` part can be either a domain name
// or an IP address. If it is a domain name, then it will be resolved in order to check if the IP is contained
// in a subnet. If the resolving is not successful, isSecure will only try to match hostname to any element
// of insecureRegistries.
func isSecure(hostname string, insecureRegistries []string) (bool, error) {
if hostname == IndexServerURL.Host {
return true, nil
Expand All @@ -177,29 +180,30 @@ func isSecure(hostname string, insecureRegistries []string) (bool, error) {
addrs, err := lookupIP(host)
if err != nil {
ip := net.ParseIP(host)
if ip == nil {
// if resolving `host` fails, error out, since host is to be net.Dial-ed anyway
return true, fmt.Errorf("issecure: could not resolve %q: %v", host, err)
if ip != nil {
addrs = []net.IP{ip}
}
addrs = []net.IP{ip}
}
if len(addrs) == 0 {
return true, fmt.Errorf("issecure: could not resolve %q", host)

// if ip == nil, then `host` is neither an IP nor it could be looked up,
// either because the index is unreachable, or because the index is behind an HTTP proxy.
// So, len(addrs) == 0 and we're not aborting.
}

for _, addr := range addrs {
for _, r := range insecureRegistries {
for _, r := range insecureRegistries {
if hostname == r || host == r {
// hostname matches insecure registry
if hostname == r {
return false, nil
}
return false, nil
}

// Try CIDR notation only if addrs has any elements, i.e. if `host`'s IP could be determined.
for _, addr := range addrs {

// now assume a CIDR was passed to --insecure-registry
_, ipnet, err := net.ParseCIDR(r)
if err != nil {
// if could not parse it as a CIDR, even after removing
// if we could not parse it as a CIDR, even after removing
// assume it's not a CIDR and go on with the next candidate
continue
break
}

// check if the addr falls in the subnet
Expand Down
3 changes: 3 additions & 0 deletions registry/registry_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -348,6 +348,9 @@ func TestIsSecure(t *testing.T) {
{"example.com:5000", []string{"42.42.42.42/8"}, false},
{"127.0.0.1:5000", []string{"127.0.0.0/8"}, false},
{"42.42.42.42:5000", []string{"42.1.1.1/8"}, false},
{"invalid.domain.com", []string{"42.42.0.0/16"}, true},
{"invalid.domain.com", []string{"invalid.domain.com"}, false},
{"invalid.domain.com:5000", []string{"invalid.domain.com"}, false},
}
for _, tt := range tests {
// TODO: remove this once we remove localhost insecure by default
Expand Down
0