Skip to content

Commit 67d752a

Browse files
runcomruncom
committed
support legacy registries in exernal stores
Signed-off-by: Antonio Murdaca <[email protected]>
1 parent 1325cde commit 67d752a

7 files changed

Lines changed: 153 additions & 41 deletions

File tree

‎api/client/registry.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,8 @@ func (cli *DockerCli) RegistryAuthenticationPrivilegedFunc(index *registrytypes.
4949
return func() (string, error) {
5050
fmt.Fprintf(cli.out, "\nPlease login prior to %s:\n", cmdName)
5151
indexServer := registry.GetAuthConfigKey(index)
52-
authConfig, err := cli.ConfigureAuth("", "", indexServer, false)
52+
isDefaultRegistry := indexServer == cli.ElectAuthServer(context.Background())
53+
authConfig, err := cli.ConfigureAuth("", "", indexServer, isDefaultRegistry)
5354
if err != nil {
5455
return "", err
5556
}
@@ -91,6 +92,10 @@ func (cli *DockerCli) ConfigureAuth(flUser, flPassword, serverAddress string, is
9192
cli.in = os.Stdin
9293
}
9394

95+
if !isDefaultRegistry {
96+
serverAddress = registry.ConvertToHostname(serverAddress)
97+
}
98+
9499
authconfig, err := GetCredentials(cli.configFile, serverAddress)
95100
if err != nil {
96101
return authconfig, err

‎api/client/registry/login.go‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -50,14 +50,18 @@ func runLogin(dockerCli *client.DockerCli, opts loginOptions) error {
5050
ctx := context.Background()
5151
clnt := dockerCli.Client()
5252

53-
var serverAddress string
54-
var isDefaultRegistry bool
53+
var (
54+
serverAddress string
55+
authServer = dockerCli.ElectAuthServer(ctx)
56+
)
5557
if opts.serverAddress != "" {
5658
serverAddress = opts.serverAddress
5759
} else {
58-
serverAddress = dockerCli.ElectAuthServer(ctx)
59-
isDefaultRegistry = true
60+
serverAddress = authServer
6061
}
62+
63+
isDefaultRegistry := serverAddress == authServer
64+
6165
authConfig, err := dockerCli.ConfigureAuth(opts.user, opts.password, serverAddress, isDefaultRegistry)
6266
if err != nil {
6367
return err

‎api/client/registry/logout.go‎

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77

88
"github.com/docker/docker/api/client"
99
"github.com/docker/docker/cli"
10+
"github.com/docker/docker/registry"
1011
"github.com/spf13/cobra"
1112
)
1213

@@ -31,21 +32,45 @@ func NewLogoutCommand(dockerCli *client.DockerCli) *cobra.Command {
3132

3233
func runLogout(dockerCli *client.DockerCli, serverAddress string) error {
3334
ctx := context.Background()
35+
var isDefaultRegistry bool
3436

3537
if serverAddress == "" {
3638
serverAddress = dockerCli.ElectAuthServer(ctx)
39+
isDefaultRegistry = true
40+
}
41+
42+
var (
43+
loggedIn bool
44+
regsToLogout []string
45+
hostnameAddress = serverAddress
46+
regsToTry = []string{serverAddress}
47+
)
48+
if !isDefaultRegistry {
49+
hostnameAddress = registry.ConvertToHostname(serverAddress)
50+
// the tries below are kept for backward compatibily where a user could have
51+
// saved the registry in one of the following format.
52+
regsToTry = append(regsToTry, hostnameAddress, "http://"+hostnameAddress, "https://"+hostnameAddress)
3753
}
3854

3955
// check if we're logged in based on the records in the config file
4056
// which means it couldn't have user/pass cause they may be in the creds store
41-
if _, ok := dockerCli.ConfigFile().AuthConfigs[serverAddress]; !ok {
42-
fmt.Fprintf(dockerCli.Out(), "Not logged in to %s\n", serverAddress)
57+
for _, s := range regsToTry {
58+
if _, ok := dockerCli.ConfigFile().AuthConfigs[s]; ok {
59+
loggedIn = true
60+
regsToLogout = append(regsToLogout, s)
61+
}
62+
}
63+
64+
if !loggedIn {
65+
fmt.Fprintf(dockerCli.Out(), "Not logged in to %s\n", hostnameAddress)
4366
return nil
4467
}
4568

46-
fmt.Fprintf(dockerCli.Out(), "Removing login credentials for %s\n", serverAddress)
47-
if err := client.EraseCredentials(dockerCli.ConfigFile(), serverAddress); err != nil {
48-
fmt.Fprintf(dockerCli.Err(), "WARNING: could not erase credentials: %v\n", err)
69+
fmt.Fprintf(dockerCli.Out(), "Removing login credentials for %s\n", hostnameAddress)
70+
for _, r := range regsToLogout {
71+
if err := client.EraseCredentials(dockerCli.ConfigFile(), r); err != nil {
72+
fmt.Fprintf(dockerCli.Err(), "WARNING: could not erase credentials: %v\n", err)
73+
}
4974
}
5075

5176
return nil

‎cliconfig/credentials/file_store.go‎

Lines changed: 3 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
11
package credentials
22

33
import (
4-
"strings"
5-
64
"github.com/docker/docker/cliconfig/configfile"
5+
"github.com/docker/docker/registry"
76
"github.com/docker/engine-api/types"
87
)
98

@@ -32,8 +31,8 @@ func (c *fileStore) Get(serverAddress string) (types.AuthConfig, error) {
3231
if !ok {
3332
// Maybe they have a legacy config file, we will iterate the keys converting
3433
// them to the new format and testing
35-
for registry, ac := range c.file.AuthConfigs {
36-
if serverAddress == convertToHostname(registry) {
34+
for r, ac := range c.file.AuthConfigs {
35+
if serverAddress == registry.ConvertToHostname(r) {
3736
return ac, nil
3837
}
3938
}
@@ -52,16 +51,3 @@ func (c *fileStore) Store(authConfig types.AuthConfig) error {
5251
c.file.AuthConfigs[authConfig.ServerAddress] = authConfig
5352
return c.file.Save()
5453
}
55-
56-
func convertToHostname(url string) string {
57-
stripped := url
58-
if strings.HasPrefix(url, "http://") {
59-
stripped = strings.Replace(url, "http://", "", 1)
60-
} else if strings.HasPrefix(url, "https://") {
61-
stripped = strings.Replace(url, "https://", "", 1)
62-
}
63-
64-
nameParts := strings.SplitN(stripped, "/", 2)
65-
66-
return nameParts[0]
67-
}

‎integration-cli/docker_cli_logout_test.go‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
package main
22

33
import (
4+
"bytes"
45
"fmt"
56
"io/ioutil"
67
"os"
8+
"os/exec"
79
"path/filepath"
810

911
"github.com/docker/docker/pkg/integration/checker"
@@ -54,3 +56,45 @@ func (s *DockerRegistryAuthHtpasswdSuite) TestLogoutWithExternalAuth(c *check.C)
5456
c.Assert(err, check.NotNil, check.Commentf(out))
5557
c.Assert(out, checker.Contains, "Error: image dockercli/busybox:authtest not found")
5658
}
59+
60+
// #23100
61+
func (s *DockerRegistryAuthHtpasswdSuite) TestLogoutWithWrongHostnamesStored(c *check.C) {
62+
osPath := os.Getenv("PATH")
63+
defer os.Setenv("PATH", osPath)
64+
65+
workingDir, err := os.Getwd()
66+
c.Assert(err, checker.IsNil)
67+
absolute, err := filepath.Abs(filepath.Join(workingDir, "fixtures", "auth"))
68+
c.Assert(err, checker.IsNil)
69+
testPath := fmt.Sprintf("%s%c%s", osPath, filepath.ListSeparator, absolute)
70+
71+
os.Setenv("PATH", testPath)
72+
73+
cmd := exec.Command("docker-credential-shell-test", "store")
74+
stdin := bytes.NewReader([]byte(fmt.Sprintf(`{"ServerURL": "https://%s", "Username": "%s", "Secret": "%s"}`, privateRegistryURL, s.reg.username, s.reg.password)))
75+
cmd.Stdin = stdin
76+
c.Assert(cmd.Run(), checker.IsNil)
77+
78+
tmp, err := ioutil.TempDir("", "integration-cli-")
79+
c.Assert(err, checker.IsNil)
80+
81+
externalAuthConfig := fmt.Sprintf(`{ "auths": {"https://%s": {}}, "credsStore": "shell-test" }`, privateRegistryURL)
82+
83+
configPath := filepath.Join(tmp, "config.json")
84+
err = ioutil.WriteFile(configPath, []byte(externalAuthConfig), 0644)
85+
c.Assert(err, checker.IsNil)
86+
87+
dockerCmd(c, "--config", tmp, "login", "-u", s.reg.username, "-p", s.reg.password, privateRegistryURL)
88+
89+
b, err := ioutil.ReadFile(configPath)
90+
c.Assert(err, checker.IsNil)
91+
c.Assert(string(b), checker.Contains, fmt.Sprintf("\"https://%s\": {}", privateRegistryURL))
92+
c.Assert(string(b), checker.Contains, fmt.Sprintf("\"%s\": {}", privateRegistryURL))
93+
94+
dockerCmd(c, "--config", tmp, "logout", privateRegistryURL)
95+
96+
b, err = ioutil.ReadFile(configPath)
97+
c.Assert(err, checker.IsNil)
98+
c.Assert(string(b), checker.Not(checker.Contains), fmt.Sprintf("\"https://%s\": {}", privateRegistryURL))
99+
c.Assert(string(b), checker.Not(checker.Contains), fmt.Sprintf("\"%s\": {}", privateRegistryURL))
100+
}

‎integration-cli/docker_cli_pull_local_test.go‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -387,6 +387,52 @@ func (s *DockerRegistrySuite) TestPullManifestList(c *check.C) {
387387
dockerCmd(c, "rmi", repoName)
388388
}
389389

390+
// #23100
391+
func (s *DockerRegistryAuthHtpasswdSuite) TestPullWithExternalAuthLoginWithScheme(c *check.C) {
392+
osPath := os.Getenv("PATH")
393+
defer os.Setenv("PATH", osPath)
394+
395+
workingDir, err := os.Getwd()
396+
c.Assert(err, checker.IsNil)
397+
absolute, err := filepath.Abs(filepath.Join(workingDir, "fixtures", "auth"))
398+
c.Assert(err, checker.IsNil)
399+
testPath := fmt.Sprintf("%s%c%s", osPath, filepath.ListSeparator, absolute)
400+
401+
os.Setenv("PATH", testPath)
402+
403+
repoName := fmt.Sprintf("%v/dockercli/busybox:authtest", privateRegistryURL)
404+
405+
tmp, err := ioutil.TempDir("", "integration-cli-")
406+
c.Assert(err, checker.IsNil)
407+
408+
externalAuthConfig := `{ "credsStore": "shell-test" }`
409+
410+
configPath := filepath.Join(tmp, "config.json")
411+
err = ioutil.WriteFile(configPath, []byte(externalAuthConfig), 0644)
412+
c.Assert(err, checker.IsNil)
413+
414+
dockerCmd(c, "--config", tmp, "login", "-u", s.reg.username, "-p", s.reg.password, privateRegistryURL)
415+
416+
b, err := ioutil.ReadFile(configPath)
417+
c.Assert(err, checker.IsNil)
418+
c.Assert(string(b), checker.Not(checker.Contains), "\"auth\":")
419+
420+
dockerCmd(c, "--config", tmp, "tag", "busybox", repoName)
421+
dockerCmd(c, "--config", tmp, "push", repoName)
422+
423+
dockerCmd(c, "--config", tmp, "logout", privateRegistryURL)
424+
dockerCmd(c, "--config", tmp, "login", "-u", s.reg.username, "-p", s.reg.password, "https://"+privateRegistryURL)
425+
dockerCmd(c, "--config", tmp, "pull", repoName)
426+
427+
// likewise push should work
428+
repoName2 := fmt.Sprintf("%v/dockercli/busybox:nocreds", privateRegistryURL)
429+
dockerCmd(c, "tag", repoName, repoName2)
430+
dockerCmd(c, "--config", tmp, "push", repoName2)
431+
432+
// logout should work w scheme also because it will be stripped
433+
dockerCmd(c, "--config", tmp, "logout", "https://"+privateRegistryURL)
434+
}
435+
390436
func (s *DockerRegistryAuthHtpasswdSuite) TestPullWithExternalAuth(c *check.C) {
391437
osPath := os.Getenv("PATH")
392438
defer os.Setenv("PATH", osPath)

‎registry/auth.go‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,21 @@ func v2AuthHTTPClient(endpoint *url.URL, authTransport http.RoundTripper, modifi
206206

207207
}
208208

209+
// ConvertToHostname converts a registry url which has http|https prepended
210+
// to just an hostname.
211+
func ConvertToHostname(url string) string {
212+
stripped := url
213+
if strings.HasPrefix(url, "http://") {
214+
stripped = strings.TrimPrefix(url, "http://")
215+
} else if strings.HasPrefix(url, "https://") {
216+
stripped = strings.TrimPrefix(url, "https://")
217+
}
218+
219+
nameParts := strings.SplitN(stripped, "/", 2)
220+
221+
return nameParts[0]
222+
}
223+
209224
// ResolveAuthConfig matches an auth configuration to a server address or a URL
210225
func ResolveAuthConfig(authConfigs map[string]types.AuthConfig, index *registrytypes.IndexInfo) types.AuthConfig {
211226
configKey := GetAuthConfigKey(index)
@@ -214,23 +229,10 @@ func ResolveAuthConfig(authConfigs map[string]types.AuthConfig, index *registryt
214229
return c
215230
}
216231

217-
convertToHostname := func(url string) string {
218-
stripped := url
219-
if strings.HasPrefix(url, "http://") {
220-
stripped = strings.Replace(url, "http://", "", 1)
221-
} else if strings.HasPrefix(url, "https://") {
222-
stripped = strings.Replace(url, "https://", "", 1)
223-
}
224-
225-
nameParts := strings.SplitN(stripped, "/", 2)
226-
227-
return nameParts[0]
228-
}
229-
230232
// Maybe they have a legacy config file, we will iterate the keys converting
231233
// them to the new format and testing
232234
for registry, ac := range authConfigs {
233-
if configKey == convertToHostname(registry) {
235+
if configKey == ConvertToHostname(registry) {
234236
return ac
235237
}
236238
}

0 commit comments

Comments
 (0)