github.com/brahmaroutu/docker@v1.2.1-0.20160809185609-eb28dde01f16/api/client/trust.go (about) 1 package client 2 3 import ( 4 "encoding/hex" 5 "encoding/json" 6 "errors" 7 "fmt" 8 "io" 9 "net" 10 "net/http" 11 "net/url" 12 "os" 13 "path" 14 "path/filepath" 15 "sort" 16 "strconv" 17 "time" 18 19 "golang.org/x/net/context" 20 21 "github.com/Sirupsen/logrus" 22 "github.com/docker/distribution/digest" 23 "github.com/docker/distribution/registry/client/auth" 24 "github.com/docker/distribution/registry/client/transport" 25 "github.com/docker/docker/cliconfig" 26 "github.com/docker/docker/distribution" 27 "github.com/docker/docker/pkg/jsonmessage" 28 "github.com/docker/docker/reference" 29 "github.com/docker/docker/registry" 30 "github.com/docker/engine-api/types" 31 registrytypes "github.com/docker/engine-api/types/registry" 32 "github.com/docker/go-connections/tlsconfig" 33 "github.com/docker/notary/client" 34 "github.com/docker/notary/passphrase" 35 "github.com/docker/notary/trustmanager" 36 "github.com/docker/notary/trustpinning" 37 "github.com/docker/notary/tuf/data" 38 "github.com/docker/notary/tuf/signed" 39 "github.com/docker/notary/tuf/store" 40 "github.com/spf13/pflag" 41 ) 42 43 var ( 44 releasesRole = path.Join(data.CanonicalTargetsRole, "releases") 45 untrusted bool 46 ) 47 48 // AddTrustedFlags adds content trust flags to the current command flagset 49 func AddTrustedFlags(fs *pflag.FlagSet, verify bool) { 50 trusted, message := setupTrustedFlag(verify) 51 fs.BoolVar(&untrusted, "disable-content-trust", !trusted, message) 52 } 53 54 func setupTrustedFlag(verify bool) (bool, string) { 55 var trusted bool 56 if e := os.Getenv("DOCKER_CONTENT_TRUST"); e != "" { 57 if t, err := strconv.ParseBool(e); t || err != nil { 58 // treat any other value as true 59 trusted = true 60 } 61 } 62 message := "Skip image signing" 63 if verify { 64 message = "Skip image verification" 65 } 66 return trusted, message 67 } 68 69 // IsTrusted returns true if content trust is enabled 70 func IsTrusted() bool { 71 return !untrusted 72 } 73 74 type target struct { 75 reference registry.Reference 76 digest digest.Digest 77 size int64 78 } 79 80 func (cli *DockerCli) trustDirectory() string { 81 return filepath.Join(cliconfig.ConfigDir(), "trust") 82 } 83 84 // certificateDirectory returns the directory containing 85 // TLS certificates for the given server. An error is 86 // returned if there was an error parsing the server string. 87 func (cli *DockerCli) certificateDirectory(server string) (string, error) { 88 u, err := url.Parse(server) 89 if err != nil { 90 return "", err 91 } 92 93 return filepath.Join(cliconfig.ConfigDir(), "tls", u.Host), nil 94 } 95 96 func trustServer(index *registrytypes.IndexInfo) (string, error) { 97 if s := os.Getenv("DOCKER_CONTENT_TRUST_SERVER"); s != "" { 98 urlObj, err := url.Parse(s) 99 if err != nil || urlObj.Scheme != "https" { 100 return "", fmt.Errorf("valid https URL required for trust server, got %s", s) 101 } 102 103 return s, nil 104 } 105 if index.Official { 106 return registry.NotaryServer, nil 107 } 108 return "https://" + index.Name, nil 109 } 110 111 type simpleCredentialStore struct { 112 auth types.AuthConfig 113 } 114 115 func (scs simpleCredentialStore) Basic(u *url.URL) (string, string) { 116 return scs.auth.Username, scs.auth.Password 117 } 118 119 func (scs simpleCredentialStore) RefreshToken(u *url.URL, service string) string { 120 return scs.auth.IdentityToken 121 } 122 123 func (scs simpleCredentialStore) SetRefreshToken(*url.URL, string, string) { 124 } 125 126 // getNotaryRepository returns a NotaryRepository which stores all the 127 // information needed to operate on a notary repository. 128 // It creates an HTTP transport providing authentication support. 129 func (cli *DockerCli) getNotaryRepository(repoInfo *registry.RepositoryInfo, authConfig types.AuthConfig, actions ...string) (*client.NotaryRepository, error) { 130 server, err := trustServer(repoInfo.Index) 131 if err != nil { 132 return nil, err 133 } 134 135 var cfg = tlsconfig.ClientDefault 136 cfg.InsecureSkipVerify = !repoInfo.Index.Secure 137 138 // Get certificate base directory 139 certDir, err := cli.certificateDirectory(server) 140 if err != nil { 141 return nil, err 142 } 143 logrus.Debugf("reading certificate directory: %s", certDir) 144 145 if err := registry.ReadCertsDirectory(&cfg, certDir); err != nil { 146 return nil, err 147 } 148 149 base := &http.Transport{ 150 Proxy: http.ProxyFromEnvironment, 151 Dial: (&net.Dialer{ 152 Timeout: 30 * time.Second, 153 KeepAlive: 30 * time.Second, 154 DualStack: true, 155 }).Dial, 156 TLSHandshakeTimeout: 10 * time.Second, 157 TLSClientConfig: &cfg, 158 DisableKeepAlives: true, 159 } 160 161 // Skip configuration headers since request is not going to Docker daemon 162 modifiers := registry.DockerHeaders(clientUserAgent(), http.Header{}) 163 authTransport := transport.NewTransport(base, modifiers...) 164 pingClient := &http.Client{ 165 Transport: authTransport, 166 Timeout: 5 * time.Second, 167 } 168 endpointStr := server + "/v2/" 169 req, err := http.NewRequest("GET", endpointStr, nil) 170 if err != nil { 171 return nil, err 172 } 173 174 challengeManager := auth.NewSimpleChallengeManager() 175 176 resp, err := pingClient.Do(req) 177 if err != nil { 178 // Ignore error on ping to operate in offline mode 179 logrus.Debugf("Error pinging notary server %q: %s", endpointStr, err) 180 } else { 181 defer resp.Body.Close() 182 183 // Add response to the challenge manager to parse out 184 // authentication header and register authentication method 185 if err := challengeManager.AddResponse(resp); err != nil { 186 return nil, err 187 } 188 } 189 190 creds := simpleCredentialStore{auth: authConfig} 191 tokenHandler := auth.NewTokenHandler(authTransport, creds, repoInfo.FullName(), actions...) 192 basicHandler := auth.NewBasicHandler(creds) 193 modifiers = append(modifiers, transport.RequestModifier(auth.NewAuthorizer(challengeManager, tokenHandler, basicHandler))) 194 tr := transport.NewTransport(base, modifiers...) 195 196 return client.NewNotaryRepository( 197 cli.trustDirectory(), repoInfo.FullName(), server, tr, cli.getPassphraseRetriever(), 198 trustpinning.TrustPinConfig{}) 199 } 200 201 func convertTarget(t client.Target) (target, error) { 202 h, ok := t.Hashes["sha256"] 203 if !ok { 204 return target{}, errors.New("no valid hash, expecting sha256") 205 } 206 return target{ 207 reference: registry.ParseReference(t.Name), 208 digest: digest.NewDigestFromHex("sha256", hex.EncodeToString(h)), 209 size: t.Length, 210 }, nil 211 } 212 213 func (cli *DockerCli) getPassphraseRetriever() passphrase.Retriever { 214 aliasMap := map[string]string{ 215 "root": "root", 216 "snapshot": "repository", 217 "targets": "repository", 218 "default": "repository", 219 } 220 baseRetriever := passphrase.PromptRetrieverWithInOut(cli.in, cli.out, aliasMap) 221 env := map[string]string{ 222 "root": os.Getenv("DOCKER_CONTENT_TRUST_ROOT_PASSPHRASE"), 223 "snapshot": os.Getenv("DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE"), 224 "targets": os.Getenv("DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE"), 225 "default": os.Getenv("DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE"), 226 } 227 228 return func(keyName string, alias string, createNew bool, numAttempts int) (string, bool, error) { 229 if v := env[alias]; v != "" { 230 return v, numAttempts > 1, nil 231 } 232 // For non-root roles, we can also try the "default" alias if it is specified 233 if v := env["default"]; v != "" && alias != data.CanonicalRootRole { 234 return v, numAttempts > 1, nil 235 } 236 return baseRetriever(keyName, alias, createNew, numAttempts) 237 } 238 } 239 240 // TrustedReference returns the canonical trusted reference for an image reference 241 func (cli *DockerCli) TrustedReference(ctx context.Context, ref reference.NamedTagged) (reference.Canonical, error) { 242 repoInfo, err := registry.ParseRepositoryInfo(ref) 243 if err != nil { 244 return nil, err 245 } 246 247 // Resolve the Auth config relevant for this server 248 authConfig := cli.ResolveAuthConfig(ctx, repoInfo.Index) 249 250 notaryRepo, err := cli.getNotaryRepository(repoInfo, authConfig, "pull") 251 if err != nil { 252 fmt.Fprintf(cli.out, "Error establishing connection to trust repository: %s\n", err) 253 return nil, err 254 } 255 256 t, err := notaryRepo.GetTargetByName(ref.Tag(), releasesRole, data.CanonicalTargetsRole) 257 if err != nil { 258 return nil, err 259 } 260 // Only list tags in the top level targets role or the releases delegation role - ignore 261 // all other delegation roles 262 if t.Role != releasesRole && t.Role != data.CanonicalTargetsRole { 263 return nil, notaryError(repoInfo.FullName(), fmt.Errorf("No trust data for %s", ref.Tag())) 264 } 265 r, err := convertTarget(t.Target) 266 if err != nil { 267 return nil, err 268 269 } 270 271 return reference.WithDigest(ref, r.digest) 272 } 273 274 // TagTrusted tags a trusted ref 275 func (cli *DockerCli) TagTrusted(ctx context.Context, trustedRef reference.Canonical, ref reference.NamedTagged) error { 276 fmt.Fprintf(cli.out, "Tagging %s as %s\n", trustedRef.String(), ref.String()) 277 278 return cli.client.ImageTag(ctx, trustedRef.String(), ref.String()) 279 } 280 281 func notaryError(repoName string, err error) error { 282 switch err.(type) { 283 case *json.SyntaxError: 284 logrus.Debugf("Notary syntax error: %s", err) 285 return fmt.Errorf("Error: no trust data available for remote repository %s. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address?", repoName) 286 case signed.ErrExpired: 287 return fmt.Errorf("Error: remote repository %s out-of-date: %v", repoName, err) 288 case trustmanager.ErrKeyNotFound: 289 return fmt.Errorf("Error: signing keys for remote repository %s not found: %v", repoName, err) 290 case *net.OpError: 291 return fmt.Errorf("Error: error contacting notary server: %v", err) 292 case store.ErrMetaNotFound: 293 return fmt.Errorf("Error: trust data missing for remote repository %s or remote repository not found: %v", repoName, err) 294 case signed.ErrInvalidKeyType: 295 return fmt.Errorf("Warning: potential malicious behavior - trust data mismatch for remote repository %s: %v", repoName, err) 296 case signed.ErrNoKeys: 297 return fmt.Errorf("Error: could not find signing keys for remote repository %s, or could not decrypt signing key: %v", repoName, err) 298 case signed.ErrLowVersion: 299 return fmt.Errorf("Warning: potential malicious behavior - trust data version is lower than expected for remote repository %s: %v", repoName, err) 300 case signed.ErrRoleThreshold: 301 return fmt.Errorf("Warning: potential malicious behavior - trust data has insufficient signatures for remote repository %s: %v", repoName, err) 302 case client.ErrRepositoryNotExist: 303 return fmt.Errorf("Error: remote trust data does not exist for %s: %v", repoName, err) 304 case signed.ErrInsufficientSignatures: 305 return fmt.Errorf("Error: could not produce valid signature for %s. If Yubikey was used, was touch input provided?: %v", repoName, err) 306 } 307 308 return err 309 } 310 311 // TrustedPull handles content trust pulling of an image 312 func (cli *DockerCli) TrustedPull(ctx context.Context, repoInfo *registry.RepositoryInfo, ref registry.Reference, authConfig types.AuthConfig, requestPrivilege types.RequestPrivilegeFunc) error { 313 var refs []target 314 315 notaryRepo, err := cli.getNotaryRepository(repoInfo, authConfig, "pull") 316 if err != nil { 317 fmt.Fprintf(cli.out, "Error establishing connection to trust repository: %s\n", err) 318 return err 319 } 320 321 if ref.String() == "" { 322 // List all targets 323 targets, err := notaryRepo.ListTargets(releasesRole, data.CanonicalTargetsRole) 324 if err != nil { 325 return notaryError(repoInfo.FullName(), err) 326 } 327 for _, tgt := range targets { 328 t, err := convertTarget(tgt.Target) 329 if err != nil { 330 fmt.Fprintf(cli.out, "Skipping target for %q\n", repoInfo.Name()) 331 continue 332 } 333 // Only list tags in the top level targets role or the releases delegation role - ignore 334 // all other delegation roles 335 if tgt.Role != releasesRole && tgt.Role != data.CanonicalTargetsRole { 336 continue 337 } 338 refs = append(refs, t) 339 } 340 if len(refs) == 0 { 341 return notaryError(repoInfo.FullName(), fmt.Errorf("No trusted tags for %s", repoInfo.FullName())) 342 } 343 } else { 344 t, err := notaryRepo.GetTargetByName(ref.String(), releasesRole, data.CanonicalTargetsRole) 345 if err != nil { 346 return notaryError(repoInfo.FullName(), err) 347 } 348 // Only get the tag if it's in the top level targets role or the releases delegation role 349 // ignore it if it's in any other delegation roles 350 if t.Role != releasesRole && t.Role != data.CanonicalTargetsRole { 351 return notaryError(repoInfo.FullName(), fmt.Errorf("No trust data for %s", ref.String())) 352 } 353 354 logrus.Debugf("retrieving target for %s role\n", t.Role) 355 r, err := convertTarget(t.Target) 356 if err != nil { 357 return err 358 359 } 360 refs = append(refs, r) 361 } 362 363 for i, r := range refs { 364 displayTag := r.reference.String() 365 if displayTag != "" { 366 displayTag = ":" + displayTag 367 } 368 fmt.Fprintf(cli.out, "Pull (%d of %d): %s%s@%s\n", i+1, len(refs), repoInfo.Name(), displayTag, r.digest) 369 370 ref, err := reference.WithDigest(repoInfo, r.digest) 371 if err != nil { 372 return err 373 } 374 if err := cli.ImagePullPrivileged(ctx, authConfig, ref.String(), requestPrivilege, false); err != nil { 375 return err 376 } 377 378 // If reference is not trusted, tag by trusted reference 379 if !r.reference.HasDigest() { 380 tagged, err := reference.WithTag(repoInfo, r.reference.String()) 381 if err != nil { 382 return err 383 } 384 trustedRef, err := reference.WithDigest(repoInfo, r.digest) 385 if err != nil { 386 return err 387 } 388 if err := cli.TagTrusted(ctx, trustedRef, tagged); err != nil { 389 return err 390 } 391 } 392 } 393 return nil 394 } 395 396 // TrustedPush handles content trust pushing of an image 397 func (cli *DockerCli) TrustedPush(ctx context.Context, repoInfo *registry.RepositoryInfo, ref reference.Named, authConfig types.AuthConfig, requestPrivilege types.RequestPrivilegeFunc) error { 398 responseBody, err := cli.ImagePushPrivileged(ctx, authConfig, ref.String(), requestPrivilege) 399 if err != nil { 400 return err 401 } 402 403 defer responseBody.Close() 404 405 // If it is a trusted push we would like to find the target entry which match the 406 // tag provided in the function and then do an AddTarget later. 407 target := &client.Target{} 408 // Count the times of calling for handleTarget, 409 // if it is called more that once, that should be considered an error in a trusted push. 410 cnt := 0 411 handleTarget := func(aux *json.RawMessage) { 412 cnt++ 413 if cnt > 1 { 414 // handleTarget should only be called one. This will be treated as an error. 415 return 416 } 417 418 var pushResult distribution.PushResult 419 err := json.Unmarshal(*aux, &pushResult) 420 if err == nil && pushResult.Tag != "" && pushResult.Digest.Validate() == nil { 421 h, err := hex.DecodeString(pushResult.Digest.Hex()) 422 if err != nil { 423 target = nil 424 return 425 } 426 target.Name = registry.ParseReference(pushResult.Tag).String() 427 target.Hashes = data.Hashes{string(pushResult.Digest.Algorithm()): h} 428 target.Length = int64(pushResult.Size) 429 } 430 } 431 432 var tag string 433 switch x := ref.(type) { 434 case reference.Canonical: 435 return errors.New("cannot push a digest reference") 436 case reference.NamedTagged: 437 tag = x.Tag() 438 } 439 440 // We want trust signatures to always take an explicit tag, 441 // otherwise it will act as an untrusted push. 442 if tag == "" { 443 if err = jsonmessage.DisplayJSONMessagesStream(responseBody, cli.out, cli.outFd, cli.isTerminalOut, nil); err != nil { 444 return err 445 } 446 fmt.Fprintln(cli.out, "No tag specified, skipping trust metadata push") 447 return nil 448 } 449 450 if err = jsonmessage.DisplayJSONMessagesStream(responseBody, cli.out, cli.outFd, cli.isTerminalOut, handleTarget); err != nil { 451 return err 452 } 453 454 if cnt > 1 { 455 return fmt.Errorf("internal error: only one call to handleTarget expected") 456 } 457 458 if target == nil { 459 fmt.Fprintln(cli.out, "No targets found, please provide a specific tag in order to sign it") 460 return nil 461 } 462 463 fmt.Fprintln(cli.out, "Signing and pushing trust metadata") 464 465 repo, err := cli.getNotaryRepository(repoInfo, authConfig, "push", "pull") 466 if err != nil { 467 fmt.Fprintf(cli.out, "Error establishing connection to notary repository: %s\n", err) 468 return err 469 } 470 471 // get the latest repository metadata so we can figure out which roles to sign 472 err = repo.Update(false) 473 474 switch err.(type) { 475 case client.ErrRepoNotInitialized, client.ErrRepositoryNotExist: 476 keys := repo.CryptoService.ListKeys(data.CanonicalRootRole) 477 var rootKeyID string 478 // always select the first root key 479 if len(keys) > 0 { 480 sort.Strings(keys) 481 rootKeyID = keys[0] 482 } else { 483 rootPublicKey, err := repo.CryptoService.Create(data.CanonicalRootRole, "", data.ECDSAKey) 484 if err != nil { 485 return err 486 } 487 rootKeyID = rootPublicKey.ID() 488 } 489 490 // Initialize the notary repository with a remotely managed snapshot key 491 if err := repo.Initialize(rootKeyID, data.CanonicalSnapshotRole); err != nil { 492 return notaryError(repoInfo.FullName(), err) 493 } 494 fmt.Fprintf(cli.out, "Finished initializing %q\n", repoInfo.FullName()) 495 err = repo.AddTarget(target, data.CanonicalTargetsRole) 496 case nil: 497 // already initialized and we have successfully downloaded the latest metadata 498 err = cli.addTargetToAllSignableRoles(repo, target) 499 default: 500 return notaryError(repoInfo.FullName(), err) 501 } 502 503 if err == nil { 504 err = repo.Publish() 505 } 506 507 if err != nil { 508 fmt.Fprintf(cli.out, "Failed to sign %q:%s - %s\n", repoInfo.FullName(), tag, err.Error()) 509 return notaryError(repoInfo.FullName(), err) 510 } 511 512 fmt.Fprintf(cli.out, "Successfully signed %q:%s\n", repoInfo.FullName(), tag) 513 return nil 514 } 515 516 // Attempt to add the image target to all the top level delegation roles we can 517 // (based on whether we have the signing key and whether the role's path allows 518 // us to). 519 // If there are no delegation roles, we add to the targets role. 520 func (cli *DockerCli) addTargetToAllSignableRoles(repo *client.NotaryRepository, target *client.Target) error { 521 var signableRoles []string 522 523 // translate the full key names, which includes the GUN, into just the key IDs 524 allCanonicalKeyIDs := make(map[string]struct{}) 525 for fullKeyID := range repo.CryptoService.ListAllKeys() { 526 allCanonicalKeyIDs[path.Base(fullKeyID)] = struct{}{} 527 } 528 529 allDelegationRoles, err := repo.GetDelegationRoles() 530 if err != nil { 531 return err 532 } 533 534 // if there are no delegation roles, then just try to sign it into the targets role 535 if len(allDelegationRoles) == 0 { 536 return repo.AddTarget(target, data.CanonicalTargetsRole) 537 } 538 539 // there are delegation roles, find every delegation role we have a key for, and 540 // attempt to sign into into all those roles. 541 for _, delegationRole := range allDelegationRoles { 542 // We do not support signing any delegation role that isn't a direct child of the targets role. 543 // Also don't bother checking the keys if we can't add the target 544 // to this role due to path restrictions 545 if path.Dir(delegationRole.Name) != data.CanonicalTargetsRole || !delegationRole.CheckPaths(target.Name) { 546 continue 547 } 548 549 for _, canonicalKeyID := range delegationRole.KeyIDs { 550 if _, ok := allCanonicalKeyIDs[canonicalKeyID]; ok { 551 signableRoles = append(signableRoles, delegationRole.Name) 552 break 553 } 554 } 555 } 556 557 if len(signableRoles) == 0 { 558 return fmt.Errorf("no valid signing keys for delegation roles") 559 } 560 561 return repo.AddTarget(target, signableRoles...) 562 } 563 564 // ImagePullPrivileged pulls the image and displays it to the output 565 func (cli *DockerCli) ImagePullPrivileged(ctx context.Context, authConfig types.AuthConfig, ref string, requestPrivilege types.RequestPrivilegeFunc, all bool) error { 566 567 encodedAuth, err := EncodeAuthToBase64(authConfig) 568 if err != nil { 569 return err 570 } 571 options := types.ImagePullOptions{ 572 RegistryAuth: encodedAuth, 573 PrivilegeFunc: requestPrivilege, 574 All: all, 575 } 576 577 responseBody, err := cli.client.ImagePull(ctx, ref, options) 578 if err != nil { 579 return err 580 } 581 defer responseBody.Close() 582 583 return jsonmessage.DisplayJSONMessagesStream(responseBody, cli.out, cli.outFd, cli.isTerminalOut, nil) 584 } 585 586 // ImagePushPrivileged push the image 587 func (cli *DockerCli) ImagePushPrivileged(ctx context.Context, authConfig types.AuthConfig, ref string, requestPrivilege types.RequestPrivilegeFunc) (io.ReadCloser, error) { 588 encodedAuth, err := EncodeAuthToBase64(authConfig) 589 if err != nil { 590 return nil, err 591 } 592 options := types.ImagePushOptions{ 593 RegistryAuth: encodedAuth, 594 PrivilegeFunc: requestPrivilege, 595 } 596 597 return cli.client.ImagePush(ctx, ref, options) 598 }