1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
|
package domain
import (
"context"
"crypto/tls"
"errors"
"net/http"
"sync"
"gitlab.com/gitlab-org/labkit/errortracking"
"gitlab.com/gitlab-org/gitlab-pages/internal/httperrors"
"gitlab.com/gitlab-org/gitlab-pages/internal/serving"
)
// ErrDomainDoesNotExist returned when a domain is not found or when a lookup path
// for a domain could not be resolved
var ErrDomainDoesNotExist = errors.New("domain does not exist")
// Domain is a domain that gitlab-pages can serve.
type Domain struct {
Name string
CertificateCert string
CertificateKey string
Resolver Resolver
certificate *tls.Certificate
certificateError error
certificateOnce sync.Once
}
// New creates a new domain with a resolver and existing certificates
func New(name, cert, key string, resolver Resolver) *Domain {
return &Domain{
Name: name,
CertificateCert: cert,
CertificateKey: key,
Resolver: resolver,
}
}
// String implements Stringer.
func (d *Domain) String() string {
return d.Name
}
func (d *Domain) resolve(r *http.Request) (*serving.Request, error) {
if d == nil {
return nil, ErrDomainDoesNotExist
}
return d.Resolver.Resolve(r)
}
// GetLookupPath returns a project details based on the request. It returns nil
// if project does not exist.
func (d *Domain) GetLookupPath(r *http.Request) (*serving.LookupPath, error) {
servingReq, err := d.resolve(r)
if err != nil {
return nil, err
}
return servingReq.LookupPath, nil
}
// IsHTTPSOnly figures out if the request should be handled with HTTPS
// only by looking at group and project level config.
func (d *Domain) IsHTTPSOnly(r *http.Request) bool {
if lookupPath, _ := d.GetLookupPath(r); lookupPath != nil {
return lookupPath.IsHTTPSOnly
}
return false
}
// IsAccessControlEnabled figures out if the request is to a project that has access control enabled
func (d *Domain) IsAccessControlEnabled(r *http.Request) bool {
if lookupPath, _ := d.GetLookupPath(r); lookupPath != nil {
return lookupPath.HasAccessControl
}
return false
}
// IsNamespaceProject figures out if the request is to a namespace project
func (d *Domain) IsNamespaceProject(r *http.Request) bool {
if lookupPath, _ := d.GetLookupPath(r); lookupPath != nil {
return lookupPath.IsNamespaceProject
}
return false
}
// GetProjectID figures out what is the ID of the project user tries to access
func (d *Domain) GetProjectID(r *http.Request) uint64 {
if lookupPath, _ := d.GetLookupPath(r); lookupPath != nil {
return lookupPath.ProjectID
}
return 0
}
// EnsureCertificate parses the PEM-encoded certificate for the domain
func (d *Domain) EnsureCertificate() (*tls.Certificate, error) {
if d == nil || len(d.CertificateKey) == 0 || len(d.CertificateCert) == 0 {
return nil, errors.New("tls certificates can be loaded only for pages with configuration")
}
d.certificateOnce.Do(func() {
var cert tls.Certificate
cert, d.certificateError = tls.X509KeyPair(
[]byte(d.CertificateCert),
[]byte(d.CertificateKey),
)
if d.certificateError == nil {
d.certificate = &cert
}
})
return d.certificate, d.certificateError
}
// ServeFileHTTP returns true if something was served, false if not.
func (d *Domain) ServeFileHTTP(w http.ResponseWriter, r *http.Request) bool {
request, err := d.resolve(r)
if err != nil {
if errors.Is(err, ErrDomainDoesNotExist) {
// serve generic 404
httperrors.Serve404(w)
return true
}
errortracking.Capture(err, errortracking.WithRequest(r), errortracking.WithStackTrace())
httperrors.Serve503(w)
return true
}
return request.ServeFileHTTP(w, r)
}
// ServeNotFoundHTTP serves the not found pages from the projects.
func (d *Domain) ServeNotFoundHTTP(w http.ResponseWriter, r *http.Request) {
request, err := d.resolve(r)
if err != nil {
if errors.Is(err, ErrDomainDoesNotExist) {
// serve generic 404
httperrors.Serve404(w)
return
}
errortracking.Capture(err, errortracking.WithRequest(r), errortracking.WithStackTrace())
httperrors.Serve503(w)
return
}
request.ServeNotFoundHTTP(w, r)
}
// ServeNamespaceNotFound will try to find a parent namespace domain for a request
// that failed authentication so that we serve the custom namespace error page for
// public namespace domains
func (d *Domain) ServeNamespaceNotFound(w http.ResponseWriter, r *http.Request) {
// clone r and override the path and try to resolve the domain name
clonedReq := r.Clone(context.Background())
clonedReq.URL.Path = "/"
namespaceDomain, err := d.Resolver.Resolve(clonedReq)
if err != nil {
if errors.Is(err, ErrDomainDoesNotExist) {
// serve generic 404
httperrors.Serve404(w)
return
}
errortracking.Capture(err, errortracking.WithRequest(r), errortracking.WithStackTrace())
httperrors.Serve503(w)
return
}
// for namespace domains that have no access control enabled
if !namespaceDomain.LookupPath.HasAccessControl {
namespaceDomain.ServeNotFoundHTTP(w, r)
return
}
httperrors.Serve404(w)
}
// ServeNotFoundAuthFailed handler to be called when auth failed so the correct custom
// 404 page is served.
func (d *Domain) ServeNotFoundAuthFailed(w http.ResponseWriter, r *http.Request) {
lookupPath, err := d.GetLookupPath(r)
if err != nil {
httperrors.Serve404(w)
return
}
if d.IsNamespaceProject(r) && !lookupPath.HasAccessControl {
d.ServeNotFoundHTTP(w, r)
return
}
d.ServeNamespaceNotFound(w, r)
}
|