bbox/docker_socket_mapping.go at main · moolen/bbox · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
package bbox

import (
	"regexp"
	"strings"
)

var dockerAPIVersionPrefixRe = regexp.MustCompile(`^/v[0-9]+(?:\.[0-9]+)?(?:/|$)`)

type dockerRequestMeta struct {
	Method    string
	Path      string
	Operation DockerOperation
}

func normalizeDockerAPIPath(path string) string {
	normalized := strings.TrimSpace(path)
	if normalized == "" {
		return "/"
	}
	if idx := strings.Index(normalized, "?"); idx >= 0 {
		normalized = normalized[:idx]
	}
	if normalized == "" {
		return "/"
	}
	if !strings.HasPrefix(normalized, "/") {
		normalized = "/" + normalized
	}

	normalized = dockerAPIVersionPrefixRe.ReplaceAllString(normalized, "/")
	if normalized == "" {
		return "/"
	}
	if len(normalized) > 1 {
		normalized = strings.TrimRight(normalized, "/")
		if normalized == "" {
			return "/"
		}
	}
	return normalized
}

func mapDockerRequest(method, path string) dockerRequestMeta {
	normalizedMethod := strings.ToUpper(strings.TrimSpace(method))
	normalizedPath := normalizeDockerAPIPath(path)

	meta := dockerRequestMeta{
		Method:    normalizedMethod,
		Path:      normalizedPath,
		Operation: DockerOperation("unknown"),
	}

	switch {
	case normalizedMethod == "POST" && normalizedPath == "/images/create":
		meta.Operation = DockerOperation("image_pull")
	case normalizedMethod == "GET" &&
		strings.HasPrefix(normalizedPath, "/images/") &&
		strings.HasSuffix(normalizedPath, "/json") &&
		pathSegmentCount(normalizedPath) >= 3:
		meta.Operation = DockerOperation("image_inspect")
	case normalizedMethod == "POST" && normalizedPath == "/build":
		meta.Operation = DockerOperation("build")
	case normalizedMethod == "POST" && matchPathPattern(normalizedPath, "/containers/*/exec"):
		meta.Operation = DockerOperation("exec_create")
	case normalizedMethod == "POST" && matchPathPattern(normalizedPath, "/exec/*/start"):
		meta.Operation = DockerOperation("exec_start")
	case normalizedMethod == "GET" && matchPathPattern(normalizedPath, "/containers/*/archive"):
		meta.Operation = DockerOperation("archive_read")
	}

	return meta
}

func isPayloadAwareOperation(op DockerOperation) bool {
	switch normalizeDockerOperation(string(op)) {
	case DockerOperation("build"), DockerOperation("exec_create"), DockerOperation("exec_start"):
		return true
	default:
		return false
	}
}

func isStreamingDockerOperation(op DockerOperation) bool {
	switch normalizeDockerOperation(string(op)) {
	case DockerOperation("image_pull"), DockerOperation("build"), DockerOperation("exec_start"):
		return true
	default:
		return false
	}
}

func matchPathPattern(path, pattern string) bool {
	pathSegments := splitPathSegments(path)
	patternSegments := splitPathSegments(pattern)
	if len(pathSegments) != len(patternSegments) {
		return false
	}
	for idx := range pathSegments {
		if patternSegments[idx] == "*" {
			if pathSegments[idx] == "" {
				return false
			}
			continue
		}
		if pathSegments[idx] != patternSegments[idx] {
			return false
		}
	}
	return true
}

func pathSegmentCount(path string) int {
	return len(splitPathSegments(path))
}

func splitPathSegments(path string) []string {
	trimmed := strings.Trim(path, "/")
	if trimmed == "" {
		return nil
	}
	return strings.Split(trimmed, "/")
}