beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #45312 from rumpl/c8d-fix-http-fallback

Browse source 
c8d: Fix checking TLS handshake for insecure registries
This commit is contained in:
Sebastiaan van Stijn 2023-04-13 00:33:01 +02:00 committed by GitHub
commit 3d0bdfaa70
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
daemon/containerd/resolver.go
View file

@ -1,8 +1,9 @@
package containerd
import (
"crypto/tls"
"errors"
"net/http"
"strings"
"github.com/containerd/containerd/remotes"
"github.com/containerd/containerd/remotes/docker"
@ -72,12 +73,16 @@ type httpFallback struct {
func (f httpFallback) RoundTrip(r *http.Request) (*http.Response, error) {
resp, err := f.super.RoundTrip(r)
if err != nil {
if strings.Contains(err.Error(), "http: server gave HTTP response to HTTPS client") {
plain := r.Clone(r.Context())
plain.URL.Scheme = "http"
return http.DefaultTransport.RoundTrip(plain)
}
var tlsErr tls.RecordHeaderError
if errors.As(err, &tlsErr) && string(tlsErr.RecordHeader[:]) == "HTTP/" {
// server gave HTTP response to HTTPS client
plainHttpUrl := *r.URL
plainHttpUrl.Scheme = "http"
plainHttpRequest := *r
plainHttpRequest.URL = &plainHttpUrl
return http.DefaultTransport.RoundTrip(&plainHttpRequest)
}
return resp, err