o tf@szdZddlZddlZddlmZddlmZddlmZddlm Z m Z m Z ddl Z ddl mZmZddlmZmZdd lmZdd lmZmZmZdd lmZdd lmZmZmZmZm Z m!Z!m"Z"m#Z#dd l$m%Z%ddl&m'Z'ddl(m)Z)ddl*m+Z+m,Z,Gddde%Z-GdddeZ.Gddde+eZ/Gddde/Z0Gddde/Z1Gddde0Z2Gddde2Z3d d!Z4dS)"zw Authenticated HTTP proxy for Jupyter Notebooks Some original inspiration from https://github.com/senko/tornado-proxy N)Lockcopy)mkdtemp)quoteurlparse urlunparse)JupyterHandlerutcnow) ensure_async url_path_join)SupervisedProcess) httpclienthttputilweb)SimpleAsyncHTTPClient)BytesDictInstanceIntegerUnicodeUniondefaultobserve) HasTraits) UnixResolvercall_with_asked_args)WebSocketHandlerMixinpingable_ws_connectcseZdZdZeejdZee ee j dgdZ e ZeZeddZedddZed d d Zed d dZedddZed ddZfddZddZZS)RewritableResponsezJ A class to hold the response to be rewritten by rewrite_response )klass)Z trait_typesT) allow_noneheaderscCs t|jjSN)r orig_responser$selfr)f/var/www/html/software/conda/envs/catlas/lib/python3.10/site-packages/jupyter_server_proxy/handlers.py_default_headers+s z#RewritableResponse._default_headersbodycC|jjSr%)r&r,r'r)r)r* _default_body/z RewritableResponse._default_bodycodecCr-r%)r&r0r'r)r)r* _default_code3r/z RewritableResponse._default_codereasoncCr-r%)r&r2r'r)r)r*_default_reason7r/z"RewritableResponse._default_reasoncCs4|jtj|ddkrtj|dd|_dSdS)NoldUnknownnew)r2r responsesget)r(Zchanger)r)r* _observe_code;s z RewritableResponse._observe_codecstj|i||jdSr%)super__init__r0r(argskwargs __class__r)r*r;Hs zRewritableResponse.__init__cCst|}|||S)zI Apply a function to a copy of self, and return the copy r)r(funcr6r)r)r*_apply_to_copyNsz!RewritableResponse._apply_to_copy)__name__ __module__ __qualname____doc__rr HTTPResponser&rrr HTTPHeadersr$rr,rr0rr2rr+r.r1r3rr9r;rB __classcell__r)r)r?r*r!s&        r!c@seZdZdZejddZdS)AddSlashHandlerz*Add trailing slash to URLs that need them.cGs0t|jj}|j|jdd}|t|dS)N/)path)rrequesturi_replacerLredirectr)r(r=srcdestr)r)r*r8Zs zAddSlashHandler.getN)rCrDrErFr authenticatedr8r)r)r)r*rJWsrJcs eZdZdZdZfddZd:ddZddZfd d Zd;d d Z d;ddZ d;ddZ d;ddZ d;ddZ d;ddZd;ddZddZddZddZd d!Zd"d#Zd$d%Zd&d'Zd(d)Zd*d+Zd,d-Zd;d.d/Zd0d1Zd2d3Zd4d5Zd6d7Zd8d9ZZ S)< ProxyHandlera A tornado request handler that proxies HTTP and websockets from a given host/port combination. This class is not meant to be used directly as a means of overriding CORS. This presents significant security risks, and could allow arbitrary remote code access. Instead, it is meant to be subclassed and used for proxying URLs from trusted sources. Subclasses should implement open, http_get, post, put, delete, head, patch, and options. NcsRd|_|dd|_|dddg|_|dt|_d|_tj|i|dS)N absolute_urlFhost_allowlist localhostz 127.0.0.1rewrite_response) proxy_basepoprVrWtuplerY_requested_subprotocolsr:r;r<r?r)r*r;oszProxyHandler.__init__cCs t||Sr%)r check_origin)r(originr)r)r*r^} zProxyHandler.check_originc td)Nz0Subclasses of ProxyHandler should implement openNotImplementedErrorr(port proxied_pathr)r)r*openszProxyHandler.opencsttj|i|}|dur|IdH|jjdkr/|jjdddkr/|js-t ddSt dd|dS) z Enforce authentication on *all* requests. This method is called *before* any other method for all requests. See https://www.tornadoweb.org/en/stable/web.html#tornado.web.RequestHandler.prepare. NGETUpgraderU websocketcSsdSr%r))Zrequest_handlerr)r)r*z&ProxyHandler.prepare..) r:preparerMmethodr$r8lower current_userr HTTPErrorrS)r(r=r>Z _preparedr?r)r*rns   zProxyHandler.preparerUcra)zOur non-websocket GET.z4Subclasses of ProxyHandler should implement http_getrbr(hostre proxy_pathr)r)r*http_getszProxyHandler.http_getcCtd)Nz5Subclasses of ProxyHandler should implement this postrbrsr)r)r*postzProxyHandler.postcCrw)Nz4Subclasses of ProxyHandler should implement this putrb)r(rerur)r)r*putryzProxyHandler.putcCrw)Nz2Subclasses of ProxyHandler should implement deleterbrsr)r)r*deletezProxyHandler.deletecCrw)Nz0Subclasses of ProxyHandler should implement headrbrsr)r)r*headr|zProxyHandler.headcCrw)Nz1Subclasses of ProxyHandler should implement patchrbrsr)r)r*patchr|zProxyHandler.patchcCrw)Nz3Subclasses of ProxyHandler should implement optionsrbrsr)r)r*optionsr|zProxyHandler.optionscCs0|t|dr|jj|t|tddSdS)zh Called when we receive a message from our client. We proxy it to the backend. wsbinaryN)_record_activityhasattrr write_message isinstancebytes)r(messager)r)r* on_messages zProxyHandler.on_messagecCs:|jd||t|dr|jj|dSdS)zm Called when the client pings our websocket connection. We proxy it to the backend. zjupyter_server_proxy: on_ping: rN)logdebugrrrprotocolZ write_pingr(datar)r)r*on_pings  zProxyHandler.on_pingcCs|jd|dS)z5 Called when we receive a ping back. zjupyter_server_proxy: on_pong: N)rrrr)r)r*on_pongszProxyHandler.on_pongcCst|dr |jdSdS)z~ Called when the client closes our websocket connection. We close our connection to the backend too. rN)rrcloser'r)r)r*on_closes zProxyHandler.on_closecCst|jd<dS)zRecord proxied activity as API activity avoids proxied traffic being ignored by the notebook's internal idle-shutdown mechanism Zapi_last_activityN)r settingsr'r)r)r*rszProxyHandler._record_activitycCsX|dkrt|n|dt|}|jrt|j|jS|jr%t|jdd|St|jd|S)a5 Some applications need to know where they are being proxied from. This is either: - {base_url}/proxy/{port} - {base_url}/proxy/{host}:{port} - {base_url}/proxy/absolute/{port} - {base_url}/proxy/absolute/{host}:{port} - {base_url}/{proxy_base} rX:proxyabsolute)strrZr base_urlrV)r(rtreZ host_and_portr)r)r*_get_context_paths zProxyHandler._get_context_pathcCsn|jr|||}t||}n|}|dsd|}t|dd}dj||||d}|jjr5|d|jj7}|S)NrKz:/?#[]@!$&'()*+,;=-._~)safez {protocol}://{host}:{port}{path})rrtrerL?)rVrr startswithrformatrMquery)r(rrtrerf context_pathZ client_path client_urir)r)r*get_client_uris     zProxyHandler.get_client_uric Csj|}|d|||}|js!|||}||d<||d<||d<tj|f|jj|d|d|}|S)NhttpzX-Forwarded-ContextzX-ProxyContextPathzX-Forwarded-PrefixF)ror,Zdecompress_responser$) proxy_request_headersrrVrr HTTPRequestrMroproxy_request_options) r(rtrerfr,r$rrreqr)r)r*_build_proxy_request s$ z!ProxyHandler._build_proxy_requestcCs t|jr |||S||jvSr%)callablerW)r(rtr)r)r*_check_host_allowlist7s   z"ProxyHandler._check_host_allowlistc s\||stdd|dgd}|D] }||jjvr#|jj|=q||jjdddkr?|j d| d |jj }|sP|jj d vrNd }nd }|j d uro|jd |j |dkseJdtdt|j d}nt}|||||}|jd|jz |j|ddId H} Wntjy} z| jdkr|tdt| d } ~ ww|| jrt| jtjurtd t| jt| d} |j} t| ttfr| } n| g} |j| |||d| }| D]dtffdd }||}q| |j|j t!"|_#|j$D]\}}|dvr|%||q|j r,|&|j d Sd S)z This serverextension handles: {base_url}/proxy/{port([0-9]+)}/{proxied_path} {base_url}/proxy/absolute/{port([0-9]+)}/{proxied_path} {base_url}/{proxy_base}/{proxied_path} rkzHost 'zp' is not allowed. See https://jupyter-server-proxy.readthedocs.io/en/latest/arbitrary-ports-hosts.html for info.) zProxy-Connectionz Keep-AliveTransfer-EncodingZTE ConnectionZTrailerrizProxy-AuthorizationzProxy-AuthenticaterirUrjz=we wanna websocket, but we don't define WebSocketProxyHandler>PUTPOSTNz Making client for Unix socket %rrX'Unix sockets only possible on localhostT)Zforce_instanceresolverzProxying request to F)Z raise_erroriW)r&)rMr&rtrerLrewritable_responsecstd|iS)Nresponser)rZ!optional_args_to_rewrite_functionZrewriter)r* rewrite_pesz&ProxyHandler.proxy..rewrite_pe)zContent-Lengthrr)'rrrrrMr$rr8rprinfo set_statusr,ro unix_socketrrrrZAsyncHTTPClientrurlfetchr0rerrortyper!rYrlistr\rBr2rrH_headersget_all add_headerwrite)r(rtrerfZhop_by_hop_headersZheader_to_remover,clientrrerroriginal_responserYZrewrite_responsesZrewritten_responserheadervr)rr*r=s                 zProxyHandler.proxycs|sdjdj|ddS|ds$d|}jdur>|dks1Jdjd|t jnd d ||| fd d fd d fdd}|IdHdS)z Called when a client opens a websocket connection. We establish a websocket connection to the proxied backend & set up a callback to relay messages through. rkz|Host '{host}' is not allowed. See https://jupyter-server-proxy.readthedocs.io/en/latest/arbitrary-ports-hosts.html for info.)rtNrKrXrz#Opening websocket on Unix socket %rrcs4|durdSj|t|tddS)zz Callback when the backend sends messages to us We just pass it back to the frontend Nr)rrrrr)rr'r)r* message_cbs z+ProxyHandler.proxy_open..message_cbcs|dS)zy Callback when the backend sends pings to us. We just pass it back to the frontend. N)rZping)rr'r)r*ping_cbsz(ProxyHandler.proxy_open..ping_cbc sjdtjd}t|jdIdH_jdjjjkrMj djjdjdjddSdS) Nz,Trying to establish websocket connection to )rr$)rMZon_message_callbackZon_ping_callback subprotocolsrz$Websocket connection established to z,Websocket subprotocol between proxy/server (z*) became different than for client/proxy (zd) due to https://github.com/jupyterhub/jupyter-server-proxy/issues/459. Requested subprotocols were .) rrrrrr r]rZselected_subprotocolwarn)rMrr$rrrr(r)r*start_websocket_connections, z;ProxyHandler.proxy_open..start_websocket_connection) rrrrrrrrrrrr)r(rtrerfrr)rr* proxy_opens0        zProxyHandler.proxy_opencCs|jj}|||S)z}A dictionary of headers to be used when constructing a tornado.httpclient.HTTPRequest instance for the proxy request.)rMr$rupdateget_request_headers_override)r(r$r)r)r*rs z"ProxyHandler.proxy_request_headerscCiS)zCAdd additional request headers. Typically overridden in subclasses.r)r'r)r)r*r$sz)ProxyHandler.get_request_headers_overridecCstddddS)z}A dictionary of options to be used when constructing a tornado.httpclient.HTTPRequest instance for the proxy request.Fg@o@gr@)Zfollow_redirectsconnect_timeoutrequest_timeout)dictr'r)r)r*r(sz"ProxyHandler.proxy_request_optionscCdS)zi http://www.tornadoweb.org/en/stable/guide/security.html Defer to proxied apps. Nr)r'r)r)r*check_xsrf_cookie/rmzProxyHandler.check_xsrf_cookiecCs2|r|nd|_|r|jd|d|dSdS)a Select a single Sec-WebSocket-Protocol during handshake. Overrides `tornado.websocket.WebSocketHandler.select_subprotocol` that includes an informative docstring: https://github.com/tornadoweb/tornado/blob/v6.4.0/tornado/websocket.py#L337-L360. NzClient sent subprotocols: z, selecting the firstr)r]rr)r(rr)r)r*select_subprotocol6s   zProxyHandler.select_subprotocolr%)rU)!rCrDrErFrr;r^rgrnrvrxrzr{r}r~rrrrrrrrrrrrrrrrrrIr)r)r?r*rTas>    !          QrTc`eZdZdZddZddZddZdd Zd d Zd d Z ddZ ddZ fddZ Z S)LocalProxyHandleraN A tornado request handler that proxies HTTP and websockets from a port on the local system. Same as the above ProxyHandler, but specific to 'localhost'. The arguments "port" and "proxied_path" in each method are extracted from the URL as capture groups in the regex specified in the add_handlers method. cs|||IdHSr%rrdr)r)r*rv^szLocalProxyHandler.http_getcs|d||IdHSNrXrrdr)r)r*rgazLocalProxyHandler.opencC |||Sr%rrdr)r)r*rxdr`zLocalProxyHandler.postcCrr%rrdr)r)r*rzgr`zLocalProxyHandler.putcCrr%rrdr)r)r*r{jr`zLocalProxyHandler.deletecCrr%rrdr)r)r*r}mr`zLocalProxyHandler.headcCrr%rrdr)r)r*r~pr`zLocalProxyHandler.patchcCrr%rrdr)r)r*rsr`zLocalProxyHandler.optionscstd||Srr:rrdr?r)r*rvzLocalProxyHandler.proxy)rCrDrErFrvrgrxrzr{r}r~rrrIr)r)r?r*rSs rcr)RemoteProxyHandlera A tornado request handler that proxies HTTP and websockets from a port on a specified remote system. The arguments "host", "port" and "proxied_path" in each method are extracted from the URL as capture groups in the regex specified in the add_handlers method. c||||IdHSr%rr(rtrerfr)r)r*rvrzRemoteProxyHandler.http_getcC||||Sr%rrr)r)r*rxzRemoteProxyHandler.postcCrr%rrr)r)r*rzrzRemoteProxyHandler.putcCrr%rrr)r)r*r{rzRemoteProxyHandler.deletecCrr%rrr)r)r*r}rzRemoteProxyHandler.headcCrr%rrr)r)r*r~rzRemoteProxyHandler.patchcCrr%rrr)r)r*rrzRemoteProxyHandler.optionscrr%rrr)r)r*rgrzRemoteProxyHandler.opencst|||Sr%rrr?r)r*rrzRemoteProxyHandler.proxy)rCrDrErFrvrxrzr{r}r~rrgrrIr)r)r?r*rzs rcseZdZdZdZiZeddZddZddZ fd d Z d d Z fd dZ ddZ ddZddZddZddZddZZS)NamedLocalProxyHandlera^ A tornado request handler that proxies HTTP and websockets from a port on the local system. The port is specified in config, and associated with a name which forms part of the URL. Config will create a subclass of this for each named proxy. A further subclass below is used for named proxies where we also start the server. rcCs|j|jpd|jdS)NrUrerrrr'r)r)r* process_argssz#NamedLocalProxyHandler.process_argscstj}t|tur|jdi|St|tur fdd|DSt|tur1fdd|DStdt|)Ncsg|]}|qSr)_render_template).0rr'r)r* sz;NamedLocalProxyHandler._render_template..cs"i|] \}}||qSr)r)rkrr'r)r* sz;NamedLocalProxyHandler._render_template..zValue of unrecognized type r))rrrrrritems ValueError)r(valuer=r)r'r*rs    z'NamedLocalProxyHandler._render_templatecCst|r t||j}||S)z5Call any callables, then render any templated values.)rrrr)r( attributer)r)r*_realize_rendered_templates  z1NamedLocalProxyHandler._realize_rendered_templatecs\|ds d|}|jr"t|jrt|jd|i}n|j||}tt||IdHS)NrKrL)rmappathrrr8r r:rr(rerLr?r)r*rs  zNamedLocalProxyHandler.proxycst||j|IdHSr%)r rrer(rLr)r)r*rvszNamedLocalProxyHandler.http_getcst|j|IdHSr%)r:rgrerr?r)r*rgszNamedLocalProxyHandler.opencC||j|Sr%rrerr)r)r*rxrzNamedLocalProxyHandler.postcCrr%rrr)r)r*rzrzNamedLocalProxyHandler.putcCrr%rrr)r)r*r{rzNamedLocalProxyHandler.deletecCrr%rrr)r)r*r}rzNamedLocalProxyHandler.headcCrr%rrr)r)r*r~rzNamedLocalProxyHandler.patchcCrr%rrr)r)r*rrzNamedLocalProxyHandler.options)rCrDrErFrerpropertyrrrrrvrgrxrzr{r}r~rrIr)r)r?r*rs"    rcseZdZdZfddZddZdZeddZed d Z d d Z d dZ ddZ ddZ ddZddZfddZfddZZS)SuperviseAndProxyHandlera A tornado request handler that proxies HTTP and websockets from a local process which is launched on demand to handle requests. The command and other process options are specified in config. A subclass of this will be made for each configured server process. cs0d|_d|_i|_t|_tj|i|dS)NrF)requested_portrequested_unix_socketrrcommandr:r;r<r?r)r*r;s z!SuperviseAndProxyHandler.__init__cCs ||_d|vrt|d<dSdS)N proc_lock)stater)r(rr)r)r* initializesz#SuperviseAndProxyHandler.initializeprocesscCsd|jrdSd|jvr-|jr|j|jd<nt}|d|jf|d|jd<||jdS)zj Allocate either the requested port or a random empty port for use by application rrerUr)rrrsocketbind getsocknamer)r(sockr)r)r*res  zSuperviseAndProxyHandler.portcCsTd|jvr%|jdurtdd}tj|d}n |jr|j}nd}||jd<|jdS)NrTzjupyter-server-proxy-)prefixr)rrrosrLjoin)r(Zsock_dirZ sock_pathr)r)r*rs     z$SuperviseAndProxyHandler.unix_socketcCs ||jSr%)rrr'r)r)r*get_cmd&r`z SuperviseAndProxyHandler.get_cmdcCstS)zGet the current working directory for our process Override in subclass to launch the process in a directory other than the current. )rgetcwdr'r)r)r*get_cwd)sz SuperviseAndProxyHandler.get_cwdcCr)z[Set up extra environment variables for process. Typically overridden in subclasses.r)r'r)r)r*get_env1sz SuperviseAndProxyHandler.get_envcCr)zU Return timeout (in s) to wait before giving up on process readiness r)r'r)r)r* get_timeout6sz$SuperviseAndProxyHandler.get_timeoutc s*|jdurd}t|j}nd|j}d}tj|d4IdHg}z<|j|dd4IdH$}|jd|jd| WdIdHWWdIdHdS1IdHsXwYWntj y||jd |d YWdIdHdSwWdIdHdS1IdHswYdS) Nzhttp://localhostzhttp://localhost:) connectorF)allow_redirectsz Got code z back from TzConnection to z refused) raiohttpZ UnixConnectorreZ ClientSessionr8rrstatusZClientConnectionError)r(prrsessionrespr)r)r*_http_ready_func<s*  .z)SuperviseAndProxyHandler._http_ready_funcc s:|jd4IdHd|jvrz|}|s'd|jd< WdIdHdStj}|||}t|j g|R||j ||j d}||jd<z$| IdH| IdH}|sp|IdHtdd|j dWn|jd=WdIdHdSWdIdHdS1IdHswYdS) z# Start the process rNprocz+process not managed by jupyter-server-proxy)envZ ready_funcZ ready_timeoutrrzcould not start z in time)rr renvironrrr rr namerrstartreadykillrrr)r(cmdZ server_envtimeoutrZis_readyr)r)r*ensure_processNsH    ".z'SuperviseAndProxyHandler.ensure_processcs(|IdHtt||IdHSr%)r r r:rrr?r)r*rszSuperviseAndProxyHandler.proxycs"|IdHt|IdHSr%)r r:rgrr?r)r*rgszSuperviseAndProxyHandler.open)rCrDrErFr;rrrrerr r r rrr rrgrIr)r)r?r*rs"     2rc Cs|j}|j}|dt|jddtd||dft|jddtd||dft|jddtd|d ft|jdd td|d fgdS) Nz.*rz/proxy/([^/:@]+):(\d+)(/.*|)F)rVrWrYz%/proxy/absolute/([^/:@]+):(\d+)(/.*|)Tz/proxy/(\d+)(/.*|))rVrYz/proxy/absolute/(\d+)(/.*|))rWZnon_service_rewrite_response add_handlersr rrr)Zweb_appZserverproxy_configrWrYr)r)r*setup_handlerssX   r")5rFrrasynciorrtempfiler urllib.parserrrrZjupyter_server.base.handlersr r Zjupyter_server.utilsr r Z simpervisorr tornadorrrZtornado.simple_httpclientrZ traitletsrrrrrrrrZtraitlets.traitletsrZunixsockrutilsrrjrr r!rJrTrrrrr"r)r)r)r*s<     (   ; u'&N