Merge pull request #5632 from hashicorp/f-nomad-exec-parts-01-base

nomad exec part 1: plumbing and docker driver

acl/policy.go

@@ -28,6 +28,8 @@ const (
 	NamespaceCapabilityDispatchJob      = "dispatch-job"
 	NamespaceCapabilityReadLogs         = "read-logs"
 	NamespaceCapabilityReadFS           = "read-fs"
+	NamespaceCapabilityAllocExec        = "alloc-exec"
+	NamespaceCapabilityAllocNodeExec    = "alloc-node-exec"
 	NamespaceCapabilityAllocLifecycle   = "alloc-lifecycle"
 	NamespaceCapabilitySentinelOverride = "sentinel-override"
 )
@@ -94,7 +96,8 @@ func isNamespaceCapabilityValid(cap string) bool {
 	switch cap {
 	case NamespaceCapabilityDeny, NamespaceCapabilityListJobs, NamespaceCapabilityReadJob,
 		NamespaceCapabilitySubmitJob, NamespaceCapabilityDispatchJob, NamespaceCapabilityReadLogs,
-		NamespaceCapabilityReadFS, NamespaceCapabilityAllocLifecycle:
+		NamespaceCapabilityReadFS, NamespaceCapabilityAllocLifecycle,
+		NamespaceCapabilityAllocExec, NamespaceCapabilityAllocNodeExec:
 		return true
 	// Separate the enterprise-only capabilities
 	case NamespaceCapabilitySentinelOverride:
@@ -123,6 +126,7 @@ func expandNamespacePolicy(policy string) []string {
 			NamespaceCapabilityDispatchJob,
 			NamespaceCapabilityReadLogs,
 			NamespaceCapabilityReadFS,
+			NamespaceCapabilityAllocExec,
 			NamespaceCapabilityAllocLifecycle,
 		}
 	default:

acl/policy_test.go

@@ -80,6 +80,7 @@ func TestParse(t *testing.T) {
 							NamespaceCapabilityDispatchJob,
 							NamespaceCapabilityReadLogs,
 							NamespaceCapabilityReadFS,
+							NamespaceCapabilityAllocExec,
 							NamespaceCapabilityAllocLifecycle,
 						},
 					},

api/allocations.go

@@ -1,9 +1,18 @@
 package api
 
 import (
+	"context"
+	"encoding/json"
+	"errors"
 	"fmt"
+	"io"
+	"net"
 	"sort"
+	"strconv"
+	"sync"
 	"time"
+
+	"github.com/gorilla/websocket"
 )
 
 var (
@@ -61,6 +70,222 @@ func (a *Allocations) Info(allocID string, q *QueryOptions) (*Allocation, *Query
 	return &resp, qm, nil
 }
 
+// Exec is used to execute a command inside a running task.  The command is to run inside
+// the task environment.
+//
+// The parameters are:
+// * ctx: context to set deadlines or timeout
+// * allocation: the allocation to execute command inside
+// * task: the task's name to execute command in
+// * tty: indicates whether to start a pseudo-tty for the command
+// * stdin, stdout, stderr: the std io to pass to command.
+//      If tty is true, then streams need to point to a tty that's alive for the whole process
+// * terminalSizeCh: A channel to send new tty terminal sizes
+//
+// The call blocks until command terminates (or an error occurs), and returns the exit code.
+func (a *Allocations) Exec(ctx context.Context,
+	alloc *Allocation, task string, tty bool, command []string,
+	stdin io.Reader, stdout, stderr io.Writer,
+	terminalSizeCh <-chan TerminalSize, q *QueryOptions) (exitCode int, err error) {
+
+	ctx, cancelFn := context.WithCancel(ctx)
+	defer cancelFn()
+
+	errCh := make(chan error, 4)
+
+	sender, output := a.execFrames(ctx, alloc, task, tty, command, errCh, q)
+
+	select {
+	case err := <-errCh:
+		return -2, err
+	default:
+	}
+
+	// Errors resulting from sending input (in goroutines) are silently dropped.
+	// To mitigate this, extra care is needed to distinguish between actual send errors
+	// and from send errors due to command terminating and our race to detect failures.
+	// If we have an actual network failure or send a bad input, we'd get an
+	// error in the reading side of websocket.
+
+	go func() {
+
+		bytes := make([]byte, 2048)
+		for {
+			if ctx.Err() != nil {
+				return
+			}
+
+			input := ExecStreamingInput{Stdin: &ExecStreamingIOOperation{}}
+
+			n, err := stdin.Read(bytes)
+
+			// always send data if we read some
+			if n != 0 {
+				input.Stdin.Data = bytes[:n]
+				sender(&input)
+			}
+
+			// then handle error
+			if err == io.EOF {
+				// if n != 0, send data and we'll get n = 0 on next read
+				if n == 0 {
+					input.Stdin.Close = true
+					sender(&input)
+					return
+				}
+			} else if err != nil {
+				errCh <- err
+				return
+			}
+		}
+	}()
+
+	// forwarding terminal size
+	go func() {
+		for {
+			resizeInput := ExecStreamingInput{}
+
+			select {
+			case <-ctx.Done():
+				return
+			case size, ok := <-terminalSizeCh:
+				if !ok {
+					return
+				}
+				resizeInput.TTYSize = &size
+				sender(&resizeInput)
+			}
+
+		}
+	}()
+
+	// send a heartbeat every 10 seconds
+	go func() {
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			// heartbeat message
+			case <-time.After(10 * time.Second):
+				sender(&execStreamingInputHeartbeat)
+			}
+
+		}
+	}()
+
+	for {
+		select {
+		case err := <-errCh:
+			// drop websocket code, not relevant to user
+			if wsErr, ok := err.(*websocket.CloseError); ok && wsErr.Text != "" {
+				return -2, errors.New(wsErr.Text)
+			}
+			return -2, err
+		case <-ctx.Done():
+			return -2, ctx.Err()
+		case frame, ok := <-output:
+			if !ok {
+				return -2, errors.New("disconnected without receiving the exit code")
+			}
+
+			switch {
+			case frame.Stdout != nil:
+				if len(frame.Stdout.Data) != 0 {
+					stdout.Write(frame.Stdout.Data)
+				}
+				// don't really do anything if stdout is closing
+			case frame.Stderr != nil:
+				if len(frame.Stderr.Data) != 0 {
+					stderr.Write(frame.Stderr.Data)
+				}
+				// don't really do anything if stderr is closing
+			case frame.Exited && frame.Result != nil:
+				return frame.Result.ExitCode, nil
+			default:
+				// noop - heartbeat
+			}
+		}
+	}
+}
+
+func (a *Allocations) execFrames(ctx context.Context, alloc *Allocation, task string, tty bool, command []string,
+	errCh chan<- error, q *QueryOptions) (sendFn func(*ExecStreamingInput) error, output <-chan *ExecStreamingOutput) {
+
+	nodeClient, err := a.client.GetNodeClientWithTimeout(alloc.NodeID, ClientConnTimeout, q)
+	if err != nil {
+		errCh <- err
+		return nil, nil
+	}
+
+	if q == nil {
+		q = &QueryOptions{}
+	}
+	if q.Params == nil {
+		q.Params = make(map[string]string)
+	}
+
+	commandBytes, err := json.Marshal(command)
+	if err != nil {
+		errCh <- fmt.Errorf("failed to marshal command: %s", err)
+		return nil, nil
+	}
+
+	q.Params["tty"] = strconv.FormatBool(tty)
+	q.Params["task"] = task
+	q.Params["command"] = string(commandBytes)
+
+	reqPath := fmt.Sprintf("/v1/client/allocation/%s/exec", alloc.ID)
+
+	conn, _, err := nodeClient.websocket(reqPath, q)
+	if err != nil {
+		// There was an error talking directly to the client. Non-network
+		// errors are fatal, but network errors can attempt to route via RPC.
+		if _, ok := err.(net.Error); !ok {
+			errCh <- err
+			return nil, nil
+		}
+
+		conn, _, err = a.client.websocket(reqPath, q)
+		if err != nil {
+			errCh <- err
+			return nil, nil
+		}
+	}
+
+	// Create the output channel
+	frames := make(chan *ExecStreamingOutput, 10)
+
+	go func() {
+		defer conn.Close()
+		for ctx.Err() == nil {
+
+			// Decode the next frame
+			var frame ExecStreamingOutput
+			err := conn.ReadJSON(&frame)
+			if websocket.IsCloseError(err, websocket.CloseNormalClosure) {
+				close(frames)
+				return
+			} else if err != nil {
+				errCh <- err
+				return
+			}
+
+			frames <- &frame
+		}
+	}()
+
+	var sendLock sync.Mutex
+	send := func(v *ExecStreamingInput) error {
+		sendLock.Lock()
+		defer sendLock.Unlock()
+
+		return conn.WriteJSON(v)
+	}
+
+	return send, frames
+
+}
+
 func (a *Allocations) Stats(alloc *Allocation, q *QueryOptions) (*AllocResourceUsage, error) {
 	var resp AllocResourceUsage
 	path := fmt.Sprintf("/v1/client/allocation/%s/stats", alloc.ID)
@@ -339,3 +564,42 @@ type DesiredTransition struct {
 func (d DesiredTransition) ShouldMigrate() bool {
 	return d.Migrate != nil && *d.Migrate
 }
+
+// ExecStreamingIOOperation represents a stream write operation: either appending data or close (exclusively)
+type ExecStreamingIOOperation struct {
+	Data  []byte `json:"data,omitempty"`
+	Close bool   `json:"close,omitempty"`
+}
+
+// TerminalSize represents the size of the terminal
+type TerminalSize struct {
+	Height int `json:"height,omitempty"`
+	Width  int `json:"width,omitempty"`
+}
+
+var execStreamingInputHeartbeat = ExecStreamingInput{}
+
+// ExecStreamingInput represents user input to be sent to nomad exec handler.
+//
+// At most one field should be set.
+type ExecStreamingInput struct {
+	Stdin   *ExecStreamingIOOperation `json:"stdin,omitempty"`
+	TTYSize *TerminalSize             `json:"tty_size,omitempty"`
+}
+
+// ExecStreamingExitResults captures the exit code of just completed nomad exec command
+type ExecStreamingExitResult struct {
+	ExitCode int `json:"exit_code"`
+}
+
+// ExecStreamingInput represents an output streaming entity, e.g. stdout/stderr update or termination
+//
+// At most one of these fields should be set: `Stdout`, `Stderr`, or `Result`.
+// If `Exited` is true, then `Result` is non-nil, and other fields are nil.
+type ExecStreamingOutput struct {
+	Stdout *ExecStreamingIOOperation `json:"stdout,omitempty"`
+	Stderr *ExecStreamingIOOperation `json:"stderr,omitempty"`
+
+	Exited bool                     `json:"exited,omitempty"`
+	Result *ExecStreamingExitResult `json:"result,omitempty"`
+}

api/api.go

@@ -15,6 +15,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/gorilla/websocket"
 	cleanhttp "github.com/hashicorp/go-cleanhttp"
 	rootcerts "github.com/hashicorp/go-rootcerts"
 )
@@ -655,6 +656,63 @@ func (c *Client) rawQuery(endpoint string, q *QueryOptions) (io.ReadCloser, erro
 	return resp.Body, nil
 }
 
+// websocket makes a websocket request to the specific endpoint
+func (c *Client) websocket(endpoint string, q *QueryOptions) (*websocket.Conn, *http.Response, error) {
+
+	transport, ok := c.config.httpClient.Transport.(*http.Transport)
+	if !ok {
+		return nil, nil, fmt.Errorf("unsupported transport")
+	}
+	dialer := websocket.Dialer{
+		ReadBufferSize:   4096,
+		WriteBufferSize:  4096,
+		HandshakeTimeout: c.config.httpClient.Timeout,
+
+		// values to inherit from http client configuration
+		NetDial:         transport.Dial,
+		NetDialContext:  transport.DialContext,
+		Proxy:           transport.Proxy,
+		TLSClientConfig: transport.TLSClientConfig,
+	}
+
+	// build request object for header and parameters
+	r, err := c.newRequest("GET", endpoint)
+	if err != nil {
+		return nil, nil, err
+	}
+	r.setQueryOptions(q)
+
+	rhttp, err := r.toHTTP()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// convert scheme
+	wsScheme := ""
+	switch rhttp.URL.Scheme {
+	case "http":
+		wsScheme = "ws"
+	case "https":
+		wsScheme = "wss"
+	default:
+		return nil, nil, fmt.Errorf("unsupported scheme: %v", rhttp.URL.Scheme)
+	}
+	rhttp.URL.Scheme = wsScheme
+
+	conn, resp, err := dialer.Dial(rhttp.URL.String(), rhttp.Header)
+
+	// check resp status code, as it's more informative than handshake error we get from ws library
+	if resp != nil && resp.StatusCode != 101 {
+		var buf bytes.Buffer
+		io.Copy(&buf, resp.Body)
+		resp.Body.Close()
+
+		return nil, nil, fmt.Errorf("Unexpected response code: %d (%s)", resp.StatusCode, buf.Bytes())
+	}
+
+	return conn, resp, err
+}
+
 // query is used to do a GET request against an endpoint
 // and deserialize the response into an interface using
 // standard Nomad conventions.

client/acl.go

@@ -70,38 +70,43 @@ func (c *cachedACLValue) Age() time.Duration {
 // ResolveToken is used to translate an ACL Token Secret ID into
 // an ACL object, nil if ACLs are disabled, or an error.
 func (c *Client) ResolveToken(secretID string) (*acl.ACL, error) {
+	a, _, err := c.resolveTokenAndACL(secretID)
+	return a, err
+}
+
+func (c *Client) resolveTokenAndACL(secretID string) (*acl.ACL, *structs.ACLToken, error) {
 	// Fast-path if ACLs are disabled
 	if !c.config.ACLEnabled {
-		return nil, nil
+		return nil, nil, nil
 	}
 	defer metrics.MeasureSince([]string{"client", "acl", "resolve_token"}, time.Now())
 
 	// Resolve the token value
 	token, err := c.resolveTokenValue(secretID)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 	if token == nil {
-		return nil, structs.ErrTokenNotFound
+		return nil, nil, structs.ErrTokenNotFound
 	}
 
 	// Check if this is a management token
 	if token.Type == structs.ACLManagementToken {
-		return acl.ManagementACL, nil
+		return acl.ManagementACL, token, nil
 	}
 
 	// Resolve the policies
 	policies, err := c.resolvePolicies(token.SecretID, token.Policies)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 
 	// Resolve the ACL object
 	aclObj, err := structs.CompileACLObject(c.aclCache, policies)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
-	return aclObj, nil
+	return aclObj, token, nil
 }
 
 // resolveTokenValue is used to translate a secret ID into an ACL token with caching

client/alloc_endpoint.go

@@ -1,12 +1,22 @@
 package client
 
 import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
 	"time"
 
 	metrics "github.com/armon/go-metrics"
 	"github.com/hashicorp/nomad/acl"
 	cstructs "github.com/hashicorp/nomad/client/structs"
+	"github.com/hashicorp/nomad/helper"
+	"github.com/hashicorp/nomad/helper/uuid"
+	"github.com/hashicorp/nomad/nomad/structs"
 	nstructs "github.com/hashicorp/nomad/nomad/structs"
+	"github.com/hashicorp/nomad/plugins/drivers"
+	"github.com/ugorji/go/codec"
 )
 
 // Allocations endpoint is used for interacting with client allocations
@@ -14,6 +24,12 @@ type Allocations struct {
 	c *Client
 }
 
+func NewAllocationsEndpoint(c *Client) *Allocations {
+	a := &Allocations{c: c}
+	a.c.streamingRpcs.Register("Allocations.Exec", a.exec)
+	return a
+}
+
 // GarbageCollectAll is used to garbage collect all allocations on a client.
 func (a *Allocations) GarbageCollectAll(args *nstructs.NodeSpecificRequest, reply *nstructs.GenericResponse) error {
 	defer metrics.MeasureSince([]string{"client", "allocations", "garbage_collect_all"}, time.Now())
@@ -100,3 +116,178 @@ func (a *Allocations) Stats(args *cstructs.AllocStatsRequest, reply *cstructs.Al
 	reply.Stats = stats
 	return nil
 }
+
+// exec is used to execute command in a running task
+func (a *Allocations) exec(conn io.ReadWriteCloser) {
+	defer metrics.MeasureSince([]string{"client", "allocations", "exec"}, time.Now())
+	defer conn.Close()
+
+	execID := uuid.Generate()
+	decoder := codec.NewDecoder(conn, structs.MsgpackHandle)
+	encoder := codec.NewEncoder(conn, structs.MsgpackHandle)
+
+	code, err := a.execImpl(encoder, decoder, execID)
+	if err != nil {
+		a.c.logger.Info("task exec session ended with an error", "error", err, "code", code)
+		handleStreamResultError(err, code, encoder)
+		return
+	}
+
+	a.c.logger.Info("task exec session ended", "exec_id", execID)
+}
+
+func (a *Allocations) execImpl(encoder *codec.Encoder, decoder *codec.Decoder, execID string) (code *int64, err error) {
+
+	// Decode the arguments
+	var req cstructs.AllocExecRequest
+	if err := decoder.Decode(&req); err != nil {
+		return helper.Int64ToPtr(500), err
+	}
+
+	aclObj, token, err := a.c.resolveTokenAndACL(req.QueryOptions.AuthToken)
+	{
+		// log access
+		tokenName, tokenID := "", ""
+		if token != nil {
+			tokenName, tokenID = token.Name, token.AccessorID
+		}
+
+		a.c.logger.Info("task exec session starting",
+			"exec_id", execID,
+			"alloc_id", req.AllocID,
+			"task", req.Task,
+			"command", req.Cmd,
+			"tty", req.Tty,
+			"access_token_name", tokenName,
+			"access_token_id", tokenID,
+		)
+	}
+
+	// Check read permissions
+	if err != nil {
+		return nil, err
+	} else if aclObj != nil {
+		exec := aclObj.AllowNsOp(req.QueryOptions.Namespace, acl.NamespaceCapabilityAllocExec)
+		if !exec {
+			return nil, structs.ErrPermissionDenied
+		}
+	}
+
+	// Validate the arguments
+	if req.AllocID == "" {
+		return helper.Int64ToPtr(400), allocIDNotPresentErr
+	}
+	if req.Task == "" {
+		return helper.Int64ToPtr(400), taskNotPresentErr
+	}
+	if len(req.Cmd) == 0 {
+		return helper.Int64ToPtr(400), errors.New("command is not present")
+	}
+
+	ar, err := a.c.getAllocRunner(req.AllocID)
+	if err != nil {
+		code := helper.Int64ToPtr(500)
+		if structs.IsErrUnknownAllocation(err) {
+			code = helper.Int64ToPtr(404)
+		}
+
+		return code, err
+	}
+
+	capabilities, err := ar.GetTaskDriverCapabilities(req.Task)
+	if err != nil {
+		code := helper.Int64ToPtr(500)
+		if structs.IsErrUnknownAllocation(err) {
+			code = helper.Int64ToPtr(404)
+		}
+
+		return code, err
+	}
+
+	// check node access
+	if aclObj != nil && capabilities.FSIsolation == drivers.FSIsolationNone {
+		exec := aclObj.AllowNsOp(req.QueryOptions.Namespace, acl.NamespaceCapabilityAllocNodeExec)
+		if !exec {
+			return nil, structs.ErrPermissionDenied
+		}
+	}
+
+	allocState, err := a.c.GetAllocState(req.AllocID)
+	if err != nil {
+		code := helper.Int64ToPtr(500)
+		if structs.IsErrUnknownAllocation(err) {
+			code = helper.Int64ToPtr(404)
+		}
+
+		return code, err
+	}
+
+	// Check that the task is there
+	taskState := allocState.TaskStates[req.Task]
+	if taskState == nil {
+		return helper.Int64ToPtr(400), fmt.Errorf("unknown task name %q", req.Task)
+	}
+
+	if taskState.StartedAt.IsZero() {
+		return helper.Int64ToPtr(404), fmt.Errorf("task %q not started yet.", req.Task)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	h := ar.GetTaskExecHandler(req.Task)
+	if h == nil {
+		return helper.Int64ToPtr(404), fmt.Errorf("task %q is not running.", req.Task)
+	}
+
+	err = h(ctx, req.Cmd, req.Tty, newExecStream(cancel, decoder, encoder))
+	if err != nil {
+		code := helper.Int64ToPtr(500)
+		return code, err
+	}
+
+	return nil, nil
+}
+
+// newExecStream returns a new exec stream as expected by drivers that interpolate with RPC streaming format
+func newExecStream(cancelFn func(), decoder *codec.Decoder, encoder *codec.Encoder) drivers.ExecTaskStream {
+	buf := new(bytes.Buffer)
+	return &execStream{
+		cancelFn: cancelFn,
+		decoder:  decoder,
+
+		buf:        buf,
+		encoder:    encoder,
+		frameCodec: codec.NewEncoder(buf, structs.JsonHandle),
+	}
+}
+
+type execStream struct {
+	cancelFn func()
+	decoder  *codec.Decoder
+
+	encoder    *codec.Encoder
+	buf        *bytes.Buffer
+	frameCodec *codec.Encoder
+}
+
+// Send sends driver output response across RPC mechanism using cstructs.StreamErrWrapper
+func (s *execStream) Send(m *drivers.ExecTaskStreamingResponseMsg) error {
+	s.buf.Reset()
+	s.frameCodec.Reset(s.buf)
+
+	s.frameCodec.MustEncode(m)
+	return s.encoder.Encode(cstructs.StreamErrWrapper{
+		Payload: s.buf.Bytes(),
+	})
+}
+
+// Recv returns next exec user input from the RPC to be passed to driver exec handler
+func (s *execStream) Recv() (*drivers.ExecTaskStreamingRequestMsg, error) {
+	req := drivers.ExecTaskStreamingRequestMsg{}
+	err := s.decoder.Decode(&req)
+	if err == io.EOF || err == io.ErrClosedPipe {
+		s.cancelFn()
+	}
+	return &req, err
+}

client/alloc_endpoint_test.go

@@ -1,17 +1,30 @@
 package client
 
 import (
+	"encoding/json"
 	"fmt"
+	"io"
+	"net"
+	"runtime"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/hashicorp/nomad/acl"
 	"github.com/hashicorp/nomad/client/config"
 	cstructs "github.com/hashicorp/nomad/client/structs"
+	"github.com/hashicorp/nomad/helper/pluginutils/catalog"
+	"github.com/hashicorp/nomad/helper/uuid"
+	"github.com/hashicorp/nomad/nomad"
 	"github.com/hashicorp/nomad/nomad/mock"
+	"github.com/hashicorp/nomad/nomad/structs"
 	nstructs "github.com/hashicorp/nomad/nomad/structs"
+	nconfig "github.com/hashicorp/nomad/nomad/structs/config"
+	"github.com/hashicorp/nomad/plugins/drivers"
 	"github.com/hashicorp/nomad/testutil"
 	"github.com/stretchr/testify/require"
+	"github.com/ugorji/go/codec"
+	"golang.org/x/sys/unix"
 )
 
 func TestAllocations_Restart(t *testing.T) {
@@ -446,3 +459,723 @@ func TestAllocations_Stats_ACL(t *testing.T) {
 		require.True(nstructs.IsErrUnknownAllocation(err))
 	}
 }
+
+func TestAlloc_ExecStreaming(t *testing.T) {
+	t.Parallel()
+	require := require.New(t)
+
+	// Start a server and client
+	s := nomad.TestServer(t, nil)
+	defer s.Shutdown()
+	testutil.WaitForLeader(t, s.RPC)
+
+	c, cleanup := TestClient(t, func(c *config.Config) {
+		c.Servers = []string{s.GetConfig().RPCAddr.String()}
+	})
+	defer cleanup()
+
+	expectedStdout := "Hello from the other side\n"
+	expectedStderr := "Hello from the other side\n"
+	job := mock.BatchJob()
+	job.TaskGroups[0].Count = 1
+	job.TaskGroups[0].Tasks[0].Config = map[string]interface{}{
+		"run_for": "20s",
+		"exec_command": map[string]interface{}{
+			"run_for":       "1ms",
+			"stdout_string": expectedStdout,
+			"stderr_string": expectedStderr,
+			"exit_code":     3,
+		},
+	}
+
+	// Wait for client to be running job
+	testutil.WaitForRunning(t, s.RPC, job)
+
+	// Get the allocation ID
+	args := nstructs.AllocListRequest{}
+	args.Region = "global"
+	resp := nstructs.AllocListResponse{}
+	require.NoError(s.RPC("Alloc.List", &args, &resp))
+	require.Len(resp.Allocations, 1)
+	allocID := resp.Allocations[0].ID
+
+	// Make the request
+	req := &cstructs.AllocExecRequest{
+		AllocID:      allocID,
+		Task:         job.TaskGroups[0].Tasks[0].Name,
+		Tty:          true,
+		Cmd:          []string{"placeholder command"},
+		QueryOptions: nstructs.QueryOptions{Region: "global"},
+	}
+
+	// Get the handler
+	handler, err := c.StreamingRpcHandler("Allocations.Exec")
+	require.Nil(err)
+
+	// Create a pipe
+	p1, p2 := net.Pipe()
+	defer p1.Close()
+	defer p2.Close()
+
+	errCh := make(chan error)
+	frames := make(chan *drivers.ExecTaskStreamingResponseMsg)
+
+	// Start the handler
+	go handler(p2)
+	go decodeFrames(t, p1, frames, errCh)
+
+	// Send the request
+	encoder := codec.NewEncoder(p1, nstructs.MsgpackHandle)
+	require.Nil(encoder.Encode(req))
+
+	timeout := time.After(3 * time.Second)
+
+	exitCode := -1
+	receivedStdout := ""
+	receivedStderr := ""
+
+OUTER:
+	for {
+		select {
+		case <-timeout:
+			// time out report
+			require.Equal(expectedStdout, receivedStderr, "didn't receive expected stdout")
+			require.Equal(expectedStderr, receivedStderr, "didn't receive expected stderr")
+			require.Equal(3, exitCode, "failed to get exit code")
+			require.FailNow("timed out")
+		case err := <-errCh:
+			require.NoError(err)
+		case f := <-frames:
+			switch {
+			case f.Stdout != nil && len(f.Stdout.Data) != 0:
+				receivedStdout += string(f.Stdout.Data)
+			case f.Stderr != nil && len(f.Stderr.Data) != 0:
+				receivedStderr += string(f.Stderr.Data)
+			case f.Exited && f.Result != nil:
+				exitCode = int(f.Result.ExitCode)
+			default:
+				t.Logf("received unrelevant frame: %v", f)
+			}
+
+			if expectedStdout == receivedStdout && expectedStderr == receivedStderr && exitCode == 3 {
+				break OUTER
+			}
+		}
+	}
+}
+
+func TestAlloc_ExecStreaming_NoAllocation(t *testing.T) {
+	t.Parallel()
+	require := require.New(t)
+
+	// Start a server and client
+	s := nomad.TestServer(t, nil)
+	defer s.Shutdown()
+	testutil.WaitForLeader(t, s.RPC)
+
+	c, cleanup := TestClient(t, func(c *config.Config) {
+		c.Servers = []string{s.GetConfig().RPCAddr.String()}
+	})
+	defer cleanup()
+
+	// Make the request
+	req := &cstructs.AllocExecRequest{
+		AllocID:      uuid.Generate(),
+		Task:         "testtask",
+		Tty:          true,
+		Cmd:          []string{"placeholder command"},
+		QueryOptions: nstructs.QueryOptions{Region: "global"},
+	}
+
+	// Get the handler
+	handler, err := c.StreamingRpcHandler("Allocations.Exec")
+	require.Nil(err)
+
+	// Create a pipe
+	p1, p2 := net.Pipe()
+	defer p1.Close()
+	defer p2.Close()
+
+	errCh := make(chan error)
+	frames := make(chan *drivers.ExecTaskStreamingResponseMsg)
+
+	// Start the handler
+	go handler(p2)
+	go decodeFrames(t, p1, frames, errCh)
+
+	// Send the request
+	encoder := codec.NewEncoder(p1, nstructs.MsgpackHandle)
+	require.Nil(encoder.Encode(req))
+
+	timeout := time.After(3 * time.Second)
+
+	select {
+	case <-timeout:
+		require.FailNow("timed out")
+	case err := <-errCh:
+		require.True(nstructs.IsErrUnknownAllocation(err), "expected no allocation error but found: %v", err)
+	case f := <-frames:
+		require.Fail("received unexpected frame", "frame: %#v", f)
+	}
+}
+
+func TestAlloc_ExecStreaming_ACL_Basic(t *testing.T) {
+	t.Parallel()
+	require := require.New(t)
+
+	// Start a server and client
+	s, root := nomad.TestACLServer(t, nil)
+	defer s.Shutdown()
+	testutil.WaitForLeader(t, s.RPC)
+
+	client, cleanup := TestClient(t, func(c *config.Config) {
+		c.ACLEnabled = true
+		c.Servers = []string{s.GetConfig().RPCAddr.String()}
+	})
+	defer cleanup()
+
+	// Create a bad token
+	policyBad := mock.NamespacePolicy("other", "", []string{acl.NamespaceCapabilityDeny})
+	tokenBad := mock.CreatePolicyAndToken(t, s.State(), 1005, "invalid", policyBad)
+
+	policyGood := mock.NamespacePolicy(structs.DefaultNamespace, "",
+		[]string{acl.NamespaceCapabilityAllocExec, acl.NamespaceCapabilityReadFS})
+	tokenGood := mock.CreatePolicyAndToken(t, s.State(), 1009, "valid2", policyGood)
+
+	cases := []struct {
+		Name          string
+		Token         string
+		ExpectedError string
+	}{
+		{
+			Name:          "bad token",
+			Token:         tokenBad.SecretID,
+			ExpectedError: structs.ErrPermissionDenied.Error(),
+		},
+		{
+			Name:          "good token",
+			Token:         tokenGood.SecretID,
+			ExpectedError: structs.ErrUnknownAllocationPrefix,
+		},
+		{
+			Name:          "root token",
+			Token:         root.SecretID,
+			ExpectedError: structs.ErrUnknownAllocationPrefix,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.Name, func(t *testing.T) {
+
+			// Make the request
+			req := &cstructs.AllocExecRequest{
+				AllocID: uuid.Generate(),
+				Task:    "testtask",
+				Tty:     true,
+				Cmd:     []string{"placeholder command"},
+				QueryOptions: nstructs.QueryOptions{
+					Region:    "global",
+					AuthToken: c.Token,
+					Namespace: nstructs.DefaultNamespace,
+				},
+			}
+
+			// Get the handler
+			handler, err := client.StreamingRpcHandler("Allocations.Exec")
+			require.Nil(err)
+
+			// Create a pipe
+			p1, p2 := net.Pipe()
+			defer p1.Close()
+			defer p2.Close()
+
+			errCh := make(chan error)
+			frames := make(chan *drivers.ExecTaskStreamingResponseMsg)
+
+			// Start the handler
+			go handler(p2)
+			go decodeFrames(t, p1, frames, errCh)
+
+			// Send the request
+			encoder := codec.NewEncoder(p1, nstructs.MsgpackHandle)
+			require.Nil(encoder.Encode(req))
+
+			select {
+			case <-time.After(3 * time.Second):
+				require.FailNow("timed out")
+			case err := <-errCh:
+				require.Contains(err.Error(), c.ExpectedError)
+			case f := <-frames:
+				require.Fail("received unexpected frame", "frame: %#v", f)
+			}
+		})
+	}
+}
+
+// TestAlloc_ExecStreaming_ACL_WithIsolation_Image asserts that token only needs
+// alloc-exec acl policy when image isolation is used
+func TestAlloc_ExecStreaming_ACL_WithIsolation_Image(t *testing.T) {
+	t.Parallel()
+	isolation := drivers.FSIsolationImage
+
+	// Start a server and client
+	s, root := nomad.TestACLServer(t, nil)
+	defer s.Shutdown()
+	testutil.WaitForLeader(t, s.RPC)
+
+	client, cleanup := TestClient(t, func(c *config.Config) {
+		c.ACLEnabled = true
+		c.Servers = []string{s.GetConfig().RPCAddr.String()}
+
+		pluginConfig := []*nconfig.PluginConfig{
+			{
+				Name: "mock_driver",
+				Config: map[string]interface{}{
+					"fs_isolation": string(isolation),
+				},
+			},
+		}
+
+		c.PluginLoader = catalog.TestPluginLoaderWithOptions(t, "", map[string]string{}, pluginConfig)
+	})
+	defer cleanup()
+
+	// Create a bad token
+	policyBad := mock.NamespacePolicy("other", "", []string{acl.NamespaceCapabilityDeny})
+	tokenBad := mock.CreatePolicyAndToken(t, s.State(), 1005, "invalid", policyBad)
+
+	policyAllocExec := mock.NamespacePolicy(structs.DefaultNamespace, "",
+		[]string{acl.NamespaceCapabilityAllocExec})
+	tokenAllocExec := mock.CreatePolicyAndToken(t, s.State(), 1009, "valid2", policyAllocExec)
+
+	policyAllocNodeExec := mock.NamespacePolicy(structs.DefaultNamespace, "",
+		[]string{acl.NamespaceCapabilityAllocExec, acl.NamespaceCapabilityAllocNodeExec})
+	tokenAllocNodeExec := mock.CreatePolicyAndToken(t, s.State(), 1009, "valid2", policyAllocNodeExec)
+
+	job := mock.BatchJob()
+	job.TaskGroups[0].Count = 1
+	job.TaskGroups[0].Tasks[0].Config = map[string]interface{}{
+		"run_for": "20s",
+		"exec_command": map[string]interface{}{
+			"run_for":       "1ms",
+			"stdout_string": "some output",
+		},
+	}
+
+	// Wait for client to be running job
+	testutil.WaitForRunningWithToken(t, s.RPC, job, root.SecretID)
+
+	// Get the allocation ID
+	args := nstructs.AllocListRequest{}
+	args.Region = "global"
+	args.AuthToken = root.SecretID
+	args.Namespace = nstructs.DefaultNamespace
+	resp := nstructs.AllocListResponse{}
+	require.NoError(t, s.RPC("Alloc.List", &args, &resp))
+	require.Len(t, resp.Allocations, 1)
+	allocID := resp.Allocations[0].ID
+
+	cases := []struct {
+		Name          string
+		Token         string
+		ExpectedError string
+	}{
+		{
+			Name:          "bad token",
+			Token:         tokenBad.SecretID,
+			ExpectedError: structs.ErrPermissionDenied.Error(),
+		},
+		{
+			Name:          "alloc-exec token",
+			Token:         tokenAllocExec.SecretID,
+			ExpectedError: "",
+		},
+		{
+			Name:          "alloc-node-exec token",
+			Token:         tokenAllocNodeExec.SecretID,
+			ExpectedError: "",
+		},
+		{
+			Name:          "root token",
+			Token:         root.SecretID,
+			ExpectedError: "",
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.Name, func(t *testing.T) {
+
+			// Make the request
+			req := &cstructs.AllocExecRequest{
+				AllocID: allocID,
+				Task:    job.TaskGroups[0].Tasks[0].Name,
+				Tty:     true,
+				Cmd:     []string{"placeholder command"},
+				QueryOptions: nstructs.QueryOptions{
+					Region:    "global",
+					AuthToken: c.Token,
+					Namespace: nstructs.DefaultNamespace,
+				},
+			}
+
+			// Get the handler
+			handler, err := client.StreamingRpcHandler("Allocations.Exec")
+			require.Nil(t, err)
+
+			// Create a pipe
+			p1, p2 := net.Pipe()
+			defer p1.Close()
+			defer p2.Close()
+
+			errCh := make(chan error)
+			frames := make(chan *drivers.ExecTaskStreamingResponseMsg)
+
+			// Start the handler
+			go handler(p2)
+			go decodeFrames(t, p1, frames, errCh)
+
+			// Send the request
+			encoder := codec.NewEncoder(p1, nstructs.MsgpackHandle)
+			require.Nil(t, encoder.Encode(req))
+
+			select {
+			case <-time.After(3 * time.Second):
+			case err := <-errCh:
+				if c.ExpectedError == "" {
+					require.NoError(t, err)
+				} else {
+					require.Contains(t, err.Error(), c.ExpectedError)
+				}
+			case f := <-frames:
+				// we are good if we don't expect an error
+				if c.ExpectedError != "" {
+					require.Fail(t, "unexpected frame", "frame: %#v", f)
+				}
+			}
+		})
+	}
+}
+
+// TestAlloc_ExecStreaming_ACL_WithIsolation_Chroot asserts that token only needs
+// alloc-exec acl policy when chroot isolation is used
+func TestAlloc_ExecStreaming_ACL_WithIsolation_Chroot(t *testing.T) {
+	t.Parallel()
+
+	if runtime.GOOS != "linux" || unix.Geteuid() != 0 {
+		t.Skip("chroot isolation requires linux root")
+	}
+
+	isolation := drivers.FSIsolationChroot
+
+	// Start a server and client
+	s, root := nomad.TestACLServer(t, nil)
+	defer s.Shutdown()
+	testutil.WaitForLeader(t, s.RPC)
+
+	client, cleanup := TestClient(t, func(c *config.Config) {
+		c.ACLEnabled = true
+		c.Servers = []string{s.GetConfig().RPCAddr.String()}
+
+		pluginConfig := []*nconfig.PluginConfig{
+			{
+				Name: "mock_driver",
+				Config: map[string]interface{}{
+					"fs_isolation": string(isolation),
+				},
+			},
+		}
+
+		c.PluginLoader = catalog.TestPluginLoaderWithOptions(t, "", map[string]string{}, pluginConfig)
+	})
+	defer cleanup()
+
+	// Create a bad token
+	policyBad := mock.NamespacePolicy("other", "", []string{acl.NamespaceCapabilityDeny})
+	tokenBad := mock.CreatePolicyAndToken(t, s.State(), 1005, "invalid", policyBad)
+
+	policyAllocExec := mock.NamespacePolicy(structs.DefaultNamespace, "",
+		[]string{acl.NamespaceCapabilityAllocExec})
+	tokenAllocExec := mock.CreatePolicyAndToken(t, s.State(), 1009, "alloc-exec", policyAllocExec)
+
+	policyAllocNodeExec := mock.NamespacePolicy(structs.DefaultNamespace, "",
+		[]string{acl.NamespaceCapabilityAllocExec, acl.NamespaceCapabilityAllocNodeExec})
+	tokenAllocNodeExec := mock.CreatePolicyAndToken(t, s.State(), 1009, "alloc-node-exec", policyAllocNodeExec)
+
+	job := mock.BatchJob()
+	job.TaskGroups[0].Count = 1
+	job.TaskGroups[0].Tasks[0].Config = map[string]interface{}{
+		"run_for": "20s",
+		"exec_command": map[string]interface{}{
+			"run_for":       "1ms",
+			"stdout_string": "some output",
+		},
+	}
+
+	// Wait for client to be running job
+	testutil.WaitForRunningWithToken(t, s.RPC, job, root.SecretID)
+
+	// Get the allocation ID
+	args := nstructs.AllocListRequest{}
+	args.Region = "global"
+	args.AuthToken = root.SecretID
+	args.Namespace = nstructs.DefaultNamespace
+	resp := nstructs.AllocListResponse{}
+	require.NoError(t, s.RPC("Alloc.List", &args, &resp))
+	require.Len(t, resp.Allocations, 1)
+	allocID := resp.Allocations[0].ID
+
+	cases := []struct {
+		Name          string
+		Token         string
+		ExpectedError string
+	}{
+		{
+			Name:          "bad token",
+			Token:         tokenBad.SecretID,
+			ExpectedError: structs.ErrPermissionDenied.Error(),
+		},
+		{
+			Name:          "alloc-exec token",
+			Token:         tokenAllocExec.SecretID,
+			ExpectedError: "",
+		},
+		{
+			Name:          "alloc-node-exec token",
+			Token:         tokenAllocNodeExec.SecretID,
+			ExpectedError: "",
+		},
+		{
+			Name:          "root token",
+			Token:         root.SecretID,
+			ExpectedError: "",
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.Name, func(t *testing.T) {
+
+			// Make the request
+			req := &cstructs.AllocExecRequest{
+				AllocID: allocID,
+				Task:    job.TaskGroups[0].Tasks[0].Name,
+				Tty:     true,
+				Cmd:     []string{"placeholder command"},
+				QueryOptions: nstructs.QueryOptions{
+					Region:    "global",
+					AuthToken: c.Token,
+					Namespace: nstructs.DefaultNamespace,
+				},
+			}
+
+			// Get the handler
+			handler, err := client.StreamingRpcHandler("Allocations.Exec")
+			require.Nil(t, err)
+
+			// Create a pipe
+			p1, p2 := net.Pipe()
+			defer p1.Close()
+			defer p2.Close()
+
+			errCh := make(chan error)
+			frames := make(chan *drivers.ExecTaskStreamingResponseMsg)
+
+			// Start the handler
+			go handler(p2)
+			go decodeFrames(t, p1, frames, errCh)
+
+			// Send the request
+			encoder := codec.NewEncoder(p1, nstructs.MsgpackHandle)
+			require.Nil(t, encoder.Encode(req))
+
+			select {
+			case <-time.After(3 * time.Second):
+			case err := <-errCh:
+				if c.ExpectedError == "" {
+					require.NoError(t, err)
+				} else {
+					require.Contains(t, err.Error(), c.ExpectedError)
+				}
+			case f := <-frames:
+				// we are good if we don't expect an error
+				if c.ExpectedError != "" {
+					require.Fail(t, "unexpected frame", "frame: %#v", f)
+				}
+			}
+		})
+	}
+}
+
+// TestAlloc_ExecStreaming_ACL_WithIsolation_None asserts that token needs
+// alloc-node-exec acl policy as well when no isolation is used
+func TestAlloc_ExecStreaming_ACL_WithIsolation_None(t *testing.T) {
+	t.Parallel()
+	isolation := drivers.FSIsolationNone
+
+	// Start a server and client
+	s, root := nomad.TestACLServer(t, nil)
+	defer s.Shutdown()
+	testutil.WaitForLeader(t, s.RPC)
+
+	client, cleanup := TestClient(t, func(c *config.Config) {
+		c.ACLEnabled = true
+		c.Servers = []string{s.GetConfig().RPCAddr.String()}
+
+		pluginConfig := []*nconfig.PluginConfig{
+			{
+				Name: "mock_driver",
+				Config: map[string]interface{}{
+					"fs_isolation": string(isolation),
+				},
+			},
+		}
+
+		c.PluginLoader = catalog.TestPluginLoaderWithOptions(t, "", map[string]string{}, pluginConfig)
+	})
+	defer cleanup()
+
+	// Create a bad token
+	policyBad := mock.NamespacePolicy("other", "", []string{acl.NamespaceCapabilityDeny})
+	tokenBad := mock.CreatePolicyAndToken(t, s.State(), 1005, "invalid", policyBad)
+
+	policyAllocExec := mock.NamespacePolicy(structs.DefaultNamespace, "",
+		[]string{acl.NamespaceCapabilityAllocExec})
+	tokenAllocExec := mock.CreatePolicyAndToken(t, s.State(), 1009, "alloc-exec", policyAllocExec)
+
+	policyAllocNodeExec := mock.NamespacePolicy(structs.DefaultNamespace, "",
+		[]string{acl.NamespaceCapabilityAllocExec, acl.NamespaceCapabilityAllocNodeExec})
+	tokenAllocNodeExec := mock.CreatePolicyAndToken(t, s.State(), 1009, "alloc-node-exec", policyAllocNodeExec)
+
+	job := mock.BatchJob()
+	job.TaskGroups[0].Count = 1
+	job.TaskGroups[0].Tasks[0].Config = map[string]interface{}{
+		"run_for": "20s",
+		"exec_command": map[string]interface{}{
+			"run_for":       "1ms",
+			"stdout_string": "some output",
+		},
+	}
+
+	// Wait for client to be running job
+	testutil.WaitForRunningWithToken(t, s.RPC, job, root.SecretID)
+
+	// Get the allocation ID
+	args := nstructs.AllocListRequest{}
+	args.Region = "global"
+	args.AuthToken = root.SecretID
+	args.Namespace = nstructs.DefaultNamespace
+	resp := nstructs.AllocListResponse{}
+	require.NoError(t, s.RPC("Alloc.List", &args, &resp))
+	require.Len(t, resp.Allocations, 1)
+	allocID := resp.Allocations[0].ID
+
+	cases := []struct {
+		Name          string
+		Token         string
+		ExpectedError string
+	}{
+		{
+			Name:          "bad token",
+			Token:         tokenBad.SecretID,
+			ExpectedError: structs.ErrPermissionDenied.Error(),
+		},
+		{
+			Name:          "alloc-exec token",
+			Token:         tokenAllocExec.SecretID,
+			ExpectedError: structs.ErrPermissionDenied.Error(),
+		},
+		{
+			Name:          "alloc-node-exec token",
+			Token:         tokenAllocNodeExec.SecretID,
+			ExpectedError: "",
+		},
+		{
+			Name:          "root token",
+			Token:         root.SecretID,
+			ExpectedError: "",
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.Name, func(t *testing.T) {
+
+			// Make the request
+			req := &cstructs.AllocExecRequest{
+				AllocID: allocID,
+				Task:    job.TaskGroups[0].Tasks[0].Name,
+				Tty:     true,
+				Cmd:     []string{"placeholder command"},
+				QueryOptions: nstructs.QueryOptions{
+					Region:    "global",
+					AuthToken: c.Token,
+					Namespace: nstructs.DefaultNamespace,
+				},
+			}
+
+			// Get the handler
+			handler, err := client.StreamingRpcHandler("Allocations.Exec")
+			require.Nil(t, err)
+
+			// Create a pipe
+			p1, p2 := net.Pipe()
+			defer p1.Close()
+			defer p2.Close()
+
+			errCh := make(chan error)
+			frames := make(chan *drivers.ExecTaskStreamingResponseMsg)
+
+			// Start the handler
+			go handler(p2)
+			go decodeFrames(t, p1, frames, errCh)
+
+			// Send the request
+			encoder := codec.NewEncoder(p1, nstructs.MsgpackHandle)
+			require.Nil(t, encoder.Encode(req))
+
+			select {
+			case <-time.After(3 * time.Second):
+			case err := <-errCh:
+				if c.ExpectedError == "" {
+					require.NoError(t, err)
+				} else {
+					require.Contains(t, err.Error(), c.ExpectedError)
+				}
+			case f := <-frames:
+				// we are good if we don't expect an error
+				if c.ExpectedError != "" {
+					require.Fail(t, "unexpected frame", "frame: %#v", f)
+				}
+			}
+		})
+	}
+}
+
+func decodeFrames(t *testing.T, p1 net.Conn, frames chan<- *drivers.ExecTaskStreamingResponseMsg, errCh chan<- error) {
+	// Start the decoder
+	decoder := codec.NewDecoder(p1, nstructs.MsgpackHandle)
+
+	for {
+		var msg cstructs.StreamErrWrapper
+		if err := decoder.Decode(&msg); err != nil {
+			if err == io.EOF || strings.Contains(err.Error(), "closed") {
+				return
+			}
+			t.Logf("received error decoding: %#v", err)
+
+			errCh <- fmt.Errorf("error decoding: %v", err)
+			return
+		}
+
+		if msg.Error != nil {
+			errCh <- msg.Error
+			continue
+		}
+
+		var frame drivers.ExecTaskStreamingResponseMsg
+		if err := json.Unmarshal(msg.Payload, &frame); err != nil {
+			errCh <- err
+			return
+		}
+		t.Logf("received message: %#v", msg)
+		frames <- &frame
+	}
+}

client/allocrunner/alloc_runner.go

@@ -990,3 +990,21 @@ func (ar *allocRunner) Signal(taskName, signal string) error {
 
 	return err.ErrorOrNil()
 }
+
+func (ar *allocRunner) GetTaskExecHandler(taskName string) drivermanager.TaskExecHandler {
+	tr, ok := ar.tasks[taskName]
+	if !ok {
+		return nil
+	}
+
+	return tr.TaskExecHandler()
+}
+
+func (ar *allocRunner) GetTaskDriverCapabilities(taskName string) (*drivers.Capabilities, error) {
+	tr, ok := ar.tasks[taskName]
+	if !ok {
+		return nil, fmt.Errorf("task not found")
+	}
+
+	return tr.DriverCapabilities()
+}

client/allocrunner/taskrunner/driver_handle.go

@@ -2,6 +2,7 @@ package taskrunner
 
 import (
 	"context"
+	"fmt"
 	"time"
 
 	cstructs "github.com/hashicorp/nomad/client/structs"
@@ -52,6 +53,7 @@ func (h *DriverHandle) Signal(s string) error {
 	return h.driver.SignalTask(h.taskID, s)
 }
 
+// Exec is the handled used by client endpoint handler to invoke the appropriate task driver exec.
 func (h *DriverHandle) Exec(timeout time.Duration, cmd string, args []string) ([]byte, int, error) {
 	command := append([]string{cmd}, args...)
 	res, err := h.driver.ExecTask(h.taskID, command, timeout)
@@ -61,6 +63,46 @@ func (h *DriverHandle) Exec(timeout time.Duration, cmd string, args []string) ([
 	return res.Stdout, res.ExitResult.ExitCode, res.ExitResult.Err
 }
 
+// ExecStreaming is the handled used by client endpoint handler to invoke the appropriate task driver exec.
+// while allowing to stream input and output
+func (h *DriverHandle) ExecStreaming(ctx context.Context,
+	command []string,
+	tty bool,
+	stream drivers.ExecTaskStream) error {
+
+	if impl, ok := h.driver.(drivers.ExecTaskStreamingRawDriver); ok {
+		return impl.ExecTaskStreamingRaw(ctx, h.taskID, command, tty, stream)
+	}
+
+	d, ok := h.driver.(drivers.ExecTaskStreamingDriver)
+	if !ok {
+		return fmt.Errorf("task driver does not support exec")
+	}
+
+	execOpts, doneCh := drivers.StreamToExecOptions(
+		ctx, command, tty, stream)
+
+	result, err := d.ExecTaskStreaming(ctx, h.taskID, execOpts)
+	if err != nil {
+		return err
+	}
+
+	execOpts.Stdout.Close()
+	execOpts.Stderr.Close()
+
+	select {
+	case err = <-doneCh:
+	case <-ctx.Done():
+		err = fmt.Errorf("exec task timed out: %v", ctx.Err())
+	}
+
+	if err != nil {
+		return err
+	}
+
+	return stream.Send(drivers.NewExecStreamingResponseExit(result.ExitCode))
+}
+
 func (h *DriverHandle) Network() *drivers.DriverNetwork {
 	return h.net
 }

client/allocrunner/taskrunner/task_runner.go

@@ -1220,3 +1220,11 @@ func appendTaskEvent(state *structs.TaskState, event *structs.TaskEvent, capacit
 
 	state.Events = append(state.Events, event)
 }
+
+func (tr *TaskRunner) TaskExecHandler() drivermanager.TaskExecHandler {
+	return tr.getDriverHandle().ExecStreaming
+}
+
+func (tr *TaskRunner) DriverCapabilities() (*drivers.Capabilities, error) {
+	return tr.driver.Capabilities()
+}

client/client.go

@@ -44,6 +44,7 @@ import (
 	"github.com/hashicorp/nomad/nomad/structs"
 	nconfig "github.com/hashicorp/nomad/nomad/structs/config"
 	"github.com/hashicorp/nomad/plugins/device"
+	"github.com/hashicorp/nomad/plugins/drivers"
 	vaultapi "github.com/hashicorp/vault/api"
 	"github.com/shirou/gopsutil/host"
 )
@@ -133,6 +134,9 @@ type AllocRunner interface {
 
 	RestartTask(taskName string, taskEvent *structs.TaskEvent) error
 	RestartAll(taskEvent *structs.TaskEvent) error
+
+	GetTaskExecHandler(taskName string) drivermanager.TaskExecHandler
+	GetTaskDriverCapabilities(taskName string) (*drivers.Capabilities, error)
 }
 
 // Client is used to implement the client interaction with Nomad. Clients

client/fs_endpoint.go

@@ -84,7 +84,7 @@ func NewFileSystemEndpoint(c *Client) *FileSystem {
 // handleStreamResultError is a helper for sending an error with a potential
 // error code. The transmission of the error is ignored if the error has been
 // generated by the closing of the underlying transport.
-func (f *FileSystem) handleStreamResultError(err error, code *int64, encoder *codec.Encoder) {
+func handleStreamResultError(err error, code *int64, encoder *codec.Encoder) {
 	// Nothing to do as the conn is closed
 	if err == io.EOF || strings.Contains(err.Error(), "closed") {
 		return
@@ -155,26 +155,26 @@ func (f *FileSystem) stream(conn io.ReadWriteCloser) {
 	encoder := codec.NewEncoder(conn, structs.MsgpackHandle)
 
 	if err := decoder.Decode(&req); err != nil {
-		f.handleStreamResultError(err, helper.Int64ToPtr(500), encoder)
+		handleStreamResultError(err, helper.Int64ToPtr(500), encoder)
 		return
 	}
 
 	// Check read permissions
 	if aclObj, err := f.c.ResolveToken(req.QueryOptions.AuthToken); err != nil {
-		f.handleStreamResultError(err, nil, encoder)
+		handleStreamResultError(err, helper.Int64ToPtr(403), encoder)
 		return
 	} else if aclObj != nil && !aclObj.AllowNsOp(req.Namespace, acl.NamespaceCapabilityReadFS) {
-		f.handleStreamResultError(structs.ErrPermissionDenied, nil, encoder)
+		handleStreamResultError(structs.ErrPermissionDenied, helper.Int64ToPtr(403), encoder)
 		return
 	}
 
 	// Validate the arguments
 	if req.AllocID == "" {
-		f.handleStreamResultError(allocIDNotPresentErr, helper.Int64ToPtr(400), encoder)
+		handleStreamResultError(allocIDNotPresentErr, helper.Int64ToPtr(400), encoder)
 		return
 	}
 	if req.Path == "" {
-		f.handleStreamResultError(pathNotPresentErr, helper.Int64ToPtr(400), encoder)
+		handleStreamResultError(pathNotPresentErr, helper.Int64ToPtr(400), encoder)
 		return
 	}
 	switch req.Origin {
@@ -182,7 +182,7 @@ func (f *FileSystem) stream(conn io.ReadWriteCloser) {
 	case "":
 		req.Origin = "start"
 	default:
-		f.handleStreamResultError(invalidOrigin, helper.Int64ToPtr(400), encoder)
+		handleStreamResultError(invalidOrigin, helper.Int64ToPtr(400), encoder)
 		return
 	}
 
@@ -193,18 +193,18 @@ func (f *FileSystem) stream(conn io.ReadWriteCloser) {
 			code = helper.Int64ToPtr(404)
 		}
 
-		f.handleStreamResultError(err, code, encoder)
+		handleStreamResultError(err, code, encoder)
 		return
 	}
 
 	// Calculate the offset
 	fileInfo, err := fs.Stat(req.Path)
 	if err != nil {
-		f.handleStreamResultError(err, helper.Int64ToPtr(400), encoder)
+		handleStreamResultError(err, helper.Int64ToPtr(400), encoder)
 		return
 	}
 	if fileInfo.IsDir {
-		f.handleStreamResultError(
+		handleStreamResultError(
 			fmt.Errorf("file %q is a directory", req.Path),
 			helper.Int64ToPtr(400), encoder)
 		return
@@ -312,7 +312,7 @@ OUTER:
 	}
 
 	if streamErr != nil {
-		f.handleStreamResultError(streamErr, helper.Int64ToPtr(500), encoder)
+		handleStreamResultError(streamErr, helper.Int64ToPtr(500), encoder)
 		return
 	}
 }
@@ -328,36 +328,36 @@ func (f *FileSystem) logs(conn io.ReadWriteCloser) {
 	encoder := codec.NewEncoder(conn, structs.MsgpackHandle)
 
 	if err := decoder.Decode(&req); err != nil {
-		f.handleStreamResultError(err, helper.Int64ToPtr(500), encoder)
+		handleStreamResultError(err, helper.Int64ToPtr(500), encoder)
 		return
 	}
 
 	// Check read permissions
 	if aclObj, err := f.c.ResolveToken(req.QueryOptions.AuthToken); err != nil {
-		f.handleStreamResultError(err, nil, encoder)
+		handleStreamResultError(err, nil, encoder)
 		return
 	} else if aclObj != nil {
 		readfs := aclObj.AllowNsOp(req.QueryOptions.Namespace, acl.NamespaceCapabilityReadFS)
 		logs := aclObj.AllowNsOp(req.QueryOptions.Namespace, acl.NamespaceCapabilityReadLogs)
 		if !readfs && !logs {
-			f.handleStreamResultError(structs.ErrPermissionDenied, nil, encoder)
+			handleStreamResultError(structs.ErrPermissionDenied, nil, encoder)
 			return
 		}
 	}
 
 	// Validate the arguments
 	if req.AllocID == "" {
-		f.handleStreamResultError(allocIDNotPresentErr, helper.Int64ToPtr(400), encoder)
+		handleStreamResultError(allocIDNotPresentErr, helper.Int64ToPtr(400), encoder)
 		return
 	}
 	if req.Task == "" {
-		f.handleStreamResultError(taskNotPresentErr, helper.Int64ToPtr(400), encoder)
+		handleStreamResultError(taskNotPresentErr, helper.Int64ToPtr(400), encoder)
 		return
 	}
 	switch req.LogType {
 	case "stdout", "stderr":
 	default:
-		f.handleStreamResultError(logTypeNotPresentErr, helper.Int64ToPtr(400), encoder)
+		handleStreamResultError(logTypeNotPresentErr, helper.Int64ToPtr(400), encoder)
 		return
 	}
 	switch req.Origin {
@@ -365,7 +365,7 @@ func (f *FileSystem) logs(conn io.ReadWriteCloser) {
 	case "":
 		req.Origin = "start"
 	default:
-		f.handleStreamResultError(invalidOrigin, helper.Int64ToPtr(400), encoder)
+		handleStreamResultError(invalidOrigin, helper.Int64ToPtr(400), encoder)
 		return
 	}
 
@@ -376,7 +376,7 @@ func (f *FileSystem) logs(conn io.ReadWriteCloser) {
 			code = helper.Int64ToPtr(404)
 		}
 
-		f.handleStreamResultError(err, code, encoder)
+		handleStreamResultError(err, code, encoder)
 		return
 	}
 
@@ -387,14 +387,14 @@ func (f *FileSystem) logs(conn io.ReadWriteCloser) {
 			code = helper.Int64ToPtr(404)
 		}
 
-		f.handleStreamResultError(err, code, encoder)
+		handleStreamResultError(err, code, encoder)
 		return
 	}
 
 	// Check that the task is there
 	taskState := allocState.TaskStates[req.Task]
 	if taskState == nil {
-		f.handleStreamResultError(
+		handleStreamResultError(
 			fmt.Errorf("unknown task name %q", req.Task),
 			helper.Int64ToPtr(400),
 			encoder)
@@ -402,7 +402,7 @@ func (f *FileSystem) logs(conn io.ReadWriteCloser) {
 	}
 
 	if taskState.StartedAt.IsZero() {
-		f.handleStreamResultError(
+		handleStreamResultError(
 			fmt.Errorf("task %q not started yet. No logs available", req.Task),
 			helper.Int64ToPtr(404),
 			encoder)
@@ -494,7 +494,7 @@ OUTER:
 		if codedErr, ok := streamErr.(interface{ Code() int }); ok {
 			code = int64(codedErr.Code())
 		}
-		f.handleStreamResultError(streamErr, &code, encoder)
+		handleStreamResultError(streamErr, &code, encoder)
 		return
 	}
 }

client/pluginmanager/drivermanager/manager.go

@@ -29,6 +29,13 @@ type Manager interface {
 	Dispense(driver string) (drivers.DriverPlugin, error)
 }
 
+// TaskExecHandler is function to be called for executing commands in a task
+type TaskExecHandler func(
+	ctx context.Context,
+	command []string,
+	tty bool,
+	stream drivers.ExecTaskStream) error
+
 // EventHandler is a callback to be called for a task.
 // The handler should not block execution.
 type EventHandler func(*drivers.TaskEvent)

client/rpc.go

@@ -217,7 +217,7 @@ func (c *Client) setupClientRpc() {
 	// Initialize the RPC handlers
 	c.endpoints.ClientStats = &ClientStats{c}
 	c.endpoints.FileSystem = NewFileSystemEndpoint(c)
-	c.endpoints.Allocations = &Allocations{c}
+	c.endpoints.Allocations = NewAllocationsEndpoint(c)
 
 	// Create the RPC Server
 	c.rpcServer = rpc.NewServer()

client/structs/structs.go

@@ -144,6 +144,23 @@ type StreamErrWrapper struct {
 	Payload []byte
 }
 
+// AllocExecRequest is the initial request for execing into an Alloc task
+type AllocExecRequest struct {
+	// AllocID is the allocation to stream logs from
+	AllocID string
+
+	// Task is the task to stream logs from
+	Task string
+
+	// Tty indicates whether to allocate a pseudo-TTY
+	Tty bool
+
+	// Cmd is the command to be executed
+	Cmd []string
+
+	structs.QueryOptions
+}
+
 // AllocStatsRequest is used to request the resource usage of a given
 // allocation, potentially filtering by task
 type AllocStatsRequest struct {

command/agent/alloc_endpoint.go

@@ -1,14 +1,21 @@
 package agent
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
+	"io"
+	"net"
 	"net/http"
+	"strconv"
 	"strings"
 
 	"github.com/golang/snappy"
+	"github.com/gorilla/websocket"
 	cstructs "github.com/hashicorp/nomad/client/structs"
 	"github.com/hashicorp/nomad/nomad/structs"
+	"github.com/hashicorp/nomad/plugins/drivers"
+	"github.com/ugorji/go/codec"
 )
 
 const (
@@ -129,6 +136,8 @@ func (s *HTTPServer) ClientAllocRequest(resp http.ResponseWriter, req *http.Requ
 	switch tokens[1] {
 	case "stats":
 		return s.allocStats(allocID, resp, req)
+	case "exec":
+		return s.allocExec(allocID, resp, req)
 	case "snapshot":
 		if s.agent.client == nil {
 			return nil, clientNotRunning
@@ -347,3 +356,187 @@ func (s *HTTPServer) allocStats(allocID string, resp http.ResponseWriter, req *h
 
 	return reply.Stats, rpcErr
 }
+
+func (s *HTTPServer) allocExec(allocID string, resp http.ResponseWriter, req *http.Request) (interface{}, error) {
+	// Build the request and parse the ACL token
+	task := req.URL.Query().Get("task")
+	cmdJsonStr := req.URL.Query().Get("command")
+	var command []string
+	err := json.Unmarshal([]byte(cmdJsonStr), &command)
+	if err != nil {
+		// this shouldn't happen, []string is always be serializable to json
+		return nil, fmt.Errorf("failed to marshal command into json: %v", err)
+	}
+
+	ttyB := false
+	if tty := req.URL.Query().Get("tty"); tty != "" {
+		ttyB, err = strconv.ParseBool(tty)
+		if err != nil {
+			return nil, fmt.Errorf("tty value is not a boolean: %v", err)
+		}
+	}
+
+	args := cstructs.AllocExecRequest{
+		AllocID: allocID,
+		Task:    task,
+		Cmd:     command,
+		Tty:     ttyB,
+	}
+	s.parse(resp, req, &args.QueryOptions.Region, &args.QueryOptions)
+
+	conn, err := s.wsUpgrader.Upgrade(resp, req, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to upgrade connection: %v", err)
+	}
+
+	return s.execStreamImpl(conn, &args)
+}
+
+func (s *HTTPServer) execStreamImpl(ws *websocket.Conn, args *cstructs.AllocExecRequest) (interface{}, error) {
+	allocID := args.AllocID
+	method := "Allocations.Exec"
+
+	// Get the correct handler
+	localClient, remoteClient, localServer := s.rpcHandlerForAlloc(allocID)
+	var handler structs.StreamingRpcHandler
+	var handlerErr error
+	if localClient {
+		handler, handlerErr = s.agent.Client().StreamingRpcHandler(method)
+	} else if remoteClient {
+		handler, handlerErr = s.agent.Client().RemoteStreamingRpcHandler(method)
+	} else if localServer {
+		handler, handlerErr = s.agent.Server().StreamingRpcHandler(method)
+	}
+
+	if handlerErr != nil {
+		return nil, CodedError(500, handlerErr.Error())
+	}
+
+	// Create a pipe connecting the (possibly remote) handler to the http response
+	httpPipe, handlerPipe := net.Pipe()
+	decoder := codec.NewDecoder(httpPipe, structs.MsgpackHandle)
+	encoder := codec.NewEncoder(httpPipe, structs.MsgpackHandle)
+
+	// Create a goroutine that closes the pipe if the connection closes.
+	ctx, cancel := context.WithCancel(context.Background())
+	go func() {
+		<-ctx.Done()
+		httpPipe.Close()
+
+		// don't close ws - wait to drain messages
+	}()
+
+	// Create a channel that decodes the results
+	errCh := make(chan HTTPCodedError, 2)
+
+	// stream response
+	go func() {
+		defer cancel()
+
+		// Send the request
+		if err := encoder.Encode(args); err != nil {
+			errCh <- CodedError(500, err.Error())
+			return
+		}
+
+		go forwardExecInput(encoder, ws, errCh)
+
+		for {
+			select {
+			case <-ctx.Done():
+				errCh <- nil
+				return
+			default:
+			}
+
+			var res cstructs.StreamErrWrapper
+			err := decoder.Decode(&res)
+			if isClosedError(err) {
+				ws.WriteMessage(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, ""))
+				errCh <- nil
+				return
+			}
+
+			if err != nil {
+				errCh <- CodedError(500, err.Error())
+				return
+			}
+			decoder.Reset(httpPipe)
+
+			if err := res.Error; err != nil {
+				code := 500
+				if err.Code != nil {
+					code = int(*err.Code)
+				}
+				errCh <- CodedError(code, err.Error())
+				return
+			}
+
+			if err := ws.WriteMessage(websocket.TextMessage, res.Payload); err != nil {
+				errCh <- CodedError(500, err.Error())
+				return
+			}
+		}
+	}()
+
+	// start streaming request to streaming RPC - returns when streaming completes or errors
+	handler(handlerPipe)
+	// stop streaming background goroutines for streaming - but not websocket activity
+	cancel()
+	// retreieve any error and/or wait until goroutine stop and close errCh connection before
+	// closing websocket connection
+	codedErr := <-errCh
+
+	if isClosedError(codedErr) {
+		codedErr = nil
+	} else if codedErr != nil {
+		ws.WriteMessage(websocket.CloseMessage,
+			websocket.FormatCloseMessage(toWsCode(codedErr.Code()), codedErr.Error()))
+	}
+	ws.Close()
+
+	return nil, codedErr
+}
+
+func toWsCode(httpCode int) int {
+	switch httpCode {
+	case 500:
+		return websocket.CloseInternalServerErr
+	default:
+		// placeholder error code
+		return websocket.ClosePolicyViolation
+	}
+}
+
+func isClosedError(err error) bool {
+	if err == nil {
+		return false
+	}
+
+	return err == io.EOF ||
+		err == io.ErrClosedPipe ||
+		strings.Contains(err.Error(), "closed") ||
+		strings.Contains(err.Error(), "EOF")
+}
+
+// forwardExecInput forwards exec input (e.g. stdin) from websocket connection
+// to the streaming RPC connection to client
+func forwardExecInput(encoder *codec.Encoder, ws *websocket.Conn, errCh chan<- HTTPCodedError) {
+	for {
+		sf := &drivers.ExecTaskStreamingRequestMsg{}
+		err := ws.ReadJSON(sf)
+		if err == io.EOF {
+			return
+		}
+
+		if err != nil {
+			errCh <- CodedError(500, err.Error())
+			return
+		}
+
+		err = encoder.Encode(sf)
+		if err != nil {
+			errCh <- CodedError(500, err.Error())
+		}
+	}
+}

command/agent/http.go

@@ -15,6 +15,7 @@ import (
 
 	"github.com/NYTimes/gziphandler"
 	assetfs "github.com/elazarl/go-bindata-assetfs"
+	"github.com/gorilla/websocket"
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/nomad/helper/tlsutil"
 	"github.com/hashicorp/nomad/nomad/structs"
@@ -54,6 +55,8 @@ type HTTPServer struct {
 	listenerCh chan struct{}
 	logger     log.Logger
 	Addr       string
+
+	wsUpgrader *websocket.Upgrader
 }
 
 // NewHTTPServer starts new HTTP server over the agent
@@ -85,6 +88,11 @@ func NewHTTPServer(agent *Agent, config *Config) (*HTTPServer, error) {
 	// Create the mux
 	mux := http.NewServeMux()
 
+	wsUpgrader := &websocket.Upgrader{
+		ReadBufferSize:  2048,
+		WriteBufferSize: 2048,
+	}
+
 	// Create the server
 	srv := &HTTPServer{
 		agent:      agent,
@@ -93,6 +101,7 @@ func NewHTTPServer(agent *Agent, config *Config) (*HTTPServer, error) {
 		listenerCh: make(chan struct{}),
 		logger:     agent.httpLogger,
 		Addr:       ln.Addr().String(),
+		wsUpgrader: wsUpgrader,
 	}
 	srv.registerHandlers(config.EnableDebug)
 

drivers/docker/docklog/docker_logger.go

@@ -98,7 +98,11 @@ func (d *dockerLogger) Start(opts *StartOpts) error {
 				Follow:       true,
 				Stdout:       true,
 				Stderr:       true,
-				RawTerminal:  opts.TTY,
+
+				// When running in TTY, we must use a raw terminal.
+				// If not, we set RawTerminal to false to allow docker client
+				// to interpret special stdout/stderr messages
+				RawTerminal: opts.TTY,
 			}
 
 			err := client.Logs(logOpts)

drivers/docker/driver.go

@@ -1215,6 +1215,95 @@ func (d *Driver) ExecTask(taskID string, cmd []string, timeout time.Duration) (*
 	return h.Exec(ctx, cmd[0], cmd[1:])
 }
 
+var _ drivers.ExecTaskStreamingDriver = (*Driver)(nil)
+
+func (d *Driver) ExecTaskStreaming(ctx context.Context, taskID string, opts *drivers.ExecOptions) (*drivers.ExitResult, error) {
+	defer opts.Stdout.Close()
+	defer opts.Stderr.Close()
+
+	done := make(chan interface{})
+	defer close(done)
+
+	h, ok := d.tasks.Get(taskID)
+	if !ok {
+		return nil, drivers.ErrTaskNotFound
+	}
+
+	if len(opts.Command) == 0 {
+		return nil, fmt.Errorf("command is required but was empty")
+	}
+
+	createExecOpts := docker.CreateExecOptions{
+		AttachStdin:  true,
+		AttachStdout: true,
+		AttachStderr: true,
+		Tty:          opts.Tty,
+		Cmd:          opts.Command,
+		Container:    h.containerID,
+		Context:      ctx,
+	}
+	exec, err := h.client.CreateExec(createExecOpts)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create exec object: %v", err)
+	}
+
+	go func() {
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-done:
+				return
+			case s, ok := <-opts.ResizeCh:
+				if !ok {
+					return
+				}
+				client.ResizeExecTTY(exec.ID, s.Height, s.Width)
+			}
+		}
+	}()
+
+	startOpts := docker.StartExecOptions{
+		Detach: false,
+
+		// When running in TTY, we must use a raw terminal.
+		// If not, we set RawTerminal to false to allow docker client
+		// to interpret special stdout/stderr messages
+		Tty:         opts.Tty,
+		RawTerminal: opts.Tty,
+
+		InputStream:  opts.Stdin,
+		OutputStream: opts.Stdout,
+		ErrorStream:  opts.Stderr,
+		Context:      ctx,
+	}
+	if err := client.StartExec(exec.ID, startOpts); err != nil {
+		return nil, fmt.Errorf("failed to start exec: %v", err)
+	}
+
+	// StartExec returns after process completes, but InspectExec seems to have a delay
+	// get in getting status code
+
+	const execTerminatingTimeout = 3 * time.Second
+	start := time.Now()
+	var res *docker.ExecInspect
+	for res == nil || res.Running || time.Since(start) > execTerminatingTimeout {
+		res, err = client.InspectExec(exec.ID)
+		if err != nil {
+			return nil, fmt.Errorf("failed to inspect exec result: %v", err)
+		}
+		time.Sleep(50 * time.Millisecond)
+	}
+
+	if res == nil || res.Running {
+		return nil, fmt.Errorf("failed to retrieve exec result")
+	}
+
+	return &drivers.ExitResult{
+		ExitCode: res.ExitCode,
+	}, nil
+}
+
 // dockerClients creates two *docker.Client, one for long running operations and
 // the other for shorter operations. In test / dev mode we can use ENV vars to
 // connect to the docker daemon. In production mode we will read docker.endpoint

drivers/docker/driver_unix_test.go

@@ -18,6 +18,7 @@ import (
 	"github.com/hashicorp/nomad/client/testutil"
 	"github.com/hashicorp/nomad/helper/uuid"
 	"github.com/hashicorp/nomad/plugins/drivers"
+	dtestutil "github.com/hashicorp/nomad/plugins/drivers/testutils"
 	tu "github.com/hashicorp/nomad/testutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -754,3 +755,32 @@ func copyFile(src, dst string, t *testing.T) {
 		t.Fatalf("copying %v -> %v failed: %v", src, dst, err)
 	}
 }
+
+func TestDocker_ExecTaskStreaming(t *testing.T) {
+	if !tu.IsCI() {
+		t.Parallel()
+	}
+	testutil.DockerCompatible(t)
+
+	taskCfg := newTaskConfig("", []string{"/bin/sleep", "1000"})
+	task := &drivers.TaskConfig{
+		ID:        uuid.Generate(),
+		Name:      "nc-demo",
+		AllocID:   uuid.Generate(),
+		Resources: basicResources,
+	}
+	require.NoError(t, task.EncodeConcreteDriverConfig(&taskCfg))
+
+	d := dockerDriverHarness(t, nil)
+	cleanup := d.MkAllocDir(task, true)
+	defer cleanup()
+	copyImage(t, task.TaskDir(), "busybox.tar")
+
+	_, _, err := d.StartTask(task)
+	require.NoError(t, err)
+
+	defer d.DestroyTask(task.ID, true)
+
+	dtestutil.ExecTaskStreamingConformanceTests(t, d, task.ID)
+
+}

drivers/mock/command.go

@@ -0,0 +1,93 @@
+package mock
+
+import (
+	"errors"
+	"io"
+	"sync"
+	"time"
+
+	hclog "github.com/hashicorp/go-hclog"
+	bstructs "github.com/hashicorp/nomad/plugins/base/structs"
+	"github.com/hashicorp/nomad/plugins/drivers"
+)
+
+func runCommand(c Command, stdout, stderr io.WriteCloser, cancelCh <-chan struct{}, pluginExitTimer <-chan time.Time, logger hclog.Logger) *drivers.ExitResult {
+	errCh := make(chan error, 1)
+
+	var wg sync.WaitGroup
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		runCommandOutput(stdout, c.StdoutString, c.StdoutRepeat, c.stdoutRepeatDuration, cancelCh, logger, errCh)
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		runCommandOutput(stderr, c.StderrString, c.StderrRepeat, c.stderrRepeatDuration, cancelCh, logger, errCh)
+	}()
+
+	timer := time.NewTimer(c.runForDuration)
+	defer timer.Stop()
+
+	select {
+	case <-timer.C:
+		logger.Debug("run_for time elapsed; exiting", "run_for", c.RunFor)
+	case <-cancelCh:
+		logger.Debug("killed; exiting")
+	case <-pluginExitTimer:
+		logger.Debug("exiting plugin")
+		return &drivers.ExitResult{
+			Err: bstructs.ErrPluginShutdown,
+		}
+	case err := <-errCh:
+		logger.Error("error running mock task; exiting", "error", err)
+		return &drivers.ExitResult{
+			Err: err,
+		}
+	}
+
+	wg.Wait()
+
+	var exitErr error
+	if c.ExitErrMsg != "" {
+		exitErr = errors.New(c.ExitErrMsg)
+	}
+
+	return &drivers.ExitResult{
+		ExitCode: c.ExitCode,
+		Signal:   c.ExitSignal,
+		Err:      exitErr,
+	}
+}
+
+func runCommandOutput(writer io.WriteCloser,
+	output string, outputRepeat int, repeatDuration time.Duration,
+	cancelCh <-chan struct{}, logger hclog.Logger, errCh chan error) {
+
+	defer writer.Close()
+
+	if output == "" {
+		return
+	}
+
+	if _, err := io.WriteString(writer, output); err != nil {
+		logger.Error("failed to write to stdout", "error", err)
+		errCh <- err
+		return
+	}
+
+	for i := 0; i < outputRepeat; i++ {
+		select {
+		case <-cancelCh:
+			logger.Warn("exiting before done writing output", "i", i, "total", outputRepeat)
+			return
+		case <-time.After(repeatDuration):
+			if _, err := io.WriteString(writer, output); err != nil {
+				logger.Error("failed to write to stdout", "error", err)
+				errCh <- err
+				return
+			}
+		}
+	}
+}

drivers/mock/driver.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io/ioutil"
 	"math/rand"
 	"strconv"
 	"strings"
@@ -57,6 +58,10 @@ var (
 
 	// configSpec is the hcl specification returned by the ConfigSchema RPC
 	configSpec = hclspec.NewObject(map[string]*hclspec.Spec{
+		"fs_isolation": hclspec.NewDefault(
+			hclspec.NewAttr("fs_isolation", "string", false),
+			hclspec.NewLiteral(fmt.Sprintf("%q", drivers.FSIsolationNone)),
+		),
 		"shutdown_periodic_after": hclspec.NewDefault(
 			hclspec.NewAttr("shutdown_periodic_after", "bool", false),
 			hclspec.NewLiteral("false"),
@@ -72,26 +77,36 @@ var (
 		"start_block_for":         hclspec.NewAttr("start_block_for", "string", false),
 		"kill_after":              hclspec.NewAttr("kill_after", "string", false),
 		"plugin_exit_after":       hclspec.NewAttr("plugin_exit_after", "string", false),
-		"run_for":                 hclspec.NewAttr("run_for", "string", false),
-		"exit_code":               hclspec.NewAttr("exit_code", "number", false),
-		"exit_signal":             hclspec.NewAttr("exit_signal", "number", false),
-		"exit_err_msg":            hclspec.NewAttr("exit_err_msg", "string", false),
-		"signal_error":            hclspec.NewAttr("signal_error", "string", false),
 		"driver_ip":               hclspec.NewAttr("driver_ip", "string", false),
 		"driver_advertise":        hclspec.NewAttr("driver_advertise", "bool", false),
 		"driver_port_map":         hclspec.NewAttr("driver_port_map", "string", false),
-		"stdout_string":           hclspec.NewAttr("stdout_string", "string", false),
-		"stdout_repeat":           hclspec.NewAttr("stdout_repeat", "number", false),
-		"stdout_repeat_duration":  hclspec.NewAttr("stdout_repeat_duration", "string", false),
-	})
 
-	// capabilities is returned by the Capabilities RPC and indicates what
-	// optional features this driver supports
-	capabilities = &drivers.Capabilities{
-		SendSignals: true,
-		Exec:        true,
-		FSIsolation: drivers.FSIsolationNone,
-	}
+		"run_for":                hclspec.NewAttr("run_for", "string", false),
+		"exit_code":              hclspec.NewAttr("exit_code", "number", false),
+		"exit_signal":            hclspec.NewAttr("exit_signal", "number", false),
+		"exit_err_msg":           hclspec.NewAttr("exit_err_msg", "string", false),
+		"signal_error":           hclspec.NewAttr("signal_error", "string", false),
+		"stdout_string":          hclspec.NewAttr("stdout_string", "string", false),
+		"stdout_repeat":          hclspec.NewAttr("stdout_repeat", "number", false),
+		"stdout_repeat_duration": hclspec.NewAttr("stdout_repeat_duration", "string", false),
+		"stderr_string":          hclspec.NewAttr("stderr_string", "string", false),
+		"stderr_repeat":          hclspec.NewAttr("stderr_repeat", "number", false),
+		"stderr_repeat_duration": hclspec.NewAttr("stderr_repeat_duration", "string", false),
+
+		"exec_command": hclspec.NewBlock("exec_command", false, hclspec.NewObject(map[string]*hclspec.Spec{
+			"run_for":                hclspec.NewAttr("run_for", "string", false),
+			"exit_code":              hclspec.NewAttr("exit_code", "number", false),
+			"exit_signal":            hclspec.NewAttr("exit_signal", "number", false),
+			"exit_err_msg":           hclspec.NewAttr("exit_err_msg", "string", false),
+			"signal_error":           hclspec.NewAttr("signal_error", "string", false),
+			"stdout_string":          hclspec.NewAttr("stdout_string", "string", false),
+			"stdout_repeat":          hclspec.NewAttr("stdout_repeat", "number", false),
+			"stdout_repeat_duration": hclspec.NewAttr("stdout_repeat_duration", "string", false),
+			"stderr_string":          hclspec.NewAttr("stderr_string", "string", false),
+			"stderr_repeat":          hclspec.NewAttr("stderr_repeat", "number", false),
+			"stderr_repeat_duration": hclspec.NewAttr("stderr_repeat_duration", "string", false),
+		})),
+	})
 )
 
 // Driver is a mock DriverPlugin implementation
@@ -100,6 +115,10 @@ type Driver struct {
 	// event can be broadcast to all callers
 	eventer *eventer.Eventer
 
+	// capabilities is returned by the Capabilities RPC and indicates what
+	// optional features this driver supports
+	capabilities *drivers.Capabilities
+
 	// config is the driver configuration set by the SetConfig RPC
 	config *Config
 
@@ -133,8 +152,16 @@ type Driver struct {
 func NewMockDriver(logger hclog.Logger) drivers.DriverPlugin {
 	ctx, cancel := context.WithCancel(context.Background())
 	logger = logger.Named(pluginName)
+
+	capabilities := &drivers.Capabilities{
+		SendSignals: true,
+		Exec:        true,
+		FSIsolation: drivers.FSIsolationNone,
+	}
+
 	return &Driver{
 		eventer:        eventer.NewEventer(ctx, logger),
+		capabilities:   capabilities,
 		config:         &Config{},
 		tasks:          newTaskStore(),
 		ctx:            ctx,
@@ -145,6 +172,8 @@ func NewMockDriver(logger hclog.Logger) drivers.DriverPlugin {
 
 // Config is the configuration for the driver that applies to all tasks
 type Config struct {
+	FSIsolation string `codec:"fs_isolation"`
+
 	// ShutdownPeriodicAfter is a toggle that can be used during tests to
 	// "stop" a previously-functioning driver, allowing for testing of periodic
 	// drivers and fingerprinters
@@ -156,8 +185,54 @@ type Config struct {
 	ShutdownPeriodicDuration time.Duration `codec:"shutdown_periodic_duration"`
 }
 
+type Command struct {
+	// RunFor is the duration for which the fake task runs for. After this
+	// period the MockDriver responds to the task running indicating that the
+	// task has terminated
+	RunFor         string `codec:"run_for"`
+	runForDuration time.Duration
+
+	// ExitCode is the exit code with which the MockDriver indicates the task
+	// has exited
+	ExitCode int `codec:"exit_code"`
+
+	// ExitSignal is the signal with which the MockDriver indicates the task has
+	// been killed
+	ExitSignal int `codec:"exit_signal"`
+
+	// ExitErrMsg is the error message that the task returns while exiting
+	ExitErrMsg string `codec:"exit_err_msg"`
+
+	// SignalErr is the error message that the task returns if signalled
+	SignalErr string `codec:"signal_error"`
+
+	// StdoutString is the string that should be sent to stdout
+	StdoutString string `codec:"stdout_string"`
+
+	// StdoutRepeat is the number of times the output should be sent.
+	StdoutRepeat int `codec:"stdout_repeat"`
+
+	// StdoutRepeatDur is the duration between repeated outputs.
+	StdoutRepeatDur      string `codec:"stdout_repeat_duration"`
+	stdoutRepeatDuration time.Duration
+
+	// StderrString is the string that should be sent to stderr
+	StderrString string `codec:"stderr_string"`
+
+	// StderrRepeat is the number of times the errput should be sent.
+	StderrRepeat int `codec:"stderr_repeat"`
+
+	// StderrRepeatDur is the duration between repeated errputs.
+	StderrRepeatDur      string `codec:"stderr_repeat_duration"`
+	stderrRepeatDuration time.Duration
+}
+
 // TaskConfig is the driver configuration of a task within a job
 type TaskConfig struct {
+	Command
+
+	ExecCommand *Command `codec:"exec_command"`
+
 	// PluginExitAfter is the duration after which the mock driver indicates the
 	// plugin has exited via the WaitTask call.
 	PluginExitAfter         string `codec:"plugin_exit_after"`
@@ -179,26 +254,6 @@ type TaskConfig struct {
 	KillAfter         string `codec:"kill_after"`
 	killAfterDuration time.Duration
 
-	// RunFor is the duration for which the fake task runs for. After this
-	// period the MockDriver responds to the task running indicating that the
-	// task has terminated
-	RunFor         string `codec:"run_for"`
-	runForDuration time.Duration
-
-	// ExitCode is the exit code with which the MockDriver indicates the task
-	// has exited
-	ExitCode int `codec:"exit_code"`
-
-	// ExitSignal is the signal with which the MockDriver indicates the task has
-	// been killed
-	ExitSignal int `codec:"exit_signal"`
-
-	// ExitErrMsg is the error message that the task returns while exiting
-	ExitErrMsg string `codec:"exit_err_msg"`
-
-	// SignalErr is the error message that the task returns if signalled
-	SignalErr string `codec:"signal_error"`
-
 	// DriverIP will be returned as the DriverNetwork.IP from Start()
 	DriverIP string `codec:"driver_ip"`
 
@@ -209,16 +264,6 @@ type TaskConfig struct {
 	// DriverPortMap will parse a label:number pair and return it in
 	// DriverNetwork.PortMap from Start().
 	DriverPortMap string `codec:"driver_port_map"`
-
-	// StdoutString is the string that should be sent to stdout
-	StdoutString string `codec:"stdout_string"`
-
-	// StdoutRepeat is the number of times the output should be sent.
-	StdoutRepeat int `codec:"stdout_repeat"`
-
-	// StdoutRepeatDur is the duration between repeated outputs.
-	StdoutRepeatDur      string `codec:"stdout_repeat_duration"`
-	stdoutRepeatDuration time.Duration
 }
 
 type MockTaskState struct {
@@ -245,6 +290,12 @@ func (d *Driver) SetConfig(cfg *base.Config) error {
 	if d.config.ShutdownPeriodicAfter {
 		d.shutdownFingerprintTime = time.Now().Add(d.config.ShutdownPeriodicDuration)
 	}
+
+	isolation := config.FSIsolation
+	if isolation != "" {
+		d.capabilities.FSIsolation = drivers.FSIsolation(isolation)
+	}
+
 	return nil
 }
 
@@ -253,7 +304,7 @@ func (d *Driver) TaskConfigSchema() (*hclspec.Spec, error) {
 }
 
 func (d *Driver) Capabilities() (*drivers.Capabilities, error) {
-	return capabilities, nil
+	return d.capabilities, nil
 }
 
 func (d *Driver) Fingerprint(ctx context.Context) (<-chan *drivers.Fingerprint, error) {
@@ -329,6 +380,23 @@ func (d *Driver) RecoverTask(handle *drivers.TaskHandle) error {
 	return nil
 }
 
+func (c *Command) parseDurations() error {
+	var err error
+	if c.runForDuration, err = parseDuration(c.RunFor); err != nil {
+		return fmt.Errorf("run_for %v not a valid duration: %v", c.RunFor, err)
+	}
+
+	if c.stdoutRepeatDuration, err = parseDuration(c.StdoutRepeatDur); err != nil {
+		return fmt.Errorf("stdout_repeat_duration %v not a valid duration: %v", c.stdoutRepeatDuration, err)
+	}
+
+	if c.stderrRepeatDuration, err = parseDuration(c.StderrRepeatDur); err != nil {
+		return fmt.Errorf("stderr_repeat_duration %v not a valid duration: %v", c.stderrRepeatDuration, err)
+	}
+
+	return nil
+}
+
 func parseDriverConfig(cfg *drivers.TaskConfig) (*TaskConfig, error) {
 	var driverConfig TaskConfig
 	if err := cfg.DecodeDriverConfig(&driverConfig); err != nil {
@@ -340,16 +408,18 @@ func parseDriverConfig(cfg *drivers.TaskConfig) (*TaskConfig, error) {
 		return nil, fmt.Errorf("start_block_for %v not a valid duration: %v", driverConfig.StartBlockFor, err)
 	}
 
-	if driverConfig.runForDuration, err = parseDuration(driverConfig.RunFor); err != nil {
-		return nil, fmt.Errorf("run_for %v not a valid duration: %v", driverConfig.RunFor, err)
-	}
-
 	if driverConfig.pluginExitAfterDuration, err = parseDuration(driverConfig.PluginExitAfter); err != nil {
 		return nil, fmt.Errorf("plugin_exit_after %v not a valid duration: %v", driverConfig.PluginExitAfter, err)
 	}
 
-	if driverConfig.stdoutRepeatDuration, err = parseDuration(driverConfig.StdoutRepeatDur); err != nil {
-		return nil, fmt.Errorf("stdout_repeat_duration %v not a valid duration: %v", driverConfig.stdoutRepeatDuration, err)
+	if err = driverConfig.parseDurations(); err != nil {
+		return nil, err
+	}
+
+	if driverConfig.ExecCommand != nil {
+		if err = driverConfig.ExecCommand.parseDurations(); err != nil {
+			return nil, err
+		}
 	}
 
 	return &driverConfig, nil
@@ -359,26 +429,16 @@ func newTaskHandle(cfg *drivers.TaskConfig, driverConfig *TaskConfig, logger hcl
 	killCtx, killCancel := context.WithCancel(context.Background())
 	h := &taskHandle{
 		taskConfig:      cfg,
-		runFor:          driverConfig.runForDuration,
+		command:         driverConfig.Command,
+		execCommand:     driverConfig.ExecCommand,
 		pluginExitAfter: driverConfig.pluginExitAfterDuration,
 		killAfter:       driverConfig.killAfterDuration,
-		exitCode:        driverConfig.ExitCode,
-		exitSignal:      driverConfig.ExitSignal,
-		stdoutString:    driverConfig.StdoutString,
-		stdoutRepeat:    driverConfig.StdoutRepeat,
-		stdoutRepeatDur: driverConfig.stdoutRepeatDuration,
 		logger:          logger.With("task_name", cfg.Name),
-		waitCh:          make(chan struct{}),
+		waitCh:          make(chan interface{}),
 		killCh:          killCtx.Done(),
 		kill:            killCancel,
 		startedAt:       time.Now(),
 	}
-	if driverConfig.ExitErrMsg != "" {
-		h.exitErr = errors.New(driverConfig.ExitErrMsg)
-	}
-	if driverConfig.SignalErr != "" {
-		h.signalErr = fmt.Errorf(driverConfig.SignalErr)
-	}
 	return h
 }
 
@@ -541,7 +601,11 @@ func (d *Driver) SignalTask(taskID string, signal string) error {
 		return drivers.ErrTaskNotFound
 	}
 
-	return h.signalErr
+	if h.command.SignalErr == "" {
+		return nil
+	}
+
+	return errors.New(h.command.SignalErr)
 }
 
 func (d *Driver) ExecTask(taskID string, cmd []string, timeout time.Duration) (*drivers.ExecTaskResult, error) {
@@ -557,6 +621,38 @@ func (d *Driver) ExecTask(taskID string, cmd []string, timeout time.Duration) (*
 	return &res, nil
 }
 
+var _ drivers.ExecTaskStreamingDriver = (*Driver)(nil)
+
+func (d *Driver) ExecTaskStreaming(ctx context.Context, taskID string, execOpts *drivers.ExecOptions) (*drivers.ExitResult, error) {
+	h, ok := d.tasks.Get(taskID)
+	if !ok {
+		return nil, drivers.ErrTaskNotFound
+	}
+
+	d.logger.Info("executing task", "command", h.execCommand, "task_id", taskID)
+
+	if h.execCommand == nil {
+		return nil, errors.New("no exec command is configured")
+	}
+
+	cancelCh := make(chan struct{})
+	exitTimer := make(chan time.Time)
+
+	cmd := *h.execCommand
+	if len(execOpts.Command) == 1 && execOpts.Command[0] == "showinput" {
+		stdin, _ := ioutil.ReadAll(execOpts.Stdin)
+		cmd = Command{
+			RunFor: "1ms",
+			StdoutString: fmt.Sprintf("TTY: %v\nStdin:\n%s\n",
+				execOpts.Tty,
+				stdin,
+			),
+		}
+	}
+
+	return runCommand(cmd, execOpts.Stdout, execOpts.Stderr, cancelCh, exitTimer, d.logger), nil
+}
+
 // GetTaskConfig is unique to the mock driver and for testing purposes only. It
 // returns the *drivers.TaskConfig passed to StartTask and the decoded
 // *mock.TaskConfig created by the last StartTask call.

drivers/mock/handle.go

@@ -2,13 +2,11 @@ package mock
 
 import (
 	"context"
-	"io"
 	"sync"
 	"time"
 
 	hclog "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/nomad/client/lib/fifo"
-	bstructs "github.com/hashicorp/nomad/plugins/base/structs"
 	"github.com/hashicorp/nomad/plugins/drivers"
 )
 
@@ -16,19 +14,13 @@ import (
 type taskHandle struct {
 	logger hclog.Logger
 
-	runFor          time.Duration
 	pluginExitAfter time.Duration
 	killAfter       time.Duration
-	waitCh          chan struct{}
-	exitCode        int
-	exitSignal      int
-	exitErr         error
-	signalErr       error
-	stdoutString    string
-	stdoutRepeat    int
-	stdoutRepeatDur time.Duration
+	waitCh          chan interface{}
 
-	taskConfig *drivers.TaskConfig
+	taskConfig  *drivers.TaskConfig
+	command     Command
+	execCommand *Command
 
 	// stateLock guards the procState field
 	stateLock sync.RWMutex
@@ -81,14 +73,6 @@ func (h *taskHandle) run() {
 	h.procState = drivers.TaskStateRunning
 	h.stateLock.Unlock()
 
-	errCh := make(chan error, 1)
-
-	// Setup logging output
-	go h.handleLogging(errCh)
-
-	timer := time.NewTimer(h.runFor)
-	defer timer.Stop()
-
 	var pluginExitTimer <-chan time.Time
 	if h.pluginExitAfter != 0 {
 		timer := time.NewTimer(h.pluginExitAfter)
@@ -96,70 +80,19 @@ func (h *taskHandle) run() {
 		pluginExitTimer = timer.C
 	}
 
-	select {
-	case <-timer.C:
-		h.logger.Debug("run_for time elapsed; exiting", "run_for", h.runFor)
-	case <-h.killCh:
-		h.logger.Debug("killed; exiting")
-	case <-pluginExitTimer:
-		h.logger.Debug("exiting plugin")
-		h.exitResult = &drivers.ExitResult{
-			Err: bstructs.ErrPluginShutdown,
-		}
-
-		return
-	case err := <-errCh:
-		h.logger.Error("error running mock task; exiting", "error", err)
-		h.exitResult = &drivers.ExitResult{
-			Err: err,
-		}
-		return
-	}
-
-	h.exitResult = &drivers.ExitResult{
-		ExitCode: h.exitCode,
-		Signal:   h.exitSignal,
-		Err:      h.exitErr,
-	}
-	return
-}
-
-func (h *taskHandle) handleLogging(errCh chan<- error) {
 	stdout, err := fifo.OpenWriter(h.taskConfig.StdoutPath)
 	if err != nil {
 		h.logger.Error("failed to write to stdout", "error", err)
-		errCh <- err
+		h.exitResult = &drivers.ExitResult{Err: err}
 		return
 	}
 	stderr, err := fifo.OpenWriter(h.taskConfig.StderrPath)
 	if err != nil {
 		h.logger.Error("failed to write to stderr", "error", err)
-		errCh <- err
-		return
-	}
-	defer stderr.Close()
-
-	if h.stdoutString == "" {
+		h.exitResult = &drivers.ExitResult{Err: err}
 		return
 	}
 
-	if _, err := io.WriteString(stdout, h.stdoutString); err != nil {
-		h.logger.Error("failed to write to stdout", "error", err)
-		errCh <- err
-		return
-	}
-
-	for i := 0; i < h.stdoutRepeat; i++ {
-		select {
-		case <-h.waitCh:
-			h.logger.Warn("exiting before done writing output", "i", i, "total", h.stdoutRepeat)
-			return
-		case <-time.After(h.stdoutRepeatDur):
-			if _, err := io.WriteString(stdout, h.stdoutString); err != nil {
-				h.logger.Error("failed to write to stdout", "error", err)
-				errCh <- err
-				return
-			}
-		}
-	}
+	h.exitResult = runCommand(h.command, stdout, stderr, h.killCh, pluginExitTimer, h.logger)
+	return
 }

e2e/e2e_test.go

@@ -10,6 +10,7 @@ import (
 	_ "github.com/hashicorp/nomad/e2e/consultemplate"
 	_ "github.com/hashicorp/nomad/e2e/example"
 	_ "github.com/hashicorp/nomad/e2e/nomad09upgrade"
+	_ "github.com/hashicorp/nomad/e2e/nomadexec"
 	_ "github.com/hashicorp/nomad/e2e/spread"
 	_ "github.com/hashicorp/nomad/e2e/taskevents"
 )

e2e/nomadexec/exec.go

@@ -0,0 +1,144 @@
+package nomadexec
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"reflect"
+	"regexp"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/nomad/api"
+	"github.com/hashicorp/nomad/e2e/e2eutil"
+	"github.com/hashicorp/nomad/e2e/framework"
+	"github.com/hashicorp/nomad/helper/uuid"
+	dtestutils "github.com/hashicorp/nomad/plugins/drivers/testutils"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type NomadExecE2ETest struct {
+	framework.TC
+
+	name        string
+	jobFilePath string
+
+	jobID string
+	alloc api.Allocation
+}
+
+func init() {
+	framework.AddSuites(&framework.TestSuite{
+		Component:   "Nomad exec",
+		CanRunLocal: true,
+		Cases: []framework.TestCase{
+			newNomadExecE2eTest("docker", "./nomadexec/testdata/docker.nomad"),
+		},
+	})
+}
+
+func newNomadExecE2eTest(name, jobFilePath string) *NomadExecE2ETest {
+	return &NomadExecE2ETest{
+		name:        name,
+		jobFilePath: jobFilePath,
+	}
+}
+
+func (tc *NomadExecE2ETest) Name() string {
+	return fmt.Sprintf("%v (%v)", tc.TC.Name(), tc.name)
+}
+
+func (tc *NomadExecE2ETest) BeforeAll(f *framework.F) {
+	// Ensure cluster has leader before running tests
+	e2eutil.WaitForLeader(f.T(), tc.Nomad())
+	e2eutil.WaitForNodesReady(f.T(), tc.Nomad(), 1)
+
+	// register a job for execing into
+	tc.jobID = "nomad-exec" + uuid.Generate()[:8]
+	allocs := e2eutil.RegisterAndWaitForAllocs(f.T(), tc.Nomad(), tc.jobFilePath, tc.jobID)
+	f.Len(allocs, 1)
+
+	e2eutil.WaitForAllocRunning(f.T(), tc.Nomad(), allocs[0].ID)
+
+	tc.alloc = api.Allocation{
+		ID:        allocs[0].ID,
+		Namespace: allocs[0].Namespace,
+		NodeID:    allocs[0].NodeID,
+	}
+}
+
+func (tc *NomadExecE2ETest) TestExecBasicResponses(f *framework.F) {
+	for _, c := range dtestutils.ExecTaskStreamingBasicCases {
+		f.T().Run(c.Name, func(t *testing.T) {
+
+			stdin := newTestStdin(c.Tty, c.Stdin)
+			var stdout, stderr bytes.Buffer
+
+			resizeCh := make(chan api.TerminalSize)
+			go func() {
+				resizeCh <- api.TerminalSize{Height: 100, Width: 100}
+			}()
+
+			ctx, cancelFn := context.WithTimeout(context.Background(), 15*time.Second)
+			defer cancelFn()
+
+			exitCode, err := tc.Nomad().Allocations().Exec(ctx,
+				&tc.alloc, "task", c.Tty,
+				[]string{"/bin/sh", "-c", c.Command},
+				stdin, &stdout, &stderr,
+				resizeCh, nil)
+
+			require.NoError(t, err)
+
+			assert.Equal(t, c.ExitCode, exitCode)
+
+			switch s := c.Stdout.(type) {
+			case string:
+				require.Equal(t, s, stdout.String())
+			case *regexp.Regexp:
+				require.Regexp(t, s, stdout.String())
+			case nil:
+				require.Empty(t, stdout.String())
+			default:
+				require.Fail(t, "unexpected stdout type", "found %v (%v), but expected string or regexp", s, reflect.TypeOf(s))
+			}
+
+			switch s := c.Stderr.(type) {
+			case string:
+				require.Equal(t, s, stderr.String())
+			case *regexp.Regexp:
+				require.Regexp(t, s, stderr.String())
+			case nil:
+				require.Empty(t, stderr.String())
+			default:
+				require.Fail(t, "unexpected stderr type", "found %v (%v), but expected string or regexp", s, reflect.TypeOf(s))
+			}
+		})
+	}
+}
+
+func (tc *NomadExecE2ETest) AfterAll(f *framework.F) {
+	jobs := tc.Nomad().Jobs()
+	if tc.jobID != "" {
+		jobs.Deregister(tc.jobID, true, nil)
+	}
+	tc.Nomad().System().GarbageCollect()
+}
+
+func newTestStdin(tty bool, d string) io.Reader {
+	pr, pw := io.Pipe()
+	go func() {
+		pw.Write([]byte(d))
+
+		// when testing TTY, leave connection open for the entire duration of command
+		// closing stdin may cause TTY session prematurely before command completes
+		if !tty {
+			pw.Close()
+		}
+
+	}()
+
+	return pr
+}

e2e/nomadexec/testdata/docker.nomad

@@ -0,0 +1,20 @@
+job "nomadexec-docker" {
+  datacenters = ["dc1"]
+
+  group "group" {
+    task "task" {
+      driver = "docker"
+
+      config {
+        image = "busybox:1.29.2"
+        command = "/bin/sleep"
+        args = ["1000"]
+      }
+
+      resources {
+        cpu    = 500
+        memory = 256
+      }
+    }
+  }
+}

internal/testing/apitests/streamingsync_test.go

@@ -0,0 +1,100 @@
+package apitests
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/hashicorp/nomad/api"
+	"github.com/hashicorp/nomad/plugins/drivers"
+	"github.com/stretchr/testify/require"
+)
+
+// TestExecStreamingInputIsInSync asserts that a rountrip of exec streaming input doesn't lose any data
+func TestExecStreamingInputIsInSync(t *testing.T) {
+	cases := []struct {
+		name  string
+		input api.ExecStreamingInput
+	}{
+		{
+			"stdin_data",
+			api.ExecStreamingInput{Stdin: &api.ExecStreamingIOOperation{Data: []byte("hello there")}},
+		},
+		{
+			"stdin_close",
+			api.ExecStreamingInput{Stdin: &api.ExecStreamingIOOperation{Close: true}},
+		},
+		{
+			"tty_size",
+			api.ExecStreamingInput{TTYSize: &api.TerminalSize{Height: 10, Width: 20}},
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			b, err := json.Marshal(c.input)
+			require.NoError(t, err)
+
+			var proto drivers.ExecTaskStreamingRequestMsg
+			err = json.Unmarshal(b, &proto)
+			require.NoError(t, err)
+
+			protoB, err := json.Marshal(proto)
+			require.NoError(t, err)
+
+			var roundtrip api.ExecStreamingInput
+			err = json.Unmarshal(protoB, &roundtrip)
+			require.NoError(t, err)
+
+			require.EqualValues(t, c.input, roundtrip)
+		})
+	}
+}
+
+// TestExecStreamingOutputIsInSync asserts that a rountrip of exec streaming input doesn't lose any data
+func TestExecStreamingOutputIsInSync(t *testing.T) {
+	cases := []struct {
+		name  string
+		input api.ExecStreamingOutput
+	}{
+		{
+			"stdout_data",
+			api.ExecStreamingOutput{Stdout: &api.ExecStreamingIOOperation{Data: []byte("hello there")}},
+		},
+		{
+			"stdout_close",
+			api.ExecStreamingOutput{Stdout: &api.ExecStreamingIOOperation{Close: true}},
+		},
+		{
+			"stderr_data",
+			api.ExecStreamingOutput{Stderr: &api.ExecStreamingIOOperation{Data: []byte("hello there")}},
+		},
+		{
+			"stderr_close",
+			api.ExecStreamingOutput{Stderr: &api.ExecStreamingIOOperation{Close: true}},
+		},
+		{
+			"exited",
+			api.ExecStreamingOutput{Exited: true, Result: &api.ExecStreamingExitResult{ExitCode: 21}},
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			b, err := json.Marshal(c.input)
+			require.NoError(t, err)
+
+			var proto drivers.ExecTaskStreamingResponseMsg
+			err = json.Unmarshal(b, &proto)
+			require.NoError(t, err)
+
+			protoB, err := json.Marshal(proto)
+			require.NoError(t, err)
+
+			var roundtrip api.ExecStreamingOutput
+			err = json.Unmarshal(protoB, &roundtrip)
+			require.NoError(t, err)
+
+			require.EqualValues(t, c.input, roundtrip)
+		})
+	}
+}

nomad/client_alloc_endpoint.go

@@ -2,11 +2,16 @@ package nomad
 
 import (
 	"errors"
+	"fmt"
+	"io"
+	"net"
 	"time"
 
 	metrics "github.com/armon/go-metrics"
 	log "github.com/hashicorp/go-hclog"
 	cstructs "github.com/hashicorp/nomad/client/structs"
+	"github.com/hashicorp/nomad/helper"
+	"github.com/ugorji/go/codec"
 
 	"github.com/hashicorp/nomad/acl"
 	"github.com/hashicorp/nomad/nomad/structs"
@@ -19,6 +24,10 @@ type ClientAllocations struct {
 	logger log.Logger
 }
 
+func (a *ClientAllocations) register() {
+	a.srv.streamingRpcs.Register("Allocations.Exec", a.exec)
+}
+
 // GarbageCollectAll is used to garbage collect all allocations on a client.
 func (a *ClientAllocations) GarbageCollectAll(args *structs.NodeSpecificRequest, reply *structs.GenericResponse) error {
 	// We only allow stale reads since the only potentially stale information is
@@ -287,3 +296,125 @@ func (a *ClientAllocations) Stats(args *cstructs.AllocStatsRequest, reply *cstru
 	// Make the RPC
 	return NodeRpc(state.Session, "Allocations.Stats", args, reply)
 }
+
+// exec is used to execute command in a running task
+func (a *ClientAllocations) exec(conn io.ReadWriteCloser) {
+	defer conn.Close()
+	defer metrics.MeasureSince([]string{"nomad", "alloc", "exec"}, time.Now())
+
+	// Decode the arguments
+	var args cstructs.AllocExecRequest
+	decoder := codec.NewDecoder(conn, structs.MsgpackHandle)
+	encoder := codec.NewEncoder(conn, structs.MsgpackHandle)
+
+	if err := decoder.Decode(&args); err != nil {
+		handleStreamResultError(err, helper.Int64ToPtr(500), encoder)
+		return
+	}
+
+	// Check if we need to forward to a different region
+	if r := args.RequestRegion(); r != a.srv.Region() {
+		forwardRegionStreamingRpc(a.srv, conn, encoder, &args, "Allocations.Exec",
+			args.AllocID, &args.QueryOptions)
+		return
+	}
+
+	// Check node read permissions
+	if aclObj, err := a.srv.ResolveToken(args.AuthToken); err != nil {
+		handleStreamResultError(err, nil, encoder)
+		return
+	} else if aclObj != nil {
+		// client ultimately checks if AllocNodeExec is required
+		exec := aclObj.AllowNsOp(args.QueryOptions.Namespace, acl.NamespaceCapabilityAllocExec)
+		if !exec {
+			handleStreamResultError(structs.ErrPermissionDenied, nil, encoder)
+			return
+		}
+	}
+
+	// Verify the arguments.
+	if args.AllocID == "" {
+		handleStreamResultError(errors.New("missing AllocID"), helper.Int64ToPtr(400), encoder)
+		return
+	}
+
+	// Retrieve the allocation
+	snap, err := a.srv.State().Snapshot()
+	if err != nil {
+		handleStreamResultError(err, nil, encoder)
+		return
+	}
+
+	alloc, err := snap.AllocByID(nil, args.AllocID)
+	if err != nil {
+		handleStreamResultError(err, nil, encoder)
+		return
+	}
+	if alloc == nil {
+		handleStreamResultError(structs.NewErrUnknownAllocation(args.AllocID), helper.Int64ToPtr(404), encoder)
+		return
+	}
+	nodeID := alloc.NodeID
+
+	// Make sure Node is valid and new enough to support RPC
+	node, err := snap.NodeByID(nil, nodeID)
+	if err != nil {
+		handleStreamResultError(err, helper.Int64ToPtr(500), encoder)
+		return
+	}
+
+	if node == nil {
+		err := fmt.Errorf("Unknown node %q", nodeID)
+		handleStreamResultError(err, helper.Int64ToPtr(400), encoder)
+		return
+	}
+
+	if err := nodeSupportsRpc(node); err != nil {
+		handleStreamResultError(err, helper.Int64ToPtr(400), encoder)
+		return
+	}
+
+	// Get the connection to the client either by forwarding to another server
+	// or creating a direct stream
+	var clientConn net.Conn
+	state, ok := a.srv.getNodeConn(nodeID)
+	if !ok {
+		// Determine the Server that has a connection to the node.
+		srv, err := a.srv.serverWithNodeConn(nodeID, a.srv.Region())
+		if err != nil {
+			var code *int64
+			if structs.IsErrNoNodeConn(err) {
+				code = helper.Int64ToPtr(404)
+			}
+			handleStreamResultError(err, code, encoder)
+			return
+		}
+
+		// Get a connection to the server
+		conn, err := a.srv.streamingRpc(srv, "Allocations.Exec")
+		if err != nil {
+			handleStreamResultError(err, nil, encoder)
+			return
+		}
+
+		clientConn = conn
+	} else {
+		stream, err := NodeStreamingRpc(state.Session, "Allocations.Exec")
+		if err != nil {
+			handleStreamResultError(err, nil, encoder)
+			return
+		}
+		clientConn = stream
+	}
+	defer clientConn.Close()
+
+	// Send the request.
+	outEncoder := codec.NewEncoder(clientConn, structs.MsgpackHandle)
+	if err := outEncoder.Encode(args); err != nil {
+		handleStreamResultError(err, nil, encoder)
+		return
+	}
+
+	structs.Bridge(conn, clientConn)
+	return
+}

nomad/client_alloc_endpoint_test.go

@@ -1,8 +1,13 @@
 package nomad
 
 import (
+	"encoding/json"
 	"fmt"
+	"io"
+	"net"
+	"strings"
 	"testing"
+	"time"
 
 	msgpackrpc "github.com/hashicorp/net-rpc-msgpackrpc"
 	"github.com/hashicorp/nomad/acl"
@@ -12,9 +17,12 @@ import (
 	"github.com/hashicorp/nomad/helper/uuid"
 	"github.com/hashicorp/nomad/nomad/mock"
 	"github.com/hashicorp/nomad/nomad/structs"
+	nstructs "github.com/hashicorp/nomad/nomad/structs"
+	"github.com/hashicorp/nomad/plugins/drivers"
 	"github.com/hashicorp/nomad/testutil"
 	"github.com/kr/pretty"
 	"github.com/stretchr/testify/require"
+	"github.com/ugorji/go/codec"
 )
 
 func TestClientAllocations_GarbageCollectAll_Local(t *testing.T) {
@@ -1040,3 +1048,179 @@ func TestClientAllocations_Restart_ACL(t *testing.T) {
 		})
 	}
 }
+
+// TestAlloc_ExecStreaming asserts that exec task requests are forwarded
+// to appropriate server or remote regions
+func TestAlloc_ExecStreaming(t *testing.T) {
+	t.Skip("try skipping")
+	t.Parallel()
+
+	////// Nomad clusters topology - not specific to test
+	localServer := TestServer(t, nil)
+	defer localServer.Shutdown()
+
+	remoteServer := TestServer(t, func(c *Config) {
+		c.DevDisableBootstrap = true
+	})
+	defer remoteServer.Shutdown()
+
+	remoteRegionServer := TestServer(t, func(c *Config) {
+		c.Region = "two"
+	})
+	defer remoteRegionServer.Shutdown()
+
+	TestJoin(t, localServer, remoteServer)
+	TestJoin(t, localServer, remoteRegionServer)
+	testutil.WaitForLeader(t, localServer.RPC)
+	testutil.WaitForLeader(t, remoteServer.RPC)
+	testutil.WaitForLeader(t, remoteRegionServer.RPC)
+
+	c, cleanup := client.TestClient(t, func(c *config.Config) {
+		c.Servers = []string{localServer.config.RPCAddr.String()}
+	})
+	defer cleanup()
+
+	// Wait for the client to connect
+	testutil.WaitForResult(func() (bool, error) {
+		nodes := remoteServer.connectedNodes()
+		return len(nodes) == 1, nil
+	}, func(err error) {
+		require.NoError(t, err, "failed to have a client")
+	})
+
+	// Force remove the connection locally in case it exists
+	remoteServer.nodeConnsLock.Lock()
+	delete(remoteServer.nodeConns, c.NodeID())
+	remoteServer.nodeConnsLock.Unlock()
+
+	///// Start task
+	a := mock.BatchAlloc()
+	a.NodeID = c.NodeID()
+	a.Job.Type = structs.JobTypeBatch
+	a.Job.TaskGroups[0].Count = 1
+	a.Job.TaskGroups[0].Tasks[0].Config = map[string]interface{}{
+		"run_for": "20s",
+		"exec_command": map[string]interface{}{
+			"run_for":       "1ms",
+			"stdout_string": "expected output",
+			"exit_code":     3,
+		},
+	}
+
+	// Upsert the allocation
+	localState := localServer.State()
+	require.Nil(t, localState.UpsertJob(999, a.Job))
+	require.Nil(t, localState.UpsertAllocs(1003, []*structs.Allocation{a}))
+	remoteState := remoteServer.State()
+	require.Nil(t, remoteState.UpsertJob(999, a.Job))
+	require.Nil(t, remoteState.UpsertAllocs(1003, []*structs.Allocation{a}))
+
+	// Wait for the client to run the allocation
+	testutil.WaitForResult(func() (bool, error) {
+		alloc, err := localState.AllocByID(nil, a.ID)
+		if err != nil {
+			return false, err
+		}
+		if alloc == nil {
+			return false, fmt.Errorf("unknown alloc")
+		}
+		if alloc.ClientStatus != structs.AllocClientStatusRunning {
+			return false, fmt.Errorf("alloc client status: %v", alloc.ClientStatus)
+		}
+
+		return true, nil
+	}, func(err error) {
+		require.NoError(t, err, "task didn't start yet")
+	})
+
+	/////////  Actually run query now
+	cases := []struct {
+		name string
+		rpc  func(string) (structs.StreamingRpcHandler, error)
+	}{
+		{"client", c.StreamingRpcHandler},
+		{"local_server", localServer.StreamingRpcHandler},
+		{"remote_server", remoteServer.StreamingRpcHandler},
+		{"remote_region", remoteRegionServer.StreamingRpcHandler},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+
+			// Make the request
+			req := &cstructs.AllocExecRequest{
+				AllocID:      a.ID,
+				Task:         a.Job.TaskGroups[0].Tasks[0].Name,
+				Tty:          true,
+				Cmd:          []string{"placeholder command"},
+				QueryOptions: nstructs.QueryOptions{Region: "global"},
+			}
+
+			// Get the handler
+			handler, err := tc.rpc("Allocations.Exec")
+			require.Nil(t, err)
+
+			// Create a pipe
+			p1, p2 := net.Pipe()
+			defer p1.Close()
+			defer p2.Close()
+
+			errCh := make(chan error)
+			frames := make(chan *drivers.ExecTaskStreamingResponseMsg)
+
+			// Start the handler
+			go handler(p2)
+			go decodeFrames(t, p1, frames, errCh)
+
+			// Send the request
+			encoder := codec.NewEncoder(p1, nstructs.MsgpackHandle)
+			require.Nil(t, encoder.Encode(req))
+
+			timeout := time.After(3 * time.Second)
+
+		OUTER:
+			for {
+				select {
+				case <-timeout:
+					require.FailNow(t, "timed out before getting exit code")
+				case err := <-errCh:
+					require.NoError(t, err)
+				case f := <-frames:
+					if f.Exited && f.Result != nil {
+						code := int(f.Result.ExitCode)
+						require.Equal(t, 3, code)
+						break OUTER
+					}
+				}
+			}
+		})
+	}
+}
+
+func decodeFrames(t *testing.T, p1 net.Conn, frames chan<- *drivers.ExecTaskStreamingResponseMsg, errCh chan<- error) {
+	// Start the decoder
+	decoder := codec.NewDecoder(p1, nstructs.MsgpackHandle)
+
+	for {
+		var msg cstructs.StreamErrWrapper
+		if err := decoder.Decode(&msg); err != nil {
+			if err == io.EOF || strings.Contains(err.Error(), "closed") {
+				return
+			}
+			t.Logf("received error decoding: %#v", err)
+
+			errCh <- fmt.Errorf("error decoding: %v", err)
+			return
+		}
+
+		if msg.Error != nil {
+			errCh <- msg.Error
+			continue
+		}
+
+		var frame drivers.ExecTaskStreamingResponseMsg
+		json.Unmarshal(msg.Payload, &frame)
+		t.Logf("received message: %#v", msg)
+		frames <- &frame
+	}
+}

nomad/client_fs_endpoint.go

@@ -33,7 +33,7 @@ func (f *FileSystem) register() {
 // handleStreamResultError is a helper for sending an error with a potential
 // error code. The transmission of the error is ignored if the error has been
 // generated by the closing of the underlying transport.
-func (f *FileSystem) handleStreamResultError(err error, code *int64, encoder *codec.Encoder) {
+func handleStreamResultError(err error, code *int64, encoder *codec.Encoder) {
 	// Nothing to do as the conn is closed
 	if err == io.EOF || strings.Contains(err.Error(), "closed") {
 		return
@@ -48,7 +48,7 @@ func (f *FileSystem) handleStreamResultError(err error, code *int64, encoder *co
 // forwardRegionStreamingRpc is used to make a streaming RPC to a different
 // region. It looks up the allocation in the remote region to determine what
 // remote server can route the request.
-func (f *FileSystem) forwardRegionStreamingRpc(conn io.ReadWriteCloser,
+func forwardRegionStreamingRpc(fsrv *Server, conn io.ReadWriteCloser,
 	encoder *codec.Encoder, args interface{}, method, allocID string, qo *structs.QueryOptions) {
 	// Request the allocation from the target region
 	allocReq := &structs.AllocSpecificRequest{
@@ -56,31 +56,31 @@ func (f *FileSystem) forwardRegionStreamingRpc(conn io.ReadWriteCloser,
 		QueryOptions: *qo,
 	}
 	var allocResp structs.SingleAllocResponse
-	if err := f.srv.forwardRegion(qo.RequestRegion(), "Alloc.GetAlloc", allocReq, &allocResp); err != nil {
-		f.handleStreamResultError(err, nil, encoder)
+	if err := fsrv.forwardRegion(qo.RequestRegion(), "Alloc.GetAlloc", allocReq, &allocResp); err != nil {
+		handleStreamResultError(err, nil, encoder)
 		return
 	}
 
 	if allocResp.Alloc == nil {
-		f.handleStreamResultError(structs.NewErrUnknownAllocation(allocID), helper.Int64ToPtr(404), encoder)
+		handleStreamResultError(structs.NewErrUnknownAllocation(allocID), helper.Int64ToPtr(404), encoder)
 		return
 	}
 
 	// Determine the Server that has a connection to the node.
-	srv, err := f.srv.serverWithNodeConn(allocResp.Alloc.NodeID, qo.RequestRegion())
+	srv, err := fsrv.serverWithNodeConn(allocResp.Alloc.NodeID, qo.RequestRegion())
 	if err != nil {
 		var code *int64
 		if structs.IsErrNoNodeConn(err) {
 			code = helper.Int64ToPtr(404)
 		}
-		f.handleStreamResultError(err, code, encoder)
+		handleStreamResultError(err, code, encoder)
 		return
 	}
 
 	// Get a connection to the server
-	srvConn, err := f.srv.streamingRpc(srv, method)
+	srvConn, err := fsrv.streamingRpc(srv, method)
 	if err != nil {
-		f.handleStreamResultError(err, nil, encoder)
+		handleStreamResultError(err, nil, encoder)
 		return
 	}
 	defer srvConn.Close()
@@ -88,7 +88,7 @@ func (f *FileSystem) forwardRegionStreamingRpc(conn io.ReadWriteCloser,
 	// Send the request.
 	outEncoder := codec.NewEncoder(srvConn, structs.MsgpackHandle)
 	if err := outEncoder.Encode(args); err != nil {
-		f.handleStreamResultError(err, nil, encoder)
+		handleStreamResultError(err, nil, encoder)
 		return
 	}
 
@@ -217,46 +217,46 @@ func (f *FileSystem) stream(conn io.ReadWriteCloser) {
 	encoder := codec.NewEncoder(conn, structs.MsgpackHandle)
 
 	if err := decoder.Decode(&args); err != nil {
-		f.handleStreamResultError(err, helper.Int64ToPtr(500), encoder)
+		handleStreamResultError(err, helper.Int64ToPtr(500), encoder)
 		return
 	}
 
 	// Check if we need to forward to a different region
 	if r := args.RequestRegion(); r != f.srv.Region() {
-		f.forwardRegionStreamingRpc(conn, encoder, &args, "FileSystem.Stream",
+		forwardRegionStreamingRpc(f.srv, conn, encoder, &args, "FileSystem.Stream",
 			args.AllocID, &args.QueryOptions)
 		return
 	}
 
 	// Check node read permissions
 	if aclObj, err := f.srv.ResolveToken(args.AuthToken); err != nil {
-		f.handleStreamResultError(err, nil, encoder)
+		handleStreamResultError(err, nil, encoder)
 		return
 	} else if aclObj != nil && !aclObj.AllowNsOp(args.Namespace, acl.NamespaceCapabilityReadFS) {
-		f.handleStreamResultError(structs.ErrPermissionDenied, nil, encoder)
+		handleStreamResultError(structs.ErrPermissionDenied, nil, encoder)
 		return
 	}
 
 	// Verify the arguments.
 	if args.AllocID == "" {
-		f.handleStreamResultError(errors.New("missing AllocID"), helper.Int64ToPtr(400), encoder)
+		handleStreamResultError(errors.New("missing AllocID"), helper.Int64ToPtr(400), encoder)
 		return
 	}
 
 	// Retrieve the allocation
 	snap, err := f.srv.State().Snapshot()
 	if err != nil {
-		f.handleStreamResultError(err, nil, encoder)
+		handleStreamResultError(err, nil, encoder)
 		return
 	}
 
 	alloc, err := snap.AllocByID(nil, args.AllocID)
 	if err != nil {
-		f.handleStreamResultError(err, nil, encoder)
+		handleStreamResultError(err, nil, encoder)
 		return
 	}
 	if alloc == nil {
-		f.handleStreamResultError(structs.NewErrUnknownAllocation(args.AllocID), helper.Int64ToPtr(404), encoder)
+		handleStreamResultError(structs.NewErrUnknownAllocation(args.AllocID), helper.Int64ToPtr(404), encoder)
 		return
 	}
 	nodeID := alloc.NodeID
@@ -264,18 +264,18 @@ func (f *FileSystem) stream(conn io.ReadWriteCloser) {
 	// Make sure Node is valid and new enough to support RPC
 	node, err := snap.NodeByID(nil, nodeID)
 	if err != nil {
-		f.handleStreamResultError(err, helper.Int64ToPtr(500), encoder)
+		handleStreamResultError(err, helper.Int64ToPtr(500), encoder)
 		return
 	}
 
 	if node == nil {
 		err := fmt.Errorf("Unknown node %q", nodeID)
-		f.handleStreamResultError(err, helper.Int64ToPtr(400), encoder)
+		handleStreamResultError(err, helper.Int64ToPtr(400), encoder)
 		return
 	}
 
 	if err := nodeSupportsRpc(node); err != nil {
-		f.handleStreamResultError(err, helper.Int64ToPtr(400), encoder)
+		handleStreamResultError(err, helper.Int64ToPtr(400), encoder)
 		return
 	}
 
@@ -291,14 +291,14 @@ func (f *FileSystem) stream(conn io.ReadWriteCloser) {
 			if structs.IsErrNoNodeConn(err) {
 				code = helper.Int64ToPtr(404)
 			}
-			f.handleStreamResultError(err, code, encoder)
+			handleStreamResultError(err, code, encoder)
 			return
 		}
 
 		// Get a connection to the server
 		conn, err := f.srv.streamingRpc(srv, "FileSystem.Stream")
 		if err != nil {
-			f.handleStreamResultError(err, nil, encoder)
+			handleStreamResultError(err, nil, encoder)
 			return
 		}
 
@@ -306,7 +306,7 @@ func (f *FileSystem) stream(conn io.ReadWriteCloser) {
 	} else {
 		stream, err := NodeStreamingRpc(state.Session, "FileSystem.Stream")
 		if err != nil {
-			f.handleStreamResultError(err, nil, encoder)
+			handleStreamResultError(err, nil, encoder)
 			return
 		}
 		clientConn = stream
@@ -316,7 +316,7 @@ func (f *FileSystem) stream(conn io.ReadWriteCloser) {
 	// Send the request.
 	outEncoder := codec.NewEncoder(clientConn, structs.MsgpackHandle)
 	if err := outEncoder.Encode(args); err != nil {
-		f.handleStreamResultError(err, nil, encoder)
+		handleStreamResultError(err, nil, encoder)
 		return
 	}
 
@@ -335,50 +335,50 @@ func (f *FileSystem) logs(conn io.ReadWriteCloser) {
 	encoder := codec.NewEncoder(conn, structs.MsgpackHandle)
 
 	if err := decoder.Decode(&args); err != nil {
-		f.handleStreamResultError(err, helper.Int64ToPtr(500), encoder)
+		handleStreamResultError(err, helper.Int64ToPtr(500), encoder)
 		return
 	}
 
 	// Check if we need to forward to a different region
 	if r := args.RequestRegion(); r != f.srv.Region() {
-		f.forwardRegionStreamingRpc(conn, encoder, &args, "FileSystem.Logs",
+		forwardRegionStreamingRpc(f.srv, conn, encoder, &args, "FileSystem.Logs",
 			args.AllocID, &args.QueryOptions)
 		return
 	}
 
 	// Check node read permissions
 	if aclObj, err := f.srv.ResolveToken(args.AuthToken); err != nil {
-		f.handleStreamResultError(err, nil, encoder)
+		handleStreamResultError(err, nil, encoder)
 		return
 	} else if aclObj != nil {
 		readfs := aclObj.AllowNsOp(args.QueryOptions.Namespace, acl.NamespaceCapabilityReadFS)
 		logs := aclObj.AllowNsOp(args.QueryOptions.Namespace, acl.NamespaceCapabilityReadLogs)
 		if !readfs && !logs {
-			f.handleStreamResultError(structs.ErrPermissionDenied, nil, encoder)
+			handleStreamResultError(structs.ErrPermissionDenied, nil, encoder)
 			return
 		}
 	}
 
 	// Verify the arguments.
 	if args.AllocID == "" {
-		f.handleStreamResultError(errors.New("missing AllocID"), helper.Int64ToPtr(400), encoder)
+		handleStreamResultError(errors.New("missing AllocID"), helper.Int64ToPtr(400), encoder)
 		return
 	}
 
 	// Retrieve the allocation
 	snap, err := f.srv.State().Snapshot()
 	if err != nil {
-		f.handleStreamResultError(err, nil, encoder)
+		handleStreamResultError(err, nil, encoder)
 		return
 	}
 
 	alloc, err := snap.AllocByID(nil, args.AllocID)
 	if err != nil {
-		f.handleStreamResultError(err, nil, encoder)
+		handleStreamResultError(err, nil, encoder)
 		return
 	}
 	if alloc == nil {
-		f.handleStreamResultError(structs.NewErrUnknownAllocation(args.AllocID), helper.Int64ToPtr(404), encoder)
+		handleStreamResultError(structs.NewErrUnknownAllocation(args.AllocID), helper.Int64ToPtr(404), encoder)
 		return
 	}
 	nodeID := alloc.NodeID
@@ -386,18 +386,18 @@ func (f *FileSystem) logs(conn io.ReadWriteCloser) {
 	// Make sure Node is valid and new enough to support RPC
 	node, err := snap.NodeByID(nil, nodeID)
 	if err != nil {
-		f.handleStreamResultError(err, helper.Int64ToPtr(500), encoder)
+		handleStreamResultError(err, helper.Int64ToPtr(500), encoder)
 		return
 	}
 
 	if node == nil {
 		err := fmt.Errorf("Unknown node %q", nodeID)
-		f.handleStreamResultError(err, helper.Int64ToPtr(400), encoder)
+		handleStreamResultError(err, helper.Int64ToPtr(400), encoder)
 		return
 	}
 
 	if err := nodeSupportsRpc(node); err != nil {
-		f.handleStreamResultError(err, helper.Int64ToPtr(400), encoder)
+		handleStreamResultError(err, helper.Int64ToPtr(400), encoder)
 		return
 	}
 
@@ -413,14 +413,14 @@ func (f *FileSystem) logs(conn io.ReadWriteCloser) {
 			if structs.IsErrNoNodeConn(err) {
 				code = helper.Int64ToPtr(404)
 			}
-			f.handleStreamResultError(err, code, encoder)
+			handleStreamResultError(err, code, encoder)
 			return
 		}
 
 		// Get a connection to the server
 		conn, err := f.srv.streamingRpc(srv, "FileSystem.Logs")
 		if err != nil {
-			f.handleStreamResultError(err, nil, encoder)
+			handleStreamResultError(err, nil, encoder)
 			return
 		}
 
@@ -428,7 +428,7 @@ func (f *FileSystem) logs(conn io.ReadWriteCloser) {
 	} else {
 		stream, err := NodeStreamingRpc(state.Session, "FileSystem.Logs")
 		if err != nil {
-			f.handleStreamResultError(err, nil, encoder)
+			handleStreamResultError(err, nil, encoder)
 			return
 		}
 		clientConn = stream
@@ -438,7 +438,7 @@ func (f *FileSystem) logs(conn io.ReadWriteCloser) {
 	// Send the request.
 	outEncoder := codec.NewEncoder(clientConn, structs.MsgpackHandle)
 	if err := outEncoder.Encode(args); err != nil {
-		f.handleStreamResultError(err, nil, encoder)
+		handleStreamResultError(err, nil, encoder)
 		return
 	}
 

nomad/server.go

@@ -1027,6 +1027,7 @@ func (s *Server) setupRpcServer(server *rpc.Server, ctx *RPCContext) {
 		// Client endpoints
 		s.staticEndpoints.ClientStats = &ClientStats{srv: s, logger: s.logger.Named("client_stats")}
 		s.staticEndpoints.ClientAllocations = &ClientAllocations{srv: s, logger: s.logger.Named("client_allocs")}
+		s.staticEndpoints.ClientAllocations.register()
 
 		// Streaming endpoints
 		s.staticEndpoints.FileSystem = &FileSystem{srv: s, logger: s.logger.Named("client_fs")}

plugins/drivers/client.go

@@ -392,5 +392,70 @@ func (d *driverPluginClient) ExecTask(taskID string, cmd []string, timeout time.
 	}
 
 	return result, nil
-
+}
+
+var _ ExecTaskStreamingRawDriver = (*driverPluginClient)(nil)
+
+func (d *driverPluginClient) ExecTaskStreamingRaw(ctx context.Context,
+	taskID string,
+	command []string,
+	tty bool,
+	execStream ExecTaskStream) error {
+
+	stream, err := d.client.ExecTaskStreaming(ctx)
+	if err != nil {
+		return grpcutils.HandleGrpcErr(err, d.doneCtx)
+	}
+
+	err = stream.Send(&proto.ExecTaskStreamingRequest{
+		Setup: &proto.ExecTaskStreamingRequest_Setup{
+			TaskId:  taskID,
+			Command: command,
+			Tty:     tty,
+		},
+	})
+	if err != nil {
+		return grpcutils.HandleGrpcErr(err, d.doneCtx)
+	}
+
+	errCh := make(chan error, 1)
+
+	go func() {
+		for {
+			m, err := execStream.Recv()
+			if err == io.EOF {
+				return
+			} else if err != nil {
+				errCh <- err
+				return
+			}
+
+			if err := stream.Send(m); err != nil {
+				errCh <- err
+				return
+			}
+
+		}
+	}()
+
+	for {
+		select {
+		case err := <-errCh:
+			return err
+		default:
+		}
+
+		m, err := stream.Recv()
+		if err == io.EOF {
+			// Once we get to the end of stream successfully, we can ignore errCh:
+			// e.g. input write failures after process terminates shouldn't cause method to fail
+			return nil
+		} else if err != nil {
+			return err
+		}
+
+		if err := execStream.Send(m); err != nil {
+			return err
+		}
+	}
 }

plugins/drivers/driver.go

@@ -15,6 +15,7 @@ import (
 	"github.com/hashicorp/nomad/helper"
 	"github.com/hashicorp/nomad/nomad/structs"
 	"github.com/hashicorp/nomad/plugins/base"
+	"github.com/hashicorp/nomad/plugins/drivers/proto"
 	"github.com/hashicorp/nomad/plugins/shared/hclspec"
 	pstructs "github.com/hashicorp/nomad/plugins/shared/structs"
 	"github.com/zclconf/go-cty/cty"
@@ -56,6 +57,28 @@ type DriverPlugin interface {
 	ExecTask(taskID string, cmd []string, timeout time.Duration) (*ExecTaskResult, error)
 }
 
+// ExecTaskStreamingDriver marks that a driver supports streaming exec task.  This represents a user friendly
+// interface to implement, as an alternative to the ExecTaskStreamingRawDriver, the low level interface.
+type ExecTaskStreamingDriver interface {
+	ExecTaskStreaming(ctx context.Context, taskID string, execOptions *ExecOptions) (*ExitResult, error)
+}
+
+type ExecOptions struct {
+	// Command is command to run
+	Command []string
+
+	// Tty indicates whether pseudo-terminal is to be allocated
+	Tty bool
+
+	// streams
+	Stdin  io.ReadCloser
+	Stdout io.WriteCloser
+	Stderr io.WriteCloser
+
+	// terminal size channel
+	ResizeCh <-chan TerminalSize
+}
+
 // InternalDriverPlugin is an interface that exposes functions that are only
 // implemented by internal driver plugins.
 type InternalDriverPlugin interface {
@@ -127,6 +150,11 @@ type Capabilities struct {
 	FSIsolation FSIsolation
 }
 
+type TerminalSize struct {
+	Height int
+	Width  int
+}
+
 type TaskConfig struct {
 	ID              string
 	JobName         string
@@ -406,3 +434,40 @@ func (d *DriverNetwork) Hash() []byte {
 	}
 	return h.Sum(nil)
 }
+
+//// helper types for operating on raw exec operation
+// we alias proto instances as much as possible to avoid conversion overhead
+
+// ExecTaskStreamingRawDriver represents a low-level interface for executing a streaming exec
+// call, and is intended to be used when driver instance is to delegate exec handling to another
+// backend, e.g. to a executor or a driver behind a grpc/rpc protocol
+//
+// Nomad client would prefer this interface method over `ExecTaskStreaming` if driver implements it.
+type ExecTaskStreamingRawDriver interface {
+	ExecTaskStreamingRaw(
+		ctx context.Context,
+		taskID string,
+		command []string,
+		tty bool,
+		stream ExecTaskStream) error
+}
+
+// ExecTaskStream represents a stream of exec streaming messages,
+// and is a handle to get stdin and tty size and send back
+// stdout/stderr and exit operations.
+//
+// The methods are not concurrent safe; callers must ensure that methods are called
+// from at most one goroutine.
+type ExecTaskStream interface {
+	// Send relays response message back to API.
+	//
+	// The call is synchronous and no references to message is held: once
+	// method call completes, the message reference can be reused or freed.
+	Send(*ExecTaskStreamingResponseMsg) error
+
+	// Receive exec streaming messages from API.  Returns `io.EOF` on completion of stream.
+	Recv() (*ExecTaskStreamingRequestMsg, error)
+}
+
+type ExecTaskStreamingRequestMsg = proto.ExecTaskStreamingRequest
+type ExecTaskStreamingResponseMsg = proto.ExecTaskStreamingResponse

plugins/drivers/execstreaming.go

@@ -0,0 +1,185 @@
+package drivers
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"sync"
+
+	"github.com/hashicorp/nomad/plugins/drivers/proto"
+)
+
+// StreamToExecOptions is a convenience method to convert exec stream into
+// ExecOptions object.
+func StreamToExecOptions(
+	ctx context.Context,
+	command []string,
+	tty bool,
+	stream ExecTaskStream) (*ExecOptions, <-chan error) {
+
+	inReader, inWriter := io.Pipe()
+	outReader, outWriter := io.Pipe()
+	errReader, errWriter := io.Pipe()
+	resize := make(chan TerminalSize, 2)
+
+	errCh := make(chan error, 3)
+
+	// handle input
+	go func() {
+		for {
+			msg, err := stream.Recv()
+			if err == io.EOF {
+				return
+			} else if err != nil {
+				errCh <- err
+				return
+			}
+
+			if msg.Stdin != nil && !msg.Stdin.Close {
+				_, err := inWriter.Write(msg.Stdin.Data)
+				if err != nil {
+					errCh <- err
+					return
+				}
+			} else if msg.Stdin != nil && msg.Stdin.Close {
+				inWriter.Close()
+			} else if msg.TtySize != nil {
+				select {
+				case resize <- TerminalSize{
+					Height: int(msg.TtySize.Height),
+					Width:  int(msg.TtySize.Width),
+				}:
+				case <-ctx.Done():
+					// process terminated before resize is processed
+					return
+				}
+			} else if isHeartbeat(msg) {
+				// do nothing
+			} else {
+				errCh <- fmt.Errorf("unexpected message type: %#v", msg)
+			}
+		}
+	}()
+
+	var sendLock sync.Mutex
+	send := func(v *ExecTaskStreamingResponseMsg) error {
+		sendLock.Lock()
+		defer sendLock.Unlock()
+
+		return stream.Send(v)
+	}
+
+	var outWg sync.WaitGroup
+	outWg.Add(2)
+	// handle Stdout
+	go func() {
+		defer outWg.Done()
+
+		reader := outReader
+		bytes := make([]byte, 1024)
+		msg := &ExecTaskStreamingResponseMsg{Stdout: &proto.ExecTaskStreamingIOOperation{}}
+
+		for {
+			n, err := reader.Read(bytes)
+			// always send data if we read some
+			if n != 0 {
+				msg.Stdout.Data = bytes[:n]
+				if err := send(msg); err != nil {
+					errCh <- err
+					break
+				}
+			}
+
+			// then handle error
+			if err == io.EOF || err == io.ErrClosedPipe {
+				msg.Stdout.Data = nil
+				msg.Stdout.Close = true
+
+				if err := send(msg); err != nil {
+					errCh <- err
+				}
+				break
+			}
+
+			if err != nil {
+				errCh <- err
+				break
+			}
+		}
+
+	}()
+	// handle Stderr
+	go func() {
+		defer outWg.Done()
+
+		reader := errReader
+		bytes := make([]byte, 1024)
+		msg := &ExecTaskStreamingResponseMsg{Stderr: &proto.ExecTaskStreamingIOOperation{}}
+
+		for {
+			n, err := reader.Read(bytes)
+			// always send data if we read some
+			if n != 0 {
+				msg.Stderr.Data = bytes[:n]
+				if err := send(msg); err != nil {
+					errCh <- err
+					break
+				}
+			}
+
+			// then handle error
+			if err == io.EOF || err == io.ErrClosedPipe {
+				msg.Stderr.Data = nil
+				msg.Stderr.Close = true
+
+				if err := send(msg); err != nil {
+					errCh <- err
+				}
+				break
+			}
+
+			if err != nil {
+				errCh <- err
+				break
+			}
+		}
+
+	}()
+
+	doneCh := make(chan error, 1)
+	go func() {
+		outWg.Wait()
+
+		select {
+		case err := <-errCh:
+			doneCh <- err
+		default:
+		}
+		close(doneCh)
+	}()
+
+	return &ExecOptions{
+		Command: command,
+		Tty:     tty,
+
+		Stdin:  inReader,
+		Stdout: outWriter,
+		Stderr: errWriter,
+
+		ResizeCh: resize,
+	}, doneCh
+}
+
+func NewExecStreamingResponseExit(exitCode int) *ExecTaskStreamingResponseMsg {
+	return &ExecTaskStreamingResponseMsg{
+		Exited: true,
+		Result: &proto.ExitResult{
+			ExitCode: int32(exitCode),
+		},
+	}
+
+}
+
+func isHeartbeat(r *ExecTaskStreamingRequestMsg) bool {
+	return r.Stdin == nil && r.Setup == nil && r.TtySize == nil
+}

plugins/drivers/proto/driver.proto

@@ -70,6 +70,10 @@ service Driver {
 
     // ExecTask executes a command inside the tasks execution context
     rpc ExecTask(ExecTaskRequest) returns (ExecTaskResponse) {}
+
+    // ExecTaskStreaming executes a command inside the tasks execution context
+    // and streams back results
+    rpc ExecTaskStreaming(stream ExecTaskStreamingRequest) returns (stream ExecTaskStreamingResponse) {}
 }
 
 message TaskConfigSchemaRequest {}
@@ -280,6 +284,36 @@ message ExecTaskResponse {
     ExitResult result = 3;
 }
 
+message ExecTaskStreamingIOOperation {
+    bytes data = 1;
+    bool close = 2;
+}
+
+message ExecTaskStreamingRequest {
+    message Setup {
+        string task_id = 1;
+        repeated string command = 2;
+        bool tty = 3;
+    }
+
+    message TerminalSize {
+        int32 height = 1;
+        int32 width = 2;
+    }
+
+    Setup setup = 1;
+    TerminalSize tty_size = 2;
+    ExecTaskStreamingIOOperation stdin = 3;
+}
+
+message ExecTaskStreamingResponse {
+    ExecTaskStreamingIOOperation stdout = 1;
+    ExecTaskStreamingIOOperation stderr = 2;
+
+    bool exited = 3;
+    ExitResult result = 4;
+}
+
 message DriverCapabilities {
 
     // SendSignals indicates that the driver can send process signals (ex. SIGUSR1)

plugins/drivers/server.go

@@ -277,6 +277,60 @@ func (b *driverPluginServer) ExecTask(ctx context.Context, req *proto.ExecTaskRe
 	return resp, nil
 }
 
+func (b *driverPluginServer) ExecTaskStreaming(server proto.Driver_ExecTaskStreamingServer) error {
+	msg, err := server.Recv()
+	if err != nil {
+		return fmt.Errorf("failed to receive initial message: %v", err)
+	}
+
+	if msg.Setup == nil {
+		return fmt.Errorf("first message should always be setup")
+	}
+
+	if impl, ok := b.impl.(ExecTaskStreamingRawDriver); ok {
+		return impl.ExecTaskStreamingRaw(server.Context(),
+			msg.Setup.TaskId, msg.Setup.Command, msg.Setup.Tty,
+			server)
+	}
+
+	d, ok := b.impl.(ExecTaskStreamingDriver)
+	if !ok {
+		return fmt.Errorf("driver does not support exec")
+	}
+
+	execOpts, errCh := StreamToExecOptions(server.Context(),
+		msg.Setup.Command, msg.Setup.Tty,
+		server)
+
+	result, err := d.ExecTaskStreaming(server.Context(),
+		msg.Setup.TaskId, execOpts)
+
+	execOpts.Stdout.Close()
+	execOpts.Stderr.Close()
+
+	if err != nil {
+		return err
+	}
+
+	// wait for copy to be done
+	select {
+	case err = <-errCh:
+	case <-server.Context().Done():
+		err = fmt.Errorf("exec timed out: %v", server.Context().Err())
+	}
+
+	if err != nil {
+		return err
+	}
+
+	server.Send(&ExecTaskStreamingResponseMsg{
+		Exited: true,
+		Result: exitResultToProto(result),
+	})
+
+	return err
+}
+
 func (b *driverPluginServer) SignalTask(ctx context.Context, req *proto.SignalTaskRequest) (*proto.SignalTaskResponse, error) {
 	err := b.impl.SignalTask(req.TaskId, req.Signal)
 	if err != nil {

plugins/drivers/testutils/exec_testing.go

@@ -0,0 +1,354 @@
+package testutils
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"reflect"
+	"regexp"
+	"runtime"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/nomad/plugins/drivers"
+	dproto "github.com/hashicorp/nomad/plugins/drivers/proto"
+	"github.com/stretchr/testify/require"
+)
+
+func ExecTaskStreamingConformanceTests(t *testing.T, driver *DriverHarness, taskID string) {
+	t.Helper()
+
+	if runtime.GOOS == "windows" {
+		// tests assume unix-ism now
+		t.Skip("test assume unix tasks")
+	}
+
+	TestExecTaskStreamingBasicResponses(t, driver, taskID)
+	TestExecFSIsolation(t, driver, taskID)
+}
+
+var ExecTaskStreamingBasicCases = []struct {
+	Name     string
+	Command  string
+	Tty      bool
+	Stdin    string
+	Stdout   interface{}
+	Stderr   interface{}
+	ExitCode int
+}{
+	{
+		Name:     "notty: basic",
+		Command:  "echo hello stdout; echo hello stderr >&2; exit 43",
+		Tty:      false,
+		Stdout:   "hello stdout\n",
+		Stderr:   "hello stderr\n",
+		ExitCode: 43,
+	},
+	{
+		Name:     "notty: streaming",
+		Command:  "for n in 1 2 3; do echo $n; sleep 1; done",
+		Tty:      false,
+		Stdout:   "1\n2\n3\n",
+		ExitCode: 0,
+	},
+	{
+		Name:     "notty: stty check",
+		Command:  "stty size",
+		Tty:      false,
+		Stderr:   regexp.MustCompile("stty: .?standard input.?: Inappropriate ioctl for device\n"),
+		ExitCode: 1,
+	},
+	{
+		Name:     "notty: stdin passing",
+		Command:  "echo hello from command; head -n1",
+		Tty:      false,
+		Stdin:    "hello from stdin\n",
+		Stdout:   "hello from command\nhello from stdin\n",
+		ExitCode: 0,
+	},
+	{
+		Name:    "notty: children processes",
+		Command: "(( sleep 3; echo from background ) & ); echo from main; exec sleep 1",
+		Tty:     false,
+		// when not using tty; wait for all processes to exit matching behavior of `docker exec`
+		Stdout:   "from main\nfrom background\n",
+		ExitCode: 0,
+	},
+
+	// TTY cases - difference is new lines add `\r` and child process waiting is different
+	{
+		Name:     "tty: basic",
+		Command:  "echo hello stdout; echo hello stderr >&2; exit 43",
+		Tty:      true,
+		Stdout:   "hello stdout\r\nhello stderr\r\n",
+		ExitCode: 43,
+	},
+	{
+		Name:     "tty: streaming",
+		Command:  "for n in 1 2 3; do echo $n; sleep 1; done",
+		Tty:      true,
+		Stdout:   "1\r\n2\r\n3\r\n",
+		ExitCode: 0,
+	},
+	{
+		Name:     "tty: stty check",
+		Command:  "sleep 1; stty size",
+		Tty:      true,
+		Stdout:   "100 100\r\n",
+		ExitCode: 0,
+	},
+	{
+		Name:    "tty: stdin passing",
+		Command: "head -n1",
+		Tty:     true,
+		Stdin:   "hello from stdin\n",
+		// in tty mode, we emit line twice: once for tty echoing and one for the actual head output
+		Stdout:   "hello from stdin\r\nhello from stdin\r\n",
+		ExitCode: 0,
+	},
+	{
+		Name:    "tty: children processes",
+		Command: "(( sleep 3; echo from background ) & ); echo from main; exec sleep 1",
+		Tty:     true,
+		// when using tty; wait for lead process only, like `docker exec -it`
+		Stdout:   "from main\r\n",
+		ExitCode: 0,
+	},
+}
+
+func TestExecTaskStreamingBasicResponses(t *testing.T, driver *DriverHarness, taskID string) {
+	for _, c := range ExecTaskStreamingBasicCases {
+		t.Run("basic: "+c.Name, func(t *testing.T) {
+
+			result := execTask(t, driver, taskID, c.Command, c.Tty, c.Stdin)
+
+			require.Equal(t, c.ExitCode, result.exitCode)
+
+			switch s := c.Stdout.(type) {
+			case string:
+				require.Equal(t, s, result.stdout)
+			case *regexp.Regexp:
+				require.Regexp(t, s, result.stdout)
+			case nil:
+				require.Empty(t, result.stdout)
+			default:
+				require.Fail(t, "unexpected stdout type", "found %v (%v), but expected string or regexp", s, reflect.TypeOf(s))
+			}
+
+			switch s := c.Stderr.(type) {
+			case string:
+				require.Equal(t, s, result.stderr)
+			case *regexp.Regexp:
+				require.Regexp(t, s, result.stderr)
+			case nil:
+				require.Empty(t, result.stderr)
+			default:
+				require.Fail(t, "unexpected stderr type", "found %v (%v), but expected string or regexp", s, reflect.TypeOf(s))
+			}
+
+		})
+	}
+}
+
+// TestExecFSIsolation asserts that exec occurs inside chroot/isolation environment rather than
+// on host
+func TestExecFSIsolation(t *testing.T, driver *DriverHarness, taskID string) {
+	t.Run("isolation", func(t *testing.T) {
+		caps, err := driver.Capabilities()
+		require.NoError(t, err)
+
+		isolated := (caps.FSIsolation != drivers.FSIsolationNone)
+
+		text := "hello from the other side"
+
+		// write to a file and check it presence in host
+		w := execTask(t, driver, taskID,
+			fmt.Sprintf(`FILE=$(mktemp); echo "$FILE"; echo %q >> "${FILE}"`, text),
+			false, "")
+		require.Zero(t, w.exitCode)
+
+		tempfile := strings.TrimSpace(w.stdout)
+		if !isolated {
+			defer os.Remove(tempfile)
+		}
+
+		t.Logf("created file in task: %v", tempfile)
+
+		// read from host
+		b, err := ioutil.ReadFile(tempfile)
+		if !isolated {
+			require.NoError(t, err)
+			require.Equal(t, text, strings.TrimSpace(string(b)))
+		} else {
+			require.Error(t, err)
+			require.True(t, os.IsNotExist(err))
+		}
+
+		// read should succeed from task again
+		r := execTask(t, driver, taskID,
+			fmt.Sprintf("cat %q", tempfile),
+			false, "")
+		require.Zero(t, r.exitCode)
+		require.Equal(t, text, strings.TrimSpace(r.stdout))
+
+		// we always run in a cgroup - testing freezer cgroup
+		r = execTask(t, driver, taskID,
+			fmt.Sprintf("cat /proc/self/cgroup"),
+			false, "")
+		require.Zero(t, r.exitCode)
+
+		if !strings.Contains(r.stdout, ":freezer:/nomad") && !strings.Contains(r.stdout, "freezer:/docker") {
+			require.Fail(t, "unexpected freezer cgroup", "expected freezer to be /nomad/ or /docker/, but found:\n%s", r.stdout)
+
+		}
+	})
+}
+
+func execTask(t *testing.T, driver *DriverHarness, taskID string, cmd string, tty bool, stdin string) execResult {
+	stream := newTestExecStream(t, tty, stdin)
+
+	ctx, cancelFn := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancelFn()
+
+	command := []string{"/bin/sh", "-c", cmd}
+
+	isRaw := false
+	exitCode := -2
+	if raw, ok := driver.impl.(drivers.ExecTaskStreamingRawDriver); ok {
+		isRaw = true
+		err := raw.ExecTaskStreamingRaw(ctx, taskID,
+			command, tty, stream)
+		require.NoError(t, err)
+	} else if d, ok := driver.impl.(drivers.ExecTaskStreamingDriver); ok {
+		execOpts, errCh := drivers.StreamToExecOptions(ctx, command, tty, stream)
+
+		r, err := d.ExecTaskStreaming(ctx, taskID, execOpts)
+		require.NoError(t, err)
+
+		select {
+		case err := <-errCh:
+			require.NoError(t, err)
+		default:
+			// all good
+		}
+
+		exitCode = r.ExitCode
+	} else {
+		require.Fail(t, "driver does not support exec")
+	}
+
+	result := stream.currentResult()
+	require.NoError(t, result.err)
+
+	if !isRaw {
+		result.exitCode = exitCode
+	}
+
+	return result
+}
+
+type execResult struct {
+	exitCode int
+	stdout   string
+	stderr   string
+
+	err error
+}
+
+func newTestExecStream(t *testing.T, tty bool, stdin string) *testExecStream {
+
+	return &testExecStream{
+		t:      t,
+		input:  newInputStream(tty, stdin),
+		result: &execResult{exitCode: -2},
+	}
+}
+
+func newInputStream(tty bool, stdin string) []*drivers.ExecTaskStreamingRequestMsg {
+	input := []*drivers.ExecTaskStreamingRequestMsg{}
+	if tty {
+		// emit two resize to ensure we honor latest
+		input = append(input, &drivers.ExecTaskStreamingRequestMsg{
+			TtySize: &dproto.ExecTaskStreamingRequest_TerminalSize{
+				Height: 50,
+				Width:  40,
+			}})
+		input = append(input, &drivers.ExecTaskStreamingRequestMsg{
+			TtySize: &dproto.ExecTaskStreamingRequest_TerminalSize{
+				Height: 100,
+				Width:  100,
+			}})
+
+	}
+
+	input = append(input, &drivers.ExecTaskStreamingRequestMsg{
+		Stdin: &dproto.ExecTaskStreamingIOOperation{
+			Data: []byte(stdin),
+		},
+	})
+
+	if !tty {
+		// don't close stream in interactive session and risk closing tty prematurely
+		input = append(input, &drivers.ExecTaskStreamingRequestMsg{
+			Stdin: &dproto.ExecTaskStreamingIOOperation{
+				Close: true,
+			},
+		})
+	}
+
+	return input
+}
+
+var _ drivers.ExecTaskStream = (*testExecStream)(nil)
+
+type testExecStream struct {
+	t *testing.T
+
+	// input
+	input      []*drivers.ExecTaskStreamingRequestMsg
+	recvCalled int
+
+	// result so far
+	resultLock sync.Mutex
+	result     *execResult
+}
+
+func (s *testExecStream) currentResult() execResult {
+	s.resultLock.Lock()
+	defer s.resultLock.Unlock()
+
+	// make a copy
+	return *s.result
+}
+
+func (s *testExecStream) Recv() (*drivers.ExecTaskStreamingRequestMsg, error) {
+	if s.recvCalled >= len(s.input) {
+		return nil, io.EOF
+	}
+
+	i := s.input[s.recvCalled]
+	s.recvCalled++
+	return i, nil
+}
+
+func (s *testExecStream) Send(m *drivers.ExecTaskStreamingResponseMsg) error {
+	s.resultLock.Lock()
+	defer s.resultLock.Unlock()
+
+	switch {
+	case m.Stdout != nil && m.Stdout.Data != nil:
+		s.t.Logf("received stdout: %s", string(m.Stdout.Data))
+		s.result.stdout += string(m.Stdout.Data)
+	case m.Stderr != nil && m.Stderr.Data != nil:
+		s.t.Logf("received stderr: %s", string(m.Stderr.Data))
+		s.result.stderr += string(m.Stderr.Data)
+	case m.Exited && m.Result != nil:
+		s.result.exitCode = int(m.Result.ExitCode)
+	}
+
+	return nil
+}

plugins/drivers/testutils/testing.go

@@ -181,19 +181,20 @@ func (h *DriverHarness) WaitUntilStarted(taskID string, timeout time.Duration) e
 // is passed through the base plugin layer.
 type MockDriver struct {
 	base.MockPlugin
-	TaskConfigSchemaF func() (*hclspec.Spec, error)
-	FingerprintF      func(context.Context) (<-chan *drivers.Fingerprint, error)
-	CapabilitiesF     func() (*drivers.Capabilities, error)
-	RecoverTaskF      func(*drivers.TaskHandle) error
-	StartTaskF        func(*drivers.TaskConfig) (*drivers.TaskHandle, *drivers.DriverNetwork, error)
-	WaitTaskF         func(context.Context, string) (<-chan *drivers.ExitResult, error)
-	StopTaskF         func(string, time.Duration, string) error
-	DestroyTaskF      func(string, bool) error
-	InspectTaskF      func(string) (*drivers.TaskStatus, error)
-	TaskStatsF        func(context.Context, string, time.Duration) (<-chan *drivers.TaskResourceUsage, error)
-	TaskEventsF       func(context.Context) (<-chan *drivers.TaskEvent, error)
-	SignalTaskF       func(string, string) error
-	ExecTaskF         func(string, []string, time.Duration) (*drivers.ExecTaskResult, error)
+	TaskConfigSchemaF  func() (*hclspec.Spec, error)
+	FingerprintF       func(context.Context) (<-chan *drivers.Fingerprint, error)
+	CapabilitiesF      func() (*drivers.Capabilities, error)
+	RecoverTaskF       func(*drivers.TaskHandle) error
+	StartTaskF         func(*drivers.TaskConfig) (*drivers.TaskHandle, *drivers.DriverNetwork, error)
+	WaitTaskF          func(context.Context, string) (<-chan *drivers.ExitResult, error)
+	StopTaskF          func(string, time.Duration, string) error
+	DestroyTaskF       func(string, bool) error
+	InspectTaskF       func(string) (*drivers.TaskStatus, error)
+	TaskStatsF         func(context.Context, string, time.Duration) (<-chan *drivers.TaskResourceUsage, error)
+	TaskEventsF        func(context.Context) (<-chan *drivers.TaskEvent, error)
+	SignalTaskF        func(string, string) error
+	ExecTaskF          func(string, []string, time.Duration) (*drivers.ExecTaskResult, error)
+	ExecTaskStreamingF func(context.Context, string, *drivers.ExecOptions) (*drivers.ExitResult, error)
 }
 
 func (d *MockDriver) TaskConfigSchema() (*hclspec.Spec, error) { return d.TaskConfigSchemaF() }
@@ -230,6 +231,10 @@ func (d *MockDriver) ExecTask(taskID string, cmd []string, timeout time.Duration
 	return d.ExecTaskF(taskID, cmd, timeout)
 }
 
+func (d *MockDriver) ExecTaskStreaming(ctx context.Context, taskID string, execOpts *drivers.ExecOptions) (*drivers.ExitResult, error) {
+	return d.ExecTaskStreamingF(ctx, taskID, execOpts)
+}
+
 // SetEnvvars sets path and host env vars depending on the FS isolation used.
 func SetEnvvars(envBuilder *taskenv.Builder, fsi drivers.FSIsolation, taskDir *allocdir.TaskDir, conf *config.Config) {
 	// Set driver-specific environment variables

testutil/wait.go

@@ -92,11 +92,13 @@ func WaitForLeader(t testing.T, rpc rpcFn) {
 	})
 }
 
-func RegisterJob(t testing.T, rpc rpcFn, job *structs.Job) {
+func RegisterJobWithToken(t testing.T, rpc rpcFn, job *structs.Job, token string) {
 	WaitForResult(func() (bool, error) {
 		args := &structs.JobRegisterRequest{}
 		args.Job = job
 		args.WriteRequest.Region = "global"
+		args.AuthToken = token
+		args.Namespace = structs.DefaultNamespace
 		var jobResp structs.JobRegisterResponse
 		err := rpc("Job.Register", args, &jobResp)
 		return err == nil, fmt.Errorf("Job.Register error: %v", err)
@@ -107,9 +109,12 @@ func RegisterJob(t testing.T, rpc rpcFn, job *structs.Job) {
 	t.Logf("Job %q registered", job.ID)
 }
 
-// WaitForRunning runs a job and blocks until all allocs are out of pending.
-func WaitForRunning(t testing.T, rpc rpcFn, job *structs.Job) []*structs.AllocListStub {
-	RegisterJob(t, rpc, job)
+func RegisterJob(t testing.T, rpc rpcFn, job *structs.Job) {
+	RegisterJobWithToken(t, rpc, job, "")
+}
+
+func WaitForRunningWithToken(t testing.T, rpc rpcFn, job *structs.Job, token string) []*structs.AllocListStub {
+	RegisterJobWithToken(t, rpc, job, token)
 
 	var resp structs.JobAllocationsResponse
 
@@ -117,6 +122,8 @@ func WaitForRunning(t testing.T, rpc rpcFn, job *structs.Job) []*structs.AllocLi
 		args := &structs.JobSpecificRequest{}
 		args.JobID = job.ID
 		args.QueryOptions.Region = "global"
+		args.AuthToken = token
+		args.Namespace = structs.DefaultNamespace
 		err := rpc("Job.Allocations", args, &resp)
 		if err != nil {
 			return false, fmt.Errorf("Job.Allocations error: %v", err)
@@ -140,3 +147,8 @@ func WaitForRunning(t testing.T, rpc rpcFn, job *structs.Job) []*structs.AllocLi
 
 	return resp.Allocations
 }
+
+// WaitForRunning runs a job and blocks until all allocs are out of pending.
+func WaitForRunning(t testing.T, rpc rpcFn, job *structs.Job) []*structs.AllocListStub {
+	return WaitForRunningWithToken(t, rpc, job, "")
+}

vendor/github.com/gorilla/websocket/AUTHORS

@@ -0,0 +1,9 @@
+# This is the official list of Gorilla WebSocket authors for copyright
+# purposes.
+#
+# Please keep the list sorted.
+
+Gary Burd <gary@beagledreams.com>
+Google LLC (https://opensource.google.com/)
+Joachim Bauch <mail@joachim-bauch.de>
+

vendor/github.com/gorilla/websocket/LICENSE

@@ -0,0 +1,22 @@
+Copyright (c) 2013 The Gorilla WebSocket Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+  Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+  Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/gorilla/websocket/README.md

@@ -0,0 +1,64 @@
+# Gorilla WebSocket
+
+Gorilla WebSocket is a [Go](http://golang.org/) implementation of the
+[WebSocket](http://www.rfc-editor.org/rfc/rfc6455.txt) protocol.
+
+[![Build Status](https://travis-ci.org/gorilla/websocket.svg?branch=master)](https://travis-ci.org/gorilla/websocket)
+[![GoDoc](https://godoc.org/github.com/gorilla/websocket?status.svg)](https://godoc.org/github.com/gorilla/websocket)
+
+### Documentation
+
+* [API Reference](http://godoc.org/github.com/gorilla/websocket)
+* [Chat example](https://github.com/gorilla/websocket/tree/master/examples/chat)
+* [Command example](https://github.com/gorilla/websocket/tree/master/examples/command)
+* [Client and server example](https://github.com/gorilla/websocket/tree/master/examples/echo)
+* [File watch example](https://github.com/gorilla/websocket/tree/master/examples/filewatch)
+
+### Status
+
+The Gorilla WebSocket package provides a complete and tested implementation of
+the [WebSocket](http://www.rfc-editor.org/rfc/rfc6455.txt) protocol. The
+package API is stable.
+
+### Installation
+
+    go get github.com/gorilla/websocket
+
+### Protocol Compliance
+
+The Gorilla WebSocket package passes the server tests in the [Autobahn Test
+Suite](https://github.com/crossbario/autobahn-testsuite) using the application in the [examples/autobahn
+subdirectory](https://github.com/gorilla/websocket/tree/master/examples/autobahn).
+
+### Gorilla WebSocket compared with other packages
+
+<table>
+<tr>
+<th></th>
+<th><a href="http://godoc.org/github.com/gorilla/websocket">github.com/gorilla</a></th>
+<th><a href="http://godoc.org/golang.org/x/net/websocket">golang.org/x/net</a></th>
+</tr>
+<tr>
+<tr><td colspan="3"><a href="http://tools.ietf.org/html/rfc6455">RFC 6455</a> Features</td></tr>
+<tr><td>Passes <a href="http://autobahn.ws/testsuite/">Autobahn Test Suite</a></td><td><a href="https://github.com/gorilla/websocket/tree/master/examples/autobahn">Yes</a></td><td>No</td></tr>
+<tr><td>Receive <a href="https://tools.ietf.org/html/rfc6455#section-5.4">fragmented</a> message<td>Yes</td><td><a href="https://code.google.com/p/go/issues/detail?id=7632">No</a>, see note 1</td></tr>
+<tr><td>Send <a href="https://tools.ietf.org/html/rfc6455#section-5.5.1">close</a> message</td><td><a href="http://godoc.org/github.com/gorilla/websocket#hdr-Control_Messages">Yes</a></td><td><a href="https://code.google.com/p/go/issues/detail?id=4588">No</a></td></tr>
+<tr><td>Send <a href="https://tools.ietf.org/html/rfc6455#section-5.5.2">pings</a> and receive <a href="https://tools.ietf.org/html/rfc6455#section-5.5.3">pongs</a></td><td><a href="http://godoc.org/github.com/gorilla/websocket#hdr-Control_Messages">Yes</a></td><td>No</td></tr>
+<tr><td>Get the <a href="https://tools.ietf.org/html/rfc6455#section-5.6">type</a> of a received data message</td><td>Yes</td><td>Yes, see note 2</td></tr>
+<tr><td colspan="3">Other Features</tr></td>
+<tr><td><a href="https://tools.ietf.org/html/rfc7692">Compression Extensions</a></td><td>Experimental</td><td>No</td></tr>
+<tr><td>Read message using io.Reader</td><td><a href="http://godoc.org/github.com/gorilla/websocket#Conn.NextReader">Yes</a></td><td>No, see note 3</td></tr>
+<tr><td>Write message using io.WriteCloser</td><td><a href="http://godoc.org/github.com/gorilla/websocket#Conn.NextWriter">Yes</a></td><td>No, see note 3</td></tr>
+</table>
+
+Notes:
+
+1. Large messages are fragmented in [Chrome's new WebSocket implementation](http://www.ietf.org/mail-archive/web/hybi/current/msg10503.html).
+2. The application can get the type of a received data message by implementing
+   a [Codec marshal](http://godoc.org/golang.org/x/net/websocket#Codec.Marshal)
+   function.
+3. The go.net io.Reader and io.Writer operate across WebSocket frame boundaries.
+  Read returns when the input buffer is full or a frame boundary is
+  encountered. Each call to Write sends a single frame message. The Gorilla
+  io.Reader and io.WriteCloser operate on a single WebSocket message.
+

vendor/github.com/gorilla/websocket/client.go

@@ -0,0 +1,395 @@
+// Copyright 2013 The Gorilla WebSocket Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package websocket
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"errors"
+	"io"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"net/http/httptrace"
+	"net/url"
+	"strings"
+	"time"
+)
+
+// ErrBadHandshake is returned when the server response to opening handshake is
+// invalid.
+var ErrBadHandshake = errors.New("websocket: bad handshake")
+
+var errInvalidCompression = errors.New("websocket: invalid compression negotiation")
+
+// NewClient creates a new client connection using the given net connection.
+// The URL u specifies the host and request URI. Use requestHeader to specify
+// the origin (Origin), subprotocols (Sec-WebSocket-Protocol) and cookies
+// (Cookie). Use the response.Header to get the selected subprotocol
+// (Sec-WebSocket-Protocol) and cookies (Set-Cookie).
+//
+// If the WebSocket handshake fails, ErrBadHandshake is returned along with a
+// non-nil *http.Response so that callers can handle redirects, authentication,
+// etc.
+//
+// Deprecated: Use Dialer instead.
+func NewClient(netConn net.Conn, u *url.URL, requestHeader http.Header, readBufSize, writeBufSize int) (c *Conn, response *http.Response, err error) {
+	d := Dialer{
+		ReadBufferSize:  readBufSize,
+		WriteBufferSize: writeBufSize,
+		NetDial: func(net, addr string) (net.Conn, error) {
+			return netConn, nil
+		},
+	}
+	return d.Dial(u.String(), requestHeader)
+}
+
+// A Dialer contains options for connecting to WebSocket server.
+type Dialer struct {
+	// NetDial specifies the dial function for creating TCP connections. If
+	// NetDial is nil, net.Dial is used.
+	NetDial func(network, addr string) (net.Conn, error)
+
+	// NetDialContext specifies the dial function for creating TCP connections. If
+	// NetDialContext is nil, net.DialContext is used.
+	NetDialContext func(ctx context.Context, network, addr string) (net.Conn, error)
+
+	// Proxy specifies a function to return a proxy for a given
+	// Request. If the function returns a non-nil error, the
+	// request is aborted with the provided error.
+	// If Proxy is nil or returns a nil *URL, no proxy is used.
+	Proxy func(*http.Request) (*url.URL, error)
+
+	// TLSClientConfig specifies the TLS configuration to use with tls.Client.
+	// If nil, the default configuration is used.
+	TLSClientConfig *tls.Config
+
+	// HandshakeTimeout specifies the duration for the handshake to complete.
+	HandshakeTimeout time.Duration
+
+	// ReadBufferSize and WriteBufferSize specify I/O buffer sizes in bytes. If a buffer
+	// size is zero, then a useful default size is used. The I/O buffer sizes
+	// do not limit the size of the messages that can be sent or received.
+	ReadBufferSize, WriteBufferSize int
+
+	// WriteBufferPool is a pool of buffers for write operations. If the value
+	// is not set, then write buffers are allocated to the connection for the
+	// lifetime of the connection.
+	//
+	// A pool is most useful when the application has a modest volume of writes
+	// across a large number of connections.
+	//
+	// Applications should use a single pool for each unique value of
+	// WriteBufferSize.
+	WriteBufferPool BufferPool
+
+	// Subprotocols specifies the client's requested subprotocols.
+	Subprotocols []string
+
+	// EnableCompression specifies if the client should attempt to negotiate
+	// per message compression (RFC 7692). Setting this value to true does not
+	// guarantee that compression will be supported. Currently only "no context
+	// takeover" modes are supported.
+	EnableCompression bool
+
+	// Jar specifies the cookie jar.
+	// If Jar is nil, cookies are not sent in requests and ignored
+	// in responses.
+	Jar http.CookieJar
+}
+
+// Dial creates a new client connection by calling DialContext with a background context.
+func (d *Dialer) Dial(urlStr string, requestHeader http.Header) (*Conn, *http.Response, error) {
+	return d.DialContext(context.Background(), urlStr, requestHeader)
+}
+
+var errMalformedURL = errors.New("malformed ws or wss URL")
+
+func hostPortNoPort(u *url.URL) (hostPort, hostNoPort string) {
+	hostPort = u.Host
+	hostNoPort = u.Host
+	if i := strings.LastIndex(u.Host, ":"); i > strings.LastIndex(u.Host, "]") {
+		hostNoPort = hostNoPort[:i]
+	} else {
+		switch u.Scheme {
+		case "wss":
+			hostPort += ":443"
+		case "https":
+			hostPort += ":443"
+		default:
+			hostPort += ":80"
+		}
+	}
+	return hostPort, hostNoPort
+}
+
+// DefaultDialer is a dialer with all fields set to the default values.
+var DefaultDialer = &Dialer{
+	Proxy:            http.ProxyFromEnvironment,
+	HandshakeTimeout: 45 * time.Second,
+}
+
+// nilDialer is dialer to use when receiver is nil.
+var nilDialer = *DefaultDialer
+
+// DialContext creates a new client connection. Use requestHeader to specify the
+// origin (Origin), subprotocols (Sec-WebSocket-Protocol) and cookies (Cookie).
+// Use the response.Header to get the selected subprotocol
+// (Sec-WebSocket-Protocol) and cookies (Set-Cookie).
+//
+// The context will be used in the request and in the Dialer.
+//
+// If the WebSocket handshake fails, ErrBadHandshake is returned along with a
+// non-nil *http.Response so that callers can handle redirects, authentication,
+// etcetera. The response body may not contain the entire response and does not
+// need to be closed by the application.
+func (d *Dialer) DialContext(ctx context.Context, urlStr string, requestHeader http.Header) (*Conn, *http.Response, error) {
+	if d == nil {
+		d = &nilDialer
+	}
+
+	challengeKey, err := generateChallengeKey()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	u, err := url.Parse(urlStr)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	switch u.Scheme {
+	case "ws":
+		u.Scheme = "http"
+	case "wss":
+		u.Scheme = "https"
+	default:
+		return nil, nil, errMalformedURL
+	}
+
+	if u.User != nil {
+		// User name and password are not allowed in websocket URIs.
+		return nil, nil, errMalformedURL
+	}
+
+	req := &http.Request{
+		Method:     "GET",
+		URL:        u,
+		Proto:      "HTTP/1.1",
+		ProtoMajor: 1,
+		ProtoMinor: 1,
+		Header:     make(http.Header),
+		Host:       u.Host,
+	}
+	req = req.WithContext(ctx)
+
+	// Set the cookies present in the cookie jar of the dialer
+	if d.Jar != nil {
+		for _, cookie := range d.Jar.Cookies(u) {
+			req.AddCookie(cookie)
+		}
+	}
+
+	// Set the request headers using the capitalization for names and values in
+	// RFC examples. Although the capitalization shouldn't matter, there are
+	// servers that depend on it. The Header.Set method is not used because the
+	// method canonicalizes the header names.
+	req.Header["Upgrade"] = []string{"websocket"}
+	req.Header["Connection"] = []string{"Upgrade"}
+	req.Header["Sec-WebSocket-Key"] = []string{challengeKey}
+	req.Header["Sec-WebSocket-Version"] = []string{"13"}
+	if len(d.Subprotocols) > 0 {
+		req.Header["Sec-WebSocket-Protocol"] = []string{strings.Join(d.Subprotocols, ", ")}
+	}
+	for k, vs := range requestHeader {
+		switch {
+		case k == "Host":
+			if len(vs) > 0 {
+				req.Host = vs[0]
+			}
+		case k == "Upgrade" ||
+			k == "Connection" ||
+			k == "Sec-Websocket-Key" ||
+			k == "Sec-Websocket-Version" ||
+			k == "Sec-Websocket-Extensions" ||
+			(k == "Sec-Websocket-Protocol" && len(d.Subprotocols) > 0):
+			return nil, nil, errors.New("websocket: duplicate header not allowed: " + k)
+		case k == "Sec-Websocket-Protocol":
+			req.Header["Sec-WebSocket-Protocol"] = vs
+		default:
+			req.Header[k] = vs
+		}
+	}
+
+	if d.EnableCompression {
+		req.Header["Sec-WebSocket-Extensions"] = []string{"permessage-deflate; server_no_context_takeover; client_no_context_takeover"}
+	}
+
+	if d.HandshakeTimeout != 0 {
+		var cancel func()
+		ctx, cancel = context.WithTimeout(ctx, d.HandshakeTimeout)
+		defer cancel()
+	}
+
+	// Get network dial function.
+	var netDial func(network, add string) (net.Conn, error)
+
+	if d.NetDialContext != nil {
+		netDial = func(network, addr string) (net.Conn, error) {
+			return d.NetDialContext(ctx, network, addr)
+		}
+	} else if d.NetDial != nil {
+		netDial = d.NetDial
+	} else {
+		netDialer := &net.Dialer{}
+		netDial = func(network, addr string) (net.Conn, error) {
+			return netDialer.DialContext(ctx, network, addr)
+		}
+	}
+
+	// If needed, wrap the dial function to set the connection deadline.
+	if deadline, ok := ctx.Deadline(); ok {
+		forwardDial := netDial
+		netDial = func(network, addr string) (net.Conn, error) {
+			c, err := forwardDial(network, addr)
+			if err != nil {
+				return nil, err
+			}
+			err = c.SetDeadline(deadline)
+			if err != nil {
+				c.Close()
+				return nil, err
+			}
+			return c, nil
+		}
+	}
+
+	// If needed, wrap the dial function to connect through a proxy.
+	if d.Proxy != nil {
+		proxyURL, err := d.Proxy(req)
+		if err != nil {
+			return nil, nil, err
+		}
+		if proxyURL != nil {
+			dialer, err := proxy_FromURL(proxyURL, netDialerFunc(netDial))
+			if err != nil {
+				return nil, nil, err
+			}
+			netDial = dialer.Dial
+		}
+	}
+
+	hostPort, hostNoPort := hostPortNoPort(u)
+	trace := httptrace.ContextClientTrace(ctx)
+	if trace != nil && trace.GetConn != nil {
+		trace.GetConn(hostPort)
+	}
+
+	netConn, err := netDial("tcp", hostPort)
+	if trace != nil && trace.GotConn != nil {
+		trace.GotConn(httptrace.GotConnInfo{
+			Conn: netConn,
+		})
+	}
+	if err != nil {
+		return nil, nil, err
+	}
+
+	defer func() {
+		if netConn != nil {
+			netConn.Close()
+		}
+	}()
+
+	if u.Scheme == "https" {
+		cfg := cloneTLSConfig(d.TLSClientConfig)
+		if cfg.ServerName == "" {
+			cfg.ServerName = hostNoPort
+		}
+		tlsConn := tls.Client(netConn, cfg)
+		netConn = tlsConn
+
+		var err error
+		if trace != nil {
+			err = doHandshakeWithTrace(trace, tlsConn, cfg)
+		} else {
+			err = doHandshake(tlsConn, cfg)
+		}
+
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+
+	conn := newConn(netConn, false, d.ReadBufferSize, d.WriteBufferSize, d.WriteBufferPool, nil, nil)
+
+	if err := req.Write(netConn); err != nil {
+		return nil, nil, err
+	}
+
+	if trace != nil && trace.GotFirstResponseByte != nil {
+		if peek, err := conn.br.Peek(1); err == nil && len(peek) == 1 {
+			trace.GotFirstResponseByte()
+		}
+	}
+
+	resp, err := http.ReadResponse(conn.br, req)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	if d.Jar != nil {
+		if rc := resp.Cookies(); len(rc) > 0 {
+			d.Jar.SetCookies(u, rc)
+		}
+	}
+
+	if resp.StatusCode != 101 ||
+		!strings.EqualFold(resp.Header.Get("Upgrade"), "websocket") ||
+		!strings.EqualFold(resp.Header.Get("Connection"), "upgrade") ||
+		resp.Header.Get("Sec-Websocket-Accept") != computeAcceptKey(challengeKey) {
+		// Before closing the network connection on return from this
+		// function, slurp up some of the response to aid application
+		// debugging.
+		buf := make([]byte, 1024)
+		n, _ := io.ReadFull(resp.Body, buf)
+		resp.Body = ioutil.NopCloser(bytes.NewReader(buf[:n]))
+		return nil, resp, ErrBadHandshake
+	}
+
+	for _, ext := range parseExtensions(resp.Header) {
+		if ext[""] != "permessage-deflate" {
+			continue
+		}
+		_, snct := ext["server_no_context_takeover"]
+		_, cnct := ext["client_no_context_takeover"]
+		if !snct || !cnct {
+			return nil, resp, errInvalidCompression
+		}
+		conn.newCompressionWriter = compressNoContextTakeover
+		conn.newDecompressionReader = decompressNoContextTakeover
+		break
+	}
+
+	resp.Body = ioutil.NopCloser(bytes.NewReader([]byte{}))
+	conn.subprotocol = resp.Header.Get("Sec-Websocket-Protocol")
+
+	netConn.SetDeadline(time.Time{})
+	netConn = nil // to avoid close in defer.
+	return conn, resp, nil
+}
+
+func doHandshake(tlsConn *tls.Conn, cfg *tls.Config) error {
+	if err := tlsConn.Handshake(); err != nil {
+		return err
+	}
+	if !cfg.InsecureSkipVerify {
+		if err := tlsConn.VerifyHostname(cfg.ServerName); err != nil {
+			return err
+		}
+	}
+	return nil
+}

vendor/github.com/gorilla/websocket/client_clone.go

@@ -0,0 +1,16 @@
+// Copyright 2013 The Gorilla WebSocket Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build go1.8
+
+package websocket
+
+import "crypto/tls"
+
+func cloneTLSConfig(cfg *tls.Config) *tls.Config {
+	if cfg == nil {
+		return &tls.Config{}
+	}
+	return cfg.Clone()
+}

vendor/github.com/gorilla/websocket/client_clone_legacy.go

@@ -0,0 +1,38 @@
+// Copyright 2013 The Gorilla WebSocket Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !go1.8
+
+package websocket
+
+import "crypto/tls"
+
+// cloneTLSConfig clones all public fields except the fields
+// SessionTicketsDisabled and SessionTicketKey. This avoids copying the
+// sync.Mutex in the sync.Once and makes it safe to call cloneTLSConfig on a
+// config in active use.
+func cloneTLSConfig(cfg *tls.Config) *tls.Config {
+	if cfg == nil {
+		return &tls.Config{}
+	}
+	return &tls.Config{
+		Rand:                     cfg.Rand,
+		Time:                     cfg.Time,
+		Certificates:             cfg.Certificates,
+		NameToCertificate:        cfg.NameToCertificate,
+		GetCertificate:           cfg.GetCertificate,
+		RootCAs:                  cfg.RootCAs,
+		NextProtos:               cfg.NextProtos,
+		ServerName:               cfg.ServerName,
+		ClientAuth:               cfg.ClientAuth,
+		ClientCAs:                cfg.ClientCAs,
+		InsecureSkipVerify:       cfg.InsecureSkipVerify,
+		CipherSuites:             cfg.CipherSuites,
+		PreferServerCipherSuites: cfg.PreferServerCipherSuites,
+		ClientSessionCache:       cfg.ClientSessionCache,
+		MinVersion:               cfg.MinVersion,
+		MaxVersion:               cfg.MaxVersion,
+		CurvePreferences:         cfg.CurvePreferences,
+	}
+}

vendor/github.com/gorilla/websocket/compression.go

@@ -0,0 +1,148 @@
+// Copyright 2017 The Gorilla WebSocket Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package websocket
+
+import (
+	"compress/flate"
+	"errors"
+	"io"
+	"strings"
+	"sync"
+)
+
+const (
+	minCompressionLevel     = -2 // flate.HuffmanOnly not defined in Go < 1.6
+	maxCompressionLevel     = flate.BestCompression
+	defaultCompressionLevel = 1
+)
+
+var (
+	flateWriterPools [maxCompressionLevel - minCompressionLevel + 1]sync.Pool
+	flateReaderPool  = sync.Pool{New: func() interface{} {
+		return flate.NewReader(nil)
+	}}
+)
+
+func decompressNoContextTakeover(r io.Reader) io.ReadCloser {
+	const tail =
+	// Add four bytes as specified in RFC
+	"\x00\x00\xff\xff" +
+		// Add final block to squelch unexpected EOF error from flate reader.
+		"\x01\x00\x00\xff\xff"
+
+	fr, _ := flateReaderPool.Get().(io.ReadCloser)
+	fr.(flate.Resetter).Reset(io.MultiReader(r, strings.NewReader(tail)), nil)
+	return &flateReadWrapper{fr}
+}
+
+func isValidCompressionLevel(level int) bool {
+	return minCompressionLevel <= level && level <= maxCompressionLevel
+}
+
+func compressNoContextTakeover(w io.WriteCloser, level int) io.WriteCloser {
+	p := &flateWriterPools[level-minCompressionLevel]
+	tw := &truncWriter{w: w}
+	fw, _ := p.Get().(*flate.Writer)
+	if fw == nil {
+		fw, _ = flate.NewWriter(tw, level)
+	} else {
+		fw.Reset(tw)
+	}
+	return &flateWriteWrapper{fw: fw, tw: tw, p: p}
+}
+
+// truncWriter is an io.Writer that writes all but the last four bytes of the
+// stream to another io.Writer.
+type truncWriter struct {
+	w io.WriteCloser
+	n int
+	p [4]byte
+}
+
+func (w *truncWriter) Write(p []byte) (int, error) {
+	n := 0
+
+	// fill buffer first for simplicity.
+	if w.n < len(w.p) {
+		n = copy(w.p[w.n:], p)
+		p = p[n:]
+		w.n += n
+		if len(p) == 0 {
+			return n, nil
+		}
+	}
+
+	m := len(p)
+	if m > len(w.p) {
+		m = len(w.p)
+	}
+
+	if nn, err := w.w.Write(w.p[:m]); err != nil {
+		return n + nn, err
+	}
+
+	copy(w.p[:], w.p[m:])
+	copy(w.p[len(w.p)-m:], p[len(p)-m:])
+	nn, err := w.w.Write(p[:len(p)-m])
+	return n + nn, err
+}
+
+type flateWriteWrapper struct {
+	fw *flate.Writer
+	tw *truncWriter
+	p  *sync.Pool
+}
+
+func (w *flateWriteWrapper) Write(p []byte) (int, error) {
+	if w.fw == nil {
+		return 0, errWriteClosed
+	}
+	return w.fw.Write(p)
+}
+
+func (w *flateWriteWrapper) Close() error {
+	if w.fw == nil {
+		return errWriteClosed
+	}
+	err1 := w.fw.Flush()
+	w.p.Put(w.fw)
+	w.fw = nil
+	if w.tw.p != [4]byte{0, 0, 0xff, 0xff} {
+		return errors.New("websocket: internal error, unexpected bytes at end of flate stream")
+	}
+	err2 := w.tw.w.Close()
+	if err1 != nil {
+		return err1
+	}
+	return err2
+}
+
+type flateReadWrapper struct {
+	fr io.ReadCloser
+}
+
+func (r *flateReadWrapper) Read(p []byte) (int, error) {
+	if r.fr == nil {
+		return 0, io.ErrClosedPipe
+	}
+	n, err := r.fr.Read(p)
+	if err == io.EOF {
+		// Preemptively place the reader back in the pool. This helps with
+		// scenarios where the application does not call NextReader() soon after
+		// this final read.
+		r.Close()
+	}
+	return n, err
+}
+
+func (r *flateReadWrapper) Close() error {
+	if r.fr == nil {
+		return io.ErrClosedPipe
+	}
+	err := r.fr.Close()
+	flateReaderPool.Put(r.fr)
+	r.fr = nil
+	return err
+}

vendor/github.com/gorilla/websocket/conn_write.go

@@ -0,0 +1,15 @@
+// Copyright 2016 The Gorilla WebSocket Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build go1.8
+
+package websocket
+
+import "net"
+
+func (c *Conn) writeBufs(bufs ...[]byte) error {
+	b := net.Buffers(bufs)
+	_, err := b.WriteTo(c.conn)
+	return err
+}

vendor/github.com/gorilla/websocket/conn_write_legacy.go

@@ -0,0 +1,18 @@
+// Copyright 2016 The Gorilla WebSocket Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !go1.8
+
+package websocket
+
+func (c *Conn) writeBufs(bufs ...[]byte) error {
+	for _, buf := range bufs {
+		if len(buf) > 0 {
+			if _, err := c.conn.Write(buf); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}

vendor/github.com/gorilla/websocket/doc.go

@@ -0,0 +1,227 @@
+// Copyright 2013 The Gorilla WebSocket Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package websocket implements the WebSocket protocol defined in RFC 6455.
+//
+// Overview
+//
+// The Conn type represents a WebSocket connection. A server application calls
+// the Upgrader.Upgrade method from an HTTP request handler to get a *Conn:
+//
+//  var upgrader = websocket.Upgrader{
+//      ReadBufferSize:  1024,
+//      WriteBufferSize: 1024,
+//  }
+//
+//  func handler(w http.ResponseWriter, r *http.Request) {
+//      conn, err := upgrader.Upgrade(w, r, nil)
+//      if err != nil {
+//          log.Println(err)
+//          return
+//      }
+//      ... Use conn to send and receive messages.
+//  }
+//
+// Call the connection's WriteMessage and ReadMessage methods to send and
+// receive messages as a slice of bytes. This snippet of code shows how to echo
+// messages using these methods:
+//
+//  for {
+//      messageType, p, err := conn.ReadMessage()
+//      if err != nil {
+//          log.Println(err)
+//          return
+//      }
+//      if err := conn.WriteMessage(messageType, p); err != nil {
+//          log.Println(err)
+//          return
+//      }
+//  }
+//
+// In above snippet of code, p is a []byte and messageType is an int with value
+// websocket.BinaryMessage or websocket.TextMessage.
+//
+// An application can also send and receive messages using the io.WriteCloser
+// and io.Reader interfaces. To send a message, call the connection NextWriter
+// method to get an io.WriteCloser, write the message to the writer and close
+// the writer when done. To receive a message, call the connection NextReader
+// method to get an io.Reader and read until io.EOF is returned. This snippet
+// shows how to echo messages using the NextWriter and NextReader methods:
+//
+//  for {
+//      messageType, r, err := conn.NextReader()
+//      if err != nil {
+//          return
+//      }
+//      w, err := conn.NextWriter(messageType)
+//      if err != nil {
+//          return err
+//      }
+//      if _, err := io.Copy(w, r); err != nil {
+//          return err
+//      }
+//      if err := w.Close(); err != nil {
+//          return err
+//      }
+//  }
+//
+// Data Messages
+//
+// The WebSocket protocol distinguishes between text and binary data messages.
+// Text messages are interpreted as UTF-8 encoded text. The interpretation of
+// binary messages is left to the application.
+//
+// This package uses the TextMessage and BinaryMessage integer constants to
+// identify the two data message types. The ReadMessage and NextReader methods
+// return the type of the received message. The messageType argument to the
+// WriteMessage and NextWriter methods specifies the type of a sent message.
+//
+// It is the application's responsibility to ensure that text messages are
+// valid UTF-8 encoded text.
+//
+// Control Messages
+//
+// The WebSocket protocol defines three types of control messages: close, ping
+// and pong. Call the connection WriteControl, WriteMessage or NextWriter
+// methods to send a control message to the peer.
+//
+// Connections handle received close messages by calling the handler function
+// set with the SetCloseHandler method and by returning a *CloseError from the
+// NextReader, ReadMessage or the message Read method. The default close
+// handler sends a close message to the peer.
+//
+// Connections handle received ping messages by calling the handler function
+// set with the SetPingHandler method. The default ping handler sends a pong
+// message to the peer.
+//
+// Connections handle received pong messages by calling the handler function
+// set with the SetPongHandler method. The default pong handler does nothing.
+// If an application sends ping messages, then the application should set a
+// pong handler to receive the corresponding pong.
+//
+// The control message handler functions are called from the NextReader,
+// ReadMessage and message reader Read methods. The default close and ping
+// handlers can block these methods for a short time when the handler writes to
+// the connection.
+//
+// The application must read the connection to process close, ping and pong
+// messages sent from the peer. If the application is not otherwise interested
+// in messages from the peer, then the application should start a goroutine to
+// read and discard messages from the peer. A simple example is:
+//
+//  func readLoop(c *websocket.Conn) {
+//      for {
+//          if _, _, err := c.NextReader(); err != nil {
+//              c.Close()
+//              break
+//          }
+//      }
+//  }
+//
+// Concurrency
+//
+// Connections support one concurrent reader and one concurrent writer.
+//
+// Applications are responsible for ensuring that no more than one goroutine
+// calls the write methods (NextWriter, SetWriteDeadline, WriteMessage,
+// WriteJSON, EnableWriteCompression, SetCompressionLevel) concurrently and
+// that no more than one goroutine calls the read methods (NextReader,
+// SetReadDeadline, ReadMessage, ReadJSON, SetPongHandler, SetPingHandler)
+// concurrently.
+//
+// The Close and WriteControl methods can be called concurrently with all other
+// methods.
+//
+// Origin Considerations
+//
+// Web browsers allow Javascript applications to open a WebSocket connection to
+// any host. It's up to the server to enforce an origin policy using the Origin
+// request header sent by the browser.
+//
+// The Upgrader calls the function specified in the CheckOrigin field to check
+// the origin. If the CheckOrigin function returns false, then the Upgrade
+// method fails the WebSocket handshake with HTTP status 403.
+//
+// If the CheckOrigin field is nil, then the Upgrader uses a safe default: fail
+// the handshake if the Origin request header is present and the Origin host is
+// not equal to the Host request header.
+//
+// The deprecated package-level Upgrade function does not perform origin
+// checking. The application is responsible for checking the Origin header
+// before calling the Upgrade function.
+//
+// Buffers
+//
+// Connections buffer network input and output to reduce the number
+// of system calls when reading or writing messages.
+//
+// Write buffers are also used for constructing WebSocket frames. See RFC 6455,
+// Section 5 for a discussion of message framing. A WebSocket frame header is
+// written to the network each time a write buffer is flushed to the network.
+// Decreasing the size of the write buffer can increase the amount of framing
+// overhead on the connection.
+//
+// The buffer sizes in bytes are specified by the ReadBufferSize and
+// WriteBufferSize fields in the Dialer and Upgrader. The Dialer uses a default
+// size of 4096 when a buffer size field is set to zero. The Upgrader reuses
+// buffers created by the HTTP server when a buffer size field is set to zero.
+// The HTTP server buffers have a size of 4096 at the time of this writing.
+//
+// The buffer sizes do not limit the size of a message that can be read or
+// written by a connection.
+//
+// Buffers are held for the lifetime of the connection by default. If the
+// Dialer or Upgrader WriteBufferPool field is set, then a connection holds the
+// write buffer only when writing a message.
+//
+// Applications should tune the buffer sizes to balance memory use and
+// performance. Increasing the buffer size uses more memory, but can reduce the
+// number of system calls to read or write the network. In the case of writing,
+// increasing the buffer size can reduce the number of frame headers written to
+// the network.
+//
+// Some guidelines for setting buffer parameters are:
+//
+// Limit the buffer sizes to the maximum expected message size. Buffers larger
+// than the largest message do not provide any benefit.
+//
+// Depending on the distribution of message sizes, setting the buffer size to
+// to a value less than the maximum expected message size can greatly reduce
+// memory use with a small impact on performance. Here's an example: If 99% of
+// the messages are smaller than 256 bytes and the maximum message size is 512
+// bytes, then a buffer size of 256 bytes will result in 1.01 more system calls
+// than a buffer size of 512 bytes. The memory savings is 50%.
+//
+// A write buffer pool is useful when the application has a modest number
+// writes over a large number of connections. when buffers are pooled, a larger
+// buffer size has a reduced impact on total memory use and has the benefit of
+// reducing system calls and frame overhead.
+//
+// Compression EXPERIMENTAL
+//
+// Per message compression extensions (RFC 7692) are experimentally supported
+// by this package in a limited capacity. Setting the EnableCompression option
+// to true in Dialer or Upgrader will attempt to negotiate per message deflate
+// support.
+//
+//  var upgrader = websocket.Upgrader{
+//      EnableCompression: true,
+//  }
+//
+// If compression was successfully negotiated with the connection's peer, any
+// message received in compressed form will be automatically decompressed.
+// All Read methods will return uncompressed bytes.
+//
+// Per message compression of messages written to a connection can be enabled
+// or disabled by calling the corresponding Conn method:
+//
+//  conn.EnableWriteCompression(false)
+//
+// Currently this package does not support compression with "context takeover".
+// This means that messages must be compressed and decompressed in isolation,
+// without retaining sliding window or dictionary state across messages. For
+// more details refer to RFC 7692.
+//
+// Use of compression is experimental and may result in decreased performance.
+package websocket

vendor/github.com/gorilla/websocket/go.mod

@@ -0,0 +1 @@
+module github.com/gorilla/websocket

vendor/github.com/gorilla/websocket/go.sum

@@ -0,0 +1,2 @@
+github.com/gorilla/websocket v1.4.0 h1:WDFjx/TMzVgy9VdMMQi2K2Emtwi2QcUQsztZ/zLaH/Q=
+github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=

vendor/github.com/gorilla/websocket/join.go

@@ -0,0 +1,42 @@
+// Copyright 2019 The Gorilla WebSocket Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package websocket
+
+import (
+	"io"
+	"strings"
+)
+
+// JoinMessages concatenates received messages to create a single io.Reader.
+// The string term is appended to each message. The returned reader does not
+// support concurrent calls to the Read method.
+func JoinMessages(c *Conn, term string) io.Reader {
+	return &joinReader{c: c, term: term}
+}
+
+type joinReader struct {
+	c    *Conn
+	term string
+	r    io.Reader
+}
+
+func (r *joinReader) Read(p []byte) (int, error) {
+	if r.r == nil {
+		var err error
+		_, r.r, err = r.c.NextReader()
+		if err != nil {
+			return 0, err
+		}
+		if r.term != "" {
+			r.r = io.MultiReader(r.r, strings.NewReader(r.term))
+		}
+	}
+	n, err := r.r.Read(p)
+	if err == io.EOF {
+		err = nil
+		r.r = nil
+	}
+	return n, err
+}

vendor/github.com/gorilla/websocket/json.go

@@ -0,0 +1,60 @@
+// Copyright 2013 The Gorilla WebSocket Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package websocket
+
+import (
+	"encoding/json"
+	"io"
+)
+
+// WriteJSON writes the JSON encoding of v as a message.
+//
+// Deprecated: Use c.WriteJSON instead.
+func WriteJSON(c *Conn, v interface{}) error {
+	return c.WriteJSON(v)
+}
+
+// WriteJSON writes the JSON encoding of v as a message.
+//
+// See the documentation for encoding/json Marshal for details about the
+// conversion of Go values to JSON.
+func (c *Conn) WriteJSON(v interface{}) error {
+	w, err := c.NextWriter(TextMessage)
+	if err != nil {
+		return err
+	}
+	err1 := json.NewEncoder(w).Encode(v)
+	err2 := w.Close()
+	if err1 != nil {
+		return err1
+	}
+	return err2
+}
+
+// ReadJSON reads the next JSON-encoded message from the connection and stores
+// it in the value pointed to by v.
+//
+// Deprecated: Use c.ReadJSON instead.
+func ReadJSON(c *Conn, v interface{}) error {
+	return c.ReadJSON(v)
+}
+
+// ReadJSON reads the next JSON-encoded message from the connection and stores
+// it in the value pointed to by v.
+//
+// See the documentation for the encoding/json Unmarshal function for details
+// about the conversion of JSON to a Go value.
+func (c *Conn) ReadJSON(v interface{}) error {
+	_, r, err := c.NextReader()
+	if err != nil {
+		return err
+	}
+	err = json.NewDecoder(r).Decode(v)
+	if err == io.EOF {
+		// One value is expected in the message.
+		err = io.ErrUnexpectedEOF
+	}
+	return err
+}

vendor/github.com/gorilla/websocket/mask.go

@@ -0,0 +1,54 @@
+// Copyright 2016 The Gorilla WebSocket Authors. All rights reserved.  Use of
+// this source code is governed by a BSD-style license that can be found in the
+// LICENSE file.
+
+// +build !appengine
+
+package websocket
+
+import "unsafe"
+
+const wordSize = int(unsafe.Sizeof(uintptr(0)))
+
+func maskBytes(key [4]byte, pos int, b []byte) int {
+	// Mask one byte at a time for small buffers.
+	if len(b) < 2*wordSize {
+		for i := range b {
+			b[i] ^= key[pos&3]
+			pos++
+		}
+		return pos & 3
+	}
+
+	// Mask one byte at a time to word boundary.
+	if n := int(uintptr(unsafe.Pointer(&b[0]))) % wordSize; n != 0 {
+		n = wordSize - n
+		for i := range b[:n] {
+			b[i] ^= key[pos&3]
+			pos++
+		}
+		b = b[n:]
+	}
+
+	// Create aligned word size key.
+	var k [wordSize]byte
+	for i := range k {
+		k[i] = key[(pos+i)&3]
+	}
+	kw := *(*uintptr)(unsafe.Pointer(&k))
+
+	// Mask one word at a time.
+	n := (len(b) / wordSize) * wordSize
+	for i := 0; i < n; i += wordSize {
+		*(*uintptr)(unsafe.Pointer(uintptr(unsafe.Pointer(&b[0])) + uintptr(i))) ^= kw
+	}
+
+	// Mask one byte at a time for remaining bytes.
+	b = b[n:]
+	for i := range b {
+		b[i] ^= key[pos&3]
+		pos++
+	}
+
+	return pos & 3
+}

vendor/github.com/gorilla/websocket/mask_safe.go

@@ -0,0 +1,15 @@
+// Copyright 2016 The Gorilla WebSocket Authors. All rights reserved.  Use of
+// this source code is governed by a BSD-style license that can be found in the
+// LICENSE file.
+
+// +build appengine
+
+package websocket
+
+func maskBytes(key [4]byte, pos int, b []byte) int {
+	for i := range b {
+		b[i] ^= key[pos&3]
+		pos++
+	}
+	return pos & 3
+}

vendor/github.com/gorilla/websocket/prepared.go

@@ -0,0 +1,102 @@
+// Copyright 2017 The Gorilla WebSocket Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package websocket
+
+import (
+	"bytes"
+	"net"
+	"sync"
+	"time"
+)
+
+// PreparedMessage caches on the wire representations of a message payload.
+// Use PreparedMessage to efficiently send a message payload to multiple
+// connections. PreparedMessage is especially useful when compression is used
+// because the CPU and memory expensive compression operation can be executed
+// once for a given set of compression options.
+type PreparedMessage struct {
+	messageType int
+	data        []byte
+	mu          sync.Mutex
+	frames      map[prepareKey]*preparedFrame
+}
+
+// prepareKey defines a unique set of options to cache prepared frames in PreparedMessage.
+type prepareKey struct {
+	isServer         bool
+	compress         bool
+	compressionLevel int
+}
+
+// preparedFrame contains data in wire representation.
+type preparedFrame struct {
+	once sync.Once
+	data []byte
+}
+
+// NewPreparedMessage returns an initialized PreparedMessage. You can then send
+// it to connection using WritePreparedMessage method. Valid wire
+// representation will be calculated lazily only once for a set of current
+// connection options.
+func NewPreparedMessage(messageType int, data []byte) (*PreparedMessage, error) {
+	pm := &PreparedMessage{
+		messageType: messageType,
+		frames:      make(map[prepareKey]*preparedFrame),
+		data:        data,
+	}
+
+	// Prepare a plain server frame.
+	_, frameData, err := pm.frame(prepareKey{isServer: true, compress: false})
+	if err != nil {
+		return nil, err
+	}
+
+	// To protect against caller modifying the data argument, remember the data
+	// copied to the plain server frame.
+	pm.data = frameData[len(frameData)-len(data):]
+	return pm, nil
+}
+
+func (pm *PreparedMessage) frame(key prepareKey) (int, []byte, error) {
+	pm.mu.Lock()
+	frame, ok := pm.frames[key]
+	if !ok {
+		frame = &preparedFrame{}
+		pm.frames[key] = frame
+	}
+	pm.mu.Unlock()
+
+	var err error
+	frame.once.Do(func() {
+		// Prepare a frame using a 'fake' connection.
+		// TODO: Refactor code in conn.go to allow more direct construction of
+		// the frame.
+		mu := make(chan bool, 1)
+		mu <- true
+		var nc prepareConn
+		c := &Conn{
+			conn:                   &nc,
+			mu:                     mu,
+			isServer:               key.isServer,
+			compressionLevel:       key.compressionLevel,
+			enableWriteCompression: true,
+			writeBuf:               make([]byte, defaultWriteBufferSize+maxFrameHeaderSize),
+		}
+		if key.compress {
+			c.newCompressionWriter = compressNoContextTakeover
+		}
+		err = c.WriteMessage(pm.messageType, pm.data)
+		frame.data = nc.buf.Bytes()
+	})
+	return pm.messageType, frame.data, err
+}
+
+type prepareConn struct {
+	buf bytes.Buffer
+	net.Conn
+}
+
+func (pc *prepareConn) Write(p []byte) (int, error)        { return pc.buf.Write(p) }
+func (pc *prepareConn) SetWriteDeadline(t time.Time) error { return nil }

vendor/github.com/gorilla/websocket/proxy.go

@@ -0,0 +1,77 @@
+// Copyright 2017 The Gorilla WebSocket Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package websocket
+
+import (
+	"bufio"
+	"encoding/base64"
+	"errors"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+type netDialerFunc func(network, addr string) (net.Conn, error)
+
+func (fn netDialerFunc) Dial(network, addr string) (net.Conn, error) {
+	return fn(network, addr)
+}
+
+func init() {
+	proxy_RegisterDialerType("http", func(proxyURL *url.URL, forwardDialer proxy_Dialer) (proxy_Dialer, error) {
+		return &httpProxyDialer{proxyURL: proxyURL, forwardDial: forwardDialer.Dial}, nil
+	})
+}
+
+type httpProxyDialer struct {
+	proxyURL    *url.URL
+	forwardDial func(network, addr string) (net.Conn, error)
+}
+
+func (hpd *httpProxyDialer) Dial(network string, addr string) (net.Conn, error) {
+	hostPort, _ := hostPortNoPort(hpd.proxyURL)
+	conn, err := hpd.forwardDial(network, hostPort)
+	if err != nil {
+		return nil, err
+	}
+
+	connectHeader := make(http.Header)
+	if user := hpd.proxyURL.User; user != nil {
+		proxyUser := user.Username()
+		if proxyPassword, passwordSet := user.Password(); passwordSet {
+			credential := base64.StdEncoding.EncodeToString([]byte(proxyUser + ":" + proxyPassword))
+			connectHeader.Set("Proxy-Authorization", "Basic "+credential)
+		}
+	}
+
+	connectReq := &http.Request{
+		Method: "CONNECT",
+		URL:    &url.URL{Opaque: addr},
+		Host:   addr,
+		Header: connectHeader,
+	}
+
+	if err := connectReq.Write(conn); err != nil {
+		conn.Close()
+		return nil, err
+	}
+
+	// Read response. It's OK to use and discard buffered reader here becaue
+	// the remote server does not speak until spoken to.
+	br := bufio.NewReader(conn)
+	resp, err := http.ReadResponse(br, connectReq)
+	if err != nil {
+		conn.Close()
+		return nil, err
+	}
+
+	if resp.StatusCode != 200 {
+		conn.Close()
+		f := strings.SplitN(resp.Status, " ", 2)
+		return nil, errors.New(f[1])
+	}
+	return conn, nil
+}

vendor/github.com/gorilla/websocket/server.go

@@ -0,0 +1,363 @@
+// Copyright 2013 The Gorilla WebSocket Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package websocket
+
+import (
+	"bufio"
+	"errors"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+// HandshakeError describes an error with the handshake from the peer.
+type HandshakeError struct {
+	message string
+}
+
+func (e HandshakeError) Error() string { return e.message }
+
+// Upgrader specifies parameters for upgrading an HTTP connection to a
+// WebSocket connection.
+type Upgrader struct {
+	// HandshakeTimeout specifies the duration for the handshake to complete.
+	HandshakeTimeout time.Duration
+
+	// ReadBufferSize and WriteBufferSize specify I/O buffer sizes in bytes. If a buffer
+	// size is zero, then buffers allocated by the HTTP server are used. The
+	// I/O buffer sizes do not limit the size of the messages that can be sent
+	// or received.
+	ReadBufferSize, WriteBufferSize int
+
+	// WriteBufferPool is a pool of buffers for write operations. If the value
+	// is not set, then write buffers are allocated to the connection for the
+	// lifetime of the connection.
+	//
+	// A pool is most useful when the application has a modest volume of writes
+	// across a large number of connections.
+	//
+	// Applications should use a single pool for each unique value of
+	// WriteBufferSize.
+	WriteBufferPool BufferPool
+
+	// Subprotocols specifies the server's supported protocols in order of
+	// preference. If this field is not nil, then the Upgrade method negotiates a
+	// subprotocol by selecting the first match in this list with a protocol
+	// requested by the client. If there's no match, then no protocol is
+	// negotiated (the Sec-Websocket-Protocol header is not included in the
+	// handshake response).
+	Subprotocols []string
+
+	// Error specifies the function for generating HTTP error responses. If Error
+	// is nil, then http.Error is used to generate the HTTP response.
+	Error func(w http.ResponseWriter, r *http.Request, status int, reason error)
+
+	// CheckOrigin returns true if the request Origin header is acceptable. If
+	// CheckOrigin is nil, then a safe default is used: return false if the
+	// Origin request header is present and the origin host is not equal to
+	// request Host header.
+	//
+	// A CheckOrigin function should carefully validate the request origin to
+	// prevent cross-site request forgery.
+	CheckOrigin func(r *http.Request) bool
+
+	// EnableCompression specify if the server should attempt to negotiate per
+	// message compression (RFC 7692). Setting this value to true does not
+	// guarantee that compression will be supported. Currently only "no context
+	// takeover" modes are supported.
+	EnableCompression bool
+}
+
+func (u *Upgrader) returnError(w http.ResponseWriter, r *http.Request, status int, reason string) (*Conn, error) {
+	err := HandshakeError{reason}
+	if u.Error != nil {
+		u.Error(w, r, status, err)
+	} else {
+		w.Header().Set("Sec-Websocket-Version", "13")
+		http.Error(w, http.StatusText(status), status)
+	}
+	return nil, err
+}
+
+// checkSameOrigin returns true if the origin is not set or is equal to the request host.
+func checkSameOrigin(r *http.Request) bool {
+	origin := r.Header["Origin"]
+	if len(origin) == 0 {
+		return true
+	}
+	u, err := url.Parse(origin[0])
+	if err != nil {
+		return false
+	}
+	return equalASCIIFold(u.Host, r.Host)
+}
+
+func (u *Upgrader) selectSubprotocol(r *http.Request, responseHeader http.Header) string {
+	if u.Subprotocols != nil {
+		clientProtocols := Subprotocols(r)
+		for _, serverProtocol := range u.Subprotocols {
+			for _, clientProtocol := range clientProtocols {
+				if clientProtocol == serverProtocol {
+					return clientProtocol
+				}
+			}
+		}
+	} else if responseHeader != nil {
+		return responseHeader.Get("Sec-Websocket-Protocol")
+	}
+	return ""
+}
+
+// Upgrade upgrades the HTTP server connection to the WebSocket protocol.
+//
+// The responseHeader is included in the response to the client's upgrade
+// request. Use the responseHeader to specify cookies (Set-Cookie) and the
+// application negotiated subprotocol (Sec-WebSocket-Protocol).
+//
+// If the upgrade fails, then Upgrade replies to the client with an HTTP error
+// response.
+func (u *Upgrader) Upgrade(w http.ResponseWriter, r *http.Request, responseHeader http.Header) (*Conn, error) {
+	const badHandshake = "websocket: the client is not using the websocket protocol: "
+
+	if !tokenListContainsValue(r.Header, "Connection", "upgrade") {
+		return u.returnError(w, r, http.StatusBadRequest, badHandshake+"'upgrade' token not found in 'Connection' header")
+	}
+
+	if !tokenListContainsValue(r.Header, "Upgrade", "websocket") {
+		return u.returnError(w, r, http.StatusBadRequest, badHandshake+"'websocket' token not found in 'Upgrade' header")
+	}
+
+	if r.Method != "GET" {
+		return u.returnError(w, r, http.StatusMethodNotAllowed, badHandshake+"request method is not GET")
+	}
+
+	if !tokenListContainsValue(r.Header, "Sec-Websocket-Version", "13") {
+		return u.returnError(w, r, http.StatusBadRequest, "websocket: unsupported version: 13 not found in 'Sec-Websocket-Version' header")
+	}
+
+	if _, ok := responseHeader["Sec-Websocket-Extensions"]; ok {
+		return u.returnError(w, r, http.StatusInternalServerError, "websocket: application specific 'Sec-WebSocket-Extensions' headers are unsupported")
+	}
+
+	checkOrigin := u.CheckOrigin
+	if checkOrigin == nil {
+		checkOrigin = checkSameOrigin
+	}
+	if !checkOrigin(r) {
+		return u.returnError(w, r, http.StatusForbidden, "websocket: request origin not allowed by Upgrader.CheckOrigin")
+	}
+
+	challengeKey := r.Header.Get("Sec-Websocket-Key")
+	if challengeKey == "" {
+		return u.returnError(w, r, http.StatusBadRequest, "websocket: not a websocket handshake: `Sec-WebSocket-Key' header is missing or blank")
+	}
+
+	subprotocol := u.selectSubprotocol(r, responseHeader)
+
+	// Negotiate PMCE
+	var compress bool
+	if u.EnableCompression {
+		for _, ext := range parseExtensions(r.Header) {
+			if ext[""] != "permessage-deflate" {
+				continue
+			}
+			compress = true
+			break
+		}
+	}
+
+	h, ok := w.(http.Hijacker)
+	if !ok {
+		return u.returnError(w, r, http.StatusInternalServerError, "websocket: response does not implement http.Hijacker")
+	}
+	var brw *bufio.ReadWriter
+	netConn, brw, err := h.Hijack()
+	if err != nil {
+		return u.returnError(w, r, http.StatusInternalServerError, err.Error())
+	}
+
+	if brw.Reader.Buffered() > 0 {
+		netConn.Close()
+		return nil, errors.New("websocket: client sent data before handshake is complete")
+	}
+
+	var br *bufio.Reader
+	if u.ReadBufferSize == 0 && bufioReaderSize(netConn, brw.Reader) > 256 {
+		// Reuse hijacked buffered reader as connection reader.
+		br = brw.Reader
+	}
+
+	buf := bufioWriterBuffer(netConn, brw.Writer)
+
+	var writeBuf []byte
+	if u.WriteBufferPool == nil && u.WriteBufferSize == 0 && len(buf) >= maxFrameHeaderSize+256 {
+		// Reuse hijacked write buffer as connection buffer.
+		writeBuf = buf
+	}
+
+	c := newConn(netConn, true, u.ReadBufferSize, u.WriteBufferSize, u.WriteBufferPool, br, writeBuf)
+	c.subprotocol = subprotocol
+
+	if compress {
+		c.newCompressionWriter = compressNoContextTakeover
+		c.newDecompressionReader = decompressNoContextTakeover
+	}
+
+	// Use larger of hijacked buffer and connection write buffer for header.
+	p := buf
+	if len(c.writeBuf) > len(p) {
+		p = c.writeBuf
+	}
+	p = p[:0]
+
+	p = append(p, "HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Accept: "...)
+	p = append(p, computeAcceptKey(challengeKey)...)
+	p = append(p, "\r\n"...)
+	if c.subprotocol != "" {
+		p = append(p, "Sec-WebSocket-Protocol: "...)
+		p = append(p, c.subprotocol...)
+		p = append(p, "\r\n"...)
+	}
+	if compress {
+		p = append(p, "Sec-WebSocket-Extensions: permessage-deflate; server_no_context_takeover; client_no_context_takeover\r\n"...)
+	}
+	for k, vs := range responseHeader {
+		if k == "Sec-Websocket-Protocol" {
+			continue
+		}
+		for _, v := range vs {
+			p = append(p, k...)
+			p = append(p, ": "...)
+			for i := 0; i < len(v); i++ {
+				b := v[i]
+				if b <= 31 {
+					// prevent response splitting.
+					b = ' '
+				}
+				p = append(p, b)
+			}
+			p = append(p, "\r\n"...)
+		}
+	}
+	p = append(p, "\r\n"...)
+
+	// Clear deadlines set by HTTP server.
+	netConn.SetDeadline(time.Time{})
+
+	if u.HandshakeTimeout > 0 {
+		netConn.SetWriteDeadline(time.Now().Add(u.HandshakeTimeout))
+	}
+	if _, err = netConn.Write(p); err != nil {
+		netConn.Close()
+		return nil, err
+	}
+	if u.HandshakeTimeout > 0 {
+		netConn.SetWriteDeadline(time.Time{})
+	}
+
+	return c, nil
+}
+
+// Upgrade upgrades the HTTP server connection to the WebSocket protocol.
+//
+// Deprecated: Use websocket.Upgrader instead.
+//
+// Upgrade does not perform origin checking. The application is responsible for
+// checking the Origin header before calling Upgrade. An example implementation
+// of the same origin policy check is:
+//
+//	if req.Header.Get("Origin") != "http://"+req.Host {
+//		http.Error(w, "Origin not allowed", http.StatusForbidden)
+//		return
+//	}
+//
+// If the endpoint supports subprotocols, then the application is responsible
+// for negotiating the protocol used on the connection. Use the Subprotocols()
+// function to get the subprotocols requested by the client. Use the
+// Sec-Websocket-Protocol response header to specify the subprotocol selected
+// by the application.
+//
+// The responseHeader is included in the response to the client's upgrade
+// request. Use the responseHeader to specify cookies (Set-Cookie) and the
+// negotiated subprotocol (Sec-Websocket-Protocol).
+//
+// The connection buffers IO to the underlying network connection. The
+// readBufSize and writeBufSize parameters specify the size of the buffers to
+// use. Messages can be larger than the buffers.
+//
+// If the request is not a valid WebSocket handshake, then Upgrade returns an
+// error of type HandshakeError. Applications should handle this error by
+// replying to the client with an HTTP error response.
+func Upgrade(w http.ResponseWriter, r *http.Request, responseHeader http.Header, readBufSize, writeBufSize int) (*Conn, error) {
+	u := Upgrader{ReadBufferSize: readBufSize, WriteBufferSize: writeBufSize}
+	u.Error = func(w http.ResponseWriter, r *http.Request, status int, reason error) {
+		// don't return errors to maintain backwards compatibility
+	}
+	u.CheckOrigin = func(r *http.Request) bool {
+		// allow all connections by default
+		return true
+	}
+	return u.Upgrade(w, r, responseHeader)
+}
+
+// Subprotocols returns the subprotocols requested by the client in the
+// Sec-Websocket-Protocol header.
+func Subprotocols(r *http.Request) []string {
+	h := strings.TrimSpace(r.Header.Get("Sec-Websocket-Protocol"))
+	if h == "" {
+		return nil
+	}
+	protocols := strings.Split(h, ",")
+	for i := range protocols {
+		protocols[i] = strings.TrimSpace(protocols[i])
+	}
+	return protocols
+}
+
+// IsWebSocketUpgrade returns true if the client requested upgrade to the
+// WebSocket protocol.
+func IsWebSocketUpgrade(r *http.Request) bool {
+	return tokenListContainsValue(r.Header, "Connection", "upgrade") &&
+		tokenListContainsValue(r.Header, "Upgrade", "websocket")
+}
+
+// bufioReaderSize size returns the size of a bufio.Reader.
+func bufioReaderSize(originalReader io.Reader, br *bufio.Reader) int {
+	// This code assumes that peek on a reset reader returns
+	// bufio.Reader.buf[:0].
+	// TODO: Use bufio.Reader.Size() after Go 1.10
+	br.Reset(originalReader)
+	if p, err := br.Peek(0); err == nil {
+		return cap(p)
+	}
+	return 0
+}
+
+// writeHook is an io.Writer that records the last slice passed to it vio
+// io.Writer.Write.
+type writeHook struct {
+	p []byte
+}
+
+func (wh *writeHook) Write(p []byte) (int, error) {
+	wh.p = p
+	return len(p), nil
+}
+
+// bufioWriterBuffer grabs the buffer from a bufio.Writer.
+func bufioWriterBuffer(originalWriter io.Writer, bw *bufio.Writer) []byte {
+	// This code assumes that bufio.Writer.buf[:1] is passed to the
+	// bufio.Writer's underlying writer.
+	var wh writeHook
+	bw.Reset(&wh)
+	bw.WriteByte(0)
+	bw.Flush()
+
+	bw.Reset(originalWriter)
+
+	return wh.p[:cap(wh.p)]
+}

vendor/github.com/gorilla/websocket/trace.go

@@ -0,0 +1,19 @@
+// +build go1.8
+
+package websocket
+
+import (
+	"crypto/tls"
+	"net/http/httptrace"
+)
+
+func doHandshakeWithTrace(trace *httptrace.ClientTrace, tlsConn *tls.Conn, cfg *tls.Config) error {
+	if trace.TLSHandshakeStart != nil {
+		trace.TLSHandshakeStart()
+	}
+	err := doHandshake(tlsConn, cfg)
+	if trace.TLSHandshakeDone != nil {
+		trace.TLSHandshakeDone(tlsConn.ConnectionState(), err)
+	}
+	return err
+}

vendor/github.com/gorilla/websocket/trace_17.go

@@ -0,0 +1,12 @@
+// +build !go1.8
+
+package websocket
+
+import (
+	"crypto/tls"
+	"net/http/httptrace"
+)
+
+func doHandshakeWithTrace(trace *httptrace.ClientTrace, tlsConn *tls.Conn, cfg *tls.Config) error {
+	return doHandshake(tlsConn, cfg)
+}

vendor/github.com/gorilla/websocket/util.go

@@ -0,0 +1,283 @@
+// Copyright 2013 The Gorilla WebSocket Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package websocket
+
+import (
+	"crypto/rand"
+	"crypto/sha1"
+	"encoding/base64"
+	"io"
+	"net/http"
+	"strings"
+	"unicode/utf8"
+)
+
+var keyGUID = []byte("258EAFA5-E914-47DA-95CA-C5AB0DC85B11")
+
+func computeAcceptKey(challengeKey string) string {
+	h := sha1.New()
+	h.Write([]byte(challengeKey))
+	h.Write(keyGUID)
+	return base64.StdEncoding.EncodeToString(h.Sum(nil))
+}
+
+func generateChallengeKey() (string, error) {
+	p := make([]byte, 16)
+	if _, err := io.ReadFull(rand.Reader, p); err != nil {
+		return "", err
+	}
+	return base64.StdEncoding.EncodeToString(p), nil
+}
+
+// Token octets per RFC 2616.
+var isTokenOctet = [256]bool{
+	'!':  true,
+	'#':  true,
+	'$':  true,
+	'%':  true,
+	'&':  true,
+	'\'': true,
+	'*':  true,
+	'+':  true,
+	'-':  true,
+	'.':  true,
+	'0':  true,
+	'1':  true,
+	'2':  true,
+	'3':  true,
+	'4':  true,
+	'5':  true,
+	'6':  true,
+	'7':  true,
+	'8':  true,
+	'9':  true,
+	'A':  true,
+	'B':  true,
+	'C':  true,
+	'D':  true,
+	'E':  true,
+	'F':  true,
+	'G':  true,
+	'H':  true,
+	'I':  true,
+	'J':  true,
+	'K':  true,
+	'L':  true,
+	'M':  true,
+	'N':  true,
+	'O':  true,
+	'P':  true,
+	'Q':  true,
+	'R':  true,
+	'S':  true,
+	'T':  true,
+	'U':  true,
+	'W':  true,
+	'V':  true,
+	'X':  true,
+	'Y':  true,
+	'Z':  true,
+	'^':  true,
+	'_':  true,
+	'`':  true,
+	'a':  true,
+	'b':  true,
+	'c':  true,
+	'd':  true,
+	'e':  true,
+	'f':  true,
+	'g':  true,
+	'h':  true,
+	'i':  true,
+	'j':  true,
+	'k':  true,
+	'l':  true,
+	'm':  true,
+	'n':  true,
+	'o':  true,
+	'p':  true,
+	'q':  true,
+	'r':  true,
+	's':  true,
+	't':  true,
+	'u':  true,
+	'v':  true,
+	'w':  true,
+	'x':  true,
+	'y':  true,
+	'z':  true,
+	'|':  true,
+	'~':  true,
+}
+
+// skipSpace returns a slice of the string s with all leading RFC 2616 linear
+// whitespace removed.
+func skipSpace(s string) (rest string) {
+	i := 0
+	for ; i < len(s); i++ {
+		if b := s[i]; b != ' ' && b != '\t' {
+			break
+		}
+	}
+	return s[i:]
+}
+
+// nextToken returns the leading RFC 2616 token of s and the string following
+// the token.
+func nextToken(s string) (token, rest string) {
+	i := 0
+	for ; i < len(s); i++ {
+		if !isTokenOctet[s[i]] {
+			break
+		}
+	}
+	return s[:i], s[i:]
+}
+
+// nextTokenOrQuoted returns the leading token or quoted string per RFC 2616
+// and the string following the token or quoted string.
+func nextTokenOrQuoted(s string) (value string, rest string) {
+	if !strings.HasPrefix(s, "\"") {
+		return nextToken(s)
+	}
+	s = s[1:]
+	for i := 0; i < len(s); i++ {
+		switch s[i] {
+		case '"':
+			return s[:i], s[i+1:]
+		case '\\':
+			p := make([]byte, len(s)-1)
+			j := copy(p, s[:i])
+			escape := true
+			for i = i + 1; i < len(s); i++ {
+				b := s[i]
+				switch {
+				case escape:
+					escape = false
+					p[j] = b
+					j++
+				case b == '\\':
+					escape = true
+				case b == '"':
+					return string(p[:j]), s[i+1:]
+				default:
+					p[j] = b
+					j++
+				}
+			}
+			return "", ""
+		}
+	}
+	return "", ""
+}
+
+// equalASCIIFold returns true if s is equal to t with ASCII case folding as
+// defined in RFC 4790.
+func equalASCIIFold(s, t string) bool {
+	for s != "" && t != "" {
+		sr, size := utf8.DecodeRuneInString(s)
+		s = s[size:]
+		tr, size := utf8.DecodeRuneInString(t)
+		t = t[size:]
+		if sr == tr {
+			continue
+		}
+		if 'A' <= sr && sr <= 'Z' {
+			sr = sr + 'a' - 'A'
+		}
+		if 'A' <= tr && tr <= 'Z' {
+			tr = tr + 'a' - 'A'
+		}
+		if sr != tr {
+			return false
+		}
+	}
+	return s == t
+}
+
+// tokenListContainsValue returns true if the 1#token header with the given
+// name contains a token equal to value with ASCII case folding.
+func tokenListContainsValue(header http.Header, name string, value string) bool {
+headers:
+	for _, s := range header[name] {
+		for {
+			var t string
+			t, s = nextToken(skipSpace(s))
+			if t == "" {
+				continue headers
+			}
+			s = skipSpace(s)
+			if s != "" && s[0] != ',' {
+				continue headers
+			}
+			if equalASCIIFold(t, value) {
+				return true
+			}
+			if s == "" {
+				continue headers
+			}
+			s = s[1:]
+		}
+	}
+	return false
+}
+
+// parseExtensions parses WebSocket extensions from a header.
+func parseExtensions(header http.Header) []map[string]string {
+	// From RFC 6455:
+	//
+	//  Sec-WebSocket-Extensions = extension-list
+	//  extension-list = 1#extension
+	//  extension = extension-token *( ";" extension-param )
+	//  extension-token = registered-token
+	//  registered-token = token
+	//  extension-param = token [ "=" (token | quoted-string) ]
+	//     ;When using the quoted-string syntax variant, the value
+	//     ;after quoted-string unescaping MUST conform to the
+	//     ;'token' ABNF.
+
+	var result []map[string]string
+headers:
+	for _, s := range header["Sec-Websocket-Extensions"] {
+		for {
+			var t string
+			t, s = nextToken(skipSpace(s))
+			if t == "" {
+				continue headers
+			}
+			ext := map[string]string{"": t}
+			for {
+				s = skipSpace(s)
+				if !strings.HasPrefix(s, ";") {
+					break
+				}
+				var k string
+				k, s = nextToken(skipSpace(s[1:]))
+				if k == "" {
+					continue headers
+				}
+				s = skipSpace(s)
+				var v string
+				if strings.HasPrefix(s, "=") {
+					v, s = nextTokenOrQuoted(skipSpace(s[1:]))
+					s = skipSpace(s)
+				}
+				if s != "" && s[0] != ',' && s[0] != ';' {
+					continue headers
+				}
+				ext[k] = v
+			}
+			if s != "" && s[0] != ',' {
+				continue headers
+			}
+			result = append(result, ext)
+			if s == "" {
+				continue headers
+			}
+			s = s[1:]
+		}
+	}
+	return result
+}

vendor/github.com/gorilla/websocket/x_net_proxy.go

@@ -0,0 +1,473 @@
+// Code generated by golang.org/x/tools/cmd/bundle. DO NOT EDIT.
+//go:generate bundle -o x_net_proxy.go golang.org/x/net/proxy
+
+// Package proxy provides support for a variety of protocols to proxy network
+// data.
+//
+
+package websocket
+
+import (
+	"errors"
+	"io"
+	"net"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+)
+
+type proxy_direct struct{}
+
+// Direct is a direct proxy: one that makes network connections directly.
+var proxy_Direct = proxy_direct{}
+
+func (proxy_direct) Dial(network, addr string) (net.Conn, error) {
+	return net.Dial(network, addr)
+}
+
+// A PerHost directs connections to a default Dialer unless the host name
+// requested matches one of a number of exceptions.
+type proxy_PerHost struct {
+	def, bypass proxy_Dialer
+
+	bypassNetworks []*net.IPNet
+	bypassIPs      []net.IP
+	bypassZones    []string
+	bypassHosts    []string
+}
+
+// NewPerHost returns a PerHost Dialer that directs connections to either
+// defaultDialer or bypass, depending on whether the connection matches one of
+// the configured rules.
+func proxy_NewPerHost(defaultDialer, bypass proxy_Dialer) *proxy_PerHost {
+	return &proxy_PerHost{
+		def:    defaultDialer,
+		bypass: bypass,
+	}
+}
+
+// Dial connects to the address addr on the given network through either
+// defaultDialer or bypass.
+func (p *proxy_PerHost) Dial(network, addr string) (c net.Conn, err error) {
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		return nil, err
+	}
+
+	return p.dialerForRequest(host).Dial(network, addr)
+}
+
+func (p *proxy_PerHost) dialerForRequest(host string) proxy_Dialer {
+	if ip := net.ParseIP(host); ip != nil {
+		for _, net := range p.bypassNetworks {
+			if net.Contains(ip) {
+				return p.bypass
+			}
+		}
+		for _, bypassIP := range p.bypassIPs {
+			if bypassIP.Equal(ip) {
+				return p.bypass
+			}
+		}
+		return p.def
+	}
+
+	for _, zone := range p.bypassZones {
+		if strings.HasSuffix(host, zone) {
+			return p.bypass
+		}
+		if host == zone[1:] {
+			// For a zone ".example.com", we match "example.com"
+			// too.
+			return p.bypass
+		}
+	}
+	for _, bypassHost := range p.bypassHosts {
+		if bypassHost == host {
+			return p.bypass
+		}
+	}
+	return p.def
+}
+
+// AddFromString parses a string that contains comma-separated values
+// specifying hosts that should use the bypass proxy. Each value is either an
+// IP address, a CIDR range, a zone (*.example.com) or a host name
+// (localhost). A best effort is made to parse the string and errors are
+// ignored.
+func (p *proxy_PerHost) AddFromString(s string) {
+	hosts := strings.Split(s, ",")
+	for _, host := range hosts {
+		host = strings.TrimSpace(host)
+		if len(host) == 0 {
+			continue
+		}
+		if strings.Contains(host, "/") {
+			// We assume that it's a CIDR address like 127.0.0.0/8
+			if _, net, err := net.ParseCIDR(host); err == nil {
+				p.AddNetwork(net)
+			}
+			continue
+		}
+		if ip := net.ParseIP(host); ip != nil {
+			p.AddIP(ip)
+			continue
+		}
+		if strings.HasPrefix(host, "*.") {
+			p.AddZone(host[1:])
+			continue
+		}
+		p.AddHost(host)
+	}
+}
+
+// AddIP specifies an IP address that will use the bypass proxy. Note that
+// this will only take effect if a literal IP address is dialed. A connection
+// to a named host will never match an IP.
+func (p *proxy_PerHost) AddIP(ip net.IP) {
+	p.bypassIPs = append(p.bypassIPs, ip)
+}
+
+// AddNetwork specifies an IP range that will use the bypass proxy. Note that
+// this will only take effect if a literal IP address is dialed. A connection
+// to a named host will never match.
+func (p *proxy_PerHost) AddNetwork(net *net.IPNet) {
+	p.bypassNetworks = append(p.bypassNetworks, net)
+}
+
+// AddZone specifies a DNS suffix that will use the bypass proxy. A zone of
+// "example.com" matches "example.com" and all of its subdomains.
+func (p *proxy_PerHost) AddZone(zone string) {
+	if strings.HasSuffix(zone, ".") {
+		zone = zone[:len(zone)-1]
+	}
+	if !strings.HasPrefix(zone, ".") {
+		zone = "." + zone
+	}
+	p.bypassZones = append(p.bypassZones, zone)
+}
+
+// AddHost specifies a host name that will use the bypass proxy.
+func (p *proxy_PerHost) AddHost(host string) {
+	if strings.HasSuffix(host, ".") {
+		host = host[:len(host)-1]
+	}
+	p.bypassHosts = append(p.bypassHosts, host)
+}
+
+// A Dialer is a means to establish a connection.
+type proxy_Dialer interface {
+	// Dial connects to the given address via the proxy.
+	Dial(network, addr string) (c net.Conn, err error)
+}
+
+// Auth contains authentication parameters that specific Dialers may require.
+type proxy_Auth struct {
+	User, Password string
+}
+
+// FromEnvironment returns the dialer specified by the proxy related variables in
+// the environment.
+func proxy_FromEnvironment() proxy_Dialer {
+	allProxy := proxy_allProxyEnv.Get()
+	if len(allProxy) == 0 {
+		return proxy_Direct
+	}
+
+	proxyURL, err := url.Parse(allProxy)
+	if err != nil {
+		return proxy_Direct
+	}
+	proxy, err := proxy_FromURL(proxyURL, proxy_Direct)
+	if err != nil {
+		return proxy_Direct
+	}
+
+	noProxy := proxy_noProxyEnv.Get()
+	if len(noProxy) == 0 {
+		return proxy
+	}
+
+	perHost := proxy_NewPerHost(proxy, proxy_Direct)
+	perHost.AddFromString(noProxy)
+	return perHost
+}
+
+// proxySchemes is a map from URL schemes to a function that creates a Dialer
+// from a URL with such a scheme.
+var proxy_proxySchemes map[string]func(*url.URL, proxy_Dialer) (proxy_Dialer, error)
+
+// RegisterDialerType takes a URL scheme and a function to generate Dialers from
+// a URL with that scheme and a forwarding Dialer. Registered schemes are used
+// by FromURL.
+func proxy_RegisterDialerType(scheme string, f func(*url.URL, proxy_Dialer) (proxy_Dialer, error)) {
+	if proxy_proxySchemes == nil {
+		proxy_proxySchemes = make(map[string]func(*url.URL, proxy_Dialer) (proxy_Dialer, error))
+	}
+	proxy_proxySchemes[scheme] = f
+}
+
+// FromURL returns a Dialer given a URL specification and an underlying
+// Dialer for it to make network requests.
+func proxy_FromURL(u *url.URL, forward proxy_Dialer) (proxy_Dialer, error) {
+	var auth *proxy_Auth
+	if u.User != nil {
+		auth = new(proxy_Auth)
+		auth.User = u.User.Username()
+		if p, ok := u.User.Password(); ok {
+			auth.Password = p
+		}
+	}
+
+	switch u.Scheme {
+	case "socks5":
+		return proxy_SOCKS5("tcp", u.Host, auth, forward)
+	}
+
+	// If the scheme doesn't match any of the built-in schemes, see if it
+	// was registered by another package.
+	if proxy_proxySchemes != nil {
+		if f, ok := proxy_proxySchemes[u.Scheme]; ok {
+			return f(u, forward)
+		}
+	}
+
+	return nil, errors.New("proxy: unknown scheme: " + u.Scheme)
+}
+
+var (
+	proxy_allProxyEnv = &proxy_envOnce{
+		names: []string{"ALL_PROXY", "all_proxy"},
+	}
+	proxy_noProxyEnv = &proxy_envOnce{
+		names: []string{"NO_PROXY", "no_proxy"},
+	}
+)
+
+// envOnce looks up an environment variable (optionally by multiple
+// names) once. It mitigates expensive lookups on some platforms
+// (e.g. Windows).
+// (Borrowed from net/http/transport.go)
+type proxy_envOnce struct {
+	names []string
+	once  sync.Once
+	val   string
+}
+
+func (e *proxy_envOnce) Get() string {
+	e.once.Do(e.init)
+	return e.val
+}
+
+func (e *proxy_envOnce) init() {
+	for _, n := range e.names {
+		e.val = os.Getenv(n)
+		if e.val != "" {
+			return
+		}
+	}
+}
+
+// SOCKS5 returns a Dialer that makes SOCKSv5 connections to the given address
+// with an optional username and password. See RFC 1928 and RFC 1929.
+func proxy_SOCKS5(network, addr string, auth *proxy_Auth, forward proxy_Dialer) (proxy_Dialer, error) {
+	s := &proxy_socks5{
+		network: network,
+		addr:    addr,
+		forward: forward,
+	}
+	if auth != nil {
+		s.user = auth.User
+		s.password = auth.Password
+	}
+
+	return s, nil
+}
+
+type proxy_socks5 struct {
+	user, password string
+	network, addr  string
+	forward        proxy_Dialer
+}
+
+const proxy_socks5Version = 5
+
+const (
+	proxy_socks5AuthNone     = 0
+	proxy_socks5AuthPassword = 2
+)
+
+const proxy_socks5Connect = 1
+
+const (
+	proxy_socks5IP4    = 1
+	proxy_socks5Domain = 3
+	proxy_socks5IP6    = 4
+)
+
+var proxy_socks5Errors = []string{
+	"",
+	"general failure",
+	"connection forbidden",
+	"network unreachable",
+	"host unreachable",
+	"connection refused",
+	"TTL expired",
+	"command not supported",
+	"address type not supported",
+}
+
+// Dial connects to the address addr on the given network via the SOCKS5 proxy.
+func (s *proxy_socks5) Dial(network, addr string) (net.Conn, error) {
+	switch network {
+	case "tcp", "tcp6", "tcp4":
+	default:
+		return nil, errors.New("proxy: no support for SOCKS5 proxy connections of type " + network)
+	}
+
+	conn, err := s.forward.Dial(s.network, s.addr)
+	if err != nil {
+		return nil, err
+	}
+	if err := s.connect(conn, addr); err != nil {
+		conn.Close()
+		return nil, err
+	}
+	return conn, nil
+}
+
+// connect takes an existing connection to a socks5 proxy server,
+// and commands the server to extend that connection to target,
+// which must be a canonical address with a host and port.
+func (s *proxy_socks5) connect(conn net.Conn, target string) error {
+	host, portStr, err := net.SplitHostPort(target)
+	if err != nil {
+		return err
+	}
+
+	port, err := strconv.Atoi(portStr)
+	if err != nil {
+		return errors.New("proxy: failed to parse port number: " + portStr)
+	}
+	if port < 1 || port > 0xffff {
+		return errors.New("proxy: port number out of range: " + portStr)
+	}
+
+	// the size here is just an estimate
+	buf := make([]byte, 0, 6+len(host))
+
+	buf = append(buf, proxy_socks5Version)
+	if len(s.user) > 0 && len(s.user) < 256 && len(s.password) < 256 {
+		buf = append(buf, 2 /* num auth methods */, proxy_socks5AuthNone, proxy_socks5AuthPassword)
+	} else {
+		buf = append(buf, 1 /* num auth methods */, proxy_socks5AuthNone)
+	}
+
+	if _, err := conn.Write(buf); err != nil {
+		return errors.New("proxy: failed to write greeting to SOCKS5 proxy at " + s.addr + ": " + err.Error())
+	}
+
+	if _, err := io.ReadFull(conn, buf[:2]); err != nil {
+		return errors.New("proxy: failed to read greeting from SOCKS5 proxy at " + s.addr + ": " + err.Error())
+	}
+	if buf[0] != 5 {
+		return errors.New("proxy: SOCKS5 proxy at " + s.addr + " has unexpected version " + strconv.Itoa(int(buf[0])))
+	}
+	if buf[1] == 0xff {
+		return errors.New("proxy: SOCKS5 proxy at " + s.addr + " requires authentication")
+	}
+
+	// See RFC 1929
+	if buf[1] == proxy_socks5AuthPassword {
+		buf = buf[:0]
+		buf = append(buf, 1 /* password protocol version */)
+		buf = append(buf, uint8(len(s.user)))
+		buf = append(buf, s.user...)
+		buf = append(buf, uint8(len(s.password)))
+		buf = append(buf, s.password...)
+
+		if _, err := conn.Write(buf); err != nil {
+			return errors.New("proxy: failed to write authentication request to SOCKS5 proxy at " + s.addr + ": " + err.Error())
+		}
+
+		if _, err := io.ReadFull(conn, buf[:2]); err != nil {
+			return errors.New("proxy: failed to read authentication reply from SOCKS5 proxy at " + s.addr + ": " + err.Error())
+		}
+
+		if buf[1] != 0 {
+			return errors.New("proxy: SOCKS5 proxy at " + s.addr + " rejected username/password")
+		}
+	}
+
+	buf = buf[:0]
+	buf = append(buf, proxy_socks5Version, proxy_socks5Connect, 0 /* reserved */)
+
+	if ip := net.ParseIP(host); ip != nil {
+		if ip4 := ip.To4(); ip4 != nil {
+			buf = append(buf, proxy_socks5IP4)
+			ip = ip4
+		} else {
+			buf = append(buf, proxy_socks5IP6)
+		}
+		buf = append(buf, ip...)
+	} else {
+		if len(host) > 255 {
+			return errors.New("proxy: destination host name too long: " + host)
+		}
+		buf = append(buf, proxy_socks5Domain)
+		buf = append(buf, byte(len(host)))
+		buf = append(buf, host...)
+	}
+	buf = append(buf, byte(port>>8), byte(port))
+
+	if _, err := conn.Write(buf); err != nil {
+		return errors.New("proxy: failed to write connect request to SOCKS5 proxy at " + s.addr + ": " + err.Error())
+	}
+
+	if _, err := io.ReadFull(conn, buf[:4]); err != nil {
+		return errors.New("proxy: failed to read connect reply from SOCKS5 proxy at " + s.addr + ": " + err.Error())
+	}
+
+	failure := "unknown error"
+	if int(buf[1]) < len(proxy_socks5Errors) {
+		failure = proxy_socks5Errors[buf[1]]
+	}
+
+	if len(failure) > 0 {
+		return errors.New("proxy: SOCKS5 proxy at " + s.addr + " failed to connect: " + failure)
+	}
+
+	bytesToDiscard := 0
+	switch buf[3] {
+	case proxy_socks5IP4:
+		bytesToDiscard = net.IPv4len
+	case proxy_socks5IP6:
+		bytesToDiscard = net.IPv6len
+	case proxy_socks5Domain:
+		_, err := io.ReadFull(conn, buf[:1])
+		if err != nil {
+			return errors.New("proxy: failed to read domain length from SOCKS5 proxy at " + s.addr + ": " + err.Error())
+		}
+		bytesToDiscard = int(buf[0])
+	default:
+		return errors.New("proxy: got unknown address type " + strconv.Itoa(int(buf[3])) + " from SOCKS5 proxy at " + s.addr)
+	}
+
+	if cap(buf) < bytesToDiscard {
+		buf = make([]byte, bytesToDiscard)
+	} else {
+		buf = buf[:bytesToDiscard]
+	}
+	if _, err := io.ReadFull(conn, buf); err != nil {
+		return errors.New("proxy: failed to read address from SOCKS5 proxy at " + s.addr + ": " + err.Error())
+	}
+
+	// Also need to discard the port number
+	if _, err := io.ReadFull(conn, buf[:2]); err != nil {
+		return errors.New("proxy: failed to read port from SOCKS5 proxy at " + s.addr + ": " + err.Error())
+	}
+
+	return nil
+}

vendor/vendor.json

@@ -156,6 +156,7 @@
 		{"path":"github.com/gorhill/cronexpr/cronexpr","checksumSHA1":"Nd/7mZb0T6Gj6+AymyOPsNCQSJs=","comment":"1.0.0","revision":"a557574d6c024ed6e36acc8b610f5f211c91568a"},
 		{"path":"github.com/gorilla/context","checksumSHA1":"g/V4qrXjUGG9B+e3hB+4NAYJ5Gs=","revision":"08b5f424b9271eedf6f9f0ce86cb9396ed337a42","revisionTime":"2016-08-17T18:46:32Z"},
 		{"path":"github.com/gorilla/mux","checksumSHA1":"STQSdSj2FcpCf0NLfdsKhNutQT0=","revision":"e48e440e4c92e3251d812f8ce7858944dfa3331c","revisionTime":"2018-08-07T07:52:56Z"},
+		{"path":"github.com/gorilla/websocket","checksumSHA1":"gr0edNJuVv4+olNNZl5ZmwLgscA=","revision":"0ec3d1bd7fe50c503d6df98ee649d81f4857c564","revisionTime":"2019-03-06T00:42:57Z"},
 		{"path":"github.com/hashicorp/consul-template","checksumSHA1":"+AGSqY+9kpGX5rrQDBWpgzaDKSA=","revision":"9a0f301b69d841c32f36b78008afb2dee8a9c40b","revisionTime":"2019-02-20T00:40:33Z"},
 		{"path":"github.com/hashicorp/consul-template/child","checksumSHA1":"AhDPiKa7wzh3SE6Gx0WrsDYwBHg=","revision":"9a0f301b69d841c32f36b78008afb2dee8a9c40b","revisionTime":"2019-02-20T00:40:33Z"},
 		{"path":"github.com/hashicorp/consul-template/config","checksumSHA1":"0vr6paBMXD7ZYSmtfJpjfjZJKic=","revision":"9a0f301b69d841c32f36b78008afb2dee8a9c40b","revisionTime":"2019-02-20T00:40:33Z"},