smart_proxy_dynflow 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA256:
-  metadata.gz: f0d3649273534756b41181d6ff5c4f280cd836064cc1e156882478041c206012
-  data.tar.gz: ccb29459a346b59e24ccdd1db3e8d78ce1627bb0cd70cd81011f6314d7b9e162
+SHA1:
+  metadata.gz: ebb495fc4f587cc0d94521bec26020bad3948109
+  data.tar.gz: 87a7ba0afc1876f92f336edbf5b38e523de11101
 SHA512:
-  metadata.gz: 7544fc2af767a45393d48e7bc0fa5fdac1b2e1fa8bdeb62af26af29ab342a2ac22c5c0beacd4ce3fcf0d8d6b3554ae62d80536b6e8d71755a1f6c08577f1fb8c
-  data.tar.gz: f11e9b70127d83167d53ff19529d0140f121c6909693faa043f94bfd2c5d92ea86b11b93236592c773e95274980f9807d7bbcd231dbf57a2b7dbc4571379fa16
+  metadata.gz: 1764f5ec0797cbafa4182dd848f7faffb3aae8cdc6053cf08e127cbd0ff9a654acd6994b985caea64267cceea3cde1256bddfb3d232f359b933c0f546c34ced9
+  data.tar.gz: 65494db608d5c67aed31219afb9c289ca900ed26911b034e1bf55dcb1472f17dab1d7537539f54f28407484d94e7ed27052e0a2a5f007dbc92392662b5641ee2

data/lib/smart_proxy_dynflow/api.rb

@@ -6,18 +6,53 @@ module Proxy
   class Dynflow
     class Api < ::Sinatra::Base
       helpers ::Proxy::Helpers
+      helpers ::Proxy::Log
       helpers ::Proxy::Dynflow::Helpers
 
       before do
-        logger = Proxy::LogBuffer::Decorator.instance
         content_type :json
         if request.env['HTTP_AUTHORIZATION'] && request.env['PATH_INFO'].end_with?('/done')
           # Halt running before callbacks if a token is provided and the request is notifying about task being done
           return
+        else
+          do_authorize_with_ssl_client
+          do_authorize_with_trusted_hosts
         end
       end
 
-      helpers Sinatra::Authorization
+
+      # TODO: move this to foreman-proxy to reduce code duplicities
+      def do_authorize_with_trusted_hosts
+        # When :trusted_hosts is given, we check the client against the list
+        # HTTPS: test the certificate CN
+        # HTTP: test the reverse DNS entry of the remote IP
+        trusted_hosts = Proxy::SETTINGS.trusted_hosts
+        if trusted_hosts
+          if [ 'yes', 'on', 1 ].include? request.env['HTTPS'].to_s
+            fqdn = https_cert_cn
+            source = 'SSL_CLIENT_CERT'
+          else
+            fqdn = remote_fqdn(Proxy::SETTINGS.forward_verify)
+            source = 'REMOTE_ADDR'
+          end
+          fqdn = fqdn.downcase
+          logger.debug "verifying remote client #{fqdn} (based on #{source}) against trusted_hosts #{trusted_hosts}"
+
+          unless Proxy::SETTINGS.trusted_hosts.include?(fqdn)
+            log_halt 403, "Untrusted client #{fqdn} attempted to access #{request.path_info}. Check :trusted_hosts: in settings.yml"
+          end
+        end
+      end
+
+      def do_authorize_with_ssl_client
+        if ['yes', 'on', '1'].include? request.env['HTTPS'].to_s
+          if request.env['SSL_CLIENT_CERT'].to_s.empty?
+            log_halt 403, "No client SSL certificate supplied"
+          end
+        else
+          logger.debug('require_ssl_client_verification: skipping, non-HTTPS request')
+        end
+      end
 
       post "/*" do
         relay_request

data/lib/smart_proxy_dynflow/version.rb

@@ -1,5 +1,5 @@
 module Proxy
   class Dynflow
-    VERSION = '0.2.0'
+    VERSION = '0.2.1'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: smart_proxy_dynflow
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Ivan Nečas
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-04-05 00:00:00.000000000 Z
+date: 2018-09-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -116,7 +116,7 @@ files:
 - settings.d/dynflow.yml.example
 homepage: https://github.com/theforeman/smart_proxy_dynflow
 licenses:
-- GPLv3
+- GPL-3.0
 metadata: {}
 post_install_message: 
 rdoc_options: []
@@ -134,7 +134,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.7.3
+rubygems_version: 2.6.12
 signing_key: 
 specification_version: 4
 summary: Dynflow runtime for Foreman smart proxy