smart_proxy_dynflow 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f0d3649273534756b41181d6ff5c4f280cd836064cc1e156882478041c206012
-  data.tar.gz: ccb29459a346b59e24ccdd1db3e8d78ce1627bb0cd70cd81011f6314d7b9e162
+  metadata.gz: ed31ab888b7a2f5fbc4891fe60a0332f5a43347a15175f12f96a3215c0e73447
+  data.tar.gz: 534c395d634b227cd5570687e83e3e6d227a8f1898b6fed76a7760c6c66a33e2
 SHA512:
-  metadata.gz: 7544fc2af767a45393d48e7bc0fa5fdac1b2e1fa8bdeb62af26af29ab342a2ac22c5c0beacd4ce3fcf0d8d6b3554ae62d80536b6e8d71755a1f6c08577f1fb8c
-  data.tar.gz: f11e9b70127d83167d53ff19529d0140f121c6909693faa043f94bfd2c5d92ea86b11b93236592c773e95274980f9807d7bbcd231dbf57a2b7dbc4571379fa16
+  metadata.gz: a1836fa6ab0f19b43b7321d133d69632bb248ceec3e113a46952c5fc0e5f5170f29fcec0cfd52ade22db7755dcc727c03bb8f1184215787de9e37beaffc3c901
+  data.tar.gz: 3a20420452784df395b61cb3f75bba8ef88e8627fd984d17894e9a7003262d74b9beda70ab41eff0843e6816e8c74dc798f89b4b97b4f93d80e1dc7436ac5763

data/Gemfile

@@ -7,32 +7,17 @@ group :development do
 end
 
 group :test do
-  gem 'smart_proxy_dynflow', :path => '.'
   gem 'smart_proxy', :git => "https://github.com/theforeman/smart-proxy", :branch => "develop"
+  gem 'smart_proxy_dynflow', :path => '.'
 
-  if RUBY_VERSION < '2.1'
-    gem 'public_suffix', '< 3'
-    gem 'rubocop', '< 0.51.0'
-    gem 'rainbow', '< 3'
-  else
-    gem 'rubocop', '~> 0.52.1'
-    gem 'public_suffix'
-  end
-
-  if RUBY_VERSION < '2.2'
-    gem 'rack-test', '< 0.8'
-  else
-    gem 'rack-test'
-  end
+  gem 'public_suffix'
+  gem 'rack-test'
+  gem 'rubocop', '~> 0.52.1'
 end
 
-if RUBY_VERSION < '2.2'
-  gem 'sinatra', '< 2'
-  gem 'rack', '>= 1.1', '< 2.0.0'
-else
-  gem 'sinatra'
-  gem 'rack', '>= 1.1'
-end
+gem 'logging-journald', '~> 2.0', :platforms => [:ruby]
+gem 'rack', '>= 1.1'
+gem 'sinatra'
 
 # load bundler.d
 Dir["#{File.dirname(__FILE__)}/bundler.d/*.rb"].each do |bundle|

data/lib/smart_proxy_dynflow/api.rb

@@ -6,18 +6,53 @@ module Proxy
   class Dynflow
     class Api < ::Sinatra::Base
       helpers ::Proxy::Helpers
+      helpers ::Proxy::Log
       helpers ::Proxy::Dynflow::Helpers
 
       before do
-        logger = Proxy::LogBuffer::Decorator.instance
         content_type :json
-        if request.env['HTTP_AUTHORIZATION'] && request.env['PATH_INFO'].end_with?('/done')
+        if request.env['HTTP_AUTHORIZATION'] && request.path_info =~ %r{/tasks/.*/(update|done)}
           # Halt running before callbacks if a token is provided and the request is notifying about task being done
           return
+        else
+          do_authorize_with_ssl_client
+          do_authorize_with_trusted_hosts
         end
       end
 
-      helpers Sinatra::Authorization
+      # TODO: move this to foreman-proxy to reduce code duplicities
+      def do_authorize_with_trusted_hosts
+        # When :trusted_hosts is given, we check the client against the list
+        # HTTPS: test the certificate CN
+        # HTTP: test the reverse DNS entry of the remote IP
+        trusted_hosts = Proxy::SETTINGS.trusted_hosts
+        if trusted_hosts
+          if ['yes', 'on', 1].include? request.env['HTTPS'].to_s
+            fqdn = https_cert_cn
+            source = 'SSL_CLIENT_CERT'
+          else
+            fqdn = remote_fqdn(Proxy::SETTINGS.forward_verify)
+            source = 'REMOTE_ADDR'
+          end
+          fqdn = fqdn.downcase
+          logger.debug "verifying remote client #{fqdn} (based on #{source}) against trusted_hosts #{trusted_hosts}"
+
+          unless Proxy::SETTINGS.trusted_hosts.include?(fqdn)
+            log_halt 403, "Untrusted client #{fqdn} attempted " \
+                          "to access #{request.path_info}. Check :trusted_hosts: in settings.yml"
+          end
+        end
+      end
+
+      def do_authorize_with_ssl_client
+        if %w[yes on 1].include? request.env['HTTPS'].to_s
+          if request.env['SSL_CLIENT_CERT'].to_s.empty?
+            log_halt 403, "No client SSL certificate supplied"
+          end
+        else
+          logger.debug('require_ssl_client_verification: skipping, non-HTTPS request')
+        end
+      end
 
       post "/*" do
         relay_request

data/lib/smart_proxy_dynflow/callback.rb

@@ -10,15 +10,17 @@ module Proxy
 
         def relay(request, from, to)
           path = request.path.gsub(from, to)
-          Proxy::LogBuffer::Decorator.instance.debug "Proxy request from #{request.host_with_port}#{request.path} to #{uri.to_s}#{path}"
+          message = "Proxy request from #{request.host_with_port}#{request.path} to #{uri}#{path}"
+          Proxy::LogBuffer::Decorator.instance.debug message
           req = case request.env['REQUEST_METHOD']
-                  when 'GET'
-                    request_factory.create_get path, request.env['rack.request.query_hash']
-                  when 'POST'
-                    request_factory.create_post path, request.body.read
+                when 'GET'
+                  request_factory.create_get path, request.env['rack.request.query_hash']
+                when 'POST'
+                  request_factory.create_post path, request.body.read
                 end
           req['X-Forwarded-For'] = request.env['HTTP_HOST']
           req['AUTHORIZATION'] = request.env['HTTP_AUTHORIZATION']
+          req['X-Request-Id'] = ::Logging.mdc['request']
           response = send_request req
           Proxy::LogBuffer::Decorator.instance.debug "Proxy request status #{response.code} - #{response}"
           response

data/lib/smart_proxy_dynflow/helpers.rb

@@ -1,7 +1,7 @@
 module Proxy
   class Dynflow
     module Helpers
-      def relay_request(from = /^\/dynflow/, to = '')
+      def relay_request(from = %r{^/dynflow}, to = '')
         response = Proxy::Dynflow::Callback::Core.relay(request, from, to)
         content_type response.content_type
         status response.code

data/lib/smart_proxy_dynflow/http_config.ru

@@ -1,7 +1,21 @@
-require 'smart_proxy_dynflow/api'
+# Internal core will be used if external core is either disabled or unset
+# and the core gem can be loaded
 
-map "/dynflow" do
-  map '/'do
-    run Proxy::Dynflow::Api
+if !::Proxy::Dynflow::Plugin.settings.external_core && Proxy::Dynflow::Plugin.internal_core_available?
+  require 'smart_proxy_dynflow_core/api'
+  require 'smart_proxy_dynflow_core/launcher'
+
+  SmartProxyDynflowCore::Settings.load_from_proxy(p)
+
+  map "/dynflow" do
+    SmartProxyDynflowCore::Launcher.route_mapping(self)
+  end
+else
+  require 'smart_proxy_dynflow/api'
+
+  map "/dynflow" do
+    map '/' do
+      run Proxy::Dynflow::Api
+    end
   end
 end

data/lib/smart_proxy_dynflow/plugin.rb

@@ -4,27 +4,28 @@ require 'proxy/plugin'
 
 class Proxy::Dynflow
   class Plugin < Proxy::Plugin
-    rackup_path = begin
-      require 'smart_proxy_dynflow_core'
-      'http_config_with_executor.ru'
-    rescue LoadError
-      'http_config.ru'
-    end
-    http_rackup_path File.expand_path(rackup_path, File.expand_path("../", __FILE__))
-    https_rackup_path File.expand_path(rackup_path, File.expand_path("../", __FILE__))
+    rackup_path = File.expand_path('http_config.ru', __dir__)
+    http_rackup_path rackup_path
+    https_rackup_path rackup_path
 
     settings_file "dynflow.yml"
-    requires :foreman_proxy, ">= 1.12.0"
+    requires :foreman_proxy, ">= 1.16.0"
     default_settings :core_url => 'http://localhost:8008'
     plugin :dynflow, Proxy::Dynflow::VERSION
 
     after_activation do
-      begin
-        require 'smart_proxy_dynflow_core'
-      rescue LoadError => e
-        # Dynflow core is not available in the proxy, will be handled
-        # by standalone Dynflow core
+      # Ensure the core gem is loaded, if configure NOT to use the external core
+      if Proxy::Dynflow::Plugin.settings.external_core == false && !internal_core_available?
+        raise "'smart_proxy_dynflow_core' gem is required, but not available"
       end
     end
+
+    def self.internal_core_available?
+      @core_available ||= begin
+                            require 'smart_proxy_dynflow_core'
+                            true
+                          rescue LoadError # rubocop:disable Lint/HandleExceptions
+                          end
+    end
   end
 end

data/lib/smart_proxy_dynflow/version.rb

@@ -1,5 +1,5 @@
 module Proxy
   class Dynflow
-    VERSION = '0.2.0'
+    VERSION = '0.3.0'.freeze
   end
 end

data/settings.d/dynflow.yml.example

@@ -2,3 +2,8 @@
 :enabled: true
 :database: /var/lib/foreman-proxy/dynflow/dynflow.sqlite
 :core_url: 'http://127.0.0.1:8008'
+
+# If true, external core will be used even if the core gem is available
+# If false, the feature will be disabled if the core gem is not available
+# If unset, the process will fallback to external core if the core gem is not available
+# :external_core: true

metadata

@@ -1,43 +1,43 @@
 --- !ruby/object:Gem::Specification
 name: smart_proxy_dynflow
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Ivan Nečas
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2018-04-05 00:00:00.000000000 Z
+date: 1980-01-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: bundler
+  name: logging
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.7'
-  type: :development
+        version: '0'
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: rake
+  name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '1.7'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '1.7'
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
@@ -67,33 +67,47 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1'
 - !ruby/object:Gem::Dependency
-  name: webmock
+  name: rack-test
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1'
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: rack-test
+  name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '10.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
 description: "    Use the Dynflow inside Foreman smart proxy\n"
 email:
 - inecas@redhat.com
@@ -109,33 +123,31 @@ files:
 - lib/smart_proxy_dynflow/callback.rb
 - lib/smart_proxy_dynflow/helpers.rb
 - lib/smart_proxy_dynflow/http_config.ru
-- lib/smart_proxy_dynflow/http_config_with_executor.ru
 - lib/smart_proxy_dynflow/plugin.rb
 - lib/smart_proxy_dynflow/proxy_adapter.rb
 - lib/smart_proxy_dynflow/version.rb
 - settings.d/dynflow.yml.example
 homepage: https://github.com/theforeman/smart_proxy_dynflow
 licenses:
-- GPLv3
+- GPL-3.0
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - "~>"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '2.5'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.3
-signing_key: 
+rubygems_version: 3.1.2
+signing_key:
 specification_version: 4
 summary: Dynflow runtime for Foreman smart proxy
 test_files: []

data/lib/smart_proxy_dynflow/http_config_with_executor.ru

@@ -1,8 +0,0 @@
-require 'smart_proxy_dynflow_core/api'
-require 'smart_proxy_dynflow_core/launcher'
-
-SmartProxyDynflowCore::Settings.load_from_proxy(p)
-
-map "/dynflow" do
-  SmartProxyDynflowCore::Launcher.route_mapping(self)
-end