smart_proxy_dynflow 0.1.10 → 0.1.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 111612f85395ef80b5f3a770b5d7bb4d47bc68e9
-  data.tar.gz: c59df9511f4cd1a69a49774bc6bfab4ca973b3eb
+  metadata.gz: 37c4ca86391e9bae63acf0d0f1168e6d8ac2f9ae
+  data.tar.gz: d81e1d7194797eebf44b9aba08ec01600ef42b9e
 SHA512:
-  metadata.gz: a8ef0cf4fbceff16a834f9a9e74d9ad2f19800615de47af82bba4ca34003f09f90645fa529067ea5cf0b3bdeb749b4ba1e0a3b1a3b572a6ee8e74d65ad707ab9
-  data.tar.gz: dfc585800bb40f0e9493059a24ae16815953711ae126f302f47c416bbccde2576b0ba4411f4d78df1ff78196bf24aab9557e279b6c45e2bb3bf741daf3a119db
+  metadata.gz: 370eed460b96d422d1465100ffe0f5dc74a7a39d1d1d0a09dde1c96848322b183bd893eb8c4e34e2d567d7c0d583f36ef7f01e614248789be17cb25ded4f7de7
+  data.tar.gz: 328ac8a3a3148f744425c814ce23107ed2ff4c61b3bbfd32e7721c41080ebaef72abd5da8cc187e401a1a58f3e8f196871abec5a34f825acc0b1e73511d623a8

data/lib/smart_proxy_dynflow/api.rb

@@ -6,18 +6,53 @@ module Proxy
   class Dynflow
     class Api < ::Sinatra::Base
       helpers ::Proxy::Helpers
+      helpers ::Proxy::Log
       helpers ::Proxy::Dynflow::Helpers
 
       before do
-        logger = Proxy::LogBuffer::Decorator.instance
         content_type :json
         if request.env['HTTP_AUTHORIZATION'] && request.env['PATH_INFO'].end_with?('/done')
           # Halt running before callbacks if a token is provided and the request is notifying about task being done
           return
+        else
+          do_authorize_with_ssl_client
+          do_authorize_with_trusted_hosts
         end
       end
 
-      helpers Sinatra::Authorization
+
+      # TODO: move this to foreman-proxy to reduce code duplicities
+      def do_authorize_with_trusted_hosts
+        # When :trusted_hosts is given, we check the client against the list
+        # HTTPS: test the certificate CN
+        # HTTP: test the reverse DNS entry of the remote IP
+        trusted_hosts = Proxy::SETTINGS.trusted_hosts
+        if trusted_hosts
+          if [ 'yes', 'on', 1 ].include? request.env['HTTPS'].to_s
+            fqdn = https_cert_cn
+            source = 'SSL_CLIENT_CERT'
+          else
+            fqdn = remote_fqdn(Proxy::SETTINGS.forward_verify)
+            source = 'REMOTE_ADDR'
+          end
+          fqdn = fqdn.downcase
+          logger.debug "verifying remote client #{fqdn} (based on #{source}) against trusted_hosts #{trusted_hosts}"
+
+          unless Proxy::SETTINGS.trusted_hosts.include?(fqdn)
+            log_halt 403, "Untrusted client #{fqdn} attempted to access #{request.path_info}. Check :trusted_hosts: in settings.yml"
+          end
+        end
+      end
+
+      def do_authorize_with_ssl_client
+        if ['yes', 'on', '1'].include? request.env['HTTPS'].to_s
+          if request.env['SSL_CLIENT_CERT'].to_s.empty?
+            log_halt 403, "No client SSL certificate supplied"
+          end
+        else
+          logger.debug('require_ssl_client_verification: skipping, non-HTTPS request')
+        end
+      end
 
       post "/*" do
         relay_request

data/lib/smart_proxy_dynflow/version.rb

@@ -1,5 +1,5 @@
 module Proxy
   class Dynflow
-    VERSION = '0.1.10'
+    VERSION = '0.1.11'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: smart_proxy_dynflow
 version: !ruby/object:Gem::Version
-  version: 0.1.10
+  version: 0.1.11
 platform: ruby
 authors:
 - Ivan Nečas
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-01-27 00:00:00.000000000 Z
+date: 2018-09-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler