smart_proxy_dynflow_core 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 05e52d07afb1e6ed23416a5f7d01a5c69df9fa02
-  data.tar.gz: d6d6b8e5549ebf91138f77e4bf5dc44ca924df50
+  metadata.gz: aea249b437a5dbb1733238540d317b5ece223d8e
+  data.tar.gz: 534cc45d145d741845b0719848d67dd4d60aa39d
 SHA512:
-  metadata.gz: e0eca67a30067038b0fc1cc2104011ea43612d36197f723287bb11943c77df9499771888d528406cf03a6a5e43815725d960397641cc491c4b73ad86379bdf59
-  data.tar.gz: f1f9060ff0d134af8bc22899e8d3e0af3fa46e866117b4a273b1e9a5dd567297985392a57523c0d8430da26e5eb8ac8ea2efe48eff46f3480f8744054608fb51
+  metadata.gz: a42b78b3eeb087847016050dad2e36218e8c908ea7557d33bddd5049dacd60caf3405e521626be53d8e05d45c9c762c04b5d9d1d35da26150763c050cde955c1
+  data.tar.gz: a512036ed6b11ec0b077d2e29d56beaf2f4d2c1bfb6f45b0b4e00c5719178f2d05870184f968c393ad56ff4194892148d4128cbc7407885d3db0a2a95b4d8e92

data/bin/smart_proxy_dynflow_core

@@ -11,10 +11,18 @@ OptionParser.new do |opts|
     options[:config_dir] = value
   end
 
-  opts.on('-1', '--one-config', String, 'Do not load more than 1 config') do |value|
+  opts.on('-1', '--one-config', 'Do not load more than 1 config') do |value|
     options[:one_config] = true
   end
 
+  opts.on('-d', '--[no-]daemonize', 'Fork to background after start') do |value|
+    options[:daemonize] = value
+  end
+
+  opts.on('-p', '--pid-file PID_FILE', String, 'Write pid to this file') do |value|
+    options[:pid_file] = value
+  end
+
   opts.on_tail('-h', '--help', 'Show usage help') do
     puts opts
     exit

data/config/settings.yml.example

@@ -2,8 +2,19 @@
 # Path to dynflow database, leave blank for in-memory non-persistent database
 :database:
 
-# URL of the smart proxy, used for reporting back
-:callback_url: 'https://localhost:8443'
+# URL of the foreman, used for reporting back
+:foreman_url: 'http://localhost:3000'
+
+# SSL settings for client authentication against Foreman
+# :foreman_ssl_ca: ssl/foreman_ca.pem
+# :foreman_ssl_key: ssl/foreman_key.pem
+# :foreman_ssl_cert: ssl/foreman_cert.pem
+
+:console_auth: false
+
+# Set to true to make the core fork to background after start
+# :daemonize: false
+# :pid_file: /var/run/foreman-proxy/smart_proxy_dynflow_core.pid
 
 # Listen on address
 :listen: 127.0.0.1
@@ -11,10 +22,14 @@
 # Listen on port
 :port: 8008
 
-# SSL settings for client authentication against smart proxy.
+# SSL settings for running core as https service
 # :use_https: false
 # :ssl_ca_file: ssl/ca.pem
 # :ssl_private_key: ssl/localhost.pem
 # :ssl_certificate: ssl/certs/localhost.pem
 
+# File to log to, leave empty for logging to STDOUT
 # :log_file: /var/log/foreman-proxy/smart_proxy_dynflow_core.log
+
+# Log level, one of UNKNOWN, FATAL, ERROR, WARN, INFO, DEBUG
+# :log_level: ERROR

data/deploy/smart_proxy_dynflow_core.init

@@ -10,16 +10,12 @@
 
 prog=smart_proxy_dynflow_core
 RETVAL=0
-SMART_PROXY_DYNFLOW_SCL_ROOT=/opt/theforeman/tfm/root
-SMART_PROXY_DYNFLOW_CORE_PID=${SMART_PROXY_DYNFLOW_SCL_ROOT}/var/run/$prog/$prog.pid
+SMART_PROXY_DYNFLOW_CORE_PID=/var/run/foreman-proxy/$prog.pid
 SMART_PROXY_DYNFLOW_CORE_USER=${SMART_PROXY_DYNFLOW_CORE_USER:-foreman-proxy}
 
-. /opt/theforeman/tfm/service-environment
-. scl_source enable $TFM_SCLS_ENABLED
-
 start() {
     echo -n $"Starting $prog: "
-    daemon --user ${SMART_PROXY_DYNFLOW_CORE_USER} ${SMART_PROXY_DYNFLOW_SCL_ROOT}/usr/bin/smart_proxy_dynflow_core > /dev/null
+    daemon --user ${SMART_PROXY_DYNFLOW_CORE_USER} /usr/bin/smart_proxy_dynflow_core -d -p $SMART_PROXY_DYNFLOW_CORE_PID > /dev/null
     RETVAL=$?
     if [ $RETVAL = 0 ]
     then

data/deploy/smart_proxy_dynflow_core.service

@@ -4,11 +4,10 @@ Documentation=https://github.com/theforeman/smart_proxy_dynflow
 After=network.target remote-fs.target nss-lookup.target
 
 [Service]
-Type=simple
+Type=forking
 User=foreman-proxy
-PIDFile=/opt/theforeman/tfm/root/var/run/smart_proxy_dynflow_core/smart_proxy_dynflow_core.pid
-EnvironmentFile=/opt/theforeman/tfm/service-environment
-ExecStart=/usr/bin/scl enable $TFM_SCLS_ENABLED -- /opt/theforeman/tfm/root/usr/bin/smart_proxy_dynflow_core
+PIDFile=/var/run/foreman-proxy/smart_proxy_dynflow_core.pid
+ExecStart=/usr/bin/smart_proxy_dynflow_core -d -p /var/run/foreman-proxy/smart_proxy_dynflow_core.pid
 
 [Install]
 WantedBy=multi-user.target

data/lib/smart_proxy_dynflow_core/callback.rb

@@ -10,15 +10,15 @@ module SmartProxyDynflowCore
   module Callback
     class Request
       def callback(payload)
-        response = callback_resource.post payload
-        if response.code != 200
-          raise "Failed performing callback to smart proxy: #{response.code} #{response.body}"
+        response = callback_resource.post(payload, :content_type => :json)
+        if response.code.to_s != "200"
+          raise "Failed performing callback to Foreman server: #{response.code} #{response.body}"
         end
         response
       end
 
-      def self.callback(callback, data)
-        self.new.callback(self.prepare_payload(callback, data))
+      def self.send_to_foreman_tasks(callback_info, data)
+        self.new.callback(self.prepare_payload(callback_info, data))
       end
 
       private
@@ -28,20 +28,31 @@ module SmartProxyDynflowCore
       end
 
       def callback_resource
-        @resource ||= RestClient::Resource.new Settings.instance.callback_url + '/dynflow/tasks/callback',
-                                               ssl_options
+        @resource ||= RestClient::Resource.new(Settings.instance.foreman_url + '/foreman_tasks/api/tasks/callback',
+                                               self.class.ssl_options)
       end
 
-      def ssl_options
-        return {} unless Settings.instance.use_https
-        client_key = File.read  Settings.instance.ssl_private_key
-        client_cert = File.read Settings.instance.ssl_certificate
-        {
-          :ssl_client_cert => OpenSSL::X509::Certificate.new(client_cert),
-          :ssl_client_key  => OpenSSL::PKey::RSA.new(client_key),
-          :ssl_ca_file     => Settings.instance.ssl_ca_file,
-          :verify_ssl      => OpenSSL::SSL::VERIFY_PEER
-        }
+      def self.ssl_options
+        return @ssl_options if defined? @ssl_options
+        @ssl_options = {}
+        settings = Settings.instance
+        return @ssl_options unless URI.parse(settings.foreman_url).scheme == 'https'
+
+        @ssl_options[:verify_ssl] = OpenSSL::SSL::VERIFY_PEER
+
+        private_key_file = settings.foreman_ssl_key || settings.ssl_private_key
+        if private_key_file
+          private_key = File.read(private_key_file)
+          @ssl_options[:ssl_client_key] = OpenSSL::PKey::RSA.new(private_key)
+        end
+        certificate_file = settings.foreman_ssl_cert || settings.ssl_certificate
+        if certificate_file
+          certificate = File.read(certificate_file)
+          @ssl_options[:ssl_client_cert] = OpenSSL::X509::Certificate.new(certificate)
+        end
+        ca_file = settings.foreman_ssl_ca || settings.ssl_ca_file
+        @ssl_options[:ssl_ca_file] = ca_file if ca_file
+        @ssl_options
       end
     end
 
@@ -51,8 +62,7 @@ module SmartProxyDynflowCore
       end
 
       def run
-        callback = (Settings.instance.standalone ? Callback::Request : Proxy::Dynflow::Callback::Request).new
-        callback.callback(SmartProxyDynflowCore::Callback::Request.prepare_payload(input[:callback], input[:data]))
+        Callback::Request.send_to_foreman_tasks(input[:callback], input[:data])
       end
     end
 

data/lib/smart_proxy_dynflow_core/core.rb

@@ -1,10 +1,17 @@
 module SmartProxyDynflowCore
   class Core
 
-    attr_accessor :world
+    attr_accessor :world, :accepted_cert_serial
 
     def initialize
       @world = create_world
+      cert_file = Settings.instance.foreman_ssl_cert || Settings.instance.ssl_certificate
+      if cert_file
+        client_cert = File.read(cert_file)
+        # we trust only requests using the same certificate as we are
+        # (in other words the local proxy only)
+        @accepted_cert_serial = OpenSSL::X509::Certificate.new(client_cert).serial
+      end
     end
 
     def create_world(&block)
@@ -68,7 +75,7 @@ module SmartProxyDynflowCore
           helpers Helpers
 
           before do
-            authorize_with_ssl_client
+            authorize_with_ssl_client if Settings.instance.console_auth
           end
 
           Core.ensure_initialized

data/lib/smart_proxy_dynflow_core/helpers.rb

@@ -10,6 +10,13 @@ module SmartProxyDynflowCore
           status 403
           Log.instance.error "No client SSL certificate supplied"
           halt MultiJson.dump(:error => "No client SSL certificate supplied")
+        else
+          client_cert = OpenSSL::X509::Certificate.new(request.env['SSL_CLIENT_CERT'])
+          unless SmartProxyDynflowCore::Core.instance.accepted_cert_serial == client_cert.serial
+            Log.instance.error "SSL certificate with unexpected serial supplied"
+            halt MultiJson.dump(:error => "SSL certificate with unexpected serial supplied")
+            status 403
+          end
         end
       else
         Log.instance.debug 'require_ssl_client_verification: skipping, non-HTTPS request'

data/lib/smart_proxy_dynflow_core/launcher.rb

@@ -9,13 +9,13 @@ module SmartProxyDynflowCore
     end
 
     def start(options)
-      load_settings!(options[:config_dir], options[:one_config])
+      load_settings!(options)
       Settings.instance.standalone = true
-      Core.ensure_initialized
       Rack::Server.new(rack_settings).start
     end
 
-    def load_settings!(config_dir = nil, one_config = false)
+    def load_settings!(options = {})
+      config_dir, one_config = options.values_at(:config_dir, :one_config)
       possible_config_dirs = [
         '/etc/smart_proxy_dynflow_core',
         File.expand_path('~/.config/smart_proxy_dynflow_core'),
@@ -27,6 +27,8 @@ module SmartProxyDynflowCore
       possible_config_dirs.select { |config_dir| File.directory? config_dir }.each do |config_dir|
         break if load_config_dir(config_dir) && one_config
       end
+      Settings.instance.daemonize = options[:daemonize] if options.key?(:daemonize)
+      Settings.instance.pid_file = options[:pid_file] if options.key?(:pid_file)
       Settings.loaded!
     end
 
@@ -64,9 +66,10 @@ module SmartProxyDynflowCore
         :app => app,
         :Host => Settings.instance.listen,
         :Port => Settings.instance.port,
-        :daemonize => false,
         :AccessLog => [[Log.log_file, WEBrick::AccessLog::COMMON_LOG_FORMAT]],
-        :Logger => Log.instance
+        :Logger => Log.instance,
+        :daemonize => Settings.instance.daemonize,
+        :pid => Settings.instance.pid_file
       }
     end
 

data/lib/smart_proxy_dynflow_core/settings.rb

@@ -22,23 +22,28 @@ module SmartProxyDynflowCore
 
     DEFAULT_SETTINGS = {
         :database => '/var/lib/foreman-proxy/dynflow/dynflow.sqlite',
-        :callback_url => 'https://127.0.0.1:8443',
+        :foreman_url => 'https://127.0.0.1:3000',
         :console_auth => true,
-        :foreman_url => 'http://127.0.0.1:3000',
         :listen => '127.0.0.1',
         :port => '8008',
         :use_https => false,
         :ssl_ca_file => nil,
         :ssl_private_key => nil,
         :ssl_certificate => nil,
+        :foreman_ssl_ca => nil,
+        :foreman_ssl_key => nil,
+        :foreman_ssl_cert => nil,
         :standalone => false,
         :log_file => '/var/log/foreman-proxy/smart_proxy_dynflow_core.log',
         :log_level => :ERROR,
         :plugins => {},
+        :pid_file => '/var/run/foreman-proxy/smart_proxy_dynflow_core.pid',
+        :daemonize => false,
         :loaded => false
     }
 
-    PROXY_SETTINGS = [:ssl_certificate, :ssl_ca_file, :ssl_private_key, :foreman_url,
+    PROXY_SETTINGS = [:ssl_ca_file, :ssl_certificate, :ssl_private_key, :foreman_url,
+                      :foreman_ssl_ca, :foreman_ssl_cert, :foreman_ssl_key,
                       :log_file, :log_level]
     PLUGIN_SETTINGS = [:database, :core_url, :console_auth]
 
@@ -68,7 +73,6 @@ module SmartProxyDynflowCore
       PROXY_SETTINGS.each do |key|
         SETTINGS[key] = Proxy::SETTINGS[key]
       end
-      SETTINGS.callback_url = SETTINGS.foreman_url
       PLUGIN_SETTINGS.each do |key|
         SETTINGS[key] = plugin.settings[key]
       end

data/lib/smart_proxy_dynflow_core/version.rb

@@ -1,3 +1,3 @@
 module SmartProxyDynflowCore
-  VERSION = '0.1.2'
+  VERSION = '0.1.3'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: smart_proxy_dynflow_core
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - Ivan Nečas
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-06-15 00:00:00.000000000 Z
+date: 2016-06-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler