backend/satellite_exporter/satexport.py | 23 +++++++++++++++++++++++
backend/spacewalk-backend.spec | 5 ++++-
rel-eng/packages/spacewalk-backend | 2 +-
3 files changed, 28 insertions(+), 2 deletions(-)
New commits:
commit 61c4bed14fbdc73d9e437a3d3061db860d6400d7
Author: Grant Gainey <ggainey(a)redhat.com>
Date: Tue May 21 15:30:30 2013 -0400
Automatic commit of package [spacewalk-backend] release [1.10.34-1].
diff --git a/backend/spacewalk-backend.spec b/backend/spacewalk-backend.spec
index fd04bc8..264df92 100644
--- a/backend/spacewalk-backend.spec
+++ b/backend/spacewalk-backend.spec
@@ -12,7 +12,7 @@ Name: spacewalk-backend
Summary: Common programs needed to be installed on the Spacewalk servers/proxies
Group: Applications/Internet
License: GPLv2
-Version: 1.10.33
+Version: 1.10.34
Release: 1%{?dist}
URL:
https://fedorahosted.org/spacewalk
Source0:
https://fedorahosted.org/releases/s/p/spacewalk/%{name}-%{version}.tar.gz
@@ -637,6 +637,9 @@ rm -f %{rhnconf}/rhnSecret.py*
# $Id$
%changelog
+* Tue May 21 2013 Grant Gainey <ggainey(a)redhat.com> 1.10.34-1
+- 965809 - Fix ISS authentication hole
+
* Tue May 21 2013 Tomas Kasparek <tkasparek(a)redhat.com> 1.10.33-1
- branding clean-up of spacewalk-backend
- branding clean-up of logrotate files
diff --git a/rel-eng/packages/spacewalk-backend b/rel-eng/packages/spacewalk-backend
index c6befa3..f8ff15a 100644
--- a/rel-eng/packages/spacewalk-backend
+++ b/rel-eng/packages/spacewalk-backend
@@ -1 +1 @@
-1.10.33-1 backend/
+1.10.34-1 backend/
commit 99771bb4759079291a852daec60a7f5afa0e40eb
Author: Jan Pazdziora <jpazdziora(a)redhat.com>
Date: Tue May 21 13:50:39 2013 -0400
965809 - Fix ISS authentication hole
diff --git a/backend/satellite_exporter/satexport.py
b/backend/satellite_exporter/satexport.py
index b9eb8b6..ff30bed 100644
--- a/backend/satellite_exporter/satexport.py
+++ b/backend/satellite_exporter/satexport.py
@@ -29,6 +29,8 @@ from spacewalk.server import rhnSQL, rhnImport
from spacewalk.satellite_tools.disk_dumper.dumper import ClosedConnectionError
from spacewalk.satellite_tools import constants
+from rhn.connections import idn_ascii_to_pune
+
class BaseApacheServer:
def __init__(self):
# Init log to stderr
@@ -182,6 +184,7 @@ class ApacheServer(BaseApacheServer):
return apache.OK
def get_function(self, method_name, req):
+ self.auth_system(req)
# Get the module name
idx = method_name.rfind('.')
module_name, function_name = method_name[:idx], method_name[idx+1:]
@@ -199,6 +202,26 @@ class ApacheServer(BaseApacheServer):
(module_name, function_name))
return f
+ def auth_system(self, req):
+ if CFG.DISABLE_ISS:
+ raise rhnFault(2005, _('ISS is disabled on this satellite.'))
+
+ if CFG.ALLOWED_ISS_SLAVES:
+ if not isinstance(CFG.ALLOWED_ISS_SLAVES, list):
+ allowed_iss_slaves = [CFG.ALLOWED_ISS_SLAVES]
+ else:
+ allowed_iss_slaves = CFG.ALLOWED_ISS_SLAVES
+ allowed_iss_slaves = [idn_ascii_to_pune(x) for x in allowed_iss_slaves]
+ else:
+ allowed_iss_slaves = []
+
+ remote_hostname = req.get_remote_host(apache.REMOTE_DOUBLE_REV)
+ if remote_hostname not in allowed_iss_slaves:
+ raise rhnFault(2004,
+ _('Server "%s" is not enabled for ISS.')
+ % remote_hostname)
+ return remote_hostname
+
@staticmethod
def _validate_version(req):
server_version = constants.PROTOCOL_VERSION