[master 2/3] Add optional authentication to the proxy server
dashea
installerbot-noreply at redhat.com
Tue Aug 4 15:31:59 UTC 2015
From: David Shea <dshea at redhat.com>
If the file /tmp/proxy.password exists at the time of a request, the
contents will be use as the "username:password" basic auth string
required for the request.
---
tests/kickstart_tests/proxy-common.ks | 43 ++++++++++++++++++++++++++++++++++-
1 file changed, 42 insertions(+), 1 deletion(-)
diff --git a/tests/kickstart_tests/proxy-common.ks b/tests/kickstart_tests/proxy-common.ks
index 1234f72..a95097a 100644
--- a/tests/kickstart_tests/proxy-common.ks
+++ b/tests/kickstart_tests/proxy-common.ks
@@ -6,7 +6,8 @@ cat - << "EOF" > /tmp/proxy-test.py
from http.server import SimpleHTTPRequestHandler
import socketserver
from urllib.request import urlopen
-import os, sys
+import os
+from base64 import b64decode
import logging
log = logging.getLogger("proxy_test")
@@ -15,7 +16,47 @@ log.setLevel(logging.INFO)
log.addHandler(log_handler)
class ProxyHandler(SimpleHTTPRequestHandler):
+ def send_authenticate(self):
+ self.send_response(407)
+ self.send_header('Proxy-Authenticate', 'Basic realm=proxy-test')
+ self.end_headers()
+
+ def authenticate(self):
+ # If there is no /tmp/proxy.password file, anything goes
+ if not os.path.exists('/tmp/proxy.password'):
+ return True
+
+ # If there is no Authorization header, send a 407, Proxy authentication required
+ authorization = self.headers['Proxy-Authorization']
+ if not authorization:
+ self.send_authenticate()
+ return False
+
+ # Parse the Authorization header. It should be "Basic" followed
+ # user:pass encoded in base64
+ if not authorization.startswith('Basic'):
+ self.send_authenticate()
+ return False
+
+ try:
+ client_auth = b64decode(authorization.split()[1])
+ except IndexError:
+ self.send_authenticate()
+ return False
+
+ with open('/tmp/proxy.password', 'rb') as f:
+ server_auth = f.readline().strip()
+
+ if client_auth != server_auth:
+ self.send_authenticate()
+ return False
+
+ return True
+
def do_GET(self):
+ if not self.authenticate():
+ return
+
# Log the path then proxy the request via urllib
log.info(self.path)
data = urlopen(self.path).read()
--
To view this commit on github, visit https://github.com/rhinstaller/anaconda/commit/b2bad8a24e6931e72526a5ace169b4fba8f7697d
More information about the anaconda-patches
mailing list