[master 2/3] Add optional authentication to the proxy server

dashea installerbot-noreply at redhat.com
Tue Aug 4 15:31:59 UTC 2015


From: David Shea <dshea at redhat.com>

If the file /tmp/proxy.password exists at the time of a request, the
contents will be use as the "username:password" basic auth string
required for the request.
---
 tests/kickstart_tests/proxy-common.ks | 43 ++++++++++++++++++++++++++++++++++-
 1 file changed, 42 insertions(+), 1 deletion(-)

diff --git a/tests/kickstart_tests/proxy-common.ks b/tests/kickstart_tests/proxy-common.ks
index 1234f72..a95097a 100644
--- a/tests/kickstart_tests/proxy-common.ks
+++ b/tests/kickstart_tests/proxy-common.ks
@@ -6,7 +6,8 @@ cat - << "EOF" > /tmp/proxy-test.py
 from http.server import SimpleHTTPRequestHandler
 import socketserver
 from urllib.request import urlopen
-import os, sys
+import os
+from base64 import b64decode
 
 import logging
 log = logging.getLogger("proxy_test")
@@ -15,7 +16,47 @@ log.setLevel(logging.INFO)
 log.addHandler(log_handler)
 
 class ProxyHandler(SimpleHTTPRequestHandler):
+    def send_authenticate(self):
+        self.send_response(407)
+        self.send_header('Proxy-Authenticate', 'Basic realm=proxy-test')
+        self.end_headers()
+
+    def authenticate(self):
+        # If there is no /tmp/proxy.password file, anything goes
+        if not os.path.exists('/tmp/proxy.password'):
+            return True
+
+        # If there is no Authorization header, send a 407, Proxy authentication required
+        authorization = self.headers['Proxy-Authorization']
+        if not authorization:
+            self.send_authenticate()
+            return False
+
+        # Parse the Authorization header. It should be "Basic" followed
+        # user:pass encoded in base64
+        if not authorization.startswith('Basic'):
+            self.send_authenticate()
+            return False
+
+        try:
+            client_auth = b64decode(authorization.split()[1])
+        except IndexError:
+            self.send_authenticate()
+            return False
+
+        with open('/tmp/proxy.password', 'rb') as f:
+            server_auth = f.readline().strip()
+
+        if client_auth != server_auth:
+            self.send_authenticate()
+            return False
+
+        return True
+
     def do_GET(self):
+        if not self.authenticate():
+            return
+
         # Log the path then proxy the request via urllib
         log.info(self.path)
         data = urlopen(self.path).read()


-- 
To view this commit on github, visit https://github.com/rhinstaller/anaconda/commit/b2bad8a24e6931e72526a5ace169b4fba8f7697d


More information about the anaconda-patches mailing list