class Proxy::Dynflow::Api
Public Instance Methods
do_authorize_with_ssl_client()
click to toggle source
# File lib/smart_proxy_dynflow/api.rb, line 47 def do_authorize_with_ssl_client if %w[yes on 1].include? request.env['HTTPS'].to_s if request.env['SSL_CLIENT_CERT'].to_s.empty? log_halt 403, "No client SSL certificate supplied" end else logger.debug('require_ssl_client_verification: skipping, non-HTTPS request') end end
do_authorize_with_trusted_hosts()
click to toggle source
TODO: move this to foreman-proxy to reduce code duplicities
# File lib/smart_proxy_dynflow/api.rb, line 24 def do_authorize_with_trusted_hosts # When :trusted_hosts is given, we check the client against the list # HTTPS: test the certificate CN # HTTP: test the reverse DNS entry of the remote IP trusted_hosts = Proxy::SETTINGS.trusted_hosts if trusted_hosts if ['yes', 'on', 1].include? request.env['HTTPS'].to_s fqdn = https_cert_cn source = 'SSL_CLIENT_CERT' else fqdn = remote_fqdn(Proxy::SETTINGS.forward_verify) source = 'REMOTE_ADDR' end fqdn = fqdn.downcase logger.debug "verifying remote client #{fqdn} (based on #{source}) against trusted_hosts #{trusted_hosts}" unless Proxy::SETTINGS.trusted_hosts.include?(fqdn) log_halt 403, "Untrusted client #{fqdn} attempted " \ "to access #{request.path_info}. Check :trusted_hosts: in settings.yml" end end end