From c23ceacd0b18491a6a8b76bf9497225c7764e523 Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Wed, 20 Mar 2019 22:42:47 +0100 Subject: [PATCH] initial implementation of reverse proxy, using django-revproxy from within a middleware add new config entry "primary_domain" which is used to set the cookie domain --- .bumpversion.cfg | 1 + debian/etc/passbook/config.yml | 2 + .../templates/passbook-configmap.yaml | 1 + passbook/app_gw/.DS_Store | Bin 0 -> 6148 bytes passbook/app_gw/__init__.py | 2 + passbook/app_gw/admin.py | 5 + passbook/app_gw/apps.py | 11 + passbook/app_gw/forms.py | 30 +++ passbook/app_gw/middleware.py | 222 ++++++++++++++++++ passbook/app_gw/migrations/.DS_Store | Bin 0 -> 6148 bytes passbook/app_gw/migrations/0001_initial.py | 50 ++++ passbook/app_gw/migrations/__init__.py | 0 passbook/app_gw/models.py | 61 +++++ passbook/app_gw/requirements.txt | 2 + passbook/app_gw/settings.py | 5 + passbook/app_gw/urls.py | 2 + passbook/core/settings.py | 9 +- passbook/lib/default.yml | 2 + requirements.txt | 1 + 19 files changed, 403 insertions(+), 3 deletions(-) create mode 100644 passbook/app_gw/.DS_Store create mode 100644 passbook/app_gw/__init__.py create mode 100644 passbook/app_gw/admin.py create mode 100644 passbook/app_gw/apps.py create mode 100644 passbook/app_gw/forms.py create mode 100644 passbook/app_gw/middleware.py create mode 100644 passbook/app_gw/migrations/.DS_Store create mode 100644 passbook/app_gw/migrations/0001_initial.py create mode 100644 passbook/app_gw/migrations/__init__.py create mode 100644 passbook/app_gw/models.py create mode 100644 passbook/app_gw/requirements.txt create mode 100644 passbook/app_gw/settings.py create mode 100644 passbook/app_gw/urls.py diff --git a/.bumpversion.cfg b/.bumpversion.cfg index cb13bf647..bb3411650 100644 --- a/.bumpversion.cfg +++ b/.bumpversion.cfg @@ -53,3 +53,4 @@ values = [bumpversion:file:passbook/otp/__init__.py] +[bumpversion:file:passbook/app_gw/__init__.py] diff --git a/debian/etc/passbook/config.yml b/debian/etc/passbook/config.yml index 9fd285802..d617d9afb 100644 --- a/debian/etc/passbook/config.yml +++ b/debian/etc/passbook/config.yml @@ -14,6 +14,8 @@ rabbitmq: guest:guest@localhost/passbook # Error reporting, sends stacktrace to sentry.services.beryju.org error_report_enabled: true +primary_domain: passbook.local + passbook: sign_up: # Enables signup, created users are stored in internal Database and created in LDAP if ldap.create_users is true diff --git a/helm/passbook/templates/passbook-configmap.yaml b/helm/passbook/templates/passbook-configmap.yaml index 8283e8d20..c82196107 100644 --- a/helm/passbook/templates/passbook-configmap.yaml +++ b/helm/passbook/templates/passbook-configmap.yaml @@ -46,6 +46,7 @@ data: secret_key: {{ randAlphaNum 50 }} {{- end }} + primary_domain: {{ .Values.primary_domain }} domains: {{- range .Values.ingress.hosts }} - {{ . | quote }} diff --git a/passbook/app_gw/.DS_Store b/passbook/app_gw/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..badfb0a2066fcd672ba3cee987f94c2cb62a5280 GIT binary patch literal 6148 zcmeHKO^(wr82vm`sN1Td3#6H4Hb^W+r~?dLAf&1ci`gL+!2(bxnS?e{nskzsQc6)b z+yS@&N8tnkpmCj9v&jx{-q45 z3)Y0@bVfG9h&-;R!1`8TN%*=nMoXdEB?_&Gy@G!g{u4Y&srRRXx1=`|QH=V_{eKqx zo2n-+dK94dGqe>0dG{*xOO5_>ZuE7<9Kzqmp68?0kdl(I|CQs+l8ILNyE6&=ByG2U zh@IWawd++W>$2XgzwVEsSwFSYY0|Ufm;CnBPDhSTKZ~N^Pug~#``&EOy7@Q?Q`--{ zSdo3#gUhQIe&|NCUNjBeMAg&J3Z$&b+Mu<+SR8eZ4y^l~yUPP>(do32zV~3ctjWDw zhmTH9$Mg4#56h2VAR|m*(^qyw;{|+0qEw)_{WuJwaENl|)*xa8@jb|2K4H8Z@)EYx z1fA0qlJiuJ5kgD=vr~FU>G~81ULbjX1D+l{dCEc>ZfTX5NuE_jd-1kD^3o78w=_V$ z8m6aDHm*i@O)rfCMuAIIfcFOrfw8M`m7&@?5UDEwu!3x5Nb}DEb1aQrjjIe%0uvb( zm{EnkVu*~6d`tUvHLfzu=p^*zL+F-;zM%-!I_kHSJBeHf1=bbV&0br4{y*7% z|6eDWH=}@2;J;EpRF3<{Jq$^ots8^mv(`d5MPOsURfdX!NFT>4!AJ2vf-;m@oB(z; Ut};Xp%=`!_8BAmpxKssx13l~SZU6uP literal 0 HcmV?d00001 diff --git a/passbook/app_gw/__init__.py b/passbook/app_gw/__init__.py new file mode 100644 index 000000000..0b3a08e30 --- /dev/null +++ b/passbook/app_gw/__init__.py @@ -0,0 +1,2 @@ +"""passbook Application Security Gateway Header""" +__version__ = '0.1.23-beta' diff --git a/passbook/app_gw/admin.py b/passbook/app_gw/admin.py new file mode 100644 index 000000000..9391932a6 --- /dev/null +++ b/passbook/app_gw/admin.py @@ -0,0 +1,5 @@ +"""passbook Application Security Gateway model admin""" + +from passbook.lib.admin import admin_autoregister + +admin_autoregister('passbook_app_gw') diff --git a/passbook/app_gw/apps.py b/passbook/app_gw/apps.py new file mode 100644 index 000000000..6ad71d8de --- /dev/null +++ b/passbook/app_gw/apps.py @@ -0,0 +1,11 @@ +"""passbook Application Security Gateway app""" +from django.apps import AppConfig + + +class PassbookApplicationApplicationGatewayConfig(AppConfig): + """passbook app_gw app""" + + name = 'passbook.app_gw' + label = 'passbook_app_gw' + verbose_name = 'passbook Application Security Gateway' + mountpoint = 'app_gw/' diff --git a/passbook/app_gw/forms.py b/passbook/app_gw/forms.py new file mode 100644 index 000000000..11aafd621 --- /dev/null +++ b/passbook/app_gw/forms.py @@ -0,0 +1,30 @@ +"""passbook Application Security Gateway Forms""" + +from django import forms +from django.contrib.admin.widgets import FilteredSelectMultiple +from django.utils.translation import gettext as _ + +from passbook.app_gw.models import ApplicationGatewayProvider +from passbook.lib.fields import DynamicArrayField + + +class ApplicationGatewayProviderForm(forms.ModelForm): + """Security Gateway Provider form""" + + class Meta: + + model = ApplicationGatewayProvider + fields = ['server_name', 'upstream', 'enabled', 'authentication_header', + 'default_content_type', 'upstream_ssl_verification'] + widgets = { + 'authentication_header': forms.TextInput(), + 'default_content_type': forms.TextInput(), + 'property_mappings': FilteredSelectMultiple(_('Property Mappings'), False) + } + field_classes = { + 'server_name': DynamicArrayField, + 'upstream': DynamicArrayField + } + labels = { + 'upstream_ssl_verification': _('Verify upstream SSL Certificates?') + } diff --git a/passbook/app_gw/middleware.py b/passbook/app_gw/middleware.py new file mode 100644 index 000000000..008c9c3a4 --- /dev/null +++ b/passbook/app_gw/middleware.py @@ -0,0 +1,222 @@ +"""passbook app_gw middleware""" +import mimetypes +from logging import getLogger +from urllib.parse import urlparse + +import certifi +import urllib3 +from django.core.cache import cache +from django.utils.http import urlencode +from revproxy.exceptions import InvalidUpstream +from revproxy.response import get_django_response +from revproxy.utils import encode_items, normalize_request_headers + +from passbook.app_gw.models import ApplicationGatewayProvider +from passbook.core.models import Application + +IGNORED_HOSTNAMES_KEY = 'passbook_app_gw_ignored' +LOGGER = getLogger(__name__) +QUOTE_SAFE = r'<.;>\(}*+|~=-$/_:^@)[{]&\'!,"`' +ERRORS_MESSAGES = { + 'upstream-no-scheme': ("Upstream URL scheme must be either " + "'http' or 'https' (%s).") +} + +# pylint: disable=too-many-instance-attributes +class ApplicationGatewayMiddleware: + """Check if request should be proxied or handeled normally""" + + ignored_hosts = [] + request = None + app_gw = None + http = None + http_no_verify = None + host_header = '' + + _parsed_url = None + _request_headers = None + + def __init__(self, get_response): + self.get_response = get_response + self.ignored_hosts = cache.get(IGNORED_HOSTNAMES_KEY, []) + self.http_no_verify = urllib3.PoolManager() + self.http = urllib3.PoolManager( + cert_reqs='CERT_REQUIRED', + ca_certs=certifi.where()) + + def precheck(self, request): + """Check if a request should be proxied or forwarded to passbook""" + # Check if hostname is in cached list of ignored hostnames + # This saves us having to query the database on each request + self.host_header = request.META.get('HTTP_HOST') + if self.host_header in self.ignored_hosts: + LOGGER.debug("%s is ignored", self.host_header) + return True, None + # Look through all ApplicationGatewayProviders and check hostnames + matches = ApplicationGatewayProvider.objects.filter( + server_name__contains=[self.host_header], + enabled=True) + if not matches.exists(): + # Mo matching Providers found, add host header to ignored list + self.ignored_hosts.append(self.host_header) + cache.set(IGNORED_HOSTNAMES_KEY, self.ignored_hosts) + LOGGER.debug("Ignoring %s", self.host_header) + return True, None + # At this point we're certain there's a matching ApplicationGateway + if len(matches) > 1: + # TODO This should never happen + raise ValueError + app_gw = matches.first() + try: + # Check if ApplicationGateway is associcaited with application + getattr(app_gw, 'application') + return False, app_gw + except Application.DoesNotExist: + LOGGER.debug("ApplicationGateway not associated with Application") + return True, None + return True, None + + def __call__(self, request): + forward, self.app_gw = self.precheck(request) + if forward: + return self.get_response(request) + self.request = request + return self.dispatch(request) + + def get_upstream(self): + """Get upstream as parsed url""" + # TODO: How to choose upstream? + upstream = self.app_gw.upstream[0] + + if not getattr(self, '_parsed_url', None): + self._parsed_url = urlparse(upstream) + + if self._parsed_url.scheme not in ('http', 'https'): + raise InvalidUpstream(ERRORS_MESSAGES['upstream-no-scheme'] % + upstream) + + return upstream + + # def _format_path_to_redirect(self, request): + # full_path = request.get_full_path() + # LOGGER.debug("Dispatch full path: %s", full_path) + # for from_re, to_pattern in []: + # if from_re.match(full_path): + # redirect_to = from_re.sub(to_pattern, full_path) + # LOGGER.debug("Redirect to: %s", redirect_to) + # return redirect_to + # return None + + def get_proxy_request_headers(self, request): + """Get normalized headers for the upstream + Gets all headers from the original request and normalizes them. + Normalization occurs by removing the prefix ``HTTP_`` and + replacing and ``_`` by ``-``. Example: ``HTTP_ACCEPT_ENCODING`` + becames ``Accept-Encoding``. + .. versionadded:: 0.9.1 + :param request: The original HTTPRequest instance + :returns: Normalized headers for the upstream + """ + return normalize_request_headers(request) + + def get_request_headers(self): + """Return request headers that will be sent to upstream. + The header REMOTE_USER is set to the current user + if AuthenticationMiddleware is enabled and + the view's add_remote_user property is True. + .. versionadded:: 0.9.8 + """ + request_headers = self.get_proxy_request_headers(self.request) + + if hasattr(self.request, 'user') and self.request.user.is_active: + request_headers[self.app_gw.authentication_header] = self.request.user.get_username() + LOGGER.info("REMOTE_USER set") + + return request_headers + + # def get_quoted_path(self, path): + # """Return quoted path to be used in proxied request""" + # return quote_plus(path.encode('utf8'), QUOTE_SAFE) + + def get_encoded_query_params(self): + """Return encoded query params to be used in proxied request""" + get_data = encode_items(self.request.GET.lists()) + return urlencode(get_data) + + def _created_proxy_response(self, request): + request_payload = request.body + + LOGGER.debug("Request headers: %s", self._request_headers) + + path = request.get_full_path() + request_url = self.get_upstream() + path + LOGGER.debug("Request URL: %s", request_url) + + if request.GET: + request_url += '?' + self.get_encoded_query_params() + LOGGER.debug("Request URL: %s", request_url) + + http = self.http + if not self.app_gw.upstream_ssl_verification: + http = self.http_no_verify + + try: + proxy_response = http.urlopen(request.method, + request_url, + redirect=False, + retries=None, + headers=self._request_headers, + body=request_payload, + decode_content=False, + preload_content=False) + LOGGER.debug("Proxy response header: %s", + proxy_response.getheaders()) + except urllib3.exceptions.HTTPError as error: + LOGGER.exception(error) + raise + + return proxy_response + + def _replace_host_on_redirect_location(self, request, proxy_response): + location = proxy_response.headers.get('Location') + if location: + if request.is_secure(): + scheme = 'https://' + else: + scheme = 'http://' + request_host = scheme + self.host_header + + upstream_host_http = 'http://' + self._parsed_url.netloc + upstream_host_https = 'https://' + self._parsed_url.netloc + + location = location.replace(upstream_host_http, request_host) + location = location.replace(upstream_host_https, request_host) + proxy_response.headers['Location'] = location + LOGGER.debug("Proxy response LOCATION: %s", + proxy_response.headers['Location']) + + def _set_content_type(self, request, proxy_response): + content_type = proxy_response.headers.get('Content-Type') + if not content_type: + content_type = (mimetypes.guess_type(request.path)[0] or + self.app_gw.default_content_type) + proxy_response.headers['Content-Type'] = content_type + LOGGER.debug("Proxy response CONTENT-TYPE: %s", + proxy_response.headers['Content-Type']) + + def dispatch(self, request): + """Build proxied request and pass to upstream""" + self._request_headers = self.get_request_headers() + + # redirect_to = self._format_path_to_redirect(request) + # if redirect_to: + # return redirect(redirect_to) + + proxy_response = self._created_proxy_response(request) + + self._replace_host_on_redirect_location(request, proxy_response) + self._set_content_type(request, proxy_response) + response = get_django_response(proxy_response, strict_cookies=False) + + LOGGER.debug("RESPONSE RETURNED: %s", response) + return response diff --git a/passbook/app_gw/migrations/.DS_Store b/passbook/app_gw/migrations/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..5008ddfcf53c02e82d7eee2e57c38e5672ef89f6 GIT binary patch literal 6148 zcmeH~Jr2S!425mzP>H1@V-^m;4Wg<&0T*E43hX&L&p$$qDprKhvt+--jT7}7np#A3 zem<@ulZcFPQ@L2!n>{z**++&mCkOWA81W14cNZlEfg7;MkzE(HCqgga^y>{tEnwC%0;vJ&^%eQ zLs35+`xjp>T0