|
@@ -23,6 +23,7 @@ import logging
|
|
|
import mimetypes
|
|
import mimetypes
|
|
|
import os.path
|
|
import os.path
|
|
|
import re
|
|
import re
|
|
|
|
|
+import socket
|
|
|
import tempfile
|
|
import tempfile
|
|
|
import time
|
|
import time
|
|
|
|
|
|
|
@@ -672,10 +673,15 @@ class SpnegoMiddleware(object):
|
|
|
knox_verification = False
|
|
knox_verification = False
|
|
|
if desktop.conf.KNOX.KNOX_PRINCIPAL.get() in username:
|
|
if desktop.conf.KNOX.KNOX_PRINCIPAL.get() in username:
|
|
|
# This may contain chain of reverse proxies, e.g. knox proxy, hue load balancer
|
|
# This may contain chain of reverse proxies, e.g. knox proxy, hue load balancer
|
|
|
|
|
+ # Compare hostname on both HTTP_X_FORWARDED_HOST & KNOX_PROXYHOSTS. Both of these can be configured to use either hostname or IPs and we have to normalize to one or the other
|
|
|
req_hosts = self.clean_host(request.META['HTTP_X_FORWARDED_HOST'])
|
|
req_hosts = self.clean_host(request.META['HTTP_X_FORWARDED_HOST'])
|
|
|
knox_proxy = self.clean_host(desktop.conf.KNOX.KNOX_PROXYHOSTS.get())
|
|
knox_proxy = self.clean_host(desktop.conf.KNOX.KNOX_PROXYHOSTS.get())
|
|
|
if req_hosts.intersection(knox_proxy):
|
|
if req_hosts.intersection(knox_proxy):
|
|
|
knox_verification = True
|
|
knox_verification = True
|
|
|
|
|
+ else:
|
|
|
|
|
+ access_warn(request, 'Failed to verify provided host %s with %s ' % (req_hosts, knox_proxy))
|
|
|
|
|
+ else:
|
|
|
|
|
+ access_warn(request, 'Failed to verify provided username %s with %s ' % (username, desktop.conf.KNOX.KNOX_PRINCIPAL.get()))
|
|
|
# If knox authentication failed then generate 401 (Unauthorized error)
|
|
# If knox authentication failed then generate 401 (Unauthorized error)
|
|
|
if not knox_verification:
|
|
if not knox_verification:
|
|
|
request.META['Return-401'] = ''
|
|
request.META['Return-401'] = ''
|
|
@@ -712,7 +718,7 @@ class SpnegoMiddleware(object):
|
|
|
|
|
|
|
|
def clean_host(self, pattern):
|
|
def clean_host(self, pattern):
|
|
|
if pattern:
|
|
if pattern:
|
|
|
- return set([hostport.split(':')[0] for hostport in pattern.split(',')])
|
|
|
|
|
|
|
+ return set([socket.gethostbyaddr(hostport.split(':')[0])[0] for hostport in pattern.split(',')])
|
|
|
return set([])
|
|
return set([])
|
|
|
|
|
|
|
|
def clean_username(self, username, request):
|
|
def clean_username(self, username, request):
|