summaryrefslogtreecommitdiffstats
path: root/custodia/httpd/server.py
Commit message (Collapse)AuthorAgeFilesLines
* Increase logging output of Kubernetes pluginskubeChristian Heimes2015-11-111-2/+8
| | | | Signed-off-by: Christian Heimes <cheimes@redhat.com>
* Fix authorization stack to call all modulesSimo Sorce2015-11-061-2/+6
| | | | | | | | | | | All authorization modules need to be executed, we cannot bail at the first one that returns a positive answer. Some authz modules attach data to the requst as a side effect and they need to be run even if others also authorize access. Additionally if a later module returns an explicit Deny, then that must override any previous granted access. Signed-off-by: Simo Sorce <simo@redhat.com>
* Do not use a private name for public variablesSimo Sorce2015-11-061-8/+8
| | | | | | In the server case auditlog is used in the pipeline too, so make it public. Signed-off-by: Simo Sorce <simo@redhat.com>
* Silence broad-except warningsSimo Sorce2015-11-061-1/+1
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Do not use reserved words wor argument namesSimo Sorce2015-11-061-2/+2
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix pylint violationsChristian Heimes2015-11-061-1/+1
| | | | Signed-off-by: Christian Heimes <cheimes@redhat.com>
* Improve logging format and configurationSimo Sorce2015-10-231-5/+6
| | | | | | | | | | | | | | This patch adda an 'origin' argument to the logger formatting that coms from the configuration parser and ties a log entry to the implementing class as well as the specific configuration facility that instantiated it. Also adds per configuration section debugging unless the global debug statment is true, in which case all objects have debugging forcibly turned on. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Change tests to be more self containedSimo Sorce2015-10-231-2/+0
| | | | | | | Use custom configuration and databases, do not rely on in-tree data. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add incoming requests to debug logSimo Sorce2015-10-231-0/+1
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Do not spam logs with tracebacks on HTTP ErrorsSimo Sorce2015-10-231-1/+1
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Use Python's logging framework for loggingChristian Heimes2015-10-201-8/+11
| | | | | | | | | | The custom logging and traceback functions as well as the audit logger are replaced with Python's logging framework. For now the loggers are hard-coded to use a StreamHandler(sys.stderr) as root handler and a FileHandler for the audit log. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add support for using listening on TCP socketsChristian Heimes2015-10-191-26/+68
| | | | | | | | | | | | | | | | | | | The server can be now configured using a new parameter called "server_url". Setting server_url to "http://0.0.0.0:80/" will make the server listen on TCP port 80, while setting it to "http+unix://%2fsocket" will make the server listen on the unix socket named "/socket". The backwards compatible "server_socket" is retained and used if no server_url is provided. The request dict has a new field "client_id" that contains either a PID or a peer name. In the future the field can be augmented with a TLS client cert DN or other similar identifier. Signed-off-by: Christian Heimes <cheimes@redhat.com> Signed-off-by: Simo Sorce <simo@redhat.com>
* Add auditing to auth/authz modulesSimo Sorce2015-10-191-5/+11
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add Ability to retrieve peer's SELinux ContextSimo Sorce2015-10-191-2/+16
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Make tox pep8 happySimo Sorce2015-10-191-8/+11
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Also capture loginuid of the remote processPavel Odvody2015-09-011-1/+18
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Closes #9
* Unquote the path before processingSimo Sorce2015-07-081-2/+3
| | | | | | | This avoids issues where spaces get turned to %20 and then name matching comparisons (like for KEMHandler) fail. Signed-off-by: Simo Sorce <simo@redhat.com>
* Add basic debugging capabilitiesSimo Sorce2015-06-051-12/+5
| | | | | | | If debug is set to True, then custodia's own Exception handlers will print a stack trace to standard output to aid debugging. Signed-off-by: Simo Sorce <simo@redhat.com>
* Make the socket world accessible by defaultSimo Sorce2015-05-261-0/+2
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Move pipeline from server class to request handlerSimo Sorce2015-04-081-79/+80
| | | | | Doesn't really make sense to have it on the server class, just snatch the config from it.
* Add basic framework for authorization pluginsSimo Sorce2015-04-081-3/+20
|
* Change authenticators to return a resultSimo Sorce2015-04-071-5/+13
| | | | | | | | | Authenticators will not signal anymore validity by adding a request attributes. Instead they can return on of three values: - True, indicates positive authentication - False, indicate explicit failure - None, inicates neither success nor failure, not applicable
* Add code to parse body and put it in the requestSimo Sorce2015-04-011-1/+19
| | | | | Accept a maximum of 10 Megabytes and relies on proper Content-length being set by the client
* Minor server.py fixesSimo Sorce2015-04-011-4/+9
| | | | | | | | Silence pylint errors due to python3 imports Switch to HTTP 1.0 by default, this terminates each request by default which make it handier for manual testing with clients like curl. Properly handle a consumer returning nothing (None) as output.
* Provide more complete parsing of a request pathSimo Sorce2015-03-301-0/+24
|
* Add some documentation in form of class commentsSimo Sorce2015-03-301-0/+57
|
* Adjust the code to be python3 happySimo Sorce2015-03-251-0/+191
This required the renaming of the http directory to avoid clashes with the python3 own http/server module.
generated by cgit (git 2.34.1) at 2024-05-17 15:21:05 +0000