<s> import hashlib <EOL> import time <EOL> import webob . exc <EOL> import webob . dec <EOL> from nova import auth <EOL> from nova import context <EOL> from nova import exception <EOL> from nova import flags <EOL> from nova import log as logging <EOL> from nova import utils <EOL> from nova import wsgi <EOL> from nova . api . openstack import common <EOL> from nova . api . openstack import faults <EOL> LOG = logging . getLogger ( '<STR_LIT>' ) <EOL> FLAGS = flags . FLAGS <EOL> flags . DECLARE ( '<STR_LIT>' , '<STR_LIT>' ) <EOL> class NoAuthMiddleware ( wsgi . Middleware ) : <EOL> """<STR_LIT>""" <EOL> @ webob . dec . wsgify ( RequestClass = wsgi . Request ) <EOL> def __call__ ( self , req ) : <EOL> if '<STR_LIT>' not in req . headers : <EOL> os_url = req . url <EOL> version = common . get_version_from_href ( os_url ) <EOL> user_id = req . headers . get ( '<STR_LIT>' , '<STR_LIT>' ) <EOL> project_id = req . headers . get ( '<STR_LIT>' , '<STR_LIT>' ) <EOL> if version == '<STR_LIT>' : <EOL> os_url += '<STR_LIT:/>' + project_id <EOL> res = webob . Response ( ) <EOL> res . headers [ '<STR_LIT>' ] = '<STR_LIT>' % ( user_id , project_id ) <EOL> res . headers [ '<STR_LIT>' ] = os_url <EOL> res . headers [ '<STR_LIT>' ] = '<STR_LIT>' <EOL> res . headers [ '<STR_LIT>' ] = '<STR_LIT>' <EOL> res . content_type = '<STR_LIT>' <EOL> res . status = '<STR_LIT>' <EOL> return res <EOL> token = req . headers [ '<STR_LIT>' ] <EOL> user_id , _sep , project_id = token . partition ( '<STR_LIT::>' ) <EOL> project_id = project_id or user_id <EOL> remote_address = getattr ( req , '<STR_LIT>' , '<STR_LIT:127.0.0.1>' ) <EOL> if FLAGS . use_forwarded_for : <EOL> remote_address = req . headers . get ( '<STR_LIT>' , remote_address ) <EOL> ctx = context . RequestContext ( user_id , <EOL> project_id , <EOL> is_admin = True , <EOL> remote_address = remote_address ) <EOL> req . environ [ '<STR_LIT>' ] = ctx <EOL> return self . application <EOL> class AuthMiddleware ( wsgi . Middleware ) : <EOL> """<STR_LIT>""" <EOL> def __init__ ( self , application , db_driver = None ) : <EOL> if not db_driver : <EOL> db_driver = FLAGS . db_driver <EOL> self . db = utils . import_object ( db_driver ) <EOL> self . auth = auth . manager . AuthManager ( ) <EOL> super ( AuthMiddleware , self ) . __init__ ( application ) <EOL> @ webob . dec . wsgify ( RequestClass = wsgi . Request ) <EOL> def __call__ ( self , req ) : <EOL> if not self . has_authentication ( req ) : <EOL> return self . authenticate ( req ) <EOL> user_id = self . get_user_by_authentication ( req ) <EOL> if not user_id : <EOL> token = req . headers [ "<STR_LIT>" ] <EOL> msg = _ ( "<STR_LIT>" ) <EOL> LOG . warn ( msg % locals ( ) ) <EOL> return faults . Fault ( webob . exc . HTTPUnauthorized ( ) ) <EOL> projects = self . auth . get_projects ( user_id ) <EOL> if not projects : <EOL> return faults . Fault ( webob . exc . HTTPUnauthorized ( ) ) <EOL> project_id = "<STR_LIT>" <EOL> path_parts = req . path . split ( '<STR_LIT:/>' ) <EOL> if len ( path_parts ) > <NUM_LIT:1> and path_parts [ <NUM_LIT:1> ] == '<STR_LIT>' : <EOL> project_id = path_parts [ <NUM_LIT:2> ] <EOL> try : <EOL> project = self . auth . get_project ( project_id ) <EOL> except exception . ProjectNotFound : <EOL> return faults . Fault ( webob . exc . HTTPUnauthorized ( ) ) <EOL> if project_id not in [ p . id for p in projects ] : <EOL> return faults . Fault ( webob . exc . HTTPUnauthorized ( ) ) <EOL> else : <EOL> try : <EOL> project_id = req . headers [ "<STR_LIT>" ] <EOL> except KeyError : <EOL> project_id = projects [ <NUM_LIT:0> ] . id <EOL> is_admin = self . auth . is_admin ( user_id ) <EOL> remote_address = getattr ( req , '<STR_LIT>' , '<STR_LIT:127.0.0.1>' ) <EOL> if FLAGS . use_forwarded_for : <EOL> remote_address = req . headers . get ( '<STR_LIT>' , remote_address ) <EOL> ctx = context . RequestContext ( user_id , <EOL> project_id , <EOL> is_admin = is_admin , <EOL> remote_address = remote_address ) <EOL> req . environ [ '<STR_LIT>' ] = ctx <EOL> if not is_admin and not self . auth . is_project_member ( user_id , <EOL> project_id ) : <EOL> msg = _ ( "<STR_LIT>" <EOL> "<STR_LIT>" ) <EOL> LOG . warn ( msg % locals ( ) ) <EOL> return faults . Fault ( webob . exc . HTTPUnauthorized ( ) ) <EOL> return self . application <EOL> def has_authentication ( self , req ) : <EOL> return '<STR_LIT>' in req . headers <EOL> def get_user_by_authentication ( self , req ) : <EOL> return self . authorize_token ( req . headers [ "<STR_LIT>" ] ) <EOL> def authenticate ( self , req ) : <EOL> path_info = req . path_info <EOL> if len ( path_info ) > <NUM_LIT:1> : <EOL> msg = _ ( "<STR_LIT>" <EOL> "<STR_LIT>" ) <EOL> LOG . warn ( msg ) <EOL> return faults . Fault ( webob . exc . HTTPUnauthorized ( explanation = msg ) ) <EOL> def _get_auth_header ( key ) : <EOL> """<STR_LIT>""" <EOL> try : <EOL> return req . headers [ key ] <EOL> except KeyError as ex : <EOL> raise KeyError ( key ) <EOL> try : <EOL> username = _get_auth_header ( '<STR_LIT>' ) <EOL> key = _get_auth_header ( '<STR_LIT>' ) <EOL> except KeyError as ex : <EOL> msg = _ ( "<STR_LIT>" ) % ex <EOL> LOG . warn ( msg ) <EOL> return faults . Fault ( webob . exc . HTTPUnauthorized ( explanation = msg ) ) <EOL> token , user = self . _authorize_user ( username , key , req ) <EOL> if user and token : <EOL> res = webob . Response ( ) <EOL> res . headers [ '<STR_LIT>' ] = token [ '<STR_LIT>' ] <EOL> res . headers [ '<STR_LIT>' ] = token [ '<STR_LIT>' ] <EOL> res . headers [ '<STR_LIT>' ] = token [ '<STR_LIT>' ] <EOL> res . headers [ '<STR_LIT>' ] = token [ '<STR_LIT>' ] <EOL> res . content_type = '<STR_LIT>' <EOL> res . status = '<STR_LIT>' <EOL> LOG . debug ( _ ( "<STR_LIT>" ) % username ) <EOL> return res <EOL> else : <EOL> return faults . Fault ( webob . exc . HTTPUnauthorized ( ) ) <EOL> def authorize_token ( self , token_hash ) : <EOL> """<STR_LIT>""" <EOL> ctxt = context . get_admin_context ( ) <EOL> try : <EOL> token = self . db . auth_token_get ( ctxt , token_hash ) <EOL> except exception . NotFound : <EOL> return None <EOL> if token : <EOL> delta = utils . utcnow ( ) - token [ '<STR_LIT>' ] <EOL> if delta . days >= <NUM_LIT:2> : <EOL> self . db . auth_token_destroy ( ctxt , token [ '<STR_LIT>' ] ) <EOL> else : <EOL> return token [ '<STR_LIT>' ] <EOL> return None <EOL> def _authorize_user ( self , username , key , req ) : <EOL> """<STR_LIT>""" <EOL> ctxt = context . get_admin_context ( ) <EOL> project_id = req . headers . get ( '<STR_LIT>' ) <EOL> if project_id is None : <EOL> user = self . auth . get_user_from_access_key ( key ) <EOL> projects = self . auth . get_projects ( user . id ) <EOL> if not projects : <EOL> raise webob . exc . HTTPUnauthorized ( ) <EOL> project_id = projects [ <NUM_LIT:0> ] . id <EOL> try : <EOL> user = self . auth . get_user_from_access_key ( key ) <EOL> except exception . NotFound : <EOL> LOG . warn ( _ ( "<STR_LIT>" ) ) <EOL> user = None <EOL> if user and user . name == username : <EOL> token_hash = hashlib . sha1 ( '<STR_LIT>' % ( username , key , <EOL> time . time ( ) ) ) . hexdigest ( ) <EOL> token_dict = { } <EOL> token_dict [ '<STR_LIT>' ] = token_hash <EOL> token_dict [ '<STR_LIT>' ] = '<STR_LIT>' <EOL> os_url = req . url <EOL> token_dict [ '<STR_LIT>' ] = os_url . strip ( '<STR_LIT:/>' ) <EOL> version = common . get_version_from_href ( os_url ) <EOL> if version == '<STR_LIT>' : <EOL> token_dict [ '<STR_LIT>' ] += '<STR_LIT:/>' + project_id <EOL> token_dict [ '<STR_LIT>' ] = '<STR_LIT>' <EOL> token_dict [ '<STR_LIT>' ] = user . id <EOL> token = self . db . auth_token_create ( ctxt , token_dict ) <EOL> return token , user <EOL> elif user and user . name != username : <EOL> msg = _ ( "<STR_LIT>" <EOL> "<STR_LIT>" ) % locals ( ) <EOL> LOG . warn ( msg ) <EOL> return None , None </s>
