External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-03-10 22:19:28 -02:30
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2449 from ryanpetrello/https-logs

Browse Source 
default HTTP-based log emits to HTTPS
This commit is contained in:
Ryan Petrello
2018-07-09 12:07:34 -04:00
committed by GitHub
parent 6a610d633f 6bd9792518
commit df095d9b67
4 changed files with 32 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
awx/main/conf.py
View File

@@ -473,10 +473,12 @@ register(
register( register(
'LOG_AGGREGATOR_PROTOCOL', 'LOG_AGGREGATOR_PROTOCOL',
field_class=fields.ChoiceField, field_class=fields.ChoiceField,
choices=[('https', 'HTTPS'), ('tcp', 'TCP'), ('udp', 'UDP')], choices=[('https', 'HTTPS/HTTP'), ('tcp', 'TCP'), ('udp', 'UDP')],
default='https', default='https',
label=_('Logging Aggregator Protocol'), label=_('Logging Aggregator Protocol'),
help_text=_('Protocol used to communicate with log aggregator.'), help_text=_('Protocol used to communicate with log aggregator. '
'HTTPS/HTTP assumes HTTPS unless http:// is explicitly used in '
'the Logging Aggregator hostname.'),
category=_('Logging'), category=_('Logging'),
category_slug='logging', category_slug='logging',
) )

47
awx/main/tests/unit/utils/test_handlers.py
View File

@@ -22,8 +22,8 @@ from awx.main.utils.formatters import LogstashFormatter
@pytest.fixture() @pytest.fixture()
def http_adapter(): def https_adapter():
class FakeHTTPAdapter(requests.adapters.HTTPAdapter): class FakeHTTPSAdapter(requests.adapters.HTTPAdapter):
requests = [] requests = []
status = 200 status = 200
reason = None reason = None
@@ -36,7 +36,7 @@ def http_adapter():
resp.request = request resp.request = request
return resp return resp
return FakeHTTPAdapter() return FakeHTTPSAdapter()
@pytest.fixture() @pytest.fixture()
@@ -194,17 +194,22 @@ def test_base_logging_handler_host_format(host, port, normalized, hostname_only)
'status, reason, exc', 'status, reason, exc',
[(200, '200 OK', None), (404, 'Not Found', LoggingConnectivityException)] [(200, '200 OK', None), (404, 'Not Found', LoggingConnectivityException)]
) )
def test_https_logging_handler_connectivity_test(http_adapter, status, reason, exc): @pytest.mark.parametrize('protocol', ['http', 'https', None])
http_adapter.status = status def test_https_logging_handler_connectivity_test(https_adapter, status, reason, exc, protocol):
http_adapter.reason = reason host = 'example.org'
if protocol:
host = '://'.join([protocol, host])
https_adapter.status = status
https_adapter.reason = reason
settings = LazySettings() settings = LazySettings()
settings.configure(**{ settings.configure(**{
'LOG_AGGREGATOR_HOST': 'example.org', 'LOG_AGGREGATOR_HOST': host,
'LOG_AGGREGATOR_PORT': 8080, 'LOG_AGGREGATOR_PORT': 8080,
'LOG_AGGREGATOR_TYPE': 'logstash', 'LOG_AGGREGATOR_TYPE': 'logstash',
'LOG_AGGREGATOR_USERNAME': 'user', 'LOG_AGGREGATOR_USERNAME': 'user',
'LOG_AGGREGATOR_PASSWORD': 'password', 'LOG_AGGREGATOR_PASSWORD': 'password',
'LOG_AGGREGATOR_LOGGERS': ['awx', 'activity_stream', 'job_events', 'system_tracking'], 'LOG_AGGREGATOR_LOGGERS': ['awx', 'activity_stream', 'job_events', 'system_tracking'],
'LOG_AGGREGATOR_PROTOCOL': 'https',
'CLUSTER_HOST_ID': '', 'CLUSTER_HOST_ID': '',
'LOG_AGGREGATOR_TOWER_UUID': str(uuid4()), 'LOG_AGGREGATOR_TOWER_UUID': str(uuid4()),
'LOG_AGGREGATOR_LEVEL': 'DEBUG', 'LOG_AGGREGATOR_LEVEL': 'DEBUG',
@@ -214,7 +219,7 @@ def test_https_logging_handler_connectivity_test(http_adapter, status, reason, e
def __init__(self, *args, **kwargs): def __init__(self, *args, **kwargs):
super(FakeHTTPSHandler, self).__init__(*args, **kwargs) super(FakeHTTPSHandler, self).__init__(*args, **kwargs)
self.session.mount('http://', http_adapter) self.session.mount('{}://'.format(protocol or 'https'), https_adapter)
def emit(self, record): def emit(self, record):
return super(FakeHTTPSHandler, self).emit(record) return super(FakeHTTPSHandler, self).emit(record)
@@ -270,17 +275,17 @@ def test_https_logging_handler_connection_error(connection_error_adapter,
@pytest.mark.parametrize('message_type', ['logstash', 'splunk']) @pytest.mark.parametrize('message_type', ['logstash', 'splunk'])
def test_https_logging_handler_emit_without_cred(http_adapter, dummy_log_record, def test_https_logging_handler_emit_without_cred(https_adapter, dummy_log_record,
message_type): message_type):
handler = HTTPSHandler(host='127.0.0.1', message_type=message_type) handler = HTTPSHandler(host='127.0.0.1', message_type=message_type)
handler.setFormatter(LogstashFormatter()) handler.setFormatter(LogstashFormatter())
handler.session.mount('http://', http_adapter) handler.session.mount('https://', https_adapter)
async_futures = handler.emit(dummy_log_record) async_futures = handler.emit(dummy_log_record)
[future.result() for future in async_futures] [future.result() for future in async_futures]
assert len(http_adapter.requests) == 1 assert len(https_adapter.requests) == 1
request = http_adapter.requests[0] request = https_adapter.requests[0]
assert request.url == 'http://127.0.0.1/' assert request.url == 'https://127.0.0.1/'
assert request.method == 'POST' assert request.method == 'POST'
if message_type == 'logstash': if message_type == 'logstash':
@@ -291,32 +296,32 @@ def test_https_logging_handler_emit_without_cred(http_adapter, dummy_log_record,
assert request.headers['Authorization'] == 'Splunk None' assert request.headers['Authorization'] == 'Splunk None'
def test_https_logging_handler_emit_logstash_with_creds(http_adapter, def test_https_logging_handler_emit_logstash_with_creds(https_adapter,
dummy_log_record): dummy_log_record):
handler = HTTPSHandler(host='127.0.0.1', handler = HTTPSHandler(host='127.0.0.1',
username='user', password='pass', username='user', password='pass',
message_type='logstash') message_type='logstash')
handler.setFormatter(LogstashFormatter()) handler.setFormatter(LogstashFormatter())
handler.session.mount('http://', http_adapter) handler.session.mount('https://', https_adapter)
async_futures = handler.emit(dummy_log_record) async_futures = handler.emit(dummy_log_record)
[future.result() for future in async_futures] [future.result() for future in async_futures]
assert len(http_adapter.requests) == 1 assert len(https_adapter.requests) == 1
request = http_adapter.requests[0] request = https_adapter.requests[0]
assert request.headers['Authorization'] == 'Basic %s' % base64.b64encode("user:pass") assert request.headers['Authorization'] == 'Basic %s' % base64.b64encode("user:pass")
def test_https_logging_handler_emit_splunk_with_creds(http_adapter, def test_https_logging_handler_emit_splunk_with_creds(https_adapter,
dummy_log_record): dummy_log_record):
handler = HTTPSHandler(host='127.0.0.1', handler = HTTPSHandler(host='127.0.0.1',
password='pass', message_type='splunk') password='pass', message_type='splunk')
handler.setFormatter(LogstashFormatter()) handler.setFormatter(LogstashFormatter())
handler.session.mount('http://', http_adapter) handler.session.mount('https://', https_adapter)
async_futures = handler.emit(dummy_log_record) async_futures = handler.emit(dummy_log_record)
[future.result() for future in async_futures] [future.result() for future in async_futures]
assert len(http_adapter.requests) == 1 assert len(https_adapter.requests) == 1
request = http_adapter.requests[0] request = https_adapter.requests[0]
assert request.headers['Authorization'] == 'Splunk pass' assert request.headers['Authorization'] == 'Splunk pass'

2
awx/main/utils/handlers.py
View File

@@ -203,7 +203,7 @@ class BaseHTTPSHandler(BaseHandler):
https://docs.python.org/3/library/concurrent.futures.html#future-objects https://docs.python.org/3/library/concurrent.futures.html#future-objects
http://pythonhosted.org/futures/ http://pythonhosted.org/futures/
""" """
return self.session.post(self._get_host(scheme='http'), return self.session.post(self._get_host(scheme='https'),
**self._get_post_kwargs(payload)) **self._get_post_kwargs(payload))

1
docs/CHANGELOG.md
View File

@@ -73,6 +73,7 @@
* Disallowed using HTTP PUT/PATCH methods to modify existing jobs in Job Details API endpoint. * Disallowed using HTTP PUT/PATCH methods to modify existing jobs in Job Details API endpoint.
* Changed the name of the session length setting from `AUTH_TOKEN_EXPIRATION` to `SESSION_COOKIE_AGE`. * Changed the name of the session length setting from `AUTH_TOKEN_EXPIRATION` to `SESSION_COOKIE_AGE`.
* Changed the name of the session length setting from `AUTH_TOKEN_PER_USER` to `SESSIONS_PER_USER`. * Changed the name of the session length setting from `AUTH_TOKEN_PER_USER` to `SESSIONS_PER_USER`.
* External logging now defaults to HTTPS (instead of HTTP) *unless* http:// is explicitly specified in the log aggregator hostname [[#2048](https://github.com/ansible/awx/issues/2048)]
3.2.0 3.2.0
===== =====