On Mon, 20 Jun 2011 16:15:45 +0200, Csányi Krisztián wrote:
On Mon, 20 Jun 2011 16:05:28 +0200, Balazs Scheidler wrote:
On Wed, 2011-06-15 at 15:48 +0200, Csányi Krisztián wrote:
Sziasztok!
Egy Zorp 3.3-mon működő megoldást szeretnék 3.9-re átültetni. Röviden így néz ki:
Service('outside_HTTPS_wildcard.xyz.hu', HttpsPublicWildcardXyz, chainer=SideStackChainer(right_class=HttpPublicDirector, right_chainer=ConnectChainer(protocol=ZD_PROTO_AUTO)), router=TransparentRouter(forge_addr=TRUE)) Dispatcher(DBSockAddr(SockAddrInet('__IP_OUTSIDE', 50443, ZD_PROTO_TCP), 'outside_HTTPS_wildcard.xyz.hu', transparent=TRUE)
A HttpsPublicWildcardXyz egy sima PsslProxy aminek van egy self.client_cert_file és client_key_file megadva. (wildcardos)
A HttpPublicDirector pedig egy sima HttpProxy, ahol self.request_url_host alapján döntünk, hogy melyik szervernek dobódjon át a forgalom.
A kérdésem, hogy mi a fentieknek az elegáns megoldása 3.9 alatt? (Tekintettel arra, hogy már minden proxy támogat SSL-t) A fenti megoldás már nem működik 3.9-en.
be tudnad dobni a proxy class-t is? Persze:
########################### class PublicHttpProxyBase(HttpProxy): def config(self): HttpProxy.config(self) self.request['GET'] = (HTTP_REQ_POLICY, self.filterURL) self.request['POST'] = (HTTP_REQ_POLICY, self.filterURL) self.request['HEAD'] = (HTTP_REQ_POLICY, self.filterURL)
self.response['*', '401'] = (HTTP_RSP_ACCEPT) self.response['*', '4'] = (HTTP_RSP_POLICY, self.filterError) self.response['*', '5'] = (HTTP_RSP_POLICY, self.filterError)
self.response_headers['Server'] = (HTTP_HDR_DROP) self.response_headers['X-Powered-By'] = (HTTP_HDR_DROP) self.response_headers['X-AspNet-Version'] = (HTTP_HDR_DROP)
self.error_silent = TRUE
self.transparent_mode = TRUE self.permit_proxy_requests = FALSE
def filterURL(self, method, url, version): log('http.info', 3, "%s: %s" % (method, url)) return HTTP_REQ_ACCEPT
def filterError(self, method, url, version, response): self.error_status = 404 self.error_msg = 'not found' return HTTP_RSP_DENY
########################### class HttpPublicDirector(PublicHttpProxyBase): def config(self): PublicHttpProxyBase.config(self)
def filterURL(self, method, url, version): if self.request_url_host == 'a.xyz.hu':
self.session.setServer(SockAddrInet('192.168.168.100', 80)) elif self.request_url_host == 'b.xyz.hu':
self.session.setServer(SockAddrInet('192.168.168.25', 80)) elif self.request_url_host == 'c.xyz.hu':
self.session.setServer(SockAddrInet('192.168.169.10', 80)) elif self.request_url_host == '192.168.169.10':
self.session.setServer(SockAddrInet('192.168.169.10', 80)) else: log('http.info', 3, "Public http access denied: %s: %s" % (method, url)) return HTTP_REQ_ABORT
log('http.info', 3, "%s: %s" % (method, url)) return HTTP_REQ_ACCEPT
def __destroy__(self): log(self.session.session_id, CORE_DEBUG, 3, "Accounting data: client_address='%s', server_address='%s', client_stream_recvd='%s', client_stream_sent='%s'", (self.session.client_address, self.session.server_address,
self.session.client_stream.bytes_recvd,self.session.client_stream.bytes_sent)) PublicHttpProxyBase.__destroy__(self)
########################### class HttpsPublicWildcardXyz(PsslProxy): def config(self): PsslProxy.config(self)
self.client_cert_file = "/etc/zorp/certs/wildcard.xyz.hu-cert.pem" self.client_key_file = "/etc/zorp/certs/wildcard.xyz.hu-key.pem" _______________________________________________ zorp-hu mailing list zorp-hu@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp-hu
Még csak annyi, hogy amikor 3.9-en próbálkoztam a fentiekkel, akkor az alábbi logot kaptam: Jun 16 16:59:00 svc0 zorp/iPublic[3148]: core.session(3): (svc/outside_HTTPS_wildcard.xyz.hu:27): Starting proxy instance; client_fd='15', client_address='AF_INET(84.206.45.43:56118)', client_zone='Zone(outside, 0.0.0.0/0)', client_local='AF_INET(192.168.169.10:443)', client_protocol='TCP' Jun 16 16:59:00 svc0 zorp/iPublic[3148]: core.error(1): (svc/outside_HTTPS_wildcard.xyz.hu:27/plug): SSL handshake failed; side='client', error='error:140890C7:SSL routines:lib(20):SSL3_GET_CLIENT_CERTIFICATE:func(137):peer did not return a certificate:reason(199), supressed 1 messages' Jun 16 16:59:00 svc0 zorp/iPublic[3148]: core.session(4): (svc/outside_HTTPS_wildcard.xyz.hu:27): Ending proxy instance;