Class: Strelka::AuthProvider::HostAccess

Inherits:
Strelka::AuthProvider show all
Extended by:
Loggability
Includes:
Configurability, Constants, MethodUtilities
Defined in:
lib/strelka/authprovider/hostaccess.rb

Overview

HostAccess AuthProvider class -- restricts access to requests coming from a list of netblocks.

You can configure which ones from the auth section of the config:

auth:
allowed_netblocks:
- 127.0.0.0/8
- 10.5.3.0/22

Constant Summary collapse

DEFAULT_ALLOWED_NETBLOCKS =

The default list of netblocks to allow

%w[127.0.0.0/8]

Instance Attribute Summary collapse

Attributes inherited from Strelka::AuthProvider

#app

Instance Method Summary collapse

Methods included from MethodUtilities

#attr_predicate, #attr_predicate_accessor, #singleton_attr_accessor, #singleton_attr_reader, #singleton_attr_writer, #singleton_method_alias, #singleton_predicate_accessor, #singleton_predicate_reader

Methods inherited from Strelka::AuthProvider

#auth_succeeded, #authenticate

Methods included from Delegation

def_class_delegators, def_ivar_delegators, def_method_delegators

Methods included from Strelka::AbstractClass

extended, included, #inherited, #pure_virtual

Methods included from ResponseHelpers

finish_with

Constructor Details

#initialize ⇒ HostAccess

Create a new Default AuthProvider.



43
44
45
46
47
48
49
50
 
# File 'lib/strelka/authprovider/hostaccess.rb', line 43

def initialize( * )
	super

	self.allowed_netblocks = DEFAULT_ALLOWED_NETBLOCKS

	# Register this instance with Configurability
	config_key :hostaccess
end

Instance Attribute Details

#allowed_netblocks ⇒ Object

An Array of IPAddr objects that represent the netblocks that will be allowed access to the protected resources



59
60
61
 
# File 'lib/strelka/authprovider/hostaccess.rb', line 59

def allowed_netblocks
  @allowed_netblocks
end

Instance Method Details

#authorize(_, request, _) ⇒ Object

Check authorization for the specified request by testing its the IP in its X-forwarded-for header against the allowed_netblocks.



81
82
83
84
85
86
87
88
89
 
# File 'lib/strelka/authprovider/hostaccess.rb', line 81

def authorize( _, request, _ )
	client_ip = request.header.x_forwarded_for or
		raise "No X-Forwarded-For header?!"
	addr = IPAddr.new( client_ip )

	return true if self.in_allowed_netblocks?( addr )

	return false
end

#configure(config = nil) ⇒ Object

Configurability API -- configure the auth provider instance.



69
70
71
72
73
74
75
76
 
# File 'lib/strelka/authprovider/hostaccess.rb', line 69

def configure( config=nil )
	self.log.debug "Configuring %p with config: %p" % [ self, config ]
	if config && config['allowed_netblocks']
		self.allowed_netblocks = config['allowed_netblocks']
	else
		self.allowed_netblocks = DEFAULT_ALLOWED_NETBLOCKS
	end
end

#in_allowed_netblocks?(ipaddr) ⇒ Boolean

Returns true if the given ipaddr is in the #allowed_netblocks.

Returns:

  • (Boolean) 


93
94
95
 
# File 'lib/strelka/authprovider/hostaccess.rb', line 93

def in_allowed_netblocks?( ipaddr )
	return self.allowed_netblocks.any? {|nb| nb.include?(ipaddr) }
end