Merge lp:~gesha/linaro-license-protection/add-exception-hosts into lp:~linaro-automation/linaro-license-protection/trunk

[Georgy Redkozubov]

This branch add hosts that are always allowed to get through the click-through license protection and lost wsgi.py

[James Tunnicliffe (dooferlad)]

Please add a unit test for get_client_ip. I assume you can just push some fake headers through it to make sure that the machines in INTERNAL_HOSTS get through and others don't.

review: Needs Fixing

[lp:~gesha/linaro-license-protection/add-exception-hosts]

91. By Georgy Redkozubov on 2012-07-27

Added tests for hosts exception.

[Georgy Redkozubov (gesha)]

I've added tests for hosts exception.

[lp:~gesha/linaro-license-protection/add-exception-hosts]

92. By Georgy Redkozubov on 2012-07-31

Use internal_host from config file to pass tests even if IP address of the internal host changes.

[James Tunnicliffe (dooferlad)]

Thanks. Looks good now.

review: Approve

=== added file 'license_protected_downloads/config.py'
--- license_protected_downloads/config.py	1970-01-01 00:00:00 +0000
+++ license_protected_downloads/config.py	2012-07-31 10:21:20 +0000
@@ -0,0 +1,7 @@
+# Configuration file for linaro-license-protection
+
+# Let internal hosts through always.
+INTERNAL_HOSTS = (
+    '50.17.250.69',  # android-build.linaro.org
+    '82.69.11.23',  # validation.linaro.org
+)

=== modified file 'license_protected_downloads/tests/test_views.py'
--- license_protected_downloads/tests/test_views.py	2012-07-27 18:57:32 +0000
+++ license_protected_downloads/tests/test_views.py	2012-07-31 10:21:20 +0000
@@ -9,6 +9,7 @@
 
 from license_protected_downloads.buildinfo import BuildInfo
 from license_protected_downloads.views import _insert_license_into_db
+from license_protected_downloads.config import INTERNAL_HOSTS
 
 THIS_DIRECTORY = os.path.dirname(os.path.abspath(__file__))
 TESTSERVER_ROOT = os.path.join(THIS_DIRECTORY, "testserver_root")
@@ -332,6 +333,7 @@
         file_path = os.path.join(TESTSERVER_ROOT, target_file)
         self.assertEqual(response['X-Sendfile'], file_path)
 
+<<<<<<< TREE
     def test_header_html(self):
         target_file = "~linaro-android"
         url = urlparse.urljoin("http://testserver/", target_file)
@@ -340,5 +342,51 @@
         self.assertContains(response,
             r"Welcome to the Linaro releases server")
 
+=======
+    def test_exception_ip_x_forwarded_for(self):
+        internal_host = INTERNAL_HOSTS[0]
+        target_file = 'build-info/origen-blob.txt'
+        url = urlparse.urljoin("http://testserver/", target_file)
+        response = self.client.get(url, follow=True,
+            HTTP_X_FORWARDED_FOR=internal_host)
+
+        # If we have access to the file, we will get an X-Sendfile response
+        self.assertEqual(response.status_code, 200)
+        file_path = os.path.join(TESTSERVER_ROOT, target_file)
+        self.assertEqual(response['X-Sendfile'], file_path)
+
+    def test_exception_ip_remote_addr(self):
+        internal_host = INTERNAL_HOSTS[0]
+        target_file = 'build-info/origen-blob.txt'
+        url = urlparse.urljoin("http://testserver/", target_file)
+        response = self.client.get(url, follow=True,
+            REMOTE_ADDR=internal_host)
+
+        # If we have access to the file, we will get an X-Sendfile response
+        self.assertEqual(response.status_code, 200)
+        file_path = os.path.join(TESTSERVER_ROOT, target_file)
+        self.assertEqual(response['X-Sendfile'], file_path)
+
+    def test_no_exception_ip(self):
+        internal_host = '10.1.2.3'
+        target_file = 'build-info/origen-blob.txt'
+        file_path = os.path.join(TESTSERVER_ROOT, target_file)
+        build_info = BuildInfo(file_path)
+
+        # Try to fetch file from server - we should be redirected
+        url = urlparse.urljoin("http://testserver/", target_file)
+        response = self.client.get(url, follow=True,
+            REMOTE_ADDR=internal_host)
+        digest = hashlib.md5(build_info.get("license-text")).hexdigest()
+        self.assertRedirects(response, '/license?lic=%s&url=%s' %
+                                       (digest, target_file))
+
+        # Make sure that we get the license text in the license page
+        self.assertContains(response, build_info.get("license-text"))
+
+        # Test that we use the "samsung" theme. This contains exynos.png
+        self.assertContains(response, "exynos.png")
+
+>>>>>>> MERGE-SOURCE
 if __name__ == '__main__':
     unittest.main()

=== modified file 'license_protected_downloads/views.py'
--- license_protected_downloads/views.py	2012-07-27 18:57:32 +0000
+++ license_protected_downloads/views.py	2012-07-31 10:21:20 +0000
@@ -21,7 +21,11 @@
 from buildinfo import BuildInfo
 from models import License
 from openid_auth import OpenIDAuth
+<<<<<<< TREE
 from BeautifulSoup import BeautifulSoup
+=======
+import config
+>>>>>>> MERGE-SOURCE
 
 
 def _hidden_file(file_name):
@@ -188,6 +192,15 @@
     return digests
 
 
+def get_client_ip(request):
+    x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
+    if x_forwarded_for:
+        ip = x_forwarded_for.split(',')[-1].strip()
+    else:
+        ip = request.META.get('REMOTE_ADDR')
+    return ip
+
+
 def license_accepted(request, digest):
     return 'license_accepted_' + digest in request.COOKIES
 
@@ -268,7 +281,10 @@
     file_name = os.path.basename(path)
 
     response = None
-    digests = is_protected(path)
+    if get_client_ip(request) in config.INTERNAL_HOSTS:
+        digests = 'OPEN'
+    else:
+        digests = is_protected(path)
     if not digests:
         # File has no license text but is protected
         response = HttpResponseForbidden(

=== added file 'license_protected_downloads/wsgi.py'
--- license_protected_downloads/wsgi.py	1970-01-01 00:00:00 +0000
+++ license_protected_downloads/wsgi.py	2012-07-31 10:21:20 +0000
@@ -0,0 +1,41 @@
+"""
+WSGI config for license_protected_downloads project.
+
+This module contains the WSGI application used by Django's development server
+and any production WSGI deployments. It should expose a module-level variable
+named ``application``. Django's ``runserver`` and ``runfcgi`` commands discover
+this application via the ``WSGI_APPLICATION`` setting.
+
+Usually you will have the standard Django WSGI application here, but it also
+might make sense to replace the whole Django WSGI application with a custom one
+that later delegates to the Django one. For example, you could introduce WSGI
+middleware here, or combine a Django application with an application of another
+framework.
+
+"""
+import os
+import sys
+sys.path.append("/usr/lib/python2.7/dist-packages")
+sys.path.append("/usr/lib/pymodules/python2.7")
+sys.path.append("/usr/lib/python2.7")
+
+# NOTE: Set actual path to directory containing linaro-license-protection app
+#sys.path.append("linaro-license-protection")
+
+os.environ.setdefault(
+    "DJANGO_SETTINGS_MODULE",
+    "linaro-license-protection.settings"
+)
+
+# This application object is used by any WSGI server configured to use this
+# file. This includes Django's development server, if the WSGI_APPLICATION
+# setting points here.
+#from django.core.wsgi import get_wsgi_application
+#application = get_wsgi_application()
+
+import django.core.handlers.wsgi
+application = django.core.handlers.wsgi.WSGIHandler()
+
+# Apply WSGI middleware here.
+# from helloworld.wsgi import HelloWorldApplication
+# application = HelloWorldApplication(application)