#NEWLINE# @ wsgify #NEWLINE# def __call__( self , req ) : #NEWLINE# #INDENT# if ( not self . allow_full_urls ) : #NEWLINE# #INDENT# sync_to = req . headers . get ( 'x-container-sync-to' ) #NEWLINE# if ( sync_to and ( not sync_to . startswith ( '//' ) ) ) : #NEWLINE# #INDENT# raise HTTPBadRequest ( body = 'Full URLs are not allowed for X-Container-Sync-To values. Only realm values of the format //realm/cluster/account/container are allowed.\n' , request = req ) #NEWLINE# #UNINDENT# #UNINDENT# auth = req . headers . get ( 'x-container-sync-auth' ) #NEWLINE# if auth : #NEWLINE# #INDENT# valid = False #NEWLINE# auth = auth . split ( ) #NEWLINE# if ( len ( auth ) != 3 ) : #NEWLINE# #INDENT# req . environ . setdefault ( 'swift.log_info' , [ ] ) . append ( 'cs:not-3-args' ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# ( realm , nonce , sig ) = auth #NEWLINE# realm_key = self . realms_conf . key ( realm ) #NEWLINE# realm_key2 = self . realms_conf . key2 ( realm ) #NEWLINE# if ( not realm_key ) : #NEWLINE# #INDENT# req . environ . setdefault ( 'swift.log_info' , [ ] ) . append ( 'cs:no-local-realm-key' ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# info = get_container_info ( nonce . environ , self . app , swift_source = 'CS' ) #NEWLINE# user_key = info . get ( 'sync_key' ) #NEWLINE# if ( not user_key ) : #NEWLINE# #INDENT# req . environ . setdefault ( 'swift.log_info' , [ ] ) . append ( 'cs:no-local-user-key' ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( 'x-backend-inbound-x-timestamp' in req . headers ) : #NEWLINE# #INDENT# req . headers [ 'x-timestamp' ] = req . headers . pop ( 'x-backend-inbound-x-timestamp' ) #NEWLINE# #UNINDENT# expected = self . realms_conf . get_sig ( req . method , req . path , req . headers . get ( 'x-timestamp' , '0' ) , nonce , realm_key , user_key ) #NEWLINE# expected2 = ( self . realms_conf . get_sig ( req . method , req . path , req . headers . get ( 'x-timestamp' , '0' ) , nonce , realm_key2 , user_key ) if realm_key2 else expected ) #NEWLINE# if ( ( not streq_const_time ( sig , expected ) ) and ( not streq_const_time ( sig , expected2 ) ) ) : #NEWLINE# #INDENT# req . environ . setdefault ( 'swift.log_info' , [ ] ) . append ( 'cs:invalid-sig' ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# req . environ . setdefault ( 'swift.log_info' , [ ] ) . append ( 'cs:valid' ) #NEWLINE# valid = True #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# #UNINDENT# if ( not valid ) : #NEWLINE# #INDENT# exc = HTTPUnauthorized ( body = 'X-Container-Sync-Auth header not valid; contact cluster operator for support.' , headers = { #NEWLINE# #INDENT# 'content-type' : 'text/plain' , #NEWLINE# #UNINDENT# } , request = req ) #NEWLINE# exc . headers [ 'www-authenticate' ] = ' ' . join ( [ 'SwiftContainerSync' , exc . www_authenticate ( ) . split ( None , 1 ) [ 1 ] ] ) #NEWLINE# raise exc #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# req . environ [ 'swift.authorize_override' ] = True #NEWLINE# #UNINDENT# #UNINDENT# if ( req . path == '/info' ) : #NEWLINE# #INDENT# self . register_info ( ) #NEWLINE# #UNINDENT# return self . app