redhat-cop / openshift-applier

Used to apply OpenShift objects to an OpenShift Cluster
Apache License 2.0
102 stars 61 forks source link

Make sure openshift-applier supports running from behind proxies #86

Open InfoSec812 opened 5 years ago

InfoSec812 commented 5 years ago

The typical method of using SOCKS proxies in Linux is to set http(s)_proxy environment variables using a protocol prefix of socks5://. The python urllib library cannot handle SOCKS proxies in that manner and you cannot simply use http:// with a SOCKS proxy.

>>> urllib.urlopen(path)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python2.7/urllib.py", line 87, in urlopen
    return opener.open(url)
  File "/usr/lib/python2.7/urllib.py", line 208, in open
    return self.open_unknown_proxy(proxy, fullurl, data)
  File "/usr/lib/python2.7/urllib.py", line 227, in open_unknown_proxy
    raise IOError, ('url error', 'invalid proxy for %s' % type, proxy)
IOError: [Errno url error] invalid proxy for https: 'socks5://localhost:4567'

We will need to import a SOCKS library and add logic to detect when a SOCKS proxy protocol prefix is in use in order to configure urllib to use that proxy.

InfoSec812 commented 5 years ago

As a workaround for those impacted by this issue. You can use SSHuttle as a "poor man's VPN" and openshift-applier will work. My SSHuttle command looks like:

sshuttle -r infosec812@FQDN:2222 -D --dns 192.168.0.0/24
oybed commented 5 years ago

This issue should be looked at broadly to ensure the openshift-applier can work behind proxies in general. The information above is a good example of a scenario that should work, but there are most likely other scenarios as well that needs to be covered.