|
| 1 | +# |
| 2 | +# Copyright © 2011-2026 Splunk, Inc. |
| 3 | +# |
| 4 | +# Licensed under the Apache License, Version 2.0 (the "License"): you may |
| 5 | +# not use this file except in compliance with the License. You may obtain |
| 6 | +# a copy of the License at |
| 7 | +# |
| 8 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +# |
| 10 | +# Unless required by applicable law or agreed to in writing, software |
| 11 | +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 12 | +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the |
| 13 | +# License for the specific language governing permissions and limitations |
| 14 | +# under the License. |
| 15 | + |
| 16 | +import asyncio |
| 17 | +import base64 |
| 18 | +import traceback |
| 19 | +from abc import abstractmethod |
| 20 | +from http.cookies import SimpleCookie |
| 21 | + |
| 22 | +from splunklib.binding import _spliturl |
| 23 | +from splunklib.client import Service, connect |
| 24 | + |
| 25 | +try: |
| 26 | + import splunk |
| 27 | + |
| 28 | + class CRETestHandler(splunk.rest.BaseRestHandler): |
| 29 | + _service: Service | None = None |
| 30 | + |
| 31 | + def handle_POST(self) -> None: |
| 32 | + async def run() -> None: |
| 33 | + try: |
| 34 | + await self.run() |
| 35 | + except Exception: |
| 36 | + trace = traceback.format_exc() |
| 37 | + self.response.setStatus(500) |
| 38 | + self.response.write(trace) |
| 39 | + return |
| 40 | + |
| 41 | + self.response.setStatus(200) |
| 42 | + |
| 43 | + asyncio.run(run()) |
| 44 | + |
| 45 | + @abstractmethod |
| 46 | + async def run(self) -> None: ... |
| 47 | + |
| 48 | + @property |
| 49 | + def service(self) -> Service: |
| 50 | + if self._service is not None: |
| 51 | + return self._service |
| 52 | + |
| 53 | + mngmt_url: str = splunk.getLocalServerInfo() |
| 54 | + scheme, host, port, path = _spliturl(mngmt_url) |
| 55 | + |
| 56 | + headers = self.request["headers"] |
| 57 | + |
| 58 | + cookies: str | None = headers.get("cookie") |
| 59 | + authorizaiton: str | None = headers.get("authorization") |
| 60 | + |
| 61 | + if cookies is not None: |
| 62 | + c = SimpleCookie() |
| 63 | + c.load(cookies) |
| 64 | + cookie_token = c.get("splunkd_8089") |
| 65 | + if cookie_token is not None: |
| 66 | + service = connect( |
| 67 | + scheme=scheme, |
| 68 | + host=host, |
| 69 | + port=port, |
| 70 | + path=path, |
| 71 | + autologin=True, |
| 72 | + cookie=f"splunkd_8089: {cookie_token}", |
| 73 | + ) |
| 74 | + |
| 75 | + # Make sure splunk connection works. |
| 76 | + assert service.info.startup_time |
| 77 | + |
| 78 | + self._service = service |
| 79 | + return service |
| 80 | + |
| 81 | + if authorizaiton is not None: |
| 82 | + authType, token = authorizaiton.split(" ", 1) |
| 83 | + if authType.lower() == "bearer" or authType.lower() == "splunk": |
| 84 | + service = connect( |
| 85 | + scheme=scheme, |
| 86 | + host=host, |
| 87 | + port=port, |
| 88 | + path=path, |
| 89 | + autologin=True, |
| 90 | + token=token, |
| 91 | + ) |
| 92 | + |
| 93 | + # Make sure splunk connection works. |
| 94 | + assert service.info.startup_time |
| 95 | + |
| 96 | + self._service = service |
| 97 | + return service |
| 98 | + elif authType.lower() == "basic": |
| 99 | + decoded_bytes = base64.b64decode(token) |
| 100 | + username, password = decoded_bytes.decode("utf-8").split(":", 1) |
| 101 | + service = connect( |
| 102 | + scheme=scheme, |
| 103 | + host=host, |
| 104 | + port=port, |
| 105 | + path=path, |
| 106 | + autologin=True, |
| 107 | + username=username, |
| 108 | + password=password, |
| 109 | + ) |
| 110 | + |
| 111 | + # Make sure splunk connection works. |
| 112 | + assert service.info.startup_time |
| 113 | + |
| 114 | + self._service = service |
| 115 | + return service |
| 116 | + |
| 117 | + # We should not reach here, since Splunk requires that the request is authenticated. |
| 118 | + raise Exception("Missing auth") |
| 119 | +except ImportError as e: |
| 120 | + # The "splunk" package is only available on the Splunk instances, as it is only shipped |
| 121 | + # with the default splunk python interpreter. We can't use it reliabely if used outside of |
| 122 | + # splunk, in such cases, we don't expose the wrapped class. |
| 123 | + if e.name != "splunk": |
| 124 | + raise |
0 commit comments