X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fjournal%2Fjournal-gatewayd.c;h=d47b27ef7fdbbcde15acff423c26690a0c40cee8;hp=b2d4abf4fee705a2757fbc7611ff6c17ccfe63e1;hb=fdfccdbc985944a57017a25f44dd6acc1a937bab;hpb=48383c251185c4596e9098878b28334c69e7bfd9 diff --git a/src/journal/journal-gatewayd.c b/src/journal/journal-gatewayd.c index b2d4abf4f..d47b27ef7 100644 --- a/src/journal/journal-gatewayd.c +++ b/src/journal/journal-gatewayd.c @@ -23,15 +23,28 @@ #include #include #include +#include #include +#ifdef HAVE_GNUTLS +#include +#endif + #include "log.h" #include "util.h" #include "sd-journal.h" #include "sd-daemon.h" +#include "sd-bus.h" +#include "bus-util.h" #include "logs-show.h" -#include "virt.h" +#include "microhttpd-util.h" +#include "build.h" +#include "fileio.h" + +static char *key_pem = NULL; +static char *cert_pem = NULL; +static char *trust_pem = NULL; typedef struct RequestMeta { sd_journal *journal; @@ -50,6 +63,9 @@ typedef struct RequestMeta { bool follow; bool discrete; + + uint64_t n_fields; + bool n_fields_set; } RequestMeta; static const char* const mime_types[_OUTPUT_MODE_MAX] = { @@ -62,6 +78,7 @@ static const char* const mime_types[_OUTPUT_MODE_MAX] = { static RequestMeta *request_meta(void **connection_cls) { RequestMeta *m; + assert(connection_cls); if (*connection_cls) return *connection_cls; @@ -100,59 +117,7 @@ static int open_journal(RequestMeta *m) { if (m->journal) return 0; - return sd_journal_open(&m->journal, SD_JOURNAL_LOCAL_ONLY|SD_JOURNAL_SYSTEM_ONLY); -} - - -static int respond_oom(struct MHD_Connection *connection) { - struct MHD_Response *response; - const char m[] = "Out of memory.\n"; - int ret; - - assert(connection); - - response = MHD_create_response_from_buffer(sizeof(m)-1, (char*) m, MHD_RESPMEM_PERSISTENT); - if (!response) - return MHD_NO; - - MHD_add_response_header(response, "Content-Type", "text/plain"); - ret = MHD_queue_response(connection, MHD_HTTP_SERVICE_UNAVAILABLE, response); - MHD_destroy_response(response); - - return ret; -} - -static int respond_error( - struct MHD_Connection *connection, - unsigned code, - const char *format, ...) { - - struct MHD_Response *response; - char *m; - int r; - va_list ap; - - assert(connection); - assert(format); - - va_start(ap, format); - r = vasprintf(&m, format, ap); - va_end(ap); - - if (r < 0) - return respond_oom(connection); - - response = MHD_create_response_from_buffer(strlen(m), m, MHD_RESPMEM_MUST_FREE); - if (!response) { - free(m); - return respond_oom(connection); - } - - MHD_add_response_header(response, "Content-Type", "text/plain"); - r = MHD_queue_response(connection, code, response); - MHD_destroy_response(response); - - return r; + return sd_journal_open(&m->journal, SD_JOURNAL_LOCAL_ONLY|SD_JOURNAL_SYSTEM); } static ssize_t request_reader_entries( @@ -234,11 +199,11 @@ static ssize_t request_reader_entries( m->tmp = tmpfile(); if (!m->tmp) { log_error("Failed to create temporary file: %m"); - return MHD_CONTENT_READER_END_WITH_ERROR;; + return MHD_CONTENT_READER_END_WITH_ERROR; } } - r = output_journal(m->tmp, m->journal, m->mode, 0, OUTPUT_FULL_WIDTH); + r = output_journal(m->tmp, m->journal, m->mode, 0, OUTPUT_FULL_WIDTH, NULL); if (r < 0) { log_error("Failed to serialize item: %s", strerror(-r)); return MHD_CONTENT_READER_END_WITH_ERROR; @@ -276,20 +241,20 @@ static int request_parse_accept( RequestMeta *m, struct MHD_Connection *connection) { - const char *accept; + const char *header; assert(m); assert(connection); - accept = MHD_lookup_connection_value(connection, MHD_HEADER_KIND, "Accept"); - if (!accept) + header = MHD_lookup_connection_value(connection, MHD_HEADER_KIND, "Accept"); + if (!header) return 0; - if (streq(accept, mime_types[OUTPUT_JSON])) + if (streq(header, mime_types[OUTPUT_JSON])) m->mode = OUTPUT_JSON; - else if (streq(accept, mime_types[OUTPUT_JSON_SSE])) + else if (streq(header, mime_types[OUTPUT_JSON_SSE])) m->mode = OUTPUT_JSON_SSE; - else if (streq(accept, mime_types[OUTPUT_EXPORT])) + else if (streq(header, mime_types[OUTPUT_EXPORT])) m->mode = OUTPUT_EXPORT; else m->mode = OUTPUT_SHORT; @@ -325,14 +290,13 @@ static int request_parse_range( colon2 = strchr(colon + 1, ':'); if (colon2) { - char *t; + _cleanup_free_ char *t; t = strndup(colon + 1, colon2 - colon - 1); if (!t) return -ENOMEM; r = safe_atoi64(t, &m->n_skip); - free(t); if (r < 0) return r; } @@ -413,6 +377,38 @@ static int request_parse_arguments_iterator( return MHD_YES; } + if (streq(key, "boot")) { + if (isempty(value)) + r = true; + else { + r = parse_boolean(value); + if (r < 0) { + m->argument_parse_error = r; + return MHD_NO; + } + } + + if (r) { + char match[9 + 32 + 1] = "_BOOT_ID="; + sd_id128_t bid; + + r = sd_id128_get_boot(&bid); + if (r < 0) { + log_error("Failed to get boot ID: %s", strerror(-r)); + return MHD_NO; + } + + sd_id128_to_string(bid, match + 9); + r = sd_journal_add_match(m->journal, match, sizeof(match)-1); + if (r < 0) { + m->argument_parse_error = r; + return MHD_NO; + } + } + + return MHD_YES; + } + p = strjoin(key, "=", strempty(value), NULL); if (!p) { m->argument_parse_error = log_oom(); @@ -443,18 +439,14 @@ static int request_parse_arguments( static int request_handler_entries( struct MHD_Connection *connection, - void **connection_cls) { + void *connection_cls) { struct MHD_Response *response; - RequestMeta *m; + RequestMeta *m = connection_cls; int r; assert(connection); - assert(connection_cls); - - m = request_meta(connection_cls); - if (!m) - return respond_oom(connection); + assert(m); r = open_journal(m); if (r < 0) @@ -498,6 +490,149 @@ static int request_handler_entries( return r; } +static int output_field(FILE *f, OutputMode m, const char *d, size_t l) { + const char *eq; + size_t j; + + eq = memchr(d, '=', l); + if (!eq) + return -EINVAL; + + j = l - (eq - d + 1); + + if (m == OUTPUT_JSON) { + fprintf(f, "{ \"%.*s\" : ", (int) (eq - d), d); + json_escape(f, eq+1, j, OUTPUT_FULL_WIDTH); + fputs(" }\n", f); + } else { + fwrite(eq+1, 1, j, f); + fputc('\n', f); + } + + return 0; +} + +static ssize_t request_reader_fields( + void *cls, + uint64_t pos, + char *buf, + size_t max) { + + RequestMeta *m = cls; + int r; + size_t n, k; + + assert(m); + assert(buf); + assert(max > 0); + assert(pos >= m->delta); + + pos -= m->delta; + + while (pos >= m->size) { + off_t sz; + const void *d; + size_t l; + + /* End of this field, so let's serialize the next + * one */ + + if (m->n_fields_set && + m->n_fields <= 0) + return MHD_CONTENT_READER_END_OF_STREAM; + + r = sd_journal_enumerate_unique(m->journal, &d, &l); + if (r < 0) { + log_error("Failed to advance field index: %s", strerror(-r)); + return MHD_CONTENT_READER_END_WITH_ERROR; + } else if (r == 0) + return MHD_CONTENT_READER_END_OF_STREAM; + + pos -= m->size; + m->delta += m->size; + + if (m->n_fields_set) + m->n_fields -= 1; + + if (m->tmp) + rewind(m->tmp); + else { + m->tmp = tmpfile(); + if (!m->tmp) { + log_error("Failed to create temporary file: %m"); + return MHD_CONTENT_READER_END_WITH_ERROR; + } + } + + r = output_field(m->tmp, m->mode, d, l); + if (r < 0) { + log_error("Failed to serialize item: %s", strerror(-r)); + return MHD_CONTENT_READER_END_WITH_ERROR; + } + + sz = ftello(m->tmp); + if (sz == (off_t) -1) { + log_error("Failed to retrieve file position: %m"); + return MHD_CONTENT_READER_END_WITH_ERROR; + } + + m->size = (uint64_t) sz; + } + + if (fseeko(m->tmp, pos, SEEK_SET) < 0) { + log_error("Failed to seek to position: %m"); + return MHD_CONTENT_READER_END_WITH_ERROR; + } + + n = m->size - pos; + if (n > max) + n = max; + + errno = 0; + k = fread(buf, 1, n, m->tmp); + if (k != n) { + log_error("Failed to read from file: %s", errno ? strerror(errno) : "Premature EOF"); + return MHD_CONTENT_READER_END_WITH_ERROR; + } + + return (ssize_t) k; +} + +static int request_handler_fields( + struct MHD_Connection *connection, + const char *field, + void *connection_cls) { + + struct MHD_Response *response; + RequestMeta *m = connection_cls; + int r; + + assert(connection); + assert(m); + + r = open_journal(m); + if (r < 0) + return respond_error(connection, MHD_HTTP_INTERNAL_SERVER_ERROR, "Failed to open journal: %s\n", strerror(-r)); + + if (request_parse_accept(m, connection) < 0) + return respond_error(connection, MHD_HTTP_BAD_REQUEST, "Failed to parse Accept header.\n"); + + r = sd_journal_query_unique(m->journal, field); + if (r < 0) + return respond_error(connection, MHD_HTTP_BAD_REQUEST, "Failed to query unique fields.\n"); + + response = MHD_create_response_from_callback(MHD_SIZE_UNKNOWN, 4*1024, request_reader_fields, m, NULL); + if (!response) + return respond_oom(connection); + + MHD_add_response_header(response, "Content-Type", mime_types[m->mode == OUTPUT_JSON ? OUTPUT_JSON : OUTPUT_SHORT]); + + r = MHD_queue_response(connection, MHD_HTTP_OK, response); + MHD_destroy_response(response); + + return r; +} + static int request_handler_redirect( struct MHD_Connection *connection, const char *target) { @@ -562,24 +697,51 @@ static int request_handler_file( return ret; } +static int get_virtualization(char **v) { + _cleanup_bus_unref_ sd_bus *bus = NULL; + char *b = NULL; + int r; + + r = sd_bus_default_system(&bus); + if (r < 0) + return r; + + r = sd_bus_get_property_string( + bus, + "org.freedesktop.systemd1", + "/org/freedesktop/systemd1", + "org.freedesktop.systemd1.Manager", + "Virtualization", + NULL, + &b); + if (r < 0) + return r; + + if (isempty(b)) { + free(b); + *v = NULL; + return 0; + } + + *v = b; + return 1; +} + static int request_handler_machine( struct MHD_Connection *connection, - void **connection_cls) { + void *connection_cls) { struct MHD_Response *response; - RequestMeta *m; + RequestMeta *m = connection_cls; int r; _cleanup_free_ char* hostname = NULL, *os_name = NULL; - uint64_t cutoff_from, cutoff_to, usage; + uint64_t cutoff_from = 0, cutoff_to = 0, usage; char *json; sd_id128_t mid, bid; - const char *v = "bare"; + _cleanup_free_ char *v = NULL; assert(connection); - - m = request_meta(connection_cls); - if (!m) - return respond_oom(connection); + assert(m); r = open_journal(m); if (r < 0) @@ -607,7 +769,7 @@ static int request_handler_machine( parse_env_file("/etc/os-release", NEWLINE, "PRETTY_NAME", &os_name, NULL); - detect_virtualization(&v); + get_virtualization(&v); r = asprintf(&json, "{ \"machine_id\" : \"" SD_ID128_FORMAT_STR "\"," @@ -615,17 +777,17 @@ static int request_handler_machine( "\"hostname\" : \"%s\"," "\"os_pretty_name\" : \"%s\"," "\"virtualization\" : \"%s\"," - "\"usage\" : \"%llu\"," - "\"cutoff_from_realtime\" : \"%llu\"," - "\"cutoff_to_realtime\" : \"%llu\" }\n", + "\"usage\" : \"%"PRIu64"\"," + "\"cutoff_from_realtime\" : \"%"PRIu64"\"," + "\"cutoff_to_realtime\" : \"%"PRIu64"\" }\n", SD_ID128_FORMAT_VAL(mid), SD_ID128_FORMAT_VAL(bid), - hostname_cleanup(hostname), + hostname_cleanup(hostname, false), os_name ? os_name : "Linux", - v, - (unsigned long long) usage, - (unsigned long long) cutoff_from, - (unsigned long long) cutoff_to); + v ? v : "bare", + usage, + cutoff_from, + cutoff_to); if (r < 0) return respond_oom(connection); @@ -652,42 +814,183 @@ static int request_handler( const char *upload_data, size_t *upload_data_size, void **connection_cls) { + int r, code; assert(connection); + assert(connection_cls); assert(url); assert(method); if (!streq(method, "GET")) - return MHD_NO; + return respond_error(connection, MHD_HTTP_METHOD_NOT_ACCEPTABLE, + "Unsupported method.\n"); + + + if (!*connection_cls) { + if (!request_meta(connection_cls)) + return respond_oom(connection); + return MHD_YES; + } + + if (trust_pem) { + r = check_permissions(connection, &code); + if (r < 0) + return code; + } if (streq(url, "/")) return request_handler_redirect(connection, "/browse"); if (streq(url, "/entries")) - return request_handler_entries(connection, connection_cls); + return request_handler_entries(connection, *connection_cls); + + if (startswith(url, "/fields/")) + return request_handler_fields(connection, url + 8, *connection_cls); if (streq(url, "/browse")) return request_handler_file(connection, DOCUMENT_ROOT "/browse.html", "text/html"); if (streq(url, "/machine")) - return request_handler_machine(connection, connection_cls); + return request_handler_machine(connection, *connection_cls); return respond_error(connection, MHD_HTTP_NOT_FOUND, "Not found.\n"); } -int main(int argc, char *argv[]) { - struct MHD_Daemon *daemon = NULL; - int r = EXIT_FAILURE, n; +static int help(void) { + + printf("%s [OPTIONS...] ...\n\n" + "HTTP server for journal events.\n\n" + " -h --help Show this help\n" + " --version Show package version\n" + " --cert=CERT.PEM Server certificate in PEM format\n" + " --key=KEY.PEM Server key in PEM format\n" + " --trust=CERT.PEM Certificat authority certificate in PEM format\n", + program_invocation_short_name); + + return 0; +} + +static int parse_argv(int argc, char *argv[]) { + enum { + ARG_VERSION = 0x100, + ARG_KEY, + ARG_CERT, + ARG_TRUST, + }; + + int r, c; + + static const struct option options[] = { + { "help", no_argument, NULL, 'h' }, + { "version", no_argument, NULL, ARG_VERSION }, + { "key", required_argument, NULL, ARG_KEY }, + { "cert", required_argument, NULL, ARG_CERT }, + { "trust", required_argument, NULL, ARG_TRUST }, + {} + }; + + assert(argc >= 0); + assert(argv); + + while ((c = getopt_long(argc, argv, "h", options, NULL)) >= 0) + + switch(c) { + + case 'h': + return help(); + + case ARG_VERSION: + puts(PACKAGE_STRING); + puts(SYSTEMD_FEATURES); + return 0; + + case ARG_KEY: + if (key_pem) { + log_error("Key file specified twice"); + return -EINVAL; + } + r = read_full_file(optarg, &key_pem, NULL); + if (r < 0) { + log_error("Failed to read key file: %s", strerror(-r)); + return r; + } + assert(key_pem); + break; - if (argc > 1) { + case ARG_CERT: + if (cert_pem) { + log_error("Certificate file specified twice"); + return -EINVAL; + } + r = read_full_file(optarg, &cert_pem, NULL); + if (r < 0) { + log_error("Failed to read certificate file: %s", strerror(-r)); + return r; + } + assert(cert_pem); + break; + + case ARG_TRUST: +#ifdef HAVE_GNUTLS + if (trust_pem) { + log_error("CA certificate file specified twice"); + return -EINVAL; + } + r = read_full_file(optarg, &trust_pem, NULL); + if (r < 0) { + log_error("Failed to read CA certificate file: %s", strerror(-r)); + return r; + } + assert(trust_pem); + break; +#else + log_error("Option --trust is not available."); +#endif + + case '?': + return -EINVAL; + + default: + assert_not_reached("Unhandled option"); + } + + if (optind < argc) { log_error("This program does not take arguments."); - goto finish; + return -EINVAL; + } + + if (!!key_pem != !!cert_pem) { + log_error("Certificate and key files must be specified together"); + return -EINVAL; + } + + if (trust_pem && !key_pem) { + log_error("CA certificate can only be used with certificate file"); + return -EINVAL; } + return 1; +} + +int main(int argc, char *argv[]) { + struct MHD_Daemon *d = NULL; + int r, n; + log_set_target(LOG_TARGET_AUTO); log_parse_environment(); log_open(); + r = parse_argv(argc, argv); + if (r < 0) + return EXIT_FAILURE; + if (r == 0) + return EXIT_SUCCESS; + +#ifdef HAVE_GNUTLS + gnutls_global_set_log_function(log_func_gnutls); + gnutls_global_set_log_level(GNUTLS_LOG_LEVEL); +#endif + n = sd_listen_fds(1); if (n < 0) { log_error("Failed to determine passed sockets: %s", strerror(-n)); @@ -695,26 +998,45 @@ int main(int argc, char *argv[]) { } else if (n > 1) { log_error("Can't listen on more than one socket."); goto finish; - } else if (n > 0) { - daemon = MHD_start_daemon( - MHD_USE_THREAD_PER_CONNECTION|MHD_USE_POLL|MHD_USE_DEBUG, - 19531, - NULL, NULL, - request_handler, NULL, - MHD_OPTION_LISTEN_SOCKET, SD_LISTEN_FDS_START, - MHD_OPTION_NOTIFY_COMPLETED, request_meta_free, NULL, - MHD_OPTION_END); } else { - daemon = MHD_start_daemon( - MHD_USE_DEBUG|MHD_USE_THREAD_PER_CONNECTION|MHD_USE_POLL, - 19531, - NULL, NULL, - request_handler, NULL, - MHD_OPTION_NOTIFY_COMPLETED, request_meta_free, NULL, - MHD_OPTION_END); + struct MHD_OptionItem opts[] = { + { MHD_OPTION_NOTIFY_COMPLETED, + (intptr_t) request_meta_free, NULL }, + { MHD_OPTION_EXTERNAL_LOGGER, + (intptr_t) microhttpd_logger, NULL }, + { MHD_OPTION_END, 0, NULL }, + { MHD_OPTION_END, 0, NULL }, + { MHD_OPTION_END, 0, NULL }, + { MHD_OPTION_END, 0, NULL }, + { MHD_OPTION_END, 0, NULL }}; + int opts_pos = 2; + int flags = MHD_USE_THREAD_PER_CONNECTION|MHD_USE_POLL|MHD_USE_DEBUG; + + if (n > 0) + opts[opts_pos++] = (struct MHD_OptionItem) + {MHD_OPTION_LISTEN_SOCKET, SD_LISTEN_FDS_START}; + if (key_pem) { + assert(cert_pem); + opts[opts_pos++] = (struct MHD_OptionItem) + {MHD_OPTION_HTTPS_MEM_KEY, 0, key_pem}; + opts[opts_pos++] = (struct MHD_OptionItem) + {MHD_OPTION_HTTPS_MEM_CERT, 0, cert_pem}; + flags |= MHD_USE_SSL; + } + if (trust_pem) { + assert(flags & MHD_USE_SSL); + opts[opts_pos++] = (struct MHD_OptionItem) + {MHD_OPTION_HTTPS_MEM_TRUST, 0, trust_pem}; + } + + d = MHD_start_daemon(flags, 19531, + NULL, NULL, + request_handler, NULL, + MHD_OPTION_ARRAY, opts, + MHD_OPTION_END); } - if (!daemon) { + if (!d) { log_error("Failed to start daemon!"); goto finish; } @@ -724,8 +1046,8 @@ int main(int argc, char *argv[]) { r = EXIT_SUCCESS; finish: - if (daemon) - MHD_stop_daemon(daemon); + if (d) + MHD_stop_daemon(d); return r; }