X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fjournal%2Fjournal-gatewayd.c;h=d47b27ef7fdbbcde15acff423c26690a0c40cee8;hp=c51afbfeb985fab6fa70704c5036d28b16d202c3;hb=fdfccdbc985944a57017a25f44dd6acc1a937bab;hpb=47c649b5de480b832bb11e0d52ba58d962d61fb2 diff --git a/src/journal/journal-gatewayd.c b/src/journal/journal-gatewayd.c index c51afbfeb..d47b27ef7 100644 --- a/src/journal/journal-gatewayd.c +++ b/src/journal/journal-gatewayd.c @@ -27,6 +27,10 @@ #include +#ifdef HAVE_GNUTLS +#include +#endif + #include "log.h" #include "util.h" #include "sd-journal.h" @@ -38,6 +42,10 @@ #include "build.h" #include "fileio.h" +static char *key_pem = NULL; +static char *cert_pem = NULL; +static char *trust_pem = NULL; + typedef struct RequestMeta { sd_journal *journal; @@ -70,6 +78,7 @@ static const char* const mime_types[_OUTPUT_MODE_MAX] = { static RequestMeta *request_meta(void **connection_cls) { RequestMeta *m; + assert(connection_cls); if (*connection_cls) return *connection_cls; @@ -111,59 +120,6 @@ static int open_journal(RequestMeta *m) { return sd_journal_open(&m->journal, SD_JOURNAL_LOCAL_ONLY|SD_JOURNAL_SYSTEM); } -static int respond_oom_internal(struct MHD_Connection *connection) { - struct MHD_Response *response; - const char m[] = "Out of memory.\n"; - int ret; - - assert(connection); - - response = MHD_create_response_from_buffer(sizeof(m)-1, (char*) m, MHD_RESPMEM_PERSISTENT); - if (!response) - return MHD_NO; - - MHD_add_response_header(response, "Content-Type", "text/plain"); - ret = MHD_queue_response(connection, MHD_HTTP_SERVICE_UNAVAILABLE, response); - MHD_destroy_response(response); - - return ret; -} - -#define respond_oom(connection) log_oom(), respond_oom_internal(connection) - -static int respond_error( - struct MHD_Connection *connection, - unsigned code, - const char *format, ...) { - - struct MHD_Response *response; - char *m; - int r; - va_list ap; - - assert(connection); - assert(format); - - va_start(ap, format); - r = vasprintf(&m, format, ap); - va_end(ap); - - if (r < 0) - return respond_oom(connection); - - response = MHD_create_response_from_buffer(strlen(m), m, MHD_RESPMEM_MUST_FREE); - if (!response) { - free(m); - return respond_oom(connection); - } - - MHD_add_response_header(response, "Content-Type", "text/plain"); - r = MHD_queue_response(connection, code, response); - MHD_destroy_response(response); - - return r; -} - static ssize_t request_reader_entries( void *cls, uint64_t pos, @@ -743,10 +699,10 @@ static int request_handler_file( static int get_virtualization(char **v) { _cleanup_bus_unref_ sd_bus *bus = NULL; - char *b; + char *b = NULL; int r; - r = sd_bus_open_system(&bus); + r = sd_bus_default_system(&bus); if (r < 0) return r; @@ -779,7 +735,7 @@ static int request_handler_machine( RequestMeta *m = connection_cls; int r; _cleanup_free_ char* hostname = NULL, *os_name = NULL; - uint64_t cutoff_from, cutoff_to, usage; + uint64_t cutoff_from = 0, cutoff_to = 0, usage; char *json; sd_id128_t mid, bid; _cleanup_free_ char *v = NULL; @@ -858,6 +814,7 @@ static int request_handler( const char *upload_data, size_t *upload_data_size, void **connection_cls) { + int r, code; assert(connection); assert(connection_cls); @@ -875,6 +832,12 @@ static int request_handler( return MHD_YES; } + if (trust_pem) { + r = check_permissions(connection, &code); + if (r < 0) + return code; + } + if (streq(url, "/")) return request_handler_redirect(connection, "/browse"); @@ -899,21 +862,20 @@ static int help(void) { "HTTP server for journal events.\n\n" " -h --help Show this help\n" " --version Show package version\n" - " --cert=CERT.PEM Specify server certificate in PEM format\n" - " --key=KEY.PEM Specify server key in PEM format\n", + " --cert=CERT.PEM Server certificate in PEM format\n" + " --key=KEY.PEM Server key in PEM format\n" + " --trust=CERT.PEM Certificat authority certificate in PEM format\n", program_invocation_short_name); return 0; } -static char *key_pem = NULL; -static char *cert_pem = NULL; - static int parse_argv(int argc, char *argv[]) { enum { ARG_VERSION = 0x100, ARG_KEY, ARG_CERT, + ARG_TRUST, }; int r, c; @@ -923,6 +885,7 @@ static int parse_argv(int argc, char *argv[]) { { "version", no_argument, NULL, ARG_VERSION }, { "key", required_argument, NULL, ARG_KEY }, { "cert", required_argument, NULL, ARG_CERT }, + { "trust", required_argument, NULL, ARG_TRUST }, {} }; @@ -967,6 +930,23 @@ static int parse_argv(int argc, char *argv[]) { assert(cert_pem); break; + case ARG_TRUST: +#ifdef HAVE_GNUTLS + if (trust_pem) { + log_error("CA certificate file specified twice"); + return -EINVAL; + } + r = read_full_file(optarg, &trust_pem, NULL); + if (r < 0) { + log_error("Failed to read CA certificate file: %s", strerror(-r)); + return r; + } + assert(trust_pem); + break; +#else + log_error("Option --trust is not available."); +#endif + case '?': return -EINVAL; @@ -984,6 +964,11 @@ static int parse_argv(int argc, char *argv[]) { return -EINVAL; } + if (trust_pem && !key_pem) { + log_error("CA certificate can only be used with certificate file"); + return -EINVAL; + } + return 1; } @@ -1001,6 +986,11 @@ int main(int argc, char *argv[]) { if (r == 0) return EXIT_SUCCESS; +#ifdef HAVE_GNUTLS + gnutls_global_set_log_function(log_func_gnutls); + gnutls_global_set_log_level(GNUTLS_LOG_LEVEL); +#endif + n = sd_listen_fds(1); if (n < 0) { log_error("Failed to determine passed sockets: %s", strerror(-n)); @@ -1017,6 +1007,7 @@ int main(int argc, char *argv[]) { { MHD_OPTION_END, 0, NULL }, { MHD_OPTION_END, 0, NULL }, { MHD_OPTION_END, 0, NULL }, + { MHD_OPTION_END, 0, NULL }, { MHD_OPTION_END, 0, NULL }}; int opts_pos = 2; int flags = MHD_USE_THREAD_PER_CONNECTION|MHD_USE_POLL|MHD_USE_DEBUG; @@ -1032,6 +1023,11 @@ int main(int argc, char *argv[]) { {MHD_OPTION_HTTPS_MEM_CERT, 0, cert_pem}; flags |= MHD_USE_SSL; } + if (trust_pem) { + assert(flags & MHD_USE_SSL); + opts[opts_pos++] = (struct MHD_OptionItem) + {MHD_OPTION_HTTPS_MEM_TRUST, 0, trust_pem}; + } d = MHD_start_daemon(flags, 19531, NULL, NULL,