#include <microhttpd.h>
+#ifdef HAVE_GNUTLS
+#include <gnutls/gnutls.h>
+#endif
+
#include "log.h"
#include "util.h"
#include "sd-journal.h"
#include "build.h"
#include "fileio.h"
+static char *key_pem = NULL;
+static char *cert_pem = NULL;
+static char *trust_pem = NULL;
+
typedef struct RequestMeta {
sd_journal *journal;
return sd_journal_open(&m->journal, SD_JOURNAL_LOCAL_ONLY|SD_JOURNAL_SYSTEM);
}
-static int respond_oom_internal(struct MHD_Connection *connection) {
- struct MHD_Response *response;
- const char m[] = "Out of memory.\n";
- int ret;
-
- assert(connection);
-
- response = MHD_create_response_from_buffer(sizeof(m)-1, (char*) m, MHD_RESPMEM_PERSISTENT);
- if (!response)
- return MHD_NO;
-
- MHD_add_response_header(response, "Content-Type", "text/plain");
- ret = MHD_queue_response(connection, MHD_HTTP_SERVICE_UNAVAILABLE, response);
- MHD_destroy_response(response);
-
- return ret;
-}
-
-#define respond_oom(connection) log_oom(), respond_oom_internal(connection)
-
-_printf_(3,4)
-static int respond_error(
- struct MHD_Connection *connection,
- unsigned code,
- const char *format, ...) {
-
- struct MHD_Response *response;
- char *m;
- int r;
- va_list ap;
-
- assert(connection);
- assert(format);
-
- va_start(ap, format);
- r = vasprintf(&m, format, ap);
- va_end(ap);
-
- if (r < 0)
- return respond_oom(connection);
-
- response = MHD_create_response_from_buffer(strlen(m), m, MHD_RESPMEM_MUST_FREE);
- if (!response) {
- free(m);
- return respond_oom(connection);
- }
-
- MHD_add_response_header(response, "Content-Type", "text/plain");
- r = MHD_queue_response(connection, code, response);
- MHD_destroy_response(response);
-
- return r;
-}
-
static ssize_t request_reader_entries(
void *cls,
uint64_t pos,
const char *upload_data,
size_t *upload_data_size,
void **connection_cls) {
+ int r, code;
assert(connection);
assert(connection_cls);
return MHD_YES;
}
+ if (trust_pem) {
+ r = check_permissions(connection, &code);
+ if (r < 0)
+ return code;
+ }
+
if (streq(url, "/"))
return request_handler_redirect(connection, "/browse");
return 0;
}
-static char *key_pem = NULL;
-static char *cert_pem = NULL;
-static char *trust_pem = NULL;
-
static int parse_argv(int argc, char *argv[]) {
enum {
ARG_VERSION = 0x100,
break;
case ARG_TRUST:
+#ifdef HAVE_GNUTLS
if (trust_pem) {
log_error("CA certificate file specified twice");
return -EINVAL;
}
assert(trust_pem);
break;
+#else
+ log_error("Option --trust is not available.");
+#endif
case '?':
return -EINVAL;
/***
This file is part of systemd.
+ Copyright 2012 Lennart Poettering
Copyright 2012 Zbigniew Jędrzejewski-Szmek
systemd is free software; you can redistribute it and/or modify it
#include <stddef.h>
#include <stdio.h>
+#include <string.h>
#include "microhttpd-util.h"
#include "log.h"
#include "macro.h"
#include "util.h"
+#ifdef HAVE_GNUTLS
+#include <gnutls/gnutls.h>
+#include <gnutls/x509.h>
+#endif
+
void microhttpd_logger(void *arg, const char *fmt, va_list ap) {
_cleanup_free_ char *f = NULL;
REENABLE_WARNING;
}
+
+int respond_oom_internal(struct MHD_Connection *connection) {
+ struct MHD_Response *response;
+ const char m[] = "Out of memory.\n";
+ int ret;
+
+ assert(connection);
+
+ response = MHD_create_response_from_buffer(sizeof(m)-1, (char*) m, MHD_RESPMEM_PERSISTENT);
+ if (!response)
+ return MHD_NO;
+
+ MHD_add_response_header(response, "Content-Type", "text/plain");
+ ret = MHD_queue_response(connection, MHD_HTTP_SERVICE_UNAVAILABLE, response);
+ MHD_destroy_response(response);
+
+ return ret;
+}
+
+_printf_(3,4)
+int respond_error(struct MHD_Connection *connection,
+ unsigned code,
+ const char *format, ...) {
+
+ struct MHD_Response *response;
+ char *m;
+ int r;
+ va_list ap;
+
+ assert(connection);
+ assert(format);
+
+ va_start(ap, format);
+ r = vasprintf(&m, format, ap);
+ va_end(ap);
+
+ if (r < 0)
+ return respond_oom(connection);
+
+ response = MHD_create_response_from_buffer(strlen(m), m, MHD_RESPMEM_MUST_FREE);
+ if (!response) {
+ free(m);
+ return respond_oom(connection);
+ }
+
+ log_debug("queing response %u: %s", code, m);
+ MHD_add_response_header(response, "Content-Type", "text/plain");
+ r = MHD_queue_response(connection, code, response);
+ MHD_destroy_response(response);
+
+ return r;
+}
+
#ifdef HAVE_GNUTLS
static int log_level_map[] = {
log_meta(ourlevel, NULL, 0, NULL, "gnutls: %s", message);
}
+static int verify_cert_authorized(gnutls_session_t session) {
+ unsigned status;
+ gnutls_certificate_type_t type;
+ gnutls_datum_t out;
+ int r;
+
+ r = gnutls_certificate_verify_peers2(session, &status);
+ if (r < 0) {
+ log_error("gnutls_certificate_verify_peers2 failed: %s", strerror(-r));
+ return r;
+ }
+
+ type = gnutls_certificate_type_get(session);
+ r = gnutls_certificate_verification_status_print(status, type, &out, 0);
+ if (r < 0) {
+ log_error("gnutls_certificate_verification_status_print failed: %s", strerror(-r));
+ return r;
+ }
+
+ log_info("Certificate status: %s", out.data);
+
+ return status == 0 ? 0 : -EPERM;
+}
+
+static int get_client_cert(gnutls_session_t session, gnutls_x509_crt_t *client_cert) {
+ const gnutls_datum_t *pcert;
+ unsigned listsize;
+ gnutls_x509_crt_t cert;
+ int r;
+
+ assert(session);
+ assert(client_cert);
+
+ pcert = gnutls_certificate_get_peers(session, &listsize);
+ if (!pcert || !listsize) {
+ log_error("Failed to retrieve certificate chain");
+ return -EINVAL;
+ }
+
+ r = gnutls_x509_crt_init(&cert);
+ if (r < 0) {
+ log_error("Failed to initialize client certificate");
+ return r;
+ }
+
+ /* Note that by passing values between 0 and listsize here, you
+ can get access to the CA's certs */
+ r = gnutls_x509_crt_import(cert, &pcert[0], GNUTLS_X509_FMT_DER);
+ if (r < 0) {
+ log_error("Failed to import client certificate");
+ gnutls_x509_crt_deinit(cert);
+ return r;
+ }
+
+ *client_cert = cert;
+ return 0;
+}
+
+static int get_auth_dn(gnutls_x509_crt_t client_cert, char **buf) {
+ size_t len = 0;
+ int r;
+
+ assert(buf);
+ assert(*buf == NULL);
+
+ r = gnutls_x509_crt_get_dn(client_cert, NULL, &len);
+ if (r != GNUTLS_E_SHORT_MEMORY_BUFFER) {
+ log_error("gnutls_x509_crt_get_dn failed");
+ return r;
+ }
+
+ *buf = malloc(len);
+ if (!*buf)
+ return log_oom();
+
+ gnutls_x509_crt_get_dn(client_cert, *buf, &len);
+ return 0;
+}
+
+int check_permissions(struct MHD_Connection *connection, int *code) {
+ const union MHD_ConnectionInfo *ci;
+ gnutls_session_t session;
+ gnutls_x509_crt_t client_cert;
+ char _cleanup_free_ *buf = NULL;
+ int r;
+
+ assert(connection);
+ assert(code);
+
+ *code = 0;
+
+ ci = MHD_get_connection_info(connection,
+ MHD_CONNECTION_INFO_GNUTLS_SESSION);
+ if (!ci) {
+ log_error("MHD_get_connection_info failed");
+ return -EINVAL;
+ }
+ session = ci->tls_session;
+ assert(session);
+
+ r = get_client_cert(session, &client_cert);
+ if (r < 0) {
+ *code = respond_error(connection, MHD_HTTP_UNAUTHORIZED,
+ "Authorization through certificate is required");
+ return -EPERM;
+ }
+
+ r = get_auth_dn(client_cert, &buf);
+ if (r < 0) {
+ *code = respond_error(connection, MHD_HTTP_UNAUTHORIZED,
+ "Failed to determine distinguished name from certificate");
+ return -EPERM;
+ }
+
+ log_info("Connection from %s", buf);
+
+ r = verify_cert_authorized(session);
+ if (r < 0) {
+ log_error("Client is not authorized");
+ *code = respond_error(connection, MHD_HTTP_UNAUTHORIZED,
+ "Client certificate not signed by recognized authority");
+ }
+ return r;
+}
+
+#else
+int check_permissions(struct MHD_Connection *connection, int *code) {
+ return -EPERM;
+}
#endif
~ianmdlvl / elogind.git / commitdiff