From: Zbigniew Jędrzejewski-Szmek Date: Sat, 1 Dec 2012 10:12:05 +0000 (+0100) Subject: journal-gatewayd: check if certificate is signed by CA X-Git-Tag: v212~139 X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=commitdiff_plain;h=f12be7e8ca278a5a207d0fd051acec700b804a7a;p=elogind.git journal-gatewayd: check if certificate is signed by CA If --trust=ca.crt is used, only clients presenting certificates signed by the ca will be allowed to proceed. No hostname matching is performed, so any client wielding a signed certificate will be authorized. Error functions are moved from journal-gateway to microhttp-util and made non-static, since now they are used in two source files. --- diff --git a/configure.ac b/configure.ac index 9e0739a6a..099fdac0d 100644 --- a/configure.ac +++ b/configure.ac @@ -712,7 +712,7 @@ AM_CONDITIONAL(HAVE_MICROHTTPD, [test "$have_microhttpd" = "yes"]) have_gnutls=no AC_ARG_ENABLE(gnutls, AS_HELP_STRING([--disable-gnutls], [disable gnutls support])) if test "x$enable_gnutls" != "xno"; then - PKG_CHECK_MODULES(GNUTLS, [gnutls], + PKG_CHECK_MODULES(GNUTLS, [gnutls >= 3.1.4], [AC_DEFINE(HAVE_GNUTLS, 1, [Define if gnutls is available]) have_gnutls=yes], have_gnutls=no) if test "x$have_gnutls" = xno -a "x$enable_gnutls" = xyes; then AC_MSG_ERROR([*** gnutls support requested but libraries not found]) diff --git a/src/journal/journal-gatewayd.c b/src/journal/journal-gatewayd.c index c9a243841..ac16a7cf2 100644 --- a/src/journal/journal-gatewayd.c +++ b/src/journal/journal-gatewayd.c @@ -27,6 +27,10 @@ #include +#ifdef HAVE_GNUTLS +#include +#endif + #include "log.h" #include "util.h" #include "sd-journal.h" @@ -38,6 +42,10 @@ #include "build.h" #include "fileio.h" +static char *key_pem = NULL; +static char *cert_pem = NULL; +static char *trust_pem = NULL; + typedef struct RequestMeta { sd_journal *journal; @@ -111,60 +119,6 @@ static int open_journal(RequestMeta *m) { return sd_journal_open(&m->journal, SD_JOURNAL_LOCAL_ONLY|SD_JOURNAL_SYSTEM); } -static int respond_oom_internal(struct MHD_Connection *connection) { - struct MHD_Response *response; - const char m[] = "Out of memory.\n"; - int ret; - - assert(connection); - - response = MHD_create_response_from_buffer(sizeof(m)-1, (char*) m, MHD_RESPMEM_PERSISTENT); - if (!response) - return MHD_NO; - - MHD_add_response_header(response, "Content-Type", "text/plain"); - ret = MHD_queue_response(connection, MHD_HTTP_SERVICE_UNAVAILABLE, response); - MHD_destroy_response(response); - - return ret; -} - -#define respond_oom(connection) log_oom(), respond_oom_internal(connection) - -_printf_(3,4) -static int respond_error( - struct MHD_Connection *connection, - unsigned code, - const char *format, ...) { - - struct MHD_Response *response; - char *m; - int r; - va_list ap; - - assert(connection); - assert(format); - - va_start(ap, format); - r = vasprintf(&m, format, ap); - va_end(ap); - - if (r < 0) - return respond_oom(connection); - - response = MHD_create_response_from_buffer(strlen(m), m, MHD_RESPMEM_MUST_FREE); - if (!response) { - free(m); - return respond_oom(connection); - } - - MHD_add_response_header(response, "Content-Type", "text/plain"); - r = MHD_queue_response(connection, code, response); - MHD_destroy_response(response); - - return r; -} - static ssize_t request_reader_entries( void *cls, uint64_t pos, @@ -859,6 +813,7 @@ static int request_handler( const char *upload_data, size_t *upload_data_size, void **connection_cls) { + int r, code; assert(connection); assert(connection_cls); @@ -876,6 +831,12 @@ static int request_handler( return MHD_YES; } + if (trust_pem) { + r = check_permissions(connection, &code); + if (r < 0) + return code; + } + if (streq(url, "/")) return request_handler_redirect(connection, "/browse"); @@ -908,10 +869,6 @@ static int help(void) { return 0; } -static char *key_pem = NULL; -static char *cert_pem = NULL; -static char *trust_pem = NULL; - static int parse_argv(int argc, char *argv[]) { enum { ARG_VERSION = 0x100, @@ -973,6 +930,7 @@ static int parse_argv(int argc, char *argv[]) { break; case ARG_TRUST: +#ifdef HAVE_GNUTLS if (trust_pem) { log_error("CA certificate file specified twice"); return -EINVAL; @@ -984,6 +942,9 @@ static int parse_argv(int argc, char *argv[]) { } assert(trust_pem); break; +#else + log_error("Option --trust is not available."); +#endif case '?': return -EINVAL; diff --git a/src/journal/microhttpd-util.c b/src/journal/microhttpd-util.c index b07ae6dff..17135abf8 100644 --- a/src/journal/microhttpd-util.c +++ b/src/journal/microhttpd-util.c @@ -3,6 +3,7 @@ /*** This file is part of systemd. + Copyright 2012 Lennart Poettering Copyright 2012 Zbigniew Jędrzejewski-Szmek systemd is free software; you can redistribute it and/or modify it @@ -21,12 +22,18 @@ #include #include +#include #include "microhttpd-util.h" #include "log.h" #include "macro.h" #include "util.h" +#ifdef HAVE_GNUTLS +#include +#include +#endif + void microhttpd_logger(void *arg, const char *fmt, va_list ap) { _cleanup_free_ char *f = NULL; @@ -40,6 +47,59 @@ void microhttpd_logger(void *arg, const char *fmt, va_list ap) { REENABLE_WARNING; } + +int respond_oom_internal(struct MHD_Connection *connection) { + struct MHD_Response *response; + const char m[] = "Out of memory.\n"; + int ret; + + assert(connection); + + response = MHD_create_response_from_buffer(sizeof(m)-1, (char*) m, MHD_RESPMEM_PERSISTENT); + if (!response) + return MHD_NO; + + MHD_add_response_header(response, "Content-Type", "text/plain"); + ret = MHD_queue_response(connection, MHD_HTTP_SERVICE_UNAVAILABLE, response); + MHD_destroy_response(response); + + return ret; +} + +_printf_(3,4) +int respond_error(struct MHD_Connection *connection, + unsigned code, + const char *format, ...) { + + struct MHD_Response *response; + char *m; + int r; + va_list ap; + + assert(connection); + assert(format); + + va_start(ap, format); + r = vasprintf(&m, format, ap); + va_end(ap); + + if (r < 0) + return respond_oom(connection); + + response = MHD_create_response_from_buffer(strlen(m), m, MHD_RESPMEM_MUST_FREE); + if (!response) { + free(m); + return respond_oom(connection); + } + + log_debug("queing response %u: %s", code, m); + MHD_add_response_header(response, "Content-Type", "text/plain"); + r = MHD_queue_response(connection, code, response); + MHD_destroy_response(response); + + return r; +} + #ifdef HAVE_GNUTLS static int log_level_map[] = { @@ -73,4 +133,133 @@ void log_func_gnutls(int level, const char *message) { log_meta(ourlevel, NULL, 0, NULL, "gnutls: %s", message); } +static int verify_cert_authorized(gnutls_session_t session) { + unsigned status; + gnutls_certificate_type_t type; + gnutls_datum_t out; + int r; + + r = gnutls_certificate_verify_peers2(session, &status); + if (r < 0) { + log_error("gnutls_certificate_verify_peers2 failed: %s", strerror(-r)); + return r; + } + + type = gnutls_certificate_type_get(session); + r = gnutls_certificate_verification_status_print(status, type, &out, 0); + if (r < 0) { + log_error("gnutls_certificate_verification_status_print failed: %s", strerror(-r)); + return r; + } + + log_info("Certificate status: %s", out.data); + + return status == 0 ? 0 : -EPERM; +} + +static int get_client_cert(gnutls_session_t session, gnutls_x509_crt_t *client_cert) { + const gnutls_datum_t *pcert; + unsigned listsize; + gnutls_x509_crt_t cert; + int r; + + assert(session); + assert(client_cert); + + pcert = gnutls_certificate_get_peers(session, &listsize); + if (!pcert || !listsize) { + log_error("Failed to retrieve certificate chain"); + return -EINVAL; + } + + r = gnutls_x509_crt_init(&cert); + if (r < 0) { + log_error("Failed to initialize client certificate"); + return r; + } + + /* Note that by passing values between 0 and listsize here, you + can get access to the CA's certs */ + r = gnutls_x509_crt_import(cert, &pcert[0], GNUTLS_X509_FMT_DER); + if (r < 0) { + log_error("Failed to import client certificate"); + gnutls_x509_crt_deinit(cert); + return r; + } + + *client_cert = cert; + return 0; +} + +static int get_auth_dn(gnutls_x509_crt_t client_cert, char **buf) { + size_t len = 0; + int r; + + assert(buf); + assert(*buf == NULL); + + r = gnutls_x509_crt_get_dn(client_cert, NULL, &len); + if (r != GNUTLS_E_SHORT_MEMORY_BUFFER) { + log_error("gnutls_x509_crt_get_dn failed"); + return r; + } + + *buf = malloc(len); + if (!*buf) + return log_oom(); + + gnutls_x509_crt_get_dn(client_cert, *buf, &len); + return 0; +} + +int check_permissions(struct MHD_Connection *connection, int *code) { + const union MHD_ConnectionInfo *ci; + gnutls_session_t session; + gnutls_x509_crt_t client_cert; + char _cleanup_free_ *buf = NULL; + int r; + + assert(connection); + assert(code); + + *code = 0; + + ci = MHD_get_connection_info(connection, + MHD_CONNECTION_INFO_GNUTLS_SESSION); + if (!ci) { + log_error("MHD_get_connection_info failed"); + return -EINVAL; + } + session = ci->tls_session; + assert(session); + + r = get_client_cert(session, &client_cert); + if (r < 0) { + *code = respond_error(connection, MHD_HTTP_UNAUTHORIZED, + "Authorization through certificate is required"); + return -EPERM; + } + + r = get_auth_dn(client_cert, &buf); + if (r < 0) { + *code = respond_error(connection, MHD_HTTP_UNAUTHORIZED, + "Failed to determine distinguished name from certificate"); + return -EPERM; + } + + log_info("Connection from %s", buf); + + r = verify_cert_authorized(session); + if (r < 0) { + log_error("Client is not authorized"); + *code = respond_error(connection, MHD_HTTP_UNAUTHORIZED, + "Client certificate not signed by recognized authority"); + } + return r; +} + +#else +int check_permissions(struct MHD_Connection *connection, int *code) { + return -EPERM; +} #endif diff --git a/src/journal/microhttpd-util.h b/src/journal/microhttpd-util.h index 4afe0a29d..cd14ac4dc 100644 --- a/src/journal/microhttpd-util.h +++ b/src/journal/microhttpd-util.h @@ -22,14 +22,24 @@ #pragma once #include +#include #include "macro.h" void microhttpd_logger(void *arg, const char *fmt, va_list ap) _printf_(2, 0); -#ifdef HAVE_GNUTLS -#include +int respond_oom_internal(struct MHD_Connection *connection); + +/* respond_oom() must be usable with return, hence this form. */ +#define respond_oom(connection) log_oom(), respond_oom_internal(connection) + +int respond_error(struct MHD_Connection *connection, + unsigned code, + const char *format, ...); +int check_permissions(struct MHD_Connection *connection, int *code); + +#ifdef HAVE_GNUTLS void log_func_gnutls(int level, const char *message); /* This is additionally filtered by our internal log level, so it