mirror of
https://github.com/systemd/systemd.git
synced 2024-10-27 10:25:37 +03:00
journal-gatewayd: check if certificate is signed by CA
If --trust=ca.crt is used, only clients presenting certificates signed by the ca will be allowed to proceed. No hostname matching is performed, so any client wielding a signed certificate will be authorized. Error functions are moved from journal-gateway to microhttp-util and made non-static, since now they are used in two source files.
This commit is contained in:
parent
cafc7f9130
commit
f12be7e8ca
@ -712,7 +712,7 @@ AM_CONDITIONAL(HAVE_MICROHTTPD, [test "$have_microhttpd" = "yes"])
|
|||||||
have_gnutls=no
|
have_gnutls=no
|
||||||
AC_ARG_ENABLE(gnutls, AS_HELP_STRING([--disable-gnutls], [disable gnutls support]))
|
AC_ARG_ENABLE(gnutls, AS_HELP_STRING([--disable-gnutls], [disable gnutls support]))
|
||||||
if test "x$enable_gnutls" != "xno"; then
|
if test "x$enable_gnutls" != "xno"; then
|
||||||
PKG_CHECK_MODULES(GNUTLS, [gnutls],
|
PKG_CHECK_MODULES(GNUTLS, [gnutls >= 3.1.4],
|
||||||
[AC_DEFINE(HAVE_GNUTLS, 1, [Define if gnutls is available]) have_gnutls=yes], have_gnutls=no)
|
[AC_DEFINE(HAVE_GNUTLS, 1, [Define if gnutls is available]) have_gnutls=yes], have_gnutls=no)
|
||||||
if test "x$have_gnutls" = xno -a "x$enable_gnutls" = xyes; then
|
if test "x$have_gnutls" = xno -a "x$enable_gnutls" = xyes; then
|
||||||
AC_MSG_ERROR([*** gnutls support requested but libraries not found])
|
AC_MSG_ERROR([*** gnutls support requested but libraries not found])
|
||||||
|
@ -27,6 +27,10 @@
|
|||||||
|
|
||||||
#include <microhttpd.h>
|
#include <microhttpd.h>
|
||||||
|
|
||||||
|
#ifdef HAVE_GNUTLS
|
||||||
|
#include <gnutls/gnutls.h>
|
||||||
|
#endif
|
||||||
|
|
||||||
#include "log.h"
|
#include "log.h"
|
||||||
#include "util.h"
|
#include "util.h"
|
||||||
#include "sd-journal.h"
|
#include "sd-journal.h"
|
||||||
@ -38,6 +42,10 @@
|
|||||||
#include "build.h"
|
#include "build.h"
|
||||||
#include "fileio.h"
|
#include "fileio.h"
|
||||||
|
|
||||||
|
static char *key_pem = NULL;
|
||||||
|
static char *cert_pem = NULL;
|
||||||
|
static char *trust_pem = NULL;
|
||||||
|
|
||||||
typedef struct RequestMeta {
|
typedef struct RequestMeta {
|
||||||
sd_journal *journal;
|
sd_journal *journal;
|
||||||
|
|
||||||
@ -111,60 +119,6 @@ static int open_journal(RequestMeta *m) {
|
|||||||
return sd_journal_open(&m->journal, SD_JOURNAL_LOCAL_ONLY|SD_JOURNAL_SYSTEM);
|
return sd_journal_open(&m->journal, SD_JOURNAL_LOCAL_ONLY|SD_JOURNAL_SYSTEM);
|
||||||
}
|
}
|
||||||
|
|
||||||
static int respond_oom_internal(struct MHD_Connection *connection) {
|
|
||||||
struct MHD_Response *response;
|
|
||||||
const char m[] = "Out of memory.\n";
|
|
||||||
int ret;
|
|
||||||
|
|
||||||
assert(connection);
|
|
||||||
|
|
||||||
response = MHD_create_response_from_buffer(sizeof(m)-1, (char*) m, MHD_RESPMEM_PERSISTENT);
|
|
||||||
if (!response)
|
|
||||||
return MHD_NO;
|
|
||||||
|
|
||||||
MHD_add_response_header(response, "Content-Type", "text/plain");
|
|
||||||
ret = MHD_queue_response(connection, MHD_HTTP_SERVICE_UNAVAILABLE, response);
|
|
||||||
MHD_destroy_response(response);
|
|
||||||
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
#define respond_oom(connection) log_oom(), respond_oom_internal(connection)
|
|
||||||
|
|
||||||
_printf_(3,4)
|
|
||||||
static int respond_error(
|
|
||||||
struct MHD_Connection *connection,
|
|
||||||
unsigned code,
|
|
||||||
const char *format, ...) {
|
|
||||||
|
|
||||||
struct MHD_Response *response;
|
|
||||||
char *m;
|
|
||||||
int r;
|
|
||||||
va_list ap;
|
|
||||||
|
|
||||||
assert(connection);
|
|
||||||
assert(format);
|
|
||||||
|
|
||||||
va_start(ap, format);
|
|
||||||
r = vasprintf(&m, format, ap);
|
|
||||||
va_end(ap);
|
|
||||||
|
|
||||||
if (r < 0)
|
|
||||||
return respond_oom(connection);
|
|
||||||
|
|
||||||
response = MHD_create_response_from_buffer(strlen(m), m, MHD_RESPMEM_MUST_FREE);
|
|
||||||
if (!response) {
|
|
||||||
free(m);
|
|
||||||
return respond_oom(connection);
|
|
||||||
}
|
|
||||||
|
|
||||||
MHD_add_response_header(response, "Content-Type", "text/plain");
|
|
||||||
r = MHD_queue_response(connection, code, response);
|
|
||||||
MHD_destroy_response(response);
|
|
||||||
|
|
||||||
return r;
|
|
||||||
}
|
|
||||||
|
|
||||||
static ssize_t request_reader_entries(
|
static ssize_t request_reader_entries(
|
||||||
void *cls,
|
void *cls,
|
||||||
uint64_t pos,
|
uint64_t pos,
|
||||||
@ -859,6 +813,7 @@ static int request_handler(
|
|||||||
const char *upload_data,
|
const char *upload_data,
|
||||||
size_t *upload_data_size,
|
size_t *upload_data_size,
|
||||||
void **connection_cls) {
|
void **connection_cls) {
|
||||||
|
int r, code;
|
||||||
|
|
||||||
assert(connection);
|
assert(connection);
|
||||||
assert(connection_cls);
|
assert(connection_cls);
|
||||||
@ -876,6 +831,12 @@ static int request_handler(
|
|||||||
return MHD_YES;
|
return MHD_YES;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (trust_pem) {
|
||||||
|
r = check_permissions(connection, &code);
|
||||||
|
if (r < 0)
|
||||||
|
return code;
|
||||||
|
}
|
||||||
|
|
||||||
if (streq(url, "/"))
|
if (streq(url, "/"))
|
||||||
return request_handler_redirect(connection, "/browse");
|
return request_handler_redirect(connection, "/browse");
|
||||||
|
|
||||||
@ -908,10 +869,6 @@ static int help(void) {
|
|||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
static char *key_pem = NULL;
|
|
||||||
static char *cert_pem = NULL;
|
|
||||||
static char *trust_pem = NULL;
|
|
||||||
|
|
||||||
static int parse_argv(int argc, char *argv[]) {
|
static int parse_argv(int argc, char *argv[]) {
|
||||||
enum {
|
enum {
|
||||||
ARG_VERSION = 0x100,
|
ARG_VERSION = 0x100,
|
||||||
@ -973,6 +930,7 @@ static int parse_argv(int argc, char *argv[]) {
|
|||||||
break;
|
break;
|
||||||
|
|
||||||
case ARG_TRUST:
|
case ARG_TRUST:
|
||||||
|
#ifdef HAVE_GNUTLS
|
||||||
if (trust_pem) {
|
if (trust_pem) {
|
||||||
log_error("CA certificate file specified twice");
|
log_error("CA certificate file specified twice");
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
@ -984,6 +942,9 @@ static int parse_argv(int argc, char *argv[]) {
|
|||||||
}
|
}
|
||||||
assert(trust_pem);
|
assert(trust_pem);
|
||||||
break;
|
break;
|
||||||
|
#else
|
||||||
|
log_error("Option --trust is not available.");
|
||||||
|
#endif
|
||||||
|
|
||||||
case '?':
|
case '?':
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
@ -3,6 +3,7 @@
|
|||||||
/***
|
/***
|
||||||
This file is part of systemd.
|
This file is part of systemd.
|
||||||
|
|
||||||
|
Copyright 2012 Lennart Poettering
|
||||||
Copyright 2012 Zbigniew Jędrzejewski-Szmek
|
Copyright 2012 Zbigniew Jędrzejewski-Szmek
|
||||||
|
|
||||||
systemd is free software; you can redistribute it and/or modify it
|
systemd is free software; you can redistribute it and/or modify it
|
||||||
@ -21,12 +22,18 @@
|
|||||||
|
|
||||||
#include <stddef.h>
|
#include <stddef.h>
|
||||||
#include <stdio.h>
|
#include <stdio.h>
|
||||||
|
#include <string.h>
|
||||||
|
|
||||||
#include "microhttpd-util.h"
|
#include "microhttpd-util.h"
|
||||||
#include "log.h"
|
#include "log.h"
|
||||||
#include "macro.h"
|
#include "macro.h"
|
||||||
#include "util.h"
|
#include "util.h"
|
||||||
|
|
||||||
|
#ifdef HAVE_GNUTLS
|
||||||
|
#include <gnutls/gnutls.h>
|
||||||
|
#include <gnutls/x509.h>
|
||||||
|
#endif
|
||||||
|
|
||||||
void microhttpd_logger(void *arg, const char *fmt, va_list ap) {
|
void microhttpd_logger(void *arg, const char *fmt, va_list ap) {
|
||||||
_cleanup_free_ char *f = NULL;
|
_cleanup_free_ char *f = NULL;
|
||||||
|
|
||||||
@ -40,6 +47,59 @@ void microhttpd_logger(void *arg, const char *fmt, va_list ap) {
|
|||||||
REENABLE_WARNING;
|
REENABLE_WARNING;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
int respond_oom_internal(struct MHD_Connection *connection) {
|
||||||
|
struct MHD_Response *response;
|
||||||
|
const char m[] = "Out of memory.\n";
|
||||||
|
int ret;
|
||||||
|
|
||||||
|
assert(connection);
|
||||||
|
|
||||||
|
response = MHD_create_response_from_buffer(sizeof(m)-1, (char*) m, MHD_RESPMEM_PERSISTENT);
|
||||||
|
if (!response)
|
||||||
|
return MHD_NO;
|
||||||
|
|
||||||
|
MHD_add_response_header(response, "Content-Type", "text/plain");
|
||||||
|
ret = MHD_queue_response(connection, MHD_HTTP_SERVICE_UNAVAILABLE, response);
|
||||||
|
MHD_destroy_response(response);
|
||||||
|
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
|
_printf_(3,4)
|
||||||
|
int respond_error(struct MHD_Connection *connection,
|
||||||
|
unsigned code,
|
||||||
|
const char *format, ...) {
|
||||||
|
|
||||||
|
struct MHD_Response *response;
|
||||||
|
char *m;
|
||||||
|
int r;
|
||||||
|
va_list ap;
|
||||||
|
|
||||||
|
assert(connection);
|
||||||
|
assert(format);
|
||||||
|
|
||||||
|
va_start(ap, format);
|
||||||
|
r = vasprintf(&m, format, ap);
|
||||||
|
va_end(ap);
|
||||||
|
|
||||||
|
if (r < 0)
|
||||||
|
return respond_oom(connection);
|
||||||
|
|
||||||
|
response = MHD_create_response_from_buffer(strlen(m), m, MHD_RESPMEM_MUST_FREE);
|
||||||
|
if (!response) {
|
||||||
|
free(m);
|
||||||
|
return respond_oom(connection);
|
||||||
|
}
|
||||||
|
|
||||||
|
log_debug("queing response %u: %s", code, m);
|
||||||
|
MHD_add_response_header(response, "Content-Type", "text/plain");
|
||||||
|
r = MHD_queue_response(connection, code, response);
|
||||||
|
MHD_destroy_response(response);
|
||||||
|
|
||||||
|
return r;
|
||||||
|
}
|
||||||
|
|
||||||
#ifdef HAVE_GNUTLS
|
#ifdef HAVE_GNUTLS
|
||||||
|
|
||||||
static int log_level_map[] = {
|
static int log_level_map[] = {
|
||||||
@ -73,4 +133,133 @@ void log_func_gnutls(int level, const char *message) {
|
|||||||
log_meta(ourlevel, NULL, 0, NULL, "gnutls: %s", message);
|
log_meta(ourlevel, NULL, 0, NULL, "gnutls: %s", message);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static int verify_cert_authorized(gnutls_session_t session) {
|
||||||
|
unsigned status;
|
||||||
|
gnutls_certificate_type_t type;
|
||||||
|
gnutls_datum_t out;
|
||||||
|
int r;
|
||||||
|
|
||||||
|
r = gnutls_certificate_verify_peers2(session, &status);
|
||||||
|
if (r < 0) {
|
||||||
|
log_error("gnutls_certificate_verify_peers2 failed: %s", strerror(-r));
|
||||||
|
return r;
|
||||||
|
}
|
||||||
|
|
||||||
|
type = gnutls_certificate_type_get(session);
|
||||||
|
r = gnutls_certificate_verification_status_print(status, type, &out, 0);
|
||||||
|
if (r < 0) {
|
||||||
|
log_error("gnutls_certificate_verification_status_print failed: %s", strerror(-r));
|
||||||
|
return r;
|
||||||
|
}
|
||||||
|
|
||||||
|
log_info("Certificate status: %s", out.data);
|
||||||
|
|
||||||
|
return status == 0 ? 0 : -EPERM;
|
||||||
|
}
|
||||||
|
|
||||||
|
static int get_client_cert(gnutls_session_t session, gnutls_x509_crt_t *client_cert) {
|
||||||
|
const gnutls_datum_t *pcert;
|
||||||
|
unsigned listsize;
|
||||||
|
gnutls_x509_crt_t cert;
|
||||||
|
int r;
|
||||||
|
|
||||||
|
assert(session);
|
||||||
|
assert(client_cert);
|
||||||
|
|
||||||
|
pcert = gnutls_certificate_get_peers(session, &listsize);
|
||||||
|
if (!pcert || !listsize) {
|
||||||
|
log_error("Failed to retrieve certificate chain");
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
|
r = gnutls_x509_crt_init(&cert);
|
||||||
|
if (r < 0) {
|
||||||
|
log_error("Failed to initialize client certificate");
|
||||||
|
return r;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Note that by passing values between 0 and listsize here, you
|
||||||
|
can get access to the CA's certs */
|
||||||
|
r = gnutls_x509_crt_import(cert, &pcert[0], GNUTLS_X509_FMT_DER);
|
||||||
|
if (r < 0) {
|
||||||
|
log_error("Failed to import client certificate");
|
||||||
|
gnutls_x509_crt_deinit(cert);
|
||||||
|
return r;
|
||||||
|
}
|
||||||
|
|
||||||
|
*client_cert = cert;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
static int get_auth_dn(gnutls_x509_crt_t client_cert, char **buf) {
|
||||||
|
size_t len = 0;
|
||||||
|
int r;
|
||||||
|
|
||||||
|
assert(buf);
|
||||||
|
assert(*buf == NULL);
|
||||||
|
|
||||||
|
r = gnutls_x509_crt_get_dn(client_cert, NULL, &len);
|
||||||
|
if (r != GNUTLS_E_SHORT_MEMORY_BUFFER) {
|
||||||
|
log_error("gnutls_x509_crt_get_dn failed");
|
||||||
|
return r;
|
||||||
|
}
|
||||||
|
|
||||||
|
*buf = malloc(len);
|
||||||
|
if (!*buf)
|
||||||
|
return log_oom();
|
||||||
|
|
||||||
|
gnutls_x509_crt_get_dn(client_cert, *buf, &len);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int check_permissions(struct MHD_Connection *connection, int *code) {
|
||||||
|
const union MHD_ConnectionInfo *ci;
|
||||||
|
gnutls_session_t session;
|
||||||
|
gnutls_x509_crt_t client_cert;
|
||||||
|
char _cleanup_free_ *buf = NULL;
|
||||||
|
int r;
|
||||||
|
|
||||||
|
assert(connection);
|
||||||
|
assert(code);
|
||||||
|
|
||||||
|
*code = 0;
|
||||||
|
|
||||||
|
ci = MHD_get_connection_info(connection,
|
||||||
|
MHD_CONNECTION_INFO_GNUTLS_SESSION);
|
||||||
|
if (!ci) {
|
||||||
|
log_error("MHD_get_connection_info failed");
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
session = ci->tls_session;
|
||||||
|
assert(session);
|
||||||
|
|
||||||
|
r = get_client_cert(session, &client_cert);
|
||||||
|
if (r < 0) {
|
||||||
|
*code = respond_error(connection, MHD_HTTP_UNAUTHORIZED,
|
||||||
|
"Authorization through certificate is required");
|
||||||
|
return -EPERM;
|
||||||
|
}
|
||||||
|
|
||||||
|
r = get_auth_dn(client_cert, &buf);
|
||||||
|
if (r < 0) {
|
||||||
|
*code = respond_error(connection, MHD_HTTP_UNAUTHORIZED,
|
||||||
|
"Failed to determine distinguished name from certificate");
|
||||||
|
return -EPERM;
|
||||||
|
}
|
||||||
|
|
||||||
|
log_info("Connection from %s", buf);
|
||||||
|
|
||||||
|
r = verify_cert_authorized(session);
|
||||||
|
if (r < 0) {
|
||||||
|
log_error("Client is not authorized");
|
||||||
|
*code = respond_error(connection, MHD_HTTP_UNAUTHORIZED,
|
||||||
|
"Client certificate not signed by recognized authority");
|
||||||
|
}
|
||||||
|
return r;
|
||||||
|
}
|
||||||
|
|
||||||
|
#else
|
||||||
|
int check_permissions(struct MHD_Connection *connection, int *code) {
|
||||||
|
return -EPERM;
|
||||||
|
}
|
||||||
#endif
|
#endif
|
||||||
|
@ -22,14 +22,24 @@
|
|||||||
#pragma once
|
#pragma once
|
||||||
|
|
||||||
#include <stdarg.h>
|
#include <stdarg.h>
|
||||||
|
#include <microhttpd.h>
|
||||||
|
|
||||||
#include "macro.h"
|
#include "macro.h"
|
||||||
|
|
||||||
void microhttpd_logger(void *arg, const char *fmt, va_list ap) _printf_(2, 0);
|
void microhttpd_logger(void *arg, const char *fmt, va_list ap) _printf_(2, 0);
|
||||||
|
|
||||||
#ifdef HAVE_GNUTLS
|
int respond_oom_internal(struct MHD_Connection *connection);
|
||||||
#include <gnutls/gnutls.h>
|
|
||||||
|
|
||||||
|
/* respond_oom() must be usable with return, hence this form. */
|
||||||
|
#define respond_oom(connection) log_oom(), respond_oom_internal(connection)
|
||||||
|
|
||||||
|
int respond_error(struct MHD_Connection *connection,
|
||||||
|
unsigned code,
|
||||||
|
const char *format, ...);
|
||||||
|
|
||||||
|
int check_permissions(struct MHD_Connection *connection, int *code);
|
||||||
|
|
||||||
|
#ifdef HAVE_GNUTLS
|
||||||
void log_func_gnutls(int level, const char *message);
|
void log_func_gnutls(int level, const char *message);
|
||||||
|
|
||||||
/* This is additionally filtered by our internal log level, so it
|
/* This is additionally filtered by our internal log level, so it
|
||||||
|
Loading…
Reference in New Issue
Block a user