journal-gatewayd: check if certificate is signed by CA

If --trust=ca.crt is used, only clients presenting certificates signed
by the ca will be allowed to proceed. No hostname matching is
performed, so any client wielding a signed certificate will be
authorized.

Error functions are moved from journal-gateway to microhttp-util and
made non-static, since now they are used in two source files.

3 files changed, 220 insertions, 60 deletions

diff --git a/src/journal/journal-gatewayd.c b/src/journal/journal-gatewayd.c
index c9a243841d..ac16a7cf26 100644
--- a/src/journal/journal-gatewayd.c
+++ b/src/journal/journal-gatewayd.c
@@ -27,6 +27,10 @@
 
 #include <microhttpd.h>
 
+#ifdef HAVE_GNUTLS
+#include <gnutls/gnutls.h>
+#endif
+
 #include "log.h"
 #include "util.h"
 #include "sd-journal.h"
@@ -38,6 +42,10 @@
 #include "build.h"
 #include "fileio.h"
 
+static char *key_pem = NULL;
+static char *cert_pem = NULL;
+static char *trust_pem = NULL;
+
 typedef struct RequestMeta {
         sd_journal *journal;
 
@@ -111,60 +119,6 @@ static int open_journal(RequestMeta *m) {
         return sd_journal_open(&m->journal, SD_JOURNAL_LOCAL_ONLY|SD_JOURNAL_SYSTEM);
 }
 
-static int respond_oom_internal(struct MHD_Connection *connection) {
-        struct MHD_Response *response;
-        const char m[] = "Out of memory.\n";
-        int ret;
-
-        assert(connection);
-
-        response = MHD_create_response_from_buffer(sizeof(m)-1, (char*) m, MHD_RESPMEM_PERSISTENT);
-        if (!response)
-                return MHD_NO;
-
-        MHD_add_response_header(response, "Content-Type", "text/plain");
-        ret = MHD_queue_response(connection, MHD_HTTP_SERVICE_UNAVAILABLE, response);
-        MHD_destroy_response(response);
-
-        return ret;
-}
-
-#define respond_oom(connection) log_oom(), respond_oom_internal(connection)
-
-_printf_(3,4)
-static int respond_error(
-                struct MHD_Connection *connection,
-                unsigned code,
-                const char *format, ...) {
-
-        struct MHD_Response *response;
-        char *m;
-        int r;
-        va_list ap;
-
-        assert(connection);
-        assert(format);
-
-        va_start(ap, format);
-        r = vasprintf(&m, format, ap);
-        va_end(ap);
-
-        if (r < 0)
-                return respond_oom(connection);
-
-        response = MHD_create_response_from_buffer(strlen(m), m, MHD_RESPMEM_MUST_FREE);
-        if (!response) {
-                free(m);
-                return respond_oom(connection);
-        }
-
-        MHD_add_response_header(response, "Content-Type", "text/plain");
-        r = MHD_queue_response(connection, code, response);
-        MHD_destroy_response(response);
-
-        return r;
-}
-
 static ssize_t request_reader_entries(
                 void *cls,
                 uint64_t pos,
@@ -859,6 +813,7 @@ static int request_handler(
                 const char *upload_data,
                 size_t *upload_data_size,
                 void **connection_cls) {
+        int r, code;
 
         assert(connection);
         assert(connection_cls);
@@ -876,6 +831,12 @@ static int request_handler(
                 return MHD_YES;
         }
 
+        if (trust_pem) {
+                r = check_permissions(connection, &code);
+                if (r < 0)
+                        return code;
+        }
+
         if (streq(url, "/"))
                 return request_handler_redirect(connection, "/browse");
 
@@ -908,10 +869,6 @@ static int help(void) {
         return 0;
 }
 
-static char *key_pem = NULL;
-static char *cert_pem = NULL;
-static char *trust_pem = NULL;
-
 static int parse_argv(int argc, char *argv[]) {
         enum {
                 ARG_VERSION = 0x100,
@@ -973,6 +930,7 @@ static int parse_argv(int argc, char *argv[]) {
                         break;
 
                 case ARG_TRUST:
+#ifdef HAVE_GNUTLS
                         if (trust_pem) {
                                 log_error("CA certificate file specified twice");
                                 return -EINVAL;
@@ -984,6 +942,9 @@ static int parse_argv(int argc, char *argv[]) {
                         }
                         assert(trust_pem);
                         break;
+#else
+                        log_error("Option --trust is not available.");
+#endif
 
                 case '?':
                         return -EINVAL;
diff --git a/src/journal/microhttpd-util.c b/src/journal/microhttpd-util.c
index b07ae6dff3..17135abf8b 100644
--- a/src/journal/microhttpd-util.c
+++ b/src/journal/microhttpd-util.c
@@ -3,6 +3,7 @@
 /***
   This file is part of systemd.
 
+  Copyright 2012 Lennart Poettering
   Copyright 2012 Zbigniew Jędrzejewski-Szmek
 
   systemd is free software; you can redistribute it and/or modify it
@@ -21,12 +22,18 @@
 
 #include <stddef.h>
 #include <stdio.h>
+#include <string.h>
 
 #include "microhttpd-util.h"
 #include "log.h"
 #include "macro.h"
 #include "util.h"
 
+#ifdef HAVE_GNUTLS
+#include <gnutls/gnutls.h>
+#include <gnutls/x509.h>
+#endif
+
 void microhttpd_logger(void *arg, const char *fmt, va_list ap) {
         _cleanup_free_ char *f = NULL;
 
@@ -40,6 +47,59 @@ void microhttpd_logger(void *arg, const char *fmt, va_list ap) {
         REENABLE_WARNING;
 }
 
+
+int respond_oom_internal(struct MHD_Connection *connection) {
+        struct MHD_Response *response;
+        const char m[] = "Out of memory.\n";
+        int ret;
+
+        assert(connection);
+
+        response = MHD_create_response_from_buffer(sizeof(m)-1, (char*) m, MHD_RESPMEM_PERSISTENT);
+        if (!response)
+                return MHD_NO;
+
+        MHD_add_response_header(response, "Content-Type", "text/plain");
+        ret = MHD_queue_response(connection, MHD_HTTP_SERVICE_UNAVAILABLE, response);
+        MHD_destroy_response(response);
+
+        return ret;
+}
+
+_printf_(3,4)
+int respond_error(struct MHD_Connection *connection,
+                  unsigned code,
+                  const char *format, ...) {
+
+        struct MHD_Response *response;
+        char *m;
+        int r;
+        va_list ap;
+
+        assert(connection);
+        assert(format);
+
+        va_start(ap, format);
+        r = vasprintf(&m, format, ap);
+        va_end(ap);
+
+        if (r < 0)
+                return respond_oom(connection);
+
+        response = MHD_create_response_from_buffer(strlen(m), m, MHD_RESPMEM_MUST_FREE);
+        if (!response) {
+                free(m);
+                return respond_oom(connection);
+        }
+
+        log_debug("queing response %u: %s", code, m);
+        MHD_add_response_header(response, "Content-Type", "text/plain");
+        r = MHD_queue_response(connection, code, response);
+        MHD_destroy_response(response);
+
+        return r;
+}
+
 #ifdef HAVE_GNUTLS
 
 static int log_level_map[] = {
@@ -73,4 +133,133 @@ void log_func_gnutls(int level, const char *message) {
         log_meta(ourlevel, NULL, 0, NULL, "gnutls: %s", message);
 }
 
+static int verify_cert_authorized(gnutls_session_t session) {
+        unsigned status;
+        gnutls_certificate_type_t type;
+        gnutls_datum_t out;
+        int r;
+
+        r = gnutls_certificate_verify_peers2(session, &status);
+        if (r < 0) {
+                log_error("gnutls_certificate_verify_peers2 failed: %s", strerror(-r));
+                return r;
+        }
+
+        type = gnutls_certificate_type_get(session);
+        r = gnutls_certificate_verification_status_print(status, type, &out, 0);
+        if (r < 0) {
+                log_error("gnutls_certificate_verification_status_print failed: %s", strerror(-r));
+                return r;
+        }
+
+        log_info("Certificate status: %s", out.data);
+
+        return status == 0 ? 0 : -EPERM;
+}
+
+static int get_client_cert(gnutls_session_t session, gnutls_x509_crt_t *client_cert) {
+        const gnutls_datum_t *pcert;
+        unsigned listsize;
+        gnutls_x509_crt_t cert;
+        int r;
+
+        assert(session);
+        assert(client_cert);
+
+        pcert = gnutls_certificate_get_peers(session, &listsize);
+        if (!pcert || !listsize) {
+                log_error("Failed to retrieve certificate chain");
+                return -EINVAL;
+        }
+
+        r = gnutls_x509_crt_init(&cert);
+        if (r < 0) {
+                log_error("Failed to initialize client certificate");
+                return r;
+        }
+
+        /* Note that by passing values between 0 and listsize here, you
+           can get access to the CA's certs */
+        r = gnutls_x509_crt_import(cert, &pcert[0], GNUTLS_X509_FMT_DER);
+        if (r < 0) {
+                log_error("Failed to import client certificate");
+                gnutls_x509_crt_deinit(cert);
+                return r;
+        }
+
+        *client_cert = cert;
+        return 0;
+}
+
+static int get_auth_dn(gnutls_x509_crt_t client_cert, char **buf) {
+        size_t len = 0;
+        int r;
+
+        assert(buf);
+        assert(*buf == NULL);
+
+        r = gnutls_x509_crt_get_dn(client_cert, NULL, &len);
+        if (r != GNUTLS_E_SHORT_MEMORY_BUFFER) {
+                log_error("gnutls_x509_crt_get_dn failed");
+                return r;
+        }
+
+        *buf = malloc(len);
+        if (!*buf)
+                return log_oom();
+
+        gnutls_x509_crt_get_dn(client_cert, *buf, &len);
+        return 0;
+}
+
+int check_permissions(struct MHD_Connection *connection, int *code) {
+        const union MHD_ConnectionInfo *ci;
+        gnutls_session_t session;
+        gnutls_x509_crt_t client_cert;
+        char _cleanup_free_ *buf = NULL;
+        int r;
+
+        assert(connection);
+        assert(code);
+
+        *code = 0;
+
+        ci = MHD_get_connection_info(connection,
+                                     MHD_CONNECTION_INFO_GNUTLS_SESSION);
+        if (!ci) {
+                log_error("MHD_get_connection_info failed");
+                return -EINVAL;
+        }
+        session = ci->tls_session;
+        assert(session);
+
+        r = get_client_cert(session, &client_cert);
+        if (r < 0) {
+                *code = respond_error(connection, MHD_HTTP_UNAUTHORIZED,
+                                      "Authorization through certificate is required");
+                return -EPERM;
+        }
+
+        r = get_auth_dn(client_cert, &buf);
+        if (r < 0) {
+                *code = respond_error(connection, MHD_HTTP_UNAUTHORIZED,
+                                      "Failed to determine distinguished name from certificate");
+                return -EPERM;
+        }
+
+        log_info("Connection from %s", buf);
+
+        r = verify_cert_authorized(session);
+        if (r < 0) {
+                log_error("Client is not authorized");
+                *code = respond_error(connection, MHD_HTTP_UNAUTHORIZED,
+                                      "Client certificate not signed by recognized authority");
+        }
+        return r;
+}
+
+#else
+int check_permissions(struct MHD_Connection *connection, int *code) {
+        return -EPERM;
+}
 #endif
diff --git a/src/journal/microhttpd-util.h b/src/journal/microhttpd-util.h
index 4afe0a29d1..cd14ac4dcf 100644
--- a/src/journal/microhttpd-util.h
+++ b/src/journal/microhttpd-util.h
@@ -22,14 +22,24 @@
 #pragma once
 
 #include <stdarg.h>
+#include <microhttpd.h>
 
 #include "macro.h"
 
 void microhttpd_logger(void *arg, const char *fmt, va_list ap) _printf_(2, 0);
 
-#ifdef HAVE_GNUTLS
-#include <gnutls/gnutls.h>
+int respond_oom_internal(struct MHD_Connection *connection);
+
+/* respond_oom() must be usable with return, hence this form. */
+#define respond_oom(connection) log_oom(), respond_oom_internal(connection)
+
+int respond_error(struct MHD_Connection *connection,
+                  unsigned code,
+                  const char *format, ...);
 
+int check_permissions(struct MHD_Connection *connection, int *code);
+
+#ifdef HAVE_GNUTLS
 void log_func_gnutls(int level, const char *message);
 
 /* This is additionally filtered by our internal log level, so it