diff options
Diffstat (limited to 'src/grp-journal/grp-remote')
13 files changed, 64 insertions, 469 deletions
diff --git a/src/grp-journal/grp-remote/microhttpd-util.c b/src/grp-journal/grp-remote/microhttpd-util.c deleted file mode 100644 index 3fc5e13b71..0000000000 --- a/src/grp-journal/grp-remote/microhttpd-util.c +++ /dev/null @@ -1,328 +0,0 @@ -/*** - This file is part of systemd. - - Copyright 2012 Lennart Poettering - Copyright 2012 Zbigniew Jędrzejewski-Szmek - - systemd is free software; you can redistribute it and/or modify it - under the terms of the GNU Lesser General Public License as published by - the Free Software Foundation; either version 2.1 of the License, or - (at your option) any later version. - - systemd is distributed in the hope that it will be useful, but - WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - Lesser General Public License for more details. - - You should have received a copy of the GNU Lesser General Public License - along with systemd; If not, see <http://www.gnu.org/licenses/>. -***/ - -#include <stddef.h> -#include <stdio.h> -#include <string.h> - -#ifdef HAVE_GNUTLS -#include <gnutls/gnutls.h> -#include <gnutls/x509.h> -#endif - -#include "basic/alloc-util.h" -#include "basic/log.h" -#include "basic/macro.h" -#include "basic/string-util.h" -#include "basic/strv.h" -#include "basic/util.h" - -#include "microhttpd-util.h" - -void microhttpd_logger(void *arg, const char *fmt, va_list ap) { - char *f; - - f = strjoina("microhttpd: ", fmt); - - DISABLE_WARNING_FORMAT_NONLITERAL; - log_internalv(LOG_INFO, 0, NULL, 0, NULL, f, ap); - REENABLE_WARNING; -} - - -static int mhd_respond_internal(struct MHD_Connection *connection, - enum MHD_RequestTerminationCode code, - char *buffer, - size_t size, - enum MHD_ResponseMemoryMode mode) { - struct MHD_Response *response; - int r; - - assert(connection); - - response = MHD_create_response_from_buffer(size, buffer, mode); - if (!response) - return MHD_NO; - - log_debug("Queueing response %u: %s", code, buffer); - MHD_add_response_header(response, "Content-Type", "text/plain"); - r = MHD_queue_response(connection, code, response); - MHD_destroy_response(response); - - return r; -} - -int mhd_respond(struct MHD_Connection *connection, - enum MHD_RequestTerminationCode code, - const char *message) { - - return mhd_respond_internal(connection, code, - (char*) message, strlen(message), - MHD_RESPMEM_PERSISTENT); -} - -int mhd_respond_oom(struct MHD_Connection *connection) { - return mhd_respond(connection, MHD_HTTP_SERVICE_UNAVAILABLE, "Out of memory.\n"); -} - -int mhd_respondf(struct MHD_Connection *connection, - enum MHD_RequestTerminationCode code, - const char *format, ...) { - - char *m; - int r; - va_list ap; - - assert(connection); - assert(format); - - va_start(ap, format); - r = vasprintf(&m, format, ap); - va_end(ap); - - if (r < 0) - return respond_oom(connection); - - return mhd_respond_internal(connection, code, m, r, MHD_RESPMEM_MUST_FREE); -} - -#ifdef HAVE_GNUTLS - -static struct { - const char *const names[4]; - int level; - bool enabled; -} gnutls_log_map[] = { - { {"0"}, LOG_DEBUG }, - { {"1", "audit"}, LOG_WARNING, true}, /* gnutls session audit */ - { {"2", "assert"}, LOG_DEBUG }, /* gnutls assert log */ - { {"3", "hsk", "ext"}, LOG_DEBUG }, /* gnutls handshake log */ - { {"4", "rec"}, LOG_DEBUG }, /* gnutls record log */ - { {"5", "dtls"}, LOG_DEBUG }, /* gnutls DTLS log */ - { {"6", "buf"}, LOG_DEBUG }, - { {"7", "write", "read"}, LOG_DEBUG }, - { {"8"}, LOG_DEBUG }, - { {"9", "enc", "int"}, LOG_DEBUG }, -}; - -static void log_func_gnutls(int level, const char *message) { - assert_se(message); - - if (0 <= level && level < (int) ELEMENTSOF(gnutls_log_map)) { - if (gnutls_log_map[level].enabled) - log_internal(gnutls_log_map[level].level, 0, NULL, 0, NULL, "gnutls %d/%s: %s", level, gnutls_log_map[level].names[1], message); - } else { - log_debug("Received GNUTLS message with unknown level %d.", level); - log_internal(LOG_DEBUG, 0, NULL, 0, NULL, "gnutls: %s", message); - } -} - -static void log_reset_gnutls_level(void) { - int i; - - for (i = ELEMENTSOF(gnutls_log_map) - 1; i >= 0; i--) - if (gnutls_log_map[i].enabled) { - log_debug("Setting gnutls log level to %d", i); - gnutls_global_set_log_level(i); - break; - } -} - -static int log_enable_gnutls_category(const char *cat) { - unsigned i; - - if (streq(cat, "all")) { - for (i = 0; i < ELEMENTSOF(gnutls_log_map); i++) - gnutls_log_map[i].enabled = true; - log_reset_gnutls_level(); - return 0; - } else - for (i = 0; i < ELEMENTSOF(gnutls_log_map); i++) - if (strv_contains((char**)gnutls_log_map[i].names, cat)) { - gnutls_log_map[i].enabled = true; - log_reset_gnutls_level(); - return 0; - } - log_error("No such log category: %s", cat); - return -EINVAL; -} - -int setup_gnutls_logger(char **categories) { - char **cat; - int r; - - gnutls_global_set_log_function(log_func_gnutls); - - if (categories) { - STRV_FOREACH(cat, categories) { - r = log_enable_gnutls_category(*cat); - if (r < 0) - return r; - } - } else - log_reset_gnutls_level(); - - return 0; -} - -static int verify_cert_authorized(gnutls_session_t session) { - unsigned status; - gnutls_certificate_type_t type; - gnutls_datum_t out; - int r; - - r = gnutls_certificate_verify_peers2(session, &status); - if (r < 0) - return log_error_errno(r, "gnutls_certificate_verify_peers2 failed: %m"); - - type = gnutls_certificate_type_get(session); - r = gnutls_certificate_verification_status_print(status, type, &out, 0); - if (r < 0) - return log_error_errno(r, "gnutls_certificate_verification_status_print failed: %m"); - - log_debug("Certificate status: %s", out.data); - gnutls_free(out.data); - - return status == 0 ? 0 : -EPERM; -} - -static int get_client_cert(gnutls_session_t session, gnutls_x509_crt_t *client_cert) { - const gnutls_datum_t *pcert; - unsigned listsize; - gnutls_x509_crt_t cert; - int r; - - assert(session); - assert(client_cert); - - pcert = gnutls_certificate_get_peers(session, &listsize); - if (!pcert || !listsize) { - log_error("Failed to retrieve certificate chain"); - return -EINVAL; - } - - r = gnutls_x509_crt_init(&cert); - if (r < 0) { - log_error("Failed to initialize client certificate"); - return r; - } - - /* Note that by passing values between 0 and listsize here, you - can get access to the CA's certs */ - r = gnutls_x509_crt_import(cert, &pcert[0], GNUTLS_X509_FMT_DER); - if (r < 0) { - log_error("Failed to import client certificate"); - gnutls_x509_crt_deinit(cert); - return r; - } - - *client_cert = cert; - return 0; -} - -static int get_auth_dn(gnutls_x509_crt_t client_cert, char **buf) { - size_t len = 0; - int r; - - assert(buf); - assert(*buf == NULL); - - r = gnutls_x509_crt_get_dn(client_cert, NULL, &len); - if (r != GNUTLS_E_SHORT_MEMORY_BUFFER) { - log_error("gnutls_x509_crt_get_dn failed"); - return r; - } - - *buf = malloc(len); - if (!*buf) - return log_oom(); - - gnutls_x509_crt_get_dn(client_cert, *buf, &len); - return 0; -} - -static inline void gnutls_x509_crt_deinitp(gnutls_x509_crt_t *p) { - gnutls_x509_crt_deinit(*p); -} - -int check_permissions(struct MHD_Connection *connection, int *code, char **hostname) { - const union MHD_ConnectionInfo *ci; - gnutls_session_t session; - _cleanup_(gnutls_x509_crt_deinitp) gnutls_x509_crt_t client_cert = NULL; - _cleanup_free_ char *buf = NULL; - int r; - - assert(connection); - assert(code); - - *code = 0; - - ci = MHD_get_connection_info(connection, - MHD_CONNECTION_INFO_GNUTLS_SESSION); - if (!ci) { - log_error("MHD_get_connection_info failed: session is unencrypted"); - *code = mhd_respond(connection, MHD_HTTP_FORBIDDEN, - "Encrypted connection is required"); - return -EPERM; - } - session = ci->tls_session; - assert(session); - - r = get_client_cert(session, &client_cert); - if (r < 0) { - *code = mhd_respond(connection, MHD_HTTP_UNAUTHORIZED, - "Authorization through certificate is required"); - return -EPERM; - } - - r = get_auth_dn(client_cert, &buf); - if (r < 0) { - *code = mhd_respond(connection, MHD_HTTP_UNAUTHORIZED, - "Failed to determine distinguished name from certificate"); - return -EPERM; - } - - log_debug("Connection from %s", buf); - - if (hostname) { - *hostname = buf; - buf = NULL; - } - - r = verify_cert_authorized(session); - if (r < 0) { - log_warning("Client is not authorized"); - *code = mhd_respond(connection, MHD_HTTP_UNAUTHORIZED, - "Client certificate not signed by recognized authority"); - } - return r; -} - -#else -int check_permissions(struct MHD_Connection *connection, int *code, char **hostname) { - return -EPERM; -} - -int setup_gnutls_logger(char **categories) { - if (categories) - log_notice("Ignoring specified gnutls logging categories — gnutls not available."); - return 0; -} -#endif diff --git a/src/grp-journal/grp-remote/microhttpd-util.h b/src/grp-journal/grp-remote/microhttpd-util.h deleted file mode 100644 index 178e78f892..0000000000 --- a/src/grp-journal/grp-remote/microhttpd-util.h +++ /dev/null @@ -1,60 +0,0 @@ -#pragma once - -/*** - This file is part of systemd. - - Copyright 2012 Zbigniew Jędrzejewski-Szmek - - systemd is free software; you can redistribute it and/or modify it - under the terms of the GNU Lesser General Public License as published by - the Free Software Foundation; either version 2.1 of the License, or - (at your option) any later version. - - systemd is distributed in the hope that it will be useful, but - WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - Lesser General Public License for more details. - - You should have received a copy of the GNU Lesser General Public License - along with systemd; If not, see <http://www.gnu.org/licenses/>. -***/ - -#include <microhttpd.h> -#include <stdarg.h> - -#include "basic/macro.h" - -/* Compatiblity with libmicrohttpd < 0.9.38 */ -#ifndef MHD_HTTP_NOT_ACCEPTABLE -#define MHD_HTTP_NOT_ACCEPTABLE MHD_HTTP_METHOD_NOT_ACCEPTABLE -#endif - -#if MHD_VERSION < 0x00094203 -#define MHD_create_response_from_fd_at_offset64 MHD_create_response_from_fd_at_offset -#endif - -void microhttpd_logger(void *arg, const char *fmt, va_list ap) _printf_(2, 0); - -/* respond_oom() must be usable with return, hence this form. */ -#define respond_oom(connection) log_oom(), mhd_respond_oom(connection) - -int mhd_respondf(struct MHD_Connection *connection, - unsigned code, - const char *format, ...) _printf_(3,4); - -int mhd_respond(struct MHD_Connection *connection, - unsigned code, - const char *message); - -int mhd_respond_oom(struct MHD_Connection *connection); - -int check_permissions(struct MHD_Connection *connection, int *code, char **hostname); - -/* Set gnutls internal logging function to a callback which uses our - * own logging framework. - * - * gnutls categories are additionally filtered by our internal log - * level, so it should be set fairly high to capture all potentially - * interesting events without overwhelming detail. - */ -int setup_gnutls_logger(char **categories); diff --git a/src/grp-journal/grp-remote/systemd-journal-gatewayd/Makefile b/src/grp-journal/grp-remote/systemd-journal-gatewayd/Makefile index 1daedbd8dd..723dfa7ac7 100644 --- a/src/grp-journal/grp-remote/systemd-journal-gatewayd/Makefile +++ b/src/grp-journal/grp-remote/systemd-journal-gatewayd/Makefile @@ -30,21 +30,12 @@ rootlibexec_PROGRAMS += \ systemd-journal-gatewayd systemd_journal_gatewayd_SOURCES = \ - src/journal-remote/journal-gatewayd.c \ - src/journal-remote/microhttpd-util.h \ - src/journal-remote/microhttpd-util.c + src/journal-remote/journal-gatewayd.c systemd_journal_gatewayd_LDADD = \ + libsystemd-internal.la \ libsystemd-shared.la \ - $(MICROHTTPD_LIBS) - -ifneq ($(HAVE_GNUTLS),) -systemd_journal_gatewayd_LDADD += \ - $(GNUTLS_LIBS) -endif # HAVE_GNUTLS - -systemd_journal_gatewayd_CFLAGS = \ - $(MICROHTTPD_CFLAGS) + libsystemd-microhttpd.la systemd_journal_gatewayd_CPPFLAGS = \ -DDOCUMENT_ROOT=\"$(gatewayddocumentrootdir)\" diff --git a/src/grp-journal/grp-remote/systemd-journal-gatewayd/journal-gatewayd.c b/src/grp-journal/grp-remote/systemd-journal-gatewayd/journal-gatewayd.c index 76b241a14b..b92945455b 100644 --- a/src/grp-journal/grp-remote/systemd-journal-gatewayd/journal-gatewayd.c +++ b/src/grp-journal/grp-remote/systemd-journal-gatewayd/journal-gatewayd.c @@ -31,17 +31,17 @@ #include <systemd/sd-daemon.h> #include <systemd/sd-journal.h> -#include "basic/alloc-util.h" -#include "basic/fd-util.h" -#include "basic/fileio.h" -#include "basic/hostname-util.h" -#include "basic/log.h" -#include "basic/parse-util.h" -#include "basic/sigbus.h" -#include "basic/util.h" -#include "microhttpd-util.h" -#include "shared/bus-util.h" -#include "shared/logs-show.h" +#include "sd-bus/bus-util.h" +#include "systemd-basic/alloc-util.h" +#include "systemd-basic/fd-util.h" +#include "systemd-basic/fileio.h" +#include "systemd-basic/hostname-util.h" +#include "systemd-basic/log.h" +#include "systemd-basic/parse-util.h" +#include "systemd-basic/sigbus.h" +#include "systemd-basic/util.h" +#include "systemd-microhttpd/microhttpd-util.h" +#include "systemd-shared/logs-show.h" #define JOURNAL_WAIT_TIMEOUT (10*USEC_PER_SEC) diff --git a/src/grp-journal/grp-remote/systemd-journal-remote/Makefile b/src/grp-journal/grp-remote/systemd-journal-remote/Makefile index ebfa101c97..601bad9b5f 100644 --- a/src/grp-journal/grp-remote/systemd-journal-remote/Makefile +++ b/src/grp-journal/grp-remote/systemd-journal-remote/Makefile @@ -36,28 +36,14 @@ systemd_journal_remote_SOURCES = \ src/journal-remote/journal-remote.c systemd_journal_remote_LDADD = \ + libsystemd-microhttpd.la \ libjournal-core.la -systemd_journal_remote_SOURCES += \ - src/journal-remote/microhttpd-util.h \ - src/journal-remote/microhttpd-util.c - -systemd_journal_remote_CFLAGS = \ - $(MICROHTTPD_CFLAGS) - -systemd_journal_remote_LDADD += \ - $(MICROHTTPD_LIBS) - ifneq ($(ENABLE_TMPFILES),) dist_tmpfiles_DATA += \ tmpfiles.d/systemd-remote.conf endif # ENABLE_TMPFILES -ifneq ($(HAVE_GNUTLS),) -systemd_journal_remote_LDADD += \ - $(GNUTLS_LIBS) -endif # HAVE_GNUTLS - # systemd-journal-remote make sense mostly with full crypto stack dist_systemunit_DATA += \ units/systemd-journal-remote.socket @@ -81,4 +67,7 @@ EXTRA_DIST += \ src/journal-remote/log-generator.py endif # HAVE_MICROHTTPD +sd.CPPFLAGS += -DPKGSYSCONFDIR=\"$(pkgsysconfdir)\" +sd.CPPFLAGS += -DCERTIFICATE_ROOT=\"$(CERTIFICATEROOT)\" + include $(topsrcdir)/build-aux/Makefile.tail.mk diff --git a/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote-parse.c b/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote-parse.c index c71fedd816..fdfa692214 100644 --- a/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote-parse.c +++ b/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote-parse.c @@ -17,11 +17,11 @@ along with systemd; If not, see <http://www.gnu.org/licenses/>. ***/ -#include "basic/alloc-util.h" -#include "basic/fd-util.h" -#include "basic/parse-util.h" -#include "basic/string-util.h" -#include "journald-native.h" +#include "journal-core/journald-native.h" +#include "systemd-basic/alloc-util.h" +#include "systemd-basic/fd-util.h" +#include "systemd-basic/parse-util.h" +#include "systemd-basic/string-util.h" #include "journal-remote-parse.h" diff --git a/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote-write.c b/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote-write.c index 4e05eda103..31abdc76d2 100644 --- a/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote-write.c +++ b/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote-write.c @@ -17,7 +17,7 @@ along with systemd; If not, see <http://www.gnu.org/licenses/>. ***/ -#include "basic/alloc-util.h" +#include "systemd-basic/alloc-util.h" #include "journal-remote.h" diff --git a/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote.c b/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote.c index ac1ba30310..b77abfc184 100644 --- a/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote.c +++ b/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote.c @@ -33,23 +33,23 @@ #include <systemd/sd-daemon.h> -#include "basic/alloc-util.h" -#include "basic/def.h" -#include "basic/escape.h" -#include "basic/fd-util.h" -#include "basic/fileio.h" -#include "basic/macro.h" -#include "basic/parse-util.h" -#include "basic/signal-util.h" -#include "basic/socket-util.h" -#include "basic/stat-util.h" -#include "basic/stdio-util.h" -#include "basic/string-table.h" -#include "basic/string-util.h" -#include "basic/strv.h" -#include "journald-native.h" +#include "journal-core/journald-native.h" #include "sd-journal/journal-file.h" -#include "shared/conf-parser.h" +#include "systemd-basic/alloc-util.h" +#include "systemd-basic/def.h" +#include "systemd-basic/escape.h" +#include "systemd-basic/fd-util.h" +#include "systemd-basic/fileio.h" +#include "systemd-basic/macro.h" +#include "systemd-basic/parse-util.h" +#include "systemd-basic/signal-util.h" +#include "systemd-basic/socket-util.h" +#include "systemd-basic/stat-util.h" +#include "systemd-basic/stdio-util.h" +#include "systemd-basic/string-table.h" +#include "systemd-basic/string-util.h" +#include "systemd-basic/strv.h" +#include "systemd-shared/conf-parser.h" #include "journal-remote-write.h" #include "journal-remote.h" diff --git a/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote.h b/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote.h index 6abfc1019d..1c090ccdfc 100644 --- a/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote.h +++ b/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote.h @@ -21,8 +21,8 @@ #include <systemd/sd-event.h> -#include "basic/hashmap.h" -#include "microhttpd-util.h" +#include "systemd-basic/hashmap.h" +#include "systemd-microhttpd/microhttpd-util.h" #include "journal-remote-parse.h" #include "journal-remote-write.h" diff --git a/src/grp-journal/grp-remote/systemd-journal-upload/Makefile b/src/grp-journal/grp-remote/systemd-journal-upload/Makefile index acfcbd22df..bc272e52da 100644 --- a/src/grp-journal/grp-remote/systemd-journal-upload/Makefile +++ b/src/grp-journal/grp-remote/systemd-journal-upload/Makefile @@ -54,4 +54,7 @@ EXTRA_DIST += \ units/systemd-journal-upload.service.in \ src/journal-remote/journal-upload.conf.in +sd.CPPFLAGS += -DPKGSYSCONFDIR=\"$(pkgsysconfdir)\" +sd.CPPFLAGS += -DCERTIFICATE_ROOT=\"$(CERTIFICATEROOT)\" + include $(topsrcdir)/build-aux/Makefile.tail.mk diff --git a/src/grp-journal/grp-remote/systemd-journal-upload/journal-upload-journal.c b/src/grp-journal/grp-remote/systemd-journal-upload/journal-upload-journal.c index 61d287da97..3a5e450e35 100644 --- a/src/grp-journal/grp-remote/systemd-journal-upload/journal-upload-journal.c +++ b/src/grp-journal/grp-remote/systemd-journal-upload/journal-upload-journal.c @@ -22,10 +22,10 @@ #include <systemd/sd-daemon.h> -#include "basic/alloc-util.h" -#include "basic/log.h" -#include "basic/utf8.h" -#include "basic/util.h" +#include "systemd-basic/alloc-util.h" +#include "systemd-basic/log.h" +#include "systemd-basic/utf8.h" +#include "systemd-basic/util.h" #include "journal-upload.h" diff --git a/src/grp-journal/grp-remote/systemd-journal-upload/journal-upload.c b/src/grp-journal/grp-remote/systemd-journal-upload/journal-upload.c index 82d8331e76..52964bd03a 100644 --- a/src/grp-journal/grp-remote/systemd-journal-upload/journal-upload.c +++ b/src/grp-journal/grp-remote/systemd-journal-upload/journal-upload.c @@ -25,20 +25,20 @@ #include <systemd/sd-daemon.h> -#include "basic/alloc-util.h" -#include "basic/def.h" -#include "basic/fd-util.h" -#include "basic/fileio.h" -#include "basic/formats-util.h" -#include "basic/glob-util.h" -#include "basic/log.h" -#include "basic/mkdir.h" -#include "basic/parse-util.h" -#include "basic/sigbus.h" -#include "basic/signal-util.h" -#include "basic/string-util.h" -#include "basic/util.h" -#include "shared/conf-parser.h" +#include "systemd-basic/alloc-util.h" +#include "systemd-basic/def.h" +#include "systemd-basic/fd-util.h" +#include "systemd-basic/fileio.h" +#include "systemd-basic/formats-util.h" +#include "systemd-basic/glob-util.h" +#include "systemd-basic/log.h" +#include "systemd-basic/mkdir.h" +#include "systemd-basic/parse-util.h" +#include "systemd-basic/sigbus.h" +#include "systemd-basic/signal-util.h" +#include "systemd-basic/string-util.h" +#include "systemd-basic/util.h" +#include "systemd-shared/conf-parser.h" #include "journal-upload.h" diff --git a/src/grp-journal/grp-remote/systemd-journal-upload/journal-upload.h b/src/grp-journal/grp-remote/systemd-journal-upload/journal-upload.h index 9eeb8d2123..f1fd95e22c 100644 --- a/src/grp-journal/grp-remote/systemd-journal-upload/journal-upload.h +++ b/src/grp-journal/grp-remote/systemd-journal-upload/journal-upload.h @@ -6,7 +6,7 @@ #include <systemd/sd-event.h> #include <systemd/sd-journal.h> -#include "basic/time-util.h" +#include "systemd-basic/time-util.h" typedef enum { ENTRY_CURSOR = 0, /* Nothing actually written yet. */ |