29132483780

Committed 10 Jul 2026 08:43PM UTC coverage: 72.912% (+0.2%) from 72.702%

Build # 29132483780

Build Type

push

github

Committed by

bluca

Commit Message

man: run forgotten 'update-man-rules'

Coverage Stats

344600 of 472622 relevant lines covered (72.91%)

1365091.83 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

66.26

/src/shared/microhttpd-util.c

/* SPDX-License-Identifier: LGPL-2.1-or-later */

#include <stdio.h>

#include "alloc-util.h"
#include "gnutls-util.h"
#include "log.h"
#include "microhttpd-util.h"
#include "string-util.h"
#include "strv.h"

#if HAVE_MICROHTTPD
DLSYM_PROTOTYPE(MHD_add_response_header) = NULL;
DLSYM_PROTOTYPE(MHD_create_response_from_buffer) = NULL;
DLSYM_PROTOTYPE(MHD_create_response_from_callback) = NULL;
#if MHD_VERSION < 0x00094203
DLSYM_PROTOTYPE(MHD_create_response_from_fd_at_offset) = NULL;
#else
DLSYM_PROTOTYPE(MHD_create_response_from_fd_at_offset64) = NULL;
#endif
DLSYM_PROTOTYPE(MHD_destroy_response) = NULL;
DLSYM_PROTOTYPE(MHD_get_connection_info) = NULL;
DLSYM_PROTOTYPE(MHD_get_connection_values) = NULL;
DLSYM_PROTOTYPE(MHD_get_daemon_info) = NULL;
DLSYM_PROTOTYPE(MHD_get_timeout) = NULL;
DLSYM_PROTOTYPE(MHD_lookup_connection_value) = NULL;
DLSYM_PROTOTYPE(MHD_queue_response) = NULL;
DLSYM_PROTOTYPE(MHD_run) = NULL;
DLSYM_PROTOTYPE(MHD_start_daemon) = NULL;
DLSYM_PROTOTYPE(MHD_stop_daemon) = NULL;
#endif

int dlopen_microhttpd(int log_level) {
#if HAVE_MICROHTTPD
        static void *microhttpd_dl = NULL;

        LIBMICROHTTPD_NOTE(suggested);

        return dlopen_many_sym_or_warn(
                        &microhttpd_dl,
                        "libmicrohttpd.so.12",
                        log_level,
                        DLSYM_ARG(MHD_add_response_header),
                        DLSYM_ARG(MHD_create_response_from_buffer),
                        DLSYM_ARG(MHD_create_response_from_callback),
#if MHD_VERSION < 0x00094203
                        DLSYM_ARG(MHD_create_response_from_fd_at_offset),
#else
                        DLSYM_ARG(MHD_create_response_from_fd_at_offset64),
#endif
                        DLSYM_ARG(MHD_destroy_response),
                        DLSYM_ARG(MHD_get_connection_info),
                        DLSYM_ARG(MHD_get_connection_values),
                        DLSYM_ARG(MHD_get_daemon_info),
                        DLSYM_ARG(MHD_get_timeout),
                        DLSYM_ARG(MHD_lookup_connection_value),
                        DLSYM_ARG(MHD_queue_response),
                        DLSYM_ARG(MHD_run),
                        DLSYM_ARG(MHD_start_daemon),
                        DLSYM_ARG(MHD_stop_daemon));
#else
        return log_full_errno(log_level, SYNTHETIC_ERRNO(EOPNOTSUPP),
                              "libmicrohttpd support is not compiled in.");
#endif
}

#if HAVE_MICROHTTPD

void microhttpd_logger(void *arg, const char *fmt, va_list ap) {
        char *f;

        f = strjoina("microhttpd: ", fmt);

        DISABLE_WARNING_FORMAT_NONLITERAL;
        log_internalv(LOG_INFO, 0, NULL, 0, NULL, f, ap);
        REENABLE_WARNING;
}

int mhd_respond_internal(
                struct MHD_Connection *connection,
                enum MHD_RequestTerminationCode code,
                const char *encoding,
                const char *buffer,
                size_t size,
                enum MHD_ResponseMemoryMode mode) {

        assert(connection);

        _cleanup_(MHD_destroy_responsep) struct MHD_Response *response
                = sym_MHD_create_response_from_buffer(size, (char*) buffer, mode);
        if (!response)
                return MHD_NO;

        log_debug("Queueing response %u: %s", code, buffer);
        if (encoding)
                if (sym_MHD_add_response_header(response, "Accept-Encoding", encoding) == MHD_NO)
                        return MHD_NO;

        if (sym_MHD_add_response_header(response, "Content-Type", "text/plain") == MHD_NO)
                return MHD_NO;
        return sym_MHD_queue_response(connection, code, response);
}

int mhd_respond_oom(struct MHD_Connection *connection) {
        return mhd_respond(connection, MHD_HTTP_SERVICE_UNAVAILABLE, "Out of memory.");
}

int mhd_respondf_internal(
                struct MHD_Connection *connection,
                int error,
                enum MHD_RequestTerminationCode code,
                const char *encoding,
                const char *format, ...) {

        char *m;
        int r;
        va_list ap;

        assert(connection);
        assert(format);

        errno = ERRNO_VALUE(error);
        va_start(ap, format);
        r = vasprintf(&m, format, ap);
        va_end(ap);

        if (r < 0)
                return respond_oom(connection);

        return mhd_respond_internal(connection, code, encoding, m, r, MHD_RESPMEM_MUST_FREE);
}

#if HAVE_GNUTLS

static struct {
        const char *const names[4];
        int level;
        bool enabled;
} gnutls_log_map[] = {
        { {"0"},                  LOG_DEBUG },
        { {"1", "audit"},         LOG_WARNING, true}, /* gnutls session audit */
        { {"2", "assert"},        LOG_DEBUG },        /* gnutls assert log */
        { {"3", "hsk", "ext"},    LOG_DEBUG },        /* gnutls handshake log */
        { {"4", "rec"},           LOG_DEBUG },        /* gnutls record log */
        { {"5", "dtls"},          LOG_DEBUG },        /* gnutls DTLS log */
        { {"6", "buf"},           LOG_DEBUG },
        { {"7", "write", "read"}, LOG_DEBUG },
        { {"8"},                  LOG_DEBUG },
        { {"9", "enc", "int"},    LOG_DEBUG },
};

static void log_func_gnutls(int level, const char *message) {
        assert_se(message);

        if (0 <= level && level < (int) ELEMENTSOF(gnutls_log_map)) {
                if (gnutls_log_map[level].enabled)
                        log_internal(gnutls_log_map[level].level, 0, NULL, 0, NULL, "gnutls %d/%s: %s", level, gnutls_log_map[level].names[1], message);
        } else {
                log_debug("Received GNUTLS message with unknown level %d.", level);
                log_internal(LOG_DEBUG, 0, NULL, 0, NULL, "gnutls: %s", message);
        }
}

static void log_reset_gnutls_level(void) {
        int i;

        for (i = ELEMENTSOF(gnutls_log_map) - 1; i >= 0; i--)
                if (gnutls_log_map[i].enabled) {
                        log_debug("Setting gnutls log level to %d", i);
                        sym_gnutls_global_set_log_level(i);
                        break;
                }
}

static int log_enable_gnutls_category(const char *cat) {
        if (streq(cat, "all")) {
                FOREACH_ELEMENT(entry, gnutls_log_map)
                        entry->enabled = true;
                log_reset_gnutls_level();
                return 0;
        } else
                FOREACH_ELEMENT(entry, gnutls_log_map)
                        if (strv_contains((char**)entry->names, cat)) {
                                entry->enabled = true;
                                log_reset_gnutls_level();
                                return 0;
                        }
        return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "No such log category: %s", cat);
}

int setup_gnutls_logger(char **categories) {
        int r;

        r = dlopen_gnutls(LOG_DEBUG);
        if (r < 0) {
                if (categories)
                        log_notice("Ignoring specified gnutls logging categories -- gnutls not available.");
                else
                        log_debug("GnuTLS not available, skipping logger setup.");
                return 0;
        }

        sym_gnutls_global_set_log_function(log_func_gnutls);

        if (categories)
                STRV_FOREACH(cat, categories) {
                        r = log_enable_gnutls_category(*cat);
                        if (r < 0)
                                return r;
                }
        else
                log_reset_gnutls_level();

        return 0;
}

static int verify_cert_authorized(gnutls_session_t session) {
        unsigned status;
        gnutls_certificate_type_t type;
        gnutls_datum_t out;
        int r;

        r = sym_gnutls_certificate_verify_peers2(session, &status);
        if (r < 0)
                return log_error_errno(r, "gnutls_certificate_verify_peers2 failed: %m");

        type = sym_gnutls_certificate_type_get(session);
        r = sym_gnutls_certificate_verification_status_print(status, type, &out, 0);
        if (r < 0)
                return log_error_errno(r, "gnutls_certificate_verification_status_print failed: %m");

        log_debug("Certificate status: %s", out.data);
        /* gnutls_free is declared as a function pointer variable (not a function), so sym_gnutls_free
         * ends up as a pointer-to-function-pointer and must be explicitly dereferenced to be called. */
        (*sym_gnutls_free)(out.data);

        return status == 0 ? 0 : -EPERM;
}

static int get_client_cert(gnutls_session_t session, gnutls_x509_crt_t *client_cert) {
        const gnutls_datum_t *pcert;
        unsigned listsize;
        gnutls_x509_crt_t cert;
        int r;

        assert(session);
        assert(client_cert);

        pcert = sym_gnutls_certificate_get_peers(session, &listsize);
        if (!pcert || !listsize)
                return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
                                       "Failed to retrieve certificate chain");

        r = sym_gnutls_x509_crt_init(&cert);
        if (r < 0) {
                log_error("Failed to initialize client certificate");
                return r;
        }

        /* Note that by passing values between 0 and listsize here, you
           can get access to the CA's certs */
        r = sym_gnutls_x509_crt_import(cert, &pcert[0], GNUTLS_X509_FMT_DER);
        if (r < 0) {
                log_error("Failed to import client certificate");
                sym_gnutls_x509_crt_deinit(cert);
                return r;
        }

        *client_cert = cert;
        return 0;
}

static int get_auth_dn(gnutls_x509_crt_t client_cert, char **buf) {
        size_t len = 0;
        int r;

        assert(buf);
        assert(*buf == NULL);

        r = sym_gnutls_x509_crt_get_dn(client_cert, NULL, &len);
        if (r != GNUTLS_E_SHORT_MEMORY_BUFFER) {
                log_error("gnutls_x509_crt_get_dn failed");
                return r;
        }

        *buf = malloc(len);
        if (!*buf)
                return log_oom();

        sym_gnutls_x509_crt_get_dn(client_cert, *buf, &len);
        return 0;
}

static void gnutls_x509_crt_deinitp(gnutls_x509_crt_t *p) {
        assert(p);

        if (*p)
                sym_gnutls_x509_crt_deinit(*p);
}

int check_permissions(struct MHD_Connection *connection, int *code, char **hostname) {
        const union MHD_ConnectionInfo *ci;
        gnutls_session_t session;
        _cleanup_(gnutls_x509_crt_deinitp) gnutls_x509_crt_t client_cert = NULL;
        _cleanup_free_ char *buf = NULL;
        int r;

        assert(connection);
        assert(code);

        *code = 0;

        r = dlopen_gnutls(LOG_ERR);
        if (r < 0)
                return r;

        ci = sym_MHD_get_connection_info(connection,
                                         MHD_CONNECTION_INFO_GNUTLS_SESSION);
        if (!ci) {
                log_error("MHD_get_connection_info failed: session is unencrypted");
                *code = mhd_respond(connection, MHD_HTTP_FORBIDDEN,
                                    "Encrypted connection is required");
                return -EPERM;
        }
        session = ci->tls_session;
        assert(session);

        r = get_client_cert(session, &client_cert);
        if (r < 0) {
                *code = mhd_respond(connection, MHD_HTTP_UNAUTHORIZED,
                                    "Authorization through certificate is required");
                return -EPERM;
        }

        r = get_auth_dn(client_cert, &buf);
        if (r < 0) {
                *code = mhd_respond(connection, MHD_HTTP_UNAUTHORIZED,
                                    "Failed to determine distinguished name from certificate");
                return -EPERM;
        }

        log_debug("Connection from %s", buf);

        if (hostname)
                *hostname = TAKE_PTR(buf);

        r = verify_cert_authorized(session);
        if (r < 0) {
                log_warning("Client is not authorized");
                *code = mhd_respond(connection, MHD_HTTP_UNAUTHORIZED,
                                    "Client certificate not signed by recognized authority");
        }
        return r;
}

#else
_noreturn_ int check_permissions(struct MHD_Connection *connection, int *code, char **hostname) {
        assert_not_reached();
}

int setup_gnutls_logger(char **categories) {
        if (categories)
                log_notice("Ignoring specified gnutls logging categories — gnutls not available.");
        return 0;
}
#endif

#endif

1	/* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3	#include <stdio.h>
4
5	#include "alloc-util.h"
6	#include "gnutls-util.h"
7	#include "log.h"
8	#include "microhttpd-util.h"
9	#include "string-util.h"
10	#include "strv.h"
11
12	#if HAVE_MICROHTTPD
13	DLSYM_PROTOTYPE(MHD_add_response_header) = NULL;
14	DLSYM_PROTOTYPE(MHD_create_response_from_buffer) = NULL;
15	DLSYM_PROTOTYPE(MHD_create_response_from_callback) = NULL;
16	#if MHD_VERSION < 0x00094203
17	DLSYM_PROTOTYPE(MHD_create_response_from_fd_at_offset) = NULL;
18	#else
19	DLSYM_PROTOTYPE(MHD_create_response_from_fd_at_offset64) = NULL;
20	#endif
21	DLSYM_PROTOTYPE(MHD_destroy_response) = NULL;
22	DLSYM_PROTOTYPE(MHD_get_connection_info) = NULL;
23	DLSYM_PROTOTYPE(MHD_get_connection_values) = NULL;
24	DLSYM_PROTOTYPE(MHD_get_daemon_info) = NULL;
25	DLSYM_PROTOTYPE(MHD_get_timeout) = NULL;
26	DLSYM_PROTOTYPE(MHD_lookup_connection_value) = NULL;
27	DLSYM_PROTOTYPE(MHD_queue_response) = NULL;
28	DLSYM_PROTOTYPE(MHD_run) = NULL;
29	DLSYM_PROTOTYPE(MHD_start_daemon) = NULL;
30	DLSYM_PROTOTYPE(MHD_stop_daemon) = NULL;
31	#endif
32
33	int dlopen_microhttpd(int log_level) {	11✔
34	#if HAVE_MICROHTTPD
35	static void *microhttpd_dl = NULL;	11✔
36
37	LIBMICROHTTPD_NOTE(suggested);	11✔
38
39	return dlopen_many_sym_or_warn(	11✔
40	&microhttpd_dl,
41	"libmicrohttpd.so.12",
42	log_level,
43	DLSYM_ARG(MHD_add_response_header),
44	DLSYM_ARG(MHD_create_response_from_buffer),
45	DLSYM_ARG(MHD_create_response_from_callback),
46	#if MHD_VERSION < 0x00094203
47	DLSYM_ARG(MHD_create_response_from_fd_at_offset),
48	#else
49	DLSYM_ARG(MHD_create_response_from_fd_at_offset64),
50	#endif
51	DLSYM_ARG(MHD_destroy_response),
52	DLSYM_ARG(MHD_get_connection_info),
53	DLSYM_ARG(MHD_get_connection_values),
54	DLSYM_ARG(MHD_get_daemon_info),
55	DLSYM_ARG(MHD_get_timeout),
56	DLSYM_ARG(MHD_lookup_connection_value),
57	DLSYM_ARG(MHD_queue_response),
58	DLSYM_ARG(MHD_run),
59	DLSYM_ARG(MHD_start_daemon),
60	DLSYM_ARG(MHD_stop_daemon));
61	#else
62	return log_full_errno(log_level, SYNTHETIC_ERRNO(EOPNOTSUPP),
63	"libmicrohttpd support is not compiled in.");
64	#endif
65	}
66
67	#if HAVE_MICROHTTPD
68
69	void microhttpd_logger(void arg, const char fmt, va_list ap) {	×
70	char *f;	×
71
72	f = strjoina("microhttpd: ", fmt);	×
73
74	DISABLE_WARNING_FORMAT_NONLITERAL;	×
75	log_internalv(LOG_INFO, 0, NULL, 0, NULL, f, ap);	×
76	REENABLE_WARNING;	×
77	}	×
78
79	int mhd_respond_internal(	24✔
80	struct MHD_Connection *connection,
81	enum MHD_RequestTerminationCode code,
82	const char *encoding,
83	const char *buffer,
84	size_t size,
85	enum MHD_ResponseMemoryMode mode) {
86
87	assert(connection);	24✔
88
89	_cleanup_(MHD_destroy_responsep) struct MHD_Response *response	24✔
90	= sym_MHD_create_response_from_buffer(size, (char*) buffer, mode);	24✔
91	if (!response)	24✔
92	return MHD_NO;
93
94	log_debug("Queueing response %u: %s", code, buffer);	24✔
95	if (encoding)	24✔
96	if (sym_MHD_add_response_header(response, "Accept-Encoding", encoding) == MHD_NO)	11✔
97	return MHD_NO;
98
99	if (sym_MHD_add_response_header(response, "Content-Type", "text/plain") == MHD_NO)	24✔
100	return MHD_NO;
101	return sym_MHD_queue_response(connection, code, response);	24✔
102	}
103
104	int mhd_respond_oom(struct MHD_Connection *connection) {	×
105	return mhd_respond(connection, MHD_HTTP_SERVICE_UNAVAILABLE, "Out of memory.");	×
106	}
107
108	int mhd_respondf_internal(	2✔
109	struct MHD_Connection *connection,
110	int error,
111	enum MHD_RequestTerminationCode code,
112	const char *encoding,
113	const char *format, ...) {
114
115	char *m;	2✔
116	int r;	2✔
117	va_list ap;	2✔
118
119	assert(connection);	2✔
120	assert(format);	2✔
121
122	errno = ERRNO_VALUE(error);	2✔
123	va_start(ap, format);	2✔
124	r = vasprintf(&m, format, ap);	2✔
125	va_end(ap);	2✔
126
127	if (r < 0)	2✔
128	return respond_oom(connection);	×
129
130	return mhd_respond_internal(connection, code, encoding, m, r, MHD_RESPMEM_MUST_FREE);	2✔
131	}
132
133	#if HAVE_GNUTLS
134
135	static struct {
136	const char *const names[4];
137	int level;
138	bool enabled;
139	} gnutls_log_map[] = {
140	{ {"0"}, LOG_DEBUG },
141	{ {"1", "audit"}, LOG_WARNING, true}, /* gnutls session audit */
142	{ {"2", "assert"}, LOG_DEBUG }, /* gnutls assert log */
143	{ {"3", "hsk", "ext"}, LOG_DEBUG }, /* gnutls handshake log */
144	{ {"4", "rec"}, LOG_DEBUG }, /* gnutls record log */
145	{ {"5", "dtls"}, LOG_DEBUG }, /* gnutls DTLS log */
146	{ {"6", "buf"}, LOG_DEBUG },
147	{ {"7", "write", "read"}, LOG_DEBUG },
148	{ {"8"}, LOG_DEBUG },
149	{ {"9", "enc", "int"}, LOG_DEBUG },
150	};
151
152	static void log_func_gnutls(int level, const char *message) {	×
153	assert_se(message);	×
154
155	if (0 <= level && level < (int) ELEMENTSOF(gnutls_log_map)) {	×
156	if (gnutls_log_map[level].enabled)	×
157	log_internal(gnutls_log_map[level].level, 0, NULL, 0, NULL, "gnutls %d/%s: %s", level, gnutls_log_map[level].names[1], message);	×
158	} else {
159	log_debug("Received GNUTLS message with unknown level %d.", level);	×
160	log_internal(LOG_DEBUG, 0, NULL, 0, NULL, "gnutls: %s", message);	×
161	}
162	}	×
163
164	static void log_reset_gnutls_level(void) {	3✔
165	int i;	3✔
166
167	for (i = ELEMENTSOF(gnutls_log_map) - 1; i >= 0; i--)	27✔
168	if (gnutls_log_map[i].enabled) {	27✔
169	log_debug("Setting gnutls log level to %d", i);	3✔
170	sym_gnutls_global_set_log_level(i);	3✔
171	break;	3✔
172	}
173	}	3✔
174
175	static int log_enable_gnutls_category(const char *cat) {	×
176	if (streq(cat, "all")) {	×
177	FOREACH_ELEMENT(entry, gnutls_log_map)	×
178	entry->enabled = true;	×
179	log_reset_gnutls_level();	×
180	return 0;	×
181	} else
182	FOREACH_ELEMENT(entry, gnutls_log_map)	×
183	if (strv_contains((char**)entry->names, cat)) {	×
184	entry->enabled = true;	×
185	log_reset_gnutls_level();	×
186	return 0;	×
187	}
188	return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "No such log category: %s", cat);	×
189	}
190
191	int setup_gnutls_logger(char **categories) {	3✔
192	int r;	3✔
193
194	r = dlopen_gnutls(LOG_DEBUG);	3✔
195	if (r < 0) {	3✔
196	if (categories)	×
197	log_notice("Ignoring specified gnutls logging categories -- gnutls not available.");	×
198	else
199	log_debug("GnuTLS not available, skipping logger setup.");	×
200	return 0;
201	}
202
203	sym_gnutls_global_set_log_function(log_func_gnutls);	3✔
204
205	if (categories)	3✔
206	STRV_FOREACH(cat, categories) {	×
207	r = log_enable_gnutls_category(*cat);	×
208	if (r < 0)	×
209	return r;
210	}
211	else
212	log_reset_gnutls_level();	3✔
213
214	return 0;
215	}
216
217	static int verify_cert_authorized(gnutls_session_t session) {	10✔
218	unsigned status;	10✔
219	gnutls_certificate_type_t type;	10✔
220	gnutls_datum_t out;	10✔
221	int r;	10✔
222
223	r = sym_gnutls_certificate_verify_peers2(session, &status);	10✔
224	if (r < 0)	10✔
225	return log_error_errno(r, "gnutls_certificate_verify_peers2 failed: %m");	×
226
227	type = sym_gnutls_certificate_type_get(session);	10✔
228	r = sym_gnutls_certificate_verification_status_print(status, type, &out, 0);	10✔
229	if (r < 0)	10✔
230	return log_error_errno(r, "gnutls_certificate_verification_status_print failed: %m");	×
231
232	log_debug("Certificate status: %s", out.data);	10✔
233	/* gnutls_free is declared as a function pointer variable (not a function), so sym_gnutls_free
234	* ends up as a pointer-to-function-pointer and must be explicitly dereferenced to be called. */
235	(*sym_gnutls_free)(out.data);	10✔
236
237	return status == 0 ? 0 : -EPERM;	10✔
238	}
239
240	static int get_client_cert(gnutls_session_t session, gnutls_x509_crt_t *client_cert) {	10✔
241	const gnutls_datum_t *pcert;	10✔
242	unsigned listsize;	10✔
243	gnutls_x509_crt_t cert;	10✔
244	int r;	10✔
245
246	assert(session);	10✔
247	assert(client_cert);	10✔
248
249	pcert = sym_gnutls_certificate_get_peers(session, &listsize);	10✔
250	if (!pcert \|\| !listsize)	10✔
251	return log_error_errno(SYNTHETIC_ERRNO(EINVAL),	×
252	"Failed to retrieve certificate chain");
253
254	r = sym_gnutls_x509_crt_init(&cert);	10✔
255	if (r < 0) {	10✔
256	log_error("Failed to initialize client certificate");	×
257	return r;
258	}
259
260	/* Note that by passing values between 0 and listsize here, you
261	can get access to the CA's certs */
262	r = sym_gnutls_x509_crt_import(cert, &pcert[0], GNUTLS_X509_FMT_DER);	10✔
263	if (r < 0) {	10✔
264	log_error("Failed to import client certificate");	×
265	sym_gnutls_x509_crt_deinit(cert);	×
266	return r;	×
267	}
268
269	*client_cert = cert;	10✔
270	return 0;	10✔
271	}
272
273	static int get_auth_dn(gnutls_x509_crt_t client_cert, char **buf) {	10✔
274	size_t len = 0;	10✔
275	int r;	10✔
276
277	assert(buf);	10✔
278	assert(*buf == NULL);	10✔
279
280	r = sym_gnutls_x509_crt_get_dn(client_cert, NULL, &len);	10✔
281	if (r != GNUTLS_E_SHORT_MEMORY_BUFFER) {	10✔
282	log_error("gnutls_x509_crt_get_dn failed");	×
283	return r;	10✔
284	}
285
286	*buf = malloc(len);	10✔
287	if (!*buf)	10✔
288	return log_oom();	×
289
290	sym_gnutls_x509_crt_get_dn(client_cert, *buf, &len);	10✔
291	return 0;
292	}
293
294	static void gnutls_x509_crt_deinitp(gnutls_x509_crt_t *p) {	10✔
295	assert(p);	10✔
296
297	if (*p)	10✔
298	sym_gnutls_x509_crt_deinit(*p);	10✔
299	}	10✔
300
301	int check_permissions(struct MHD_Connection connection, int code, char **hostname) {	10✔
302	const union MHD_ConnectionInfo *ci;	10✔
303	gnutls_session_t session;	10✔
304	_cleanup_(gnutls_x509_crt_deinitp) gnutls_x509_crt_t client_cert = NULL;	×
305	_cleanup_free_ char *buf = NULL;	10✔
306	int r;	10✔
307
308	assert(connection);	10✔
309	assert(code);	10✔
310
311	*code = 0;	10✔
312
313	r = dlopen_gnutls(LOG_ERR);	10✔
314	if (r < 0)	10✔
315	return r;
316
317	ci = sym_MHD_get_connection_info(connection,	10✔
318	MHD_CONNECTION_INFO_GNUTLS_SESSION);
319	if (!ci) {	10✔
320	log_error("MHD_get_connection_info failed: session is unencrypted");	×
321	*code = mhd_respond(connection, MHD_HTTP_FORBIDDEN,	×
322	"Encrypted connection is required");
323	return -EPERM;	×
324	}
325	session = ci->tls_session;	10✔
326	assert(session);	10✔
327
328	r = get_client_cert(session, &client_cert);	10✔
329	if (r < 0) {	10✔
330	*code = mhd_respond(connection, MHD_HTTP_UNAUTHORIZED,	×
331	"Authorization through certificate is required");
332	return -EPERM;	×
333	}
334
335	r = get_auth_dn(client_cert, &buf);	10✔
336	if (r < 0) {	10✔
337	*code = mhd_respond(connection, MHD_HTTP_UNAUTHORIZED,	×
338	"Failed to determine distinguished name from certificate");
339	return -EPERM;	×
340	}
341
342	log_debug("Connection from %s", buf);	10✔
343
344	if (hostname)	10✔
345	*hostname = TAKE_PTR(buf);	10✔
346
347	r = verify_cert_authorized(session);	10✔
348	if (r < 0) {	10✔
349	log_warning("Client is not authorized");	×
350	*code = mhd_respond(connection, MHD_HTTP_UNAUTHORIZED,	×
351	"Client certificate not signed by recognized authority");
352	}
353	return r;
354	}
355
356	#else
357	_noreturn_ int check_permissions(struct MHD_Connection connection, int code, char **hostname) {
358	assert_not_reached();
359	}
360
361	int setup_gnutls_logger(char **categories) {
362	if (categories)
363	log_notice("Ignoring specified gnutls logging categories — gnutls not available.");
364	return 0;
365	}
366	#endif
367
368	#endif

systemd / systemd / 29132483780

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous