base/SOURCES/0067-ureport-use-additional-HTTP-headers-with-rhsm-entitl.patch

From 4f61f5d9eec75e471c8176dac0c21f4361e40ee6 Mon Sep 17 00:00:00 2001
From: Jakub Filak <jfilak@redhat.com>
Date: Thu, 11 Sep 2014 12:33:05 +0200
Subject: [LIBREPORT PATCH 67/93] ureport: use additional HTTP headers with
 'rhsm-entitlement' cert auth

Related to rhbz#1140224

Signed-off-by: Jakub Filak <jfilak@redhat.com>

Conflicts:
	src/plugins/ureport.conf
---
 src/lib/json.c           | 29 +++++++++++----
 src/lib/ureport.h        |  1 +
 src/plugins/ureport.c    | 94 +++++++++++++++++++++++++++++++++++++++++++++++-
 src/plugins/ureport.conf |  4 ++-
 4 files changed, 119 insertions(+), 9 deletions(-)

diff --git a/src/lib/json.c b/src/lib/json.c
index 8935ef8..6fbbf39 100644
--- a/src/lib/json.c
+++ b/src/lib/json.c
@@ -113,14 +113,25 @@ struct post_state *post_ureport(const char *json, struct ureport_server_config *
         post_state->client_key_path = config->ur_client_key;
     }
 
-    static const char *headers[] = {
-        "Accept: application/json",
-        "Connection: close",
-        NULL,
-    };
+    char **headers = xmalloc(sizeof(char *) * (3 + size_map_string(config->ur_http_headers)));
+    headers[0] = (char *)"Accept: application/json";
+    headers[1] = (char *)"Connection: close";
+    headers[2] = NULL;
+
+    if (config->ur_http_headers != NULL)
+    {
+        unsigned i = 2;
+        const char *header;
+        const char *value;
+        map_string_iter_t iter;
+        init_map_string_iter(&iter, config->ur_http_headers);
+        while (next_map_string_iter(&iter, &header, &value))
+            headers[i++] = xasprintf("%s: %s", header, value);
+        headers[i] = NULL;
+    }
 
     post_string_as_form_data(post_state, config->ur_url, "application/json",
-                     headers, json);
+                    (const char **)headers, json);
 
     /* Client authentication failed. Try again without client auth.
      * CURLE_SSL_CONNECT_ERROR - cert not found/server doesnt trust the CA
@@ -135,10 +146,14 @@ struct post_state *post_ureport(const char *json, struct ureport_server_config *
         post_state = new_post_state(flags);
 
         post_string_as_form_data(post_state, config->ur_url, "application/json",
-                         headers, json);
+                         (const char **)headers, json);
 
     }
 
+    for (unsigned i = size_map_string(config->ur_http_headers); i != 0; --i)
+        free(headers[i + 1]);
+    free(headers);
+
     return post_state;
 }
 
diff --git a/src/lib/ureport.h b/src/lib/ureport.h
index ca1d538..319aca9 100644
--- a/src/lib/ureport.h
+++ b/src/lib/ureport.h
@@ -43,6 +43,7 @@ struct ureport_server_config
     char *ur_client_cert; ///< Path to certificate used for client
                           ///< authentication (or NULL)
     char *ur_client_key;  ///< Private key for the certificate
+    map_string_t *ur_http_headers; ///< Additional HTTP headers
 
     struct ureport_preferences ur_prefs; ///< configuration for uReport generation
 };
diff --git a/src/plugins/ureport.c b/src/plugins/ureport.c
index d23cc79..9c69cad 100644
--- a/src/plugins/ureport.c
+++ b/src/plugins/ureport.c
@@ -31,6 +31,12 @@
 #define RHSM_CERT_PATH "/etc/pki/consumer/cert.pem"
 #define RHSM_KEY_PATH "/etc/pki/consumer/key.pem"
 
+#define RHAP_PEM_DIR_PATH "/etc/pki/entitlement"
+#define RHAP_ENT_DATA_BEGIN_TAG "-----BEGIN ENTITLEMENT DATA-----"
+#define RHAP_ENT_DATA_END_TAG "-----END ENTITLEMENT DATA-----"
+#define RHAP_SIG_DATA_BEGIN_TAG "-----BEGIN RSA SIGNATURE-----"
+#define RHAP_SIG_DATA_END_TAG "-----END RSA SIGNATURE-----"
+
 #define VALUE_FROM_CONF(opt, var, tr) do { const char *value = getenv("uReport_"opt); \
         if (!value) { value = get_map_string_item_or_NULL(settings, opt); } if (value) { var = tr(value); } \
     } while(0)
@@ -72,6 +78,88 @@ static void parse_client_auth_paths(struct ureport_server_config *config, const
         config->ur_client_cert = xstrdup(RHSM_CERT_PATH);
         config->ur_client_key = xstrdup(RHSM_KEY_PATH);
     }
+    else if (strcmp(client_auth, "rhsm-entitlement") == 0)
+    {
+        GList *certs = get_file_list(RHAP_PEM_DIR_PATH, "pem");
+        if (g_list_length(certs) != 2)
+        {
+            log_notice(RHAP_PEM_DIR_PATH" does not contain unique cert-key files pair");
+            log_notice("Not using client authentication");
+            return;
+        }
+
+        const char *cert = NULL;
+        const char *key = NULL;
+
+        file_obj_t *fst = (file_obj_t *)certs->data;
+        file_obj_t *scn = (file_obj_t *)certs->next->data;
+
+        if (strlen(fo_get_filename(fst)) < strlen(fo_get_filename(scn)))
+        {
+            cert = fo_get_filename(fst);
+            key = fo_get_filename(scn);
+
+            config->ur_client_cert = xstrdup(fo_get_fullpath(fst));
+            config->ur_client_key = xstrdup(fo_get_fullpath(scn));
+        }
+        else
+        {
+            cert = fo_get_filename(scn);
+            key = fo_get_filename(fst);
+
+            config->ur_client_cert = xstrdup(fo_get_fullpath(scn));
+            config->ur_client_key = xstrdup(fo_get_fullpath(fst));
+        }
+
+        const bool iscomplement = prefixcmp(key, cert) != 0 || strcmp("-key", key + strlen(cert)) != 0;
+        g_list_free_full(certs, (GDestroyNotify)free_file_obj);
+
+        if (iscomplement)
+        {
+            log_notice("Key file '%s' isn't complement to cert file '%s'",
+                    config->ur_client_key, config->ur_client_cert);
+            log_notice("Not using client authentication");
+
+            free(config->ur_client_cert);
+            free(config->ur_client_key);
+            config->ur_client_cert = NULL;
+            config->ur_client_key = NULL;
+
+            return;
+        }
+
+        char *certdata = xmalloc_open_read_close(config->ur_client_cert, /*no size limit*/NULL);
+        if (certdata != NULL)
+        {
+            char *ent_data = xstrdup_between(certdata,
+                    RHAP_ENT_DATA_BEGIN_TAG, RHAP_ENT_DATA_END_TAG);
+
+            char *sig_data = xstrdup_between(certdata,
+                    RHAP_SIG_DATA_BEGIN_TAG, RHAP_SIG_DATA_END_TAG);
+
+            if (ent_data != NULL && sig_data != NULL)
+            {
+                ent_data = strremovech(ent_data, '\n');
+                insert_map_string(config->ur_http_headers,
+                        xstrdup("X-RH-Entitlement-Data"),
+                        xasprintf(RHAP_ENT_DATA_BEGIN_TAG"%s"RHAP_ENT_DATA_END_TAG, ent_data));
+
+                sig_data = strremovech(sig_data, '\n');
+                insert_map_string(config->ur_http_headers,
+                        xstrdup("X-RH-Entitlement-Sig"),
+                        xasprintf(RHAP_SIG_DATA_BEGIN_TAG"%s"RHAP_SIG_DATA_END_TAG, sig_data));
+            }
+            else
+            {
+                log_notice("Cert file '%s' doesn't contain Entitlement and RSA Signature sections", config->ur_client_cert);
+                log_notice("Not using HTTP authentication headers");
+            }
+
+            free(sig_data);
+            free(ent_data);
+            free(certdata);
+        }
+    }
     else if (strcmp(client_auth, "puppet") == 0)
     {
         config->ur_client_cert = puppet_config_print("hostcert");
@@ -83,7 +171,6 @@ static void parse_client_auth_paths(struct ureport_server_config *config, const
         config->ur_client_cert = xstrdup(strtok(scratch, ":"));
         config->ur_client_key = xstrdup(strtok(NULL, ":"));
         free(scratch);
-
         if (config->ur_client_cert == NULL || config->ur_client_key == NULL)
             error_msg_and_die("Invalid client authentication specification");
     }
@@ -426,11 +513,14 @@ int main(int argc, char **argv)
         .ur_ssl_verify = true,
         .ur_client_cert = NULL,
         .ur_client_key = NULL,
+        .ur_http_headers = NULL,
         {
             .urp_auth_items = NULL,
         },
     };
 
+    config.ur_http_headers = new_map_string();
+
     enum {
         OPT_v = 1 << 0,
         OPT_d = 1 << 1,
@@ -677,6 +767,8 @@ finalize:
     if (config.ur_prefs.urp_auth_items != auth_items)
         g_list_free_full(config.ur_prefs.urp_auth_items, free);
 
+    free_map_string(config.ur_http_headers);
+
     free_map_string(settings);
     free(config.ur_client_cert);
     free(config.ur_client_key);
diff --git a/src/plugins/ureport.conf b/src/plugins/ureport.conf
index 8abeb26..fc0dc21 100644
--- a/src/plugins/ureport.conf
+++ b/src/plugins/ureport.conf
@@ -19,7 +19,9 @@ AuthDataItems = hostname, machineid
 # None (default):
 # SSLClientAuth =
 # Using RH subscription management certificate:
-SSLClientAuth = rhsm
+# SSLClientAuth = rhsm
+# Using RH subscription management entitlement certificate:
+# SSLClientAuth = rhsm-entitlement
 # Using Puppet certificate:
 # SSLClientAuth = puppet
 # Using custom certificate:
-- 
1.8.3.1