Greenbone Security Assistant
7.0.3~git
|
Main module of Greenbone Security Assistant daemon. More...
#include <arpa/inet.h>
#include <assert.h>
#include <errno.h>
#include <gcrypt.h>
#include <glib.h>
#include <gnutls/gnutls.h>
#include <langinfo.h>
#include <locale.h>
#include <netinet/in.h>
#include <openvas/misc/openvas_logging.h>
#include <openvas/base/openvas_file.h>
#include <openvas/base/openvas_networking.h>
#include <openvas/base/pidfile.h>
#include <openvas/omp/xml.h>
#include <openvas/misc/openvas_uuid.h>
#include <pthread.h>
#include <pwd.h>
#include <grp.h>
#include <signal.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#include <microhttpd.h>
#include "gsad_base.h"
#include "gsad_omp.h"
#include "validator.h"
#include "xslt_i18n.h"
Go to the source code of this file.
Data Structures | |
struct | user |
User information structure, for sessions. More... | |
Macros | |
#define | _GNU_SOURCE /* for strcasecmp */ |
The Glib fatal mask, redefined to leave out G_LOG_FLAG_RECURSION. More... | |
#define | G_LOG_DOMAIN "gsad main" |
GLib log domain. More... | |
#define | G_LOG_FATAL_MASK G_LOG_LEVEL_ERROR |
#define | MHD_HTTP_NOT_ACCEPTABLE MHD_HTTP_METHOD_NOT_ACCEPTABLE |
The symbol is deprecated, but older versions (0.9.37 - Debian jessie) don't define it yet. More... | |
#define | SID_COOKIE_NAME "GSAD_SID" |
Name of the cookie used to store the SID. More... | |
#define | DEFAULT_GSAD_HTTPS_PORT 443 |
Fallback GSAD port for HTTPS. More... | |
#define | DEFAULT_GSAD_HTTP_PORT 80 |
Fallback GSAD port for HTTP. More... | |
#define | DEFAULT_GSAD_PORT 9392 |
Fallback unprivileged GSAD port. More... | |
#define | DEFAULT_GSAD_REDIRECT_PORT 80 |
Fallback GSAD port. More... | |
#define | DEFAULT_OPENVAS_MANAGER_PORT 9390 |
Fallback Manager port. More... | |
#define | POST_BUFFER_SIZE 500000 |
Buffer size for POST processor. More... | |
#define | MAX_FILE_NAME_SIZE 128 |
Maximum length of "file name" for /help/ URLs. More... | |
#define | SESSION_TIMEOUT 15 |
Max number of minutes between activity in a session. More... | |
#define | DEFAULT_CLIENT_WATCH_INTERVAL 1 |
Default value for client_watch_interval. More... | |
#define | DEFAULT_GSAD_FACE "classic" |
Default face name. More... | |
#define | DEFAULT_GSAD_X_FRAME_OPTIONS "SAMEORIGIN" |
Default value for HTTP header "X-Frame-Options". More... | |
#define | DEFAULT_GSAD_CONTENT_SECURITY_POLICY |
Default value for HTTP header "Content-Security-Policy". More... | |
#define | DEFAULT_GSAD_GUEST_CHART_X_FRAME_OPTIONS "SAMEORIGIN" |
Default value for HTTP header "X-Frame-Options" for guest charts. More... | |
#define | DEFAULT_GSAD_GUEST_CHART_CONTENT_SECURITY_POLICY |
Default guest charts value for HTTP header "Content-Security-Policy". More... | |
#define | DEFAULT_GSAD_HSTS_MAX_AGE 31536000 |
Default "max-age" for HTTP header "Strict-Transport-Security". More... | |
#define | UTF8_ERROR_PAGE(location) |
#define | HOST_HEADER_ERROR_PAGE |
#define | USER_OK 0 |
#define | USER_BAD_TOKEN 1 |
#define | USER_EXPIRED_TOKEN 2 |
#define | USER_BAD_MISSING_COOKIE 3 |
#define | USER_BAD_MISSING_TOKEN 4 |
#define | USER_GUEST_LOGIN_FAILED 5 |
#define | USER_OMP_DOWN 6 |
#define | USER_IP_ADDRESS_MISSMATCH 7 |
#define | USER_GUEST_LOGIN_ERROR -1 |
#define | ELSE(name) |
#define | ELSE(name) |
#define | EXPIRES_LENGTH 100 |
#define | MAX_HOST_LEN 1000 |
#define | DATE_2822_LEN 100 |
Typedefs | |
typedef struct user | user_t |
User information type, for sessions. More... | |
Functions | |
void | add_security_headers (struct MHD_Response *response) |
Add security headers to a MHD response. More... | |
void | add_guest_chart_content_security_headers (struct MHD_Response *response) |
Add guest chart content security headers to a MHD response. More... | |
user_t * | user_add (const gchar *username, const gchar *password, const gchar *timezone, const gchar *severity, const gchar *role, const gchar *capabilities, const gchar *language, const gchar *pw_warning, GTree *chart_prefs, const gchar *autorefresh, const char *address) |
Add a user. More... | |
int | user_find (const gchar *cookie, const gchar *token, const char *address, user_t **user_return) |
Find a user, given a token and cookie. More... | |
int | user_set_timezone (const gchar *token, const gchar *timezone) |
Set timezone of user. More... | |
int | user_set_password (const gchar *token, const gchar *password) |
Set password of user. More... | |
int | user_set_severity (const gchar *token, const gchar *severity) |
Set severity class of user. More... | |
int | user_set_language (const gchar *token, const gchar *language) |
Set language of user. More... | |
int | user_set_charts (const gchar *token, const int charts) |
Set charts setting of user. More... | |
int | user_set_chart_pref (const gchar *token, gchar *pref_id, gchar *pref_value) |
Set a chart preference of a user. More... | |
int | user_set_autorefresh (const gchar *token, const gchar *autorefresh) |
Set default autorefresh interval of user. More... | |
int | user_logout_all_sessions (const gchar *username, credentials_t *credentials) |
Logs out all sessions of a given user, except the current one. More... | |
void | user_release (user_t *user) |
Release a user_t returned by user_add or user_find. More... | |
void | user_remove (user_t *user) |
Remove a user from the session "database", releasing the user_t too. More... | |
int | token_user (const gchar *token, user_t **user_return) |
Find a user, given a token. More... | |
int | token_user_remove (const char *token) |
Remove a user from the session "database", releasing the user_t too. More... | |
void | init_validator () |
Initialise the parameter validator. More... | |
Variables | |
volatile int | termination_signal = 0 |
Flag for signal handler. More... | |
GCRY_THREAD_OPTION_PTHREAD_IMPL | |
Libgcrypt thread callback definition for libgcrypt < 1.6.0. More... | |
const char * | NOT_FOUND_TITLE = "Invalid request" |
Title for "Page not found" messages. More... | |
const char * | NOT_FOUND_MESSAGE = "The requested page or file does not exist." |
Main message for "Page not found" messages. More... | |
const char * | ERROR_PAGE = "<html><body>HTTP Method not supported</body></html>" |
Error page HTML. More... | |
char * | BAD_REQUEST_PAGE |
Bad request error HTML. More... | |
char * | SERVER_ERROR |
Server error HTML. More... | |
struct MHD_Daemon * | gsad_daemon |
The handle on the embedded HTTP daemon. More... | |
GSList * | address_list = NULL |
The IP addresses of this program, "the GSAD". More... | |
GHashTable * | gsad_header_hosts = NULL |
Host names and IP accepted in the "Host" HTTP header. More... | |
gchar * | redirect_location = NULL |
Location for redirection server. More... | |
pid_t | redirect_pid = 0 |
PID of redirect child in parent, 0 in child. More... | |
pid_t | unix_pid = 0 |
PID of unix socket child in parent, 0 in child. More... | |
int | unix_socket = 0 |
Unix socket to listen on. More... | |
GSList * | log_config = NULL |
Logging parameters, as passed to setup_log_handlers. More... | |
int | use_secure_cookie = 1 |
Whether to use a secure cookie. More... | |
int | session_timeout |
Maximum number of minutes of user idle time. More... | |
gchar * | guest_username = NULL |
Guest username. More... | |
gchar * | guest_password = NULL |
Guest password. More... | |
GPtrArray * | users = NULL |
User session data. More... | |
gchar * | http_x_frame_options |
Current value for HTTP header "X-Frame-Options". More... | |
gchar * | http_content_security_policy |
Current value for HTTP header "Content-Security-Policy". More... | |
gchar * | http_guest_chart_x_frame_options |
Current guest chart specific value for HTTP header "X-Frame-Options". More... | |
gchar * | http_guest_chart_content_security_policy |
Current guest chart value for HTTP header "Content-Security-Policy". More... | |
gchar * | http_strict_transport_security |
Current value of for HTTP header "Strict-Transport-Security". More... | |
gboolean | ignore_http_x_real_ip |
Current preference for using X_Real_IP from HTTP header. More... | |
int | chroot_state = 0 |
Whether chroot is used. More... | |
int | client_watch_interval = DEFAULT_CLIENT_WATCH_INTERVAL |
Interval in seconds to check whether client connection was closed. More... | |
validator_t | validator |
Parameter validator. More... | |
Main module of Greenbone Security Assistant daemon.
This file contains the core of the GSA server process that handles HTTPS requests and communicates with OpenVAS-Manager via the OMP protocol.
Definition in file gsad.c.
#define _GNU_SOURCE /* for strcasecmp */ |
#define DATE_2822_LEN 100 |
#define DEFAULT_CLIENT_WATCH_INTERVAL 1 |
#define DEFAULT_GSAD_CONTENT_SECURITY_POLICY |
#define DEFAULT_GSAD_GUEST_CHART_CONTENT_SECURITY_POLICY |
#define DEFAULT_GSAD_GUEST_CHART_X_FRAME_OPTIONS "SAMEORIGIN" |
#define DEFAULT_GSAD_HSTS_MAX_AGE 31536000 |
#define DEFAULT_GSAD_HTTP_PORT 80 |
#define DEFAULT_GSAD_HTTPS_PORT 443 |
#define DEFAULT_GSAD_PORT 9392 |
#define DEFAULT_GSAD_X_FRAME_OPTIONS "SAMEORIGIN" |
#define DEFAULT_OPENVAS_MANAGER_PORT 9390 |
#define ELSE | ( | name | ) |
#define ELSE | ( | name | ) |
#define EXPIRES_LENGTH 100 |
#define HOST_HEADER_ERROR_PAGE |
#define MAX_FILE_NAME_SIZE 128 |
#define MAX_HOST_LEN 1000 |
#define MHD_HTTP_NOT_ACCEPTABLE MHD_HTTP_METHOD_NOT_ACCEPTABLE |
#define POST_BUFFER_SIZE 500000 |
#define SESSION_TIMEOUT 15 |
#define SID_COOKIE_NAME "GSAD_SID" |
#define USER_BAD_MISSING_TOKEN 4 |
Definition at line 517 of file gsad.c.
Referenced by user_find().
#define UTF8_ERROR_PAGE | ( | location | ) |
void add_guest_chart_content_security_headers | ( | struct MHD_Response * | response | ) |
Add guest chart content security headers to a MHD response.
Definition at line 403 of file gsad.c.
References http_content_security_policy, http_guest_chart_content_security_policy, http_guest_chart_x_frame_options, and http_x_frame_options.
void add_security_headers | ( | struct MHD_Response * | response | ) |
Add security headers to a MHD response.
Definition at line 386 of file gsad.c.
References http_content_security_policy, http_strict_transport_security, and http_x_frame_options.
void init_validator | ( | ) |
Initialise the parameter validator.
Definition at line 999 of file gsad.c.
References openvas_validator_add(), openvas_validator_alias(), openvas_validator_new(), and validator.
int token_user | ( | const gchar * | token, |
user_t ** | user_return | ||
) |
Find a user, given a token.
If a user is returned, it's up to the caller to release the user.
[in] | token | Token request parameter. |
[out] | user_return | User. |
Definition at line 938 of file gsad.c.
Referenced by token_user_remove().
int token_user_remove | ( | const char * | token | ) |
Remove a user from the session "database", releasing the user_t too.
[in] | token | User's token. |
Definition at line 980 of file gsad.c.
References user::token, token_user(), and users.
Referenced by logout().
user_t* user_add | ( | const gchar * | username, |
const gchar * | password, | ||
const gchar * | timezone, | ||
const gchar * | severity, | ||
const gchar * | role, | ||
const gchar * | capabilities, | ||
const gchar * | language, | ||
const gchar * | pw_warning, | ||
GTree * | chart_prefs, | ||
const gchar * | autorefresh, | ||
const char * | address | ||
) |
Add a user.
Creates and initializes a user object with given parameters
It's up to the caller to release the returned user.
[in] | username | Name of user. |
[in] | password | Password for user. |
[in] | timezone | Timezone of user. |
[in] | severity | Severity class setting of user. |
[in] | role | Role of user. |
[in] | capabilities | Capabilities of manager. |
[in] | language | User Interface Language (language name or code) |
[in] | pw_warning | Password policy warning. |
[in] | chart_prefs | The chart preferences. |
[in] | autorefresh | The autorefresh preference. |
[in] | address | Client's IP address. |
Definition at line 469 of file gsad.c.
int user_find | ( | const gchar * | cookie, |
const gchar * | token, | ||
const char * | address, | ||
user_t ** | user_return | ||
) |
Find a user, given a token and cookie.
If a user is returned, it's up to the caller to release the user.
[in] | cookie | Token in cookie. |
[in] | token | Token request parameter. |
[in] | address | Client's IP address. |
[out] | user_return | User. |
Definition at line 539 of file gsad.c.
References user::autorefresh, user::capabilities, user::chart_prefs, user::cookie, guest_username, user::language, user::pw_warning, user::role, user::severity, user::timezone, user::token, and USER_BAD_MISSING_TOKEN.
int user_logout_all_sessions | ( | const gchar * | username, |
credentials_t * | credentials | ||
) |
void user_release | ( | user_t * | user | ) |
void user_remove | ( | user_t * | user | ) |
int user_set_autorefresh | ( | const gchar * | token, |
const gchar * | autorefresh | ||
) |
int user_set_chart_pref | ( | const gchar * | token, |
gchar * | pref_id, | ||
gchar * | pref_value | ||
) |
int user_set_charts | ( | const gchar * | token, |
const int | charts | ||
) |
int user_set_language | ( | const gchar * | token, |
const gchar * | language | ||
) |
Set language of user.
[in] | token | User token. |
[in] | language | Language. |
Definition at line 762 of file gsad.c.
int user_set_password | ( | const gchar * | token, |
const gchar * | password | ||
) |
int user_set_severity | ( | const gchar * | token, |
const gchar * | severity | ||
) |
int user_set_timezone | ( | const gchar * | token, |
const gchar * | timezone | ||
) |
GSList* address_list = NULL |
char* BAD_REQUEST_PAGE |
int chroot_state = 0 |
Whether chroot is used.
Definition at line 375 of file gsad.c.
Referenced by get_chroot_state(), and set_chroot_state().
int client_watch_interval = DEFAULT_CLIENT_WATCH_INTERVAL |
const char* ERROR_PAGE = "<html><body>HTTP Method not supported</body></html>" |
GCRY_THREAD_OPTION_PTHREAD_IMPL |
struct MHD_Daemon* gsad_daemon |
GHashTable* gsad_header_hosts = NULL |
gchar* guest_username = NULL |
gchar* http_content_security_policy |
Current value for HTTP header "Content-Security-Policy".
Definition at line 350 of file gsad.c.
Referenced by add_guest_chart_content_security_headers(), and add_security_headers().
gchar* http_guest_chart_content_security_policy |
Current guest chart value for HTTP header "Content-Security-Policy".
Definition at line 360 of file gsad.c.
Referenced by add_guest_chart_content_security_headers().
gchar* http_guest_chart_x_frame_options |
Current guest chart specific value for HTTP header "X-Frame-Options".
Definition at line 355 of file gsad.c.
Referenced by add_guest_chart_content_security_headers().
gchar* http_strict_transport_security |
Current value of for HTTP header "Strict-Transport-Security".
Definition at line 365 of file gsad.c.
Referenced by add_security_headers().
gchar* http_x_frame_options |
Current value for HTTP header "X-Frame-Options".
Definition at line 345 of file gsad.c.
Referenced by add_guest_chart_content_security_headers(), and add_security_headers().
gboolean ignore_http_x_real_ip |
GSList* log_config = NULL |
const char* NOT_FOUND_MESSAGE = "The requested page or file does not exist." |
const char* NOT_FOUND_TITLE = "Invalid request" |
gchar* redirect_location = NULL |
pid_t redirect_pid = 0 |
char* SERVER_ERROR |
int session_timeout |
pid_t unix_pid = 0 |
int use_secure_cookie = 1 |
GPtrArray* users = NULL |
User session data.
Definition at line 340 of file gsad.c.
Referenced by create_group_omp(), create_role_omp(), save_group_omp(), save_role_omp(), token_user_remove(), and user_remove().
validator_t validator |
Parameter validator.
Definition at line 993 of file gsad.c.
Referenced by init_validator(), openvas_validate(), openvas_validator_add(), openvas_validator_alias(), openvas_validator_alias_for(), and openvas_validator_free().