1 /* 2 * QEMU crypto TLS credential support 3 * 4 * Copyright (c) 2015 Red Hat, Inc. 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2.1 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 * 19 */ 20 21 #include "qemu/osdep.h" 22 #include "qapi/error.h" 23 #include "qapi-types-crypto.h" 24 #include "qemu/module.h" 25 #include "tlscredspriv.h" 26 #include "trace.h" 27 28 #define DH_BITS 2048 29 30 #ifdef CONFIG_GNUTLS 31 int 32 qcrypto_tls_creds_get_dh_params_file(QCryptoTLSCreds *creds, 33 const char *filename, 34 gnutls_dh_params_t *dh_params, 35 Error **errp) 36 { 37 int ret; 38 39 trace_qcrypto_tls_creds_load_dh(creds, filename ? filename : "<generated>"); 40 41 if (filename == NULL) { 42 ret = gnutls_dh_params_init(dh_params); 43 if (ret < 0) { 44 error_setg(errp, "Unable to initialize DH parameters: %s", 45 gnutls_strerror(ret)); 46 return -1; 47 } 48 ret = gnutls_dh_params_generate2(*dh_params, DH_BITS); 49 if (ret < 0) { 50 gnutls_dh_params_deinit(*dh_params); 51 *dh_params = NULL; 52 error_setg(errp, "Unable to generate DH parameters: %s", 53 gnutls_strerror(ret)); 54 return -1; 55 } 56 } else { 57 GError *gerr = NULL; 58 gchar *contents; 59 gsize len; 60 gnutls_datum_t data; 61 if (!g_file_get_contents(filename, 62 &contents, 63 &len, 64 &gerr)) { 65 66 error_setg(errp, "%s", gerr->message); 67 g_error_free(gerr); 68 return -1; 69 } 70 data.data = (unsigned char *)contents; 71 data.size = len; 72 ret = gnutls_dh_params_init(dh_params); 73 if (ret < 0) { 74 g_free(contents); 75 error_setg(errp, "Unable to initialize DH parameters: %s", 76 gnutls_strerror(ret)); 77 return -1; 78 } 79 ret = gnutls_dh_params_import_pkcs3(*dh_params, 80 &data, 81 GNUTLS_X509_FMT_PEM); 82 g_free(contents); 83 if (ret < 0) { 84 gnutls_dh_params_deinit(*dh_params); 85 *dh_params = NULL; 86 error_setg(errp, "Unable to load DH parameters from %s: %s", 87 filename, gnutls_strerror(ret)); 88 return -1; 89 } 90 } 91 92 return 0; 93 } 94 95 96 int 97 qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds, 98 const char *filename, 99 bool required, 100 char **cred, 101 Error **errp) 102 { 103 struct stat sb; 104 int ret = -1; 105 106 if (!creds->dir) { 107 if (required) { 108 error_setg(errp, "Missing 'dir' property value"); 109 return -1; 110 } else { 111 return 0; 112 } 113 } 114 115 *cred = g_strdup_printf("%s/%s", creds->dir, filename); 116 117 if (stat(*cred, &sb) < 0) { 118 if (errno == ENOENT && !required) { 119 ret = 0; 120 } else { 121 error_setg_errno(errp, errno, 122 "Unable to access credentials %s", 123 *cred); 124 } 125 g_free(*cred); 126 *cred = NULL; 127 goto cleanup; 128 } 129 130 ret = 0; 131 cleanup: 132 trace_qcrypto_tls_creds_get_path(creds, filename, 133 *cred ? *cred : "<none>"); 134 return ret; 135 } 136 137 138 #endif /* ! CONFIG_GNUTLS */ 139 140 141 static void 142 qcrypto_tls_creds_prop_set_verify(Object *obj, 143 bool value, 144 Error **errp G_GNUC_UNUSED) 145 { 146 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 147 148 creds->verifyPeer = value; 149 } 150 151 152 static bool 153 qcrypto_tls_creds_prop_get_verify(Object *obj, 154 Error **errp G_GNUC_UNUSED) 155 { 156 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 157 158 return creds->verifyPeer; 159 } 160 161 162 static void 163 qcrypto_tls_creds_prop_set_dir(Object *obj, 164 const char *value, 165 Error **errp G_GNUC_UNUSED) 166 { 167 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 168 169 creds->dir = g_strdup(value); 170 } 171 172 173 static char * 174 qcrypto_tls_creds_prop_get_dir(Object *obj, 175 Error **errp G_GNUC_UNUSED) 176 { 177 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 178 179 return g_strdup(creds->dir); 180 } 181 182 183 static void 184 qcrypto_tls_creds_prop_set_priority(Object *obj, 185 const char *value, 186 Error **errp G_GNUC_UNUSED) 187 { 188 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 189 190 creds->priority = g_strdup(value); 191 } 192 193 194 static char * 195 qcrypto_tls_creds_prop_get_priority(Object *obj, 196 Error **errp G_GNUC_UNUSED) 197 { 198 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 199 200 return g_strdup(creds->priority); 201 } 202 203 204 static void 205 qcrypto_tls_creds_prop_set_endpoint(Object *obj, 206 int value, 207 Error **errp G_GNUC_UNUSED) 208 { 209 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 210 211 creds->endpoint = value; 212 } 213 214 215 static int 216 qcrypto_tls_creds_prop_get_endpoint(Object *obj, 217 Error **errp G_GNUC_UNUSED) 218 { 219 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 220 221 return creds->endpoint; 222 } 223 224 225 static void 226 qcrypto_tls_creds_class_init(ObjectClass *oc, void *data) 227 { 228 object_class_property_add_bool(oc, "verify-peer", 229 qcrypto_tls_creds_prop_get_verify, 230 qcrypto_tls_creds_prop_set_verify); 231 object_class_property_add_str(oc, "dir", 232 qcrypto_tls_creds_prop_get_dir, 233 qcrypto_tls_creds_prop_set_dir); 234 object_class_property_add_enum(oc, "endpoint", 235 "QCryptoTLSCredsEndpoint", 236 &QCryptoTLSCredsEndpoint_lookup, 237 qcrypto_tls_creds_prop_get_endpoint, 238 qcrypto_tls_creds_prop_set_endpoint); 239 object_class_property_add_str(oc, "priority", 240 qcrypto_tls_creds_prop_get_priority, 241 qcrypto_tls_creds_prop_set_priority); 242 } 243 244 245 static void 246 qcrypto_tls_creds_init(Object *obj) 247 { 248 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 249 250 creds->verifyPeer = true; 251 } 252 253 254 static void 255 qcrypto_tls_creds_finalize(Object *obj) 256 { 257 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 258 259 g_free(creds->dir); 260 g_free(creds->priority); 261 } 262 263 bool qcrypto_tls_creds_check_endpoint(QCryptoTLSCreds *creds, 264 QCryptoTLSCredsEndpoint endpoint, 265 Error **errp) 266 { 267 if (creds->endpoint != endpoint) { 268 error_setg(errp, "Expected TLS credentials for a %s endpoint", 269 QCryptoTLSCredsEndpoint_str(endpoint)); 270 return false; 271 } 272 return true; 273 } 274 275 static const TypeInfo qcrypto_tls_creds_info = { 276 .parent = TYPE_OBJECT, 277 .name = TYPE_QCRYPTO_TLS_CREDS, 278 .instance_size = sizeof(QCryptoTLSCreds), 279 .instance_init = qcrypto_tls_creds_init, 280 .instance_finalize = qcrypto_tls_creds_finalize, 281 .class_init = qcrypto_tls_creds_class_init, 282 .class_size = sizeof(QCryptoTLSCredsClass), 283 .abstract = true, 284 }; 285 286 287 static void 288 qcrypto_tls_creds_register_types(void) 289 { 290 type_register_static(&qcrypto_tls_creds_info); 291 } 292 293 294 type_init(qcrypto_tls_creds_register_types); 295