1 /* 2 * QEMU crypto TLS credential support 3 * 4 * Copyright (c) 2015 Red Hat, Inc. 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 * 19 */ 20 21 #include "crypto/tlscredspriv.h" 22 #include "trace.h" 23 24 #define DH_BITS 2048 25 26 #ifdef CONFIG_GNUTLS 27 int 28 qcrypto_tls_creds_get_dh_params_file(QCryptoTLSCreds *creds, 29 const char *filename, 30 gnutls_dh_params_t *dh_params, 31 Error **errp) 32 { 33 int ret; 34 35 trace_qcrypto_tls_creds_load_dh(creds, filename ? filename : "<generated>"); 36 37 if (filename == NULL) { 38 ret = gnutls_dh_params_init(dh_params); 39 if (ret < 0) { 40 error_setg(errp, "Unable to initialize DH parameters: %s", 41 gnutls_strerror(ret)); 42 return -1; 43 } 44 ret = gnutls_dh_params_generate2(*dh_params, DH_BITS); 45 if (ret < 0) { 46 gnutls_dh_params_deinit(*dh_params); 47 *dh_params = NULL; 48 error_setg(errp, "Unable to generate DH parameters: %s", 49 gnutls_strerror(ret)); 50 return -1; 51 } 52 } else { 53 GError *gerr = NULL; 54 gchar *contents; 55 gsize len; 56 gnutls_datum_t data; 57 if (!g_file_get_contents(filename, 58 &contents, 59 &len, 60 &gerr)) { 61 62 error_setg(errp, "%s", gerr->message); 63 g_error_free(gerr); 64 return -1; 65 } 66 data.data = (unsigned char *)contents; 67 data.size = len; 68 ret = gnutls_dh_params_init(dh_params); 69 if (ret < 0) { 70 g_free(contents); 71 error_setg(errp, "Unable to initialize DH parameters: %s", 72 gnutls_strerror(ret)); 73 return -1; 74 } 75 ret = gnutls_dh_params_import_pkcs3(*dh_params, 76 &data, 77 GNUTLS_X509_FMT_PEM); 78 g_free(contents); 79 if (ret < 0) { 80 gnutls_dh_params_deinit(*dh_params); 81 *dh_params = NULL; 82 error_setg(errp, "Unable to load DH parameters from %s: %s", 83 filename, gnutls_strerror(ret)); 84 return -1; 85 } 86 } 87 88 return 0; 89 } 90 91 92 int 93 qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds, 94 const char *filename, 95 bool required, 96 char **cred, 97 Error **errp) 98 { 99 struct stat sb; 100 int ret = -1; 101 102 if (!creds->dir) { 103 if (required) { 104 error_setg(errp, "Missing 'dir' property value"); 105 return -1; 106 } else { 107 return 0; 108 } 109 } 110 111 *cred = g_strdup_printf("%s/%s", creds->dir, filename); 112 113 if (stat(*cred, &sb) < 0) { 114 if (errno == ENOENT && !required) { 115 ret = 0; 116 } else { 117 error_setg_errno(errp, errno, 118 "Unable to access credentials %s", 119 *cred); 120 } 121 g_free(*cred); 122 *cred = NULL; 123 goto cleanup; 124 } 125 126 ret = 0; 127 cleanup: 128 trace_qcrypto_tls_creds_get_path(creds, filename, 129 *cred ? *cred : "<none>"); 130 return ret; 131 } 132 133 134 #endif /* ! CONFIG_GNUTLS */ 135 136 137 static void 138 qcrypto_tls_creds_prop_set_verify(Object *obj, 139 bool value, 140 Error **errp G_GNUC_UNUSED) 141 { 142 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 143 144 creds->verifyPeer = value; 145 } 146 147 148 static bool 149 qcrypto_tls_creds_prop_get_verify(Object *obj, 150 Error **errp G_GNUC_UNUSED) 151 { 152 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 153 154 return creds->verifyPeer; 155 } 156 157 158 static void 159 qcrypto_tls_creds_prop_set_dir(Object *obj, 160 const char *value, 161 Error **errp G_GNUC_UNUSED) 162 { 163 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 164 165 creds->dir = g_strdup(value); 166 } 167 168 169 static char * 170 qcrypto_tls_creds_prop_get_dir(Object *obj, 171 Error **errp G_GNUC_UNUSED) 172 { 173 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 174 175 return g_strdup(creds->dir); 176 } 177 178 179 static void 180 qcrypto_tls_creds_prop_set_endpoint(Object *obj, 181 int value, 182 Error **errp G_GNUC_UNUSED) 183 { 184 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 185 186 creds->endpoint = value; 187 } 188 189 190 static int 191 qcrypto_tls_creds_prop_get_endpoint(Object *obj, 192 Error **errp G_GNUC_UNUSED) 193 { 194 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 195 196 return creds->endpoint; 197 } 198 199 200 static void 201 qcrypto_tls_creds_init(Object *obj) 202 { 203 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 204 205 creds->verifyPeer = true; 206 207 object_property_add_bool(obj, "verify-peer", 208 qcrypto_tls_creds_prop_get_verify, 209 qcrypto_tls_creds_prop_set_verify, 210 NULL); 211 object_property_add_str(obj, "dir", 212 qcrypto_tls_creds_prop_get_dir, 213 qcrypto_tls_creds_prop_set_dir, 214 NULL); 215 object_property_add_enum(obj, "endpoint", 216 "QCryptoTLSCredsEndpoint", 217 QCryptoTLSCredsEndpoint_lookup, 218 qcrypto_tls_creds_prop_get_endpoint, 219 qcrypto_tls_creds_prop_set_endpoint, 220 NULL); 221 } 222 223 224 static void 225 qcrypto_tls_creds_finalize(Object *obj) 226 { 227 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj); 228 229 g_free(creds->dir); 230 } 231 232 233 static const TypeInfo qcrypto_tls_creds_info = { 234 .parent = TYPE_OBJECT, 235 .name = TYPE_QCRYPTO_TLS_CREDS, 236 .instance_size = sizeof(QCryptoTLSCreds), 237 .instance_init = qcrypto_tls_creds_init, 238 .instance_finalize = qcrypto_tls_creds_finalize, 239 .class_size = sizeof(QCryptoTLSCredsClass), 240 .abstract = true, 241 }; 242 243 244 static void 245 qcrypto_tls_creds_register_types(void) 246 { 247 type_register_static(&qcrypto_tls_creds_info); 248 } 249 250 251 type_init(qcrypto_tls_creds_register_types); 252