1 /* 2 * QEMU crypto TLS x509 credential support 3 * 4 * Copyright (c) 2015 Red Hat, Inc. 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 * 19 */ 20 21 #include "qemu/osdep.h" 22 #include "crypto/tlscredsx509.h" 23 #include "crypto/tlscredspriv.h" 24 #include "crypto/secret.h" 25 #include "qom/object_interfaces.h" 26 #include "trace.h" 27 28 29 #ifdef CONFIG_GNUTLS 30 31 #include <gnutls/x509.h> 32 33 34 static int 35 qcrypto_tls_creds_check_cert_times(gnutls_x509_crt_t cert, 36 const char *certFile, 37 bool isServer, 38 bool isCA, 39 Error **errp) 40 { 41 time_t now = time(NULL); 42 43 if (now == ((time_t)-1)) { 44 error_setg_errno(errp, errno, "cannot get current time"); 45 return -1; 46 } 47 48 if (gnutls_x509_crt_get_expiration_time(cert) < now) { 49 error_setg(errp, 50 (isCA ? 51 "The CA certificate %s has expired" : 52 (isServer ? 53 "The server certificate %s has expired" : 54 "The client certificate %s has expired")), 55 certFile); 56 return -1; 57 } 58 59 if (gnutls_x509_crt_get_activation_time(cert) > now) { 60 error_setg(errp, 61 (isCA ? 62 "The CA certificate %s is not yet active" : 63 (isServer ? 64 "The server certificate %s is not yet active" : 65 "The client certificate %s is not yet active")), 66 certFile); 67 return -1; 68 } 69 70 return 0; 71 } 72 73 74 #if LIBGNUTLS_VERSION_NUMBER >= 2 75 /* 76 * The gnutls_x509_crt_get_basic_constraints function isn't 77 * available in GNUTLS 1.0.x branches. This isn't critical 78 * though, since gnutls_certificate_verify_peers2 will do 79 * pretty much the same check at runtime, so we can just 80 * disable this code 81 */ 82 static int 83 qcrypto_tls_creds_check_cert_basic_constraints(QCryptoTLSCredsX509 *creds, 84 gnutls_x509_crt_t cert, 85 const char *certFile, 86 bool isServer, 87 bool isCA, 88 Error **errp) 89 { 90 int status; 91 92 status = gnutls_x509_crt_get_basic_constraints(cert, NULL, NULL, NULL); 93 trace_qcrypto_tls_creds_x509_check_basic_constraints( 94 creds, certFile, status); 95 96 if (status > 0) { /* It is a CA cert */ 97 if (!isCA) { 98 error_setg(errp, isServer ? 99 "The certificate %s basic constraints show a CA, " 100 "but we need one for a server" : 101 "The certificate %s basic constraints show a CA, " 102 "but we need one for a client", 103 certFile); 104 return -1; 105 } 106 } else if (status == 0) { /* It is not a CA cert */ 107 if (isCA) { 108 error_setg(errp, 109 "The certificate %s basic constraints do not " 110 "show a CA", 111 certFile); 112 return -1; 113 } 114 } else if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) { 115 /* Missing basicConstraints */ 116 if (isCA) { 117 error_setg(errp, 118 "The certificate %s is missing basic constraints " 119 "for a CA", 120 certFile); 121 return -1; 122 } 123 } else { /* General error */ 124 error_setg(errp, 125 "Unable to query certificate %s basic constraints: %s", 126 certFile, gnutls_strerror(status)); 127 return -1; 128 } 129 130 return 0; 131 } 132 #endif 133 134 135 static int 136 qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCredsX509 *creds, 137 gnutls_x509_crt_t cert, 138 const char *certFile, 139 bool isCA, 140 Error **errp) 141 { 142 int status; 143 unsigned int usage = 0; 144 unsigned int critical = 0; 145 146 status = gnutls_x509_crt_get_key_usage(cert, &usage, &critical); 147 trace_qcrypto_tls_creds_x509_check_key_usage( 148 creds, certFile, status, usage, critical); 149 150 if (status < 0) { 151 if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) { 152 usage = isCA ? GNUTLS_KEY_KEY_CERT_SIGN : 153 GNUTLS_KEY_DIGITAL_SIGNATURE|GNUTLS_KEY_KEY_ENCIPHERMENT; 154 } else { 155 error_setg(errp, 156 "Unable to query certificate %s key usage: %s", 157 certFile, gnutls_strerror(status)); 158 return -1; 159 } 160 } 161 162 if (isCA) { 163 if (!(usage & GNUTLS_KEY_KEY_CERT_SIGN)) { 164 if (critical) { 165 error_setg(errp, 166 "Certificate %s usage does not permit " 167 "certificate signing", certFile); 168 return -1; 169 } 170 } 171 } else { 172 if (!(usage & GNUTLS_KEY_DIGITAL_SIGNATURE)) { 173 if (critical) { 174 error_setg(errp, 175 "Certificate %s usage does not permit digital " 176 "signature", certFile); 177 return -1; 178 } 179 } 180 if (!(usage & GNUTLS_KEY_KEY_ENCIPHERMENT)) { 181 if (critical) { 182 error_setg(errp, 183 "Certificate %s usage does not permit key " 184 "encipherment", certFile); 185 return -1; 186 } 187 } 188 } 189 190 return 0; 191 } 192 193 194 static int 195 qcrypto_tls_creds_check_cert_key_purpose(QCryptoTLSCredsX509 *creds, 196 gnutls_x509_crt_t cert, 197 const char *certFile, 198 bool isServer, 199 Error **errp) 200 { 201 int status; 202 size_t i; 203 unsigned int purposeCritical; 204 unsigned int critical; 205 char *buffer = NULL; 206 size_t size; 207 bool allowClient = false, allowServer = false; 208 209 critical = 0; 210 for (i = 0; ; i++) { 211 size = 0; 212 status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer, 213 &size, NULL); 214 215 if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) { 216 217 /* If there is no data at all, then we must allow 218 client/server to pass */ 219 if (i == 0) { 220 allowServer = allowClient = true; 221 } 222 break; 223 } 224 if (status != GNUTLS_E_SHORT_MEMORY_BUFFER) { 225 error_setg(errp, 226 "Unable to query certificate %s key purpose: %s", 227 certFile, gnutls_strerror(status)); 228 return -1; 229 } 230 231 buffer = g_new0(char, size); 232 233 status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer, 234 &size, &purposeCritical); 235 236 if (status < 0) { 237 trace_qcrypto_tls_creds_x509_check_key_purpose( 238 creds, certFile, status, "<none>", purposeCritical); 239 g_free(buffer); 240 error_setg(errp, 241 "Unable to query certificate %s key purpose: %s", 242 certFile, gnutls_strerror(status)); 243 return -1; 244 } 245 trace_qcrypto_tls_creds_x509_check_key_purpose( 246 creds, certFile, status, buffer, purposeCritical); 247 if (purposeCritical) { 248 critical = true; 249 } 250 251 if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_SERVER)) { 252 allowServer = true; 253 } else if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_CLIENT)) { 254 allowClient = true; 255 } else if (g_str_equal(buffer, GNUTLS_KP_ANY)) { 256 allowServer = allowClient = true; 257 } 258 259 g_free(buffer); 260 buffer = NULL; 261 } 262 263 if (isServer) { 264 if (!allowServer) { 265 if (critical) { 266 error_setg(errp, 267 "Certificate %s purpose does not allow " 268 "use with a TLS server", certFile); 269 return -1; 270 } 271 } 272 } else { 273 if (!allowClient) { 274 if (critical) { 275 error_setg(errp, 276 "Certificate %s purpose does not allow use " 277 "with a TLS client", certFile); 278 return -1; 279 } 280 } 281 } 282 283 return 0; 284 } 285 286 287 static int 288 qcrypto_tls_creds_check_cert(QCryptoTLSCredsX509 *creds, 289 gnutls_x509_crt_t cert, 290 const char *certFile, 291 bool isServer, 292 bool isCA, 293 Error **errp) 294 { 295 if (qcrypto_tls_creds_check_cert_times(cert, certFile, 296 isServer, isCA, 297 errp) < 0) { 298 return -1; 299 } 300 301 #if LIBGNUTLS_VERSION_NUMBER >= 2 302 if (qcrypto_tls_creds_check_cert_basic_constraints(creds, 303 cert, certFile, 304 isServer, isCA, 305 errp) < 0) { 306 return -1; 307 } 308 #endif 309 310 if (qcrypto_tls_creds_check_cert_key_usage(creds, 311 cert, certFile, 312 isCA, errp) < 0) { 313 return -1; 314 } 315 316 if (!isCA && 317 qcrypto_tls_creds_check_cert_key_purpose(creds, 318 cert, certFile, 319 isServer, errp) < 0) { 320 return -1; 321 } 322 323 return 0; 324 } 325 326 327 static int 328 qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t cert, 329 const char *certFile, 330 gnutls_x509_crt_t *cacerts, 331 size_t ncacerts, 332 const char *cacertFile, 333 bool isServer, 334 Error **errp) 335 { 336 unsigned int status; 337 338 if (gnutls_x509_crt_list_verify(&cert, 1, 339 cacerts, ncacerts, 340 NULL, 0, 341 0, &status) < 0) { 342 error_setg(errp, isServer ? 343 "Unable to verify server certificate %s against " 344 "CA certificate %s" : 345 "Unable to verify client certificate %s against " 346 "CA certificate %s", 347 certFile, cacertFile); 348 return -1; 349 } 350 351 if (status != 0) { 352 const char *reason = "Invalid certificate"; 353 354 if (status & GNUTLS_CERT_INVALID) { 355 reason = "The certificate is not trusted"; 356 } 357 358 if (status & GNUTLS_CERT_SIGNER_NOT_FOUND) { 359 reason = "The certificate hasn't got a known issuer"; 360 } 361 362 if (status & GNUTLS_CERT_REVOKED) { 363 reason = "The certificate has been revoked"; 364 } 365 366 #ifndef GNUTLS_1_0_COMPAT 367 if (status & GNUTLS_CERT_INSECURE_ALGORITHM) { 368 reason = "The certificate uses an insecure algorithm"; 369 } 370 #endif 371 372 error_setg(errp, 373 "Our own certificate %s failed validation against %s: %s", 374 certFile, cacertFile, reason); 375 return -1; 376 } 377 378 return 0; 379 } 380 381 382 static gnutls_x509_crt_t 383 qcrypto_tls_creds_load_cert(QCryptoTLSCredsX509 *creds, 384 const char *certFile, 385 bool isServer, 386 Error **errp) 387 { 388 gnutls_datum_t data; 389 gnutls_x509_crt_t cert = NULL; 390 char *buf = NULL; 391 gsize buflen; 392 GError *gerr; 393 int ret = -1; 394 395 trace_qcrypto_tls_creds_x509_load_cert(creds, isServer, certFile); 396 397 if (gnutls_x509_crt_init(&cert) < 0) { 398 error_setg(errp, "Unable to initialize certificate"); 399 goto cleanup; 400 } 401 402 if (!g_file_get_contents(certFile, &buf, &buflen, &gerr)) { 403 error_setg(errp, "Cannot load CA cert list %s: %s", 404 certFile, gerr->message); 405 g_error_free(gerr); 406 goto cleanup; 407 } 408 409 data.data = (unsigned char *)buf; 410 data.size = strlen(buf); 411 412 if (gnutls_x509_crt_import(cert, &data, GNUTLS_X509_FMT_PEM) < 0) { 413 error_setg(errp, isServer ? 414 "Unable to import server certificate %s" : 415 "Unable to import client certificate %s", 416 certFile); 417 goto cleanup; 418 } 419 420 ret = 0; 421 422 cleanup: 423 if (ret != 0) { 424 gnutls_x509_crt_deinit(cert); 425 cert = NULL; 426 } 427 g_free(buf); 428 return cert; 429 } 430 431 432 static int 433 qcrypto_tls_creds_load_ca_cert_list(QCryptoTLSCredsX509 *creds, 434 const char *certFile, 435 gnutls_x509_crt_t *certs, 436 unsigned int certMax, 437 size_t *ncerts, 438 Error **errp) 439 { 440 gnutls_datum_t data; 441 char *buf = NULL; 442 gsize buflen; 443 int ret = -1; 444 GError *gerr = NULL; 445 446 *ncerts = 0; 447 trace_qcrypto_tls_creds_x509_load_cert_list(creds, certFile); 448 449 if (!g_file_get_contents(certFile, &buf, &buflen, &gerr)) { 450 error_setg(errp, "Cannot load CA cert list %s: %s", 451 certFile, gerr->message); 452 g_error_free(gerr); 453 goto cleanup; 454 } 455 456 data.data = (unsigned char *)buf; 457 data.size = strlen(buf); 458 459 if (gnutls_x509_crt_list_import(certs, &certMax, &data, 460 GNUTLS_X509_FMT_PEM, 0) < 0) { 461 error_setg(errp, 462 "Unable to import CA certificate list %s", 463 certFile); 464 goto cleanup; 465 } 466 *ncerts = certMax; 467 468 ret = 0; 469 470 cleanup: 471 g_free(buf); 472 return ret; 473 } 474 475 476 #define MAX_CERTS 16 477 static int 478 qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds, 479 bool isServer, 480 const char *cacertFile, 481 const char *certFile, 482 Error **errp) 483 { 484 gnutls_x509_crt_t cert = NULL; 485 gnutls_x509_crt_t cacerts[MAX_CERTS]; 486 size_t ncacerts = 0; 487 size_t i; 488 int ret = -1; 489 490 memset(cacerts, 0, sizeof(cacerts)); 491 if (certFile && 492 access(certFile, R_OK) == 0) { 493 cert = qcrypto_tls_creds_load_cert(creds, 494 certFile, isServer, 495 errp); 496 if (!cert) { 497 goto cleanup; 498 } 499 } 500 if (access(cacertFile, R_OK) == 0) { 501 if (qcrypto_tls_creds_load_ca_cert_list(creds, 502 cacertFile, cacerts, 503 MAX_CERTS, &ncacerts, 504 errp) < 0) { 505 goto cleanup; 506 } 507 } 508 509 if (cert && 510 qcrypto_tls_creds_check_cert(creds, 511 cert, certFile, isServer, 512 false, errp) < 0) { 513 goto cleanup; 514 } 515 516 for (i = 0; i < ncacerts; i++) { 517 if (qcrypto_tls_creds_check_cert(creds, 518 cacerts[i], cacertFile, 519 isServer, true, errp) < 0) { 520 goto cleanup; 521 } 522 } 523 524 if (cert && ncacerts && 525 qcrypto_tls_creds_check_cert_pair(cert, certFile, cacerts, 526 ncacerts, cacertFile, 527 isServer, errp) < 0) { 528 goto cleanup; 529 } 530 531 ret = 0; 532 533 cleanup: 534 if (cert) { 535 gnutls_x509_crt_deinit(cert); 536 } 537 for (i = 0; i < ncacerts; i++) { 538 gnutls_x509_crt_deinit(cacerts[i]); 539 } 540 return ret; 541 } 542 543 544 static int 545 qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds, 546 Error **errp) 547 { 548 char *cacert = NULL, *cacrl = NULL, *cert = NULL, 549 *key = NULL, *dhparams = NULL; 550 int ret; 551 int rv = -1; 552 553 trace_qcrypto_tls_creds_x509_load(creds, 554 creds->parent_obj.dir ? creds->parent_obj.dir : "<nodir>"); 555 556 if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) { 557 if (qcrypto_tls_creds_get_path(&creds->parent_obj, 558 QCRYPTO_TLS_CREDS_X509_CA_CERT, 559 true, &cacert, errp) < 0 || 560 qcrypto_tls_creds_get_path(&creds->parent_obj, 561 QCRYPTO_TLS_CREDS_X509_CA_CRL, 562 false, &cacrl, errp) < 0 || 563 qcrypto_tls_creds_get_path(&creds->parent_obj, 564 QCRYPTO_TLS_CREDS_X509_SERVER_CERT, 565 true, &cert, errp) < 0 || 566 qcrypto_tls_creds_get_path(&creds->parent_obj, 567 QCRYPTO_TLS_CREDS_X509_SERVER_KEY, 568 true, &key, errp) < 0 || 569 qcrypto_tls_creds_get_path(&creds->parent_obj, 570 QCRYPTO_TLS_CREDS_DH_PARAMS, 571 false, &dhparams, errp) < 0) { 572 goto cleanup; 573 } 574 } else { 575 if (qcrypto_tls_creds_get_path(&creds->parent_obj, 576 QCRYPTO_TLS_CREDS_X509_CA_CERT, 577 true, &cacert, errp) < 0 || 578 qcrypto_tls_creds_get_path(&creds->parent_obj, 579 QCRYPTO_TLS_CREDS_X509_CLIENT_CERT, 580 false, &cert, errp) < 0 || 581 qcrypto_tls_creds_get_path(&creds->parent_obj, 582 QCRYPTO_TLS_CREDS_X509_CLIENT_KEY, 583 false, &key, errp) < 0) { 584 goto cleanup; 585 } 586 } 587 588 if (creds->sanityCheck && 589 qcrypto_tls_creds_x509_sanity_check(creds, 590 creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER, 591 cacert, cert, errp) < 0) { 592 goto cleanup; 593 } 594 595 ret = gnutls_certificate_allocate_credentials(&creds->data); 596 if (ret < 0) { 597 error_setg(errp, "Cannot allocate credentials: '%s'", 598 gnutls_strerror(ret)); 599 goto cleanup; 600 } 601 602 ret = gnutls_certificate_set_x509_trust_file(creds->data, 603 cacert, 604 GNUTLS_X509_FMT_PEM); 605 if (ret < 0) { 606 error_setg(errp, "Cannot load CA certificate '%s': %s", 607 cacert, gnutls_strerror(ret)); 608 goto cleanup; 609 } 610 611 if (cert != NULL && key != NULL) { 612 #if GNUTLS_VERSION_NUMBER >= 0x030111 613 char *password = NULL; 614 if (creds->passwordid) { 615 password = qcrypto_secret_lookup_as_utf8(creds->passwordid, 616 errp); 617 if (!password) { 618 goto cleanup; 619 } 620 } 621 ret = gnutls_certificate_set_x509_key_file2(creds->data, 622 cert, key, 623 GNUTLS_X509_FMT_PEM, 624 password, 625 0); 626 g_free(password); 627 #else /* GNUTLS_VERSION_NUMBER < 0x030111 */ 628 if (creds->passwordid) { 629 error_setg(errp, "PKCS8 decryption requires GNUTLS >= 3.1.11"); 630 goto cleanup; 631 } 632 ret = gnutls_certificate_set_x509_key_file(creds->data, 633 cert, key, 634 GNUTLS_X509_FMT_PEM); 635 #endif /* GNUTLS_VERSION_NUMBER < 0x030111 */ 636 if (ret < 0) { 637 error_setg(errp, "Cannot load certificate '%s' & key '%s': %s", 638 cert, key, gnutls_strerror(ret)); 639 goto cleanup; 640 } 641 } 642 643 if (cacrl != NULL) { 644 ret = gnutls_certificate_set_x509_crl_file(creds->data, 645 cacrl, 646 GNUTLS_X509_FMT_PEM); 647 if (ret < 0) { 648 error_setg(errp, "Cannot load CRL '%s': %s", 649 cacrl, gnutls_strerror(ret)); 650 goto cleanup; 651 } 652 } 653 654 if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) { 655 if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams, 656 &creds->parent_obj.dh_params, 657 errp) < 0) { 658 goto cleanup; 659 } 660 gnutls_certificate_set_dh_params(creds->data, 661 creds->parent_obj.dh_params); 662 } 663 664 rv = 0; 665 cleanup: 666 g_free(cacert); 667 g_free(cacrl); 668 g_free(cert); 669 g_free(key); 670 g_free(dhparams); 671 return rv; 672 } 673 674 675 static void 676 qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds) 677 { 678 if (creds->data) { 679 gnutls_certificate_free_credentials(creds->data); 680 creds->data = NULL; 681 } 682 if (creds->parent_obj.dh_params) { 683 gnutls_dh_params_deinit(creds->parent_obj.dh_params); 684 creds->parent_obj.dh_params = NULL; 685 } 686 } 687 688 689 #else /* ! CONFIG_GNUTLS */ 690 691 692 static void 693 qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED, 694 Error **errp) 695 { 696 error_setg(errp, "TLS credentials support requires GNUTLS"); 697 } 698 699 700 static void 701 qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED) 702 { 703 /* nada */ 704 } 705 706 707 #endif /* ! CONFIG_GNUTLS */ 708 709 710 static void 711 qcrypto_tls_creds_x509_prop_set_loaded(Object *obj, 712 bool value, 713 Error **errp) 714 { 715 QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj); 716 717 if (value) { 718 qcrypto_tls_creds_x509_load(creds, errp); 719 } else { 720 qcrypto_tls_creds_x509_unload(creds); 721 } 722 } 723 724 725 #ifdef CONFIG_GNUTLS 726 727 728 static bool 729 qcrypto_tls_creds_x509_prop_get_loaded(Object *obj, 730 Error **errp G_GNUC_UNUSED) 731 { 732 QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj); 733 734 return creds->data != NULL; 735 } 736 737 738 #else /* ! CONFIG_GNUTLS */ 739 740 741 static bool 742 qcrypto_tls_creds_x509_prop_get_loaded(Object *obj G_GNUC_UNUSED, 743 Error **errp G_GNUC_UNUSED) 744 { 745 return false; 746 } 747 748 749 #endif /* ! CONFIG_GNUTLS */ 750 751 752 static void 753 qcrypto_tls_creds_x509_prop_set_sanity(Object *obj, 754 bool value, 755 Error **errp G_GNUC_UNUSED) 756 { 757 QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj); 758 759 creds->sanityCheck = value; 760 } 761 762 763 static void 764 qcrypto_tls_creds_x509_prop_set_passwordid(Object *obj, 765 const char *value, 766 Error **errp G_GNUC_UNUSED) 767 { 768 QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj); 769 770 creds->passwordid = g_strdup(value); 771 } 772 773 774 static char * 775 qcrypto_tls_creds_x509_prop_get_passwordid(Object *obj, 776 Error **errp G_GNUC_UNUSED) 777 { 778 QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj); 779 780 return g_strdup(creds->passwordid); 781 } 782 783 784 static bool 785 qcrypto_tls_creds_x509_prop_get_sanity(Object *obj, 786 Error **errp G_GNUC_UNUSED) 787 { 788 QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj); 789 790 return creds->sanityCheck; 791 } 792 793 794 static void 795 qcrypto_tls_creds_x509_complete(UserCreatable *uc, Error **errp) 796 { 797 object_property_set_bool(OBJECT(uc), true, "loaded", errp); 798 } 799 800 801 static void 802 qcrypto_tls_creds_x509_init(Object *obj) 803 { 804 QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj); 805 806 creds->sanityCheck = true; 807 } 808 809 810 static void 811 qcrypto_tls_creds_x509_finalize(Object *obj) 812 { 813 QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj); 814 815 g_free(creds->passwordid); 816 qcrypto_tls_creds_x509_unload(creds); 817 } 818 819 820 static void 821 qcrypto_tls_creds_x509_class_init(ObjectClass *oc, void *data) 822 { 823 UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc); 824 825 ucc->complete = qcrypto_tls_creds_x509_complete; 826 827 object_class_property_add_bool(oc, "loaded", 828 qcrypto_tls_creds_x509_prop_get_loaded, 829 qcrypto_tls_creds_x509_prop_set_loaded, 830 NULL); 831 object_class_property_add_bool(oc, "sanity-check", 832 qcrypto_tls_creds_x509_prop_get_sanity, 833 qcrypto_tls_creds_x509_prop_set_sanity, 834 NULL); 835 object_class_property_add_str(oc, "passwordid", 836 qcrypto_tls_creds_x509_prop_get_passwordid, 837 qcrypto_tls_creds_x509_prop_set_passwordid, 838 NULL); 839 } 840 841 842 static const TypeInfo qcrypto_tls_creds_x509_info = { 843 .parent = TYPE_QCRYPTO_TLS_CREDS, 844 .name = TYPE_QCRYPTO_TLS_CREDS_X509, 845 .instance_size = sizeof(QCryptoTLSCredsX509), 846 .instance_init = qcrypto_tls_creds_x509_init, 847 .instance_finalize = qcrypto_tls_creds_x509_finalize, 848 .class_size = sizeof(QCryptoTLSCredsX509Class), 849 .class_init = qcrypto_tls_creds_x509_class_init, 850 .interfaces = (InterfaceInfo[]) { 851 { TYPE_USER_CREATABLE }, 852 { } 853 } 854 }; 855 856 857 static void 858 qcrypto_tls_creds_x509_register_types(void) 859 { 860 type_register_static(&qcrypto_tls_creds_x509_info); 861 } 862 863 864 type_init(qcrypto_tls_creds_x509_register_types); 865