[qemu.git] / crypto / tlscredsx509.c

/*
 * QEMU crypto TLS x509 credential support
 *
 * Copyright (c) 2015 Red Hat, Inc.
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 *
 */

#include "qemu/osdep.h"
#include "crypto/tlscredsx509.h"
#include "tlscredspriv.h"
#include "crypto/secret.h"
#include "qapi/error.h"
#include "qom/object_interfaces.h"
#include "trace.h"


#ifdef CONFIG_GNUTLS

#include <gnutls/x509.h>


static int
qcrypto_tls_creds_check_cert_times(gnutls_x509_crt_t cert,
                                   const char *certFile,
                                   bool isServer,
                                   bool isCA,
                                   Error **errp)
{
    time_t now = time(NULL);

    if (now == ((time_t)-1)) {
        error_setg_errno(errp, errno, "cannot get current time");
        return -1;
    }

    if (gnutls_x509_crt_get_expiration_time(cert) < now) {
        error_setg(errp,
                   (isCA ?
                    "The CA certificate %s has expired" :
                    (isServer ?
                     "The server certificate %s has expired" :
                     "The client certificate %s has expired")),
                   certFile);
        return -1;
    }

    if (gnutls_x509_crt_get_activation_time(cert) > now) {
        error_setg(errp,
                   (isCA ?
                    "The CA certificate %s is not yet active" :
                    (isServer ?
                     "The server certificate %s is not yet active" :
                     "The client certificate %s is not yet active")),
                   certFile);
        return -1;
    }

    return 0;
}


static int
qcrypto_tls_creds_check_cert_basic_constraints(QCryptoTLSCredsX509 *creds,
                                               gnutls_x509_crt_t cert,
                                               const char *certFile,
                                               bool isServer,
                                               bool isCA,
                                               Error **errp)
{
    int status;

    status = gnutls_x509_crt_get_basic_constraints(cert, NULL, NULL, NULL);
    trace_qcrypto_tls_creds_x509_check_basic_constraints(
        creds, certFile, status);

    if (status > 0) { /* It is a CA cert */
        if (!isCA) {
            error_setg(errp, isServer ?
                       "The certificate %s basic constraints show a CA, "
                       "but we need one for a server" :
                       "The certificate %s basic constraints show a CA, "
                       "but we need one for a client",
                       certFile);
            return -1;
        }
    } else if (status == 0) { /* It is not a CA cert */
        if (isCA) {
            error_setg(errp,
                       "The certificate %s basic constraints do not "
                       "show a CA",
                       certFile);
            return -1;
        }
    } else if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
        /* Missing basicConstraints */
        if (isCA) {
            error_setg(errp,
                       "The certificate %s is missing basic constraints "
                       "for a CA",
                       certFile);
            return -1;
        }
    } else { /* General error */
        error_setg(errp,
                   "Unable to query certificate %s basic constraints: %s",
                   certFile, gnutls_strerror(status));
        return -1;
    }

    return 0;
}


static int
qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCredsX509 *creds,
                                       gnutls_x509_crt_t cert,
                                       const char *certFile,
                                       bool isCA,
                                       Error **errp)
{
    int status;
    unsigned int usage = 0;
    unsigned int critical = 0;

    status = gnutls_x509_crt_get_key_usage(cert, &usage, &critical);
    trace_qcrypto_tls_creds_x509_check_key_usage(
        creds, certFile, status, usage, critical);

    if (status < 0) {
        if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
            usage = isCA ? GNUTLS_KEY_KEY_CERT_SIGN :
                GNUTLS_KEY_DIGITAL_SIGNATURE|GNUTLS_KEY_KEY_ENCIPHERMENT;
        } else {
            error_setg(errp,
                       "Unable to query certificate %s key usage: %s",
                       certFile, gnutls_strerror(status));
            return -1;
        }
    }

    if (isCA) {
        if (!(usage & GNUTLS_KEY_KEY_CERT_SIGN)) {
            if (critical) {
                error_setg(errp,
                           "Certificate %s usage does not permit "
                           "certificate signing", certFile);
                return -1;
            }
        }
    } else {
        if (!(usage & GNUTLS_KEY_DIGITAL_SIGNATURE)) {
            if (critical) {
                error_setg(errp,
                           "Certificate %s usage does not permit digital "
                           "signature", certFile);
                return -1;
            }
        }
        if (!(usage & GNUTLS_KEY_KEY_ENCIPHERMENT)) {
            if (critical) {
                error_setg(errp,
                           "Certificate %s usage does not permit key "
                           "encipherment", certFile);
                return -1;
            }
        }
    }

    return 0;
}


static int
qcrypto_tls_creds_check_cert_key_purpose(QCryptoTLSCredsX509 *creds,
                                         gnutls_x509_crt_t cert,
                                         const char *certFile,
                                         bool isServer,
                                         Error **errp)
{
    int status;
    size_t i;
    unsigned int purposeCritical;
    unsigned int critical;
    char *buffer = NULL;
    size_t size;
    bool allowClient = false, allowServer = false;

    critical = 0;
    for (i = 0; ; i++) {
        size = 0;
        status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer,
                                                     &size, NULL);

        if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {

            /* If there is no data at all, then we must allow
               client/server to pass */
            if (i == 0) {
                allowServer = allowClient = true;
            }
            break;
        }
        if (status != GNUTLS_E_SHORT_MEMORY_BUFFER) {
            error_setg(errp,
                       "Unable to query certificate %s key purpose: %s",
                       certFile, gnutls_strerror(status));
            return -1;
        }

        buffer = g_new0(char, size);

        status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer,
                                                     &size, &purposeCritical);

        if (status < 0) {
            trace_qcrypto_tls_creds_x509_check_key_purpose(
                creds, certFile, status, "<none>", purposeCritical);
            g_free(buffer);
            error_setg(errp,
                       "Unable to query certificate %s key purpose: %s",
                       certFile, gnutls_strerror(status));
            return -1;
        }
        trace_qcrypto_tls_creds_x509_check_key_purpose(
            creds, certFile, status, buffer, purposeCritical);
        if (purposeCritical) {
            critical = true;
        }

        if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_SERVER)) {
            allowServer = true;
        } else if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_CLIENT)) {
            allowClient = true;
        } else if (g_str_equal(buffer, GNUTLS_KP_ANY)) {
            allowServer = allowClient = true;
        }

        g_free(buffer);
        buffer = NULL;
    }

    if (isServer) {
        if (!allowServer) {
            if (critical) {
                error_setg(errp,
                           "Certificate %s purpose does not allow "
                           "use with a TLS server", certFile);
                return -1;
            }
        }
    } else {
        if (!allowClient) {
            if (critical) {
                error_setg(errp,
                           "Certificate %s purpose does not allow use "
                           "with a TLS client", certFile);
                return -1;
            }
        }
    }

    return 0;
}


static int
qcrypto_tls_creds_check_cert(QCryptoTLSCredsX509 *creds,
                             gnutls_x509_crt_t cert,
                             const char *certFile,
                             bool isServer,
                             bool isCA,
                             Error **errp)
{
    if (qcrypto_tls_creds_check_cert_times(cert, certFile,
                                           isServer, isCA,
                                           errp) < 0) {
        return -1;
    }

    if (qcrypto_tls_creds_check_cert_basic_constraints(creds,
                                                       cert, certFile,
                                                       isServer, isCA,
                                                       errp) < 0) {
        return -1;
    }

    if (qcrypto_tls_creds_check_cert_key_usage(creds,
                                               cert, certFile,
                                               isCA, errp) < 0) {
        return -1;
    }

    if (!isCA &&
        qcrypto_tls_creds_check_cert_key_purpose(creds,
                                                 cert, certFile,
                                                 isServer, errp) < 0) {
        return -1;
    }

    return 0;
}


static int
qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t cert,
                                  const char *certFile,
                                  gnutls_x509_crt_t *cacerts,
                                  size_t ncacerts,
                                  const char *cacertFile,
                                  bool isServer,
                                  Error **errp)
{
    unsigned int status;

    if (gnutls_x509_crt_list_verify(&cert, 1,
                                    cacerts, ncacerts,
                                    NULL, 0,
                                    0, &status) < 0) {
        error_setg(errp, isServer ?
                   "Unable to verify server certificate %s against "
                   "CA certificate %s" :
                   "Unable to verify client certificate %s against "
                   "CA certificate %s",
                   certFile, cacertFile);
        return -1;
    }

    if (status != 0) {
        const char *reason = "Invalid certificate";

        if (status & GNUTLS_CERT_INVALID) {
            reason = "The certificate is not trusted";
        }

        if (status & GNUTLS_CERT_SIGNER_NOT_FOUND) {
            reason = "The certificate hasn't got a known issuer";
        }

        if (status & GNUTLS_CERT_REVOKED) {
            reason = "The certificate has been revoked";
        }

#ifndef GNUTLS_1_0_COMPAT
        if (status & GNUTLS_CERT_INSECURE_ALGORITHM) {
            reason = "The certificate uses an insecure algorithm";
        }
#endif

        error_setg(errp,
                   "Our own certificate %s failed validation against %s: %s",
                   certFile, cacertFile, reason);
        return -1;
    }

    return 0;
}


static gnutls_x509_crt_t
qcrypto_tls_creds_load_cert(QCryptoTLSCredsX509 *creds,
                            const char *certFile,
                            bool isServer,
                            Error **errp)
{
    gnutls_datum_t data;
    gnutls_x509_crt_t cert = NULL;
    char *buf = NULL;
    gsize buflen;
    GError *gerr;
    int ret = -1;
    int err;

    trace_qcrypto_tls_creds_x509_load_cert(creds, isServer, certFile);

    err = gnutls_x509_crt_init(&cert);
    if (err < 0) {
        error_setg(errp, "Unable to initialize certificate: %s",
                   gnutls_strerror(err));
        goto cleanup;
    }

    if (!g_file_get_contents(certFile, &buf, &buflen, &gerr)) {
        error_setg(errp, "Cannot load CA cert list %s: %s",
                   certFile, gerr->message);
        g_error_free(gerr);
        goto cleanup;
    }

    data.data = (unsigned char *)buf;
    data.size = strlen(buf);

    err = gnutls_x509_crt_import(cert, &data, GNUTLS_X509_FMT_PEM);
    if (err < 0) {
        error_setg(errp, isServer ?
                   "Unable to import server certificate %s: %s" :
                   "Unable to import client certificate %s: %s",
                   certFile,
                   gnutls_strerror(err));
        goto cleanup;
    }

    ret = 0;

 cleanup:
    if (ret != 0) {
        gnutls_x509_crt_deinit(cert);
        cert = NULL;
    }
    g_free(buf);
    return cert;
}


static int
qcrypto_tls_creds_load_ca_cert_list(QCryptoTLSCredsX509 *creds,
                                    const char *certFile,
                                    gnutls_x509_crt_t *certs,
                                    unsigned int certMax,
                                    size_t *ncerts,
                                    Error **errp)
{
    gnutls_datum_t data;
    char *buf = NULL;
    gsize buflen;
    int ret = -1;
    GError *gerr = NULL;

    *ncerts = 0;
    trace_qcrypto_tls_creds_x509_load_cert_list(creds, certFile);

    if (!g_file_get_contents(certFile, &buf, &buflen, &gerr)) {
        error_setg(errp, "Cannot load CA cert list %s: %s",
                   certFile, gerr->message);
        g_error_free(gerr);
        goto cleanup;
    }

    data.data = (unsigned char *)buf;
    data.size = strlen(buf);

    if (gnutls_x509_crt_list_import(certs, &certMax, &data,
                                    GNUTLS_X509_FMT_PEM, 0) < 0) {
        error_setg(errp,
                   "Unable to import CA certificate list %s",
                   certFile);
        goto cleanup;
    }
    *ncerts = certMax;

    ret = 0;

 cleanup:
    g_free(buf);
    return ret;
}


#define MAX_CERTS 16
static int
qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
                                    bool isServer,
                                    const char *cacertFile,
                                    const char *certFile,
                                    Error **errp)
{
    gnutls_x509_crt_t cert = NULL;
    gnutls_x509_crt_t cacerts[MAX_CERTS];
    size_t ncacerts = 0;
    size_t i;
    int ret = -1;

    memset(cacerts, 0, sizeof(cacerts));
    if (certFile &&
        access(certFile, R_OK) == 0) {
        cert = qcrypto_tls_creds_load_cert(creds,
                                           certFile, isServer,
                                           errp);
        if (!cert) {
            goto cleanup;
        }
    }
    if (access(cacertFile, R_OK) == 0) {
        if (qcrypto_tls_creds_load_ca_cert_list(creds,
                                                cacertFile, cacerts,
                                                MAX_CERTS, &ncacerts,
                                                errp) < 0) {
            goto cleanup;
        }
    }

    if (cert &&
        qcrypto_tls_creds_check_cert(creds,
                                     cert, certFile, isServer,
                                     false, errp) < 0) {
        goto cleanup;
    }

    for (i = 0; i < ncacerts; i++) {
        if (qcrypto_tls_creds_check_cert(creds,
                                         cacerts[i], cacertFile,
                                         isServer, true, errp) < 0) {
            goto cleanup;
        }
    }

    if (cert && ncacerts &&
        qcrypto_tls_creds_check_cert_pair(cert, certFile, cacerts,
                                          ncacerts, cacertFile,
                                          isServer, errp) < 0) {
        goto cleanup;
    }

    ret = 0;

 cleanup:
    if (cert) {
        gnutls_x509_crt_deinit(cert);
    }
    for (i = 0; i < ncacerts; i++) {
        gnutls_x509_crt_deinit(cacerts[i]);
    }
    return ret;
}


static int
qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
                            Error **errp)
{
    char *cacert = NULL, *cacrl = NULL, *cert = NULL,
        *key = NULL, *dhparams = NULL;
    int ret;
    int rv = -1;

    trace_qcrypto_tls_creds_x509_load(creds,
            creds->parent_obj.dir ? creds->parent_obj.dir : "<nodir>");

    if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
        if (qcrypto_tls_creds_get_path(&creds->parent_obj,
                                       QCRYPTO_TLS_CREDS_X509_CA_CERT,
                                       true, &cacert, errp) < 0 ||
            qcrypto_tls_creds_get_path(&creds->parent_obj,
                                       QCRYPTO_TLS_CREDS_X509_CA_CRL,
                                       false, &cacrl, errp) < 0 ||
            qcrypto_tls_creds_get_path(&creds->parent_obj,
                                       QCRYPTO_TLS_CREDS_X509_SERVER_CERT,
                                       true, &cert, errp) < 0 ||
            qcrypto_tls_creds_get_path(&creds->parent_obj,
                                       QCRYPTO_TLS_CREDS_X509_SERVER_KEY,
                                       true, &key, errp) < 0 ||
            qcrypto_tls_creds_get_path(&creds->parent_obj,
                                       QCRYPTO_TLS_CREDS_DH_PARAMS,
                                       false, &dhparams, errp) < 0) {
            goto cleanup;
        }
    } else {
        if (qcrypto_tls_creds_get_path(&creds->parent_obj,
                                       QCRYPTO_TLS_CREDS_X509_CA_CERT,
                                       true, &cacert, errp) < 0 ||
            qcrypto_tls_creds_get_path(&creds->parent_obj,
                                       QCRYPTO_TLS_CREDS_X509_CLIENT_CERT,
                                       false, &cert, errp) < 0 ||
            qcrypto_tls_creds_get_path(&creds->parent_obj,
                                       QCRYPTO_TLS_CREDS_X509_CLIENT_KEY,
                                       false, &key, errp) < 0) {
            goto cleanup;
        }
    }

    if (creds->sanityCheck &&
        qcrypto_tls_creds_x509_sanity_check(creds,
            creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
            cacert, cert, errp) < 0) {
        goto cleanup;
    }

    ret = gnutls_certificate_allocate_credentials(&creds->data);
    if (ret < 0) {
        error_setg(errp, "Cannot allocate credentials: '%s'",
                   gnutls_strerror(ret));
        goto cleanup;
    }

    ret = gnutls_certificate_set_x509_trust_file(creds->data,
                                                 cacert,
                                                 GNUTLS_X509_FMT_PEM);
    if (ret < 0) {
        error_setg(errp, "Cannot load CA certificate '%s': %s",
                   cacert, gnutls_strerror(ret));
        goto cleanup;
    }

    if (cert != NULL && key != NULL) {
        char *password = NULL;
        if (creds->passwordid) {
            password = qcrypto_secret_lookup_as_utf8(creds->passwordid,
                                                     errp);
            if (!password) {
                goto cleanup;
            }
        }
        ret = gnutls_certificate_set_x509_key_file2(creds->data,
                                                    cert, key,
                                                    GNUTLS_X509_FMT_PEM,
                                                    password,
                                                    0);
        g_free(password);
        if (ret < 0) {
            error_setg(errp, "Cannot load certificate '%s' & key '%s': %s",
                       cert, key, gnutls_strerror(ret));
            goto cleanup;
        }
    }

    if (cacrl != NULL) {
        ret = gnutls_certificate_set_x509_crl_file(creds->data,
                                                   cacrl,
                                                   GNUTLS_X509_FMT_PEM);
        if (ret < 0) {
            error_setg(errp, "Cannot load CRL '%s': %s",
                       cacrl, gnutls_strerror(ret));
            goto cleanup;
        }
    }

    if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
        if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams,
                                                 &creds->parent_obj.dh_params,
                                                 errp) < 0) {
            goto cleanup;
        }
        gnutls_certificate_set_dh_params(creds->data,
                                         creds->parent_obj.dh_params);
    }

    rv = 0;
 cleanup:
    g_free(cacert);
    g_free(cacrl);
    g_free(cert);
    g_free(key);
    g_free(dhparams);
    return rv;
}


static void
qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds)
{
    if (creds->data) {
        gnutls_certificate_free_credentials(creds->data);
        creds->data = NULL;
    }
    if (creds->parent_obj.dh_params) {
        gnutls_dh_params_deinit(creds->parent_obj.dh_params);
        creds->parent_obj.dh_params = NULL;
    }
}


#else /* ! CONFIG_GNUTLS */


static void
qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED,
                            Error **errp)
{
    error_setg(errp, "TLS credentials support requires GNUTLS");
}


static void
qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED)
{
    /* nada */
}


#endif /* ! CONFIG_GNUTLS */


static void
qcrypto_tls_creds_x509_prop_set_loaded(Object *obj,
                                       bool value,
                                       Error **errp)
{
    QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);

    if (value) {
        qcrypto_tls_creds_x509_load(creds, errp);
    } else {
        qcrypto_tls_creds_x509_unload(creds);
    }
}


#ifdef CONFIG_GNUTLS


static bool
qcrypto_tls_creds_x509_prop_get_loaded(Object *obj,
                                       Error **errp G_GNUC_UNUSED)
{
    QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);

    return creds->data != NULL;
}


#else /* ! CONFIG_GNUTLS */


static bool
qcrypto_tls_creds_x509_prop_get_loaded(Object *obj G_GNUC_UNUSED,
                                       Error **errp G_GNUC_UNUSED)
{
    return false;
}


#endif /* ! CONFIG_GNUTLS */


static void
qcrypto_tls_creds_x509_prop_set_sanity(Object *obj,
                                       bool value,
                                       Error **errp G_GNUC_UNUSED)
{
    QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);

    creds->sanityCheck = value;
}


static void
qcrypto_tls_creds_x509_prop_set_passwordid(Object *obj,
                                           const char *value,
                                           Error **errp G_GNUC_UNUSED)
{
    QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);

    creds->passwordid = g_strdup(value);
}


static char *
qcrypto_tls_creds_x509_prop_get_passwordid(Object *obj,
                                           Error **errp G_GNUC_UNUSED)
{
    QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);

    return g_strdup(creds->passwordid);
}


static bool
qcrypto_tls_creds_x509_prop_get_sanity(Object *obj,
                                       Error **errp G_GNUC_UNUSED)
{
    QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);

    return creds->sanityCheck;
}


static void
qcrypto_tls_creds_x509_complete(UserCreatable *uc, Error **errp)
{
    object_property_set_bool(OBJECT(uc), true, "loaded", errp);
}


static void
qcrypto_tls_creds_x509_init(Object *obj)
{
    QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);

    creds->sanityCheck = true;
}


static void
qcrypto_tls_creds_x509_finalize(Object *obj)
{
    QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);

    g_free(creds->passwordid);
    qcrypto_tls_creds_x509_unload(creds);
}


static void
qcrypto_tls_creds_x509_class_init(ObjectClass *oc, void *data)
{
    UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);

    ucc->complete = qcrypto_tls_creds_x509_complete;

    object_class_property_add_bool(oc, "loaded",
                                   qcrypto_tls_creds_x509_prop_get_loaded,
                                   qcrypto_tls_creds_x509_prop_set_loaded,
                                   NULL);
    object_class_property_add_bool(oc, "sanity-check",
                                   qcrypto_tls_creds_x509_prop_get_sanity,
                                   qcrypto_tls_creds_x509_prop_set_sanity,
                                   NULL);
    object_class_property_add_str(oc, "passwordid",
                                  qcrypto_tls_creds_x509_prop_get_passwordid,
                                  qcrypto_tls_creds_x509_prop_set_passwordid,
                                  NULL);
}


static const TypeInfo qcrypto_tls_creds_x509_info = {
    .parent = TYPE_QCRYPTO_TLS_CREDS,
    .name = TYPE_QCRYPTO_TLS_CREDS_X509,
    .instance_size = sizeof(QCryptoTLSCredsX509),
    .instance_init = qcrypto_tls_creds_x509_init,
    .instance_finalize = qcrypto_tls_creds_x509_finalize,
    .class_size = sizeof(QCryptoTLSCredsX509Class),
    .class_init = qcrypto_tls_creds_x509_class_init,
    .interfaces = (InterfaceInfo[]) {
        { TYPE_USER_CREATABLE },
        { }
    }
};


static void
qcrypto_tls_creds_x509_register_types(void)
{
    type_register_static(&qcrypto_tls_creds_x509_info);
}


type_init(qcrypto_tls_creds_x509_register_types);
Commit	Line	Data
85bcbc78 DB	1	/*
	2	* QEMU crypto TLS x509 credential support
	3	*
	4	* Copyright (c) 2015 Red Hat, Inc.
	5	*
	6	* This library is free software; you can redistribute it and/or
	7	* modify it under the terms of the GNU Lesser General Public
	8	* License as published by the Free Software Foundation; either
	9	* version 2 of the License, or (at your option) any later version.
	10	*
	11	* This library is distributed in the hope that it will be useful,
	12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	14	* Lesser General Public License for more details.
	15	*
	16	* You should have received a copy of the GNU Lesser General Public
	17	* License along with this library; if not, see <http://www.gnu.org/licenses/>.
	18	*
	19	*/
	20
42f7a448	21	#include "qemu/osdep.h"
85bcbc78	22	#include "crypto/tlscredsx509.h"
986bc8de	23	#include "tlscredspriv.h"
1d7b5b4a	24	#include "crypto/secret.h"
da34e65c	25	#include "qapi/error.h"
85bcbc78 DB	26	#include "qom/object_interfaces.h"
	27	#include "trace.h"
	28
	29
	30	#ifdef CONFIG_GNUTLS
	31
9a2fd434 DB	32	#include <gnutls/x509.h>
	33
	34
	35	static int
	36	qcrypto_tls_creds_check_cert_times(gnutls_x509_crt_t cert,
	37	const char *certFile,
	38	bool isServer,
	39	bool isCA,
	40	Error **errp)
	41	{
	42	time_t now = time(NULL);
	43
	44	if (now == ((time_t)-1)) {
	45	error_setg_errno(errp, errno, "cannot get current time");
	46	return -1;
	47	}
	48
	49	if (gnutls_x509_crt_get_expiration_time(cert) < now) {
	50	error_setg(errp,
	51	(isCA ?
	52	"The CA certificate %s has expired" :
	53	(isServer ?
	54	"The server certificate %s has expired" :
	55	"The client certificate %s has expired")),
	56	certFile);
	57	return -1;
	58	}
	59
	60	if (gnutls_x509_crt_get_activation_time(cert) > now) {
	61	error_setg(errp,
	62	(isCA ?
	63	"The CA certificate %s is not yet active" :
	64	(isServer ?
	65	"The server certificate %s is not yet active" :
	66	"The client certificate %s is not yet active")),
	67	certFile);
	68	return -1;
	69	}
	70
	71	return 0;
	72	}
	73
	74
9a2fd434 DB	75	static int
	76	qcrypto_tls_creds_check_cert_basic_constraints(QCryptoTLSCredsX509 *creds,
	77	gnutls_x509_crt_t cert,
	78	const char *certFile,
	79	bool isServer,
	80	bool isCA,
	81	Error **errp)
	82	{
	83	int status;
	84
	85	status = gnutls_x509_crt_get_basic_constraints(cert, NULL, NULL, NULL);
	86	trace_qcrypto_tls_creds_x509_check_basic_constraints(
	87	creds, certFile, status);
	88
	89	if (status > 0) { /* It is a CA cert */
	90	if (!isCA) {
	91	error_setg(errp, isServer ?
	92	"The certificate %s basic constraints show a CA, "
	93	"but we need one for a server" :
	94	"The certificate %s basic constraints show a CA, "
	95	"but we need one for a client",
	96	certFile);
	97	return -1;
	98	}
	99	} else if (status == 0) { /* It is not a CA cert */
	100	if (isCA) {
	101	error_setg(errp,
	102	"The certificate %s basic constraints do not "
	103	"show a CA",
	104	certFile);
	105	return -1;
	106	}
	107	} else if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
	108	/* Missing basicConstraints */
	109	if (isCA) {
	110	error_setg(errp,
	111	"The certificate %s is missing basic constraints "
	112	"for a CA",
	113	certFile);
	114	return -1;
	115	}
	116	} else { /* General error */
	117	error_setg(errp,
	118	"Unable to query certificate %s basic constraints: %s",
	119	certFile, gnutls_strerror(status));
	120	return -1;
	121	}
	122
	123	return 0;
	124	}
9a2fd434 DB	125
	126
	127	static int
	128	qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCredsX509 *creds,
	129	gnutls_x509_crt_t cert,
	130	const char *certFile,
	131	bool isCA,
	132	Error **errp)
	133	{
	134	int status;
	135	unsigned int usage = 0;
	136	unsigned int critical = 0;
	137
	138	status = gnutls_x509_crt_get_key_usage(cert, &usage, &critical);
	139	trace_qcrypto_tls_creds_x509_check_key_usage(
	140	creds, certFile, status, usage, critical);
	141
	142	if (status < 0) {
	143	if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
	144	usage = isCA ? GNUTLS_KEY_KEY_CERT_SIGN :
	145	GNUTLS_KEY_DIGITAL_SIGNATURE\|GNUTLS_KEY_KEY_ENCIPHERMENT;
	146	} else {
	147	error_setg(errp,
	148	"Unable to query certificate %s key usage: %s",
	149	certFile, gnutls_strerror(status));
	150	return -1;
	151	}
	152	}
	153
	154	if (isCA) {
	155	if (!(usage & GNUTLS_KEY_KEY_CERT_SIGN)) {
	156	if (critical) {
	157	error_setg(errp,
	158	"Certificate %s usage does not permit "
	159	"certificate signing", certFile);
	160	return -1;
	161	}
	162	}
	163	} else {
	164	if (!(usage & GNUTLS_KEY_DIGITAL_SIGNATURE)) {
	165	if (critical) {
	166	error_setg(errp,
	167	"Certificate %s usage does not permit digital "
	168	"signature", certFile);
	169	return -1;
	170	}
	171	}
	172	if (!(usage & GNUTLS_KEY_KEY_ENCIPHERMENT)) {
	173	if (critical) {
	174	error_setg(errp,
	175	"Certificate %s usage does not permit key "
	176	"encipherment", certFile);
	177	return -1;
	178	}
	179	}
	180	}
	181
	182	return 0;
	183	}
	184
	185
	186	static int
	187	qcrypto_tls_creds_check_cert_key_purpose(QCryptoTLSCredsX509 *creds,
	188	gnutls_x509_crt_t cert,
189	const char *certFile,
190	bool isServer,
191	Error **errp)
192	{
193	int status;
194	size_t i;
195	unsigned int purposeCritical;
196	unsigned int critical;
197	char *buffer = NULL;
198	size_t size;
199	bool allowClient = false, allowServer = false;
200
201	critical = 0;
202	for (i = 0; ; i++) {
203	size = 0;
204	status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer,
205	&size, NULL);
206
207	if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
208
209	/* If there is no data at all, then we must allow
210	client/server to pass */
211	if (i == 0) {
212	allowServer = allowClient = true;
213	}
214	break;
215	}
216	if (status != GNUTLS_E_SHORT_MEMORY_BUFFER) {
217	error_setg(errp,
218	"Unable to query certificate %s key purpose: %s",
219	certFile, gnutls_strerror(status));
220	return -1;
221	}
222
223	buffer = g_new0(char, size);
224
225	status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer,
226	&size, &purposeCritical);
227
228	if (status < 0) {
229	trace_qcrypto_tls_creds_x509_check_key_purpose(
230	creds, certFile, status, "<none>", purposeCritical);
231	g_free(buffer);
232	error_setg(errp,
233	"Unable to query certificate %s key purpose: %s",
234	certFile, gnutls_strerror(status));
235	return -1;
236	}
237	trace_qcrypto_tls_creds_x509_check_key_purpose(
238	creds, certFile, status, buffer, purposeCritical);
239	if (purposeCritical) {
240	critical = true;
241	}
242
243	if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_SERVER)) {
244	allowServer = true;
245	} else if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_CLIENT)) {
246	allowClient = true;
247	} else if (g_str_equal(buffer, GNUTLS_KP_ANY)) {
248	allowServer = allowClient = true;
249	}
250
251	g_free(buffer);
0e1d0245	252	buffer = NULL;
9a2fd434 DB	253	}
	254
	255	if (isServer) {
	256	if (!allowServer) {
	257	if (critical) {
	258	error_setg(errp,
	259	"Certificate %s purpose does not allow "
	260	"use with a TLS server", certFile);
	261	return -1;
	262	}
	263	}
	264	} else {
	265	if (!allowClient) {
	266	if (critical) {
	267	error_setg(errp,
	268	"Certificate %s purpose does not allow use "
	269	"with a TLS client", certFile);
	270	return -1;
	271	}
	272	}
	273	}
	274
	275	return 0;
	276	}
	277
	278
	279	static int
	280	qcrypto_tls_creds_check_cert(QCryptoTLSCredsX509 *creds,
	281	gnutls_x509_crt_t cert,
	282	const char *certFile,
	283	bool isServer,
	284	bool isCA,
	285	Error **errp)
	286	{
	287	if (qcrypto_tls_creds_check_cert_times(cert, certFile,
	288	isServer, isCA,
	289	errp) < 0) {
	290	return -1;
	291	}
	292
9a2fd434 DB	293	if (qcrypto_tls_creds_check_cert_basic_constraints(creds,
	294	cert, certFile,
	295	isServer, isCA,
	296	errp) < 0) {
	297	return -1;
	298	}
9a2fd434 DB	299
	300	if (qcrypto_tls_creds_check_cert_key_usage(creds,
	301	cert, certFile,
	302	isCA, errp) < 0) {
	303	return -1;
	304	}
	305
	306	if (!isCA &&
	307	qcrypto_tls_creds_check_cert_key_purpose(creds,
	308	cert, certFile,
	309	isServer, errp) < 0) {
	310	return -1;
	311	}
	312
	313	return 0;
	314	}
	315
	316
	317	static int
	318	qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t cert,
	319	const char *certFile,
	320	gnutls_x509_crt_t *cacerts,
	321	size_t ncacerts,
	322	const char *cacertFile,
	323	bool isServer,
	324	Error **errp)
	325	{
	326	unsigned int status;
	327
	328	if (gnutls_x509_crt_list_verify(&cert, 1,
	329	cacerts, ncacerts,
	330	NULL, 0,
	331	0, &status) < 0) {
	332	error_setg(errp, isServer ?
	333	"Unable to verify server certificate %s against "
	334	"CA certificate %s" :
	335	"Unable to verify client certificate %s against "
	336	"CA certificate %s",
	337	certFile, cacertFile);
	338	return -1;
	339	}
	340
	341	if (status != 0) {
	342	const char *reason = "Invalid certificate";
	343
	344	if (status & GNUTLS_CERT_INVALID) {
	345	reason = "The certificate is not trusted";
	346	}
	347
	348	if (status & GNUTLS_CERT_SIGNER_NOT_FOUND) {
	349	reason = "The certificate hasn't got a known issuer";
	350	}
	351
	352	if (status & GNUTLS_CERT_REVOKED) {
	353	reason = "The certificate has been revoked";
	354	}
	355
	356	#ifndef GNUTLS_1_0_COMPAT
	357	if (status & GNUTLS_CERT_INSECURE_ALGORITHM) {
	358	reason = "The certificate uses an insecure algorithm";
	359	}
	360	#endif
	361
	362	error_setg(errp,
363	"Our own certificate %s failed validation against %s: %s",
364	certFile, cacertFile, reason);
365	return -1;
366	}
367
368	return 0;
369	}
370
371
372	static gnutls_x509_crt_t
373	qcrypto_tls_creds_load_cert(QCryptoTLSCredsX509 *creds,
374	const char *certFile,
375	bool isServer,
376	Error **errp)
377	{
378	gnutls_datum_t data;
379	gnutls_x509_crt_t cert = NULL;
380	char *buf = NULL;
381	gsize buflen;
382	GError *gerr;
383	int ret = -1;
b7b68166	384	int err;
9a2fd434 DB	385
	386	trace_qcrypto_tls_creds_x509_load_cert(creds, isServer, certFile);
	387
b7b68166 AB	388	err = gnutls_x509_crt_init(&cert);
	389	if (err < 0) {
	390	error_setg(errp, "Unable to initialize certificate: %s",
	391	gnutls_strerror(err));
9a2fd434 DB	392	goto cleanup;
	393	}
	394
	395	if (!g_file_get_contents(certFile, &buf, &buflen, &gerr)) {
	396	error_setg(errp, "Cannot load CA cert list %s: %s",
	397	certFile, gerr->message);
	398	g_error_free(gerr);
	399	goto cleanup;
	400	}
	401
	402	data.data = (unsigned char *)buf;
	403	data.size = strlen(buf);
	404
b7b68166 AB	405	err = gnutls_x509_crt_import(cert, &data, GNUTLS_X509_FMT_PEM);
b7b68166 AB	406	if (err < 0) {
9a2fd434	407	error_setg(errp, isServer ?
b7b68166 AB	408	"Unable to import server certificate %s: %s" :
	409	"Unable to import client certificate %s: %s",
	410	certFile,
	411	gnutls_strerror(err));
9a2fd434 DB	412	goto cleanup;
	413	}
	414
	415	ret = 0;
	416
	417	cleanup:
	418	if (ret != 0) {
	419	gnutls_x509_crt_deinit(cert);
	420	cert = NULL;
	421	}
	422	g_free(buf);
	423	return cert;
	424	}
	425
	426
	427	static int
	428	qcrypto_tls_creds_load_ca_cert_list(QCryptoTLSCredsX509 *creds,
	429	const char *certFile,
	430	gnutls_x509_crt_t *certs,
	431	unsigned int certMax,
	432	size_t *ncerts,
	433	Error **errp)
	434	{
	435	gnutls_datum_t data;
	436	char *buf = NULL;
	437	gsize buflen;
	438	int ret = -1;
	439	GError *gerr = NULL;
	440
	441	*ncerts = 0;
	442	trace_qcrypto_tls_creds_x509_load_cert_list(creds, certFile);
	443
	444	if (!g_file_get_contents(certFile, &buf, &buflen, &gerr)) {
	445	error_setg(errp, "Cannot load CA cert list %s: %s",
	446	certFile, gerr->message);
	447	g_error_free(gerr);
	448	goto cleanup;
	449	}
	450
	451	data.data = (unsigned char *)buf;
	452	data.size = strlen(buf);
	453
	454	if (gnutls_x509_crt_list_import(certs, &certMax, &data,
	455	GNUTLS_X509_FMT_PEM, 0) < 0) {
	456	error_setg(errp,
	457	"Unable to import CA certificate list %s",
	458	certFile);
	459	goto cleanup;
	460	}
	461	*ncerts = certMax;
	462
	463	ret = 0;
	464
	465	cleanup:
	466	g_free(buf);
	467	return ret;
	468	}
	469
	470
	471	#define MAX_CERTS 16
	472	static int
	473	qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
	474	bool isServer,
	475	const char *cacertFile,
476	const char *certFile,
477	Error **errp)
478	{
479	gnutls_x509_crt_t cert = NULL;
480	gnutls_x509_crt_t cacerts[MAX_CERTS];
481	size_t ncacerts = 0;
482	size_t i;
483	int ret = -1;
484
485	memset(cacerts, 0, sizeof(cacerts));
08cb175a DB	486	if (certFile &&
08cb175a DB	487	access(certFile, R_OK) == 0) {
9a2fd434 DB	488	cert = qcrypto_tls_creds_load_cert(creds,
	489	certFile, isServer,
	490	errp);
	491	if (!cert) {
	492	goto cleanup;
	493	}
	494	}
	495	if (access(cacertFile, R_OK) == 0) {
	496	if (qcrypto_tls_creds_load_ca_cert_list(creds,
	497	cacertFile, cacerts,
	498	MAX_CERTS, &ncacerts,
	499	errp) < 0) {
	500	goto cleanup;
	501	}
	502	}
	503
	504	if (cert &&
	505	qcrypto_tls_creds_check_cert(creds,
	506	cert, certFile, isServer,
	507	false, errp) < 0) {
	508	goto cleanup;
	509	}
	510
	511	for (i = 0; i < ncacerts; i++) {
	512	if (qcrypto_tls_creds_check_cert(creds,
	513	cacerts[i], cacertFile,
	514	isServer, true, errp) < 0) {
	515	goto cleanup;
	516	}
	517	}
	518
	519	if (cert && ncacerts &&
	520	qcrypto_tls_creds_check_cert_pair(cert, certFile, cacerts,
	521	ncacerts, cacertFile,
	522	isServer, errp) < 0) {
	523	goto cleanup;
	524	}
	525
	526	ret = 0;
	527
	528	cleanup:
	529	if (cert) {
	530	gnutls_x509_crt_deinit(cert);
	531	}
	532	for (i = 0; i < ncacerts; i++) {
	533	gnutls_x509_crt_deinit(cacerts[i]);
	534	}
	535	return ret;
	536	}
	537
85bcbc78 DB	538
	539	static int
	540	qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
	541	Error **errp)
	542	{
	543	char cacert = NULL, cacrl = NULL, *cert = NULL,
	544	key = NULL, dhparams = NULL;
	545	int ret;
	546	int rv = -1;
	547
	548	trace_qcrypto_tls_creds_x509_load(creds,
	549	creds->parent_obj.dir ? creds->parent_obj.dir : "<nodir>");
	550
	551	if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
	552	if (qcrypto_tls_creds_get_path(&creds->parent_obj,
	553	QCRYPTO_TLS_CREDS_X509_CA_CERT,
	554	true, &cacert, errp) < 0 \|\|
	555	qcrypto_tls_creds_get_path(&creds->parent_obj,
	556	QCRYPTO_TLS_CREDS_X509_CA_CRL,
	557	false, &cacrl, errp) < 0 \|\|
	558	qcrypto_tls_creds_get_path(&creds->parent_obj,
	559	QCRYPTO_TLS_CREDS_X509_SERVER_CERT,
	560	true, &cert, errp) < 0 \|\|
	561	qcrypto_tls_creds_get_path(&creds->parent_obj,
	562	QCRYPTO_TLS_CREDS_X509_SERVER_KEY,
	563	true, &key, errp) < 0 \|\|
	564	qcrypto_tls_creds_get_path(&creds->parent_obj,
	565	QCRYPTO_TLS_CREDS_DH_PARAMS,
	566	false, &dhparams, errp) < 0) {
	567	goto cleanup;
	568	}
	569	} else {
	570	if (qcrypto_tls_creds_get_path(&creds->parent_obj,
	571	QCRYPTO_TLS_CREDS_X509_CA_CERT,
	572	true, &cacert, errp) < 0 \|\|
	573	qcrypto_tls_creds_get_path(&creds->parent_obj,
	574	QCRYPTO_TLS_CREDS_X509_CLIENT_CERT,
	575	false, &cert, errp) < 0 \|\|
	576	qcrypto_tls_creds_get_path(&creds->parent_obj,
	577	QCRYPTO_TLS_CREDS_X509_CLIENT_KEY,
	578	false, &key, errp) < 0) {
	579	goto cleanup;
	580	}
	581	}
	582
9a2fd434 DB	583	if (creds->sanityCheck &&
	584	qcrypto_tls_creds_x509_sanity_check(creds,
	585	creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
	586	cacert, cert, errp) < 0) {
	587	goto cleanup;
	588	}
	589
85bcbc78 DB	590	ret = gnutls_certificate_allocate_credentials(&creds->data);
	591	if (ret < 0) {
	592	error_setg(errp, "Cannot allocate credentials: '%s'",
	593	gnutls_strerror(ret));
	594	goto cleanup;
	595	}
	596
	597	ret = gnutls_certificate_set_x509_trust_file(creds->data,
	598	cacert,
	599	GNUTLS_X509_FMT_PEM);
	600	if (ret < 0) {
	601	error_setg(errp, "Cannot load CA certificate '%s': %s",
	602	cacert, gnutls_strerror(ret));
	603	goto cleanup;
	604	}
	605
	606	if (cert != NULL && key != NULL) {
1d7b5b4a DB	607	char *password = NULL;
	608	if (creds->passwordid) {
	609	password = qcrypto_secret_lookup_as_utf8(creds->passwordid,
	610	errp);
	611	if (!password) {
	612	goto cleanup;
	613	}
	614	}
	615	ret = gnutls_certificate_set_x509_key_file2(creds->data,
	616	cert, key,
	617	GNUTLS_X509_FMT_PEM,
	618	password,
	619	0);
	620	g_free(password);
85bcbc78 DB	621	if (ret < 0) {
	622	error_setg(errp, "Cannot load certificate '%s' & key '%s': %s",
	623	cert, key, gnutls_strerror(ret));
	624	goto cleanup;
	625	}
	626	}
	627
	628	if (cacrl != NULL) {
	629	ret = gnutls_certificate_set_x509_crl_file(creds->data,
	630	cacrl,
	631	GNUTLS_X509_FMT_PEM);
	632	if (ret < 0) {
	633	error_setg(errp, "Cannot load CRL '%s': %s",
	634	cacrl, gnutls_strerror(ret));
	635	goto cleanup;
	636	}
	637	}
	638
	639	if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
	640	if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams,
	641	&creds->parent_obj.dh_params,
	642	errp) < 0) {
	643	goto cleanup;
	644	}
	645	gnutls_certificate_set_dh_params(creds->data,
	646	creds->parent_obj.dh_params);
	647	}
	648
	649	rv = 0;
	650	cleanup:
	651	g_free(cacert);
	652	g_free(cacrl);
	653	g_free(cert);
	654	g_free(key);
	655	g_free(dhparams);
	656	return rv;
	657	}
	658
	659
	660	static void
	661	qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds)
	662	{
	663	if (creds->data) {
	664	gnutls_certificate_free_credentials(creds->data);
	665	creds->data = NULL;
	666	}
61b9251a DB	667	if (creds->parent_obj.dh_params) {
	668	gnutls_dh_params_deinit(creds->parent_obj.dh_params);
	669	creds->parent_obj.dh_params = NULL;
	670	}
85bcbc78 DB	671	}
	672
	673
	674	#else /* ! CONFIG_GNUTLS */
	675
	676
	677	static void
	678	qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED,
	679	Error **errp)
	680	{
	681	error_setg(errp, "TLS credentials support requires GNUTLS");
	682	}
	683
	684
	685	static void
	686	qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED)
	687	{
	688	/* nada */
	689	}
	690
	691
	692	#endif /* ! CONFIG_GNUTLS */
	693
	694
	695	static void
	696	qcrypto_tls_creds_x509_prop_set_loaded(Object *obj,
	697	bool value,
	698	Error **errp)
	699	{
	700	QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
	701
	702	if (value) {
	703	qcrypto_tls_creds_x509_load(creds, errp);
	704	} else {
	705	qcrypto_tls_creds_x509_unload(creds);
	706	}
	707	}
	708
	709
	710	#ifdef CONFIG_GNUTLS
	711
	712
	713	static bool
	714	qcrypto_tls_creds_x509_prop_get_loaded(Object *obj,
	715	Error **errp G_GNUC_UNUSED)
	716	{
	717	QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
	718
	719	return creds->data != NULL;
	720	}
	721
	722
	723	#else /* ! CONFIG_GNUTLS */
	724
	725
	726	static bool
	727	qcrypto_tls_creds_x509_prop_get_loaded(Object *obj G_GNUC_UNUSED,
	728	Error **errp G_GNUC_UNUSED)
	729	{
	730	return false;
	731	}
	732
	733
	734	#endif /* ! CONFIG_GNUTLS */
735
736
9a2fd434 DB	737	static void
	738	qcrypto_tls_creds_x509_prop_set_sanity(Object *obj,
	739	bool value,
	740	Error **errp G_GNUC_UNUSED)
	741	{
	742	QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
	743
	744	creds->sanityCheck = value;
	745	}
	746
	747
1d7b5b4a DB	748	static void
	749	qcrypto_tls_creds_x509_prop_set_passwordid(Object *obj,
	750	const char *value,
	751	Error **errp G_GNUC_UNUSED)
	752	{
	753	QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
	754
	755	creds->passwordid = g_strdup(value);
	756	}
	757
	758
	759	static char *
	760	qcrypto_tls_creds_x509_prop_get_passwordid(Object *obj,
	761	Error **errp G_GNUC_UNUSED)
	762	{
	763	QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
	764
	765	return g_strdup(creds->passwordid);
	766	}
	767
	768
9a2fd434 DB	769	static bool
	770	qcrypto_tls_creds_x509_prop_get_sanity(Object *obj,
	771	Error **errp G_GNUC_UNUSED)
	772	{
	773	QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
	774
	775	return creds->sanityCheck;
	776	}
	777
	778
85bcbc78 DB	779	static void
	780	qcrypto_tls_creds_x509_complete(UserCreatable uc, Error *errp)
	781	{
	782	object_property_set_bool(OBJECT(uc), true, "loaded", errp);
	783	}
	784
	785
	786	static void
	787	qcrypto_tls_creds_x509_init(Object *obj)
	788	{
9a2fd434 DB	789	QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
	790
	791	creds->sanityCheck = true;
85bcbc78 DB	792	}
	793
	794
	795	static void
	796	qcrypto_tls_creds_x509_finalize(Object *obj)
	797	{
	798	QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
	799
1d7b5b4a	800	g_free(creds->passwordid);
85bcbc78 DB	801	qcrypto_tls_creds_x509_unload(creds);
	802	}
	803
	804
	805	static void
	806	qcrypto_tls_creds_x509_class_init(ObjectClass oc, void data)
	807	{
	808	UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
	809
	810	ucc->complete = qcrypto_tls_creds_x509_complete;
9884abee DB	811
	812	object_class_property_add_bool(oc, "loaded",
	813	qcrypto_tls_creds_x509_prop_get_loaded,
	814	qcrypto_tls_creds_x509_prop_set_loaded,
	815	NULL);
	816	object_class_property_add_bool(oc, "sanity-check",
	817	qcrypto_tls_creds_x509_prop_get_sanity,
	818	qcrypto_tls_creds_x509_prop_set_sanity,
	819	NULL);
	820	object_class_property_add_str(oc, "passwordid",
	821	qcrypto_tls_creds_x509_prop_get_passwordid,
	822	qcrypto_tls_creds_x509_prop_set_passwordid,
	823	NULL);
85bcbc78 DB	824	}
	825
	826
	827	static const TypeInfo qcrypto_tls_creds_x509_info = {
	828	.parent = TYPE_QCRYPTO_TLS_CREDS,
	829	.name = TYPE_QCRYPTO_TLS_CREDS_X509,
	830	.instance_size = sizeof(QCryptoTLSCredsX509),
	831	.instance_init = qcrypto_tls_creds_x509_init,
	832	.instance_finalize = qcrypto_tls_creds_x509_finalize,
	833	.class_size = sizeof(QCryptoTLSCredsX509Class),
	834	.class_init = qcrypto_tls_creds_x509_class_init,
	835	.interfaces = (InterfaceInfo[]) {
	836	{ TYPE_USER_CREATABLE },
	837	{ }
	838	}
	839	};
	840
	841
	842	static void
	843	qcrypto_tls_creds_x509_register_types(void)
	844	{
	845	type_register_static(&qcrypto_tls_creds_x509_info);
	846	}
	847
	848
	849	type_init(qcrypto_tls_creds_x509_register_types);