crypto/tlscreds.c

   1 /*
   2  * QEMU crypto TLS credential support
   3  *
   4  * Copyright (c) 2015 Red Hat, Inc.
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "qapi/error.h"
  23 #include "crypto/tlscredspriv.h"
  24 #include "trace.h"
  25
  26 #define DH_BITS 2048
  27
  28 #ifdef CONFIG_GNUTLS
  29 int
  30 qcrypto_tls_creds_get_dh_params_file(QCryptoTLSCreds *creds,
  31                                      const char *filename,
  32                                      gnutls_dh_params_t *dh_params,
  33                                      Error **errp)
  34 {
  35     int ret;
  36
  37     trace_qcrypto_tls_creds_load_dh(creds, filename ? filename : "<generated>");
  38
  39     if (filename == NULL) {
  40         ret = gnutls_dh_params_init(dh_params);
  41         if (ret < 0) {
  42             error_setg(errp, "Unable to initialize DH parameters: %s",
  43                        gnutls_strerror(ret));
  44             return -1;
  45         }
  46         ret = gnutls_dh_params_generate2(*dh_params, DH_BITS);
  47         if (ret < 0) {
  48             gnutls_dh_params_deinit(*dh_params);
  49             *dh_params = NULL;
  50             error_setg(errp, "Unable to generate DH parameters: %s",
  51                        gnutls_strerror(ret));
  52             return -1;
  53         }
  54     } else {
  55         GError *gerr = NULL;
  56         gchar *contents;
  57         gsize len;
  58         gnutls_datum_t data;
  59         if (!g_file_get_contents(filename,
  60                                  &contents,
  61                                  &len,
  62                                  &gerr)) {
  63
  64             error_setg(errp, "%s", gerr->message);
  65             g_error_free(gerr);
  66             return -1;
  67         }
  68         data.data = (unsigned char *)contents;
  69         data.size = len;
  70         ret = gnutls_dh_params_init(dh_params);
  71         if (ret < 0) {
  72             g_free(contents);
  73             error_setg(errp, "Unable to initialize DH parameters: %s",
  74                        gnutls_strerror(ret));
  75             return -1;
  76         }
  77         ret = gnutls_dh_params_import_pkcs3(*dh_params,
  78                                             &data,
  79                                             GNUTLS_X509_FMT_PEM);
  80         g_free(contents);
  81         if (ret < 0) {
  82             gnutls_dh_params_deinit(*dh_params);
  83             *dh_params = NULL;
  84             error_setg(errp, "Unable to load DH parameters from %s: %s",
  85                        filename, gnutls_strerror(ret));
  86             return -1;
  87         }
  88     }
  89
  90     return 0;
  91 }
  92
  93
  94 int
  95 qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds,
  96                            const char *filename,
  97                            bool required,
  98                            char **cred,
  99                            Error **errp)
 100 {
 101     struct stat sb;
 102     int ret = -1;
 103
 104     if (!creds->dir) {
 105         if (required) {
 106             error_setg(errp, "Missing 'dir' property value");
 107             return -1;
 108         } else {
 109             return 0;
 110         }
 111     }
 112
 113     *cred = g_strdup_printf("%s/%s", creds->dir, filename);
 114
 115     if (stat(*cred, &sb) < 0) {
 116         if (errno == ENOENT && !required) {
 117             ret = 0;
 118         } else {
 119             error_setg_errno(errp, errno,
 120                              "Unable to access credentials %s",
 121                              *cred);
 122         }
 123         g_free(*cred);
 124         *cred = NULL;
 125         goto cleanup;
 126     }
 127
 128     ret = 0;
 129  cleanup:
 130     trace_qcrypto_tls_creds_get_path(creds, filename,
 131                                      *cred ? *cred : "<none>");
 132     return ret;
 133 }
 134
 135
 136 #endif /* ! CONFIG_GNUTLS */
 137
 138
 139 static void
 140 qcrypto_tls_creds_prop_set_verify(Object *obj,
 141                                   bool value,
 142                                   Error **errp G_GNUC_UNUSED)
 143 {
 144     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 145
 146     creds->verifyPeer = value;
 147 }
 148
 149
 150 static bool
 151 qcrypto_tls_creds_prop_get_verify(Object *obj,
 152                                   Error **errp G_GNUC_UNUSED)
 153 {
 154     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 155
 156     return creds->verifyPeer;
 157 }
 158
 159
 160 static void
 161 qcrypto_tls_creds_prop_set_dir(Object *obj,
 162                                const char *value,
 163                                Error **errp G_GNUC_UNUSED)
 164 {
 165     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 166
 167     creds->dir = g_strdup(value);
 168 }
 169
 170
 171 static char *
 172 qcrypto_tls_creds_prop_get_dir(Object *obj,
 173                                Error **errp G_GNUC_UNUSED)
 174 {
 175     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 176
 177     return g_strdup(creds->dir);
 178 }
 179
 180
 181 static void
 182 qcrypto_tls_creds_prop_set_priority(Object *obj,
 183                                     const char *value,
 184                                     Error **errp G_GNUC_UNUSED)
 185 {
 186     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 187
 188     creds->priority = g_strdup(value);
 189 }
 190
 191
 192 static char *
 193 qcrypto_tls_creds_prop_get_priority(Object *obj,
 194                                     Error **errp G_GNUC_UNUSED)
 195 {
 196     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 197
 198     return g_strdup(creds->priority);
 199 }
 200
 201
 202 static void
 203 qcrypto_tls_creds_prop_set_endpoint(Object *obj,
 204                                     int value,
 205                                     Error **errp G_GNUC_UNUSED)
 206 {
 207     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 208
 209     creds->endpoint = value;
 210 }
 211
 212
 213 static int
 214 qcrypto_tls_creds_prop_get_endpoint(Object *obj,
 215                                     Error **errp G_GNUC_UNUSED)
 216 {
 217     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 218
 219     return creds->endpoint;
 220 }
 221
 222
 223 static void
 224 qcrypto_tls_creds_class_init(ObjectClass *oc, void *data)
 225 {
 226     object_class_property_add_bool(oc, "verify-peer",
 227                                    qcrypto_tls_creds_prop_get_verify,
 228                                    qcrypto_tls_creds_prop_set_verify,
 229                                    NULL);
 230     object_class_property_add_str(oc, "dir",
 231                                   qcrypto_tls_creds_prop_get_dir,
 232                                   qcrypto_tls_creds_prop_set_dir,
 233                                   NULL);
 234     object_class_property_add_enum(oc, "endpoint",
 235                                    "QCryptoTLSCredsEndpoint",
 236                                    &QCryptoTLSCredsEndpoint_lookup,
 237                                    qcrypto_tls_creds_prop_get_endpoint,
 238                                    qcrypto_tls_creds_prop_set_endpoint,
 239                                    NULL);
 240     object_class_property_add_str(oc, "priority",
 241                                   qcrypto_tls_creds_prop_get_priority,
 242                                   qcrypto_tls_creds_prop_set_priority,
 243                                   NULL);
 244 }
 245
 246
 247 static void
 248 qcrypto_tls_creds_init(Object *obj)
 249 {
 250     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 251
 252     creds->verifyPeer = true;
 253 }
 254
 255
 256 static void
 257 qcrypto_tls_creds_finalize(Object *obj)
 258 {
 259     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 260
 261     g_free(creds->dir);
 262     g_free(creds->priority);
 263 }
 264
 265
 266 static const TypeInfo qcrypto_tls_creds_info = {
 267     .parent = TYPE_OBJECT,
 268     .name = TYPE_QCRYPTO_TLS_CREDS,
 269     .instance_size = sizeof(QCryptoTLSCreds),
 270     .instance_init = qcrypto_tls_creds_init,
 271     .instance_finalize = qcrypto_tls_creds_finalize,
 272     .class_init = qcrypto_tls_creds_class_init,
 273     .class_size = sizeof(QCryptoTLSCredsClass),
 274     .abstract = true,
 275 };
 276
 277
 278 static void
 279 qcrypto_tls_creds_register_types(void)
 280 {
 281     type_register_static(&qcrypto_tls_creds_info);
 282 }
 283
 284
 285 type_init(qcrypto_tls_creds_register_types);