crypto/tlscreds.c

   1 /*
   2  * QEMU crypto TLS credential support
   3  *
   4  * Copyright (c) 2015 Red Hat, Inc.
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "qapi/error.h"
  23 #include "qapi-types-crypto.h"
  24 #include "qemu/module.h"
  25 #include "tlscredspriv.h"
  26 #include "trace.h"
  27
  28 #define DH_BITS 2048
  29
  30 #ifdef CONFIG_GNUTLS
  31 int
  32 qcrypto_tls_creds_get_dh_params_file(QCryptoTLSCreds *creds,
  33                                      const char *filename,
  34                                      gnutls_dh_params_t *dh_params,
  35                                      Error **errp)
  36 {
  37     int ret;
  38
  39     trace_qcrypto_tls_creds_load_dh(creds, filename ? filename : "<generated>");
  40
  41     if (filename == NULL) {
  42         ret = gnutls_dh_params_init(dh_params);
  43         if (ret < 0) {
  44             error_setg(errp, "Unable to initialize DH parameters: %s",
  45                        gnutls_strerror(ret));
  46             return -1;
  47         }
  48         ret = gnutls_dh_params_generate2(*dh_params, DH_BITS);
  49         if (ret < 0) {
  50             gnutls_dh_params_deinit(*dh_params);
  51             *dh_params = NULL;
  52             error_setg(errp, "Unable to generate DH parameters: %s",
  53                        gnutls_strerror(ret));
  54             return -1;
  55         }
  56     } else {
  57         GError *gerr = NULL;
  58         gchar *contents;
  59         gsize len;
  60         gnutls_datum_t data;
  61         if (!g_file_get_contents(filename,
  62                                  &contents,
  63                                  &len,
  64                                  &gerr)) {
  65
  66             error_setg(errp, "%s", gerr->message);
  67             g_error_free(gerr);
  68             return -1;
  69         }
  70         data.data = (unsigned char *)contents;
  71         data.size = len;
  72         ret = gnutls_dh_params_init(dh_params);
  73         if (ret < 0) {
  74             g_free(contents);
  75             error_setg(errp, "Unable to initialize DH parameters: %s",
  76                        gnutls_strerror(ret));
  77             return -1;
  78         }
  79         ret = gnutls_dh_params_import_pkcs3(*dh_params,
  80                                             &data,
  81                                             GNUTLS_X509_FMT_PEM);
  82         g_free(contents);
  83         if (ret < 0) {
  84             gnutls_dh_params_deinit(*dh_params);
  85             *dh_params = NULL;
  86             error_setg(errp, "Unable to load DH parameters from %s: %s",
  87                        filename, gnutls_strerror(ret));
  88             return -1;
  89         }
  90     }
  91
  92     return 0;
  93 }
  94
  95
  96 int
  97 qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds,
  98                            const char *filename,
  99                            bool required,
 100                            char **cred,
 101                            Error **errp)
 102 {
 103     struct stat sb;
 104     int ret = -1;
 105
 106     if (!creds->dir) {
 107         if (required) {
 108             error_setg(errp, "Missing 'dir' property value");
 109             return -1;
 110         } else {
 111             return 0;
 112         }
 113     }
 114
 115     *cred = g_strdup_printf("%s/%s", creds->dir, filename);
 116
 117     if (stat(*cred, &sb) < 0) {
 118         if (errno == ENOENT && !required) {
 119             ret = 0;
 120         } else {
 121             error_setg_errno(errp, errno,
 122                              "Unable to access credentials %s",
 123                              *cred);
 124         }
 125         g_free(*cred);
 126         *cred = NULL;
 127         goto cleanup;
 128     }
 129
 130     ret = 0;
 131  cleanup:
 132     trace_qcrypto_tls_creds_get_path(creds, filename,
 133                                      *cred ? *cred : "<none>");
 134     return ret;
 135 }
 136
 137
 138 #endif /* ! CONFIG_GNUTLS */
 139
 140
 141 static void
 142 qcrypto_tls_creds_prop_set_verify(Object *obj,
 143                                   bool value,
 144                                   Error **errp G_GNUC_UNUSED)
 145 {
 146     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 147
 148     creds->verifyPeer = value;
 149 }
 150
 151
 152 static bool
 153 qcrypto_tls_creds_prop_get_verify(Object *obj,
 154                                   Error **errp G_GNUC_UNUSED)
 155 {
 156     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 157
 158     return creds->verifyPeer;
 159 }
 160
 161
 162 static void
 163 qcrypto_tls_creds_prop_set_dir(Object *obj,
 164                                const char *value,
 165                                Error **errp G_GNUC_UNUSED)
 166 {
 167     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 168
 169     creds->dir = g_strdup(value);
 170 }
 171
 172
 173 static char *
 174 qcrypto_tls_creds_prop_get_dir(Object *obj,
 175                                Error **errp G_GNUC_UNUSED)
 176 {
 177     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 178
 179     return g_strdup(creds->dir);
 180 }
 181
 182
 183 static void
 184 qcrypto_tls_creds_prop_set_priority(Object *obj,
 185                                     const char *value,
 186                                     Error **errp G_GNUC_UNUSED)
 187 {
 188     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 189
 190     creds->priority = g_strdup(value);
 191 }
 192
 193
 194 static char *
 195 qcrypto_tls_creds_prop_get_priority(Object *obj,
 196                                     Error **errp G_GNUC_UNUSED)
 197 {
 198     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 199
 200     return g_strdup(creds->priority);
 201 }
 202
 203
 204 static void
 205 qcrypto_tls_creds_prop_set_endpoint(Object *obj,
 206                                     int value,
 207                                     Error **errp G_GNUC_UNUSED)
 208 {
 209     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 210
 211     creds->endpoint = value;
 212 }
 213
 214
 215 static int
 216 qcrypto_tls_creds_prop_get_endpoint(Object *obj,
 217                                     Error **errp G_GNUC_UNUSED)
 218 {
 219     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 220
 221     return creds->endpoint;
 222 }
 223
 224
 225 static void
 226 qcrypto_tls_creds_class_init(ObjectClass *oc, void *data)
 227 {
 228     object_class_property_add_bool(oc, "verify-peer",
 229                                    qcrypto_tls_creds_prop_get_verify,
 230                                    qcrypto_tls_creds_prop_set_verify);
 231     object_class_property_add_str(oc, "dir",
 232                                   qcrypto_tls_creds_prop_get_dir,
 233                                   qcrypto_tls_creds_prop_set_dir);
 234     object_class_property_add_enum(oc, "endpoint",
 235                                    "QCryptoTLSCredsEndpoint",
 236                                    &QCryptoTLSCredsEndpoint_lookup,
 237                                    qcrypto_tls_creds_prop_get_endpoint,
 238                                    qcrypto_tls_creds_prop_set_endpoint);
 239     object_class_property_add_str(oc, "priority",
 240                                   qcrypto_tls_creds_prop_get_priority,
 241                                   qcrypto_tls_creds_prop_set_priority);
 242 }
 243
 244
 245 static void
 246 qcrypto_tls_creds_init(Object *obj)
 247 {
 248     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 249
 250     creds->verifyPeer = true;
 251 }
 252
 253
 254 static void
 255 qcrypto_tls_creds_finalize(Object *obj)
 256 {
 257     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 258
 259     g_free(creds->dir);
 260     g_free(creds->priority);
 261 }
 262
 263 bool qcrypto_tls_creds_check_endpoint(QCryptoTLSCreds *creds,
 264                                       QCryptoTLSCredsEndpoint endpoint,
 265                                       Error **errp)
 266 {
 267     if (creds->endpoint != endpoint) {
 268         error_setg(errp, "Expected TLS credentials for a %s endpoint",
 269                    QCryptoTLSCredsEndpoint_str(endpoint));
 270         return false;
 271     }
 272     return true;
 273 }
 274
 275 static const TypeInfo qcrypto_tls_creds_info = {
 276     .parent = TYPE_OBJECT,
 277     .name = TYPE_QCRYPTO_TLS_CREDS,
 278     .instance_size = sizeof(QCryptoTLSCreds),
 279     .instance_init = qcrypto_tls_creds_init,
 280     .instance_finalize = qcrypto_tls_creds_finalize,
 281     .class_init = qcrypto_tls_creds_class_init,
 282     .class_size = sizeof(QCryptoTLSCredsClass),
 283     .abstract = true,
 284 };
 285
 286
 287 static void
 288 qcrypto_tls_creds_register_types(void)
 289 {
 290     type_register_static(&qcrypto_tls_creds_info);
 291 }
 292
 293
 294 type_init(qcrypto_tls_creds_register_types);