1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21#include "qemu/osdep.h"
22#include "qapi/error.h"
23#include "qapi-types-crypto.h"
24#include "qemu/module.h"
25#include "tlscredspriv.h"
26#include "trace.h"
27
28#define DH_BITS 2048
29
30#ifdef CONFIG_GNUTLS
31int
32qcrypto_tls_creds_get_dh_params_file(QCryptoTLSCreds *creds,
33 const char *filename,
34 gnutls_dh_params_t *dh_params,
35 Error **errp)
36{
37 int ret;
38
39 trace_qcrypto_tls_creds_load_dh(creds, filename ? filename : "<generated>");
40
41 if (filename == NULL) {
42 ret = gnutls_dh_params_init(dh_params);
43 if (ret < 0) {
44 error_setg(errp, "Unable to initialize DH parameters: %s",
45 gnutls_strerror(ret));
46 return -1;
47 }
48 ret = gnutls_dh_params_generate2(*dh_params, DH_BITS);
49 if (ret < 0) {
50 gnutls_dh_params_deinit(*dh_params);
51 *dh_params = NULL;
52 error_setg(errp, "Unable to generate DH parameters: %s",
53 gnutls_strerror(ret));
54 return -1;
55 }
56 } else {
57 GError *gerr = NULL;
58 gchar *contents;
59 gsize len;
60 gnutls_datum_t data;
61 if (!g_file_get_contents(filename,
62 &contents,
63 &len,
64 &gerr)) {
65
66 error_setg(errp, "%s", gerr->message);
67 g_error_free(gerr);
68 return -1;
69 }
70 data.data = (unsigned char *)contents;
71 data.size = len;
72 ret = gnutls_dh_params_init(dh_params);
73 if (ret < 0) {
74 g_free(contents);
75 error_setg(errp, "Unable to initialize DH parameters: %s",
76 gnutls_strerror(ret));
77 return -1;
78 }
79 ret = gnutls_dh_params_import_pkcs3(*dh_params,
80 &data,
81 GNUTLS_X509_FMT_PEM);
82 g_free(contents);
83 if (ret < 0) {
84 gnutls_dh_params_deinit(*dh_params);
85 *dh_params = NULL;
86 error_setg(errp, "Unable to load DH parameters from %s: %s",
87 filename, gnutls_strerror(ret));
88 return -1;
89 }
90 }
91
92 return 0;
93}
94
95
96int
97qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds,
98 const char *filename,
99 bool required,
100 char **cred,
101 Error **errp)
102{
103 struct stat sb;
104 int ret = -1;
105
106 if (!creds->dir) {
107 if (required) {
108 error_setg(errp, "Missing 'dir' property value");
109 return -1;
110 } else {
111 return 0;
112 }
113 }
114
115 *cred = g_strdup_printf("%s/%s", creds->dir, filename);
116
117 if (stat(*cred, &sb) < 0) {
118 if (errno == ENOENT && !required) {
119 ret = 0;
120 } else {
121 error_setg_errno(errp, errno,
122 "Unable to access credentials %s",
123 *cred);
124 }
125 g_free(*cred);
126 *cred = NULL;
127 goto cleanup;
128 }
129
130 ret = 0;
131 cleanup:
132 trace_qcrypto_tls_creds_get_path(creds, filename,
133 *cred ? *cred : "<none>");
134 return ret;
135}
136
137
138#endif
139
140
141static void
142qcrypto_tls_creds_prop_set_verify(Object *obj,
143 bool value,
144 Error **errp G_GNUC_UNUSED)
145{
146 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
147
148 creds->verifyPeer = value;
149}
150
151
152static bool
153qcrypto_tls_creds_prop_get_verify(Object *obj,
154 Error **errp G_GNUC_UNUSED)
155{
156 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
157
158 return creds->verifyPeer;
159}
160
161
162static void
163qcrypto_tls_creds_prop_set_dir(Object *obj,
164 const char *value,
165 Error **errp G_GNUC_UNUSED)
166{
167 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
168
169 creds->dir = g_strdup(value);
170}
171
172
173static char *
174qcrypto_tls_creds_prop_get_dir(Object *obj,
175 Error **errp G_GNUC_UNUSED)
176{
177 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
178
179 return g_strdup(creds->dir);
180}
181
182
183static void
184qcrypto_tls_creds_prop_set_priority(Object *obj,
185 const char *value,
186 Error **errp G_GNUC_UNUSED)
187{
188 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
189
190 creds->priority = g_strdup(value);
191}
192
193
194static char *
195qcrypto_tls_creds_prop_get_priority(Object *obj,
196 Error **errp G_GNUC_UNUSED)
197{
198 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
199
200 return g_strdup(creds->priority);
201}
202
203
204static void
205qcrypto_tls_creds_prop_set_endpoint(Object *obj,
206 int value,
207 Error **errp G_GNUC_UNUSED)
208{
209 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
210
211 creds->endpoint = value;
212}
213
214
215static int
216qcrypto_tls_creds_prop_get_endpoint(Object *obj,
217 Error **errp G_GNUC_UNUSED)
218{
219 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
220
221 return creds->endpoint;
222}
223
224
225static void
226qcrypto_tls_creds_class_init(ObjectClass *oc, void *data)
227{
228 object_class_property_add_bool(oc, "verify-peer",
229 qcrypto_tls_creds_prop_get_verify,
230 qcrypto_tls_creds_prop_set_verify);
231 object_class_property_add_str(oc, "dir",
232 qcrypto_tls_creds_prop_get_dir,
233 qcrypto_tls_creds_prop_set_dir);
234 object_class_property_add_enum(oc, "endpoint",
235 "QCryptoTLSCredsEndpoint",
236 &QCryptoTLSCredsEndpoint_lookup,
237 qcrypto_tls_creds_prop_get_endpoint,
238 qcrypto_tls_creds_prop_set_endpoint);
239 object_class_property_add_str(oc, "priority",
240 qcrypto_tls_creds_prop_get_priority,
241 qcrypto_tls_creds_prop_set_priority);
242}
243
244
245static void
246qcrypto_tls_creds_init(Object *obj)
247{
248 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
249
250 creds->verifyPeer = true;
251}
252
253
254static void
255qcrypto_tls_creds_finalize(Object *obj)
256{
257 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
258
259 g_free(creds->dir);
260 g_free(creds->priority);
261}
262
263bool qcrypto_tls_creds_check_endpoint(QCryptoTLSCreds *creds,
264 QCryptoTLSCredsEndpoint endpoint,
265 Error **errp)
266{
267 if (creds->endpoint != endpoint) {
268 error_setg(errp, "Expected TLS credentials for a %s endpoint",
269 QCryptoTLSCredsEndpoint_str(endpoint));
270 return false;
271 }
272 return true;
273}
274
275static const TypeInfo qcrypto_tls_creds_info = {
276 .parent = TYPE_OBJECT,
277 .name = TYPE_QCRYPTO_TLS_CREDS,
278 .instance_size = sizeof(QCryptoTLSCreds),
279 .instance_init = qcrypto_tls_creds_init,
280 .instance_finalize = qcrypto_tls_creds_finalize,
281 .class_init = qcrypto_tls_creds_class_init,
282 .class_size = sizeof(QCryptoTLSCredsClass),
283 .abstract = true,
284};
285
286
287static void
288qcrypto_tls_creds_register_types(void)
289{
290 type_register_static(&qcrypto_tls_creds_info);
291}
292
293
294type_init(qcrypto_tls_creds_register_types);
295
