crypto/tlscredspsk.c

   1 /*
   2  * QEMU crypto TLS Pre-Shared Keys (PSK) support
   3  *
   4  * Copyright (c) 2018 Red Hat, Inc.
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "crypto/tlscredspsk.h"
  23 #include "tlscredspriv.h"
  24 #include "qapi/error.h"
  25 #include "qemu/module.h"
  26 #include "qom/object_interfaces.h"
  27 #include "trace.h"
  28
  29
  30 #ifdef CONFIG_GNUTLS
  31
  32 #include <gnutls/gnutls.h>
  33
  34 static int
  35 lookup_key(const char *pskfile, const char *username, gnutls_datum_t *key,
  36            Error **errp)
  37 {
  38     const size_t ulen = strlen(username);
  39     GError *gerr = NULL;
  40     char *content = NULL;
  41     char **lines = NULL;
  42     size_t clen = 0, i;
  43     int ret = -1;
  44
  45     if (!g_file_get_contents(pskfile, &content, &clen, &gerr)) {
  46         error_setg(errp, "Cannot read PSK file %s: %s",
  47                    pskfile, gerr->message);
  48         g_error_free(gerr);
  49         return -1;
  50     }
  51
  52     lines = g_strsplit(content, "\n", -1);
  53     for (i = 0; lines[i] != NULL; ++i) {
  54         if (strncmp(lines[i], username, ulen) == 0 && lines[i][ulen] == ':') {
  55             key->data = (unsigned char *) g_strdup(&lines[i][ulen + 1]);
  56             key->size = strlen(lines[i]) - ulen - 1;
  57             ret = 0;
  58             goto out;
  59         }
  60     }
  61     error_setg(errp, "Username %s not found in PSK file %s",
  62                username, pskfile);
  63
  64  out:
  65     free(content);
  66     g_strfreev(lines);
  67     return ret;
  68 }
  69
  70 static int
  71 qcrypto_tls_creds_psk_load(QCryptoTLSCredsPSK *creds,
  72                            Error **errp)
  73 {
  74     g_autofree char *pskfile = NULL;
  75     g_autofree char *dhparams = NULL;
  76     const char *username;
  77     int ret;
  78     int rv = -1;
  79     gnutls_datum_t key = { .data = NULL };
  80
  81     trace_qcrypto_tls_creds_psk_load(creds,
  82             creds->parent_obj.dir ? creds->parent_obj.dir : "<nodir>");
  83
  84     if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
  85         if (creds->username) {
  86             error_setg(errp, "username should not be set when endpoint=server");
  87             goto cleanup;
  88         }
  89
  90         if (qcrypto_tls_creds_get_path(&creds->parent_obj,
  91                                        QCRYPTO_TLS_CREDS_DH_PARAMS,
  92                                        false, &dhparams, errp) < 0 ||
  93             qcrypto_tls_creds_get_path(&creds->parent_obj,
  94                                        QCRYPTO_TLS_CREDS_PSKFILE,
  95                                        true, &pskfile, errp) < 0) {
  96             goto cleanup;
  97         }
  98
  99         ret = gnutls_psk_allocate_server_credentials(&creds->data.server);
 100         if (ret < 0) {
 101             error_setg(errp, "Cannot allocate credentials: %s",
 102                        gnutls_strerror(ret));
 103             goto cleanup;
 104         }
 105
 106         if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams,
 107                                                  &creds->parent_obj.dh_params,
 108                                                  errp) < 0) {
 109             goto cleanup;
 110         }
 111
 112         gnutls_psk_set_server_credentials_file(creds->data.server, pskfile);
 113         gnutls_psk_set_server_dh_params(creds->data.server,
 114                                         creds->parent_obj.dh_params);
 115     } else {
 116         if (qcrypto_tls_creds_get_path(&creds->parent_obj,
 117                                        QCRYPTO_TLS_CREDS_PSKFILE,
 118                                        true, &pskfile, errp) < 0) {
 119             goto cleanup;
 120         }
 121
 122         if (creds->username) {
 123             username = creds->username;
 124         } else {
 125             username = "qemu";
 126         }
 127         if (lookup_key(pskfile, username, &key, errp) != 0) {
 128             goto cleanup;
 129         }
 130
 131         ret = gnutls_psk_allocate_client_credentials(&creds->data.client);
 132         if (ret < 0) {
 133             error_setg(errp, "Cannot allocate credentials: %s",
 134                        gnutls_strerror(ret));
 135             goto cleanup;
 136         }
 137
 138         gnutls_psk_set_client_credentials(creds->data.client,
 139                                           username, &key, GNUTLS_PSK_KEY_HEX);
 140     }
 141
 142     rv = 0;
 143  cleanup:
 144     g_free(key.data);
 145     return rv;
 146 }
 147
 148
 149 static void
 150 qcrypto_tls_creds_psk_unload(QCryptoTLSCredsPSK *creds)
 151 {
 152     if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT) {
 153         if (creds->data.client) {
 154             gnutls_psk_free_client_credentials(creds->data.client);
 155             creds->data.client = NULL;
 156         }
 157     } else {
 158         if (creds->data.server) {
 159             gnutls_psk_free_server_credentials(creds->data.server);
 160             creds->data.server = NULL;
 161         }
 162     }
 163     if (creds->parent_obj.dh_params) {
 164         gnutls_dh_params_deinit(creds->parent_obj.dh_params);
 165         creds->parent_obj.dh_params = NULL;
 166     }
 167 }
 168
 169 #else /* ! CONFIG_GNUTLS */
 170
 171
 172 static void
 173 qcrypto_tls_creds_psk_load(QCryptoTLSCredsPSK *creds G_GNUC_UNUSED,
 174                            Error **errp)
 175 {
 176     error_setg(errp, "TLS credentials support requires GNUTLS");
 177 }
 178
 179
 180 static void
 181 qcrypto_tls_creds_psk_unload(QCryptoTLSCredsPSK *creds G_GNUC_UNUSED)
 182 {
 183     /* nada */
 184 }
 185
 186
 187 #endif /* ! CONFIG_GNUTLS */
 188
 189
 190 static void
 191 qcrypto_tls_creds_psk_complete(UserCreatable *uc, Error **errp)
 192 {
 193     QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(uc);
 194
 195     qcrypto_tls_creds_psk_load(creds, errp);
 196 }
 197
 198
 199 #ifdef CONFIG_GNUTLS
 200
 201
 202 static bool
 203 qcrypto_tls_creds_psk_prop_get_loaded(Object *obj,
 204                                       Error **errp G_GNUC_UNUSED)
 205 {
 206     QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(obj);
 207
 208     if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
 209         return creds->data.server != NULL;
 210     } else {
 211         return creds->data.client != NULL;
 212     }
 213 }
 214
 215
 216 #else /* ! CONFIG_GNUTLS */
 217
 218
 219 static bool
 220 qcrypto_tls_creds_psk_prop_get_loaded(Object *obj G_GNUC_UNUSED,
 221                                       Error **errp G_GNUC_UNUSED)
 222 {
 223     return false;
 224 }
 225
 226
 227 #endif /* ! CONFIG_GNUTLS */
 228
 229
 230 static void
 231 qcrypto_tls_creds_psk_finalize(Object *obj)
 232 {
 233     QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(obj);
 234
 235     qcrypto_tls_creds_psk_unload(creds);
 236 }
 237
 238 static void
 239 qcrypto_tls_creds_psk_prop_set_username(Object *obj,
 240                                         const char *value,
 241                                         Error **errp G_GNUC_UNUSED)
 242 {
 243     QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(obj);
 244
 245     creds->username = g_strdup(value);
 246 }
 247
 248
 249 static char *
 250 qcrypto_tls_creds_psk_prop_get_username(Object *obj,
 251                                         Error **errp G_GNUC_UNUSED)
 252 {
 253     QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(obj);
 254
 255     return g_strdup(creds->username);
 256 }
 257
 258 static void
 259 qcrypto_tls_creds_psk_class_init(ObjectClass *oc, void *data)
 260 {
 261     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 262
 263     ucc->complete = qcrypto_tls_creds_psk_complete;
 264
 265     object_class_property_add_bool(oc, "loaded",
 266                                    qcrypto_tls_creds_psk_prop_get_loaded,
 267                                    NULL);
 268     object_class_property_add_str(oc, "username",
 269                                   qcrypto_tls_creds_psk_prop_get_username,
 270                                   qcrypto_tls_creds_psk_prop_set_username);
 271 }
 272
 273
 274 static const TypeInfo qcrypto_tls_creds_psk_info = {
 275     .parent = TYPE_QCRYPTO_TLS_CREDS,
 276     .name = TYPE_QCRYPTO_TLS_CREDS_PSK,
 277     .instance_size = sizeof(QCryptoTLSCredsPSK),
 278     .instance_finalize = qcrypto_tls_creds_psk_finalize,
 279     .class_size = sizeof(QCryptoTLSCredsPSKClass),
 280     .class_init = qcrypto_tls_creds_psk_class_init,
 281     .interfaces = (InterfaceInfo[]) {
 282         { TYPE_USER_CREATABLE },
 283         { }
 284     }
 285 };
 286
 287
 288 static void
 289 qcrypto_tls_creds_psk_register_types(void)
 290 {
 291     type_register_static(&qcrypto_tls_creds_psk_info);
 292 }
 293
 294
 295 type_init(qcrypto_tls_creds_psk_register_types);