Add SASL authentication support ("Daniel P. Berrange")
[qemu-kvm/fedora.git] / vnc-tls.c
blob666aa07963a3b9f9b0063c74106b8f2709283b1a
1 /*
2 * QEMU VNC display driver: TLS helpers
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
27 #include "vnc.h"
28 #include "qemu_socket.h"
30 #if defined(_VNC_DEBUG) && _VNC_DEBUG >= 2
31 /* Very verbose, so only enabled for _VNC_DEBUG >= 2 */
32 static void vnc_debug_gnutls_log(int level, const char* str) {
33 VNC_DEBUG("%d %s", level, str);
35 #endif /* defined(_VNC_DEBUG) && _VNC_DEBUG >= 2 */
38 #define DH_BITS 1024
39 static gnutls_dh_params_t dh_params;
41 static int vnc_tls_initialize(void)
43 static int tlsinitialized = 0;
45 if (tlsinitialized)
46 return 1;
48 if (gnutls_global_init () < 0)
49 return 0;
51 /* XXX ought to re-generate diffie-hellmen params periodically */
52 if (gnutls_dh_params_init (&dh_params) < 0)
53 return 0;
54 if (gnutls_dh_params_generate2 (dh_params, DH_BITS) < 0)
55 return 0;
57 #if defined(_VNC_DEBUG) && _VNC_DEBUG >= 2
58 gnutls_global_set_log_level(10);
59 gnutls_global_set_log_function(vnc_debug_gnutls_log);
60 #endif
62 tlsinitialized = 1;
64 return 1;
67 static ssize_t vnc_tls_push(gnutls_transport_ptr_t transport,
68 const void *data,
69 size_t len) {
70 struct VncState *vs = (struct VncState *)transport;
71 int ret;
73 retry:
74 ret = send(vs->csock, data, len, 0);
75 if (ret < 0) {
76 if (errno == EINTR)
77 goto retry;
78 return -1;
80 return ret;
84 static ssize_t vnc_tls_pull(gnutls_transport_ptr_t transport,
85 void *data,
86 size_t len) {
87 struct VncState *vs = (struct VncState *)transport;
88 int ret;
90 retry:
91 ret = recv(vs->csock, data, len, 0);
92 if (ret < 0) {
93 if (errno == EINTR)
94 goto retry;
95 return -1;
97 return ret;
101 static gnutls_anon_server_credentials vnc_tls_initialize_anon_cred(void)
103 gnutls_anon_server_credentials anon_cred;
104 int ret;
106 if ((ret = gnutls_anon_allocate_server_credentials(&anon_cred)) < 0) {
107 VNC_DEBUG("Cannot allocate credentials %s\n", gnutls_strerror(ret));
108 return NULL;
111 gnutls_anon_set_server_dh_params(anon_cred, dh_params);
113 return anon_cred;
117 static gnutls_certificate_credentials_t vnc_tls_initialize_x509_cred(VncDisplay *vd)
119 gnutls_certificate_credentials_t x509_cred;
120 int ret;
122 if (!vd->tls.x509cacert) {
123 VNC_DEBUG("No CA x509 certificate specified\n");
124 return NULL;
126 if (!vd->tls.x509cert) {
127 VNC_DEBUG("No server x509 certificate specified\n");
128 return NULL;
130 if (!vd->tls.x509key) {
131 VNC_DEBUG("No server private key specified\n");
132 return NULL;
135 if ((ret = gnutls_certificate_allocate_credentials(&x509_cred)) < 0) {
136 VNC_DEBUG("Cannot allocate credentials %s\n", gnutls_strerror(ret));
137 return NULL;
139 if ((ret = gnutls_certificate_set_x509_trust_file(x509_cred,
140 vd->tls.x509cacert,
141 GNUTLS_X509_FMT_PEM)) < 0) {
142 VNC_DEBUG("Cannot load CA certificate %s\n", gnutls_strerror(ret));
143 gnutls_certificate_free_credentials(x509_cred);
144 return NULL;
147 if ((ret = gnutls_certificate_set_x509_key_file (x509_cred,
148 vd->tls.x509cert,
149 vd->tls.x509key,
150 GNUTLS_X509_FMT_PEM)) < 0) {
151 VNC_DEBUG("Cannot load certificate & key %s\n", gnutls_strerror(ret));
152 gnutls_certificate_free_credentials(x509_cred);
153 return NULL;
156 if (vd->tls.x509cacrl) {
157 if ((ret = gnutls_certificate_set_x509_crl_file(x509_cred,
158 vd->tls.x509cacrl,
159 GNUTLS_X509_FMT_PEM)) < 0) {
160 VNC_DEBUG("Cannot load CRL %s\n", gnutls_strerror(ret));
161 gnutls_certificate_free_credentials(x509_cred);
162 return NULL;
166 gnutls_certificate_set_dh_params (x509_cred, dh_params);
168 return x509_cred;
172 int vnc_tls_validate_certificate(struct VncState *vs)
174 int ret;
175 unsigned int status;
176 const gnutls_datum_t *certs;
177 unsigned int nCerts, i;
178 time_t now;
180 VNC_DEBUG("Validating client certificate\n");
181 if ((ret = gnutls_certificate_verify_peers2 (vs->tls.session, &status)) < 0) {
182 VNC_DEBUG("Verify failed %s\n", gnutls_strerror(ret));
183 return -1;
186 if ((now = time(NULL)) == ((time_t)-1)) {
187 return -1;
190 if (status != 0) {
191 if (status & GNUTLS_CERT_INVALID)
192 VNC_DEBUG("The certificate is not trusted.\n");
194 if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)
195 VNC_DEBUG("The certificate hasn't got a known issuer.\n");
197 if (status & GNUTLS_CERT_REVOKED)
198 VNC_DEBUG("The certificate has been revoked.\n");
200 if (status & GNUTLS_CERT_INSECURE_ALGORITHM)
201 VNC_DEBUG("The certificate uses an insecure algorithm\n");
203 return -1;
204 } else {
205 VNC_DEBUG("Certificate is valid!\n");
208 /* Only support x509 for now */
209 if (gnutls_certificate_type_get(vs->tls.session) != GNUTLS_CRT_X509)
210 return -1;
212 if (!(certs = gnutls_certificate_get_peers(vs->tls.session, &nCerts)))
213 return -1;
215 for (i = 0 ; i < nCerts ; i++) {
216 gnutls_x509_crt_t cert;
217 VNC_DEBUG ("Checking certificate chain %d\n", i);
218 if (gnutls_x509_crt_init (&cert) < 0)
219 return -1;
221 if (gnutls_x509_crt_import(cert, &certs[i], GNUTLS_X509_FMT_DER) < 0) {
222 gnutls_x509_crt_deinit (cert);
223 return -1;
226 if (gnutls_x509_crt_get_expiration_time (cert) < now) {
227 VNC_DEBUG("The certificate has expired\n");
228 gnutls_x509_crt_deinit (cert);
229 return -1;
232 if (gnutls_x509_crt_get_activation_time (cert) > now) {
233 VNC_DEBUG("The certificate is not yet activated\n");
234 gnutls_x509_crt_deinit (cert);
235 return -1;
238 if (gnutls_x509_crt_get_activation_time (cert) > now) {
239 VNC_DEBUG("The certificate is not yet activated\n");
240 gnutls_x509_crt_deinit (cert);
241 return -1;
244 gnutls_x509_crt_deinit (cert);
247 return 0;
251 int vnc_tls_client_setup(struct VncState *vs,
252 int needX509Creds) {
253 static const int cert_type_priority[] = { GNUTLS_CRT_X509, 0 };
254 static const int protocol_priority[]= { GNUTLS_TLS1_1, GNUTLS_TLS1_0, GNUTLS_SSL3, 0 };
255 static const int kx_anon[] = {GNUTLS_KX_ANON_DH, 0};
256 static const int kx_x509[] = {GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA, GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0};
258 VNC_DEBUG("Do TLS setup\n");
259 if (vnc_tls_initialize() < 0) {
260 VNC_DEBUG("Failed to init TLS\n");
261 vnc_client_error(vs);
262 return -1;
264 if (vs->tls.session == NULL) {
265 if (gnutls_init(&vs->tls.session, GNUTLS_SERVER) < 0) {
266 vnc_client_error(vs);
267 return -1;
270 if (gnutls_set_default_priority(vs->tls.session) < 0) {
271 gnutls_deinit(vs->tls.session);
272 vs->tls.session = NULL;
273 vnc_client_error(vs);
274 return -1;
277 if (gnutls_kx_set_priority(vs->tls.session, needX509Creds ? kx_x509 : kx_anon) < 0) {
278 gnutls_deinit(vs->tls.session);
279 vs->tls.session = NULL;
280 vnc_client_error(vs);
281 return -1;
284 if (gnutls_certificate_type_set_priority(vs->tls.session, cert_type_priority) < 0) {
285 gnutls_deinit(vs->tls.session);
286 vs->tls.session = NULL;
287 vnc_client_error(vs);
288 return -1;
291 if (gnutls_protocol_set_priority(vs->tls.session, protocol_priority) < 0) {
292 gnutls_deinit(vs->tls.session);
293 vs->tls.session = NULL;
294 vnc_client_error(vs);
295 return -1;
298 if (needX509Creds) {
299 gnutls_certificate_server_credentials x509_cred = vnc_tls_initialize_x509_cred(vs->vd);
300 if (!x509_cred) {
301 gnutls_deinit(vs->tls.session);
302 vs->tls.session = NULL;
303 vnc_client_error(vs);
304 return -1;
306 if (gnutls_credentials_set(vs->tls.session, GNUTLS_CRD_CERTIFICATE, x509_cred) < 0) {
307 gnutls_deinit(vs->tls.session);
308 vs->tls.session = NULL;
309 gnutls_certificate_free_credentials(x509_cred);
310 vnc_client_error(vs);
311 return -1;
313 if (vs->vd->tls.x509verify) {
314 VNC_DEBUG("Requesting a client certificate\n");
315 gnutls_certificate_server_set_request (vs->tls.session, GNUTLS_CERT_REQUEST);
318 } else {
319 gnutls_anon_server_credentials anon_cred = vnc_tls_initialize_anon_cred();
320 if (!anon_cred) {
321 gnutls_deinit(vs->tls.session);
322 vs->tls.session = NULL;
323 vnc_client_error(vs);
324 return -1;
326 if (gnutls_credentials_set(vs->tls.session, GNUTLS_CRD_ANON, anon_cred) < 0) {
327 gnutls_deinit(vs->tls.session);
328 vs->tls.session = NULL;
329 gnutls_anon_free_server_credentials(anon_cred);
330 vnc_client_error(vs);
331 return -1;
335 gnutls_transport_set_ptr(vs->tls.session, (gnutls_transport_ptr_t)vs);
336 gnutls_transport_set_push_function(vs->tls.session, vnc_tls_push);
337 gnutls_transport_set_pull_function(vs->tls.session, vnc_tls_pull);
339 return 0;
343 void vnc_tls_client_cleanup(struct VncState *vs)
345 if (vs->tls.session) {
346 gnutls_deinit(vs->tls.session);
347 vs->tls.session = NULL;
349 vs->tls.wiremode = VNC_WIREMODE_CLEAR;
354 static int vnc_set_x509_credential(VncDisplay *vd,
355 const char *certdir,
356 const char *filename,
357 char **cred,
358 int ignoreMissing)
360 struct stat sb;
362 if (*cred) {
363 qemu_free(*cred);
364 *cred = NULL;
367 *cred = qemu_malloc(strlen(certdir) + strlen(filename) + 2);
369 strcpy(*cred, certdir);
370 strcat(*cred, "/");
371 strcat(*cred, filename);
373 VNC_DEBUG("Check %s\n", *cred);
374 if (stat(*cred, &sb) < 0) {
375 qemu_free(*cred);
376 *cred = NULL;
377 if (ignoreMissing && errno == ENOENT)
378 return 0;
379 return -1;
382 return 0;
386 #define X509_CA_CERT_FILE "ca-cert.pem"
387 #define X509_CA_CRL_FILE "ca-crl.pem"
388 #define X509_SERVER_KEY_FILE "server-key.pem"
389 #define X509_SERVER_CERT_FILE "server-cert.pem"
392 int vnc_tls_set_x509_creds_dir(VncDisplay *vd,
393 const char *certdir)
395 if (vnc_set_x509_credential(vd, certdir, X509_CA_CERT_FILE, &vd->tls.x509cacert, 0) < 0)
396 goto cleanup;
397 if (vnc_set_x509_credential(vd, certdir, X509_CA_CRL_FILE, &vd->tls.x509cacrl, 1) < 0)
398 goto cleanup;
399 if (vnc_set_x509_credential(vd, certdir, X509_SERVER_CERT_FILE, &vd->tls.x509cert, 0) < 0)
400 goto cleanup;
401 if (vnc_set_x509_credential(vd, certdir, X509_SERVER_KEY_FILE, &vd->tls.x509key, 0) < 0)
402 goto cleanup;
404 return 0;
406 cleanup:
407 qemu_free(vd->tls.x509cacert);
408 qemu_free(vd->tls.x509cacrl);
409 qemu_free(vd->tls.x509cert);
410 qemu_free(vd->tls.x509key);
411 vd->tls.x509cacert = vd->tls.x509cacrl = vd->tls.x509cert = vd->tls.x509key = NULL;
412 return -1;