crypto/tlscredspsk.c

   1 /*
   2  * QEMU crypto TLS Pre-Shared Keys (PSK) support
   3  *
   4  * Copyright (c) 2018 Red Hat, Inc.
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "crypto/tlscredspsk.h"
  23 #include "tlscredspriv.h"
  24 #include "qapi/error.h"
  25 #include "qom/object_interfaces.h"
  26 #include "trace.h"
  27
  28
  29 #ifdef CONFIG_GNUTLS
  30
  31 static int
  32 lookup_key(const char *pskfile, const char *username, gnutls_datum_t *key,
  33            Error **errp)
  34 {
  35     const size_t ulen = strlen(username);
  36     GError *gerr = NULL;
  37     char *content = NULL;
  38     char **lines = NULL;
  39     size_t clen = 0, i;
  40     int ret = -1;
  41
  42     if (!g_file_get_contents(pskfile, &content, &clen, &gerr)) {
  43         error_setg(errp, "Cannot read PSK file %s: %s",
  44                    pskfile, gerr->message);
  45         g_error_free(gerr);
  46         return -1;
  47     }
  48
  49     lines = g_strsplit(content, "\n", -1);
  50     for (i = 0; lines[i] != NULL; ++i) {
  51         if (strncmp(lines[i], username, ulen) == 0 && lines[i][ulen] == ':') {
  52             key->data = (unsigned char *) g_strdup(&lines[i][ulen + 1]);
  53             key->size = strlen(lines[i]) - ulen - 1;
  54             ret = 0;
  55             goto out;
  56         }
  57     }
  58     error_setg(errp, "Username %s not found in PSK file %s",
  59                username, pskfile);
  60
  61  out:
  62     free(content);
  63     g_strfreev(lines);
  64     return ret;
  65 }
  66
  67 static int
  68 qcrypto_tls_creds_psk_load(QCryptoTLSCredsPSK *creds,
  69                            Error **errp)
  70 {
  71     char *pskfile = NULL, *dhparams = NULL;
  72     const char *username;
  73     int ret;
  74     int rv = -1;
  75     gnutls_datum_t key = { .data = NULL };
  76
  77     trace_qcrypto_tls_creds_psk_load(creds,
  78             creds->parent_obj.dir ? creds->parent_obj.dir : "<nodir>");
  79
  80     if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
  81         if (creds->username) {
  82             error_setg(errp, "username should not be set when endpoint=server");
  83             goto cleanup;
  84         }
  85
  86         if (qcrypto_tls_creds_get_path(&creds->parent_obj,
  87                                        QCRYPTO_TLS_CREDS_DH_PARAMS,
  88                                        false, &dhparams, errp) < 0 ||
  89             qcrypto_tls_creds_get_path(&creds->parent_obj,
  90                                        QCRYPTO_TLS_CREDS_PSKFILE,
  91                                        true, &pskfile, errp) < 0) {
  92             goto cleanup;
  93         }
  94
  95         ret = gnutls_psk_allocate_server_credentials(&creds->data.server);
  96         if (ret < 0) {
  97             error_setg(errp, "Cannot allocate credentials: %s",
  98                        gnutls_strerror(ret));
  99             goto cleanup;
 100         }
 101
 102         if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams,
 103                                                  &creds->parent_obj.dh_params,
 104                                                  errp) < 0) {
 105             goto cleanup;
 106         }
 107
 108         gnutls_psk_set_server_credentials_file(creds->data.server, pskfile);
 109         gnutls_psk_set_server_dh_params(creds->data.server,
 110                                         creds->parent_obj.dh_params);
 111     } else {
 112         if (qcrypto_tls_creds_get_path(&creds->parent_obj,
 113                                        QCRYPTO_TLS_CREDS_PSKFILE,
 114                                        true, &pskfile, errp) < 0) {
 115             goto cleanup;
 116         }
 117
 118         if (creds->username) {
 119             username = creds->username;
 120         } else {
 121             username = "qemu";
 122         }
 123         if (lookup_key(pskfile, username, &key, errp) != 0) {
 124             goto cleanup;
 125         }
 126
 127         ret = gnutls_psk_allocate_client_credentials(&creds->data.client);
 128         if (ret < 0) {
 129             error_setg(errp, "Cannot allocate credentials: %s",
 130                        gnutls_strerror(ret));
 131             goto cleanup;
 132         }
 133
 134         gnutls_psk_set_client_credentials(creds->data.client,
 135                                           username, &key, GNUTLS_PSK_KEY_HEX);
 136     }
 137
 138     rv = 0;
 139  cleanup:
 140     g_free(key.data);
 141     g_free(pskfile);
 142     g_free(dhparams);
 143     return rv;
 144 }
 145
 146
 147 static void
 148 qcrypto_tls_creds_psk_unload(QCryptoTLSCredsPSK *creds)
 149 {
 150     if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT) {
 151         if (creds->data.client) {
 152             gnutls_psk_free_client_credentials(creds->data.client);
 153             creds->data.client = NULL;
 154         }
 155     } else {
 156         if (creds->data.server) {
 157             gnutls_psk_free_server_credentials(creds->data.server);
 158             creds->data.server = NULL;
 159         }
 160     }
 161     if (creds->parent_obj.dh_params) {
 162         gnutls_dh_params_deinit(creds->parent_obj.dh_params);
 163         creds->parent_obj.dh_params = NULL;
 164     }
 165 }
 166
 167 #else /* ! CONFIG_GNUTLS */
 168
 169
 170 static void
 171 qcrypto_tls_creds_psk_load(QCryptoTLSCredsPSK *creds G_GNUC_UNUSED,
 172                            Error **errp)
 173 {
 174     error_setg(errp, "TLS credentials support requires GNUTLS");
 175 }
 176
 177
 178 static void
 179 qcrypto_tls_creds_psk_unload(QCryptoTLSCredsPSK *creds G_GNUC_UNUSED)
 180 {
 181     /* nada */
 182 }
 183
 184
 185 #endif /* ! CONFIG_GNUTLS */
 186
 187
 188 static void
 189 qcrypto_tls_creds_psk_prop_set_loaded(Object *obj,
 190                                       bool value,
 191                                       Error **errp)
 192 {
 193     QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(obj);
 194
 195     if (value) {
 196         qcrypto_tls_creds_psk_load(creds, errp);
 197     } else {
 198         qcrypto_tls_creds_psk_unload(creds);
 199     }
 200 }
 201
 202
 203 #ifdef CONFIG_GNUTLS
 204
 205
 206 static bool
 207 qcrypto_tls_creds_psk_prop_get_loaded(Object *obj,
 208                                       Error **errp G_GNUC_UNUSED)
 209 {
 210     QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(obj);
 211
 212     if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
 213         return creds->data.server != NULL;
 214     } else {
 215         return creds->data.client != NULL;
 216     }
 217 }
 218
 219
 220 #else /* ! CONFIG_GNUTLS */
 221
 222
 223 static bool
 224 qcrypto_tls_creds_psk_prop_get_loaded(Object *obj G_GNUC_UNUSED,
 225                                       Error **errp G_GNUC_UNUSED)
 226 {
 227     return false;
 228 }
 229
 230
 231 #endif /* ! CONFIG_GNUTLS */
 232
 233
 234 static void
 235 qcrypto_tls_creds_psk_complete(UserCreatable *uc, Error **errp)
 236 {
 237     object_property_set_bool(OBJECT(uc), true, "loaded", errp);
 238 }
 239
 240
 241 static void
 242 qcrypto_tls_creds_psk_finalize(Object *obj)
 243 {
 244     QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(obj);
 245
 246     qcrypto_tls_creds_psk_unload(creds);
 247 }
 248
 249 static void
 250 qcrypto_tls_creds_psk_prop_set_username(Object *obj,
 251                                         const char *value,
 252                                         Error **errp G_GNUC_UNUSED)
 253 {
 254     QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(obj);
 255
 256     creds->username = g_strdup(value);
 257 }
 258
 259
 260 static char *
 261 qcrypto_tls_creds_psk_prop_get_username(Object *obj,
 262                                         Error **errp G_GNUC_UNUSED)
 263 {
 264     QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(obj);
 265
 266     return g_strdup(creds->username);
 267 }
 268
 269 static void
 270 qcrypto_tls_creds_psk_class_init(ObjectClass *oc, void *data)
 271 {
 272     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 273
 274     ucc->complete = qcrypto_tls_creds_psk_complete;
 275
 276     object_class_property_add_bool(oc, "loaded",
 277                                    qcrypto_tls_creds_psk_prop_get_loaded,
 278                                    qcrypto_tls_creds_psk_prop_set_loaded,
 279                                    NULL);
 280     object_class_property_add_str(oc, "username",
 281                                   qcrypto_tls_creds_psk_prop_get_username,
 282                                   qcrypto_tls_creds_psk_prop_set_username,
 283                                   NULL);
 284 }
 285
 286
 287 static const TypeInfo qcrypto_tls_creds_psk_info = {
 288     .parent = TYPE_QCRYPTO_TLS_CREDS,
 289     .name = TYPE_QCRYPTO_TLS_CREDS_PSK,
 290     .instance_size = sizeof(QCryptoTLSCredsPSK),
 291     .instance_finalize = qcrypto_tls_creds_psk_finalize,
 292     .class_size = sizeof(QCryptoTLSCredsPSKClass),
 293     .class_init = qcrypto_tls_creds_psk_class_init,
 294     .interfaces = (InterfaceInfo[]) {
 295         { TYPE_USER_CREATABLE },
 296         { }
 297     }
 298 };
 299
 300
 301 static void
 302 qcrypto_tls_creds_psk_register_types(void)
 303 {
 304     type_register_static(&qcrypto_tls_creds_psk_info);
 305 }
 306
 307
 308 type_init(qcrypto_tls_creds_psk_register_types);