crypto/tlscredspsk.c

   1 /*
   2  * QEMU crypto TLS Pre-Shared Keys (PSK) support
   3  *
   4  * Copyright (c) 2018 Red Hat, Inc.
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "crypto/tlscredspsk.h"
  23 #include "tlscredspriv.h"
  24 #include "qapi/error.h"
  25 #include "qemu/module.h"
  26 #include "qom/object_interfaces.h"
  27 #include "trace.h"
  28
  29
  30 #ifdef CONFIG_GNUTLS
  31
  32 static int
  33 lookup_key(const char *pskfile, const char *username, gnutls_datum_t *key,
  34            Error **errp)
  35 {
  36     const size_t ulen = strlen(username);
  37     GError *gerr = NULL;
  38     char *content = NULL;
  39     char **lines = NULL;
  40     size_t clen = 0, i;
  41     int ret = -1;
  42
  43     if (!g_file_get_contents(pskfile, &content, &clen, &gerr)) {
  44         error_setg(errp, "Cannot read PSK file %s: %s",
  45                    pskfile, gerr->message);
  46         g_error_free(gerr);
  47         return -1;
  48     }
  49
  50     lines = g_strsplit(content, "\n", -1);
  51     for (i = 0; lines[i] != NULL; ++i) {
  52         if (strncmp(lines[i], username, ulen) == 0 && lines[i][ulen] == ':') {
  53             key->data = (unsigned char *) g_strdup(&lines[i][ulen + 1]);
  54             key->size = strlen(lines[i]) - ulen - 1;
  55             ret = 0;
  56             goto out;
  57         }
  58     }
  59     error_setg(errp, "Username %s not found in PSK file %s",
  60                username, pskfile);
  61
  62  out:
  63     free(content);
  64     g_strfreev(lines);
  65     return ret;
  66 }
  67
  68 static int
  69 qcrypto_tls_creds_psk_load(QCryptoTLSCredsPSK *creds,
  70                            Error **errp)
  71 {
  72     char *pskfile = NULL, *dhparams = NULL;
  73     const char *username;
  74     int ret;
  75     int rv = -1;
  76     gnutls_datum_t key = { .data = NULL };
  77
  78     trace_qcrypto_tls_creds_psk_load(creds,
  79             creds->parent_obj.dir ? creds->parent_obj.dir : "<nodir>");
  80
  81     if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
  82         if (creds->username) {
  83             error_setg(errp, "username should not be set when endpoint=server");
  84             goto cleanup;
  85         }
  86
  87         if (qcrypto_tls_creds_get_path(&creds->parent_obj,
  88                                        QCRYPTO_TLS_CREDS_DH_PARAMS,
  89                                        false, &dhparams, errp) < 0 ||
  90             qcrypto_tls_creds_get_path(&creds->parent_obj,
  91                                        QCRYPTO_TLS_CREDS_PSKFILE,
  92                                        true, &pskfile, errp) < 0) {
  93             goto cleanup;
  94         }
  95
  96         ret = gnutls_psk_allocate_server_credentials(&creds->data.server);
  97         if (ret < 0) {
  98             error_setg(errp, "Cannot allocate credentials: %s",
  99                        gnutls_strerror(ret));
 100             goto cleanup;
 101         }
 102
 103         if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams,
 104                                                  &creds->parent_obj.dh_params,
 105                                                  errp) < 0) {
 106             goto cleanup;
 107         }
 108
 109         gnutls_psk_set_server_credentials_file(creds->data.server, pskfile);
 110         gnutls_psk_set_server_dh_params(creds->data.server,
 111                                         creds->parent_obj.dh_params);
 112     } else {
 113         if (qcrypto_tls_creds_get_path(&creds->parent_obj,
 114                                        QCRYPTO_TLS_CREDS_PSKFILE,
 115                                        true, &pskfile, errp) < 0) {
 116             goto cleanup;
 117         }
 118
 119         if (creds->username) {
 120             username = creds->username;
 121         } else {
 122             username = "qemu";
 123         }
 124         if (lookup_key(pskfile, username, &key, errp) != 0) {
 125             goto cleanup;
 126         }
 127
 128         ret = gnutls_psk_allocate_client_credentials(&creds->data.client);
 129         if (ret < 0) {
 130             error_setg(errp, "Cannot allocate credentials: %s",
 131                        gnutls_strerror(ret));
 132             goto cleanup;
 133         }
 134
 135         gnutls_psk_set_client_credentials(creds->data.client,
 136                                           username, &key, GNUTLS_PSK_KEY_HEX);
 137     }
 138
 139     rv = 0;
 140  cleanup:
 141     g_free(key.data);
 142     g_free(pskfile);
 143     g_free(dhparams);
 144     return rv;
 145 }
 146
 147
 148 static void
 149 qcrypto_tls_creds_psk_unload(QCryptoTLSCredsPSK *creds)
 150 {
 151     if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT) {
 152         if (creds->data.client) {
 153             gnutls_psk_free_client_credentials(creds->data.client);
 154             creds->data.client = NULL;
 155         }
 156     } else {
 157         if (creds->data.server) {
 158             gnutls_psk_free_server_credentials(creds->data.server);
 159             creds->data.server = NULL;
 160         }
 161     }
 162     if (creds->parent_obj.dh_params) {
 163         gnutls_dh_params_deinit(creds->parent_obj.dh_params);
 164         creds->parent_obj.dh_params = NULL;
 165     }
 166 }
 167
 168 #else /* ! CONFIG_GNUTLS */
 169
 170
 171 static void
 172 qcrypto_tls_creds_psk_load(QCryptoTLSCredsPSK *creds G_GNUC_UNUSED,
 173                            Error **errp)
 174 {
 175     error_setg(errp, "TLS credentials support requires GNUTLS");
 176 }
 177
 178
 179 static void
 180 qcrypto_tls_creds_psk_unload(QCryptoTLSCredsPSK *creds G_GNUC_UNUSED)
 181 {
 182     /* nada */
 183 }
 184
 185
 186 #endif /* ! CONFIG_GNUTLS */
 187
 188
 189 static void
 190 qcrypto_tls_creds_psk_prop_set_loaded(Object *obj,
 191                                       bool value,
 192                                       Error **errp)
 193 {
 194     QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(obj);
 195
 196     if (value) {
 197         qcrypto_tls_creds_psk_load(creds, errp);
 198     } else {
 199         qcrypto_tls_creds_psk_unload(creds);
 200     }
 201 }
 202
 203
 204 #ifdef CONFIG_GNUTLS
 205
 206
 207 static bool
 208 qcrypto_tls_creds_psk_prop_get_loaded(Object *obj,
 209                                       Error **errp G_GNUC_UNUSED)
 210 {
 211     QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(obj);
 212
 213     if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
 214         return creds->data.server != NULL;
 215     } else {
 216         return creds->data.client != NULL;
 217     }
 218 }
 219
 220
 221 #else /* ! CONFIG_GNUTLS */
 222
 223
 224 static bool
 225 qcrypto_tls_creds_psk_prop_get_loaded(Object *obj G_GNUC_UNUSED,
 226                                       Error **errp G_GNUC_UNUSED)
 227 {
 228     return false;
 229 }
 230
 231
 232 #endif /* ! CONFIG_GNUTLS */
 233
 234
 235 static void
 236 qcrypto_tls_creds_psk_complete(UserCreatable *uc, Error **errp)
 237 {
 238     object_property_set_bool(OBJECT(uc), true, "loaded", errp);
 239 }
 240
 241
 242 static void
 243 qcrypto_tls_creds_psk_finalize(Object *obj)
 244 {
 245     QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(obj);
 246
 247     qcrypto_tls_creds_psk_unload(creds);
 248 }
 249
 250 static void
 251 qcrypto_tls_creds_psk_prop_set_username(Object *obj,
 252                                         const char *value,
 253                                         Error **errp G_GNUC_UNUSED)
 254 {
 255     QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(obj);
 256
 257     creds->username = g_strdup(value);
 258 }
 259
 260
 261 static char *
 262 qcrypto_tls_creds_psk_prop_get_username(Object *obj,
 263                                         Error **errp G_GNUC_UNUSED)
 264 {
 265     QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(obj);
 266
 267     return g_strdup(creds->username);
 268 }
 269
 270 static void
 271 qcrypto_tls_creds_psk_class_init(ObjectClass *oc, void *data)
 272 {
 273     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 274
 275     ucc->complete = qcrypto_tls_creds_psk_complete;
 276
 277     object_class_property_add_bool(oc, "loaded",
 278                                    qcrypto_tls_creds_psk_prop_get_loaded,
 279                                    qcrypto_tls_creds_psk_prop_set_loaded,
 280                                    NULL);
 281     object_class_property_add_str(oc, "username",
 282                                   qcrypto_tls_creds_psk_prop_get_username,
 283                                   qcrypto_tls_creds_psk_prop_set_username,
 284                                   NULL);
 285 }
 286
 287
 288 static const TypeInfo qcrypto_tls_creds_psk_info = {
 289     .parent = TYPE_QCRYPTO_TLS_CREDS,
 290     .name = TYPE_QCRYPTO_TLS_CREDS_PSK,
 291     .instance_size = sizeof(QCryptoTLSCredsPSK),
 292     .instance_finalize = qcrypto_tls_creds_psk_finalize,
 293     .class_size = sizeof(QCryptoTLSCredsPSKClass),
 294     .class_init = qcrypto_tls_creds_psk_class_init,
 295     .interfaces = (InterfaceInfo[]) {
 296         { TYPE_USER_CREATABLE },
 297         { }
 298     }
 299 };
 300
 301
 302 static void
 303 qcrypto_tls_creds_psk_register_types(void)
 304 {
 305     type_register_static(&qcrypto_tls_creds_psk_info);
 306 }
 307
 308
 309 type_init(qcrypto_tls_creds_psk_register_types);