Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210330' into...
[qemu/ar7.git] / crypto / tlscreds.c
blobb68735f06fe35a75605533ae1f81392c9559f7de
1 /*
2  * QEMU crypto TLS credential support
3  *
4  * Copyright (c) 2015 Red Hat, Inc.
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18  *
19  */
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "qemu/module.h"
24 #include "tlscredspriv.h"
25 #include "trace.h"
27 #define DH_BITS 2048
29 #ifdef CONFIG_GNUTLS
30 int
31 qcrypto_tls_creds_get_dh_params_file(QCryptoTLSCreds *creds,
32                                      const char *filename,
33                                      gnutls_dh_params_t *dh_params,
34                                      Error **errp)
36     int ret;
38     trace_qcrypto_tls_creds_load_dh(creds, filename ? filename : "<generated>");
40     if (filename == NULL) {
41         ret = gnutls_dh_params_init(dh_params);
42         if (ret < 0) {
43             error_setg(errp, "Unable to initialize DH parameters: %s",
44                        gnutls_strerror(ret));
45             return -1;
46         }
47         ret = gnutls_dh_params_generate2(*dh_params, DH_BITS);
48         if (ret < 0) {
49             gnutls_dh_params_deinit(*dh_params);
50             *dh_params = NULL;
51             error_setg(errp, "Unable to generate DH parameters: %s",
52                        gnutls_strerror(ret));
53             return -1;
54         }
55     } else {
56         GError *gerr = NULL;
57         gchar *contents;
58         gsize len;
59         gnutls_datum_t data;
60         if (!g_file_get_contents(filename,
61                                  &contents,
62                                  &len,
63                                  &gerr)) {
65             error_setg(errp, "%s", gerr->message);
66             g_error_free(gerr);
67             return -1;
68         }
69         data.data = (unsigned char *)contents;
70         data.size = len;
71         ret = gnutls_dh_params_init(dh_params);
72         if (ret < 0) {
73             g_free(contents);
74             error_setg(errp, "Unable to initialize DH parameters: %s",
75                        gnutls_strerror(ret));
76             return -1;
77         }
78         ret = gnutls_dh_params_import_pkcs3(*dh_params,
79                                             &data,
80                                             GNUTLS_X509_FMT_PEM);
81         g_free(contents);
82         if (ret < 0) {
83             gnutls_dh_params_deinit(*dh_params);
84             *dh_params = NULL;
85             error_setg(errp, "Unable to load DH parameters from %s: %s",
86                        filename, gnutls_strerror(ret));
87             return -1;
88         }
89     }
91     return 0;
95 int
96 qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds,
97                            const char *filename,
98                            bool required,
99                            char **cred,
100                            Error **errp)
102     struct stat sb;
103     int ret = -1;
105     if (!creds->dir) {
106         if (required) {
107             error_setg(errp, "Missing 'dir' property value");
108             return -1;
109         } else {
110             return 0;
111         }
112     }
114     *cred = g_strdup_printf("%s/%s", creds->dir, filename);
116     if (stat(*cred, &sb) < 0) {
117         if (errno == ENOENT && !required) {
118             ret = 0;
119         } else {
120             error_setg_errno(errp, errno,
121                              "Unable to access credentials %s",
122                              *cred);
123         }
124         g_free(*cred);
125         *cred = NULL;
126         goto cleanup;
127     }
129     ret = 0;
130  cleanup:
131     trace_qcrypto_tls_creds_get_path(creds, filename,
132                                      *cred ? *cred : "<none>");
133     return ret;
137 #endif /* ! CONFIG_GNUTLS */
140 static void
141 qcrypto_tls_creds_prop_set_verify(Object *obj,
142                                   bool value,
143                                   Error **errp G_GNUC_UNUSED)
145     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
147     creds->verifyPeer = value;
151 static bool
152 qcrypto_tls_creds_prop_get_verify(Object *obj,
153                                   Error **errp G_GNUC_UNUSED)
155     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
157     return creds->verifyPeer;
161 static void
162 qcrypto_tls_creds_prop_set_dir(Object *obj,
163                                const char *value,
164                                Error **errp G_GNUC_UNUSED)
166     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
168     creds->dir = g_strdup(value);
172 static char *
173 qcrypto_tls_creds_prop_get_dir(Object *obj,
174                                Error **errp G_GNUC_UNUSED)
176     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
178     return g_strdup(creds->dir);
182 static void
183 qcrypto_tls_creds_prop_set_priority(Object *obj,
184                                     const char *value,
185                                     Error **errp G_GNUC_UNUSED)
187     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
189     creds->priority = g_strdup(value);
193 static char *
194 qcrypto_tls_creds_prop_get_priority(Object *obj,
195                                     Error **errp G_GNUC_UNUSED)
197     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
199     return g_strdup(creds->priority);
203 static void
204 qcrypto_tls_creds_prop_set_endpoint(Object *obj,
205                                     int value,
206                                     Error **errp G_GNUC_UNUSED)
208     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
210     creds->endpoint = value;
214 static int
215 qcrypto_tls_creds_prop_get_endpoint(Object *obj,
216                                     Error **errp G_GNUC_UNUSED)
218     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
220     return creds->endpoint;
224 static void
225 qcrypto_tls_creds_class_init(ObjectClass *oc, void *data)
227     object_class_property_add_bool(oc, "verify-peer",
228                                    qcrypto_tls_creds_prop_get_verify,
229                                    qcrypto_tls_creds_prop_set_verify);
230     object_class_property_add_str(oc, "dir",
231                                   qcrypto_tls_creds_prop_get_dir,
232                                   qcrypto_tls_creds_prop_set_dir);
233     object_class_property_add_enum(oc, "endpoint",
234                                    "QCryptoTLSCredsEndpoint",
235                                    &QCryptoTLSCredsEndpoint_lookup,
236                                    qcrypto_tls_creds_prop_get_endpoint,
237                                    qcrypto_tls_creds_prop_set_endpoint);
238     object_class_property_add_str(oc, "priority",
239                                   qcrypto_tls_creds_prop_get_priority,
240                                   qcrypto_tls_creds_prop_set_priority);
244 static void
245 qcrypto_tls_creds_init(Object *obj)
247     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
249     creds->verifyPeer = true;
253 static void
254 qcrypto_tls_creds_finalize(Object *obj)
256     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
258     g_free(creds->dir);
259     g_free(creds->priority);
263 static const TypeInfo qcrypto_tls_creds_info = {
264     .parent = TYPE_OBJECT,
265     .name = TYPE_QCRYPTO_TLS_CREDS,
266     .instance_size = sizeof(QCryptoTLSCreds),
267     .instance_init = qcrypto_tls_creds_init,
268     .instance_finalize = qcrypto_tls_creds_finalize,
269     .class_init = qcrypto_tls_creds_class_init,
270     .class_size = sizeof(QCryptoTLSCredsClass),
271     .abstract = true,
275 static void
276 qcrypto_tls_creds_register_types(void)
278     type_register_static(&qcrypto_tls_creds_info);
282 type_init(qcrypto_tls_creds_register_types);