Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210330' into...
[qemu/ar7.git] / crypto / tlscredsx509.c
blobbc503bab5585db52f7e3508618b9ba67bc78e564
1 /*
2  * QEMU crypto TLS x509 credential support
3  *
4  * Copyright (c) 2015 Red Hat, Inc.
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18  *
19  */
21 #include "qemu/osdep.h"
22 #include "crypto/tlscredsx509.h"
23 #include "tlscredspriv.h"
24 #include "crypto/secret.h"
25 #include "qapi/error.h"
26 #include "qemu/module.h"
27 #include "qom/object_interfaces.h"
28 #include "trace.h"
31 #ifdef CONFIG_GNUTLS
33 #include <gnutls/x509.h>
36 static int
37 qcrypto_tls_creds_check_cert_times(gnutls_x509_crt_t cert,
38                                    const char *certFile,
39                                    bool isServer,
40                                    bool isCA,
41                                    Error **errp)
43     time_t now = time(NULL);
45     if (now == ((time_t)-1)) {
46         error_setg_errno(errp, errno, "cannot get current time");
47         return -1;
48     }
50     if (gnutls_x509_crt_get_expiration_time(cert) < now) {
51         error_setg(errp,
52                    (isCA ?
53                     "The CA certificate %s has expired" :
54                     (isServer ?
55                      "The server certificate %s has expired" :
56                      "The client certificate %s has expired")),
57                    certFile);
58         return -1;
59     }
61     if (gnutls_x509_crt_get_activation_time(cert) > now) {
62         error_setg(errp,
63                    (isCA ?
64                     "The CA certificate %s is not yet active" :
65                     (isServer ?
66                      "The server certificate %s is not yet active" :
67                      "The client certificate %s is not yet active")),
68                    certFile);
69         return -1;
70     }
72     return 0;
76 static int
77 qcrypto_tls_creds_check_cert_basic_constraints(QCryptoTLSCredsX509 *creds,
78                                                gnutls_x509_crt_t cert,
79                                                const char *certFile,
80                                                bool isServer,
81                                                bool isCA,
82                                                Error **errp)
84     int status;
86     status = gnutls_x509_crt_get_basic_constraints(cert, NULL, NULL, NULL);
87     trace_qcrypto_tls_creds_x509_check_basic_constraints(
88         creds, certFile, status);
90     if (status > 0) { /* It is a CA cert */
91         if (!isCA) {
92             error_setg(errp, isServer ?
93                        "The certificate %s basic constraints show a CA, "
94                        "but we need one for a server" :
95                        "The certificate %s basic constraints show a CA, "
96                        "but we need one for a client",
97                        certFile);
98             return -1;
99         }
100     } else if (status == 0) { /* It is not a CA cert */
101         if (isCA) {
102             error_setg(errp,
103                        "The certificate %s basic constraints do not "
104                        "show a CA",
105                        certFile);
106             return -1;
107         }
108     } else if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
109         /* Missing basicConstraints */
110         if (isCA) {
111             error_setg(errp,
112                        "The certificate %s is missing basic constraints "
113                        "for a CA",
114                        certFile);
115             return -1;
116         }
117     } else { /* General error */
118         error_setg(errp,
119                    "Unable to query certificate %s basic constraints: %s",
120                    certFile, gnutls_strerror(status));
121         return -1;
122     }
124     return 0;
128 static int
129 qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCredsX509 *creds,
130                                        gnutls_x509_crt_t cert,
131                                        const char *certFile,
132                                        bool isCA,
133                                        Error **errp)
135     int status;
136     unsigned int usage = 0;
137     unsigned int critical = 0;
139     status = gnutls_x509_crt_get_key_usage(cert, &usage, &critical);
140     trace_qcrypto_tls_creds_x509_check_key_usage(
141         creds, certFile, status, usage, critical);
143     if (status < 0) {
144         if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
145             usage = isCA ? GNUTLS_KEY_KEY_CERT_SIGN :
146                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT;
147         } else {
148             error_setg(errp,
149                        "Unable to query certificate %s key usage: %s",
150                        certFile, gnutls_strerror(status));
151             return -1;
152         }
153     }
155     if (isCA) {
156         if (!(usage & GNUTLS_KEY_KEY_CERT_SIGN)) {
157             if (critical) {
158                 error_setg(errp,
159                            "Certificate %s usage does not permit "
160                            "certificate signing", certFile);
161                 return -1;
162             }
163         }
164     } else {
165         if (!(usage & GNUTLS_KEY_DIGITAL_SIGNATURE)) {
166             if (critical) {
167                 error_setg(errp,
168                            "Certificate %s usage does not permit digital "
169                            "signature", certFile);
170                 return -1;
171             }
172         }
173         if (!(usage & GNUTLS_KEY_KEY_ENCIPHERMENT)) {
174             if (critical) {
175                 error_setg(errp,
176                            "Certificate %s usage does not permit key "
177                            "encipherment", certFile);
178                 return -1;
179             }
180         }
181     }
183     return 0;
187 static int
188 qcrypto_tls_creds_check_cert_key_purpose(QCryptoTLSCredsX509 *creds,
189                                          gnutls_x509_crt_t cert,
190                                          const char *certFile,
191                                          bool isServer,
192                                          Error **errp)
194     int status;
195     size_t i;
196     unsigned int purposeCritical;
197     unsigned int critical;
198     char *buffer = NULL;
199     size_t size;
200     bool allowClient = false, allowServer = false;
202     critical = 0;
203     for (i = 0; ; i++) {
204         size = 0;
205         status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer,
206                                                      &size, NULL);
208         if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
210             /* If there is no data at all, then we must allow
211                client/server to pass */
212             if (i == 0) {
213                 allowServer = allowClient = true;
214             }
215             break;
216         }
217         if (status != GNUTLS_E_SHORT_MEMORY_BUFFER) {
218             error_setg(errp,
219                        "Unable to query certificate %s key purpose: %s",
220                        certFile, gnutls_strerror(status));
221             return -1;
222         }
224         buffer = g_new0(char, size);
226         status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer,
227                                                      &size, &purposeCritical);
229         if (status < 0) {
230             trace_qcrypto_tls_creds_x509_check_key_purpose(
231                 creds, certFile, status, "<none>", purposeCritical);
232             g_free(buffer);
233             error_setg(errp,
234                        "Unable to query certificate %s key purpose: %s",
235                        certFile, gnutls_strerror(status));
236             return -1;
237         }
238         trace_qcrypto_tls_creds_x509_check_key_purpose(
239             creds, certFile, status, buffer, purposeCritical);
240         if (purposeCritical) {
241             critical = true;
242         }
244         if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_SERVER)) {
245             allowServer = true;
246         } else if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_CLIENT)) {
247             allowClient = true;
248         } else if (g_str_equal(buffer, GNUTLS_KP_ANY)) {
249             allowServer = allowClient = true;
250         }
252         g_free(buffer);
253         buffer = NULL;
254     }
256     if (isServer) {
257         if (!allowServer) {
258             if (critical) {
259                 error_setg(errp,
260                            "Certificate %s purpose does not allow "
261                            "use with a TLS server", certFile);
262                 return -1;
263             }
264         }
265     } else {
266         if (!allowClient) {
267             if (critical) {
268                 error_setg(errp,
269                            "Certificate %s purpose does not allow use "
270                            "with a TLS client", certFile);
271                 return -1;
272             }
273         }
274     }
276     return 0;
280 static int
281 qcrypto_tls_creds_check_cert(QCryptoTLSCredsX509 *creds,
282                              gnutls_x509_crt_t cert,
283                              const char *certFile,
284                              bool isServer,
285                              bool isCA,
286                              Error **errp)
288     if (qcrypto_tls_creds_check_cert_times(cert, certFile,
289                                            isServer, isCA,
290                                            errp) < 0) {
291         return -1;
292     }
294     if (qcrypto_tls_creds_check_cert_basic_constraints(creds,
295                                                        cert, certFile,
296                                                        isServer, isCA,
297                                                        errp) < 0) {
298         return -1;
299     }
301     if (qcrypto_tls_creds_check_cert_key_usage(creds,
302                                                cert, certFile,
303                                                isCA, errp) < 0) {
304         return -1;
305     }
307     if (!isCA &&
308         qcrypto_tls_creds_check_cert_key_purpose(creds,
309                                                  cert, certFile,
310                                                  isServer, errp) < 0) {
311         return -1;
312     }
314     return 0;
318 static int
319 qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t cert,
320                                   const char *certFile,
321                                   gnutls_x509_crt_t *cacerts,
322                                   size_t ncacerts,
323                                   const char *cacertFile,
324                                   bool isServer,
325                                   Error **errp)
327     unsigned int status;
329     if (gnutls_x509_crt_list_verify(&cert, 1,
330                                     cacerts, ncacerts,
331                                     NULL, 0,
332                                     0, &status) < 0) {
333         error_setg(errp, isServer ?
334                    "Unable to verify server certificate %s against "
335                    "CA certificate %s" :
336                    "Unable to verify client certificate %s against "
337                    "CA certificate %s",
338                    certFile, cacertFile);
339         return -1;
340     }
342     if (status != 0) {
343         const char *reason = "Invalid certificate";
345         if (status & GNUTLS_CERT_INVALID) {
346             reason = "The certificate is not trusted";
347         }
349         if (status & GNUTLS_CERT_SIGNER_NOT_FOUND) {
350             reason = "The certificate hasn't got a known issuer";
351         }
353         if (status & GNUTLS_CERT_REVOKED) {
354             reason = "The certificate has been revoked";
355         }
357 #ifndef GNUTLS_1_0_COMPAT
358         if (status & GNUTLS_CERT_INSECURE_ALGORITHM) {
359             reason = "The certificate uses an insecure algorithm";
360         }
361 #endif
363         error_setg(errp,
364                    "Our own certificate %s failed validation against %s: %s",
365                    certFile, cacertFile, reason);
366         return -1;
367     }
369     return 0;
373 static gnutls_x509_crt_t
374 qcrypto_tls_creds_load_cert(QCryptoTLSCredsX509 *creds,
375                             const char *certFile,
376                             bool isServer,
377                             Error **errp)
379     gnutls_datum_t data;
380     gnutls_x509_crt_t cert = NULL;
381     g_autofree char *buf = NULL;
382     gsize buflen;
383     GError *gerr = NULL;
384     int ret = -1;
385     int err;
387     trace_qcrypto_tls_creds_x509_load_cert(creds, isServer, certFile);
389     err = gnutls_x509_crt_init(&cert);
390     if (err < 0) {
391         error_setg(errp, "Unable to initialize certificate: %s",
392                    gnutls_strerror(err));
393         goto cleanup;
394     }
396     if (!g_file_get_contents(certFile, &buf, &buflen, &gerr)) {
397         error_setg(errp, "Cannot load CA cert list %s: %s",
398                    certFile, gerr->message);
399         g_error_free(gerr);
400         goto cleanup;
401     }
403     data.data = (unsigned char *)buf;
404     data.size = strlen(buf);
406     err = gnutls_x509_crt_import(cert, &data, GNUTLS_X509_FMT_PEM);
407     if (err < 0) {
408         error_setg(errp, isServer ?
409                    "Unable to import server certificate %s: %s" :
410                    "Unable to import client certificate %s: %s",
411                    certFile,
412                    gnutls_strerror(err));
413         goto cleanup;
414     }
416     ret = 0;
418  cleanup:
419     if (ret != 0) {
420         gnutls_x509_crt_deinit(cert);
421         cert = NULL;
422     }
423     return cert;
427 static int
428 qcrypto_tls_creds_load_ca_cert_list(QCryptoTLSCredsX509 *creds,
429                                     const char *certFile,
430                                     gnutls_x509_crt_t *certs,
431                                     unsigned int certMax,
432                                     size_t *ncerts,
433                                     Error **errp)
435     gnutls_datum_t data;
436     g_autofree char *buf = NULL;
437     gsize buflen;
438     GError *gerr = NULL;
440     *ncerts = 0;
441     trace_qcrypto_tls_creds_x509_load_cert_list(creds, certFile);
443     if (!g_file_get_contents(certFile, &buf, &buflen, &gerr)) {
444         error_setg(errp, "Cannot load CA cert list %s: %s",
445                    certFile, gerr->message);
446         g_error_free(gerr);
447         return -1;
448     }
450     data.data = (unsigned char *)buf;
451     data.size = strlen(buf);
453     if (gnutls_x509_crt_list_import(certs, &certMax, &data,
454                                     GNUTLS_X509_FMT_PEM, 0) < 0) {
455         error_setg(errp,
456                    "Unable to import CA certificate list %s",
457                    certFile);
458         return -1;
459     }
460     *ncerts = certMax;
462     return 0;
466 #define MAX_CERTS 16
467 static int
468 qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
469                                     bool isServer,
470                                     const char *cacertFile,
471                                     const char *certFile,
472                                     Error **errp)
474     gnutls_x509_crt_t cert = NULL;
475     gnutls_x509_crt_t cacerts[MAX_CERTS];
476     size_t ncacerts = 0;
477     size_t i;
478     int ret = -1;
480     memset(cacerts, 0, sizeof(cacerts));
481     if (certFile &&
482         access(certFile, R_OK) == 0) {
483         cert = qcrypto_tls_creds_load_cert(creds,
484                                            certFile, isServer,
485                                            errp);
486         if (!cert) {
487             goto cleanup;
488         }
489     }
490     if (access(cacertFile, R_OK) == 0) {
491         if (qcrypto_tls_creds_load_ca_cert_list(creds,
492                                                 cacertFile, cacerts,
493                                                 MAX_CERTS, &ncacerts,
494                                                 errp) < 0) {
495             goto cleanup;
496         }
497     }
499     if (cert &&
500         qcrypto_tls_creds_check_cert(creds,
501                                      cert, certFile, isServer,
502                                      false, errp) < 0) {
503         goto cleanup;
504     }
506     for (i = 0; i < ncacerts; i++) {
507         if (qcrypto_tls_creds_check_cert(creds,
508                                          cacerts[i], cacertFile,
509                                          isServer, true, errp) < 0) {
510             goto cleanup;
511         }
512     }
514     if (cert && ncacerts &&
515         qcrypto_tls_creds_check_cert_pair(cert, certFile, cacerts,
516                                           ncacerts, cacertFile,
517                                           isServer, errp) < 0) {
518         goto cleanup;
519     }
521     ret = 0;
523  cleanup:
524     if (cert) {
525         gnutls_x509_crt_deinit(cert);
526     }
527     for (i = 0; i < ncacerts; i++) {
528         gnutls_x509_crt_deinit(cacerts[i]);
529     }
530     return ret;
534 static int
535 qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
536                             Error **errp)
538     char *cacert = NULL, *cacrl = NULL, *cert = NULL,
539         *key = NULL, *dhparams = NULL;
540     int ret;
541     int rv = -1;
543     trace_qcrypto_tls_creds_x509_load(creds,
544             creds->parent_obj.dir ? creds->parent_obj.dir : "<nodir>");
546     if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
547         if (qcrypto_tls_creds_get_path(&creds->parent_obj,
548                                        QCRYPTO_TLS_CREDS_X509_CA_CERT,
549                                        true, &cacert, errp) < 0 ||
550             qcrypto_tls_creds_get_path(&creds->parent_obj,
551                                        QCRYPTO_TLS_CREDS_X509_CA_CRL,
552                                        false, &cacrl, errp) < 0 ||
553             qcrypto_tls_creds_get_path(&creds->parent_obj,
554                                        QCRYPTO_TLS_CREDS_X509_SERVER_CERT,
555                                        true, &cert, errp) < 0 ||
556             qcrypto_tls_creds_get_path(&creds->parent_obj,
557                                        QCRYPTO_TLS_CREDS_X509_SERVER_KEY,
558                                        true, &key, errp) < 0 ||
559             qcrypto_tls_creds_get_path(&creds->parent_obj,
560                                        QCRYPTO_TLS_CREDS_DH_PARAMS,
561                                        false, &dhparams, errp) < 0) {
562             goto cleanup;
563         }
564     } else {
565         if (qcrypto_tls_creds_get_path(&creds->parent_obj,
566                                        QCRYPTO_TLS_CREDS_X509_CA_CERT,
567                                        true, &cacert, errp) < 0 ||
568             qcrypto_tls_creds_get_path(&creds->parent_obj,
569                                        QCRYPTO_TLS_CREDS_X509_CLIENT_CERT,
570                                        false, &cert, errp) < 0 ||
571             qcrypto_tls_creds_get_path(&creds->parent_obj,
572                                        QCRYPTO_TLS_CREDS_X509_CLIENT_KEY,
573                                        false, &key, errp) < 0) {
574             goto cleanup;
575         }
576     }
578     if (creds->sanityCheck &&
579         qcrypto_tls_creds_x509_sanity_check(creds,
580             creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
581             cacert, cert, errp) < 0) {
582         goto cleanup;
583     }
585     ret = gnutls_certificate_allocate_credentials(&creds->data);
586     if (ret < 0) {
587         error_setg(errp, "Cannot allocate credentials: '%s'",
588                    gnutls_strerror(ret));
589         goto cleanup;
590     }
592     ret = gnutls_certificate_set_x509_trust_file(creds->data,
593                                                  cacert,
594                                                  GNUTLS_X509_FMT_PEM);
595     if (ret < 0) {
596         error_setg(errp, "Cannot load CA certificate '%s': %s",
597                    cacert, gnutls_strerror(ret));
598         goto cleanup;
599     }
601     if (cert != NULL && key != NULL) {
602         char *password = NULL;
603         if (creds->passwordid) {
604             password = qcrypto_secret_lookup_as_utf8(creds->passwordid,
605                                                      errp);
606             if (!password) {
607                 goto cleanup;
608             }
609         }
610         ret = gnutls_certificate_set_x509_key_file2(creds->data,
611                                                     cert, key,
612                                                     GNUTLS_X509_FMT_PEM,
613                                                     password,
614                                                     0);
615         g_free(password);
616         if (ret < 0) {
617             error_setg(errp, "Cannot load certificate '%s' & key '%s': %s",
618                        cert, key, gnutls_strerror(ret));
619             goto cleanup;
620         }
621     }
623     if (cacrl != NULL) {
624         ret = gnutls_certificate_set_x509_crl_file(creds->data,
625                                                    cacrl,
626                                                    GNUTLS_X509_FMT_PEM);
627         if (ret < 0) {
628             error_setg(errp, "Cannot load CRL '%s': %s",
629                        cacrl, gnutls_strerror(ret));
630             goto cleanup;
631         }
632     }
634     if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
635         if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams,
636                                                  &creds->parent_obj.dh_params,
637                                                  errp) < 0) {
638             goto cleanup;
639         }
640         gnutls_certificate_set_dh_params(creds->data,
641                                          creds->parent_obj.dh_params);
642     }
644     rv = 0;
645  cleanup:
646     g_free(cacert);
647     g_free(cacrl);
648     g_free(cert);
649     g_free(key);
650     g_free(dhparams);
651     return rv;
655 static void
656 qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds)
658     if (creds->data) {
659         gnutls_certificate_free_credentials(creds->data);
660         creds->data = NULL;
661     }
662     if (creds->parent_obj.dh_params) {
663         gnutls_dh_params_deinit(creds->parent_obj.dh_params);
664         creds->parent_obj.dh_params = NULL;
665     }
669 #else /* ! CONFIG_GNUTLS */
672 static void
673 qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED,
674                             Error **errp)
676     error_setg(errp, "TLS credentials support requires GNUTLS");
680 static void
681 qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED)
683     /* nada */
687 #endif /* ! CONFIG_GNUTLS */
690 static void
691 qcrypto_tls_creds_x509_prop_set_loaded(Object *obj,
692                                        bool value,
693                                        Error **errp)
695     QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
697     qcrypto_tls_creds_x509_unload(creds);
698     if (value) {
699         qcrypto_tls_creds_x509_load(creds, errp);
700     }
704 #ifdef CONFIG_GNUTLS
707 static bool
708 qcrypto_tls_creds_x509_prop_get_loaded(Object *obj,
709                                        Error **errp G_GNUC_UNUSED)
711     QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
713     return creds->data != NULL;
717 #else /* ! CONFIG_GNUTLS */
720 static bool
721 qcrypto_tls_creds_x509_prop_get_loaded(Object *obj G_GNUC_UNUSED,
722                                        Error **errp G_GNUC_UNUSED)
724     return false;
728 #endif /* ! CONFIG_GNUTLS */
731 static void
732 qcrypto_tls_creds_x509_prop_set_sanity(Object *obj,
733                                        bool value,
734                                        Error **errp G_GNUC_UNUSED)
736     QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
738     creds->sanityCheck = value;
742 static void
743 qcrypto_tls_creds_x509_prop_set_passwordid(Object *obj,
744                                            const char *value,
745                                            Error **errp G_GNUC_UNUSED)
747     QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
749     creds->passwordid = g_strdup(value);
753 static char *
754 qcrypto_tls_creds_x509_prop_get_passwordid(Object *obj,
755                                            Error **errp G_GNUC_UNUSED)
757     QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
759     return g_strdup(creds->passwordid);
763 static bool
764 qcrypto_tls_creds_x509_prop_get_sanity(Object *obj,
765                                        Error **errp G_GNUC_UNUSED)
767     QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
769     return creds->sanityCheck;
773 #ifdef CONFIG_GNUTLS
776 static bool
777 qcrypto_tls_creds_x509_reload(QCryptoTLSCreds *creds, Error **errp)
779     QCryptoTLSCredsX509 *x509_creds = QCRYPTO_TLS_CREDS_X509(creds);
780     Error *local_err = NULL;
781     gnutls_certificate_credentials_t creds_data = x509_creds->data;
782     gnutls_dh_params_t creds_dh_params = x509_creds->parent_obj.dh_params;
784     x509_creds->data = NULL;
785     x509_creds->parent_obj.dh_params = NULL;
786     qcrypto_tls_creds_x509_load(x509_creds, &local_err);
787     if (local_err) {
788         qcrypto_tls_creds_x509_unload(x509_creds);
789         x509_creds->data = creds_data;
790         x509_creds->parent_obj.dh_params = creds_dh_params;
791         error_propagate(errp, local_err);
792         return false;
793     }
795     if (creds_data) {
796         gnutls_certificate_free_credentials(creds_data);
797     }
798     if (creds_dh_params) {
799         gnutls_dh_params_deinit(creds_dh_params);
800     }
801     return true;
805 #else /* ! CONFIG_GNUTLS */
808 static bool
809 qcrypto_tls_creds_x509_reload(QCryptoTLSCreds *creds, Error **errp)
811     return false;
815 #endif /* ! CONFIG_GNUTLS */
818 static void
819 qcrypto_tls_creds_x509_complete(UserCreatable *uc, Error **errp)
821     object_property_set_bool(OBJECT(uc), "loaded", true, errp);
825 static void
826 qcrypto_tls_creds_x509_init(Object *obj)
828     QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
830     creds->sanityCheck = true;
834 static void
835 qcrypto_tls_creds_x509_finalize(Object *obj)
837     QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
839     g_free(creds->passwordid);
840     qcrypto_tls_creds_x509_unload(creds);
844 static void
845 qcrypto_tls_creds_x509_class_init(ObjectClass *oc, void *data)
847     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
848     QCryptoTLSCredsClass *ctcc = QCRYPTO_TLS_CREDS_CLASS(oc);
850     ctcc->reload = qcrypto_tls_creds_x509_reload;
852     ucc->complete = qcrypto_tls_creds_x509_complete;
854     object_class_property_add_bool(oc, "loaded",
855                                    qcrypto_tls_creds_x509_prop_get_loaded,
856                                    qcrypto_tls_creds_x509_prop_set_loaded);
857     object_class_property_add_bool(oc, "sanity-check",
858                                    qcrypto_tls_creds_x509_prop_get_sanity,
859                                    qcrypto_tls_creds_x509_prop_set_sanity);
860     object_class_property_add_str(oc, "passwordid",
861                                   qcrypto_tls_creds_x509_prop_get_passwordid,
862                                   qcrypto_tls_creds_x509_prop_set_passwordid);
866 static const TypeInfo qcrypto_tls_creds_x509_info = {
867     .parent = TYPE_QCRYPTO_TLS_CREDS,
868     .name = TYPE_QCRYPTO_TLS_CREDS_X509,
869     .instance_size = sizeof(QCryptoTLSCredsX509),
870     .instance_init = qcrypto_tls_creds_x509_init,
871     .instance_finalize = qcrypto_tls_creds_x509_finalize,
872     .class_size = sizeof(QCryptoTLSCredsX509Class),
873     .class_init = qcrypto_tls_creds_x509_class_init,
874     .interfaces = (InterfaceInfo[]) {
875         { TYPE_USER_CREATABLE },
876         { }
877     }
881 static void
882 qcrypto_tls_creds_x509_register_types(void)
884     type_register_static(&qcrypto_tls_creds_x509_info);
888 type_init(qcrypto_tls_creds_x509_register_types);