starred/qemu
1
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2026-02-04 05:35:39 +00:00
Code Issues 380 Packages Projects Releases Wiki Activity
Files
211fc7e416d5661a8f6bd3cc8de7d1a68e07426c
qemu/crypto/tlscredsx509.c
Daniel P. Berrangé 211fc7e416 crypto: support upto 5 parallel certificate identities 
The default (required) identity is stored in server-cert.pem /
client-cert.pem and server-key.pem / client-key.pem.

The 4 extra (optional) identities are stored in server-cert-$N.pem /
client-cert-$N.pem and server-key-$N.pem / client-key-$N.pem. The
numbering starts at 0 and the first missing cert/key pair will
terminate the loading process.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2025-11-03 10:45:55 +00:00

1067 lines
32 KiB
C
Raw Blame History

/*
* QEMU crypto TLS x509 credential support
*
* Copyright (c) 2015 Red Hat, Inc.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, see <http://www.gnu.org/licenses/>.
*
*/
#include "qemu/osdep.h"
#include "crypto/tlscredsx509.h"
#include "tlscredspriv.h"
#include "crypto/secret.h"
#include "qapi/error.h"
#include "qemu/module.h"
#include "qom/object_interfaces.h"
#include "trace.h"
struct QCryptoTLSCredsX509 {
QCryptoTLSCreds parent_obj;
bool sanityCheck;
char *passwordid;
};
#ifdef CONFIG_GNUTLS
#include <gnutls/gnutls.h>
#include <gnutls/x509.h>
typedef struct QCryptoTLSCredsX509IdentFiles QCryptoTLSCredsX509IdentFiles;
struct QCryptoTLSCredsX509IdentFiles {
char *certpath;
char *keypath;
gnutls_x509_crt_t *certs;
unsigned int ncerts;
gnutls_x509_privkey_t key;
};
typedef struct QCryptoTLSCredsX509Files QCryptoTLSCredsX509Files;
struct QCryptoTLSCredsX509Files {
char *cacertpath;
gnutls_x509_crt_t *cacerts;
unsigned int ncacerts;
QCryptoTLSCredsX509IdentFiles **identities;
size_t nidentities;
};
static QCryptoTLSCredsX509Files *
qcrypto_tls_creds_x509_files_new(void)
{
return g_new0(QCryptoTLSCredsX509Files, 1);
}
static void
qcrypto_tls_creds_x509_ident_files_free(QCryptoTLSCredsX509IdentFiles *files)
{
size_t i;
for (i = 0; i < files->ncerts; i++) {
gnutls_x509_crt_deinit(files->certs[i]);
}
gnutls_x509_privkey_deinit(files->key);
g_free(files->certs);
g_free(files->certpath);
g_free(files->keypath);
g_free(files);
}
G_DEFINE_AUTOPTR_CLEANUP_FUNC(QCryptoTLSCredsX509IdentFiles,
qcrypto_tls_creds_x509_ident_files_free);
static void
qcrypto_tls_creds_x509_files_free(QCryptoTLSCredsX509Files *files)
{
size_t i;
for (i = 0; i < files->ncacerts; i++) {
gnutls_x509_crt_deinit(files->cacerts[i]);
}
g_free(files->cacerts);
g_free(files->cacertpath);
for (i = 0; i < files->nidentities; i++) {
qcrypto_tls_creds_x509_ident_files_free(files->identities[i]);
}
g_free(files->identities);
g_free(files);
}
G_DEFINE_AUTOPTR_CLEANUP_FUNC(QCryptoTLSCredsX509Files,
qcrypto_tls_creds_x509_files_free);
static int
qcrypto_tls_creds_check_cert_times(gnutls_x509_crt_t cert,
const char *certFile,
bool isServer,
bool isCA,
Error **errp)
{
time_t now = time(NULL);
if (now == ((time_t)-1)) {
error_setg_errno(errp, errno, "cannot get current time");
return -1;
}
if (gnutls_x509_crt_get_expiration_time(cert) < now) {
error_setg(errp,
(isCA ?
"The CA certificate %s has expired" :
(isServer ?
"The server certificate %s has expired" :
"The client certificate %s has expired")),
certFile);
return -1;
}
if (gnutls_x509_crt_get_activation_time(cert) > now) {
error_setg(errp,
(isCA ?
"The CA certificate %s is not yet active" :
(isServer ?
"The server certificate %s is not yet active" :
"The client certificate %s is not yet active")),
certFile);
return -1;
}
return 0;
}
static int
qcrypto_tls_creds_check_cert_basic_constraints(QCryptoTLSCredsX509 *creds,
gnutls_x509_crt_t cert,
const char *certFile,
bool isServer,
bool isCA,
Error **errp)
{
int status;
status = gnutls_x509_crt_get_basic_constraints(cert, NULL, NULL, NULL);
trace_qcrypto_tls_creds_x509_check_basic_constraints(
creds, certFile, status);
if (status > 0) { /* It is a CA cert */
if (!isCA) {
error_setg(errp, isServer ?
"The certificate %s basic constraints show a CA, "
"but we need one for a server" :
"The certificate %s basic constraints show a CA, "
"but we need one for a client",
certFile);
return -1;
}
} else if (status == 0) { /* It is not a CA cert */
if (isCA) {
error_setg(errp,
"The certificate %s basic constraints do not "
"show a CA",
certFile);
return -1;
}
} else if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
/* Missing basicConstraints */
if (isCA) {
error_setg(errp,
"The certificate %s is missing basic constraints "
"for a CA",
certFile);
return -1;
}
} else { /* General error */
error_setg(errp,
"Unable to query certificate %s basic constraints: %s",
certFile, gnutls_strerror(status));
return -1;
}
return 0;
}
static int
qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCredsX509 *creds,
gnutls_x509_crt_t cert,
const char *certFile,
bool isCA,
Error **errp)
{
int status;
unsigned int usage = 0;
unsigned int critical = 0;
status = gnutls_x509_crt_get_key_usage(cert, &usage, &critical);
trace_qcrypto_tls_creds_x509_check_key_usage(
creds, certFile, status, usage, critical);
if (status < 0) {
if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
usage = isCA ? GNUTLS_KEY_KEY_CERT_SIGN :
GNUTLS_KEY_DIGITAL_SIGNATURE;
} else {
error_setg(errp,
"Unable to query certificate %s key usage: %s",
certFile, gnutls_strerror(status));
return -1;
}
}
if (isCA) {
if (!(usage & GNUTLS_KEY_KEY_CERT_SIGN)) {
if (critical) {
error_setg(errp,
"Certificate %s usage does not permit "
"certificate signing", certFile);
return -1;
}
}
} else {
if (!(usage & GNUTLS_KEY_DIGITAL_SIGNATURE)) {
if (critical) {
error_setg(errp,
"Certificate %s usage does not permit digital "
"signature", certFile);
return -1;
}
}
}
return 0;
}
static int
qcrypto_tls_creds_check_cert_key_purpose(QCryptoTLSCredsX509 *creds,
gnutls_x509_crt_t cert,
const char *certFile,
bool isServer,
Error **errp)
{
int status;
size_t i;
unsigned int purposeCritical;
unsigned int critical;
char *buffer = NULL;
size_t size;
bool allowClient = false, allowServer = false;
critical = 0;
for (i = 0; ; i++) {
size = 0;
status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer,
&size, NULL);
if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
/* If there is no data at all, then we must allow
client/server to pass */
if (i == 0) {
allowServer = allowClient = true;
}
break;
}
if (status != GNUTLS_E_SHORT_MEMORY_BUFFER) {
error_setg(errp,
"Unable to query certificate %s key purpose: %s",
certFile, gnutls_strerror(status));
return -1;
}
buffer = g_new0(char, size);
status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer,
&size, &purposeCritical);
if (status < 0) {
trace_qcrypto_tls_creds_x509_check_key_purpose(
creds, certFile, status, "<none>", purposeCritical);
g_free(buffer);
error_setg(errp,
"Unable to query certificate %s key purpose: %s",
certFile, gnutls_strerror(status));
return -1;
}
trace_qcrypto_tls_creds_x509_check_key_purpose(
creds, certFile, status, buffer, purposeCritical);
if (purposeCritical) {
critical = true;
}
if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_SERVER)) {
allowServer = true;
} else if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_CLIENT)) {
allowClient = true;
} else if (g_str_equal(buffer, GNUTLS_KP_ANY)) {
allowServer = allowClient = true;
}
g_free(buffer);
buffer = NULL;
}
if (isServer) {
if (!allowServer) {
if (critical) {
error_setg(errp,
"Certificate %s purpose does not allow "
"use with a TLS server", certFile);
return -1;
}
}
} else {
if (!allowClient) {
if (critical) {
error_setg(errp,
"Certificate %s purpose does not allow use "
"with a TLS client", certFile);
return -1;
}
}
}
return 0;
}
static int
qcrypto_tls_creds_check_cert(QCryptoTLSCredsX509 *creds,
gnutls_x509_crt_t cert,
const char *certFile,
bool isServer,
bool isCA,
Error **errp)
{
if (qcrypto_tls_creds_check_cert_times(cert, certFile,
isServer, isCA,
errp) < 0) {
return -1;
}
if (qcrypto_tls_creds_check_cert_basic_constraints(creds,
cert, certFile,
isServer, isCA,
errp) < 0) {
return -1;
}
if (qcrypto_tls_creds_check_cert_key_usage(creds,
cert, certFile,
isCA, errp) < 0) {
return -1;
}
if (!isCA &&
qcrypto_tls_creds_check_cert_key_purpose(creds,
cert, certFile,
isServer, errp) < 0) {
return -1;
}
return 0;
}
static int
qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
QCryptoTLSCredsX509Files *files,
gnutls_x509_crt_t *certs,
unsigned int ncerts,
bool isServer,
Error **errp)
{
gnutls_x509_crt_t cert_to_check = certs[ncerts - 1];
int retval = 0;
gnutls_datum_t dn = {}, dnissuer = {};
for (int i = 0; i < (ncerts - 1); i++) {
if (!gnutls_x509_crt_check_issuer(certs[i], certs[i + 1])) {
retval = gnutls_x509_crt_get_dn2(certs[i], &dn);
if (retval < 0) {
error_setg(errp, "Unable to fetch cert DN: %s",
gnutls_strerror(retval));
return -1;
}
retval = gnutls_x509_crt_get_dn2(certs[i + 1], &dnissuer);
if (retval < 0) {
g_free(dn.data);
error_setg(errp, "Unable to fetch cert DN: %s",
gnutls_strerror(retval));
return -1;
}
error_setg(errp, "Cert '%s' does not match issuer of cert '%s'",
dnissuer.data, dn.data);
g_free(dn.data);
g_free(dnissuer.data);
return -1;
}
}
for (;;) {
gnutls_x509_crt_t cert_issuer = NULL;
if (gnutls_x509_crt_check_issuer(cert_to_check,
cert_to_check)) {
/*
* The cert is self-signed indicating we have
* reached the root of trust.
*/
return qcrypto_tls_creds_check_cert(
creds, cert_to_check, files->cacertpath,
isServer, true, errp);
}
for (int i = 0; i < files->ncacerts; i++) {
if (gnutls_x509_crt_check_issuer(cert_to_check,
files->cacerts[i])) {
cert_issuer = files->cacerts[i];
break;
}
}
if (!cert_issuer) {
break;
}
if (qcrypto_tls_creds_check_cert(creds, cert_issuer, files->cacertpath,
isServer, true, errp) < 0) {
return -1;
}
cert_to_check = cert_issuer;
}
retval = gnutls_x509_crt_get_dn2(cert_to_check, &dn);
if (retval < 0) {
error_setg(errp, "Unable to fetch cert DN: %s",
gnutls_strerror(retval));
return -1;
}
error_setg(errp, "Cert '%s' has no issuer in CA chain", dn.data);
g_free(dn.data);
return -1;
}
static int
qcrypto_tls_creds_check_cert_pair(QCryptoTLSCredsX509Files *files,
gnutls_x509_crt_t *certs,
size_t ncerts,
const char *certFile,
bool isServer,
Error **errp)
{
unsigned int status;
if (gnutls_x509_crt_list_verify(certs, ncerts,
files->cacerts, files->ncacerts,
NULL, 0,
0, &status) < 0) {
error_setg(errp, isServer ?
"Unable to verify server certificate %s against "
"CA certificate %s" :
"Unable to verify client certificate %s against "
"CA certificate %s",
certFile, files->cacertpath);
return -1;
}
if (status != 0) {
const char *reason = "Invalid certificate";
if (status & GNUTLS_CERT_INVALID) {
reason = "The certificate is not trusted";
}
if (status & GNUTLS_CERT_SIGNER_NOT_FOUND) {
reason = "The certificate hasn't got a known issuer";
}
if (status & GNUTLS_CERT_REVOKED) {
reason = "The certificate has been revoked";
}
if (status & GNUTLS_CERT_INSECURE_ALGORITHM) {
reason = "The certificate uses an insecure algorithm";
}
error_setg(errp,
"Our own certificate %s failed validation against %s: %s",
certFile, files->cacertpath, reason);
return -1;
}
return 0;
}
static int
qcrypto_tls_creds_load_cert_list(QCryptoTLSCredsX509 *creds,
const char *certFile,
gnutls_x509_crt_t **certs,
unsigned int *ncerts,
Error **errp)
{
gnutls_datum_t data;
g_autofree char *buf = NULL;
gsize buflen;
GError *gerr = NULL;
int ret;
*ncerts = 0;
trace_qcrypto_tls_creds_x509_load_cert_list(creds, certFile);
if (!g_file_get_contents(certFile, &buf, &buflen, &gerr)) {
error_setg(errp, "Cannot load CA cert list %s: %s",
certFile, gerr->message);
g_error_free(gerr);
return -1;
}
data.data = (unsigned char *)buf;
data.size = strlen(buf);
ret = gnutls_x509_crt_list_import2(certs, ncerts, &data,
GNUTLS_X509_FMT_PEM, 0);
if (ret < 0) {
error_setg(errp, "Unable to import certificate %s: %s",
certFile, gnutls_strerror(ret));
return -1;
}
return 0;
}
static int
qcrypto_tls_creds_load_privkey(QCryptoTLSCredsX509 *creds,
const char *keyFile,
gnutls_x509_privkey_t *key,
Error **errp)
{
gnutls_datum_t data;
g_autofree char *buf = NULL;
g_autofree char *password = NULL;
gsize buflen;
GError *gerr = NULL;
int ret;
ret = gnutls_x509_privkey_init(key);
if (ret < 0) {
error_setg(errp, "Unable to initialize private key: %s",
gnutls_strerror(ret));
return -1;
}
if (!g_file_get_contents(keyFile, &buf, &buflen, &gerr)) {
error_setg(errp, "Cannot load private key %s: %s",
keyFile, gerr->message);
g_error_free(gerr);
return -1;
}
data.data = (unsigned char *)buf;
data.size = strlen(buf);
if (creds->passwordid) {
password = qcrypto_secret_lookup_as_utf8(creds->passwordid,
errp);
if (!password) {
return -1;
}
}
if (gnutls_x509_privkey_import2(*key, &data,
GNUTLS_X509_FMT_PEM,
password, 0) < 0) {
error_setg(errp, "Unable to import private key %s", keyFile);
return -1;
}
return 0;
}
static int
qcrypto_tls_creds_x509_sanity_check_identity(QCryptoTLSCredsX509 *creds,
QCryptoTLSCredsX509Files *files,
QCryptoTLSCredsX509IdentFiles *ifiles,
bool isServer,
Error **errp)
{
size_t i;
for (i = 0; i < ifiles->ncerts; i++) {
if (qcrypto_tls_creds_check_cert(creds,
ifiles->certs[i], ifiles->certpath,
isServer, i != 0, errp) < 0) {
return -1;
}
}
if (ifiles->ncerts &&
qcrypto_tls_creds_check_authority_chain(creds, files,
ifiles->certs, ifiles->ncerts,
isServer, errp) < 0) {
return -1;
}
if (ifiles->ncerts &&
qcrypto_tls_creds_check_cert_pair(files, ifiles->certs, ifiles->ncerts,
ifiles->certpath, isServer, errp) < 0) {
return -1;
}
return 0;
}
static int
qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
QCryptoTLSCredsX509Files *files,
bool isServer,
Error **errp)
{
size_t i;
for (i = 0; i < files->nidentities; i++) {
if (qcrypto_tls_creds_x509_sanity_check_identity(creds,
files,
files->identities[i],
isServer,
errp) < 0) {
return -1;
}
}
return 0;
}
static int
qcrypto_tls_creds_x509_load_ca(QCryptoTLSCredsX509 *creds,
QCryptoTLSCredsBox *box,
QCryptoTLSCredsX509Files *files,
bool isServer,
Error **errp)
{
int ret;
if (qcrypto_tls_creds_get_path(&creds->parent_obj,
QCRYPTO_TLS_CREDS_X509_CA_CERT,
true, &files->cacertpath, errp) < 0) {
return -1;
}
if (qcrypto_tls_creds_load_cert_list(creds,
files->cacertpath,
&files->cacerts,
&files->ncacerts,
errp) < 0) {
return -1;
}
ret = gnutls_certificate_set_x509_trust(box->data.cert,
files->cacerts, files->ncacerts);
if (ret < 0) {
error_setg(errp, "Cannot set CA certificate '%s': %s",
files->cacertpath, gnutls_strerror(ret));
return -1;
}
return 0;
}
static QCryptoTLSCredsX509IdentFiles *
qcrypto_tls_creds_x509_load_identity(QCryptoTLSCredsX509 *creds,
QCryptoTLSCredsBox *box,
const char *certbase,
const char *keybase,
Error **errp)
{
g_autoptr(QCryptoTLSCredsX509IdentFiles) files =
g_new0(QCryptoTLSCredsX509IdentFiles, 1);
int ret;
if (qcrypto_tls_creds_get_path(&creds->parent_obj, certbase,
false, &files->certpath, errp) < 0 ||
qcrypto_tls_creds_get_path(&creds->parent_obj, keybase,
false, &files->keypath, errp) < 0) {
return NULL;
}
if (!files->certpath &&
!files->keypath) {
return NULL;
}
if (files->certpath && !files->keypath) {
g_autofree char *keypath =
qcrypto_tls_creds_build_path(&creds->parent_obj, keybase);
error_setg(errp, "Cert '%s' without corresponding key '%s'",
files->certpath, keypath);
return NULL;
}
if (!files->certpath && files->keypath) {
g_autofree char *certpath =
qcrypto_tls_creds_build_path(&creds->parent_obj, certbase);
error_setg(errp, "Key '%s' without corresponding cert '%s'",
files->keypath, certpath);
return NULL;
}
if (qcrypto_tls_creds_load_cert_list(creds,
files->certpath,
&files->certs,
&files->ncerts,
errp) < 0) {
return NULL;
}
if (qcrypto_tls_creds_load_privkey(creds,
files->keypath,
&files->key,
errp) < 0) {
return NULL;
}
ret = gnutls_certificate_set_x509_key(box->data.cert,
files->certs,
files->ncerts,
files->key);
if (ret < 0) {
error_setg(errp, "Cannot set certificate '%s' & key '%s': %s",
files->certpath, files->keypath, gnutls_strerror(ret));
return NULL;
}
return g_steal_pointer(&files);
}
static int
qcrypto_tls_creds_x509_load_identities(QCryptoTLSCredsX509 *creds,
QCryptoTLSCredsBox *box,
QCryptoTLSCredsX509Files *files,
bool isServer,
Error **errp)
{
ERRP_GUARD();
QCryptoTLSCredsX509IdentFiles *ifiles;
size_t i;
ifiles = qcrypto_tls_creds_x509_load_identity(
creds, box,
isServer ?
QCRYPTO_TLS_CREDS_X509_SERVER_CERT :
QCRYPTO_TLS_CREDS_X509_CLIENT_CERT,
isServer ?
QCRYPTO_TLS_CREDS_X509_SERVER_KEY :
QCRYPTO_TLS_CREDS_X509_CLIENT_KEY,
errp);
if (!ifiles && *errp) {
return -1;
}
if (ifiles) {
files->identities = g_renew(QCryptoTLSCredsX509IdentFiles *,
files->identities,
files->nidentities + 1);
files->identities[files->nidentities++] = ifiles;
}
for (i = 0; i < QCRYPTO_TLS_CREDS_X509_IDENTITY_MAX; i++) {
g_autofree char *cert = g_strdup_printf(
isServer ?
QCRYPTO_TLS_CREDS_X509_SERVER_CERT_N :
QCRYPTO_TLS_CREDS_X509_CLIENT_CERT_N, i);
g_autofree char *key = g_strdup_printf(
isServer ?
QCRYPTO_TLS_CREDS_X509_SERVER_KEY_N :
QCRYPTO_TLS_CREDS_X509_CLIENT_KEY_N, i);
ifiles = qcrypto_tls_creds_x509_load_identity(creds, box,
cert, key, errp);
if (!ifiles && *errp) {
return -1;
}
if (!ifiles) {
break;
}
files->identities = g_renew(QCryptoTLSCredsX509IdentFiles *,
files->identities,
files->nidentities + 1);
files->identities[files->nidentities++] = ifiles;
}
if (files->nidentities == 0 && isServer) {
g_autofree char *certpath = qcrypto_tls_creds_build_path(
&creds->parent_obj, QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
g_autofree char *keypath = qcrypto_tls_creds_build_path(
&creds->parent_obj, QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
error_setg(errp, "Missing server cert '%s' & key '%s'",
certpath, keypath);
return -1;
}
return 0;
}
static int
qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
Error **errp)
{
g_autoptr(QCryptoTLSCredsBox) box = NULL;
g_autoptr(QCryptoTLSCredsX509Files) files = NULL;
g_autofree char *cacrl = NULL;
g_autofree char *dhparams = NULL;
bool isServer = (creds->parent_obj.endpoint ==
QCRYPTO_TLS_CREDS_ENDPOINT_SERVER);
int ret;
if (!creds->parent_obj.dir) {
error_setg(errp, "Missing 'dir' property value");
return -1;
}
trace_qcrypto_tls_creds_x509_load(creds, creds->parent_obj.dir);
if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
box = qcrypto_tls_creds_box_new_server(GNUTLS_CRD_CERTIFICATE);
} else {
box = qcrypto_tls_creds_box_new_client(GNUTLS_CRD_CERTIFICATE);
}
ret = gnutls_certificate_allocate_credentials(&box->data.cert);
if (ret < 0) {
error_setg(errp, "Cannot allocate credentials: '%s'",
gnutls_strerror(ret));
return -1;
}
files = qcrypto_tls_creds_x509_files_new();
if (qcrypto_tls_creds_x509_load_ca(creds, box, files, isServer, errp) < 0) {
return -1;
}
if (qcrypto_tls_creds_x509_load_identities(creds, box, files,
isServer, errp) < 0) {
return -1;
}
if (isServer) {
if (qcrypto_tls_creds_get_path(&creds->parent_obj,
QCRYPTO_TLS_CREDS_X509_CA_CRL,
false, &cacrl, errp) < 0 ||
qcrypto_tls_creds_get_path(&creds->parent_obj,
QCRYPTO_TLS_CREDS_DH_PARAMS,
false, &dhparams, errp) < 0) {
return -1;
}
}
if (creds->sanityCheck &&
qcrypto_tls_creds_x509_sanity_check(creds, files, isServer, errp) < 0) {
return -1;
}
if (cacrl != NULL) {
ret = gnutls_certificate_set_x509_crl_file(box->data.cert,
cacrl,
GNUTLS_X509_FMT_PEM);
if (ret < 0) {
error_setg(errp, "Cannot load CRL '%s': %s",
cacrl, gnutls_strerror(ret));
return -1;
}
}
if (isServer) {
if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams,
&box->dh_params,
errp) < 0) {
return -1;
}
if (box->dh_params) {
gnutls_certificate_set_dh_params(box->data.cert, box->dh_params);
}
}
creds->parent_obj.box = g_steal_pointer(&box);
return 0;
}
#else /* ! CONFIG_GNUTLS */
static void
qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED,
Error **errp)
{
error_setg(errp, "TLS credentials support requires GNUTLS");
}
#endif /* ! CONFIG_GNUTLS */
static void
qcrypto_tls_creds_x509_complete(UserCreatable *uc, Error **errp)
{
QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(uc);
qcrypto_tls_creds_x509_load(creds, errp);
}
static void
qcrypto_tls_creds_x509_prop_set_sanity(Object *obj,
bool value,
Error **errp G_GNUC_UNUSED)
{
QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
creds->sanityCheck = value;
}
static void
qcrypto_tls_creds_x509_prop_set_passwordid(Object *obj,
const char *value,
Error **errp G_GNUC_UNUSED)
{
QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
creds->passwordid = g_strdup(value);
}
static char *
qcrypto_tls_creds_x509_prop_get_passwordid(Object *obj,
Error **errp G_GNUC_UNUSED)
{
QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
return g_strdup(creds->passwordid);
}
static bool
qcrypto_tls_creds_x509_prop_get_sanity(Object *obj,
Error **errp G_GNUC_UNUSED)
{
QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
return creds->sanityCheck;
}
#ifdef CONFIG_GNUTLS
static bool
qcrypto_tls_creds_x509_reload(QCryptoTLSCreds *creds, Error **errp)
{
QCryptoTLSCredsX509 *x509_creds = QCRYPTO_TLS_CREDS_X509(creds);
Error *local_err = NULL;
QCryptoTLSCredsBox *creds_box = creds->box;
creds->box = NULL;
qcrypto_tls_creds_x509_load(x509_creds, &local_err);
if (local_err) {
creds->box = creds_box;
error_propagate(errp, local_err);
return false;
}
qcrypto_tls_creds_box_unref(creds_box);
return true;
}
#else /* ! CONFIG_GNUTLS */
static bool
qcrypto_tls_creds_x509_reload(QCryptoTLSCreds *creds, Error **errp)
{
return false;
}
#endif /* ! CONFIG_GNUTLS */
static void
qcrypto_tls_creds_x509_init(Object *obj)
{
QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
creds->sanityCheck = true;
}
static void
qcrypto_tls_creds_x509_finalize(Object *obj)
{
QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
g_free(creds->passwordid);
}
static void
qcrypto_tls_creds_x509_class_init(ObjectClass *oc, const void *data)
{
UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
QCryptoTLSCredsClass *ctcc = QCRYPTO_TLS_CREDS_CLASS(oc);
ctcc->reload = qcrypto_tls_creds_x509_reload;
ucc->complete = qcrypto_tls_creds_x509_complete;
object_class_property_add_bool(oc, "sanity-check",
qcrypto_tls_creds_x509_prop_get_sanity,
qcrypto_tls_creds_x509_prop_set_sanity);
object_class_property_add_str(oc, "passwordid",
qcrypto_tls_creds_x509_prop_get_passwordid,
qcrypto_tls_creds_x509_prop_set_passwordid);
}
static const TypeInfo qcrypto_tls_creds_x509_info = {
.parent = TYPE_QCRYPTO_TLS_CREDS,
.name = TYPE_QCRYPTO_TLS_CREDS_X509,
.instance_size = sizeof(QCryptoTLSCredsX509),
.instance_init = qcrypto_tls_creds_x509_init,
.instance_finalize = qcrypto_tls_creds_x509_finalize,
.class_size = sizeof(QCryptoTLSCredsX509Class),
.class_init = qcrypto_tls_creds_x509_class_init,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_USER_CREATABLE },
{ }
}
};
static void
qcrypto_tls_creds_x509_register_types(void)
{
type_register_static(&qcrypto_tls_creds_x509_info);
}
type_init(qcrypto_tls_creds_x509_register_types);
Reference in New Issue View Git Blame Copy Permalink