Commit 85bcbc78 authored by Daniel P. Berrangé's avatar Daniel P. Berrangé
Browse files

crypto: introduce new module for TLS x509 credentials 



Introduce a QCryptoTLSCredsX509 class which is used to
manage x509 certificate TLS credentials. This will be
the preferred credential type offering strong security
characteristics

Example CLI configuration:

 $QEMU -object tls-creds-x509,id=tls0,endpoint=server,\
               dir=/path/to/creds/dir,verify-peer=yes

The 'id' value in the -object args will be used to associate the
credentials with the network services. For example, when the VNC
server is later converted it would use

 $QEMU -object tls-creds-x509,id=tls0,.... \
       -vnc 127.0.0.1:1,tls-creds=tls0

Signed-off-by: default avatarDaniel P. Berrange <berrange@redhat.com>
Reviewed-by: default avatarEric Blake <eblake@redhat.com>
parent e00adf6c

crypto/Makefile.objs

+1 −0
Original line number Diff line number Diff line
@@ -5,6 +5,7 @@ crypto-obj-y += desrfb.o 
crypto-obj-y += cipher.o

crypto-obj-y += tlscreds.o

crypto-obj-y += tlscredsanon.o

crypto-obj-y += tlscredsx509.o



# Let the userspace emulators avoid linking gnutls/etc

crypto-aes-obj-y = aes.o

crypto/tlscredsx509.c

0 → 100644
+263 −0
Original line number Diff line number Diff line 
/*

 * QEMU crypto TLS x509 credential support

 *

 * Copyright (c) 2015 Red Hat, Inc.

 *

 * This library is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public

 * License as published by the Free Software Foundation; either

 * version 2 of the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public

 * License along with this library; if not, see <http://www.gnu.org/licenses/>.

 *

 */



#include "crypto/tlscredsx509.h"

#include "crypto/tlscredspriv.h"

#include "qom/object_interfaces.h"

#include "trace.h"





#ifdef CONFIG_GNUTLS





static int

qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,

                            Error **errp)

{

    char *cacert = NULL, *cacrl = NULL, *cert = NULL,

        *key = NULL, *dhparams = NULL;

    int ret;

    int rv = -1;



    trace_qcrypto_tls_creds_x509_load(creds,

            creds->parent_obj.dir ? creds->parent_obj.dir : "<nodir>");



    if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {

        if (qcrypto_tls_creds_get_path(&creds->parent_obj,

                                       QCRYPTO_TLS_CREDS_X509_CA_CERT,

                                       true, &cacert, errp) < 0 ||

            qcrypto_tls_creds_get_path(&creds->parent_obj,

                                       QCRYPTO_TLS_CREDS_X509_CA_CRL,

                                       false, &cacrl, errp) < 0 ||

            qcrypto_tls_creds_get_path(&creds->parent_obj,

                                       QCRYPTO_TLS_CREDS_X509_SERVER_CERT,

                                       true, &cert, errp) < 0 ||

            qcrypto_tls_creds_get_path(&creds->parent_obj,

                                       QCRYPTO_TLS_CREDS_X509_SERVER_KEY,

                                       true, &key, errp) < 0 ||

            qcrypto_tls_creds_get_path(&creds->parent_obj,

                                       QCRYPTO_TLS_CREDS_DH_PARAMS,

                                       false, &dhparams, errp) < 0) {

            goto cleanup;

        }

    } else {

        if (qcrypto_tls_creds_get_path(&creds->parent_obj,

                                       QCRYPTO_TLS_CREDS_X509_CA_CERT,

                                       true, &cacert, errp) < 0 ||

            qcrypto_tls_creds_get_path(&creds->parent_obj,

                                       QCRYPTO_TLS_CREDS_X509_CLIENT_CERT,

                                       false, &cert, errp) < 0 ||

            qcrypto_tls_creds_get_path(&creds->parent_obj,

                                       QCRYPTO_TLS_CREDS_X509_CLIENT_KEY,

                                       false, &key, errp) < 0) {

            goto cleanup;

        }

    }



    ret = gnutls_certificate_allocate_credentials(&creds->data);

    if (ret < 0) {

        error_setg(errp, "Cannot allocate credentials: '%s'",

                   gnutls_strerror(ret));

        goto cleanup;

    }



    ret = gnutls_certificate_set_x509_trust_file(creds->data,

                                                 cacert,

                                                 GNUTLS_X509_FMT_PEM);

    if (ret < 0) {

        error_setg(errp, "Cannot load CA certificate '%s': %s",

                   cacert, gnutls_strerror(ret));

        goto cleanup;

    }



    if (cert != NULL && key != NULL) {

        ret = gnutls_certificate_set_x509_key_file(creds->data,

                                                   cert, key,

                                                   GNUTLS_X509_FMT_PEM);

        if (ret < 0) {

            error_setg(errp, "Cannot load certificate '%s' & key '%s': %s",

                       cert, key, gnutls_strerror(ret));

            goto cleanup;

        }

    }



    if (cacrl != NULL) {

        ret = gnutls_certificate_set_x509_crl_file(creds->data,

                                                   cacrl,

                                                   GNUTLS_X509_FMT_PEM);

        if (ret < 0) {

            error_setg(errp, "Cannot load CRL '%s': %s",

                       cacrl, gnutls_strerror(ret));

            goto cleanup;

        }

    }



    if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {

        if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams,

                                                 &creds->parent_obj.dh_params,

                                                 errp) < 0) {

            goto cleanup;

        }

        gnutls_certificate_set_dh_params(creds->data,

                                         creds->parent_obj.dh_params);

    }



    rv = 0;

 cleanup:

    g_free(cacert);

    g_free(cacrl);

    g_free(cert);

    g_free(key);

    g_free(dhparams);

    return rv;

}





static void

qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds)

{

    if (creds->data) {

        gnutls_certificate_free_credentials(creds->data);

        creds->data = NULL;

    }

}





#else /* ! CONFIG_GNUTLS */





static void

qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED,

                            Error **errp)

{

    error_setg(errp, "TLS credentials support requires GNUTLS");

}





static void

qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED)

{

    /* nada */

}





#endif /* ! CONFIG_GNUTLS */





static void

qcrypto_tls_creds_x509_prop_set_loaded(Object *obj,

                                       bool value,

                                       Error **errp)

{

    QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);



    if (value) {

        qcrypto_tls_creds_x509_load(creds, errp);

    } else {

        qcrypto_tls_creds_x509_unload(creds);

    }

}





#ifdef CONFIG_GNUTLS





static bool

qcrypto_tls_creds_x509_prop_get_loaded(Object *obj,

                                       Error **errp G_GNUC_UNUSED)

{

    QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);



    return creds->data != NULL;

}





#else /* ! CONFIG_GNUTLS */





static bool

qcrypto_tls_creds_x509_prop_get_loaded(Object *obj G_GNUC_UNUSED,

                                       Error **errp G_GNUC_UNUSED)

{

    return false;

}





#endif /* ! CONFIG_GNUTLS */





static void

qcrypto_tls_creds_x509_complete(UserCreatable *uc, Error **errp)

{

    object_property_set_bool(OBJECT(uc), true, "loaded", errp);

}





static void

qcrypto_tls_creds_x509_init(Object *obj)

{

    object_property_add_bool(obj, "loaded",

                             qcrypto_tls_creds_x509_prop_get_loaded,

                             qcrypto_tls_creds_x509_prop_set_loaded,

                             NULL);

}





static void

qcrypto_tls_creds_x509_finalize(Object *obj)

{

    QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);



    qcrypto_tls_creds_x509_unload(creds);

}





static void

qcrypto_tls_creds_x509_class_init(ObjectClass *oc, void *data)

{

    UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);



    ucc->complete = qcrypto_tls_creds_x509_complete;

}





static const TypeInfo qcrypto_tls_creds_x509_info = {

    .parent = TYPE_QCRYPTO_TLS_CREDS,

    .name = TYPE_QCRYPTO_TLS_CREDS_X509,

    .instance_size = sizeof(QCryptoTLSCredsX509),

    .instance_init = qcrypto_tls_creds_x509_init,

    .instance_finalize = qcrypto_tls_creds_x509_finalize,

    .class_size = sizeof(QCryptoTLSCredsX509Class),

    .class_init = qcrypto_tls_creds_x509_class_init,

    .interfaces = (InterfaceInfo[]) {

        { TYPE_USER_CREATABLE },

        { }

    }

};





static void

qcrypto_tls_creds_x509_register_types(void)

{

    type_register_static(&qcrypto_tls_creds_x509_info);

}





type_init(qcrypto_tls_creds_x509_register_types);

include/crypto/tlscredsx509.h

0 → 100644
+112 −0
Original line number Diff line number Diff line 
/*

 * QEMU crypto TLS x509 credential support

 *

 * Copyright (c) 2015 Red Hat, Inc.

 *

 * This library is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public

 * License as published by the Free Software Foundation; either

 * version 2 of the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public

 * License along with this library; if not, see <http://www.gnu.org/licenses/>.

 *

 */



#ifndef QCRYPTO_TLSCRED_X509_H__

#define QCRYPTO_TLSCRED_X509_H__



#include "crypto/tlscreds.h"



#define TYPE_QCRYPTO_TLS_CREDS_X509 "tls-creds-x509"

#define QCRYPTO_TLS_CREDS_X509(obj)                  \

    OBJECT_CHECK(QCryptoTLSCredsX509, (obj), TYPE_QCRYPTO_TLS_CREDS_X509)



typedef struct QCryptoTLSCredsX509 QCryptoTLSCredsX509;

typedef struct QCryptoTLSCredsX509Class QCryptoTLSCredsX509Class;



#define QCRYPTO_TLS_CREDS_X509_CA_CERT "ca-cert.pem"

#define QCRYPTO_TLS_CREDS_X509_CA_CRL "ca-crl.pem"

#define QCRYPTO_TLS_CREDS_X509_SERVER_KEY "server-key.pem"

#define QCRYPTO_TLS_CREDS_X509_SERVER_CERT "server-cert.pem"

#define QCRYPTO_TLS_CREDS_X509_CLIENT_KEY "client-key.pem"

#define QCRYPTO_TLS_CREDS_X509_CLIENT_CERT "client-cert.pem"





/**

 * QCryptoTLSCredsX509:

 *

 * The QCryptoTLSCredsX509 object provides a representation

 * of x509 credentials used to perform a TLS handshake.

 *

 * This is a user creatable object, which can be instantiated

 * via object_new_propv():

 *

 * <example>

 *   <title>Creating x509 TLS credential objects in code</title>

 *   <programlisting>

 *   Object *obj;

 *   Error *err = NULL;

 *   obj = object_new_propv(TYPE_QCRYPTO_TLS_CREDS_X509,

 *                          "tlscreds0",

 *                          &err,

 *                          "endpoint", "server",

 *                          "dir", "/path/x509/cert/dir",

 *                          "verify-peer", "yes",

 *                          NULL);

 *   </programlisting>

 * </example>

 *

 * Or via QMP:

 *

 * <example>

 *   <title>Creating x509 TLS credential objects via QMP</title>

 *   <programlisting>

 *    {

 *       "execute": "object-add", "arguments": {

 *          "id": "tlscreds0",

 *          "qom-type": "tls-creds-x509",

 *          "props": {

 *             "endpoint": "server",

 *             "dir": "/path/to/x509/cert/dir",

 *             "verify-peer": false

 *          }

 *       }

 *    }

 *   </programlisting>

 * </example>

 *

 *

 * Or via the CLI:

 *

 * <example>

 *   <title>Creating x509 TLS credential objects via CLI</title>

 *   <programlisting>

 *  qemu-system-x86_64 -object tls-creds-x509,id=tlscreds0,\

 *          endpoint=server,verify-peer=off,\

 *          dir=/path/to/x509/certdir/

 *   </programlisting>

 * </example>

 *

 */



struct QCryptoTLSCredsX509 {

    QCryptoTLSCreds parent_obj;

#ifdef CONFIG_GNUTLS

    gnutls_certificate_credentials_t data;

#endif

};





struct QCryptoTLSCredsX509Class {

    QCryptoTLSCredsClass parent_class;

};





#endif /* QCRYPTO_TLSCRED_X509_H__ */

qemu-options.hx

+27 −0
Original line number Diff line number Diff line
@@ -3591,6 +3591,33 @@ expensive operation that consumes random pool entropy, so it is 
recommended that a persistent set of parameters be generated

upfront and saved.



@item -object tls-creds-x509,id=@var{id},endpoint=@var{endpoint},dir=@var{/path/to/cred/dir},verify-peer=@var{on|off}



Creates a TLS anonymous credentials object, which can be used to provide

TLS support on network backends. The @option{id} parameter is a unique

ID which network backends will use to access the credentials. The

@option{endpoint} is either @option{server} or @option{client} depending

on whether the QEMU network backend that uses the credentials will be

acting as a client or as a server. If @option{verify-peer} is enabled

(the default) then once the handshake is completed, the peer credentials

will be verified. With x509 certificates, this implies that the clients

must be provided with valid client certificates too.



The @var{dir} parameter tells QEMU where to find the credential

files. For server endpoints, this directory may contain a file

@var{dh-params.pem} providing diffie-hellman parameters to use

for the TLS server. If the file is missing, QEMU will generate

a set of DH parameters at startup. This is a computationally

expensive operation that consumes random pool entropy, so it is

recommended that a persistent set of parameters be generated

upfront and saved.



For x509 certificate credentials the directory will contain further files

providing the x509 certificates. The certificates must be stored

in PEM format, in filenames @var{ca-cert.pem}, @var{ca-crl.pem} (optional),

@var{server-cert.pem} (only servers), @var{server-key.pem} (only servers),

@var{client-cert.pem} (only clients), and @var{client-key.pem} (only clients).



@end table



ETEXI

trace-events

+3 −0
Original line number Diff line number Diff line
@@ -1673,3 +1673,6 @@ qcrypto_tls_creds_get_path(void *creds, const char *filename, const char *path) 


# crypto/tlscredsanon.c

qcrypto_tls_creds_anon_load(void *creds, const char *dir) "TLS creds anon load creds=%p dir=%s"



# crypto/tlscredsx509.c

qcrypto_tls_creds_x509_load(void *creds, const char *dir) "TLS creds x509 load creds=%p dir=%s"