crypto: introduce new module for TLS x509 credentials
Introduce a QCryptoTLSCredsX509 class which is used to
manage x509 certificate TLS credentials. This will be
the preferred credential type offering strong security
characteristics
Example CLI configuration:
$QEMU -object tls-creds-x509,id=tls0,endpoint=server,\
dir=/path/to/creds/dir,verify-peer=yes
The 'id' value in the -object args will be used to associate the
credentials with the network services. For example, when the VNC
server is later converted it would use
$QEMU -object tls-creds-x509,id=tls0,.... \
-vnc 127.0.0.1:1,tls-creds=tls0
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
This commit is contained in:
Daniel P. Berrange
parent
e00adf6c3e
commit
85bcbc789e
|
|
@ -5,6 +5,7 @@ crypto-obj-y += desrfb.o
|
|||
crypto-obj-y += cipher.o
|
||||
crypto-obj-y += tlscreds.o
|
||||
crypto-obj-y += tlscredsanon.o
|
||||
crypto-obj-y += tlscredsx509.o
|
||||
|
||||
# Let the userspace emulators avoid linking gnutls/etc
|
||||
crypto-aes-obj-y = aes.o
|
||||
|
|
|
|||
|
|
@ -0,0 +1,263 @@
|
|||
/*
|
||||
* QEMU crypto TLS x509 credential support
|
||||
*
|
||||
* Copyright (c) 2015 Red Hat, Inc.
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU Lesser General Public
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 2 of the License, or (at your option) any later version.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* Lesser General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Lesser General Public
|
||||
* License along with this library; if not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
*/
|
||||
|
||||
#include "crypto/tlscredsx509.h"
|
||||
#include "crypto/tlscredspriv.h"
|
||||
#include "qom/object_interfaces.h"
|
||||
#include "trace.h"
|
||||
|
||||
|
||||
#ifdef CONFIG_GNUTLS
|
||||
|
||||
|
||||
static int
|
||||
qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
|
||||
Error **errp)
|
||||
{
|
||||
char *cacert = NULL, *cacrl = NULL, *cert = NULL,
|
||||
*key = NULL, *dhparams = NULL;
|
||||
int ret;
|
||||
int rv = -1;
|
||||
|
||||
trace_qcrypto_tls_creds_x509_load(creds,
|
||||
creds->parent_obj.dir ? creds->parent_obj.dir : "<nodir>");
|
||||
|
||||
if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
|
||||
if (qcrypto_tls_creds_get_path(&creds->parent_obj,
|
||||
QCRYPTO_TLS_CREDS_X509_CA_CERT,
|
||||
true, &cacert, errp) < 0 ||
|
||||
qcrypto_tls_creds_get_path(&creds->parent_obj,
|
||||
QCRYPTO_TLS_CREDS_X509_CA_CRL,
|
||||
false, &cacrl, errp) < 0 ||
|
||||
qcrypto_tls_creds_get_path(&creds->parent_obj,
|
||||
QCRYPTO_TLS_CREDS_X509_SERVER_CERT,
|
||||
true, &cert, errp) < 0 ||
|
||||
qcrypto_tls_creds_get_path(&creds->parent_obj,
|
||||
QCRYPTO_TLS_CREDS_X509_SERVER_KEY,
|
||||
true, &key, errp) < 0 ||
|
||||
qcrypto_tls_creds_get_path(&creds->parent_obj,
|
||||
QCRYPTO_TLS_CREDS_DH_PARAMS,
|
||||
false, &dhparams, errp) < 0) {
|
||||
goto cleanup;
|
||||
}
|
||||
} else {
|
||||
if (qcrypto_tls_creds_get_path(&creds->parent_obj,
|
||||
QCRYPTO_TLS_CREDS_X509_CA_CERT,
|
||||
true, &cacert, errp) < 0 ||
|
||||
qcrypto_tls_creds_get_path(&creds->parent_obj,
|
||||
QCRYPTO_TLS_CREDS_X509_CLIENT_CERT,
|
||||
false, &cert, errp) < 0 ||
|
||||
qcrypto_tls_creds_get_path(&creds->parent_obj,
|
||||
QCRYPTO_TLS_CREDS_X509_CLIENT_KEY,
|
||||
false, &key, errp) < 0) {
|
||||
goto cleanup;
|
||||
}
|
||||
}
|
||||
|
||||
ret = gnutls_certificate_allocate_credentials(&creds->data);
|
||||
if (ret < 0) {
|
||||
error_setg(errp, "Cannot allocate credentials: '%s'",
|
||||
gnutls_strerror(ret));
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
ret = gnutls_certificate_set_x509_trust_file(creds->data,
|
||||
cacert,
|
||||
GNUTLS_X509_FMT_PEM);
|
||||
if (ret < 0) {
|
||||
error_setg(errp, "Cannot load CA certificate '%s': %s",
|
||||
cacert, gnutls_strerror(ret));
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
if (cert != NULL && key != NULL) {
|
||||
ret = gnutls_certificate_set_x509_key_file(creds->data,
|
||||
cert, key,
|
||||
GNUTLS_X509_FMT_PEM);
|
||||
if (ret < 0) {
|
||||
error_setg(errp, "Cannot load certificate '%s' & key '%s': %s",
|
||||
cert, key, gnutls_strerror(ret));
|
||||
goto cleanup;
|
||||
}
|
||||
}
|
||||
|
||||
if (cacrl != NULL) {
|
||||
ret = gnutls_certificate_set_x509_crl_file(creds->data,
|
||||
cacrl,
|
||||
GNUTLS_X509_FMT_PEM);
|
||||
if (ret < 0) {
|
||||
error_setg(errp, "Cannot load CRL '%s': %s",
|
||||
cacrl, gnutls_strerror(ret));
|
||||
goto cleanup;
|
||||
}
|
||||
}
|
||||
|
||||
if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
|
||||
if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams,
|
||||
&creds->parent_obj.dh_params,
|
||||
errp) < 0) {
|
||||
goto cleanup;
|
||||
}
|
||||
gnutls_certificate_set_dh_params(creds->data,
|
||||
creds->parent_obj.dh_params);
|
||||
}
|
||||
|
||||
rv = 0;
|
||||
cleanup:
|
||||
g_free(cacert);
|
||||
g_free(cacrl);
|
||||
g_free(cert);
|
||||
g_free(key);
|
||||
g_free(dhparams);
|
||||
return rv;
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds)
|
||||
{
|
||||
if (creds->data) {
|
||||
gnutls_certificate_free_credentials(creds->data);
|
||||
creds->data = NULL;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
#else /* ! CONFIG_GNUTLS */
|
||||
|
||||
|
||||
static void
|
||||
qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED,
|
||||
Error **errp)
|
||||
{
|
||||
error_setg(errp, "TLS credentials support requires GNUTLS");
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED)
|
||||
{
|
||||
/* nada */
|
||||
}
|
||||
|
||||
|
||||
#endif /* ! CONFIG_GNUTLS */
|
||||
|
||||
|
||||
static void
|
||||
qcrypto_tls_creds_x509_prop_set_loaded(Object *obj,
|
||||
bool value,
|
||||
Error **errp)
|
||||
{
|
||||
QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
|
||||
|
||||
if (value) {
|
||||
qcrypto_tls_creds_x509_load(creds, errp);
|
||||
} else {
|
||||
qcrypto_tls_creds_x509_unload(creds);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
#ifdef CONFIG_GNUTLS
|
||||
|
||||
|
||||
static bool
|
||||
qcrypto_tls_creds_x509_prop_get_loaded(Object *obj,
|
||||
Error **errp G_GNUC_UNUSED)
|
||||
{
|
||||
QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
|
||||
|
||||
return creds->data != NULL;
|
||||
}
|
||||
|
||||
|
||||
#else /* ! CONFIG_GNUTLS */
|
||||
|
||||
|
||||
static bool
|
||||
qcrypto_tls_creds_x509_prop_get_loaded(Object *obj G_GNUC_UNUSED,
|
||||
Error **errp G_GNUC_UNUSED)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
#endif /* ! CONFIG_GNUTLS */
|
||||
|
||||
|
||||
static void
|
||||
qcrypto_tls_creds_x509_complete(UserCreatable *uc, Error **errp)
|
||||
{
|
||||
object_property_set_bool(OBJECT(uc), true, "loaded", errp);
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
qcrypto_tls_creds_x509_init(Object *obj)
|
||||
{
|
||||
object_property_add_bool(obj, "loaded",
|
||||
qcrypto_tls_creds_x509_prop_get_loaded,
|
||||
qcrypto_tls_creds_x509_prop_set_loaded,
|
||||
NULL);
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
qcrypto_tls_creds_x509_finalize(Object *obj)
|
||||
{
|
||||
QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
|
||||
|
||||
qcrypto_tls_creds_x509_unload(creds);
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
qcrypto_tls_creds_x509_class_init(ObjectClass *oc, void *data)
|
||||
{
|
||||
UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
|
||||
|
||||
ucc->complete = qcrypto_tls_creds_x509_complete;
|
||||
}
|
||||
|
||||
|
||||
static const TypeInfo qcrypto_tls_creds_x509_info = {
|
||||
.parent = TYPE_QCRYPTO_TLS_CREDS,
|
||||
.name = TYPE_QCRYPTO_TLS_CREDS_X509,
|
||||
.instance_size = sizeof(QCryptoTLSCredsX509),
|
||||
.instance_init = qcrypto_tls_creds_x509_init,
|
||||
.instance_finalize = qcrypto_tls_creds_x509_finalize,
|
||||
.class_size = sizeof(QCryptoTLSCredsX509Class),
|
||||
.class_init = qcrypto_tls_creds_x509_class_init,
|
||||
.interfaces = (InterfaceInfo[]) {
|
||||
{ TYPE_USER_CREATABLE },
|
||||
{ }
|
||||
}
|
||||
};
|
||||
|
||||
|
||||
static void
|
||||
qcrypto_tls_creds_x509_register_types(void)
|
||||
{
|
||||
type_register_static(&qcrypto_tls_creds_x509_info);
|
||||
}
|
||||
|
||||
|
||||
type_init(qcrypto_tls_creds_x509_register_types);
|
||||
|
|
@ -0,0 +1,112 @@
|
|||
/*
|
||||
* QEMU crypto TLS x509 credential support
|
||||
*
|
||||
* Copyright (c) 2015 Red Hat, Inc.
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU Lesser General Public
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 2 of the License, or (at your option) any later version.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* Lesser General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Lesser General Public
|
||||
* License along with this library; if not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef QCRYPTO_TLSCRED_X509_H__
|
||||
#define QCRYPTO_TLSCRED_X509_H__
|
||||
|
||||
#include "crypto/tlscreds.h"
|
||||
|
||||
#define TYPE_QCRYPTO_TLS_CREDS_X509 "tls-creds-x509"
|
||||
#define QCRYPTO_TLS_CREDS_X509(obj) \
|
||||
OBJECT_CHECK(QCryptoTLSCredsX509, (obj), TYPE_QCRYPTO_TLS_CREDS_X509)
|
||||
|
||||
typedef struct QCryptoTLSCredsX509 QCryptoTLSCredsX509;
|
||||
typedef struct QCryptoTLSCredsX509Class QCryptoTLSCredsX509Class;
|
||||
|
||||
#define QCRYPTO_TLS_CREDS_X509_CA_CERT "ca-cert.pem"
|
||||
#define QCRYPTO_TLS_CREDS_X509_CA_CRL "ca-crl.pem"
|
||||
#define QCRYPTO_TLS_CREDS_X509_SERVER_KEY "server-key.pem"
|
||||
#define QCRYPTO_TLS_CREDS_X509_SERVER_CERT "server-cert.pem"
|
||||
#define QCRYPTO_TLS_CREDS_X509_CLIENT_KEY "client-key.pem"
|
||||
#define QCRYPTO_TLS_CREDS_X509_CLIENT_CERT "client-cert.pem"
|
||||
|
||||
|
||||
/**
|
||||
* QCryptoTLSCredsX509:
|
||||
*
|
||||
* The QCryptoTLSCredsX509 object provides a representation
|
||||
* of x509 credentials used to perform a TLS handshake.
|
||||
*
|
||||
* This is a user creatable object, which can be instantiated
|
||||
* via object_new_propv():
|
||||
*
|
||||
* <example>
|
||||
* <title>Creating x509 TLS credential objects in code</title>
|
||||
* <programlisting>
|
||||
* Object *obj;
|
||||
* Error *err = NULL;
|
||||
* obj = object_new_propv(TYPE_QCRYPTO_TLS_CREDS_X509,
|
||||
* "tlscreds0",
|
||||
* &err,
|
||||
* "endpoint", "server",
|
||||
* "dir", "/path/x509/cert/dir",
|
||||
* "verify-peer", "yes",
|
||||
* NULL);
|
||||
* </programlisting>
|
||||
* </example>
|
||||
*
|
||||
* Or via QMP:
|
||||
*
|
||||
* <example>
|
||||
* <title>Creating x509 TLS credential objects via QMP</title>
|
||||
* <programlisting>
|
||||
* {
|
||||
* "execute": "object-add", "arguments": {
|
||||
* "id": "tlscreds0",
|
||||
* "qom-type": "tls-creds-x509",
|
||||
* "props": {
|
||||
* "endpoint": "server",
|
||||
* "dir": "/path/to/x509/cert/dir",
|
||||
* "verify-peer": false
|
||||
* }
|
||||
* }
|
||||
* }
|
||||
* </programlisting>
|
||||
* </example>
|
||||
*
|
||||
*
|
||||
* Or via the CLI:
|
||||
*
|
||||
* <example>
|
||||
* <title>Creating x509 TLS credential objects via CLI</title>
|
||||
* <programlisting>
|
||||
* qemu-system-x86_64 -object tls-creds-x509,id=tlscreds0,\
|
||||
* endpoint=server,verify-peer=off,\
|
||||
* dir=/path/to/x509/certdir/
|
||||
* </programlisting>
|
||||
* </example>
|
||||
*
|
||||
*/
|
||||
|
||||
struct QCryptoTLSCredsX509 {
|
||||
QCryptoTLSCreds parent_obj;
|
||||
#ifdef CONFIG_GNUTLS
|
||||
gnutls_certificate_credentials_t data;
|
||||
#endif
|
||||
};
|
||||
|
||||
|
||||
struct QCryptoTLSCredsX509Class {
|
||||
QCryptoTLSCredsClass parent_class;
|
||||
};
|
||||
|
||||
|
||||
#endif /* QCRYPTO_TLSCRED_X509_H__ */
|
||||
|
||||
|
|
@ -3591,6 +3591,33 @@ expensive operation that consumes random pool entropy, so it is
|
|||
recommended that a persistent set of parameters be generated
|
||||
upfront and saved.
|
||||
|
||||
@item -object tls-creds-x509,id=@var{id},endpoint=@var{endpoint},dir=@var{/path/to/cred/dir},verify-peer=@var{on|off}
|
||||
|
||||
Creates a TLS anonymous credentials object, which can be used to provide
|
||||
TLS support on network backends. The @option{id} parameter is a unique
|
||||
ID which network backends will use to access the credentials. The
|
||||
@option{endpoint} is either @option{server} or @option{client} depending
|
||||
on whether the QEMU network backend that uses the credentials will be
|
||||
acting as a client or as a server. If @option{verify-peer} is enabled
|
||||
(the default) then once the handshake is completed, the peer credentials
|
||||
will be verified. With x509 certificates, this implies that the clients
|
||||
must be provided with valid client certificates too.
|
||||
|
||||
The @var{dir} parameter tells QEMU where to find the credential
|
||||
files. For server endpoints, this directory may contain a file
|
||||
@var{dh-params.pem} providing diffie-hellman parameters to use
|
||||
for the TLS server. If the file is missing, QEMU will generate
|
||||
a set of DH parameters at startup. This is a computationally
|
||||
expensive operation that consumes random pool entropy, so it is
|
||||
recommended that a persistent set of parameters be generated
|
||||
upfront and saved.
|
||||
|
||||
For x509 certificate credentials the directory will contain further files
|
||||
providing the x509 certificates. The certificates must be stored
|
||||
in PEM format, in filenames @var{ca-cert.pem}, @var{ca-crl.pem} (optional),
|
||||
@var{server-cert.pem} (only servers), @var{server-key.pem} (only servers),
|
||||
@var{client-cert.pem} (only clients), and @var{client-key.pem} (only clients).
|
||||
|
||||
@end table
|
||||
|
||||
ETEXI
|
||||
|
|
|
|||
|
|
@ -1673,3 +1673,6 @@ qcrypto_tls_creds_get_path(void *creds, const char *filename, const char *path)
|
|||
|
||||
# crypto/tlscredsanon.c
|
||||
qcrypto_tls_creds_anon_load(void *creds, const char *dir) "TLS creds anon load creds=%p dir=%s"
|
||||
|
||||
# crypto/tlscredsx509.c
|
||||
qcrypto_tls_creds_x509_load(void *creds, const char *dir) "TLS creds x509 load creds=%p dir=%s"
|
||||
|
|
|
|||
Loading…
Reference in New Issue