nbd: Add max-connections to nbd-server-start
[qemu.git] / crypto / tlscreds.c
1 /*
2 * QEMU crypto TLS credential support
3 *
4 * Copyright (c) 2015 Red Hat, Inc.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 *
19 */
20
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "qemu/module.h"
24 #include "tlscredspriv.h"
25 #include "trace.h"
26
27 #define DH_BITS 2048
28
29 #ifdef CONFIG_GNUTLS
30 int
31 qcrypto_tls_creds_get_dh_params_file(QCryptoTLSCreds *creds,
32 const char *filename,
33 gnutls_dh_params_t *dh_params,
34 Error **errp)
35 {
36 int ret;
37
38 trace_qcrypto_tls_creds_load_dh(creds, filename ? filename : "<generated>");
39
40 if (filename == NULL) {
41 ret = gnutls_dh_params_init(dh_params);
42 if (ret < 0) {
43 error_setg(errp, "Unable to initialize DH parameters: %s",
44 gnutls_strerror(ret));
45 return -1;
46 }
47 ret = gnutls_dh_params_generate2(*dh_params, DH_BITS);
48 if (ret < 0) {
49 gnutls_dh_params_deinit(*dh_params);
50 *dh_params = NULL;
51 error_setg(errp, "Unable to generate DH parameters: %s",
52 gnutls_strerror(ret));
53 return -1;
54 }
55 } else {
56 GError *gerr = NULL;
57 gchar *contents;
58 gsize len;
59 gnutls_datum_t data;
60 if (!g_file_get_contents(filename,
61 &contents,
62 &len,
63 &gerr)) {
64
65 error_setg(errp, "%s", gerr->message);
66 g_error_free(gerr);
67 return -1;
68 }
69 data.data = (unsigned char *)contents;
70 data.size = len;
71 ret = gnutls_dh_params_init(dh_params);
72 if (ret < 0) {
73 g_free(contents);
74 error_setg(errp, "Unable to initialize DH parameters: %s",
75 gnutls_strerror(ret));
76 return -1;
77 }
78 ret = gnutls_dh_params_import_pkcs3(*dh_params,
79 &data,
80 GNUTLS_X509_FMT_PEM);
81 g_free(contents);
82 if (ret < 0) {
83 gnutls_dh_params_deinit(*dh_params);
84 *dh_params = NULL;
85 error_setg(errp, "Unable to load DH parameters from %s: %s",
86 filename, gnutls_strerror(ret));
87 return -1;
88 }
89 }
90
91 return 0;
92 }
93
94
95 int
96 qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds,
97 const char *filename,
98 bool required,
99 char **cred,
100 Error **errp)
101 {
102 struct stat sb;
103 int ret = -1;
104
105 if (!creds->dir) {
106 if (required) {
107 error_setg(errp, "Missing 'dir' property value");
108 return -1;
109 } else {
110 return 0;
111 }
112 }
113
114 *cred = g_strdup_printf("%s/%s", creds->dir, filename);
115
116 if (stat(*cred, &sb) < 0) {
117 if (errno == ENOENT && !required) {
118 ret = 0;
119 } else {
120 error_setg_errno(errp, errno,
121 "Unable to access credentials %s",
122 *cred);
123 }
124 g_free(*cred);
125 *cred = NULL;
126 goto cleanup;
127 }
128
129 ret = 0;
130 cleanup:
131 trace_qcrypto_tls_creds_get_path(creds, filename,
132 *cred ? *cred : "<none>");
133 return ret;
134 }
135
136
137 #endif /* ! CONFIG_GNUTLS */
138
139
140 static void
141 qcrypto_tls_creds_prop_set_verify(Object *obj,
142 bool value,
143 Error **errp G_GNUC_UNUSED)
144 {
145 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
146
147 creds->verifyPeer = value;
148 }
149
150
151 static bool
152 qcrypto_tls_creds_prop_get_verify(Object *obj,
153 Error **errp G_GNUC_UNUSED)
154 {
155 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
156
157 return creds->verifyPeer;
158 }
159
160
161 static void
162 qcrypto_tls_creds_prop_set_dir(Object *obj,
163 const char *value,
164 Error **errp G_GNUC_UNUSED)
165 {
166 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
167
168 creds->dir = g_strdup(value);
169 }
170
171
172 static char *
173 qcrypto_tls_creds_prop_get_dir(Object *obj,
174 Error **errp G_GNUC_UNUSED)
175 {
176 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
177
178 return g_strdup(creds->dir);
179 }
180
181
182 static void
183 qcrypto_tls_creds_prop_set_priority(Object *obj,
184 const char *value,
185 Error **errp G_GNUC_UNUSED)
186 {
187 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
188
189 creds->priority = g_strdup(value);
190 }
191
192
193 static char *
194 qcrypto_tls_creds_prop_get_priority(Object *obj,
195 Error **errp G_GNUC_UNUSED)
196 {
197 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
198
199 return g_strdup(creds->priority);
200 }
201
202
203 static void
204 qcrypto_tls_creds_prop_set_endpoint(Object *obj,
205 int value,
206 Error **errp G_GNUC_UNUSED)
207 {
208 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
209
210 creds->endpoint = value;
211 }
212
213
214 static int
215 qcrypto_tls_creds_prop_get_endpoint(Object *obj,
216 Error **errp G_GNUC_UNUSED)
217 {
218 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
219
220 return creds->endpoint;
221 }
222
223
224 static void
225 qcrypto_tls_creds_class_init(ObjectClass *oc, void *data)
226 {
227 object_class_property_add_bool(oc, "verify-peer",
228 qcrypto_tls_creds_prop_get_verify,
229 qcrypto_tls_creds_prop_set_verify);
230 object_class_property_add_str(oc, "dir",
231 qcrypto_tls_creds_prop_get_dir,
232 qcrypto_tls_creds_prop_set_dir);
233 object_class_property_add_enum(oc, "endpoint",
234 "QCryptoTLSCredsEndpoint",
235 &QCryptoTLSCredsEndpoint_lookup,
236 qcrypto_tls_creds_prop_get_endpoint,
237 qcrypto_tls_creds_prop_set_endpoint);
238 object_class_property_add_str(oc, "priority",
239 qcrypto_tls_creds_prop_get_priority,
240 qcrypto_tls_creds_prop_set_priority);
241 }
242
243
244 static void
245 qcrypto_tls_creds_init(Object *obj)
246 {
247 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
248
249 creds->verifyPeer = true;
250 }
251
252
253 static void
254 qcrypto_tls_creds_finalize(Object *obj)
255 {
256 QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
257
258 g_free(creds->dir);
259 g_free(creds->priority);
260 }
261
262
263 static const TypeInfo qcrypto_tls_creds_info = {
264 .parent = TYPE_OBJECT,
265 .name = TYPE_QCRYPTO_TLS_CREDS,
266 .instance_size = sizeof(QCryptoTLSCreds),
267 .instance_init = qcrypto_tls_creds_init,
268 .instance_finalize = qcrypto_tls_creds_finalize,
269 .class_init = qcrypto_tls_creds_class_init,
270 .class_size = sizeof(QCryptoTLSCredsClass),
271 .abstract = true,
272 };
273
274
275 static void
276 qcrypto_tls_creds_register_types(void)
277 {
278 type_register_static(&qcrypto_tls_creds_info);
279 }
280
281
282 type_init(qcrypto_tls_creds_register_types);