2 * QEMU crypto TLS x509 credential support
4 * Copyright (c) 2015 Red Hat, Inc.
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "crypto/tlscredsx509.h"
22 #include "crypto/tlscredspriv.h"
23 #include "qom/object_interfaces.h"
29 #include <gnutls/x509.h>
33 qcrypto_tls_creds_check_cert_times(gnutls_x509_crt_t cert,
39 time_t now = time(NULL);
41 if (now == ((time_t)-1)) {
42 error_setg_errno(errp, errno, "cannot get current time");
46 if (gnutls_x509_crt_get_expiration_time(cert) < now) {
49 "The CA certificate %s has expired" :
51 "The server certificate %s has expired" :
52 "The client certificate %s has expired")),
57 if (gnutls_x509_crt_get_activation_time(cert) > now) {
60 "The CA certificate %s is not yet active" :
62 "The server certificate %s is not yet active" :
63 "The client certificate %s is not yet active")),
72 #if LIBGNUTLS_VERSION_NUMBER >= 2
74 * The gnutls_x509_crt_get_basic_constraints function isn't
75 * available in GNUTLS 1.0.x branches. This isn't critical
76 * though, since gnutls_certificate_verify_peers2 will do
77 * pretty much the same check at runtime, so we can just
81 qcrypto_tls_creds_check_cert_basic_constraints(QCryptoTLSCredsX509 *creds,
82 gnutls_x509_crt_t cert,
90 status = gnutls_x509_crt_get_basic_constraints(cert, NULL, NULL, NULL);
91 trace_qcrypto_tls_creds_x509_check_basic_constraints(
92 creds, certFile, status);
94 if (status > 0) { /* It is a CA cert */
96 error_setg(errp, isServer ?
97 "The certificate %s basic constraints show a CA, "
98 "but we need one for a server" :
99 "The certificate %s basic constraints show a CA, "
100 "but we need one for a client",
104 } else if (status == 0) { /* It is not a CA cert */
107 "The certificate %s basic constraints do not "
112 } else if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
113 /* Missing basicConstraints */
116 "The certificate %s is missing basic constraints "
121 } else { /* General error */
123 "Unable to query certificate %s basic constraints: %s",
124 certFile, gnutls_strerror(status));
134 qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCredsX509 *creds,
135 gnutls_x509_crt_t cert,
136 const char *certFile,
141 unsigned int usage = 0;
142 unsigned int critical = 0;
144 status = gnutls_x509_crt_get_key_usage(cert, &usage, &critical);
145 trace_qcrypto_tls_creds_x509_check_key_usage(
146 creds, certFile, status, usage, critical);
149 if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
150 usage = isCA ? GNUTLS_KEY_KEY_CERT_SIGN :
151 GNUTLS_KEY_DIGITAL_SIGNATURE|GNUTLS_KEY_KEY_ENCIPHERMENT;
154 "Unable to query certificate %s key usage: %s",
155 certFile, gnutls_strerror(status));
161 if (!(usage & GNUTLS_KEY_KEY_CERT_SIGN)) {
164 "Certificate %s usage does not permit "
165 "certificate signing", certFile);
170 if (!(usage & GNUTLS_KEY_DIGITAL_SIGNATURE)) {
173 "Certificate %s usage does not permit digital "
174 "signature", certFile);
178 if (!(usage & GNUTLS_KEY_KEY_ENCIPHERMENT)) {
181 "Certificate %s usage does not permit key "
182 "encipherment", certFile);
193 qcrypto_tls_creds_check_cert_key_purpose(QCryptoTLSCredsX509 *creds,
194 gnutls_x509_crt_t cert,
195 const char *certFile,
201 unsigned int purposeCritical;
202 unsigned int critical;
205 bool allowClient = false, allowServer = false;
210 status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer,
213 if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
215 /* If there is no data at all, then we must allow
216 client/server to pass */
218 allowServer = allowClient = true;
222 if (status != GNUTLS_E_SHORT_MEMORY_BUFFER) {
224 "Unable to query certificate %s key purpose: %s",
225 certFile, gnutls_strerror(status));
229 buffer = g_new0(char, size);
231 status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer,
232 &size, &purposeCritical);
235 trace_qcrypto_tls_creds_x509_check_key_purpose(
236 creds, certFile, status, "<none>", purposeCritical);
239 "Unable to query certificate %s key purpose: %s",
240 certFile, gnutls_strerror(status));
243 trace_qcrypto_tls_creds_x509_check_key_purpose(
244 creds, certFile, status, buffer, purposeCritical);
245 if (purposeCritical) {
249 if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_SERVER)) {
251 } else if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_CLIENT)) {
253 } else if (g_str_equal(buffer, GNUTLS_KP_ANY)) {
254 allowServer = allowClient = true;
265 "Certificate %s purpose does not allow "
266 "use with a TLS server", certFile);
274 "Certificate %s purpose does not allow use "
275 "with a TLS client", certFile);
286 qcrypto_tls_creds_check_cert(QCryptoTLSCredsX509 *creds,
287 gnutls_x509_crt_t cert,
288 const char *certFile,
293 if (qcrypto_tls_creds_check_cert_times(cert, certFile,
299 #if LIBGNUTLS_VERSION_NUMBER >= 2
300 if (qcrypto_tls_creds_check_cert_basic_constraints(creds,
308 if (qcrypto_tls_creds_check_cert_key_usage(creds,
315 qcrypto_tls_creds_check_cert_key_purpose(creds,
317 isServer, errp) < 0) {
326 qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t cert,
327 const char *certFile,
328 gnutls_x509_crt_t *cacerts,
330 const char *cacertFile,
336 if (gnutls_x509_crt_list_verify(&cert, 1,
340 error_setg(errp, isServer ?
341 "Unable to verify server certificate %s against "
342 "CA certificate %s" :
343 "Unable to verify client certificate %s against "
345 certFile, cacertFile);
350 const char *reason = "Invalid certificate";
352 if (status & GNUTLS_CERT_INVALID) {
353 reason = "The certificate is not trusted";
356 if (status & GNUTLS_CERT_SIGNER_NOT_FOUND) {
357 reason = "The certificate hasn't got a known issuer";
360 if (status & GNUTLS_CERT_REVOKED) {
361 reason = "The certificate has been revoked";
364 #ifndef GNUTLS_1_0_COMPAT
365 if (status & GNUTLS_CERT_INSECURE_ALGORITHM) {
366 reason = "The certificate uses an insecure algorithm";
371 "Our own certificate %s failed validation against %s: %s",
372 certFile, cacertFile, reason);
380 static gnutls_x509_crt_t
381 qcrypto_tls_creds_load_cert(QCryptoTLSCredsX509 *creds,
382 const char *certFile,
387 gnutls_x509_crt_t cert = NULL;
393 trace_qcrypto_tls_creds_x509_load_cert(creds, isServer, certFile);
395 if (gnutls_x509_crt_init(&cert) < 0) {
396 error_setg(errp, "Unable to initialize certificate");
400 if (!g_file_get_contents(certFile, &buf, &buflen, &gerr)) {
401 error_setg(errp, "Cannot load CA cert list %s: %s",
402 certFile, gerr->message);
407 data.data = (unsigned char *)buf;
408 data.size = strlen(buf);
410 if (gnutls_x509_crt_import(cert, &data, GNUTLS_X509_FMT_PEM) < 0) {
411 error_setg(errp, isServer ?
412 "Unable to import server certificate %s" :
413 "Unable to import client certificate %s",
422 gnutls_x509_crt_deinit(cert);
431 qcrypto_tls_creds_load_ca_cert_list(QCryptoTLSCredsX509 *creds,
432 const char *certFile,
433 gnutls_x509_crt_t *certs,
434 unsigned int certMax,
445 trace_qcrypto_tls_creds_x509_load_cert_list(creds, certFile);
447 if (!g_file_get_contents(certFile, &buf, &buflen, &gerr)) {
448 error_setg(errp, "Cannot load CA cert list %s: %s",
449 certFile, gerr->message);
454 data.data = (unsigned char *)buf;
455 data.size = strlen(buf);
457 if (gnutls_x509_crt_list_import(certs, &certMax, &data,
458 GNUTLS_X509_FMT_PEM, 0) < 0) {
460 "Unable to import CA certificate list %s",
476 qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
478 const char *cacertFile,
479 const char *certFile,
482 gnutls_x509_crt_t cert = NULL;
483 gnutls_x509_crt_t cacerts[MAX_CERTS];
488 memset(cacerts, 0, sizeof(cacerts));
490 access(certFile, R_OK) == 0) {
491 cert = qcrypto_tls_creds_load_cert(creds,
498 if (access(cacertFile, R_OK) == 0) {
499 if (qcrypto_tls_creds_load_ca_cert_list(creds,
501 MAX_CERTS, &ncacerts,
508 qcrypto_tls_creds_check_cert(creds,
509 cert, certFile, isServer,
514 for (i = 0; i < ncacerts; i++) {
515 if (qcrypto_tls_creds_check_cert(creds,
516 cacerts[i], cacertFile,
517 isServer, true, errp) < 0) {
522 if (cert && ncacerts &&
523 qcrypto_tls_creds_check_cert_pair(cert, certFile, cacerts,
524 ncacerts, cacertFile,
525 isServer, errp) < 0) {
533 gnutls_x509_crt_deinit(cert);
535 for (i = 0; i < ncacerts; i++) {
536 gnutls_x509_crt_deinit(cacerts[i]);
543 qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
546 char *cacert = NULL, *cacrl = NULL, *cert = NULL,
547 *key = NULL, *dhparams = NULL;
551 trace_qcrypto_tls_creds_x509_load(creds,
552 creds->parent_obj.dir ? creds->parent_obj.dir : "<nodir>");
554 if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
555 if (qcrypto_tls_creds_get_path(&creds->parent_obj,
556 QCRYPTO_TLS_CREDS_X509_CA_CERT,
557 true, &cacert, errp) < 0 ||
558 qcrypto_tls_creds_get_path(&creds->parent_obj,
559 QCRYPTO_TLS_CREDS_X509_CA_CRL,
560 false, &cacrl, errp) < 0 ||
561 qcrypto_tls_creds_get_path(&creds->parent_obj,
562 QCRYPTO_TLS_CREDS_X509_SERVER_CERT,
563 true, &cert, errp) < 0 ||
564 qcrypto_tls_creds_get_path(&creds->parent_obj,
565 QCRYPTO_TLS_CREDS_X509_SERVER_KEY,
566 true, &key, errp) < 0 ||
567 qcrypto_tls_creds_get_path(&creds->parent_obj,
568 QCRYPTO_TLS_CREDS_DH_PARAMS,
569 false, &dhparams, errp) < 0) {
573 if (qcrypto_tls_creds_get_path(&creds->parent_obj,
574 QCRYPTO_TLS_CREDS_X509_CA_CERT,
575 true, &cacert, errp) < 0 ||
576 qcrypto_tls_creds_get_path(&creds->parent_obj,
577 QCRYPTO_TLS_CREDS_X509_CLIENT_CERT,
578 false, &cert, errp) < 0 ||
579 qcrypto_tls_creds_get_path(&creds->parent_obj,
580 QCRYPTO_TLS_CREDS_X509_CLIENT_KEY,
581 false, &key, errp) < 0) {
586 if (creds->sanityCheck &&
587 qcrypto_tls_creds_x509_sanity_check(creds,
588 creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
589 cacert, cert, errp) < 0) {
593 ret = gnutls_certificate_allocate_credentials(&creds->data);
595 error_setg(errp, "Cannot allocate credentials: '%s'",
596 gnutls_strerror(ret));
600 ret = gnutls_certificate_set_x509_trust_file(creds->data,
602 GNUTLS_X509_FMT_PEM);
604 error_setg(errp, "Cannot load CA certificate '%s': %s",
605 cacert, gnutls_strerror(ret));
609 if (cert != NULL && key != NULL) {
610 ret = gnutls_certificate_set_x509_key_file(creds->data,
612 GNUTLS_X509_FMT_PEM);
614 error_setg(errp, "Cannot load certificate '%s' & key '%s': %s",
615 cert, key, gnutls_strerror(ret));
621 ret = gnutls_certificate_set_x509_crl_file(creds->data,
623 GNUTLS_X509_FMT_PEM);
625 error_setg(errp, "Cannot load CRL '%s': %s",
626 cacrl, gnutls_strerror(ret));
631 if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
632 if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams,
633 &creds->parent_obj.dh_params,
637 gnutls_certificate_set_dh_params(creds->data,
638 creds->parent_obj.dh_params);
653 qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds)
656 gnutls_certificate_free_credentials(creds->data);
659 if (creds->parent_obj.dh_params) {
660 gnutls_dh_params_deinit(creds->parent_obj.dh_params);
661 creds->parent_obj.dh_params = NULL;
666 #else /* ! CONFIG_GNUTLS */
670 qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED,
673 error_setg(errp, "TLS credentials support requires GNUTLS");
678 qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED)
684 #endif /* ! CONFIG_GNUTLS */
688 qcrypto_tls_creds_x509_prop_set_loaded(Object *obj,
692 QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
695 qcrypto_tls_creds_x509_load(creds, errp);
697 qcrypto_tls_creds_x509_unload(creds);
706 qcrypto_tls_creds_x509_prop_get_loaded(Object *obj,
707 Error **errp G_GNUC_UNUSED)
709 QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
711 return creds->data != NULL;
715 #else /* ! CONFIG_GNUTLS */
719 qcrypto_tls_creds_x509_prop_get_loaded(Object *obj G_GNUC_UNUSED,
720 Error **errp G_GNUC_UNUSED)
726 #endif /* ! CONFIG_GNUTLS */
730 qcrypto_tls_creds_x509_prop_set_sanity(Object *obj,
732 Error **errp G_GNUC_UNUSED)
734 QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
736 creds->sanityCheck = value;
741 qcrypto_tls_creds_x509_prop_get_sanity(Object *obj,
742 Error **errp G_GNUC_UNUSED)
744 QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
746 return creds->sanityCheck;
751 qcrypto_tls_creds_x509_complete(UserCreatable *uc, Error **errp)
753 object_property_set_bool(OBJECT(uc), true, "loaded", errp);
758 qcrypto_tls_creds_x509_init(Object *obj)
760 QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
762 creds->sanityCheck = true;
764 object_property_add_bool(obj, "loaded",
765 qcrypto_tls_creds_x509_prop_get_loaded,
766 qcrypto_tls_creds_x509_prop_set_loaded,
768 object_property_add_bool(obj, "sanity-check",
769 qcrypto_tls_creds_x509_prop_get_sanity,
770 qcrypto_tls_creds_x509_prop_set_sanity,
776 qcrypto_tls_creds_x509_finalize(Object *obj)
778 QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
780 qcrypto_tls_creds_x509_unload(creds);
785 qcrypto_tls_creds_x509_class_init(ObjectClass *oc, void *data)
787 UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
789 ucc->complete = qcrypto_tls_creds_x509_complete;
793 static const TypeInfo qcrypto_tls_creds_x509_info = {
794 .parent = TYPE_QCRYPTO_TLS_CREDS,
795 .name = TYPE_QCRYPTO_TLS_CREDS_X509,
796 .instance_size = sizeof(QCryptoTLSCredsX509),
797 .instance_init = qcrypto_tls_creds_x509_init,
798 .instance_finalize = qcrypto_tls_creds_x509_finalize,
799 .class_size = sizeof(QCryptoTLSCredsX509Class),
800 .class_init = qcrypto_tls_creds_x509_class_init,
801 .interfaces = (InterfaceInfo[]) {
802 { TYPE_USER_CREATABLE },
809 qcrypto_tls_creds_x509_register_types(void)
811 type_register_static(&qcrypto_tls_creds_x509_info);
815 type_init(qcrypto_tls_creds_x509_register_types);