virnettlscontext.c 44.9 KB
Newer Older
1 2 3
/*
 * virnettlscontext.c: TLS encryption/x509 handling
 *
4
 * Copyright (C) 2010-2014 Red Hat, Inc.
5 6 7 8 9 10 11 12 13 14 15 16
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
17
 * License along with this library.  If not, see
O
Osier Yang 已提交
18
 * <http://www.gnu.org/licenses/>.
19 20 21 22 23 24 25 26 27
 */

#include <config.h>

#include <unistd.h>
#include <fnmatch.h>
#include <stdlib.h>

#include <gnutls/gnutls.h>
E
Eric Blake 已提交
28
#if HAVE_GNUTLS_CRYPTO_H
E
Eric Blake 已提交
29 30
# include <gnutls/crypto.h>
#endif
31 32 33 34
#include <gnutls/x509.h>
#include "gnutls_1_0_compat.h"

#include "virnettlscontext.h"
35
#include "virstring.h"
36

37
#include "viralloc.h"
38
#include "virerror.h"
39
#include "virfile.h"
40
#include "virutil.h"
41
#include "virlog.h"
42
#include "virprobe.h"
43
#include "virthread.h"
44 45
#include "configmake.h"

46
#define DH_BITS 2048
47 48 49 50 51 52 53 54 55 56 57

#define LIBVIRT_PKI_DIR SYSCONFDIR "/pki"
#define LIBVIRT_CACERT LIBVIRT_PKI_DIR "/CA/cacert.pem"
#define LIBVIRT_CACRL LIBVIRT_PKI_DIR "/CA/cacrl.pem"
#define LIBVIRT_CLIENTKEY LIBVIRT_PKI_DIR "/libvirt/private/clientkey.pem"
#define LIBVIRT_CLIENTCERT LIBVIRT_PKI_DIR "/libvirt/clientcert.pem"
#define LIBVIRT_SERVERKEY LIBVIRT_PKI_DIR "/libvirt/private/serverkey.pem"
#define LIBVIRT_SERVERCERT LIBVIRT_PKI_DIR "/libvirt/servercert.pem"

#define VIR_FROM_THIS VIR_FROM_RPC

58 59
VIR_LOG_INIT("rpc.nettlscontext");

60
struct _virNetTLSContext {
61
    virObjectLockable parent;
62 63 64 65 66 67 68 69 70 71

    gnutls_certificate_credentials_t x509cred;
    gnutls_dh_params_t dhParams;

    bool isServer;
    bool requireValidCert;
    const char *const*x509dnWhitelist;
};

struct _virNetTLSSession {
72
    virObjectLockable parent;
73 74 75

    bool handshakeComplete;

76
    bool isServer;
77 78 79 80 81
    char *hostname;
    gnutls_session_t session;
    virNetTLSSessionWriteFunc writeFunc;
    virNetTLSSessionReadFunc readFunc;
    void *opaque;
82
    char *x509dname;
83 84
};

85 86 87 88 89 90 91 92
static virClassPtr virNetTLSContextClass;
static virClassPtr virNetTLSSessionClass;
static void virNetTLSContextDispose(void *obj);
static void virNetTLSSessionDispose(void *obj);


static int virNetTLSContextOnceInit(void)
{
93
    if (!(virNetTLSContextClass = virClassNew(virClassForObjectLockable(),
94
                                              "virNetTLSContext",
95 96 97 98
                                              sizeof(virNetTLSContext),
                                              virNetTLSContextDispose)))
        return -1;

99
    if (!(virNetTLSSessionClass = virClassNew(virClassForObjectLockable(),
100
                                              "virNetTLSSession",
101 102 103 104 105 106 107 108 109
                                              sizeof(virNetTLSSession),
                                              virNetTLSSessionDispose)))
        return -1;

    return 0;
}

VIR_ONCE_GLOBAL_INIT(virNetTLSContext)

110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126

static int
virNetTLSContextCheckCertFile(const char *type, const char *file, bool allowMissing)
{
    if (!virFileExists(file)) {
        if (allowMissing)
            return 1;

        virReportSystemError(errno,
                             _("Cannot read %s '%s'"),
                             type, file);
        return -1;
    }
    return 0;
}


127
static void virNetTLSLog(int level ATTRIBUTE_UNUSED,
128 129
                         const char *str ATTRIBUTE_UNUSED)
{
130 131 132
    VIR_DEBUG("%d %s", level, str);
}

133

134 135 136 137
static int virNetTLSContextCheckCertTimes(gnutls_x509_crt_t cert,
                                          const char *certFile,
                                          bool isServer,
                                          bool isCA)
138 139 140 141 142 143
{
    time_t now;

    if ((now = time(NULL)) == ((time_t)-1)) {
        virReportSystemError(errno, "%s",
                             _("cannot get current time"));
144
        return -1;
145 146 147
    }

    if (gnutls_x509_crt_get_expiration_time(cert) < now) {
148 149 150 151 152 153 154
        virReportError(VIR_ERR_SYSTEM_ERROR,
                       (isCA ?
                        _("The CA certificate %s has expired") :
                        (isServer ?
                         _("The server certificate %s has expired") :
                         _("The client certificate %s has expired"))),
                       certFile);
155
        return -1;
156 157 158
    }

    if (gnutls_x509_crt_get_activation_time(cert) > now) {
159 160 161 162 163 164 165
        virReportError(VIR_ERR_SYSTEM_ERROR,
                       (isCA ?
                        _("The CA certificate %s is not yet active") :
                        (isServer ?
                         _("The server certificate %s is not yet active") :
                         _("The client certificate %s is not yet active"))),
                       certFile);
166
        return -1;
167 168
    }

169 170 171
    return 0;
}

172 173 174 175 176 177 178 179 180

#ifndef GNUTLS_1_0_COMPAT
/*
 * The gnutls_x509_crt_get_basic_constraints function isn't
 * available in GNUTLS 1.0.x branches. This isn't critical
 * though, since gnutls_certificate_verify_peers2 will do
 * pretty much the same check at runtime, so we can just
 * disable this code
 */
181 182 183 184 185 186 187
static int virNetTLSContextCheckCertBasicConstraints(gnutls_x509_crt_t cert,
                                                     const char *certFile,
                                                     bool isServer,
                                                     bool isCA)
{
    int status;

188 189 190 191 192
    status = gnutls_x509_crt_get_basic_constraints(cert, NULL, NULL, NULL);
    VIR_DEBUG("Cert %s basic constraints %d", certFile, status);

    if (status > 0) { /* It is a CA cert */
        if (!isCA) {
193 194 195 196
            virReportError(VIR_ERR_SYSTEM_ERROR, isServer ?
                           _("The certificate %s basic constraints show a CA, but we need one for a server") :
                           _("The certificate %s basic constraints show a CA, but we need one for a client"),
                           certFile);
197
            return -1;
198 199 200
        }
    } else if (status == 0) { /* It is not a CA cert */
        if (isCA) {
201 202 203
            virReportError(VIR_ERR_SYSTEM_ERROR,
                           _("The certificate %s basic constraints do not show a CA"),
                           certFile);
204
            return -1;
205 206 207
        }
    } else if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) { /* Missing basicConstraints */
        if (isCA) {
208 209 210
            virReportError(VIR_ERR_SYSTEM_ERROR,
                           _("The certificate %s is missing basic constraints for a CA"),
                           certFile);
211
            return -1;
212 213
        }
    } else { /* General error */
214 215 216
        virReportError(VIR_ERR_SYSTEM_ERROR,
                       _("Unable to query certificate %s basic constraints %s"),
                       certFile, gnutls_strerror(status));
217
        return -1;
218 219
    }

220 221
    return 0;
}
222 223
#endif

224 225 226 227 228 229

static int virNetTLSContextCheckCertKeyUsage(gnutls_x509_crt_t cert,
                                             const char *certFile,
                                             bool isCA)
{
    int status;
230 231
    unsigned int usage = 0;
    unsigned int critical = 0;
232

233
    status = gnutls_x509_crt_get_key_usage(cert, &usage, &critical);
234

235
    VIR_DEBUG("Cert %s key usage status %d usage %d critical %u", certFile, status, usage, critical);
236
    if (status < 0) {
237 238 239 240
        if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
            usage = isCA ? GNUTLS_KEY_KEY_CERT_SIGN :
                GNUTLS_KEY_DIGITAL_SIGNATURE|GNUTLS_KEY_KEY_ENCIPHERMENT;
        } else {
241 242 243
            virReportError(VIR_ERR_SYSTEM_ERROR,
                           _("Unable to query certificate %s key usage %s"),
                           certFile, gnutls_strerror(status));
244
            return -1;
245
        }
246 247
    }

248 249
    if (isCA) {
        if (!(usage & GNUTLS_KEY_KEY_CERT_SIGN)) {
250
            if (critical) {
251 252 253
                virReportError(VIR_ERR_SYSTEM_ERROR,
                               _("Certificate %s usage does not permit certificate signing"),
                               certFile);
254
                return -1;
255 256 257 258
            } else {
                VIR_WARN("Certificate %s usage does not permit certificate signing",
                         certFile);
            }
259 260
        }
    } else {
261
        if (!(usage & GNUTLS_KEY_DIGITAL_SIGNATURE)) {
262
            if (critical) {
263 264 265
                virReportError(VIR_ERR_SYSTEM_ERROR,
                               _("Certificate %s usage does not permit digital signature"),
                               certFile);
266
                return -1;
267 268 269 270
            } else {
                VIR_WARN("Certificate %s usage does not permit digital signature",
                         certFile);
            }
271 272
        }
        if (!(usage & GNUTLS_KEY_KEY_ENCIPHERMENT)) {
273
            if (critical) {
274 275 276
                virReportError(VIR_ERR_SYSTEM_ERROR,
                               _("Certificate %s usage does not permit key encipherment"),
                               certFile);
277
                return -1;
278 279 280 281
            } else {
                VIR_WARN("Certificate %s usage does not permit key encipherment",
                         certFile);
            }
282 283 284
        }
    }

285 286 287 288 289 290 291 292 293
    return 0;
}


static int virNetTLSContextCheckCertKeyPurpose(gnutls_x509_crt_t cert,
                                               const char *certFile,
                                               bool isServer)
{
    int status;
294
    size_t i;
295 296
    unsigned int purposeCritical;
    unsigned int critical;
E
Eric Blake 已提交
297
    char *buffer = NULL;
298 299 300
    size_t size;
    bool allowClient = false, allowServer = false;

301
    critical = 0;
302
    for (i = 0; ; i++) {
303 304 305 306
        size = 0;
        status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer, &size, NULL);

        if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
307
            VIR_DEBUG("No key purpose data available at slot %zu", i);
308 309 310 311

            /* If there is no data at all, then we must allow client/server to pass */
            if (i == 0)
                allowServer = allowClient = true;
312 313 314
            break;
        }
        if (status != GNUTLS_E_SHORT_MEMORY_BUFFER) {
315 316 317
            virReportError(VIR_ERR_SYSTEM_ERROR,
                           _("Unable to query certificate %s key purpose %s"),
                           certFile, gnutls_strerror(status));
318
            return -1;
319 320
        }

321
        if (VIR_ALLOC_N(buffer, size) < 0)
322
            return -1;
323

324
        status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer, &size, &purposeCritical);
325
        if (status < 0) {
326
            VIR_FREE(buffer);
327 328 329
            virReportError(VIR_ERR_SYSTEM_ERROR,
                           _("Unable to query certificate %s key purpose %s"),
                           certFile, gnutls_strerror(status));
330
            return -1;
331
        }
332 333
        if (purposeCritical)
            critical = true;
334

335
        VIR_DEBUG("Key purpose %d %s critical %u", status, buffer, purposeCritical);
336
        if (STREQ(buffer, GNUTLS_KP_TLS_WWW_SERVER)) {
337
            allowServer = true;
338
        } else if (STREQ(buffer, GNUTLS_KP_TLS_WWW_CLIENT)) {
339
            allowClient = true;
340
        } else if (STRNEQ(buffer, GNUTLS_KP_ANY)) {
341
            allowServer = allowClient = true;
342 343 344 345 346
        }

        VIR_FREE(buffer);
    }

347 348
    if (isServer) {
        if (!allowServer) {
349
            if (critical) {
350 351 352
                virReportError(VIR_ERR_SYSTEM_ERROR,
                               _("Certificate %s purpose does not allow use for with a TLS server"),
                               certFile);
353
                return -1;
354 355 356 357
            } else {
                VIR_WARN("Certificate %s purpose does not allow use for with a TLS server",
                         certFile);
            }
358
        }
359 360
    } else {
        if (!allowClient) {
361
            if (critical) {
362 363 364
                virReportError(VIR_ERR_SYSTEM_ERROR,
                               _("Certificate %s purpose does not allow use for with a TLS client"),
                               certFile);
365
                return -1;
366 367 368 369
            } else {
                VIR_WARN("Certificate %s purpose does not allow use for with a TLS client",
                         certFile);
            }
370 371 372
        }
    }

373 374 375 376 377 378 379 380 381
    return 0;
}

/* Check DN is on tls_allowed_dn_list. */
static int
virNetTLSContextCheckCertDNWhitelist(const char *dname,
                                     const char *const*wildcards)
{
    while (*wildcards) {
382
        int ret = fnmatch(*wildcards, dname, 0);
J
Ján Tomko 已提交
383
        if (ret == 0) /* Successful match */
384 385
            return 1;
        if (ret != FNM_NOMATCH) {
386 387 388
            virReportError(VIR_ERR_INTERNAL_ERROR,
                           _("Malformed TLS whitelist regular expression '%s'"),
                           *wildcards);
389 390 391 392 393 394 395 396 397 398
            return -1;
        }

        wildcards++;
    }

    /* Log the client's DN for debugging */
    VIR_DEBUG("Failed whitelist check for client DN '%s'", dname);

    /* This is the most common error: make it informative. */
399 400 401
    virReportError(VIR_ERR_SYSTEM_ERROR, "%s",
                   _("Client's Distinguished Name is not on the list "
                     "of allowed clients (tls_allowed_dn_list).  Use "
402 403
                     "'certtool -i --infile clientcert.pem' to view the "
                     "Distinguished Name field in the client certificate, "
404
                     "or run this daemon with --verbose option."));
405 406 407 408 409 410 411 412
    return 0;
}


static int
virNetTLSContextCheckCertDN(gnutls_x509_crt_t cert,
                            const char *certFile,
                            const char *hostname,
413
                            const char *dname,
414 415
                            const char *const* whitelist)
{
416 417
    if (whitelist && dname &&
        virNetTLSContextCheckCertDNWhitelist(dname, whitelist) <= 0)
418 419 420 421
        return -1;

    if (hostname &&
        !gnutls_x509_crt_check_hostname(cert, hostname)) {
422 423 424
        virReportError(VIR_ERR_RPC,
                       _("Certificate %s owner does not match the hostname %s"),
                       certFile, hostname);
425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440
        return -1;
    }

    return 0;
}


static int virNetTLSContextCheckCert(gnutls_x509_crt_t cert,
                                     const char *certFile,
                                     bool isServer,
                                     bool isCA)
{
    if (virNetTLSContextCheckCertTimes(cert, certFile,
                                       isServer, isCA) < 0)
        return -1;

441
#ifndef GNUTLS_1_0_COMPAT
442 443 444
    if (virNetTLSContextCheckCertBasicConstraints(cert, certFile,
                                                  isServer, isCA) < 0)
        return -1;
445
#endif
446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461

    if (virNetTLSContextCheckCertKeyUsage(cert, certFile,
                                          isCA) < 0)
        return -1;

    if (!isCA &&
        virNetTLSContextCheckCertKeyPurpose(cert, certFile,
                                            isServer) < 0)
        return -1;

    return 0;
}


static int virNetTLSContextCheckCertPair(gnutls_x509_crt_t cert,
                                         const char *certFile,
462 463
                                         gnutls_x509_crt_t *cacerts,
                                         size_t ncacerts,
464 465 466 467 468 469
                                         const char *cacertFile,
                                         bool isServer)
{
    unsigned int status;

    if (gnutls_x509_crt_list_verify(&cert, 1,
470
                                    cacerts, ncacerts,
471 472
                                    NULL, 0,
                                    0, &status) < 0) {
473 474 475 476
        virReportError(VIR_ERR_SYSTEM_ERROR, isServer ?
                       _("Unable to verify server certificate %s against CA certificate %s") :
                       _("Unable to verify client certificate %s against CA certificate %s"),
                       certFile, cacertFile);
477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496
        return -1;
    }

    if (status != 0) {
        const char *reason = _("Invalid certificate");

        if (status & GNUTLS_CERT_INVALID)
            reason = _("The certificate is not trusted.");

        if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)
            reason = _("The certificate hasn't got a known issuer.");

        if (status & GNUTLS_CERT_REVOKED)
            reason = _("The certificate has been revoked.");

#ifndef GNUTLS_1_0_COMPAT
        if (status & GNUTLS_CERT_INSECURE_ALGORITHM)
            reason = _("The certificate uses an insecure algorithm");
#endif

497 498 499
        virReportError(VIR_ERR_SYSTEM_ERROR,
                       _("Our own certificate %s failed validation against %s: %s"),
                       certFile, cacertFile, reason);
500 501 502 503 504 505 506 507
        return -1;
    }

    return 0;
}


static gnutls_x509_crt_t virNetTLSContextLoadCertFromFile(const char *certFile,
508
                                                          bool isServer)
509 510 511 512 513 514
{
    gnutls_datum_t data;
    gnutls_x509_crt_t cert = NULL;
    char *buf = NULL;
    int ret = -1;

515 516
    VIR_DEBUG("isServer %d certFile %s",
              isServer, certFile);
517 518

    if (gnutls_x509_crt_init(&cert) < 0) {
519 520
        virReportError(VIR_ERR_SYSTEM_ERROR, "%s",
                       _("Unable to initialize certificate"));
521 522 523 524 525 526 527 528 529 530
        goto cleanup;
    }

    if (virFileReadAll(certFile, (1<<16), &buf) < 0)
        goto cleanup;

    data.data = (unsigned char *)buf;
    data.size = strlen(buf);

    if (gnutls_x509_crt_import(cert, &data, GNUTLS_X509_FMT_PEM) < 0) {
531 532 533 534
        virReportError(VIR_ERR_SYSTEM_ERROR, isServer ?
                       _("Unable to import server certificate %s") :
                       _("Unable to import client certificate %s"),
                       certFile);
535 536
        goto cleanup;
    }
537

538 539
    ret = 0;

540
 cleanup:
541 542 543 544 545 546 547 548 549
    if (ret != 0) {
        gnutls_x509_crt_deinit(cert);
        cert = NULL;
    }
    VIR_FREE(buf);
    return cert;
}


550 551
static int virNetTLSContextLoadCACertListFromFile(const char *certFile,
                                                  gnutls_x509_crt_t *certs,
552
                                                  unsigned int certMax,
553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577
                                                  size_t *ncerts)
{
    gnutls_datum_t data;
    char *buf = NULL;
    int ret = -1;

    *ncerts = 0;
    VIR_DEBUG("certFile %s", certFile);

    if (virFileReadAll(certFile, (1<<16), &buf) < 0)
        goto cleanup;

    data.data = (unsigned char *)buf;
    data.size = strlen(buf);

    if (gnutls_x509_crt_list_import(certs, &certMax, &data, GNUTLS_X509_FMT_PEM, 0) < 0) {
        virReportError(VIR_ERR_SYSTEM_ERROR,
                       _("Unable to import CA certificate list %s"),
                       certFile);
        goto cleanup;
    }
    *ncerts = certMax;

    ret = 0;

578
 cleanup:
579 580 581 582 583 584
    VIR_FREE(buf);
    return ret;
}


#define MAX_CERTS 16
585 586 587 588 589
static int virNetTLSContextSanityCheckCredentials(bool isServer,
                                                  const char *cacertFile,
                                                  const char *certFile)
{
    gnutls_x509_crt_t cert = NULL;
590
    gnutls_x509_crt_t cacerts[MAX_CERTS];
591
    size_t ncacerts = 0;
592
    size_t i;
593 594
    int ret = -1;

595
    memset(cacerts, 0, sizeof(cacerts));
596
    if ((access(certFile, R_OK) == 0) &&
597
        !(cert = virNetTLSContextLoadCertFromFile(certFile, isServer)))
598 599
        goto cleanup;
    if ((access(cacertFile, R_OK) == 0) &&
600 601
        virNetTLSContextLoadCACertListFromFile(cacertFile, cacerts,
                                               MAX_CERTS, &ncacerts) < 0)
602
        goto cleanup;
603

604 605 606
    if (cert &&
        virNetTLSContextCheckCert(cert, certFile, isServer, false) < 0)
        goto cleanup;
607

608 609 610 611
    for (i = 0; i < ncacerts; i++) {
        if (virNetTLSContextCheckCert(cacerts[i], cacertFile, isServer, true) < 0)
            goto cleanup;
    }
612

613 614
    if (cert && ncacerts &&
        virNetTLSContextCheckCertPair(cert, certFile, cacerts, ncacerts, cacertFile, isServer) < 0)
615
        goto cleanup;
616 617 618

    ret = 0;

619
 cleanup:
620 621
    if (cert)
        gnutls_x509_crt_deinit(cert);
622 623
    for (i = 0; i < ncacerts; i++)
        gnutls_x509_crt_deinit(cacerts[i]);
624 625 626 627
    return ret;
}


628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646
static int virNetTLSContextLoadCredentials(virNetTLSContextPtr ctxt,
                                           bool isServer,
                                           const char *cacert,
                                           const char *cacrl,
                                           const char *cert,
                                           const char *key)
{
    int ret = -1;
    int err;

    if (cacert && cacert[0] != '\0') {
        if (virNetTLSContextCheckCertFile("CA certificate", cacert, false) < 0)
            goto cleanup;

        VIR_DEBUG("loading CA cert from %s", cacert);
        err = gnutls_certificate_set_x509_trust_file(ctxt->x509cred,
                                                     cacert,
                                                     GNUTLS_X509_FMT_PEM);
        if (err < 0) {
647 648
            virReportError(VIR_ERR_SYSTEM_ERROR,
                           _("Unable to set x509 CA certificate: %s: %s"),
649
                           cacert, gnutls_strerror(err));
650 651 652 653 654 655 656 657 658 659 660 661 662 663 664
            goto cleanup;
        }
    }

    if (cacrl && cacrl[0] != '\0') {
        int rv;
        if ((rv = virNetTLSContextCheckCertFile("CA revocation list", cacrl, true)) < 0)
            goto cleanup;

        if (rv == 0) {
            VIR_DEBUG("loading CRL from %s", cacrl);
            err = gnutls_certificate_set_x509_crl_file(ctxt->x509cred,
                                                       cacrl,
                                                       GNUTLS_X509_FMT_PEM);
            if (err < 0) {
665 666 667
                virReportError(VIR_ERR_SYSTEM_ERROR,
                               _("Unable to set x509 certificate revocation list: %s: %s"),
                               cacrl, gnutls_strerror(err));
668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689
                goto cleanup;
            }
        } else {
            VIR_DEBUG("Skipping non-existent CA CRL %s", cacrl);
        }
    }

    if (cert && cert[0] != '\0' && key && key[0] != '\0') {
        int rv;
        if ((rv = virNetTLSContextCheckCertFile("certificate", cert, !isServer)) < 0)
            goto cleanup;
        if (rv == 0 &&
            (rv = virNetTLSContextCheckCertFile("private key", key, !isServer)) < 0)
            goto cleanup;

        if (rv == 0) {
            VIR_DEBUG("loading cert and key from %s and %s", cert, key);
            err =
                gnutls_certificate_set_x509_key_file(ctxt->x509cred,
                                                     cert, key,
                                                     GNUTLS_X509_FMT_PEM);
            if (err < 0) {
690 691 692
                virReportError(VIR_ERR_SYSTEM_ERROR,
                               _("Unable to set x509 key and certificate: %s, %s: %s"),
                               key, cert, gnutls_strerror(err));
693 694 695
                goto cleanup;
            }
        } else {
N
Nehal J Wani 已提交
696 697
            VIR_DEBUG("Skipping non-existent cert %s key %s on client",
                      cert, key);
698 699 700 701 702
        }
    }

    ret = 0;

703
 cleanup:
704 705 706 707 708 709 710 711 712
    return ret;
}


static virNetTLSContextPtr virNetTLSContextNew(const char *cacert,
                                               const char *cacrl,
                                               const char *cert,
                                               const char *key,
                                               const char *const*x509dnWhitelist,
713
                                               bool sanityCheckCert,
714 715 716 717
                                               bool requireValidCert,
                                               bool isServer)
{
    virNetTLSContextPtr ctxt;
718
    const char *gnutlsdebug;
719 720
    int err;

721 722 723
    if (virNetTLSContextInitialize() < 0)
        return NULL;

724
    if (!(ctxt = virObjectLockableNew(virNetTLSContextClass)))
725 726
        return NULL;

727
    if ((gnutlsdebug = virGetEnvAllowSUID("LIBVIRT_GNUTLS_DEBUG")) != NULL) {
728 729 730 731 732 733 734 735 736 737 738
        int val;
        if (virStrToLong_i(gnutlsdebug, NULL, 10, &val) < 0)
            val = 10;
        gnutls_global_set_log_level(val);
        gnutls_global_set_log_function(virNetTLSLog);
        VIR_DEBUG("Enabled GNUTLS debug");
    }


    err = gnutls_certificate_allocate_credentials(&ctxt->x509cred);
    if (err) {
739 740 741
        virReportError(VIR_ERR_SYSTEM_ERROR,
                       _("Unable to allocate x509 credentials: %s"),
                       gnutls_strerror(err));
742 743 744
        goto error;
    }

745
    if (sanityCheckCert &&
746 747 748
        virNetTLSContextSanityCheckCredentials(isServer, cacert, cert) < 0)
        goto error;

749 750 751 752 753 754 755 756 757 758 759
    if (virNetTLSContextLoadCredentials(ctxt, isServer, cacert, cacrl, cert, key) < 0)
        goto error;

    /* Generate Diffie Hellman parameters - for use with DHE
     * kx algorithms. These should be discarded and regenerated
     * once a day, once a week or once a month. Depending on the
     * security requirements.
     */
    if (isServer) {
        err = gnutls_dh_params_init(&ctxt->dhParams);
        if (err < 0) {
760 761 762
            virReportError(VIR_ERR_SYSTEM_ERROR,
                           _("Unable to initialize diffie-hellman parameters: %s"),
                           gnutls_strerror(err));
763 764 765 766
            goto error;
        }
        err = gnutls_dh_params_generate2(ctxt->dhParams, DH_BITS);
        if (err < 0) {
767 768 769
            virReportError(VIR_ERR_SYSTEM_ERROR,
                           _("Unable to generate diffie-hellman parameters: %s"),
                           gnutls_strerror(err));
770 771 772 773 774 775 776 777 778 779 780
            goto error;
        }

        gnutls_certificate_set_dh_params(ctxt->x509cred,
                                         ctxt->dhParams);
    }

    ctxt->requireValidCert = requireValidCert;
    ctxt->x509dnWhitelist = x509dnWhitelist;
    ctxt->isServer = isServer;

781
    PROBE(RPC_TLS_CONTEXT_NEW,
782 783
          "ctxt=%p cacert=%s cacrl=%s cert=%s key=%s sanityCheckCert=%d requireValidCert=%d isServer=%d",
          ctxt, cacert, NULLSTR(cacrl), cert, key, sanityCheckCert, requireValidCert, isServer);
784

785 786
    return ctxt;

787
 error:
788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821
    if (isServer)
        gnutls_dh_params_deinit(ctxt->dhParams);
    gnutls_certificate_free_credentials(ctxt->x509cred);
    VIR_FREE(ctxt);
    return NULL;
}


static int virNetTLSContextLocateCredentials(const char *pkipath,
                                             bool tryUserPkiPath,
                                             bool isServer,
                                             char **cacert,
                                             char **cacrl,
                                             char **cert,
                                             char **key)
{
    char *userdir = NULL;
    char *user_pki_path = NULL;

    *cacert = NULL;
    *cacrl = NULL;
    *key = NULL;
    *cert = NULL;

    VIR_DEBUG("pkipath=%s isServer=%d tryUserPkiPath=%d",
              pkipath, isServer, tryUserPkiPath);

    /* Explicit path, then use that no matter whether the
     * files actually exist there
     */
    if (pkipath) {
        VIR_DEBUG("Told to use TLS credentials in %s", pkipath);
        if ((virAsprintf(cacert, "%s/%s", pkipath,
                         "cacert.pem")) < 0)
822
            goto error;
823 824
        if ((virAsprintf(cacrl, "%s/%s", pkipath,
                         "cacrl.pem")) < 0)
825
            goto error;
826 827
        if ((virAsprintf(key, "%s/%s", pkipath,
                         isServer ? "serverkey.pem" : "clientkey.pem")) < 0)
828
            goto error;
829 830 831

        if ((virAsprintf(cert, "%s/%s", pkipath,
                         isServer ? "servercert.pem" : "clientcert.pem")) < 0)
832
             goto error;
833 834 835 836
    } else if (tryUserPkiPath) {
        /* Check to see if $HOME/.pki contains at least one of the
         * files and if so, use that
         */
837
        userdir = virGetUserDirectory();
838 839

        if (!userdir)
840
            goto error;
841 842

        if (virAsprintf(&user_pki_path, "%s/.pki/libvirt", userdir) < 0)
843
            goto error;
844 845 846 847 848

        VIR_DEBUG("Trying to find TLS user credentials in %s", user_pki_path);

        if ((virAsprintf(cacert, "%s/%s", user_pki_path,
                         "cacert.pem")) < 0)
849
            goto error;
850 851 852

        if ((virAsprintf(cacrl, "%s/%s", user_pki_path,
                         "cacrl.pem")) < 0)
853
            goto error;
854 855 856

        if ((virAsprintf(key, "%s/%s", user_pki_path,
                         isServer ? "serverkey.pem" : "clientkey.pem")) < 0)
857
            goto error;
858 859 860

        if ((virAsprintf(cert, "%s/%s", user_pki_path,
                         isServer ? "servercert.pem" : "clientcert.pem")) < 0)
861
            goto error;
862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885

        /*
         * If some of the files can't be found, fallback
         * to the global location for them
         */
        if (!virFileExists(*cacert))
            VIR_FREE(*cacert);
        if (!virFileExists(*cacrl))
            VIR_FREE(*cacrl);

        /* Check these as a pair, since it they are
         * mutually dependent
         */
        if (!virFileExists(*key) || !virFileExists(*cert)) {
            VIR_FREE(*key);
            VIR_FREE(*cert);
        }
    }

    /* No explicit path, or user path didn't exist, so
     * fallback to global defaults
     */
    if (!*cacert) {
        VIR_DEBUG("Using default TLS CA certificate path");
886 887
        if (VIR_STRDUP(*cacert, LIBVIRT_CACERT) < 0)
            goto error;
888 889 890 891
    }

    if (!*cacrl) {
        VIR_DEBUG("Using default TLS CA revocation list path");
892 893
        if (VIR_STRDUP(*cacrl, LIBVIRT_CACRL) < 0)
            goto error;
894 895 896 897
    }

    if (!*key && !*cert) {
        VIR_DEBUG("Using default TLS key/certificate path");
898 899
        if (VIR_STRDUP(*key, isServer ? LIBVIRT_SERVERKEY : LIBVIRT_CLIENTKEY) < 0)
            goto error;
900

901 902
        if (VIR_STRDUP(*cert, isServer ? LIBVIRT_SERVERCERT : LIBVIRT_CLIENTCERT) < 0)
            goto error;
903 904 905 906 907 908 909
    }

    VIR_FREE(user_pki_path);
    VIR_FREE(userdir);

    return 0;

910
 error:
911 912 913 914 915 916 917 918 919 920 921 922 923
    VIR_FREE(*cacert);
    VIR_FREE(*cacrl);
    VIR_FREE(*key);
    VIR_FREE(*cert);
    VIR_FREE(user_pki_path);
    VIR_FREE(userdir);
    return -1;
}


static virNetTLSContextPtr virNetTLSContextNewPath(const char *pkipath,
                                                   bool tryUserPkiPath,
                                                   const char *const*x509dnWhitelist,
924
                                                   bool sanityCheckCert,
925 926 927 928 929 930 931
                                                   bool requireValidCert,
                                                   bool isServer)
{
    char *cacert = NULL, *cacrl = NULL, *key = NULL, *cert = NULL;
    virNetTLSContextPtr ctxt = NULL;

    if (virNetTLSContextLocateCredentials(pkipath, tryUserPkiPath, isServer,
932
                                          &cacert, &cacrl, &cert, &key) < 0)
933 934
        return NULL;

935
    ctxt = virNetTLSContextNew(cacert, cacrl, cert, key,
936 937
                               x509dnWhitelist, sanityCheckCert,
                               requireValidCert, isServer);
938 939 940 941 942 943 944 945 946 947 948 949

    VIR_FREE(cacert);
    VIR_FREE(cacrl);
    VIR_FREE(key);
    VIR_FREE(cert);

    return ctxt;
}

virNetTLSContextPtr virNetTLSContextNewServerPath(const char *pkipath,
                                                  bool tryUserPkiPath,
                                                  const char *const*x509dnWhitelist,
950
                                                  bool sanityCheckCert,
951 952
                                                  bool requireValidCert)
{
953 954
    return virNetTLSContextNewPath(pkipath, tryUserPkiPath, x509dnWhitelist,
                                   sanityCheckCert, requireValidCert, true);
955 956 957 958
}

virNetTLSContextPtr virNetTLSContextNewClientPath(const char *pkipath,
                                                  bool tryUserPkiPath,
959
                                                  bool sanityCheckCert,
960 961
                                                  bool requireValidCert)
{
962 963
    return virNetTLSContextNewPath(pkipath, tryUserPkiPath, NULL,
                                   sanityCheckCert, requireValidCert, false);
964 965 966 967 968 969 970 971
}


virNetTLSContextPtr virNetTLSContextNewServer(const char *cacert,
                                              const char *cacrl,
                                              const char *cert,
                                              const char *key,
                                              const char *const*x509dnWhitelist,
972
                                              bool sanityCheckCert,
973 974
                                              bool requireValidCert)
{
975 976
    return virNetTLSContextNew(cacert, cacrl, cert, key, x509dnWhitelist,
                               sanityCheckCert, requireValidCert, true);
977 978 979 980 981 982 983
}


virNetTLSContextPtr virNetTLSContextNewClient(const char *cacert,
                                              const char *cacrl,
                                              const char *cert,
                                              const char *key,
984
                                              bool sanityCheckCert,
985 986
                                              bool requireValidCert)
{
987 988
    return virNetTLSContextNew(cacert, cacrl, cert, key, NULL,
                               sanityCheckCert, requireValidCert, false);
989 990 991 992 993 994 995 996 997
}


static int virNetTLSContextValidCertificate(virNetTLSContextPtr ctxt,
                                            virNetTLSSessionPtr sess)
{
    int ret;
    unsigned int status;
    const gnutls_datum_t *certs;
998 999
    unsigned int nCerts;
    size_t i;
1000
    char dname[256];
1001
    char *dnameptr = dname;
1002 1003 1004
    size_t dnamesize = sizeof(dname);

    memset(dname, 0, dnamesize);
1005

1006
    if ((ret = gnutls_certificate_verify_peers2(sess->session, &status)) < 0) {
1007 1008 1009
        virReportError(VIR_ERR_SYSTEM_ERROR,
                       _("Unable to verify TLS peer: %s"),
                       gnutls_strerror(ret));
1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029
        goto authdeny;
    }

    if (status != 0) {
        const char *reason = _("Invalid certificate");

        if (status & GNUTLS_CERT_INVALID)
            reason = _("The certificate is not trusted.");

        if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)
            reason = _("The certificate hasn't got a known issuer.");

        if (status & GNUTLS_CERT_REVOKED)
            reason = _("The certificate has been revoked.");

#ifndef GNUTLS_1_0_COMPAT
        if (status & GNUTLS_CERT_INSECURE_ALGORITHM)
            reason = _("The certificate uses an insecure algorithm");
#endif

1030 1031 1032
        virReportError(VIR_ERR_SYSTEM_ERROR,
                       _("Certificate failed validation: %s"),
                       reason);
1033 1034 1035 1036
        goto authdeny;
    }

    if (gnutls_certificate_type_get(sess->session) != GNUTLS_CRT_X509) {
1037 1038
        virReportError(VIR_ERR_SYSTEM_ERROR, "%s",
                       _("Only x509 certificates are supported"));
1039 1040 1041 1042
        goto authdeny;
    }

    if (!(certs = gnutls_certificate_get_peers(sess->session, &nCerts))) {
1043 1044
        virReportError(VIR_ERR_SYSTEM_ERROR, "%s",
                       _("The certificate has no peers"));
1045 1046 1047 1048 1049 1050 1051
        goto authdeny;
    }

    for (i = 0; i < nCerts; i++) {
        gnutls_x509_crt_t cert;

        if (gnutls_x509_crt_init(&cert) < 0) {
1052 1053
            virReportError(VIR_ERR_SYSTEM_ERROR, "%s",
                           _("Unable to initialize certificate"));
1054 1055 1056 1057
            goto authfail;
        }

        if (gnutls_x509_crt_import(cert, &certs[i], GNUTLS_X509_FMT_DER) < 0) {
1058 1059
            virReportError(VIR_ERR_SYSTEM_ERROR, "%s",
                           _("Unable to load certificate"));
1060 1061 1062 1063
            gnutls_x509_crt_deinit(cert);
            goto authfail;
        }

1064 1065
        if (virNetTLSContextCheckCertTimes(cert, "[session]",
                                           sess->isServer, i > 0) < 0) {
1066 1067 1068 1069 1070
            gnutls_x509_crt_deinit(cert);
            goto authdeny;
        }

        if (i == 0) {
1071 1072
            ret = gnutls_x509_crt_get_dn(cert, dname, &dnamesize);
            if (ret != 0) {
1073 1074 1075
                virReportError(VIR_ERR_SYSTEM_ERROR,
                               _("Failed to get certificate %s distinguished name: %s"),
                               "[session]", gnutls_strerror(ret));
1076 1077
                goto authfail;
            }
1078
            if (VIR_STRDUP(sess->x509dname, dname) < 0)
1079
                goto authfail;
1080 1081 1082
            VIR_DEBUG("Peer DN is %s", dname);

            if (virNetTLSContextCheckCertDN(cert, "[session]", sess->hostname, dname,
1083
                                            ctxt->x509dnWhitelist) < 0) {
1084
                gnutls_x509_crt_deinit(cert);
1085 1086 1087 1088 1089 1090
                goto authdeny;
            }

            /* !sess->isServer, since on the client, we're validating the
             * server's cert, and on the server, the client's cert
             */
1091
#ifndef GNUTLS_1_0_COMPAT
1092 1093 1094 1095
            if (virNetTLSContextCheckCertBasicConstraints(cert, "[session]",
                                                          !sess->isServer, false) < 0) {
                gnutls_x509_crt_deinit(cert);
                goto authdeny;
1096
            }
1097
#endif
1098

1099 1100
            if (virNetTLSContextCheckCertKeyUsage(cert, "[session]",
                                                  false) < 0) {
1101 1102 1103 1104
                gnutls_x509_crt_deinit(cert);
                goto authdeny;
            }

1105 1106 1107
            /* !sess->isServer - as above */
            if (virNetTLSContextCheckCertKeyPurpose(cert, "[session]",
                                                    !sess->isServer) < 0) {
1108 1109 1110 1111
                gnutls_x509_crt_deinit(cert);
                goto authdeny;
            }
        }
1112
        gnutls_x509_crt_deinit(cert);
1113 1114
    }

1115 1116
    PROBE(RPC_TLS_CONTEXT_SESSION_ALLOW,
          "ctxt=%p sess=%p dname=%s",
1117
          ctxt, sess, dnameptr);
1118

1119 1120
    return 0;

1121
 authdeny:
1122 1123
    PROBE(RPC_TLS_CONTEXT_SESSION_DENY,
          "ctxt=%p sess=%p dname=%s",
1124
          ctxt, sess, dnameptr);
1125

1126 1127
    return -1;

1128
 authfail:
1129 1130 1131 1132
    PROBE(RPC_TLS_CONTEXT_SESSION_FAIL,
          "ctxt=%p sess=%p",
          ctxt, sess);

1133 1134 1135 1136 1137 1138
    return -1;
}

int virNetTLSContextCheckCertificate(virNetTLSContextPtr ctxt,
                                     virNetTLSSessionPtr sess)
{
1139 1140
    int ret = -1;

1141 1142
    virObjectLock(ctxt);
    virObjectLock(sess);
1143
    if (virNetTLSContextValidCertificate(ctxt, sess) < 0) {
1144
        VIR_WARN("Certificate check failed %s", virGetLastErrorMessage());
1145
        if (ctxt->requireValidCert) {
1146 1147
            virReportError(VIR_ERR_AUTH_FAILED, "%s",
                           _("Failed to verify peer's certificate"));
1148
            goto cleanup;
1149
        }
1150
        virResetLastError();
1151 1152
        VIR_INFO("Ignoring bad certificate at user request");
    }
1153 1154 1155

    ret = 0;

1156
 cleanup:
1157 1158
    virObjectUnlock(ctxt);
    virObjectUnlock(sess);
1159 1160

    return ret;
1161 1162
}

1163
void virNetTLSContextDispose(void *obj)
1164
{
1165
    virNetTLSContextPtr ctxt = obj;
1166

1167 1168 1169
    PROBE(RPC_TLS_CONTEXT_DISPOSE,
          "ctxt=%p", ctxt);

1170 1171 1172 1173 1174 1175 1176 1177 1178 1179
    gnutls_dh_params_deinit(ctxt->dhParams);
    gnutls_certificate_free_credentials(ctxt->x509cred);
}


static ssize_t
virNetTLSSessionPush(void *opaque, const void *buf, size_t len)
{
    virNetTLSSessionPtr sess = opaque;
    if (!sess->writeFunc) {
1180
        VIR_WARN("TLS session push with missing write function");
1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208
        errno = EIO;
        return -1;
    };

    return sess->writeFunc(buf, len, sess->opaque);
}


static ssize_t
virNetTLSSessionPull(void *opaque, void *buf, size_t len)
{
    virNetTLSSessionPtr sess = opaque;
    if (!sess->readFunc) {
        VIR_WARN("TLS session pull with missing read function");
        errno = EIO;
        return -1;
    };

    return sess->readFunc(buf, len, sess->opaque);
}


virNetTLSSessionPtr virNetTLSSessionNew(virNetTLSContextPtr ctxt,
                                        const char *hostname)
{
    virNetTLSSessionPtr sess;
    int err;

E
Eric Blake 已提交
1209 1210
    VIR_DEBUG("ctxt=%p hostname=%s isServer=%d",
              ctxt, NULLSTR(hostname), ctxt->isServer);
1211

1212
    if (!(sess = virObjectLockableNew(virNetTLSSessionClass)))
1213 1214
        return NULL;

1215
    if (VIR_STRDUP(sess->hostname, hostname) < 0)
1216 1217 1218 1219
        goto error;

    if ((err = gnutls_init(&sess->session,
                           ctxt->isServer ? GNUTLS_SERVER : GNUTLS_CLIENT)) != 0) {
1220 1221 1222
        virReportError(VIR_ERR_SYSTEM_ERROR,
                       _("Failed to initialize TLS session: %s"),
                       gnutls_strerror(err));
1223 1224 1225 1226 1227 1228
        goto error;
    }

    /* avoid calling all the priority functions, since the defaults
     * are adequate.
     */
1229
    if ((err = gnutls_set_default_priority(sess->session)) != 0) {
1230 1231 1232
        virReportError(VIR_ERR_SYSTEM_ERROR,
                       _("Failed to set TLS session priority %s"),
                       gnutls_strerror(err));
1233 1234 1235 1236 1237 1238
        goto error;
    }

    if ((err = gnutls_credentials_set(sess->session,
                                      GNUTLS_CRD_CERTIFICATE,
                                      ctxt->x509cred)) != 0) {
1239 1240 1241
        virReportError(VIR_ERR_SYSTEM_ERROR,
                       _("Failed set TLS x509 credentials: %s"),
                       gnutls_strerror(err));
1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258
        goto error;
    }

    /* request client certificate if any.
     */
    if (ctxt->isServer) {
        gnutls_certificate_server_set_request(sess->session, GNUTLS_CERT_REQUEST);

        gnutls_dh_set_prime_bits(sess->session, DH_BITS);
    }

    gnutls_transport_set_ptr(sess->session, sess);
    gnutls_transport_set_push_function(sess->session,
                                       virNetTLSSessionPush);
    gnutls_transport_set_pull_function(sess->session,
                                       virNetTLSSessionPull);

1259 1260
    sess->isServer = ctxt->isServer;

1261
    PROBE(RPC_TLS_SESSION_NEW,
1262 1263
          "sess=%p ctxt=%p hostname=%s isServer=%d",
          sess, ctxt, hostname, sess->isServer);
1264

1265 1266
    return sess;

1267
 error:
1268
    virObjectUnref(sess);
1269 1270 1271 1272 1273 1274 1275 1276 1277
    return NULL;
}


void virNetTLSSessionSetIOCallbacks(virNetTLSSessionPtr sess,
                                    virNetTLSSessionWriteFunc writeFunc,
                                    virNetTLSSessionReadFunc readFunc,
                                    void *opaque)
{
1278
    virObjectLock(sess);
1279 1280 1281
    sess->writeFunc = writeFunc;
    sess->readFunc = readFunc;
    sess->opaque = opaque;
1282
    virObjectUnlock(sess);
1283 1284 1285 1286 1287 1288 1289
}


ssize_t virNetTLSSessionWrite(virNetTLSSessionPtr sess,
                              const char *buf, size_t len)
{
    ssize_t ret;
1290

1291
    virObjectLock(sess);
1292 1293 1294
    ret = gnutls_record_send(sess->session, buf, len);

    if (ret >= 0)
1295
        goto cleanup;
1296 1297 1298 1299 1300 1301 1302 1303

    switch (ret) {
    case GNUTLS_E_AGAIN:
        errno = EAGAIN;
        break;
    case GNUTLS_E_INTERRUPTED:
        errno = EINTR;
        break;
1304 1305 1306
    case GNUTLS_E_UNEXPECTED_PACKET_LENGTH:
        errno = ENOMSG;
        break;
1307 1308 1309 1310 1311
    default:
        errno = EIO;
        break;
    }

1312 1313
    ret = -1;

1314
 cleanup:
1315
    virObjectUnlock(sess);
1316
    return ret;
1317 1318 1319 1320 1321 1322 1323
}

ssize_t virNetTLSSessionRead(virNetTLSSessionPtr sess,
                             char *buf, size_t len)
{
    ssize_t ret;

1324
    virObjectLock(sess);
1325 1326 1327
    ret = gnutls_record_recv(sess->session, buf, len);

    if (ret >= 0)
1328
        goto cleanup;
1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341

    switch (ret) {
    case GNUTLS_E_AGAIN:
        errno = EAGAIN;
        break;
    case GNUTLS_E_INTERRUPTED:
        errno = EINTR;
        break;
    default:
        errno = EIO;
        break;
    }

1342 1343
    ret = -1;

1344
 cleanup:
1345
    virObjectUnlock(sess);
1346
    return ret;
1347 1348 1349 1350
}

int virNetTLSSessionHandshake(virNetTLSSessionPtr sess)
{
1351
    int ret;
1352
    VIR_DEBUG("sess=%p", sess);
1353
    virObjectLock(sess);
1354
    ret = gnutls_handshake(sess->session);
1355 1356 1357 1358
    VIR_DEBUG("Ret=%d", ret);
    if (ret == 0) {
        sess->handshakeComplete = true;
        VIR_DEBUG("Handshake is complete");
1359 1360 1361 1362 1363
        goto cleanup;
    }
    if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
        ret = 1;
        goto cleanup;
1364 1365 1366 1367 1368 1369 1370
    }

#if 0
    PROBE(CLIENT_TLS_FAIL, "fd=%d",
          virNetServerClientGetFD(client));
#endif

1371 1372 1373
    virReportError(VIR_ERR_AUTH_FAILED,
                   _("TLS handshake failed %s"),
                   gnutls_strerror(ret));
1374 1375
    ret = -1;

1376
 cleanup:
1377
    virObjectUnlock(sess);
1378
    return ret;
1379 1380 1381 1382 1383
}

virNetTLSSessionHandshakeStatus
virNetTLSSessionGetHandshakeStatus(virNetTLSSessionPtr sess)
{
1384
    virNetTLSSessionHandshakeStatus ret;
1385
    virObjectLock(sess);
1386
    if (sess->handshakeComplete)
1387
        ret = VIR_NET_TLS_HANDSHAKE_COMPLETE;
1388
    else if (gnutls_record_get_direction(sess->session) == 0)
1389
        ret = VIR_NET_TLS_HANDSHAKE_RECVING;
1390
    else
1391
        ret = VIR_NET_TLS_HANDSHAKE_SENDING;
1392
    virObjectUnlock(sess);
1393
    return ret;
1394 1395 1396 1397 1398 1399
}

int virNetTLSSessionGetKeySize(virNetTLSSessionPtr sess)
{
    gnutls_cipher_algorithm_t cipher;
    int ssf;
1400
    virObjectLock(sess);
1401 1402
    cipher = gnutls_cipher_get(sess->session);
    if (!(ssf = gnutls_cipher_get_key_size(cipher))) {
1403 1404
        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
                       _("invalid cipher size for TLS session"));
1405 1406
        ssf = -1;
        goto cleanup;
1407 1408
    }

1409
 cleanup:
1410
    virObjectUnlock(sess);
1411 1412 1413
    return ssf;
}

1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425
const char *virNetTLSSessionGetX509DName(virNetTLSSessionPtr sess)
{
    const char *ret = NULL;

    virObjectLock(sess);

    ret = sess->x509dname;

    virObjectUnlock(sess);

    return ret;
}
1426

1427
void virNetTLSSessionDispose(void *obj)
1428
{
1429
    virNetTLSSessionPtr sess = obj;
1430

1431 1432 1433
    PROBE(RPC_TLS_SESSION_DISPOSE,
          "sess=%p", sess);

1434
    VIR_FREE(sess->x509dname);
1435 1436 1437
    VIR_FREE(sess->hostname);
    gnutls_deinit(sess->session);
}
M
Michal Privoznik 已提交
1438 1439 1440 1441 1442 1443

/*
 * This function MUST be called before any
 * virNetTLS* because it initializes
 * underlying GnuTLS library. According to
 * it's documentation, it's safe to be called
1444 1445 1446 1447 1448 1449 1450
 * many times, but is not thread safe.
 *
 * There is no corresponding "Deinit" / "Cleanup"
 * function because there is no safe way to call
 * 'gnutls_global_deinit' from a multi-threaded
 * library, where other libraries linked into the
 * application may also be using gnutls.
M
Michal Privoznik 已提交
1451 1452 1453 1454 1455
 */
void virNetTLSInit(void)
{
    gnutls_global_init();
}