This small patch series is a formal submission of another part of my previous series
v1: https://lists.gnu.org/archive/html/qemu-devel/2015-04/msg02038.html v2: https://lists.gnu.org/archive/html/qemu-devel/2015-08/msg01267.html Now we have the basic crypto module defined for hash/cipher APIs, we extend it to also cover TLS credential and TLS session handling APIs. These new TLS related APIs obsolete the vast majority of the TLS handling code in the current VNC server. As a result the VNC server no longer has to worry about conditional compilation for GNUTLS. It also gives us code reuse for future patches which intend to add TLS support to chardevs, migration, nbd, etc. This series deprecates the existing way of configuring TLS for VNC on the command line, but maintains support for back-compat reasons. Since the nice is now totally isolated from the VNC server it is also practical to provide significant unit test coverage of what is security critical code. Aside from the new CLI syntax for configuring TLS with VNC, the only other functional change is to allow diffie-hellman params to be loaded from a file, instead of being generated at startup. Changes in v3: - Switched "tls-creds" object to be just an abstract base class - Created "tls-creds-anon" object subclass in new file - Created "tls-creds-x509" object subclass in new file Daniel P. Berrange (7): crypto: introduce new base module for TLS credentials crypto: introduce new module for TLS anonymous credentials crypto: introduce new module for TLS x509 credentials crypto: add sanity checking of TLS x509 credentials crypto: introduce new module for handling TLS sessions ui: fix return type for VNC I/O functions to be ssize_t ui: convert VNC server to use QCryptoTLSSession configure | 53 +- crypto/Makefile.objs | 4 + crypto/init.c | 10 + crypto/tlscreds.c | 264 +++++++++ crypto/tlscredsanon.c | 235 ++++++++ crypto/tlscredspriv.h | 41 ++ crypto/tlscredsx509.c | 821 ++++++++++++++++++++++++++++ crypto/tlssession.c | 578 ++++++++++++++++++++ include/crypto/tlscreds.h | 74 +++ include/crypto/tlscredsanon.h | 113 ++++ include/crypto/tlscredsx509.h | 115 ++++ include/crypto/tlssession.h | 322 +++++++++++ qemu-options.hx | 75 ++- tests/.gitignore | 7 + tests/Makefile | 14 +- tests/crypto-tls-x509-helpers.c | 486 +++++++++++++++++ tests/crypto-tls-x509-helpers.h | 133 +++++ tests/pkix_asn1_tab.c | 1103 ++++++++++++++++++++++++++++++++++++++ tests/test-crypto-tlscredsx509.c | 734 +++++++++++++++++++++++++ tests/test-crypto-tlssession.c | 534 ++++++++++++++++++ ui/Makefile.objs | 2 +- ui/vnc-auth-sasl.c | 36 +- ui/vnc-auth-vencrypt.c | 80 +-- ui/vnc-tls.c | 474 ---------------- ui/vnc-tls.h | 69 --- ui/vnc-ws.c | 82 +-- ui/vnc-ws.h | 2 - ui/vnc.c | 360 ++++++++----- ui/vnc.h | 17 +- 29 files changed, 6025 insertions(+), 813 deletions(-) create mode 100644 crypto/tlscreds.c create mode 100644 crypto/tlscredsanon.c create mode 100644 crypto/tlscredspriv.h create mode 100644 crypto/tlscredsx509.c create mode 100644 crypto/tlssession.c create mode 100644 include/crypto/tlscreds.h create mode 100644 include/crypto/tlscredsanon.h create mode 100644 include/crypto/tlscredsx509.h create mode 100644 include/crypto/tlssession.h create mode 100644 tests/crypto-tls-x509-helpers.c create mode 100644 tests/crypto-tls-x509-helpers.h create mode 100644 tests/pkix_asn1_tab.c create mode 100644 tests/test-crypto-tlscredsx509.c create mode 100644 tests/test-crypto-tlssession.c delete mode 100644 ui/vnc-tls.c delete mode 100644 ui/vnc-tls.h -- 2.4.3
