This small patch series is a formal submission of another part of my previous series
v1: https://lists.gnu.org/archive/html/qemu-devel/2015-04/msg02038.html v2: https://lists.gnu.org/archive/html/qemu-devel/2015-08/msg01267.html v3: https://lists.gnu.org/archive/html/qemu-devel/2015-08/msg01386.html v4: https://lists.gnu.org/archive/html/qemu-devel/2015-08/msg02655.html Now we have the basic crypto module defined for hash/cipher APIs, we extend it to also cover TLS credential and TLS session handling APIs. These new TLS related APIs obsolete the vast majority of the TLS handling code in the current VNC server. As a result the VNC server no longer has to worry about conditional compilation for GNUTLS. It also gives us code reuse for future patches which intend to add TLS support to chardevs, migration, nbd, etc. This series deprecates the existing way of configuring TLS for VNC on the command line, but maintains support for back-compat reasons. Since the TLS code is now totally isolated from the VNC server it is also practical to provide significant unit test coverage of what is security critical code. Aside from the new CLI syntax for configuring TLS with VNC, the only other functional change is to allow diffie-hellman params to be loaded from a file, instead of being generated at startup. Changes in v5: - Introduce use of -Wl,--whole-archive with libqemuutil.a to ensure QOM objects are not discarded by linker - Remove nasty back dummy functions used to prevent QOM object discard by linker - Extend QAPI enum generator to allow enum name prefix spec to override heuristics - Switch to use QAPI to generate QCryptoTLSCredsEndpoint enum definition - Fix misc bugs in error message strings - Use alternate definition for DPRINTF Changes in v4: - Fix build when GNUTLS is disabled - Add missed return type conversion in vnc.h Changes in v3: - Switched "tls-creds" object to be just an abstract base class - Created "tls-creds-anon" object subclass in new file - Created "tls-creds-x509" object subclass in new file Daniel P. Berrange (9): qapi: allow override of default enum prefix naming make: ensure all members of libqemuutil.a are linked crypto: introduce new base module for TLS credentials crypto: introduce new module for TLS anonymous credentials crypto: introduce new module for TLS x509 credentials crypto: add sanity checking of TLS x509 credentials crypto: introduce new module for handling TLS sessions ui: fix return type for VNC I/O functions to be ssize_t ui: convert VNC server to use QCryptoTLSSession Makefile.target | 7 +- configure | 53 +- crypto/Makefile.objs | 4 + crypto/tlscreds.c | 262 +++++++++ crypto/tlscredsanon.c | 236 ++++++++ crypto/tlscredspriv.h | 41 ++ crypto/tlscredsx509.c | 820 ++++++++++++++++++++++++++++ crypto/tlssession.c | 583 ++++++++++++++++++++ include/crypto/tlscreds.h | 68 +++ include/crypto/tlscredsanon.h | 112 ++++ include/crypto/tlscredsx509.h | 113 ++++ include/crypto/tlssession.h | 322 +++++++++++ qapi-schema.json | 3 + qapi/crypto.json | 20 + qemu-options.hx | 75 ++- scripts/qapi-types.py | 14 +- scripts/qapi.py | 9 +- tests/.gitignore | 7 + tests/Makefile | 14 +- tests/crypto-tls-x509-helpers.c | 486 +++++++++++++++++ tests/crypto-tls-x509-helpers.h | 133 +++++ tests/pkix_asn1_tab.c | 1103 ++++++++++++++++++++++++++++++++++++++ tests/test-crypto-tlscredsx509.c | 734 +++++++++++++++++++++++++ tests/test-crypto-tlssession.c | 534 ++++++++++++++++++ ui/Makefile.objs | 2 +- ui/vnc-auth-sasl.c | 36 +- ui/vnc-auth-vencrypt.c | 80 +-- ui/vnc-tls.c | 474 ---------------- ui/vnc-tls.h | 69 --- ui/vnc-ws.c | 82 +-- ui/vnc-ws.h | 2 - ui/vnc.c | 360 ++++++++----- ui/vnc.h | 21 +- 33 files changed, 6053 insertions(+), 826 deletions(-) create mode 100644 crypto/tlscreds.c create mode 100644 crypto/tlscredsanon.c create mode 100644 crypto/tlscredspriv.h create mode 100644 crypto/tlscredsx509.c create mode 100644 crypto/tlssession.c create mode 100644 include/crypto/tlscreds.h create mode 100644 include/crypto/tlscredsanon.h create mode 100644 include/crypto/tlscredsx509.h create mode 100644 include/crypto/tlssession.h create mode 100644 qapi/crypto.json create mode 100644 tests/crypto-tls-x509-helpers.c create mode 100644 tests/crypto-tls-x509-helpers.h create mode 100644 tests/pkix_asn1_tab.c create mode 100644 tests/test-crypto-tlscredsx509.c create mode 100644 tests/test-crypto-tlssession.c delete mode 100644 ui/vnc-tls.c delete mode 100644 ui/vnc-tls.h -- 2.4.3
