NuKVM/libvirt
3
0 Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2026-10-02 12:20:06 -05:00
Code Issues Packages Projects Releases Wiki Activity

rpc: add support for loading multiple certs & keys

Browse Source 
In the transition to Post-Quantum Cryptography, it will often be
desirable to load multiple sets of certificates, some with RSA/ECC
and some with MLDSA. This extends the TLS context code to support
the loading of many certs, passed as a NULL terminated array.

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrangé committed 2025-11-24 15:05:09 +00:00
1 parent 74a664edd7
commit d249170bf6
6 files changed
+58 -47
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/libvirt_probes.d
+2 -1
View File
@@ -54,7 +54,8 @@ provider libvirt {
# file: src/rpc/virnettlscontext.c
# prefix: rpc
probe rpc_tls_context_new(void *ctxt, const char *cacert, const char *cacrl,
const char *cert, const char *key, int sanityCheckCert, int requireValidCert, int isServer);
const char **cert, const char **keys,
int sanityCheckCert, int requireValidCert, int isServer);
probe rpc_tls_context_dispose(void *ctxt);
probe rpc_tls_context_session_allow(void *ctxt, void *sess, const char *dname);
probe rpc_tls_context_session_deny(void *ctxt, void *sess, const char *dname);
src/remote/remote_daemon.c
+4 -2
View File
@@ -327,6 +327,9 @@ daemonSetupNetworking(virNetServer *srv,
if (config->ca_file ||
config->cert_file ||
config->key_file) {
const char *certs[] = { config->cert_file, NULL };
const char *keys[] = { config->key_file, NULL };
if (!config->ca_file) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("No CA certificate path set to match server key/cert"));
@@ -346,8 +349,7 @@ daemonSetupNetworking(virNetServer *srv,
config->ca_file, config->cert_file, config->key_file);
if (!(ctxt = virNetTLSContextNewServer(config->ca_file,
config->crl_file,
config->cert_file,
config->key_file,
certs, keys,
(const char *const*)config->tls_allowed_dn_list,
config->tls_priority,
config->tls_no_sanity_certificate ? false : true,
src/rpc/virnettlscontext.c
+28 -23
View File
@@ -115,10 +115,11 @@ static int virNetTLSContextLoadCredentials(virNetTLSContext *ctxt,
bool isServer,
const char *cacert,
const char *cacrl,
const char *cert,
const char *key)
const char *const *certs,
const char *const *keys)
{
int err;
size_t i;
if (cacert && cacert[0] != '\0') {
if (virNetTLSContextCheckCertFile("CA certificate", cacert, false) < 0)
@@ -157,29 +158,29 @@ static int virNetTLSContextLoadCredentials(virNetTLSContext *ctxt,
}
}
if (cert && cert[0] != '\0' && key && key[0] != '\0') {
for (i = 0; certs[i] != NULL && keys[i] != NULL; i++) {
int rv;
if ((rv = virNetTLSContextCheckCertFile("certificate", cert, !isServer)) < 0)
if ((rv = virNetTLSContextCheckCertFile("certificate", certs[i], !isServer)) < 0)
return -1;
if (rv == 0 &&
(rv = virNetTLSContextCheckCertFile("private key", key, !isServer)) < 0)
(rv = virNetTLSContextCheckCertFile("private key", keys[i], !isServer)) < 0)
return -1;
if (rv == 0) {
VIR_DEBUG("loading cert and key from %s and %s", cert, key);
VIR_DEBUG("loading cert and key from %s and %s", certs[i], keys[i]);
err =
gnutls_certificate_set_x509_key_file(ctxt->x509cred,
cert, key,
certs[i], keys[i],
GNUTLS_X509_FMT_PEM);
if (err < 0) {
virReportError(VIR_ERR_SYSTEM_ERROR,
_("Unable to set x509 key and certificate: %1$s, %2$s: %3$s"),
key, cert, gnutls_strerror(err));
keys[i], certs[i], gnutls_strerror(err));
return -1;
}
} else {
VIR_DEBUG("Skipping non-existent cert %s key %s on client",
cert, key);
certs[i], keys[i]);
}
}
@@ -189,8 +190,8 @@ static int virNetTLSContextLoadCredentials(virNetTLSContext *ctxt,
static virNetTLSContext *virNetTLSContextNew(const char *cacert,
const char *cacrl,
const char *cert,
const char *key,
const char *const *certs,
const char *const *keys,
const char *const *x509dnACL,
const char *priority,
bool sanityCheckCert,
@@ -199,7 +200,6 @@ static virNetTLSContext *virNetTLSContextNew(const char *cacert,
{
virNetTLSContext *ctxt;
int err;
const char *certs[] = { cert, NULL };
if (virNetTLSContextInitialize() < 0)
return NULL;
@@ -228,7 +228,8 @@ static virNetTLSContext *virNetTLSContextNew(const char *cacert,
virNetTLSCertSanityCheck(isServer, cacert, certs) < 0)
goto error;
if (virNetTLSContextLoadCredentials(ctxt, isServer, cacert, cacrl, cert, key) < 0)
if (virNetTLSContextLoadCredentials(ctxt, isServer, cacert, cacrl,
certs, keys) < 0)
goto error;
ctxt->requireValidCert = requireValidCert;
@@ -236,8 +237,8 @@ static virNetTLSContext *virNetTLSContextNew(const char *cacert,
ctxt->isServer = isServer;
PROBE(RPC_TLS_CONTEXT_NEW,
"ctxt=%p cacert=%s cacrl=%s cert=%s key=%s sanityCheckCert=%d requireValidCert=%d isServer=%d",
ctxt, cacert, NULLSTR(cacrl), cert, key, sanityCheckCert, requireValidCert, isServer);
"ctxt=%p cacert=%s cacrl=%s cert=%p key=%p sanityCheckCert=%d requireValidCert=%d isServer=%d",
ctxt, cacert, NULLSTR(cacrl), certs, keys, sanityCheckCert, requireValidCert, isServer);
return ctxt;
@@ -313,12 +314,14 @@ static virNetTLSContext *virNetTLSContextNewPath(const char *pkipath,
g_autofree char *cacrl = NULL;
g_autofree char *key = NULL;
g_autofree char *cert = NULL;
const char *certs[] = { cert, NULL };
const char *keys[] = { key, NULL };
if (virNetTLSContextLocateCredentials(pkipath, tryUserPkiPath, isServer,
&cacert, &cacrl, &cert, &key) < 0)
return NULL;
return virNetTLSContextNew(cacert, cacrl, cert, key,
return virNetTLSContextNew(cacert, cacrl, certs, keys,
x509dnACL, priority, sanityCheckCert,
requireValidCert, isServer);
}
@@ -347,14 +350,14 @@ virNetTLSContext *virNetTLSContextNewClientPath(const char *pkipath,
virNetTLSContext *virNetTLSContextNewServer(const char *cacert,
const char *cacrl,
const char *cert,
const char *key,
const char *const *certs,
const char *const *keys,
const char *const *x509dnACL,
const char *priority,
bool sanityCheckCert,
bool requireValidCert)
{
return virNetTLSContextNew(cacert, cacrl, cert, key, x509dnACL, priority,
return virNetTLSContextNew(cacert, cacrl, certs, keys, x509dnACL, priority,
sanityCheckCert, requireValidCert, true);
}
@@ -369,6 +372,7 @@ int virNetTLSContextReloadForServer(virNetTLSContext *ctxt,
g_autofree char *cert = NULL;
g_autofree char *key = NULL;
const char *certs[] = { cert, NULL };
const char *keys[] = { key, NULL };
x509credBak = g_steal_pointer(&ctxt->x509cred);
@@ -387,7 +391,8 @@ int virNetTLSContextReloadForServer(virNetTLSContext *ctxt,
if (virNetTLSCertSanityCheck(true, cacert, certs))
goto error;
if (virNetTLSContextLoadCredentials(ctxt, true, cacert, cacrl, cert, key))
if (virNetTLSContextLoadCredentials(ctxt, true, cacert, cacrl,
certs, keys))
goto error;
gnutls_certificate_free_credentials(x509credBak);
@@ -404,13 +409,13 @@ int virNetTLSContextReloadForServer(virNetTLSContext *ctxt,
virNetTLSContext *virNetTLSContextNewClient(const char *cacert,
const char *cacrl,
const char *cert,
const char *key,
const char *const *certs,
const char *const *keys,
const char *priority,
bool sanityCheckCert,
bool requireValidCert)
{
return virNetTLSContextNew(cacert, cacrl, cert, key, NULL, priority,
return virNetTLSContextNew(cacert, cacrl, certs, keys, NULL, priority,
sanityCheckCert, requireValidCert, false);
}
src/rpc/virnettlscontext.h
+13 -13
View File
@@ -44,21 +44,21 @@ virNetTLSContext *virNetTLSContextNewClientPath(const char *pkipath,
bool requireValidCert);
virNetTLSContext *virNetTLSContextNewServer(const char *cacert,
const char *cacrl,
const char *cert,
const char *key,
const char *const *x509dnACL,
const char *priority,
bool sanityCheckCert,
bool requireValidCert);
const char *cacrl,
const char *const *certs,
const char *const *keys,
const char *const *x509dnACL,
const char *priority,
bool sanityCheckCert,
bool requireValidCert);
virNetTLSContext *virNetTLSContextNewClient(const char *cacert,
const char *cacrl,
const char *cert,
const char *key,
const char *priority,
bool sanityCheckCert,
bool requireValidCert);
const char *cacrl,
const char *const *certs,
const char *const *keys,
const char *priority,
bool sanityCheckCert,
bool requireValidCert);
int virNetTLSContextReloadForServer(virNetTLSContext *ctxt,
bool tryUserPkiPath);
tests/virnettlscontexttest.c
+6 -4
View File
@@ -56,12 +56,14 @@ static int testTLSContextInit(const void *opaque)
struct testTLSContextData *data = (struct testTLSContextData *)opaque;
virNetTLSContext *ctxt = NULL;
int ret = -1;
const char *certs[] = { data->crt, NULL };
const char *keys[] = { KEYFILE, NULL };
if (data->isServer) {
ctxt = virNetTLSContextNewServer(data->cacrt,
NULL,
data->crt,
KEYFILE,
certs,
keys,
NULL,
"NORMAL",
true,
@@ -69,8 +71,8 @@ static int testTLSContextInit(const void *opaque)
} else {
ctxt = virNetTLSContextNewClient(data->cacrt,
NULL,
data->crt,
KEYFILE,
certs,
keys,
"NORMAL",
true,
true);
tests/virnettlssessiontest.c
+5 -4
View File
@@ -81,6 +81,9 @@ static int testTLSSessionInit(const void *opaque)
int channel[2];
bool clientShake = false;
bool serverShake = false;
const char *keys[] = { KEYFILE, NULL };
const char *clientcerts[] = { data->clientcrt, NULL };
const char *servercerts[] = { data->servercrt, NULL };
/* We'll use this for our fake client-server connection */
@@ -102,8 +105,7 @@ static int testTLSSessionInit(const void *opaque)
*/
serverCtxt = virNetTLSContextNewServer(data->servercacrt,
NULL,
data->servercrt,
KEYFILE,
servercerts, keys,
data->wildcards,
"NORMAL",
false,
@@ -111,8 +113,7 @@ static int testTLSSessionInit(const void *opaque)
clientCtxt = virNetTLSContextNewClient(data->clientcacrt,
NULL,
data->clientcrt,
KEYFILE,
clientcerts, keys,
"NORMAL",
false,
true);