From nobody Mon Oct 27 11:12:36 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1761320473; cv=none; d=zohomail.com; s=zohoarc; b=eKRQfXUkRcUXFjdrVf2Fa2P4j5qdfovVZRVlY2UZRTN1+hkSe668f6Q1HIDEVLjOjaMi2TVKGbLSbdcet8Vwmq7Yddu7vZs3CazdWnWI4psmfBUdzMysJycN8SQ2MSCszx2qR++UXH0+rR67O+U5D5f1/6rSbATsc6wJEOmJjFA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761320473; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=6K6yXOxzdduDep/cEeTdz/PabHfAAO8ZDJVfFXVKLhM=; b=KrcjVXe49Rd0hp+39VTIF2HisLhTpZV5+0opnjWQnc4sx8XDmGUumqSd/EHUiVz79xbehpygiQIhzL5/AdE16a4R1G7T3XtF9gb5PLdymEA5Fjp8s8FI8c4WlI3kpC80ImVz0c+LC6ySjZv34PNVYxVV/Ovbsg0y7Kz1AUgGCjQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761320473150944.5608207212916; Fri, 24 Oct 2025 08:41:13 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vCJuF-0008Dt-C3; Fri, 24 Oct 2025 11:40:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJu8-0008Cr-To for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:37 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJu5-0003Mq-UW for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:36 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-513-Nvhoxs8yNtKMxeD2GNcGew-1; Fri, 24 Oct 2025 11:40:31 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 8E6B3195398A; Fri, 24 Oct 2025 15:40:30 +0000 (UTC) Received: from toolbx.redhat.com (unknown [10.42.28.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 6A51D195398C; Fri, 24 Oct 2025 15:40:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761320432; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=6K6yXOxzdduDep/cEeTdz/PabHfAAO8ZDJVfFXVKLhM=; b=XdH5z4dhWzJ/4xErw6xB/utR1mk9YcGpmKCHdcLfH+e5HXgqCRF+07WT8ufIwpJAXHYttp Da79jE1OEotAsb9tgDkLNTxIc94GXg+YAF9T55oaOZaJoV4++iTf4RK5uNPzIVeYDkMgVk mC5cngiz/TFgqrUm2gBVp82ew3W3JiA= X-MC-Unique: Nvhoxs8yNtKMxeD2GNcGew-1 X-Mimecast-MFC-AGG-ID: Nvhoxs8yNtKMxeD2GNcGew_1761320430 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Eduardo Habkost , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Paolo Bonzini , Peter Xu Subject: [PULL 01/13] crypto: propagate Error object on premature termination Date: Fri, 24 Oct 2025 16:40:12 +0100 Message-ID: <20251024154024.227978-2-berrange@redhat.com> In-Reply-To: <20251024154024.227978-1-berrange@redhat.com> References: <20251024154024.227978-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1761320477036158500 The way that premature termination was handled in TLS connections was changed to handle an ordering problem during graceful shutdown in the migration code. Unfortunately one of the codepaths returned -1 to indicate an error condition, but failed to set the 'errp' parameter. This broke error handling in the qio_channel_tls_handshake function, as the QTask callback would no longer see that an error was raised. As a result, the client will go on to try to use the already closed TLS connection, resulting in misleading errors. This was evidenced in the I/O test 233 which showed changes such as -qemu-nbd: Certificate does not match the hostname localhost +qemu-nbd: Failed to read initial magic: Unable to read from socket: Connec= tion reset by peer Fixes: 7e0c22d585581b8083ffdeb332ea497218665daf Acked-by: Peter Xu Signed-off-by: Daniel P. Berrang=C3=A9 --- crypto/tlssession.c | 8 +++++--- io/channel-tls.c | 13 +++++++------ 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/crypto/tlssession.c b/crypto/tlssession.c index ac38c2121d..8c0bf457ad 100644 --- a/crypto/tlssession.c +++ b/crypto/tlssession.c @@ -569,8 +569,6 @@ qcrypto_tls_session_read(QCryptoTLSSession *session, if (ret < 0) { if (ret =3D=3D GNUTLS_E_AGAIN) { return QCRYPTO_TLS_SESSION_ERR_BLOCK; - } else if (ret =3D=3D GNUTLS_E_PREMATURE_TERMINATION) { - return QCRYPTO_TLS_SESSION_PREMATURE_TERMINATION; } else { if (session->rerr) { error_propagate(errp, session->rerr); @@ -580,7 +578,11 @@ qcrypto_tls_session_read(QCryptoTLSSession *session, "Cannot read from TLS channel: %s", gnutls_strerror(ret)); } - return -1; + if (ret =3D=3D GNUTLS_E_PREMATURE_TERMINATION) { + return QCRYPTO_TLS_SESSION_PREMATURE_TERMINATION; + } else { + return -1; + } } } =20 diff --git a/io/channel-tls.c b/io/channel-tls.c index 1fbed4be0c..70fad38d18 100644 --- a/io/channel-tls.c +++ b/io/channel-tls.c @@ -368,6 +368,7 @@ static ssize_t qio_channel_tls_readv(QIOChannel *ioc, int flags, Error **errp) { + ERRP_GUARD(); QIOChannelTLS *tioc =3D QIO_CHANNEL_TLS(ioc); size_t i; ssize_t got =3D 0; @@ -384,13 +385,13 @@ static ssize_t qio_channel_tls_readv(QIOChannel *ioc, } else { return QIO_CHANNEL_ERR_BLOCK; } - } else if (ret =3D=3D QCRYPTO_TLS_SESSION_PREMATURE_TERMINATION) { - if (qio_channel_tls_allow_premature_termination(tioc, flags)) { - ret =3D 0; - } else { - return -1; - } } else if (ret < 0) { + if (ret =3D=3D QCRYPTO_TLS_SESSION_PREMATURE_TERMINATION && + qio_channel_tls_allow_premature_termination(tioc, flags)) { + error_free(*errp); + *errp =3D NULL; + return got; + } return -1; } got +=3D ret; --=20 2.50.1 From nobody Mon Oct 27 11:12:36 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1761320541; cv=none; d=zohomail.com; s=zohoarc; b=N3kO4aDaswbvvKoK7dIATW8vD1OHKlx1NNirJ9dmGaWMerkj2GXZXlsYdXKYzZc9NF7aop9szRJS3tbR9dFTdM2kp8QpCiBgPF6Ed8NCwsoHxif3/4wJmtGbWt+NqSGhALEQa7cTf9tcsjDgKZMaEyFLLz01bt95T1K/1u+KAcY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761320541; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=3G2BT9iAz6T+va4TbFNMAz7RB+55LcofTHMiALdTMPQ=; b=CKhhSqpxLTv4gSoQthOgCJcgP6WKKD6rFl/ko5CCPvHGCqLsBWWJjWR36e8shc5EBWl86J2ghZAqNBxuNCksiyfjy+YL1BTuNwR6lhzr3Twn9MssjqHBJrvy2rvrw5WcL3JDqHSv6Siy+tiLE5XL97nnxyD0NwOc4GSorHgNUZw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761320541411559.263266376984; Fri, 24 Oct 2025 08:42:21 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vCJuG-0008Ed-Ay; Fri, 24 Oct 2025 11:40:44 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuB-0008D3-KO for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:41 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuA-0003N9-3M for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:39 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-472--nix1MfbNaCBTfegok-LLA-1; Fri, 24 Oct 2025 11:40:33 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id EE5B518009C2; Fri, 24 Oct 2025 15:40:32 +0000 (UTC) Received: from toolbx.redhat.com (unknown [10.42.28.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 3DE931953994; Fri, 24 Oct 2025 15:40:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761320437; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3G2BT9iAz6T+va4TbFNMAz7RB+55LcofTHMiALdTMPQ=; b=R4xewX4tA0Swsva6uwt8COW8vHCOZ0e4LUMazcJnN+ajMrAxaRqCxJxtduxSpqHBKuZf6R R45pmiyDKWWEVA2lgUk7732BbLnXq2jzy2fKoHU0dBoxFyfPQzzayzhhqvK4gkFD40DUfx 4QsGu10Va0s0ajuNCQM7ybVBAVQsZis= X-MC-Unique: -nix1MfbNaCBTfegok-LLA-1 X-Mimecast-MFC-AGG-ID: -nix1MfbNaCBTfegok-LLA_1761320433 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Eduardo Habkost , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Paolo Bonzini , Markus Armbruster Subject: [PULL 02/13] qom: use ERRP_GUARD in user_creatable_complete Date: Fri, 24 Oct 2025 16:40:13 +0100 Message-ID: <20251024154024.227978-3-berrange@redhat.com> In-Reply-To: <20251024154024.227978-1-berrange@redhat.com> References: <20251024154024.227978-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1761320547303158500 With error_propagate, the stack trace from any error_abort/fatal usage will start from the error_propagate() call, which is largely useless. Using ERRP_GUARD ensures the stack trace starts from the origin that reported the error. Reviewed-by: Paolo Bonzini Reviewed-by: Markus Armbruster Signed-off-by: Daniel P. Berrang=C3=A9 --- qom/object_interfaces.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/qom/object_interfaces.c b/qom/object_interfaces.c index 1ffea1a728..415cbee8c5 100644 --- a/qom/object_interfaces.c +++ b/qom/object_interfaces.c @@ -24,13 +24,12 @@ bool user_creatable_complete(UserCreatable *uc, Error **errp) { UserCreatableClass *ucc =3D USER_CREATABLE_GET_CLASS(uc); - Error *err =3D NULL; + ERRP_GUARD(); =20 if (ucc->complete) { - ucc->complete(uc, &err); - error_propagate(errp, err); + ucc->complete(uc, errp); } - return !err; + return !*errp; } =20 bool user_creatable_can_be_deleted(UserCreatable *uc) --=20 2.50.1 From nobody Mon Oct 27 11:12:36 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1761320557; cv=none; d=zohomail.com; s=zohoarc; b=MnqodlIiKuk4cpbEUGgC99hmqWtk/fN7nRHRl00GG8IeQooNiXEBu9MXnrWUZ+BaNYA+1QrCfI8DN0Wr0MApMQbZVzHi3vCWPRpUaT/ZSkKlBtmbFfhOLlD9YueLLxUo9j17/Lo61sH/uOazU1YpfIUMr4x/POqvdAe2R0+zr80= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761320557; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=+4+pgRmhA7AwhaFbarb6ijKQeWXtkQsaRprqh0MkzyA=; b=KVEd8Tl3lL+TygWi8v39dB6dp9wBjzDRSH7h0K5AOUM+Go2Hs9m33w0JtB6yZz0r1OqLOHboQJThFtZfRrKul7EKjX5pn0usdDuNd7eI1oiojmFFOLUPau+puTYjocZLcYHCAytL5r38n1pPdkwYuWVm6ExTq2beAonW5lQw6fY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761320557803449.11888525792233; Fri, 24 Oct 2025 08:42:37 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vCJuH-0008FD-Qs; Fri, 24 Oct 2025 11:40:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuB-0008D4-UJ for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:41 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuA-0003NC-DG for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:39 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-176-cq67STxAOqavpIJ0QmNRjA-1; Fri, 24 Oct 2025 11:40:36 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 68B9F18009C0; Fri, 24 Oct 2025 15:40:35 +0000 (UTC) Received: from toolbx.redhat.com (unknown [10.42.28.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 7B1B719540EB; Fri, 24 Oct 2025 15:40:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761320437; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=+4+pgRmhA7AwhaFbarb6ijKQeWXtkQsaRprqh0MkzyA=; b=XtB6+k3kcjTwQ5P0QZ8HfKAmCY/nLDLnuV0hWCYypom9VaQ1sO5pujsMakt6yjMIfjFE7A zUs/WPKaZTuSc258BIHAtow5FA3Uy7wMCjz86vmKVsHpyQTpY9MWuVTUtzZWlR9QTYHQOg vC81dDgFZtiUsMoFTepVFnYYcBep3+c= X-MC-Unique: cq67STxAOqavpIJ0QmNRjA-1 X-Mimecast-MFC-AGG-ID: cq67STxAOqavpIJ0QmNRjA_1761320435 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Eduardo Habkost , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Paolo Bonzini , Peter Maydell Subject: [PULL 03/13] tests: use macros for registering char tests for sockets Date: Fri, 24 Oct 2025 16:40:14 +0100 Message-ID: <20251024154024.227978-4-berrange@redhat.com> In-Reply-To: <20251024154024.227978-1-berrange@redhat.com> References: <20251024154024.227978-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1761320563711158500 The test-char.c has a couple of helper macros for registering tests that need to be repeated for both IP and UNIX sockets. One test case was not using the macro though. Reviewed-by: Peter Maydell Signed-off-by: Daniel P. Berrang=C3=A9 --- tests/unit/test-char.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/tests/unit/test-char.c b/tests/unit/test-char.c index f30a39f61f..e156b17329 100644 --- a/tests/unit/test-char.c +++ b/tests/unit/test-char.c @@ -1934,7 +1934,9 @@ int main(int argc, char **argv) g_test_add_data_func("/char/socket/server/mainloop-fdpass/" # name, \ &server3 ##name, char_socket_server_test); \ g_test_add_data_func("/char/socket/server/wait-conn-fdpass/" # name, \ - &server4 ##name, char_socket_server_test) + &server4 ##name, char_socket_server_test); \ + g_test_add_data_func("/char/socket/server/two-clients/" # name, \ + addr, char_socket_server_two_clients_test) =20 #define SOCKET_CLIENT_TEST(name, addr) \ static CharSocketClientTestConfig client1 ## name =3D \ @@ -1974,14 +1976,10 @@ int main(int argc, char **argv) if (has_ipv4) { SOCKET_SERVER_TEST(tcp, &tcpaddr); SOCKET_CLIENT_TEST(tcp, &tcpaddr); - g_test_add_data_func("/char/socket/server/two-clients/tcp", &tcpad= dr, - char_socket_server_two_clients_test); } #ifndef WIN32 SOCKET_SERVER_TEST(unix, &unixaddr); SOCKET_CLIENT_TEST(unix, &unixaddr); - g_test_add_data_func("/char/socket/server/two-clients/unix", &unixaddr, - char_socket_server_two_clients_test); #endif =20 g_test_add_func("/char/udp", char_udp_test); --=20 2.50.1 From nobody Mon Oct 27 11:12:36 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1761320560; cv=none; d=zohomail.com; s=zohoarc; b=eNlwN9JzkCuGGXT2ibN85k7HFvED8Sc8/ca6id8yFRMplYzp7S4C2wMehWBrDCZR5n+SS/Lo+tWu3jL0Z78X9vsd0VB91+2o2RUaEm9pkIIwrT1B30F9C1BWMs1TPfoOSp90+ngg3EJ80SD8SVs543PDbCHbZWaRF43L6oCKb8w= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761320560; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=AvAA3/dUluaCqtyyMtL7sm3tTucumU/mODLgAeMS2go=; b=hocXjCCFMya5k/LxdyIZFkgPN7Kdrp0UpgYHtoFCdtCKwd47Tc0KSZzfevRj1gEUnSFJm/CycLGpcO+JONEcxPgU+i/OqDUeHJQqzrCiFaEKE9dqUQejkI716hLTb8/KbG4oVz3+SHvOk9oqWmM+CnyZMp3GBhb7bSnZ3VCB354= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761320560782752.7201973416933; Fri, 24 Oct 2025 08:42:40 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vCJuH-0008Ey-9i; Fri, 24 Oct 2025 11:40:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuF-0008E3-Kr for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:43 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuD-0003NZ-To for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:43 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-661-vOghYABaM2K6WqrMlCxMBg-1; Fri, 24 Oct 2025 11:40:38 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B40431800675; Fri, 24 Oct 2025 15:40:37 +0000 (UTC) Received: from toolbx.redhat.com (unknown [10.42.28.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id F318319540EB; Fri, 24 Oct 2025 15:40:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761320441; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=AvAA3/dUluaCqtyyMtL7sm3tTucumU/mODLgAeMS2go=; b=Jh907bUXLrYngQasgwzPVqO5L6vHH50TlB98mCCzHmhUw3tiCnj8Tt9q3TWDZA+UG3+ZHc 8um5RNUuP6nAYoOj0SuTs+xl37/x/N1FelOIgLh5qTKmx0TfNYhE2NmXPeh0QDatJWMbPU 7D0kFKrMLq8GdGfqorZ5x83C5x4bgSo= X-MC-Unique: vOghYABaM2K6WqrMlCxMBg-1 X-Mimecast-MFC-AGG-ID: vOghYABaM2K6WqrMlCxMBg_1761320437 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Eduardo Habkost , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Paolo Bonzini , Eric Blake Subject: [PULL 04/13] io: release active GSource in TLS channel finalizer Date: Fri, 24 Oct 2025 16:40:15 +0100 Message-ID: <20251024154024.227978-5-berrange@redhat.com> In-Reply-To: <20251024154024.227978-1-berrange@redhat.com> References: <20251024154024.227978-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1761320561559158500 While code is supposed to call qio_channel_close() before releasing the last reference on an QIOChannel, this is not guaranteed. QIOChannelFile and QIOChannelSocket both cleanup resources in their finalizer if the close operation was missed. This ensures the TLS channel will do the same failsafe cleanup. Reviewed-by: Eric Blake Signed-off-by: Daniel P. Berrang=C3=A9 --- io/channel-tls.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/io/channel-tls.c b/io/channel-tls.c index 70fad38d18..ce041795c1 100644 --- a/io/channel-tls.c +++ b/io/channel-tls.c @@ -342,6 +342,16 @@ static void qio_channel_tls_finalize(Object *obj) { QIOChannelTLS *ioc =3D QIO_CHANNEL_TLS(obj); =20 + if (ioc->hs_ioc_tag) { + trace_qio_channel_tls_handshake_cancel(ioc); + g_clear_handle_id(&ioc->hs_ioc_tag, g_source_remove); + } + + if (ioc->bye_ioc_tag) { + trace_qio_channel_tls_bye_cancel(ioc); + g_clear_handle_id(&ioc->bye_ioc_tag, g_source_remove); + } + object_unref(OBJECT(ioc->master)); qcrypto_tls_session_free(ioc->session); } --=20 2.50.1 From nobody Mon Oct 27 11:12:36 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1761320495; cv=none; d=zohomail.com; s=zohoarc; b=KJKVmJVrFZXeosVu/tRubRlyDtTke9Y5mnKe0BBTtL5OOs5GgmdHMnrWyv/Qvod1T8zyv2QBRGY5gE5LUeyO7S0JbWT59bCGsKpHdRuRHag3QeKteC6rgZJFeWy9jvecISXIv1uivdQU/UjN+Xzkq2/HyBKoaOKTncPmv2K9eCo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761320495; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=8JQXhF8o3AXpEzb21LKwdmGdvdb2hFy8yKFZ6fAIr70=; b=ipIR33tqS+fntktKURPh5bd7uo03cGAoIkchPjhgb8uCAvi6laCdMfnTLvxNyzh7lrbFFd45cp21Y4sm/aKM1Hj/McdYz6txpcUs5VZ+Kq5IZqUowPgYY/I9KCZBkbHuRxBDn2Op9/JIoLWYkY5Gu+rCT4/IGo5FhtoGoAxlheA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761320495312621.9672020023155; Fri, 24 Oct 2025 08:41:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vCJuQ-0008Gl-3A; Fri, 24 Oct 2025 11:40:55 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuH-0008FG-Ve for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:48 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuG-0003O8-EE for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:45 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-32-NACc-t7gN4ir9ttV2Xhbjw-1; Fri, 24 Oct 2025 11:40:41 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 5767C18009C0; Fri, 24 Oct 2025 15:40:40 +0000 (UTC) Received: from toolbx.redhat.com (unknown [10.42.28.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 5F12C19540EB; Fri, 24 Oct 2025 15:40:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761320443; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=8JQXhF8o3AXpEzb21LKwdmGdvdb2hFy8yKFZ6fAIr70=; b=blRxVl2tEDoJTSQftTFqOp7oVgHoONIh0i4t9TquwEwqe27hgrRNCfKuVmWkD282Mmv0o/ Lb4oOP1O1xC/cyRP5a464B7srH4Xin7K+dvW5ep1QafjPYEL5EYMv9OMcediwIu+61exBm FqduEonW9R+PoU0U/p9Xgx0I/I1E7r4= X-MC-Unique: NACc-t7gN4ir9ttV2Xhbjw-1 X-Mimecast-MFC-AGG-ID: NACc-t7gN4ir9ttV2Xhbjw_1761320440 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Eduardo Habkost , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Paolo Bonzini , Eric Blake Subject: [PULL 05/13] io: move websock resource release to close method Date: Fri, 24 Oct 2025 16:40:16 +0100 Message-ID: <20251024154024.227978-6-berrange@redhat.com> In-Reply-To: <20251024154024.227978-1-berrange@redhat.com> References: <20251024154024.227978-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1761320496858158500 The QIOChannelWebsock object releases all its resources in the finalize callback. This is later than desired, as callers expect to be able to call qio_channel_close() to fully close a channel and release resources related to I/O. The logic in the finalize method is at most a failsafe to handle cases where a consumer forgets to call qio_channel_close. This adds equivalent logic to the close method to release the resources, using g_clear_handle_id/g_clear_pointer to be robust against repeated invocations. The finalize method is tweaked so that the GSource is removed before releasing the underlying channel. Reviewed-by: Eric Blake Signed-off-by: Daniel P. Berrang=C3=A9 --- io/channel-websock.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/io/channel-websock.c b/io/channel-websock.c index 0a8c5c4712..a50a160e18 100644 --- a/io/channel-websock.c +++ b/io/channel-websock.c @@ -922,13 +922,13 @@ static void qio_channel_websock_finalize(Object *obj) buffer_free(&ioc->encinput); buffer_free(&ioc->encoutput); buffer_free(&ioc->rawinput); - object_unref(OBJECT(ioc->master)); if (ioc->io_tag) { g_source_remove(ioc->io_tag); } if (ioc->io_err) { error_free(ioc->io_err); } + object_unref(OBJECT(ioc->master)); } =20 =20 @@ -1218,6 +1218,15 @@ static int qio_channel_websock_close(QIOChannel *ioc, QIOChannelWebsock *wioc =3D QIO_CHANNEL_WEBSOCK(ioc); =20 trace_qio_channel_websock_close(ioc); + buffer_free(&wioc->encinput); + buffer_free(&wioc->encoutput); + buffer_free(&wioc->rawinput); + if (wioc->io_tag) { + g_clear_handle_id(&wioc->io_tag, g_source_remove); + } + if (wioc->io_err) { + g_clear_pointer(&wioc->io_err, error_free); + } return qio_channel_close(wioc->master, errp); } =20 --=20 2.50.1 From nobody Mon Oct 27 11:12:36 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1761320511; cv=none; d=zohomail.com; s=zohoarc; b=SacuHfXyWwKJSpSC3wggR7BctJhysB6v46WYYfw/BjgnnwU6I5dEW7pScGjQO/kZEtQRxAY3r2zxA27vq7kwcTxOKU153AoaqvS7vxPrx31NWroRVlS385VyUOmDOyLiB50QFRJ2Yh0mHKD8eXShKQrXNzXaahK9Nz0vSdxz3bs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761320511; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=0gF93nT4QCSeQp0OqhTjXZ1wteCnmObHKQPrcwA+0mE=; b=XGDKKvyRr7keDOietUIzH77WD+fhqxGTjzxRUB+omEMbTVOmPkmih3IOkDlUnPwVLkzhI5DTRDOk8jUR0VfyY9oBr2uEf9tX93dowx85Lml7nY3PIohub3lmmjUnXUTR5dvuTDf1Ma9w5KfxWkKAcjoRlom0csVFLVz5SW3ohtU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761320511511757.133275592661; Fri, 24 Oct 2025 08:41:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vCJuR-0008Gp-Nl; Fri, 24 Oct 2025 11:40:55 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuK-0008Fs-LJ for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:52 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuI-0003OK-Pm for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:48 -0400 Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-634-PBuc54YQNoy69nhEst4WOA-1; Fri, 24 Oct 2025 11:40:44 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id E0DC1196F764; Fri, 24 Oct 2025 15:40:42 +0000 (UTC) Received: from toolbx.redhat.com (unknown [10.42.28.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id D99E119540EB; Fri, 24 Oct 2025 15:40:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761320446; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0gF93nT4QCSeQp0OqhTjXZ1wteCnmObHKQPrcwA+0mE=; b=aqp9Ns/R6cAcHnoYlaJ8MPC5QJBsshZ30WoyHLrmvtyf1D9HB/bxfymdjU/Y/F3KM0jM/C 0adcwunO/iw19hQt3vdFxCq292BF31nXAx71vXVxwD9hsKEX/Pf+7Is8pf6KtljELTbzQc hT8179pW5PntAaURD3Xw1zvzqawExnc= X-MC-Unique: PBuc54YQNoy69nhEst4WOA-1 X-Mimecast-MFC-AGG-ID: PBuc54YQNoy69nhEst4WOA_1761320443 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Eduardo Habkost , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Paolo Bonzini , Grant Millar | Cylo , Eric Blake Subject: [PULL 06/13] io: fix use after free in websocket handshake code Date: Fri, 24 Oct 2025 16:40:17 +0100 Message-ID: <20251024154024.227978-7-berrange@redhat.com> In-Reply-To: <20251024154024.227978-1-berrange@redhat.com> References: <20251024154024.227978-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1761320517057158500 If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This was observed in the VNC server with the following trace from valgrind: =3D=3D2523108=3D=3D Invalid read of size 4 =3D=3D2523108=3D=3D at 0x4054A24: vnc_disconnect_start (vnc.c:1296) =3D=3D2523108=3D=3D by 0x4054A24: vnc_client_error (vnc.c:1392) =3D=3D2523108=3D=3D by 0x4068A09: vncws_handshake_done (vnc-ws.c:105) =3D=3D2523108=3D=3D by 0x44863B4: qio_task_complete (task.c:197) =3D=3D2523108=3D=3D by 0x448343D: qio_channel_websock_handshake_io (chan= nel-websock.c:588) =3D=3D2523108=3D=3D by 0x6EDB862: UnknownInlinedFun (gmain.c:3398) =3D=3D2523108=3D=3D by 0x6EDB862: g_main_context_dispatch_unlocked.lto_p= riv.0 (gmain.c:4249) =3D=3D2523108=3D=3D by 0x6EDBAE4: g_main_context_dispatch (gmain.c:4237) =3D=3D2523108=3D=3D by 0x45EC79F: glib_pollfds_poll (main-loop.c:287) =3D=3D2523108=3D=3D by 0x45EC79F: os_host_main_loop_wait (main-loop.c:31= 0) =3D=3D2523108=3D=3D by 0x45EC79F: main_loop_wait (main-loop.c:589) =3D=3D2523108=3D=3D by 0x423A56D: qemu_main_loop (runstate.c:835) =3D=3D2523108=3D=3D by 0x454F300: qemu_default_main (main.c:37) =3D=3D2523108=3D=3D by 0x73D6574: (below main) (libc_start_call_main.h:5= 8) =3D=3D2523108=3D=3D Address 0x57a6e0dc is 28 bytes inside a block of size = 103,608 free'd =3D=3D2523108=3D=3D at 0x5F2FE43: free (vg_replace_malloc.c:989) =3D=3D2523108=3D=3D by 0x6EDC444: g_free (gmem.c:208) =3D=3D2523108=3D=3D by 0x4053F23: vnc_update_client (vnc.c:1153) =3D=3D2523108=3D=3D by 0x4053F23: vnc_refresh (vnc.c:3225) =3D=3D2523108=3D=3D by 0x4042881: dpy_refresh (console.c:880) =3D=3D2523108=3D=3D by 0x4042881: gui_update (console.c:90) =3D=3D2523108=3D=3D by 0x45EFA1B: timerlist_run_timers.part.0 (qemu-time= r.c:562) =3D=3D2523108=3D=3D by 0x45EFC8F: timerlist_run_timers (qemu-timer.c:495) =3D=3D2523108=3D=3D by 0x45EFC8F: qemu_clock_run_timers (qemu-timer.c:57= 6) =3D=3D2523108=3D=3D by 0x45EFC8F: qemu_clock_run_all_timers (qemu-timer.= c:663) =3D=3D2523108=3D=3D by 0x45EC765: main_loop_wait (main-loop.c:600) =3D=3D2523108=3D=3D by 0x423A56D: qemu_main_loop (runstate.c:835) =3D=3D2523108=3D=3D by 0x454F300: qemu_default_main (main.c:37) =3D=3D2523108=3D=3D by 0x73D6574: (below main) (libc_start_call_main.h:5= 8) =3D=3D2523108=3D=3D Block was alloc'd at =3D=3D2523108=3D=3D at 0x5F343F3: calloc (vg_replace_malloc.c:1675) =3D=3D2523108=3D=3D by 0x6EE2F81: g_malloc0 (gmem.c:133) =3D=3D2523108=3D=3D by 0x4057DA3: vnc_connect (vnc.c:3245) =3D=3D2523108=3D=3D by 0x448591B: qio_net_listener_channel_func (net-lis= tener.c:54) =3D=3D2523108=3D=3D by 0x6EDB862: UnknownInlinedFun (gmain.c:3398) =3D=3D2523108=3D=3D by 0x6EDB862: g_main_context_dispatch_unlocked.lto_p= riv.0 (gmain.c:4249) =3D=3D2523108=3D=3D by 0x6EDBAE4: g_main_context_dispatch (gmain.c:4237) =3D=3D2523108=3D=3D by 0x45EC79F: glib_pollfds_poll (main-loop.c:287) =3D=3D2523108=3D=3D by 0x45EC79F: os_host_main_loop_wait (main-loop.c:31= 0) =3D=3D2523108=3D=3D by 0x45EC79F: main_loop_wait (main-loop.c:589) =3D=3D2523108=3D=3D by 0x423A56D: qemu_main_loop (runstate.c:835) =3D=3D2523108=3D=3D by 0x454F300: qemu_default_main (main.c:37) =3D=3D2523108=3D=3D by 0x73D6574: (below main) (libc_start_call_main.h:5= 8) =3D=3D2523108=3D=3D The above can be reproduced by launching QEMU with $ qemu-system-x86_64 -vnc localhost:0,websocket=3D5700 and then repeatedly running: for i in {1..100}; do (echo -n "GET / HTTP/1.1" && sleep 0.05) | nc -w 1 localhost 5700 & done CVE-2025-11234 Reported-by: Grant Millar | Cylo Reviewed-by: Eric Blake Signed-off-by: Daniel P. Berrang=C3=A9 --- include/io/channel-websock.h | 3 ++- io/channel-websock.c | 22 ++++++++++++++++------ 2 files changed, 18 insertions(+), 7 deletions(-) diff --git a/include/io/channel-websock.h b/include/io/channel-websock.h index e180827c57..6700cf8946 100644 --- a/include/io/channel-websock.h +++ b/include/io/channel-websock.h @@ -61,7 +61,8 @@ struct QIOChannelWebsock { size_t payload_remain; size_t pong_remain; QIOChannelWebsockMask mask; - guint io_tag; + guint hs_io_tag; /* tracking handshake task */ + guint io_tag; /* tracking watch task */ Error *io_err; gboolean io_eof; uint8_t opcode; diff --git a/io/channel-websock.c b/io/channel-websock.c index a50a160e18..cb4dafdebb 100644 --- a/io/channel-websock.c +++ b/io/channel-websock.c @@ -545,6 +545,7 @@ static gboolean qio_channel_websock_handshake_send(QIOC= hannel *ioc, trace_qio_channel_websock_handshake_fail(ioc, error_get_pretty(err= )); qio_task_set_error(task, err); qio_task_complete(task); + wioc->hs_io_tag =3D 0; return FALSE; } =20 @@ -560,6 +561,7 @@ static gboolean qio_channel_websock_handshake_send(QIOC= hannel *ioc, trace_qio_channel_websock_handshake_complete(ioc); qio_task_complete(task); } + wioc->hs_io_tag =3D 0; return FALSE; } trace_qio_channel_websock_handshake_pending(ioc, G_IO_OUT); @@ -586,6 +588,7 @@ static gboolean qio_channel_websock_handshake_io(QIOCha= nnel *ioc, trace_qio_channel_websock_handshake_fail(ioc, error_get_pretty(err= )); qio_task_set_error(task, err); qio_task_complete(task); + wioc->hs_io_tag =3D 0; return FALSE; } if (ret =3D=3D 0) { @@ -597,7 +600,7 @@ static gboolean qio_channel_websock_handshake_io(QIOCha= nnel *ioc, error_propagate(&wioc->io_err, err); =20 trace_qio_channel_websock_handshake_reply(ioc); - qio_channel_add_watch( + wioc->hs_io_tag =3D qio_channel_add_watch( wioc->master, G_IO_OUT, qio_channel_websock_handshake_send, @@ -907,11 +910,12 @@ void qio_channel_websock_handshake(QIOChannelWebsock = *ioc, =20 trace_qio_channel_websock_handshake_start(ioc); trace_qio_channel_websock_handshake_pending(ioc, G_IO_IN); - qio_channel_add_watch(ioc->master, - G_IO_IN, - qio_channel_websock_handshake_io, - task, - NULL); + ioc->hs_io_tag =3D qio_channel_add_watch( + ioc->master, + G_IO_IN, + qio_channel_websock_handshake_io, + task, + NULL); } =20 =20 @@ -922,6 +926,9 @@ static void qio_channel_websock_finalize(Object *obj) buffer_free(&ioc->encinput); buffer_free(&ioc->encoutput); buffer_free(&ioc->rawinput); + if (ioc->hs_io_tag) { + g_source_remove(ioc->hs_io_tag); + } if (ioc->io_tag) { g_source_remove(ioc->io_tag); } @@ -1221,6 +1228,9 @@ static int qio_channel_websock_close(QIOChannel *ioc, buffer_free(&wioc->encinput); buffer_free(&wioc->encoutput); buffer_free(&wioc->rawinput); + if (wioc->hs_io_tag) { + g_clear_handle_id(&wioc->hs_io_tag, g_source_remove); + } if (wioc->io_tag) { g_clear_handle_id(&wioc->io_tag, g_source_remove); } --=20 2.50.1 From nobody Mon Oct 27 11:12:36 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1761320550; cv=none; d=zohomail.com; s=zohoarc; b=GZl9VBXt+tq+VTUJPv+Y2XXNRDgOq5I8QM2OxAjMTn7zWqh5UvK91MzQ0QA86bNBNrb+pVqaJtSeVkewIv+moz1ZKRMT5v+V64SC3JDxpZgQKPoSFE84unu+uxk42rDvR/7dPaUn5u4dYuFfRGzvcZMnKiyXMNRiPPuFn+9qVZ4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761320550; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=CCObt3x+cEciUOh6vncOKwvla1QzbKPqBuEb/0PEtVo=; b=iC9qVYEeyjidxP9NetwUKBCX85deJPSeZzB+sDx9AxL95tvQGF7VPyNdlwZt+pzcqHd7UaZoHxkwHJYwXlh7fKGsInXOAnMod4e+IpPgaaMMON5HYM0qIlJyVhJnUFKrAc8rUZiKtCCD0zxybqKqCFUM20G5lVdYdCAiXLTVcto= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761320550725916.8406401312308; Fri, 24 Oct 2025 08:42:30 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vCJuT-0008Hi-Li; Fri, 24 Oct 2025 11:40:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuR-0008H7-Dj for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:55 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuO-0003Oj-5l for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:54 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-38-457y4P7VPeiDc_I2xwqNpQ-1; Fri, 24 Oct 2025 11:40:47 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id BD16518002E4; Fri, 24 Oct 2025 15:40:45 +0000 (UTC) Received: from toolbx.redhat.com (unknown [10.42.28.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 8477319540EB; Fri, 24 Oct 2025 15:40:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761320451; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CCObt3x+cEciUOh6vncOKwvla1QzbKPqBuEb/0PEtVo=; b=Q1A/AmEhSLtYo9apZ8p6FJ6ODYvxysEcvRrqzL1RdODbEK6TiTULJfs5rW2z4g8Z82v0d9 aKtHeJ+ESUlySwlAyLTamYp/siafcaP0Lr57pKfheMVHv6zu4q6LTaqoZF2oBEmCxCXMQB LLlqjSN9cIxidgcIJ4YX2M+7w6HAix8= X-MC-Unique: 457y4P7VPeiDc_I2xwqNpQ-1 X-Mimecast-MFC-AGG-ID: 457y4P7VPeiDc_I2xwqNpQ_1761320445 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Eduardo Habkost , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Paolo Bonzini , Eric Blake , Henry Kleynhans Subject: [PULL 07/13] crypto: only verify CA certs in chain of trust Date: Fri, 24 Oct 2025 16:40:18 +0100 Message-ID: <20251024154024.227978-8-berrange@redhat.com> In-Reply-To: <20251024154024.227978-1-berrange@redhat.com> References: <20251024154024.227978-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1761320551438158500 From: Henry Kleynhans The CA file provided to qemu may contain CA certificates which do not form part of the chain of trust for the specific certificate we are sanity checking. This patch changes the sanity checking from validating every CA certificate to only checking the CA certificates which are part of the chain of trust (issuer chain). Other certificates are ignored. Reviewed-by: Daniel P. Berrang=C3=A9 Reviewed-by: Eric Blake Signed-off-by: Henry Kleynhans [DB: changed 'int' to 'bool' in 'checking_issuer' variable] Signed-off-by: Daniel P. Berrang=C3=A9 --- crypto/tlscredsx509.c | 57 ++++++++++++++++++++++++--- tests/unit/test-crypto-tlscredsx509.c | 25 +++++++++++- 2 files changed, 75 insertions(+), 7 deletions(-) diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c index cd1f504471..3df2a33b0b 100644 --- a/crypto/tlscredsx509.c +++ b/crypto/tlscredsx509.c @@ -315,6 +315,51 @@ qcrypto_tls_creds_check_cert(QCryptoTLSCredsX509 *cred= s, return 0; } =20 +static int +qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds, + gnutls_x509_crt_t cert, + gnutls_x509_crt_t *cacerts, + unsigned int ncacerts, + const char *cacertFile, + bool isServer, + bool isCA, + Error **errp) +{ + gnutls_x509_crt_t *cert_to_check =3D &cert; + bool checking_issuer =3D true; + int retval =3D 0; + + while (checking_issuer) { + checking_issuer =3D false; + + if (gnutls_x509_crt_check_issuer(*cert_to_check, + *cert_to_check)) { + /* + * The cert is self-signed indicating we have + * reached the root of trust. + */ + return qcrypto_tls_creds_check_cert( + creds, *cert_to_check, cacertFile, + isServer, isCA, errp); + } + for (int i =3D 0; i < ncacerts; i++) { + if (gnutls_x509_crt_check_issuer(*cert_to_check, + cacerts[i])) { + retval =3D qcrypto_tls_creds_check_cert( + creds, cacerts[i], cacertFile, + isServer, isCA, errp); + if (retval < 0) { + return retval; + } + cert_to_check =3D &cacerts[i]; + checking_issuer =3D true; + break; + } + } + } + + return -1; +} =20 static int qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t cert, @@ -499,12 +544,12 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX5= 09 *creds, goto cleanup; } =20 - for (i =3D 0; i < ncacerts; i++) { - if (qcrypto_tls_creds_check_cert(creds, - cacerts[i], cacertFile, - isServer, true, errp) < 0) { - goto cleanup; - } + if (cert && + qcrypto_tls_creds_check_authority_chain(creds, cert, + cacerts, ncacerts, + cacertFile, isServer, + true, errp) < 0) { + goto cleanup; } =20 if (cert && ncacerts && diff --git a/tests/unit/test-crypto-tlscredsx509.c b/tests/unit/test-crypto= -tlscredsx509.c index 3c25d75ca1..a7ea5f422d 100644 --- a/tests/unit/test-crypto-tlscredsx509.c +++ b/tests/unit/test-crypto-tlscredsx509.c @@ -589,6 +589,12 @@ int main(int argc, char **argv) true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); + TLS_CERT_REQ(cacertlevel1creq_invalid, cacertrootreq, + "UK", "qemu level 1c invalid", NULL, NULL, NULL, NULL, + true, true, true, + true, true, GNUTLS_KEY_KEY_CERT_SIGN, + false, false, NULL, NULL, + 360, 400); TLS_CERT_REQ(cacertlevel2areq, cacertlevel1areq, "UK", "qemu level 2a", NULL, NULL, NULL, NULL, true, true, true, @@ -617,16 +623,32 @@ int main(int argc, char **argv) cacertlevel2areq.crt, }; =20 + test_tls_write_cert_chain(WORKDIR "cacertchain-ctx.pem", certchain, G_N_ELEMENTS(certchain)); =20 + gnutls_x509_crt_t certchain_with_invalid[] =3D { + cacertrootreq.crt, + cacertlevel1areq.crt, + cacertlevel1breq.crt, + cacertlevel1creq_invalid.crt, + cacertlevel2areq.crt, + }; + + test_tls_write_cert_chain(WORKDIR "cacertchain-with-invalid-ctx.pem", + certchain_with_invalid, + G_N_ELEMENTS(certchain_with_invalid)); + TLS_TEST_REG(chain1, true, WORKDIR "cacertchain-ctx.pem", servercertlevel3areq.filename, false); TLS_TEST_REG(chain2, false, WORKDIR "cacertchain-ctx.pem", clientcertlevel2breq.filename, false); + TLS_TEST_REG(certchainwithexpiredcert, false, + WORKDIR "cacertchain-with-invalid-ctx.pem", + clientcertlevel2breq.filename, false); =20 /* Some missing certs - first two are fatal, the last * is ok @@ -640,7 +662,6 @@ int main(int argc, char **argv) TLS_TEST_REG(missingclient, false, cacert1req.filename, "clientcertdoesnotexist.pem", false); - ret =3D g_test_run(); =20 test_tls_discard_cert(&cacertreq); @@ -694,10 +715,12 @@ int main(int argc, char **argv) test_tls_discard_cert(&cacertrootreq); test_tls_discard_cert(&cacertlevel1areq); test_tls_discard_cert(&cacertlevel1breq); + test_tls_discard_cert(&cacertlevel1creq_invalid); test_tls_discard_cert(&cacertlevel2areq); test_tls_discard_cert(&servercertlevel3areq); test_tls_discard_cert(&clientcertlevel2breq); unlink(WORKDIR "cacertchain-ctx.pem"); + unlink(WORKDIR "cacertchain-with-invalid-ctx.pem"); =20 test_tls_cleanup(KEYFILE); rmdir(WORKDIR); --=20 2.50.1 From nobody Mon Oct 27 11:12:36 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1761320560; cv=none; d=zohomail.com; s=zohoarc; b=boZTjGCwreG2QSbnzzfW0liOj8xxlVNbjLcHLkpCW5vwj141NLzGnqNMUDPjd8CYEKjUYgp/Ifl9C/Bvdml/gmLKXp0ZjssqClF3/0f1ZK6i5dDuQSeu0/aOmnDwqbta+0Ki66L6QK6vrOTxH5Rdqy4SDZnhQ7HJ65/SdlpRb+Y= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761320560; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=JZB7OCoqm6b79w7L+YOt3iE+VCy+nmZflnF5z8stP38=; b=R+jZuL0SefXPCIFKXVDtt/2+8zlF3POlXWQwGoXx5S/q1Q4DiccbSHTFHuNWCNWZQNt61JZmNtaPqL4BSf2fR8npoJp/GHDD/17x3h3FUj0s9lBXwDmdu08ewczTuv7T66zqyEjQAt8z0BlTzi7c4pxKCrDDkGvMZ63OpKOLe10= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 176132056060031.217875446974517; Fri, 24 Oct 2025 08:42:40 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vCJuX-0008J5-Cp; Fri, 24 Oct 2025 11:41:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuS-0008He-Ki for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:57 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuR-0003Ot-48 for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:56 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-263-g3iU-CI2N-2bMSpiL-rF1A-1; Fri, 24 Oct 2025 11:40:50 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B38DE19560B8; Fri, 24 Oct 2025 15:40:48 +0000 (UTC) Received: from toolbx.redhat.com (unknown [10.42.28.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 589EE19540EB; Fri, 24 Oct 2025 15:40:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761320454; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JZB7OCoqm6b79w7L+YOt3iE+VCy+nmZflnF5z8stP38=; b=L6N0/ZVosRrpgOJspTjLqQ+4lB375IsXQmaCGmaZhbiCUjO8uxwlCOadYG89zJj0dM7Mu+ U6d1c5/rFAhjjSL8mjcWTAs8ZRTL6c5eNRve9KsSDnqski4S0l/nRYpgtlLiVInGl5dW1L 8xdIOsaa7ypM3TlDLTMewey/V6lYyTo= X-MC-Unique: g3iU-CI2N-2bMSpiL-rF1A-1 X-Mimecast-MFC-AGG-ID: g3iU-CI2N-2bMSpiL-rF1A_1761320449 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Eduardo Habkost , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Paolo Bonzini , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Eric Blake Subject: [PULL 08/13] crypto: remove extraneous pointer usage in gnutls certs Date: Fri, 24 Oct 2025 16:40:19 +0100 Message-ID: <20251024154024.227978-9-berrange@redhat.com> In-Reply-To: <20251024154024.227978-1-berrange@redhat.com> References: <20251024154024.227978-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1761320561564158500 The 'gnutls_x509_crt_t' type is already a pointer, not a struct, so the extra level of pointer indirection is not needed. Reviewed-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Eric Blake Signed-off-by: Daniel P. Berrang=C3=A9 --- crypto/tlscredsx509.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c index 3df2a33b0b..4169ad9a75 100644 --- a/crypto/tlscredsx509.c +++ b/crypto/tlscredsx509.c @@ -325,25 +325,25 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCre= dsX509 *creds, bool isCA, Error **errp) { - gnutls_x509_crt_t *cert_to_check =3D &cert; + gnutls_x509_crt_t cert_to_check =3D cert; bool checking_issuer =3D true; int retval =3D 0; =20 while (checking_issuer) { checking_issuer =3D false; =20 - if (gnutls_x509_crt_check_issuer(*cert_to_check, - *cert_to_check)) { + if (gnutls_x509_crt_check_issuer(cert_to_check, + cert_to_check)) { /* * The cert is self-signed indicating we have * reached the root of trust. */ return qcrypto_tls_creds_check_cert( - creds, *cert_to_check, cacertFile, + creds, cert_to_check, cacertFile, isServer, isCA, errp); } for (int i =3D 0; i < ncacerts; i++) { - if (gnutls_x509_crt_check_issuer(*cert_to_check, + if (gnutls_x509_crt_check_issuer(cert_to_check, cacerts[i])) { retval =3D qcrypto_tls_creds_check_cert( creds, cacerts[i], cacertFile, @@ -351,7 +351,7 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCreds= X509 *creds, if (retval < 0) { return retval; } - cert_to_check =3D &cacerts[i]; + cert_to_check =3D cacerts[i]; checking_issuer =3D true; break; } --=20 2.50.1 From nobody Mon Oct 27 11:12:36 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1761320493; cv=none; d=zohomail.com; s=zohoarc; b=CcZE/CN2/v947J0wIe5UZZzi96RitgmVsWE3z/PYLfXnEEQsEgsCc6lFp6qoudqLr7HyVkzGiGOWop+6dAzK5D2Z5fMNAN6scLjYCoOWl818N4n7jM38mEb6Kwr9dL0TtnVmkiENqjdN/NKM9ml0LvSL8j6qdTOIWdb9NZAf9zk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761320493; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=4U13DS84vu8fdAZLnmbcdTQZOB+68oeOMig+2Pdendk=; b=Ftt5WJ8DUPrKpqzcsaR7VkLsADl+48GOYanC8U4azzWhKEkZA+cQT8RPIWfytrdWRBctVNCtHciiIzwBeSHLWY87jigZdEruRYlRhs/Lh6N0iRhP9CEWEhbchR/BSY5eOTZotzHkz0dIOP1/LTQkL1g3uxMLVcVNXN0HoBVJGm0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761320493468790.2347424151452; Fri, 24 Oct 2025 08:41:33 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vCJuV-0008IY-Tb; Fri, 24 Oct 2025 11:41:00 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuT-0008Hq-Dt for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:57 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuR-0003P1-L4 for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:40:56 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-374-fuftHBWDPWyNt-db7-FXZA-1; Fri, 24 Oct 2025 11:40:52 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 79B9E180035D; Fri, 24 Oct 2025 15:40:51 +0000 (UTC) Received: from toolbx.redhat.com (unknown [10.42.28.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 1F79919540EB; Fri, 24 Oct 2025 15:40:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761320455; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=4U13DS84vu8fdAZLnmbcdTQZOB+68oeOMig+2Pdendk=; b=YfeobRlIwnIQIR4Mvm5qhHQd4hm8yGCXROOl08yoQ4ZjZyhvHNgaYrTL9SLCZQ612cYwfk pGF1ObRxKTWFMcLxFEkkqJ22D9M2Nk39KxN6jkfnVGwq9qds9EF0wMfMSS8HdGQZwBTqTe DC+HyAxs4/MNvjZBA9LTOKpVZH4HA1o= X-MC-Unique: fuftHBWDPWyNt-db7-FXZA-1 X-Mimecast-MFC-AGG-ID: fuftHBWDPWyNt-db7-FXZA_1761320451 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Eduardo Habkost , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Paolo Bonzini , Eric Blake , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Subject: [PULL 09/13] crypto: validate an error is reported in test expected fails Date: Fri, 24 Oct 2025 16:40:20 +0100 Message-ID: <20251024154024.227978-10-berrange@redhat.com> In-Reply-To: <20251024154024.227978-1-berrange@redhat.com> References: <20251024154024.227978-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1761320496824158500 There was a bug where TLS x509 credentials validation failed to fill out the Error object. Validate this in the failure scenarios. Reviewed-by: Eric Blake Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Daniel P. Berrang=C3=A9 --- tests/unit/test-crypto-tlscredsx509.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tests/unit/test-crypto-tlscredsx509.c b/tests/unit/test-crypto= -tlscredsx509.c index a7ea5f422d..85f51aee1b 100644 --- a/tests/unit/test-crypto-tlscredsx509.c +++ b/tests/unit/test-crypto-tlscredsx509.c @@ -73,6 +73,7 @@ static void test_tls_creds(const void *opaque) struct QCryptoTLSCredsTestData *data =3D (struct QCryptoTLSCredsTestData *)opaque; QCryptoTLSCreds *creds; + Error *err =3D NULL; =20 #define CERT_DIR "tests/test-crypto-tlscredsx509-certs/" g_mkdir_with_parents(CERT_DIR, 0700); @@ -111,10 +112,12 @@ static void test_tls_creds(const void *opaque) QCRYPTO_TLS_CREDS_ENDPOINT_SERVER : QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT), CERT_DIR, - data->expectFail ? NULL : &error_abort); + data->expectFail ? &err : &error_abort); =20 if (data->expectFail) { g_assert(creds =3D=3D NULL); + g_assert(err !=3D NULL); + error_free(err); } else { g_assert(creds !=3D NULL); } --=20 2.50.1 From nobody Mon Oct 27 11:12:36 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1761320487; cv=none; d=zohomail.com; s=zohoarc; b=AFjG4whlbG66xp6mXvGpXgrENteQfy+xPOwa09lOqetFNPfq00nGMSzee5wx90gcZj67pxwTMYsgyq/tTIqyfAhDO8kZlLhTuVVr8dYP58OJasSDOkygJ9saQquIg0Dla75AsocYp1zw+QgyQVlzplDTbmryITCTGnxTr3ObMNg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761320487; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=/OXOtC2OQD8lPutBqcaoCBpArL8Uq5/+PRqSib4ESnE=; b=luWbPUm6vHPs6SB1wNx9hTV20Qh4flc2448f4WH35DFLuZN5AGjj7pxHisn7aCngOTfp1ECJkyqewHlmLXCGzhfdCnOsQzVmZxCx1rxGy1t7CwaXLPEm8XrSxjonwb2RCSHh413c+fK2Sv44P/essurRLsu/nQdF4FRvpLmn3D8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761320487715804.4077239805754; Fri, 24 Oct 2025 08:41:27 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vCJuc-0008KF-G1; Fri, 24 Oct 2025 11:41:06 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuX-0008J6-DI for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:41:01 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuV-0003PV-NF for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:41:01 -0400 Received: from mx-prod-mc-02.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-548-iL0Ih1KjN223oqvvT1hmLQ-1; Fri, 24 Oct 2025 11:40:55 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-02.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id A0E3019560BB; Fri, 24 Oct 2025 15:40:53 +0000 (UTC) Received: from toolbx.redhat.com (unknown [10.42.28.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id DA45419540EB; Fri, 24 Oct 2025 15:40:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761320458; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/OXOtC2OQD8lPutBqcaoCBpArL8Uq5/+PRqSib4ESnE=; b=ZsH91JgjnSCzXjn4dpB9fxFUoOwU5YLtYvXR7Q4iwb9PKYXKPVzOH0FwxZHKLM+xsOn3vO 7TVohuAJRNi6zHoX/CZURic1B3Hw2XQkbulRGlzpgtDJJmMSVIepNV4B+GXhcUbb96Uuxn ApsOwfF0cXvYX4BmZuXIBmPNVMcMFXw= X-MC-Unique: iL0Ih1KjN223oqvvT1hmLQ-1 X-Mimecast-MFC-AGG-ID: iL0Ih1KjN223oqvvT1hmLQ_1761320453 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Eduardo Habkost , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Paolo Bonzini , Eric Blake Subject: [PULL 10/13] crypto: fix error reporting in cert chain checks Date: Fri, 24 Oct 2025 16:40:21 +0100 Message-ID: <20251024154024.227978-11-berrange@redhat.com> In-Reply-To: <20251024154024.227978-1-berrange@redhat.com> References: <20251024154024.227978-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1761320496878158500 The loop that checks the CA certificate chain can fail to report an error message if one of the certs in the chain has an issuer that is not present in the chain. In this case, the outer loop 'while (checking_issuer)' will terminate after failing to find the issuer, and no error message will be reported. Reviewed-by: Eric Blake Signed-off-by: Daniel P. Berrang=C3=A9 --- crypto/tlscredsx509.c | 33 ++++++++++++++++++--------- tests/unit/test-crypto-tlscredsx509.c | 12 ++++++++++ 2 files changed, 34 insertions(+), 11 deletions(-) diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c index 4169ad9a75..2eccd71b3c 100644 --- a/crypto/tlscredsx509.c +++ b/crypto/tlscredsx509.c @@ -326,11 +326,11 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCre= dsX509 *creds, Error **errp) { gnutls_x509_crt_t cert_to_check =3D cert; - bool checking_issuer =3D true; int retval =3D 0; + gnutls_datum_t dn =3D {}; =20 - while (checking_issuer) { - checking_issuer =3D false; + for (;;) { + gnutls_x509_crt_t cert_issuer =3D NULL; =20 if (gnutls_x509_crt_check_issuer(cert_to_check, cert_to_check)) { @@ -345,19 +345,30 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCre= dsX509 *creds, for (int i =3D 0; i < ncacerts; i++) { if (gnutls_x509_crt_check_issuer(cert_to_check, cacerts[i])) { - retval =3D qcrypto_tls_creds_check_cert( - creds, cacerts[i], cacertFile, - isServer, isCA, errp); - if (retval < 0) { - return retval; - } - cert_to_check =3D cacerts[i]; - checking_issuer =3D true; + cert_issuer =3D cacerts[i]; break; } } + if (!cert_issuer) { + break; + } + + if (qcrypto_tls_creds_check_cert(creds, cert_issuer, cacertFile, + isServer, isCA, errp) < 0) { + return -1; + } + + cert_to_check =3D cert_issuer; } =20 + retval =3D gnutls_x509_crt_get_dn2(cert_to_check, &dn); + if (retval < 0) { + error_setg(errp, "Unable to fetch cert DN: %s", + gnutls_strerror(retval)); + return -1; + } + error_setg(errp, "Cert '%s' has no issuer in CA chain", dn.data); + g_free(dn.data); return -1; } =20 diff --git a/tests/unit/test-crypto-tlscredsx509.c b/tests/unit/test-crypto= -tlscredsx509.c index 85f51aee1b..7c5df32bcc 100644 --- a/tests/unit/test-crypto-tlscredsx509.c +++ b/tests/unit/test-crypto-tlscredsx509.c @@ -643,6 +643,15 @@ int main(int argc, char **argv) certchain_with_invalid, G_N_ELEMENTS(certchain_with_invalid)); =20 + gnutls_x509_crt_t certchain_incomplete[] =3D { + cacertrootreq.crt, + cacertlevel2areq.crt, + }; + + test_tls_write_cert_chain(WORKDIR "cacertchain-incomplete-ctx.pem", + certchain_incomplete, + G_N_ELEMENTS(certchain_incomplete)); + TLS_TEST_REG(chain1, true, WORKDIR "cacertchain-ctx.pem", servercertlevel3areq.filename, false); @@ -652,6 +661,9 @@ int main(int argc, char **argv) TLS_TEST_REG(certchainwithexpiredcert, false, WORKDIR "cacertchain-with-invalid-ctx.pem", clientcertlevel2breq.filename, false); + TLS_TEST_REG(chainincomplete, true, + WORKDIR "cacertchain-incomplete-ctx.pem", + servercertlevel3areq.filename, true); =20 /* Some missing certs - first two are fatal, the last * is ok --=20 2.50.1 From nobody Mon Oct 27 11:12:36 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1761320513; cv=none; d=zohomail.com; s=zohoarc; b=IuxrLu+jU7K0Az6Ss/wps6YRot0dSGNx3+Eel1Sgg636h0OijvzpFkfUtpmDac+XdB4QiN7kmnI0iwralTvlGBNlLCBFRXYkEJvddK4Gw8CBR+qCsManrQR4eEyEEdRAKrAF94ZgO3AnPmYzWDscdsDOxAGrNRFZ1/pQh8gx/ag= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761320513; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Fgzo4ksGz0Ip8L/XAjnt655h1h1Bh2ciF0Js++tR7Fo=; b=A0Ezt2wsnAjA//aBsPWJoDTzT/oTMIonox0x5RuIaj7iSJyJVfj41ApsJl5xTxsZHnIRAkIqmh0bTQSb7879VrX2mErZjnSJ+NFdqAXzI1OfUpjpuiWN3hB83bvOuw9tjLrth7UqUjBRNOqQYDWcmx1fLjldJpWy0sGjnLKQYcs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761320513513205.8985805703926; Fri, 24 Oct 2025 08:41:53 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vCJua-0008Jw-5V; Fri, 24 Oct 2025 11:41:04 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuX-0008JI-P9 for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:41:01 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuV-0003PS-I7 for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:41:01 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-148-dsrNz3g2NHC5eWlJyyJwAw-1; Fri, 24 Oct 2025 11:40:57 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 13DD81955F56; Fri, 24 Oct 2025 15:40:56 +0000 (UTC) Received: from toolbx.redhat.com (unknown [10.42.28.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 2334719540EB; Fri, 24 Oct 2025 15:40:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761320458; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Fgzo4ksGz0Ip8L/XAjnt655h1h1Bh2ciF0Js++tR7Fo=; b=K5PpsogPMc5YAp086YEywT+haH6QeaLjVmbjebPpkejjd+xMS7gyEO7WcOl7iaS2UiObh1 mBkKcpgnT2kFm/+aIe8NiTOqvLEyOkzv5xI7bgWGAvmHzbxv/PqiYYs48o2u/KizzLQMXA +knrPSA4AlAeBXscVDyUkkX7iqJINiQ= X-MC-Unique: dsrNz3g2NHC5eWlJyyJwAw-1 X-Mimecast-MFC-AGG-ID: dsrNz3g2NHC5eWlJyyJwAw_1761320456 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Eduardo Habkost , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Paolo Bonzini , Eric Blake , matoro Subject: [PULL 11/13] crypto: allow client/server cert chains Date: Fri, 24 Oct 2025 16:40:22 +0100 Message-ID: <20251024154024.227978-12-berrange@redhat.com> In-Reply-To: <20251024154024.227978-1-berrange@redhat.com> References: <20251024154024.227978-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1761320515125158501 From: matoro The existing implementation assumes that client/server certificates are single individual certificates. If using publicly-issued certificates, or internal CAs that use an intermediate issuer, this is unlikely to be the case, and they will instead be certificate chains. While this can be worked around by moving the intermediate certificates to the CA certificate, which DOES currently support multiple certificates, this instead allows the issued certificate chains to be used as-is, without requiring the overhead of shuffling certificates around. Corresponding libvirt change is available here: https://gitlab.com/libvirt/libvirt/-/merge_requests/222 Reviewed-by: Daniel P. Berrang=C3=A9 Reviewed-by: Eric Blake Signed-off-by: matoro [DB: adapted for code conflicts with multi-CA patch] Signed-off-by: Daniel P. Berrang=C3=A9 --- crypto/tlscredsx509.c | 157 ++++++++++++-------------- tests/unit/test-crypto-tlscredsx509.c | 77 +++++++++++++ 2 files changed, 147 insertions(+), 87 deletions(-) diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c index 2eccd71b3c..86fdfce886 100644 --- a/crypto/tlscredsx509.c +++ b/crypto/tlscredsx509.c @@ -317,7 +317,8 @@ qcrypto_tls_creds_check_cert(QCryptoTLSCredsX509 *creds, =20 static int qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds, - gnutls_x509_crt_t cert, + gnutls_x509_crt_t *certs, + unsigned int ncerts, gnutls_x509_crt_t *cacerts, unsigned int ncacerts, const char *cacertFile, @@ -325,9 +326,32 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCred= sX509 *creds, bool isCA, Error **errp) { - gnutls_x509_crt_t cert_to_check =3D cert; + gnutls_x509_crt_t cert_to_check =3D certs[ncerts - 1]; int retval =3D 0; - gnutls_datum_t dn =3D {}; + gnutls_datum_t dn =3D {}, dnissuer =3D {}; + + for (int i =3D 0; i < (ncerts - 1); i++) { + if (!gnutls_x509_crt_check_issuer(certs[i], certs[i + 1])) { + retval =3D gnutls_x509_crt_get_dn2(certs[i], &dn); + if (retval < 0) { + error_setg(errp, "Unable to fetch cert DN: %s", + gnutls_strerror(retval)); + return -1; + } + retval =3D gnutls_x509_crt_get_dn2(certs[i + 1], &dnissuer); + if (retval < 0) { + g_free(dn.data); + error_setg(errp, "Unable to fetch cert DN: %s", + gnutls_strerror(retval)); + return -1; + } + error_setg(errp, "Cert '%s' does not match issuer of cert '%s'= ", + dnissuer.data, dn.data); + g_free(dn.data); + g_free(dnissuer.data); + return -1; + } + } =20 for (;;) { gnutls_x509_crt_t cert_issuer =3D NULL; @@ -373,7 +397,8 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCreds= X509 *creds, } =20 static int -qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t cert, +qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t *certs, + size_t ncerts, const char *certFile, gnutls_x509_crt_t *cacerts, size_t ncacerts, @@ -383,7 +408,7 @@ qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t cer= t, { unsigned int status; =20 - if (gnutls_x509_crt_list_verify(&cert, 1, + if (gnutls_x509_crt_list_verify(certs, ncerts, cacerts, ncacerts, NULL, 0, 0, &status) < 0) { @@ -425,66 +450,14 @@ qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t c= ert, } =20 =20 -static gnutls_x509_crt_t -qcrypto_tls_creds_load_cert(QCryptoTLSCredsX509 *creds, - const char *certFile, - bool isServer, - Error **errp) -{ - gnutls_datum_t data; - gnutls_x509_crt_t cert =3D NULL; - g_autofree char *buf =3D NULL; - gsize buflen; - GError *gerr =3D NULL; - int ret =3D -1; - int err; - - trace_qcrypto_tls_creds_x509_load_cert(creds, isServer, certFile); - - err =3D gnutls_x509_crt_init(&cert); - if (err < 0) { - error_setg(errp, "Unable to initialize certificate: %s", - gnutls_strerror(err)); - goto cleanup; - } - - if (!g_file_get_contents(certFile, &buf, &buflen, &gerr)) { - error_setg(errp, "Cannot load CA cert list %s: %s", - certFile, gerr->message); - g_error_free(gerr); - goto cleanup; - } - - data.data =3D (unsigned char *)buf; - data.size =3D strlen(buf); - - err =3D gnutls_x509_crt_import(cert, &data, GNUTLS_X509_FMT_PEM); - if (err < 0) { - error_setg(errp, isServer ? - "Unable to import server certificate %s: %s" : - "Unable to import client certificate %s: %s", - certFile, - gnutls_strerror(err)); - goto cleanup; - } - - ret =3D 0; - - cleanup: - if (ret !=3D 0) { - gnutls_x509_crt_deinit(cert); - cert =3D NULL; - } - return cert; -} - - static int -qcrypto_tls_creds_load_ca_cert_list(QCryptoTLSCredsX509 *creds, - const char *certFile, - gnutls_x509_crt_t **certs, - unsigned int *ncerts, - Error **errp) +qcrypto_tls_creds_load_cert_list(QCryptoTLSCredsX509 *creds, + const char *certFile, + gnutls_x509_crt_t **certs, + unsigned int *ncerts, + bool isServer, + bool isCA, + Error **errp) { gnutls_datum_t data; g_autofree char *buf =3D NULL; @@ -507,7 +480,9 @@ qcrypto_tls_creds_load_ca_cert_list(QCryptoTLSCredsX509= *creds, if (gnutls_x509_crt_list_import2(certs, ncerts, &data, GNUTLS_X509_FMT_PEM, 0) < 0) { error_setg(errp, - "Unable to import CA certificate list %s", + isCA ? "Unable to import CA certificate list %s" : + (isServer ? "Unable to import server certificate %s" : + "Unable to import client certificate %s"), certFile); return -1; } @@ -523,7 +498,8 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509= *creds, const char *certFile, Error **errp) { - gnutls_x509_crt_t cert =3D NULL; + gnutls_x509_crt_t *certs =3D NULL; + unsigned int ncerts =3D 0; gnutls_x509_crt_t *cacerts =3D NULL; unsigned int ncacerts =3D 0; size_t i; @@ -531,41 +507,48 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX5= 09 *creds, =20 if (certFile && access(certFile, R_OK) =3D=3D 0) { - cert =3D qcrypto_tls_creds_load_cert(creds, - certFile, isServer, - errp); - if (!cert) { + if (qcrypto_tls_creds_load_cert_list(creds, + certFile, + &certs, + &ncerts, + isServer, + false, + errp) < 0) { goto cleanup; } } if (access(cacertFile, R_OK) =3D=3D 0) { - if (qcrypto_tls_creds_load_ca_cert_list(creds, - cacertFile, - &cacerts, - &ncacerts, - errp) < 0) { + if (qcrypto_tls_creds_load_cert_list(creds, + cacertFile, + &cacerts, + &ncacerts, + isServer, + true, + errp) < 0) { goto cleanup; } } =20 - if (cert && - qcrypto_tls_creds_check_cert(creds, - cert, certFile, isServer, - false, errp) < 0) { - goto cleanup; + for (i =3D 0; i < ncerts; i++) { + if (qcrypto_tls_creds_check_cert(creds, + certs[i], certFile, + isServer, i !=3D 0, errp) < 0) { + goto cleanup; + } } =20 - if (cert && - qcrypto_tls_creds_check_authority_chain(creds, cert, + if (ncerts && + qcrypto_tls_creds_check_authority_chain(creds, + certs, ncerts, cacerts, ncacerts, cacertFile, isServer, true, errp) < 0) { goto cleanup; } =20 - if (cert && ncacerts && - qcrypto_tls_creds_check_cert_pair(cert, certFile, cacerts, - ncacerts, cacertFile, + if (ncerts && ncacerts && + qcrypto_tls_creds_check_cert_pair(certs, ncerts, certFile, + cacerts, ncacerts, cacertFile, isServer, errp) < 0) { goto cleanup; } @@ -573,8 +556,8 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509= *creds, ret =3D 0; =20 cleanup: - if (cert) { - gnutls_x509_crt_deinit(cert); + for (i =3D 0; i < ncerts; i++) { + gnutls_x509_crt_deinit(certs[i]); } for (i =3D 0; i < ncacerts; i++) { gnutls_x509_crt_deinit(cacerts[i]); diff --git a/tests/unit/test-crypto-tlscredsx509.c b/tests/unit/test-crypto= -tlscredsx509.c index 7c5df32bcc..96ad4e741b 100644 --- a/tests/unit/test-crypto-tlscredsx509.c +++ b/tests/unit/test-crypto-tlscredsx509.c @@ -580,6 +580,12 @@ int main(int argc, char **argv) true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); + TLS_ROOT_REQ(someotherrootreq, + "UK", "some other random CA", NULL, NULL, NULL, NULL, + true, true, true, + true, true, GNUTLS_KEY_KEY_CERT_SIGN, + false, false, NULL, NULL, + 0, 0); TLS_CERT_REQ(cacertlevel1areq, cacertrootreq, "UK", "qemu level 1a", NULL, NULL, NULL, NULL, true, true, true, @@ -626,6 +632,32 @@ int main(int argc, char **argv) cacertlevel2areq.crt, }; =20 + gnutls_x509_crt_t cabundle[] =3D { + someotherrootreq.crt, + cacertrootreq.crt, + }; + + gnutls_x509_crt_t servercertchain[] =3D { + servercertlevel3areq.crt, + cacertlevel2areq.crt, + cacertlevel1areq.crt, + }; + + gnutls_x509_crt_t servercertchain_incomplete[] =3D { + servercertlevel3areq.crt, + cacertlevel2areq.crt, + }; + + gnutls_x509_crt_t servercertchain_unsorted[] =3D { + servercertlevel3areq.crt, + cacertlevel1areq.crt, + cacertlevel2areq.crt, + }; + + gnutls_x509_crt_t clientcertchain[] =3D { + clientcertlevel2breq.crt, + cacertlevel1breq.crt, + }; =20 test_tls_write_cert_chain(WORKDIR "cacertchain-ctx.pem", certchain, @@ -665,6 +697,46 @@ int main(int argc, char **argv) WORKDIR "cacertchain-incomplete-ctx.pem", servercertlevel3areq.filename, true); =20 + test_tls_write_cert_chain(WORKDIR "servercertchain-ctx.pem", + servercertchain, + G_N_ELEMENTS(servercertchain)); + + TLS_TEST_REG(serverchain, true, + cacertrootreq.filename, + WORKDIR "servercertchain-ctx.pem", false); + + test_tls_write_cert_chain(WORKDIR "cabundle-ctx.pem", + cabundle, + G_N_ELEMENTS(cabundle)); + + TLS_TEST_REG(multiplecaswithchain, true, + WORKDIR "cabundle-ctx.pem", + WORKDIR "servercertchain-ctx.pem", false); + + test_tls_write_cert_chain(WORKDIR "servercertchain_incomplete-ctx.pem", + servercertchain_incomplete, + G_N_ELEMENTS(servercertchain_incomplete)); + + TLS_TEST_REG(incompleteserverchain, true, + cacertrootreq.filename, + WORKDIR "servercertchain_incomplete-ctx.pem", true); + + test_tls_write_cert_chain(WORKDIR "servercertchain_unsorted-ctx.pem", + servercertchain_unsorted, + G_N_ELEMENTS(servercertchain_unsorted)); + + TLS_TEST_REG(unsortedserverchain, true, + cacertrootreq.filename, + WORKDIR "servercertchain_unsorted-ctx.pem", true); + + test_tls_write_cert_chain(WORKDIR "clientcertchain-ctx.pem", + clientcertchain, + G_N_ELEMENTS(clientcertchain)); + + TLS_TEST_REG(clientchain, false, + cacertrootreq.filename, + WORKDIR "clientcertchain-ctx.pem", false); + /* Some missing certs - first two are fatal, the last * is ok */ @@ -734,8 +806,13 @@ int main(int argc, char **argv) test_tls_discard_cert(&cacertlevel2areq); test_tls_discard_cert(&servercertlevel3areq); test_tls_discard_cert(&clientcertlevel2breq); + test_tls_discard_cert(&someotherrootreq); unlink(WORKDIR "cacertchain-ctx.pem"); unlink(WORKDIR "cacertchain-with-invalid-ctx.pem"); + unlink(WORKDIR "servercertchain-ctx.pem"); + unlink(WORKDIR "servercertchain_incomplete-ctx.pem"); + unlink(WORKDIR "servercertchain_unsorted-ctx.pem"); + unlink(WORKDIR "clientcertchain-ctx.pem"); =20 test_tls_cleanup(KEYFILE); rmdir(WORKDIR); --=20 2.50.1 From nobody Mon Oct 27 11:12:36 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1761320489; cv=none; d=zohomail.com; s=zohoarc; b=BV3XrT+WNETR8QP/2U/rDNKez7l1xHWgPH8HCJ5YXqznd3lsFNpYKpO3OG+qh7vf6KROUW1nniXNOaqeaTtRBktUQsEMvT0n+S1pS+1T/txd5T3vn6yV1XNn+fSwcQkoB4mYgt1wzy9Q1E6yS5vrxfMrWBAuVhNdvg+LT4vfHEQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761320489; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=W2T13O8cObaQBpzUwPIO20hdZf6jSG5GUjAv9ASfTGo=; b=KVMmAma0PrK4osF0CNy3eQ+wlY/bTA59bV1Eepyp+ksR6DLYayjJPP6ieK8iOFqWEWLR5TlXilOHDcdoV0vhUFvMvmDfLwmuqSoF16E3Lh+qTay0PLRZupjbSCh33xbz0b8VJM1GYjztQt3bKUKe10i0CBNjVtr/lm6gnn8Lzhg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761320489450365.5342244957569; Fri, 24 Oct 2025 08:41:29 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vCJue-0008Ks-G0; Fri, 24 Oct 2025 11:41:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJuc-0008KU-Lx for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:41:06 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJua-0003QH-Da for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:41:06 -0400 Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-249-Y_ucK_u9Mwi5P3ciLgI4Dg-1; Fri, 24 Oct 2025 11:40:59 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id EFA83196F764; Fri, 24 Oct 2025 15:40:58 +0000 (UTC) Received: from toolbx.redhat.com (unknown [10.42.28.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id AC64019540EB; Fri, 24 Oct 2025 15:40:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761320463; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=W2T13O8cObaQBpzUwPIO20hdZf6jSG5GUjAv9ASfTGo=; b=RWSSWcXTuXaH1DwUGoUVtiK2OmWQwCF/oKOzlPxIm2eslHDcfbjxCQTm9fhkWJOeytWFYB lxCHCoA9snuYO68iL6eoOnJxWSSBogt4b+WtNEet8dsZUJ3ZMM9+pOJFC0s+VZVXjDifa4 XjM+Po0HZC/D9xtpia42a7cZXq6ce8E= X-MC-Unique: Y_ucK_u9Mwi5P3ciLgI4Dg-1 X-Mimecast-MFC-AGG-ID: Y_ucK_u9Mwi5P3ciLgI4Dg_1761320459 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Eduardo Habkost , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Paolo Bonzini , Eric Blake Subject: [PULL 12/13] crypto: stop requiring "key encipherment" usage in x509 certs Date: Fri, 24 Oct 2025 16:40:23 +0100 Message-ID: <20251024154024.227978-13-berrange@redhat.com> In-Reply-To: <20251024154024.227978-1-berrange@redhat.com> References: <20251024154024.227978-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1761320492804158500 This usage flag was deprecated by RFC8813, such that it is forbidden to be present for certs using ECDSA/ECDH algorithms, and in TLS 1.3 is conceptually obsolete. As such many valid certs will no longer have this key usage flag set, and QEMU should not be rejecting them, as this prevents use of otherwise valid & desirable algorithms. Reviewed-by: Eric Blake Signed-off-by: Daniel P. Berrang=C3=A9 --- crypto/tlscredsx509.c | 10 +------- docs/system/tls.rst | 13 +++------- tests/unit/crypto-tls-x509-helpers.h | 6 ++--- tests/unit/test-crypto-tlscredsx509.c | 36 +++++++++++++-------------- tests/unit/test-crypto-tlssession.c | 14 +++++------ tests/unit/test-io-channel-tls.c | 4 +-- 6 files changed, 34 insertions(+), 49 deletions(-) diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c index 86fdfce886..db2b74bafa 100644 --- a/crypto/tlscredsx509.c +++ b/crypto/tlscredsx509.c @@ -144,7 +144,7 @@ qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCredsX= 509 *creds, if (status < 0) { if (status =3D=3D GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) { usage =3D isCA ? GNUTLS_KEY_KEY_CERT_SIGN : - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT; + GNUTLS_KEY_DIGITAL_SIGNATURE; } else { error_setg(errp, "Unable to query certificate %s key usage: %s", @@ -171,14 +171,6 @@ qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCreds= X509 *creds, return -1; } } - if (!(usage & GNUTLS_KEY_KEY_ENCIPHERMENT)) { - if (critical) { - error_setg(errp, - "Certificate %s usage does not permit key " - "encipherment", certFile); - return -1; - } - } } =20 return 0; diff --git a/docs/system/tls.rst b/docs/system/tls.rst index e284c82801..a4f6781d62 100644 --- a/docs/system/tls.rst +++ b/docs/system/tls.rst @@ -118,7 +118,6 @@ information for each server, and use it to issue server= certificates. ip_address =3D 2620:0:cafe::87 ip_address =3D 2001:24::92 tls_www_server - encryption_key signing_key EOF # certtool --generate-privkey > server-hostNNN-key.pem @@ -134,9 +133,8 @@ the subject alt name extension data. The ``tls_www_serv= er`` keyword is the key purpose extension to indicate this certificate is intended for usage in a web server. Although QEMU network services are not in fact HTTP servers (except for VNC websockets), setting this key purpose is -still recommended. The ``encryption_key`` and ``signing_key`` keyword is -the key usage extension to indicate this certificate is intended for -usage in the data session. +still recommended. The ``signing_key`` keyword is the key usage extension +to indicate this certificate is intended for usage in the data session. =20 The ``server-hostNNN-key.pem`` and ``server-hostNNN-cert.pem`` files should now be securely copied to the server for which they were @@ -171,7 +169,6 @@ certificates. organization =3D Name of your organization cn =3D hostNNN.foo.example.com tls_www_client - encryption_key signing_key EOF # certtool --generate-privkey > client-hostNNN-key.pem @@ -187,9 +184,8 @@ the ``dns_name`` and ``ip_address`` fields are not incl= uded. The ``tls_www_client`` keyword is the key purpose extension to indicate this certificate is intended for usage in a web client. Although QEMU network clients are not in fact HTTP clients, setting this key purpose is still -recommended. The ``encryption_key`` and ``signing_key`` keyword is the -key usage extension to indicate this certificate is intended for usage -in the data session. +recommended. The ``signing_key`` keyword is the key usage extension to +indicate this certificate is intended for usage in the data session. =20 The ``client-hostNNN-key.pem`` and ``client-hostNNN-cert.pem`` files should now be securely copied to the client for which they were @@ -222,7 +218,6 @@ client and server instructions in one. ip_address =3D 2001:24::92 tls_www_server tls_www_client - encryption_key signing_key EOF # certtool --generate-privkey > both-hostNNN-key.pem diff --git a/tests/unit/crypto-tls-x509-helpers.h b/tests/unit/crypto-tls-x= 509-helpers.h index 2a0f7c04fd..7e9a508ad6 100644 --- a/tests/unit/crypto-tls-x509-helpers.h +++ b/tests/unit/crypto-tls-x509-helpers.h @@ -148,8 +148,7 @@ void test_tls_cleanup(const char *keyfile); .basicConstraintsIsCA =3D false, \ .keyUsageEnable =3D true, \ .keyUsageCritical =3D true, \ - .keyUsageValue =3D \ - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, \ + .keyUsageValue =3D GNUTLS_KEY_DIGITAL_SIGNATURE, \ .keyPurposeEnable =3D true, \ .keyPurposeCritical =3D true, \ .keyPurposeOID1 =3D GNUTLS_KP_TLS_WWW_CLIENT, \ @@ -168,8 +167,7 @@ void test_tls_cleanup(const char *keyfile); .basicConstraintsIsCA =3D false, \ .keyUsageEnable =3D true, \ .keyUsageCritical =3D true, \ - .keyUsageValue =3D \ - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, \ + .keyUsageValue =3D GNUTLS_KEY_DIGITAL_SIGNATURE, \ .keyPurposeEnable =3D true, \ .keyPurposeCritical =3D true, \ .keyPurposeOID1 =3D GNUTLS_KP_TLS_WWW_SERVER, \ diff --git a/tests/unit/test-crypto-tlscredsx509.c b/tests/unit/test-crypto= -tlscredsx509.c index 96ad4e741b..a5f21728d4 100644 --- a/tests/unit/test-crypto-tlscredsx509.c +++ b/tests/unit/test-crypto-tlscredsx509.c @@ -169,14 +169,14 @@ int main(int argc, char **argv) "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(clientcertreq, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); =20 @@ -199,7 +199,7 @@ int main(int argc, char **argv) "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); =20 @@ -214,7 +214,7 @@ int main(int argc, char **argv) "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); =20 @@ -229,7 +229,7 @@ int main(int argc, char **argv) "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); =20 @@ -253,7 +253,7 @@ int main(int argc, char **argv) "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* no-basic */ @@ -267,7 +267,7 @@ int main(int argc, char **argv) "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* Key usage:dig-sig:critical */ @@ -281,7 +281,7 @@ int main(int argc, char **argv) "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); =20 @@ -306,7 +306,7 @@ int main(int argc, char **argv) "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T | + GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); @@ -409,7 +409,7 @@ int main(int argc, char **argv) "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T | + GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); @@ -511,21 +511,21 @@ int main(int argc, char **argv) "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(servercertexp1req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, -1); TLS_CERT_REQ(clientcertexp1req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, -1); =20 @@ -549,21 +549,21 @@ int main(int argc, char **argv) "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(servercertnew1req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 1, 2); TLS_CERT_REQ(clientcertnew1req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 1, 2); =20 @@ -614,14 +614,14 @@ int main(int argc, char **argv) "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq, "UK", "qemu client level 2b", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); =20 diff --git a/tests/unit/test-crypto-tlssession.c b/tests/unit/test-crypto-t= lssession.c index 61311cbe6e..d0baf3b304 100644 --- a/tests/unit/test-crypto-tlssession.c +++ b/tests/unit/test-crypto-tlssession.c @@ -472,14 +472,14 @@ int main(int argc, char **argv) "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(clientcertreq, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); =20 @@ -487,7 +487,7 @@ int main(int argc, char **argv) "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); =20 @@ -506,7 +506,7 @@ int main(int argc, char **argv) "192.168.122.1", "fec0::dead:beaf", true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* This intentionally doesn't replicate */ @@ -515,7 +515,7 @@ int main(int argc, char **argv) "192.168.122.1", "fec0::dead:beaf", true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); =20 @@ -619,14 +619,14 @@ int main(int argc, char **argv) "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq, "UK", "qemu client level 2b", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); =20 diff --git a/tests/unit/test-io-channel-tls.c b/tests/unit/test-io-channel-= tls.c index 6f282ad45d..4e4034af67 100644 --- a/tests/unit/test-io-channel-tls.c +++ b/tests/unit/test-io-channel-tls.c @@ -302,14 +302,14 @@ int main(int argc, char **argv) "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(clientcertreq, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMEN= T, + GNUTLS_KEY_DIGITAL_SIGNATURE, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); =20 --=20 2.50.1 From nobody Mon Oct 27 11:12:36 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1761320555; cv=none; d=zohomail.com; s=zohoarc; b=I4tAXhka3VDOkynILPta1+UcpfbUHGra8OA2swquatPhGRGqewDG7b8cY0OprrTXCl8bWs4TcTqVj2g2LcQgUd6sxELbfHRpn/VLhX+99rx1QTZLUES4DrGovWQCt7B5j8rcVYLLDbCr3Ca9Y23v/jkwEucSk+Ks4CAscG1/juQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761320555; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=4Aun0N/wVasItP7YaAzv4+UXwONU7Qt1vFFTlbtlkBk=; b=Ksgi0y+rPvNer/ST00u3oQ6DkJhQWhVqI59NsXZGc254fAVZyZ0tUK/Tb0EOwl5lvSD7wKF6OLYnmw2vn4o5Hau51+LftyVv2TmwF6lTePMdmTGuN9JYHg3/V+AUM9BfkPXpQ3pDKtcm7MwSxjn0WzoPRFYpvYHYyamEWrQf43w= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761320555933584.4759693457692; Fri, 24 Oct 2025 08:42:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vCJui-0008Pn-6h; Fri, 24 Oct 2025 11:41:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJud-0008Kl-F8 for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:41:07 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vCJub-0003QT-Od for qemu-devel@nongnu.org; Fri, 24 Oct 2025 11:41:07 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-648-Ck-Ma1vANpmYYS368Ny7nA-1; Fri, 24 Oct 2025 11:41:02 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id A207819540E3; Fri, 24 Oct 2025 15:41:01 +0000 (UTC) Received: from toolbx.redhat.com (unknown [10.42.28.2]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id C68A419540EB; Fri, 24 Oct 2025 15:40:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761320465; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=4Aun0N/wVasItP7YaAzv4+UXwONU7Qt1vFFTlbtlkBk=; b=TlKpyv6C45yNQ5yt1s+L1T6vCiu/3mcaXV37FwTk5ar5Bmlb+Kz/j2iGvngw/+s3zjZVH9 V7UwA1d2GSyhtj/fhY8+lCcnGmT0SjX2GNiIbY6zNYSeBH8oDKg8mpfXFqooYSFOO17kG3 w3KChF4hqUcEJ6cFPDiT1hBrQ78SwkQ= X-MC-Unique: Ck-Ma1vANpmYYS368Ny7nA-1 X-Mimecast-MFC-AGG-ID: Ck-Ma1vANpmYYS368Ny7nA_1761320461 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Eduardo Habkost , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Paolo Bonzini , Eric Blake Subject: [PULL 13/13] crypto: switch to newer gnutls API for distinguished name Date: Fri, 24 Oct 2025 16:40:24 +0100 Message-ID: <20251024154024.227978-14-berrange@redhat.com> In-Reply-To: <20251024154024.227978-1-berrange@redhat.com> References: <20251024154024.227978-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1761320559463158500 The new API automatically allocates the right amount of memory to hold the distinguished name, avoiding the need to loop and realloc. Reviewed-by: Eric Blake Signed-off-by: Daniel P. Berrang=C3=A9 --- crypto/tlssession.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/crypto/tlssession.c b/crypto/tlssession.c index 8c0bf457ad..92fe4f0380 100644 --- a/crypto/tlssession.c +++ b/crypto/tlssession.c @@ -409,20 +409,14 @@ qcrypto_tls_session_check_certificate(QCryptoTLSSessi= on *session, } =20 if (i =3D=3D 0) { - size_t dnameSize =3D 1024; - session->peername =3D g_malloc(dnameSize); - requery: - ret =3D gnutls_x509_crt_get_dn(cert, session->peername, &dname= Size); + gnutls_datum_t dname =3D {}; + ret =3D gnutls_x509_crt_get_dn2(cert, &dname); if (ret < 0) { - if (ret =3D=3D GNUTLS_E_SHORT_MEMORY_BUFFER) { - session->peername =3D g_realloc(session->peername, - dnameSize); - goto requery; - } error_setg(errp, "Cannot get client distinguished name: %s= ", gnutls_strerror(ret)); goto error; } + session->peername =3D (char *)g_steal_pointer(&dname.data); if (session->authzid) { bool allow; =20 --=20 2.50.1