[PATCH v3 0/3] vnc: support reload x509 certificates

[PATCH v3 0/3] vnc: support reload x509 certificates

[Zihao Chang]

This series supports reload x509 certificates for vnc
1. Support reload x509 certificates.
2. Support reload vnc certificates.
3. Add new qmp display-reload and implement reload x509 certificates
for vnc.

Example:
{"execute": "display-reload", "arguments":{"vnc-tls-certs": true}}


Zihao Chang (3):
  crypto: add reload for QCryptoTLSCredsClass
  vnc: support reload x509 certificates for vnc
  qmp: add new qmp display-reload

 crypto/tlscredsx509.c     | 112 ++++++++++++++++++++++++++++++++++++++
 include/crypto/tlscreds.h |   8 ++-
 include/ui/console.h      |   1 +
 monitor/qmp-cmds.c        |  12 ++++
 qapi/ui.json              |  32 +++++++++++
 ui/vnc.c                  |  28 ++++++++++
 6 files changed, 190 insertions(+), 3 deletions(-)

-- 
2.28.0

[PATCH v3 1/3] crypto: add reload for QCryptoTLSCredsClass

[Zihao Chang]

This patch adds reload interface for QCryptoTLSCredsClass and implements
the interface for QCryptoTLSCredsX509.

Signed-off-by: Zihao Chang <changzihao1@huawei.com>
---
 crypto/tlscredsx509.c     | 112 ++++++++++++++++++++++++++++++++++++++
 include/crypto/tlscreds.h |   8 ++-
 2 files changed, 117 insertions(+), 3 deletions(-)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index dbadad4df28e..257106a33853 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -23,8 +23,10 @@
 #include "tlscredspriv.h"
 #include "crypto/secret.h"
 #include "qapi/error.h"
+#include "qapi/qmp/qstring.h"
 #include "qemu/module.h"
 #include "qom/object_interfaces.h"
+#include "qom/qom-qobject.h"
 #include "trace.h"
 
 
@@ -770,6 +772,113 @@ qcrypto_tls_creds_x509_prop_get_sanity(Object *obj,
 }
 
 
+#ifdef CONFIG_GNUTLS
+
+
+/*
+ * object_property_get_qobject() return "" for NULL QString,
+ * set NULL QString prop as "" is unsafe.
+ */
+static bool
+qcrypto_tls_creds_x509_need_set_prop(QObject *qobj)
+{
+    QString *qstring = qobject_to(QString, qobj);
+    /* prop type is not QString. */
+    if (!qstring) {
+        return true;
+    }
+
+    return strlen(qstring_get_str(qstring)) > 0;
+}
+
+
+static bool
+qcrypto_tls_creds_x509_copy_propertites(Object *new,
+                                        Object *old,
+                                        Error **errp)
+{
+    ObjectProperty *prop = NULL;
+    ObjectPropertyIterator iter;
+    Error *local_err = NULL;
+
+    object_property_iter_init(&iter, old);
+    while ((prop = object_property_iter_next(&iter)) && prop->set) {
+        QObject *value = NULL;
+        /* "loaded" depends on other props, copy it finally. */
+        if (g_strcmp0(prop->name, "loaded") == 0) {
+            continue;
+        }
+
+        value = object_property_get_qobject(old, prop->name, &local_err);
+        if (local_err) {
+            error_propagate(errp, local_err);
+            return false;
+        }
+
+        if (qcrypto_tls_creds_x509_need_set_prop(value)) {
+            object_property_set_qobject(new, prop->name, value, &local_err);
+            if (local_err) {
+                error_propagate(errp, local_err);
+                qobject_unref(value);
+                return false;
+            }
+        }
+        qobject_unref(value);
+    }
+
+    return true;
+}
+
+
+static bool
+qcrypto_tls_creds_x509_reload(QCryptoTLSCreds *creds, Error **errp)
+{
+    Object *old = OBJECT(creds);
+    QCryptoTLSCredsX509 *old_x509 = QCRYPTO_TLS_CREDS_X509(creds);
+    Object *new = object_new(TYPE_QCRYPTO_TLS_CREDS_X509);
+    QCryptoTLSCredsX509 *new_x509 = QCRYPTO_TLS_CREDS_X509(new);
+    Error *local_err = NULL;
+    bool ret = false;
+
+    if (!qcrypto_tls_creds_x509_copy_propertites(new, old, &local_err)) {
+        error_propagate(errp, local_err);
+        goto out;
+    }
+
+    qcrypto_tls_creds_x509_load(new_x509, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        goto out;
+    }
+
+    /* load new cert successfully, release old data and update */
+    qcrypto_tls_creds_x509_unload(old_x509);
+    old_x509->data = new_x509->data;
+    old_x509->parent_obj.dh_params = new_x509->parent_obj.dh_params;
+    new_x509->data = NULL;
+    new_x509->parent_obj.dh_params = NULL;
+
+    ret = true;
+
+ out:
+    object_unref(new);
+    return ret;
+}
+
+
+#else /* ! CONFIG_GNUTLS */
+
+
+static bool
+qcrypto_tls_creds_x509_reload(QCryptoTLSCreds *creds, Error **errp)
+{
+    return false;
+}
+
+
+#endif /* ! CONFIG_GNUTLS */
+
+
 static void
 qcrypto_tls_creds_x509_complete(UserCreatable *uc, Error **errp)
 {
@@ -800,6 +909,9 @@ static void
 qcrypto_tls_creds_x509_class_init(ObjectClass *oc, void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
+    QCryptoTLSCredsClass *ctcc = QCRYPTO_TLS_CREDS_CLASS(oc);
+
+    ctcc->reload = qcrypto_tls_creds_x509_reload;
 
     ucc->complete = qcrypto_tls_creds_x509_complete;
 
diff --git a/include/crypto/tlscreds.h b/include/crypto/tlscreds.h
index 079e37604784..d0808e391e91 100644
--- a/include/crypto/tlscreds.h
+++ b/include/crypto/tlscreds.h
@@ -30,14 +30,15 @@
 
 #define TYPE_QCRYPTO_TLS_CREDS "tls-creds"
 typedef struct QCryptoTLSCreds QCryptoTLSCreds;
-DECLARE_INSTANCE_CHECKER(QCryptoTLSCreds, QCRYPTO_TLS_CREDS,
-                         TYPE_QCRYPTO_TLS_CREDS)
-
 typedef struct QCryptoTLSCredsClass QCryptoTLSCredsClass;
+DECLARE_OBJ_CHECKERS(QCryptoTLSCreds, QCryptoTLSCredsClass, QCRYPTO_TLS_CREDS,
+                     TYPE_QCRYPTO_TLS_CREDS)
+
 
 #define QCRYPTO_TLS_CREDS_DH_PARAMS "dh-params.pem"
 
 
+typedef bool (*CryptoTLSCredsReload)(QCryptoTLSCreds *, Error **);
 /**
  * QCryptoTLSCreds:
  *
@@ -61,6 +62,7 @@ struct QCryptoTLSCreds {
 
 struct QCryptoTLSCredsClass {
     ObjectClass parent_class;
+    CryptoTLSCredsReload reload;
 };
 
 
-- 
2.28.0

[PATCH v3 2/3] vnc: support reload x509 certificates for vnc

[Zihao Chang]

This patch add vnc_display_reload_certs() to support
update x509 certificates.

Signed-off-by: Zihao Chang <changzihao1@huawei.com>
---
 include/ui/console.h |  1 +
 ui/vnc.c             | 28 ++++++++++++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/include/ui/console.h b/include/ui/console.h
index 7a3fc11abf72..da02fdd2e39d 100644
--- a/include/ui/console.h
+++ b/include/ui/console.h
@@ -441,6 +441,7 @@ int vnc_display_password(const char *id, const char *password);
 int vnc_display_pw_expire(const char *id, time_t expires);
 void vnc_parse(const char *str);
 int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp);
+bool vnc_display_reload_certs(const char *id,  Error **errp);
 
 /* input.c */
 int index_from_key(const char *key, size_t key_length);
diff --git a/ui/vnc.c b/ui/vnc.c
index 16bb3be770b2..558db1db2b91 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -584,6 +584,34 @@ VncInfo2List *qmp_query_vnc_servers(Error **errp)
     return prev;
 }
 
+bool vnc_display_reload_certs(const char *id, Error **errp)
+{
+    VncDisplay *vd = vnc_display_find(id);
+    QCryptoTLSCredsClass *creds = NULL;
+
+    if (!vd) {
+        error_setg(errp, "Can not find Vnc Display");
+        return false;
+    }
+
+    if (!vd->tlscreds) {
+        error_setg(errp, "Vnc tls is not enable");
+        return false;
+    }
+
+    creds = QCRYPTO_TLS_CREDS_GET_CLASS(OBJECT(vd->tlscreds));
+    if (creds->reload == NULL) {
+        error_setg(errp, "%s doesn't support to reload TLS credential",
+                   object_get_typename(OBJECT(vd->tlscreds)));
+        return false;
+    }
+    if (!creds->reload(vd->tlscreds, errp)) {
+        return false;
+    }
+
+    return true;
+}
+
 /* TODO
    1) Get the queue working for IO.
    2) there is some weirdness when using the -S option (the screen is grey
-- 
2.28.0

[PATCH v3 3/3] qmp: add new qmp display-reload

[Zihao Chang]

This patch provides a new qmp to reload display configuration
without restart VM, but only reloading the vnc tls certificates
is implemented.
Example:
{"execute": "display-reload", "arguments":{"vnc-tls-certs": true}}

Signed-off-by: Zihao Chang <changzihao1@huawei.com>
---
 monitor/qmp-cmds.c | 12 ++++++++++++
 qapi/ui.json       | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+)

diff --git a/monitor/qmp-cmds.c b/monitor/qmp-cmds.c
index c7df8c0ee268..edf543a4febf 100644
--- a/monitor/qmp-cmds.c
+++ b/monitor/qmp-cmds.c
@@ -334,3 +334,15 @@ MemoryInfo *qmp_query_memory_size_summary(Error **errp)
 
     return mem_info;
 }
+
+void qmp_display_reload(DiaplayReloadInfo *arg, Error **errp)
+{
+    Error *local_err = NULL;
+
+    if (arg->has_vnc_tls_certs && arg->vnc_tls_certs) {
+        if (!vnc_display_reload_certs(NULL, &local_err)) {
+            error_propagate(errp, local_err);
+            return;
+        }
+    }
+}
diff --git a/qapi/ui.json b/qapi/ui.json
index d08d72b43923..019283aad208 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -1179,3 +1179,35 @@
 ##
 { 'command': 'query-display-options',
   'returns': 'DisplayOptions' }
+
+##
+# @DiaplayReloadInfo:
+#
+# The basic information for reload Display configuration
+#
+# @vnc-tls-certs: whether to reload tls certs
+#
+# Since: 6.0
+##
+{ 'struct': 'DiaplayReloadInfo',
+  'data': { '*vnc-tls-certs': 'bool' } }
+
+##
+# @display-reload:
+#
+# Reload display configuration
+#
+# Returns: Nothing on success
+#
+# Since: 6.0
+#
+# Example:
+#
+# -> { "execute": "display-reload",
+#      "arguments": { "vnc-tls-certs": true } }
+# <- { "return": {} }
+#
+##
+{ 'command': 'display-reload',
+  'data': 'DiaplayReloadInfo',
+  'boxed' : true }
-- 
2.28.0

Re: [PATCH v3 3/3] qmp: add new qmp display-reload

[Gerd Hoffmann]

> +##
> +# @DiaplayReloadInfo:

Display

> +{ 'struct': 'DiaplayReloadInfo',

Same here.

take care,
  Gerd

Re: [PATCH v3 2/3] vnc: support reload x509 certificates for vnc

[Gerd Hoffmann]

> +    if (!vd) {
> +        error_setg(errp, "Can not find Vnc Display");

Can we make this "vnc display" please?

> +        error_setg(errp, "Vnc tls is not enable");

Same.

thanks,
  Gerd