1e1226365SDaniel P. Berrange /*
2e1226365SDaniel P. Berrange * QEMU migration TLS support
3e1226365SDaniel P. Berrange *
4e1226365SDaniel P. Berrange * Copyright (c) 2015 Red Hat, Inc.
5e1226365SDaniel P. Berrange *
6e1226365SDaniel P. Berrange * This library is free software; you can redistribute it and/or
7e1226365SDaniel P. Berrange * modify it under the terms of the GNU Lesser General Public
8e1226365SDaniel P. Berrange * License as published by the Free Software Foundation; either
9ef19b50dSChetan Pant * version 2.1 of the License, or (at your option) any later version.
10e1226365SDaniel P. Berrange *
11e1226365SDaniel P. Berrange * This library is distributed in the hope that it will be useful,
12e1226365SDaniel P. Berrange * but WITHOUT ANY WARRANTY; without even the implied warranty of
13e1226365SDaniel P. Berrange * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14e1226365SDaniel P. Berrange * Lesser General Public License for more details.
15e1226365SDaniel P. Berrange *
16e1226365SDaniel P. Berrange * You should have received a copy of the GNU Lesser General Public
17e1226365SDaniel P. Berrange * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18e1226365SDaniel P. Berrange *
19e1226365SDaniel P. Berrange */
20e1226365SDaniel P. Berrange
21e1226365SDaniel P. Berrange #include "qemu/osdep.h"
22dd4339c5SJuan Quintela #include "channel.h"
236666c96aSJuan Quintela #include "migration.h"
2441d64227SJuan Quintela #include "tls.h"
2510d4703bSJuan Quintela #include "options.h"
26e1226365SDaniel P. Berrange #include "crypto/tlscreds.h"
27e1226365SDaniel P. Berrange #include "qemu/error-report.h"
28e1226365SDaniel P. Berrange #include "qapi/error.h"
29e1226365SDaniel P. Berrange #include "trace.h"
30e1226365SDaniel P. Berrange
31e1226365SDaniel P. Berrange static QCryptoTLSCreds *
migration_tls_get_creds(QCryptoTLSCredsEndpoint endpoint,Error ** errp)323f461a0cSJuan Quintela migration_tls_get_creds(QCryptoTLSCredsEndpoint endpoint, Error **errp)
33e1226365SDaniel P. Berrange {
34e1226365SDaniel P. Berrange Object *creds;
35d5c3e195SJuan Quintela const char *tls_creds = migrate_tls_creds();
36e1226365SDaniel P. Berrange QCryptoTLSCreds *ret;
37e1226365SDaniel P. Berrange
38d5c3e195SJuan Quintela creds = object_resolve_path_component(object_get_objects_root(), tls_creds);
39e1226365SDaniel P. Berrange if (!creds) {
40d5c3e195SJuan Quintela error_setg(errp, "No TLS credentials with id '%s'", tls_creds);
41e1226365SDaniel P. Berrange return NULL;
42e1226365SDaniel P. Berrange }
43e1226365SDaniel P. Berrange ret = (QCryptoTLSCreds *)object_dynamic_cast(
44e1226365SDaniel P. Berrange creds, TYPE_QCRYPTO_TLS_CREDS);
45e1226365SDaniel P. Berrange if (!ret) {
46e1226365SDaniel P. Berrange error_setg(errp, "Object with id '%s' is not TLS credentials",
47d5c3e195SJuan Quintela tls_creds);
48e1226365SDaniel P. Berrange return NULL;
49e1226365SDaniel P. Berrange }
505590f65fSPhilippe Mathieu-Daudé if (!qcrypto_tls_creds_check_endpoint(ret, endpoint, errp)) {
51e1226365SDaniel P. Berrange return NULL;
52e1226365SDaniel P. Berrange }
53e1226365SDaniel P. Berrange
54e1226365SDaniel P. Berrange return ret;
55e1226365SDaniel P. Berrange }
56e1226365SDaniel P. Berrange
57e1226365SDaniel P. Berrange
migration_tls_incoming_handshake(QIOTask * task,gpointer opaque)5860e705c5SDaniel P. Berrange static void migration_tls_incoming_handshake(QIOTask *task,
59e1226365SDaniel P. Berrange gpointer opaque)
60e1226365SDaniel P. Berrange {
6160e705c5SDaniel P. Berrange QIOChannel *ioc = QIO_CHANNEL(qio_task_get_source(task));
6260e705c5SDaniel P. Berrange Error *err = NULL;
63e1226365SDaniel P. Berrange
6460e705c5SDaniel P. Berrange if (qio_task_propagate_error(task, &err)) {
65e1226365SDaniel P. Berrange trace_migration_tls_incoming_handshake_error(error_get_pretty(err));
6660e705c5SDaniel P. Berrange error_report_err(err);
67e1226365SDaniel P. Berrange } else {
68e1226365SDaniel P. Berrange trace_migration_tls_incoming_handshake_complete();
6954314711SJuan Quintela migration_channel_process_incoming(ioc);
70e1226365SDaniel P. Berrange }
71e1226365SDaniel P. Berrange object_unref(OBJECT(ioc));
72e1226365SDaniel P. Berrange }
73e1226365SDaniel P. Berrange
migration_tls_channel_process_incoming(MigrationState * s,QIOChannel * ioc,Error ** errp)7422724f49SDaniel P. Berrange void migration_tls_channel_process_incoming(MigrationState *s,
75e1226365SDaniel P. Berrange QIOChannel *ioc,
76e1226365SDaniel P. Berrange Error **errp)
77e1226365SDaniel P. Berrange {
78e1226365SDaniel P. Berrange QCryptoTLSCreds *creds;
79e1226365SDaniel P. Berrange QIOChannelTLS *tioc;
80e1226365SDaniel P. Berrange
813f461a0cSJuan Quintela creds = migration_tls_get_creds(QCRYPTO_TLS_CREDS_ENDPOINT_SERVER, errp);
82e1226365SDaniel P. Berrange if (!creds) {
83e1226365SDaniel P. Berrange return;
84e1226365SDaniel P. Berrange }
85e1226365SDaniel P. Berrange
862eb0308bSJuan Quintela tioc = qio_channel_tls_new_server(ioc, creds, migrate_tls_authz(), errp);
87e1226365SDaniel P. Berrange if (!tioc) {
88e1226365SDaniel P. Berrange return;
89e1226365SDaniel P. Berrange }
90e1226365SDaniel P. Berrange
91e1226365SDaniel P. Berrange trace_migration_tls_incoming_handshake_start();
926f01f136SDaniel P. Berrange qio_channel_set_name(QIO_CHANNEL(tioc), "migration-tls-incoming");
93e1226365SDaniel P. Berrange qio_channel_tls_handshake(tioc,
94e1226365SDaniel P. Berrange migration_tls_incoming_handshake,
95e1226365SDaniel P. Berrange NULL,
961939ccdaSPeter Xu NULL,
97e1226365SDaniel P. Berrange NULL);
98e1226365SDaniel P. Berrange }
99e1226365SDaniel P. Berrange
100e1226365SDaniel P. Berrange
migration_tls_outgoing_handshake(QIOTask * task,gpointer opaque)10160e705c5SDaniel P. Berrange static void migration_tls_outgoing_handshake(QIOTask *task,
102e1226365SDaniel P. Berrange gpointer opaque)
103e1226365SDaniel P. Berrange {
104e1226365SDaniel P. Berrange MigrationState *s = opaque;
10560e705c5SDaniel P. Berrange QIOChannel *ioc = QIO_CHANNEL(qio_task_get_source(task));
10660e705c5SDaniel P. Berrange Error *err = NULL;
107e1226365SDaniel P. Berrange
10860e705c5SDaniel P. Berrange if (qio_task_propagate_error(task, &err)) {
109e1226365SDaniel P. Berrange trace_migration_tls_outgoing_handshake_error(error_get_pretty(err));
110e1226365SDaniel P. Berrange } else {
111e1226365SDaniel P. Berrange trace_migration_tls_outgoing_handshake_complete();
112e1226365SDaniel P. Berrange }
113688a3dcbSDr. David Alan Gilbert migration_channel_connect(s, ioc, NULL, err);
114e1226365SDaniel P. Berrange object_unref(OBJECT(ioc));
115e1226365SDaniel P. Berrange }
116e1226365SDaniel P. Berrange
migration_tls_client_create(QIOChannel * ioc,const char * hostname,Error ** errp)117*0deb7e9bSJuan Quintela QIOChannelTLS *migration_tls_client_create(QIOChannel *ioc,
118e1226365SDaniel P. Berrange const char *hostname,
119e1226365SDaniel P. Berrange Error **errp)
120e1226365SDaniel P. Berrange {
121e1226365SDaniel P. Berrange QCryptoTLSCreds *creds;
122e1226365SDaniel P. Berrange
1233f461a0cSJuan Quintela creds = migration_tls_get_creds(QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT, errp);
124e1226365SDaniel P. Berrange if (!creds) {
125bfb790e7SChuan Zheng return NULL;
126e1226365SDaniel P. Berrange }
127e1226365SDaniel P. Berrange
1281f2f366cSJuan Quintela const char *tls_hostname = migrate_tls_hostname();
1291f2f366cSJuan Quintela if (tls_hostname && *tls_hostname) {
1301f2f366cSJuan Quintela hostname = tls_hostname;
131e1226365SDaniel P. Berrange }
132e1226365SDaniel P. Berrange
13366997c42SMarkus Armbruster return qio_channel_tls_new_client(ioc, creds, hostname, errp);
134bfb790e7SChuan Zheng }
135bfb790e7SChuan Zheng
migration_tls_channel_connect(MigrationState * s,QIOChannel * ioc,const char * hostname,Error ** errp)136bfb790e7SChuan Zheng void migration_tls_channel_connect(MigrationState *s,
137bfb790e7SChuan Zheng QIOChannel *ioc,
138bfb790e7SChuan Zheng const char *hostname,
139bfb790e7SChuan Zheng Error **errp)
140bfb790e7SChuan Zheng {
141bfb790e7SChuan Zheng QIOChannelTLS *tioc;
142bfb790e7SChuan Zheng
143*0deb7e9bSJuan Quintela tioc = migration_tls_client_create(ioc, hostname, errp);
144e1226365SDaniel P. Berrange if (!tioc) {
145e1226365SDaniel P. Berrange return;
146e1226365SDaniel P. Berrange }
147e1226365SDaniel P. Berrange
148d8053e73SChuan Zheng /* Save hostname into MigrationState for handshake */
149d8053e73SChuan Zheng s->hostname = g_strdup(hostname);
150e1226365SDaniel P. Berrange trace_migration_tls_outgoing_handshake_start(hostname);
1516f01f136SDaniel P. Berrange qio_channel_set_name(QIO_CHANNEL(tioc), "migration-tls-outgoing");
152e1226365SDaniel P. Berrange qio_channel_tls_handshake(tioc,
153e1226365SDaniel P. Berrange migration_tls_outgoing_handshake,
154e1226365SDaniel P. Berrange s,
1551939ccdaSPeter Xu NULL,
156e1226365SDaniel P. Berrange NULL);
157e1226365SDaniel P. Berrange }
15885a8578eSPeter Xu
migrate_channel_requires_tls_upgrade(QIOChannel * ioc)15985a8578eSPeter Xu bool migrate_channel_requires_tls_upgrade(QIOChannel *ioc)
16085a8578eSPeter Xu {
16110d4703bSJuan Quintela if (!migrate_tls()) {
16285a8578eSPeter Xu return false;
16385a8578eSPeter Xu }
16485a8578eSPeter Xu
16585a8578eSPeter Xu return !object_dynamic_cast(OBJECT(ioc), TYPE_QIO_CHANNEL_TLS);
16685a8578eSPeter Xu }
167