1 /* 2 * Secure Shell (ssh) backend for QEMU. 3 * 4 * Copyright (C) 2013 Red Hat Inc., Richard W.M. Jones <rjones@redhat.com> 5 * 6 * Permission is hereby granted, free of charge, to any person obtaining a copy 7 * of this software and associated documentation files (the "Software"), to deal 8 * in the Software without restriction, including without limitation the rights 9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 * copies of the Software, and to permit persons to whom the Software is 11 * furnished to do so, subject to the following conditions: 12 * 13 * The above copyright notice and this permission notice shall be included in 14 * all copies or substantial portions of the Software. 15 * 16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 * THE SOFTWARE. 23 */ 24 25 #include "qemu/osdep.h" 26 27 #include <libssh/libssh.h> 28 #include <libssh/sftp.h> 29 30 #include "block/block_int.h" 31 #include "block/qdict.h" 32 #include "qapi/error.h" 33 #include "qemu/error-report.h" 34 #include "qemu/module.h" 35 #include "qemu/option.h" 36 #include "qemu/ctype.h" 37 #include "qemu/cutils.h" 38 #include "qemu/sockets.h" 39 #include "qemu/uri.h" 40 #include "qapi/qapi-visit-sockets.h" 41 #include "qapi/qapi-visit-block-core.h" 42 #include "qapi/qmp/qdict.h" 43 #include "qapi/qmp/qstring.h" 44 #include "qapi/qobject-input-visitor.h" 45 #include "qapi/qobject-output-visitor.h" 46 #include "trace.h" 47 48 /* 49 * TRACE_LIBSSH=<level> enables tracing in libssh itself. 50 * The meaning of <level> is described here: 51 * http://api.libssh.org/master/group__libssh__log.html 52 */ 53 #define TRACE_LIBSSH 0 /* see: SSH_LOG_* */ 54 55 typedef struct BDRVSSHState { 56 /* Coroutine. */ 57 CoMutex lock; 58 59 /* SSH connection. */ 60 int sock; /* socket */ 61 ssh_session session; /* ssh session */ 62 sftp_session sftp; /* sftp session */ 63 sftp_file sftp_handle; /* sftp remote file handle */ 64 65 /* 66 * File attributes at open. We try to keep the .size field 67 * updated if it changes (eg by writing at the end of the file). 68 */ 69 sftp_attributes attrs; 70 71 InetSocketAddress *inet; 72 73 /* Used to warn if 'flush' is not supported. */ 74 bool unsafe_flush_warning; 75 76 /* 77 * Store the user name for ssh_refresh_filename() because the 78 * default depends on the system you are on -- therefore, when we 79 * generate a filename, it should always contain the user name we 80 * are actually using. 81 */ 82 char *user; 83 } BDRVSSHState; 84 85 static void ssh_state_init(BDRVSSHState *s) 86 { 87 memset(s, 0, sizeof *s); 88 s->sock = -1; 89 qemu_co_mutex_init(&s->lock); 90 } 91 92 static void ssh_state_free(BDRVSSHState *s) 93 { 94 g_free(s->user); 95 96 if (s->attrs) { 97 sftp_attributes_free(s->attrs); 98 } 99 if (s->sftp_handle) { 100 sftp_close(s->sftp_handle); 101 } 102 if (s->sftp) { 103 sftp_free(s->sftp); 104 } 105 if (s->session) { 106 ssh_disconnect(s->session); 107 ssh_free(s->session); /* This frees s->sock */ 108 } 109 } 110 111 static void GCC_FMT_ATTR(3, 4) 112 session_error_setg(Error **errp, BDRVSSHState *s, const char *fs, ...) 113 { 114 va_list args; 115 char *msg; 116 117 va_start(args, fs); 118 msg = g_strdup_vprintf(fs, args); 119 va_end(args); 120 121 if (s->session) { 122 const char *ssh_err; 123 int ssh_err_code; 124 125 /* This is not an errno. See <libssh/libssh.h>. */ 126 ssh_err = ssh_get_error(s->session); 127 ssh_err_code = ssh_get_error_code(s->session); 128 error_setg(errp, "%s: %s (libssh error code: %d)", 129 msg, ssh_err, ssh_err_code); 130 } else { 131 error_setg(errp, "%s", msg); 132 } 133 g_free(msg); 134 } 135 136 static void GCC_FMT_ATTR(3, 4) 137 sftp_error_setg(Error **errp, BDRVSSHState *s, const char *fs, ...) 138 { 139 va_list args; 140 char *msg; 141 142 va_start(args, fs); 143 msg = g_strdup_vprintf(fs, args); 144 va_end(args); 145 146 if (s->sftp) { 147 const char *ssh_err; 148 int ssh_err_code; 149 int sftp_err_code; 150 151 /* This is not an errno. See <libssh/libssh.h>. */ 152 ssh_err = ssh_get_error(s->session); 153 ssh_err_code = ssh_get_error_code(s->session); 154 /* See <libssh/sftp.h>. */ 155 sftp_err_code = sftp_get_error(s->sftp); 156 157 error_setg(errp, 158 "%s: %s (libssh error code: %d, sftp error code: %d)", 159 msg, ssh_err, ssh_err_code, sftp_err_code); 160 } else { 161 error_setg(errp, "%s", msg); 162 } 163 g_free(msg); 164 } 165 166 static void sftp_error_trace(BDRVSSHState *s, const char *op) 167 { 168 const char *ssh_err; 169 int ssh_err_code; 170 int sftp_err_code; 171 172 /* This is not an errno. See <libssh/libssh.h>. */ 173 ssh_err = ssh_get_error(s->session); 174 ssh_err_code = ssh_get_error_code(s->session); 175 /* See <libssh/sftp.h>. */ 176 sftp_err_code = sftp_get_error(s->sftp); 177 178 trace_sftp_error(op, ssh_err, ssh_err_code, sftp_err_code); 179 } 180 181 static int parse_uri(const char *filename, QDict *options, Error **errp) 182 { 183 URI *uri = NULL; 184 QueryParams *qp; 185 char *port_str; 186 int i; 187 188 uri = uri_parse(filename); 189 if (!uri) { 190 return -EINVAL; 191 } 192 193 if (g_strcmp0(uri->scheme, "ssh") != 0) { 194 error_setg(errp, "URI scheme must be 'ssh'"); 195 goto err; 196 } 197 198 if (!uri->server || strcmp(uri->server, "") == 0) { 199 error_setg(errp, "missing hostname in URI"); 200 goto err; 201 } 202 203 if (!uri->path || strcmp(uri->path, "") == 0) { 204 error_setg(errp, "missing remote path in URI"); 205 goto err; 206 } 207 208 qp = query_params_parse(uri->query); 209 if (!qp) { 210 error_setg(errp, "could not parse query parameters"); 211 goto err; 212 } 213 214 if(uri->user && strcmp(uri->user, "") != 0) { 215 qdict_put_str(options, "user", uri->user); 216 } 217 218 qdict_put_str(options, "server.host", uri->server); 219 220 port_str = g_strdup_printf("%d", uri->port ?: 22); 221 qdict_put_str(options, "server.port", port_str); 222 g_free(port_str); 223 224 qdict_put_str(options, "path", uri->path); 225 226 /* Pick out any query parameters that we understand, and ignore 227 * the rest. 228 */ 229 for (i = 0; i < qp->n; ++i) { 230 if (strcmp(qp->p[i].name, "host_key_check") == 0) { 231 qdict_put_str(options, "host_key_check", qp->p[i].value); 232 } 233 } 234 235 query_params_free(qp); 236 uri_free(uri); 237 return 0; 238 239 err: 240 if (uri) { 241 uri_free(uri); 242 } 243 return -EINVAL; 244 } 245 246 static bool ssh_has_filename_options_conflict(QDict *options, Error **errp) 247 { 248 const QDictEntry *qe; 249 250 for (qe = qdict_first(options); qe; qe = qdict_next(options, qe)) { 251 if (!strcmp(qe->key, "host") || 252 !strcmp(qe->key, "port") || 253 !strcmp(qe->key, "path") || 254 !strcmp(qe->key, "user") || 255 !strcmp(qe->key, "host_key_check") || 256 strstart(qe->key, "server.", NULL)) 257 { 258 error_setg(errp, "Option '%s' cannot be used with a file name", 259 qe->key); 260 return true; 261 } 262 } 263 264 return false; 265 } 266 267 static void ssh_parse_filename(const char *filename, QDict *options, 268 Error **errp) 269 { 270 if (ssh_has_filename_options_conflict(options, errp)) { 271 return; 272 } 273 274 parse_uri(filename, options, errp); 275 } 276 277 static int check_host_key_knownhosts(BDRVSSHState *s, Error **errp) 278 { 279 int ret; 280 enum ssh_known_hosts_e state; 281 int r; 282 ssh_key pubkey; 283 enum ssh_keytypes_e pubkey_type; 284 unsigned char *server_hash = NULL; 285 size_t server_hash_len; 286 char *fingerprint = NULL; 287 288 state = ssh_session_is_known_server(s->session); 289 trace_ssh_server_status(state); 290 291 switch (state) { 292 case SSH_KNOWN_HOSTS_OK: 293 /* OK */ 294 trace_ssh_check_host_key_knownhosts(); 295 break; 296 case SSH_KNOWN_HOSTS_CHANGED: 297 ret = -EINVAL; 298 r = ssh_get_server_publickey(s->session, &pubkey); 299 if (r == 0) { 300 r = ssh_get_publickey_hash(pubkey, SSH_PUBLICKEY_HASH_SHA256, 301 &server_hash, &server_hash_len); 302 pubkey_type = ssh_key_type(pubkey); 303 ssh_key_free(pubkey); 304 } 305 if (r == 0) { 306 fingerprint = ssh_get_fingerprint_hash(SSH_PUBLICKEY_HASH_SHA256, 307 server_hash, 308 server_hash_len); 309 ssh_clean_pubkey_hash(&server_hash); 310 } 311 if (fingerprint) { 312 error_setg(errp, 313 "host key (%s key with fingerprint %s) does not match " 314 "the one in known_hosts; this may be a possible attack", 315 ssh_key_type_to_char(pubkey_type), fingerprint); 316 ssh_string_free_char(fingerprint); 317 } else { 318 error_setg(errp, 319 "host key does not match the one in known_hosts; this " 320 "may be a possible attack"); 321 } 322 goto out; 323 case SSH_KNOWN_HOSTS_OTHER: 324 ret = -EINVAL; 325 error_setg(errp, 326 "host key for this server not found, another type exists"); 327 goto out; 328 case SSH_KNOWN_HOSTS_UNKNOWN: 329 ret = -EINVAL; 330 error_setg(errp, "no host key was found in known_hosts"); 331 goto out; 332 case SSH_KNOWN_HOSTS_NOT_FOUND: 333 ret = -ENOENT; 334 error_setg(errp, "known_hosts file not found"); 335 goto out; 336 case SSH_KNOWN_HOSTS_ERROR: 337 ret = -EINVAL; 338 error_setg(errp, "error while checking the host"); 339 goto out; 340 default: 341 ret = -EINVAL; 342 error_setg(errp, "error while checking for known server (%d)", state); 343 goto out; 344 } 345 346 /* known_hosts checking successful. */ 347 ret = 0; 348 349 out: 350 return ret; 351 } 352 353 static unsigned hex2decimal(char ch) 354 { 355 if (ch >= '0' && ch <= '9') { 356 return (ch - '0'); 357 } else if (ch >= 'a' && ch <= 'f') { 358 return 10 + (ch - 'a'); 359 } else if (ch >= 'A' && ch <= 'F') { 360 return 10 + (ch - 'A'); 361 } 362 363 return -1; 364 } 365 366 /* Compare the binary fingerprint (hash of host key) with the 367 * host_key_check parameter. 368 */ 369 static int compare_fingerprint(const unsigned char *fingerprint, size_t len, 370 const char *host_key_check) 371 { 372 unsigned c; 373 374 while (len > 0) { 375 while (*host_key_check == ':') 376 host_key_check++; 377 if (!qemu_isxdigit(host_key_check[0]) || 378 !qemu_isxdigit(host_key_check[1])) 379 return 1; 380 c = hex2decimal(host_key_check[0]) * 16 + 381 hex2decimal(host_key_check[1]); 382 if (c - *fingerprint != 0) 383 return c - *fingerprint; 384 fingerprint++; 385 len--; 386 host_key_check += 2; 387 } 388 return *host_key_check - '\0'; 389 } 390 391 static int 392 check_host_key_hash(BDRVSSHState *s, const char *hash, 393 enum ssh_publickey_hash_type type, Error **errp) 394 { 395 int r; 396 ssh_key pubkey; 397 unsigned char *server_hash; 398 size_t server_hash_len; 399 400 r = ssh_get_server_publickey(s->session, &pubkey); 401 if (r != SSH_OK) { 402 session_error_setg(errp, s, "failed to read remote host key"); 403 return -EINVAL; 404 } 405 406 r = ssh_get_publickey_hash(pubkey, type, &server_hash, &server_hash_len); 407 ssh_key_free(pubkey); 408 if (r != 0) { 409 session_error_setg(errp, s, 410 "failed reading the hash of the server SSH key"); 411 return -EINVAL; 412 } 413 414 r = compare_fingerprint(server_hash, server_hash_len, hash); 415 ssh_clean_pubkey_hash(&server_hash); 416 if (r != 0) { 417 error_setg(errp, "remote host key does not match host_key_check '%s'", 418 hash); 419 return -EPERM; 420 } 421 422 return 0; 423 } 424 425 static int check_host_key(BDRVSSHState *s, SshHostKeyCheck *hkc, Error **errp) 426 { 427 SshHostKeyCheckMode mode; 428 429 if (hkc) { 430 mode = hkc->mode; 431 } else { 432 mode = SSH_HOST_KEY_CHECK_MODE_KNOWN_HOSTS; 433 } 434 435 switch (mode) { 436 case SSH_HOST_KEY_CHECK_MODE_NONE: 437 return 0; 438 case SSH_HOST_KEY_CHECK_MODE_HASH: 439 if (hkc->u.hash.type == SSH_HOST_KEY_CHECK_HASH_TYPE_MD5) { 440 return check_host_key_hash(s, hkc->u.hash.hash, 441 SSH_PUBLICKEY_HASH_MD5, errp); 442 } else if (hkc->u.hash.type == SSH_HOST_KEY_CHECK_HASH_TYPE_SHA1) { 443 return check_host_key_hash(s, hkc->u.hash.hash, 444 SSH_PUBLICKEY_HASH_SHA1, errp); 445 } 446 g_assert_not_reached(); 447 break; 448 case SSH_HOST_KEY_CHECK_MODE_KNOWN_HOSTS: 449 return check_host_key_knownhosts(s, errp); 450 default: 451 g_assert_not_reached(); 452 } 453 454 return -EINVAL; 455 } 456 457 static int authenticate(BDRVSSHState *s, Error **errp) 458 { 459 int r, ret; 460 int method; 461 462 /* Try to authenticate with the "none" method. */ 463 r = ssh_userauth_none(s->session, NULL); 464 if (r == SSH_AUTH_ERROR) { 465 ret = -EPERM; 466 session_error_setg(errp, s, "failed to authenticate using none " 467 "authentication"); 468 goto out; 469 } else if (r == SSH_AUTH_SUCCESS) { 470 /* Authenticated! */ 471 ret = 0; 472 goto out; 473 } 474 475 method = ssh_userauth_list(s->session, NULL); 476 trace_ssh_auth_methods(method); 477 478 /* 479 * Try to authenticate with publickey, using the ssh-agent 480 * if available. 481 */ 482 if (method & SSH_AUTH_METHOD_PUBLICKEY) { 483 r = ssh_userauth_publickey_auto(s->session, NULL, NULL); 484 if (r == SSH_AUTH_ERROR) { 485 ret = -EINVAL; 486 session_error_setg(errp, s, "failed to authenticate using " 487 "publickey authentication"); 488 goto out; 489 } else if (r == SSH_AUTH_SUCCESS) { 490 /* Authenticated! */ 491 ret = 0; 492 goto out; 493 } 494 } 495 496 ret = -EPERM; 497 error_setg(errp, "failed to authenticate using publickey authentication " 498 "and the identities held by your ssh-agent"); 499 500 out: 501 return ret; 502 } 503 504 static QemuOptsList ssh_runtime_opts = { 505 .name = "ssh", 506 .head = QTAILQ_HEAD_INITIALIZER(ssh_runtime_opts.head), 507 .desc = { 508 { 509 .name = "host", 510 .type = QEMU_OPT_STRING, 511 .help = "Host to connect to", 512 }, 513 { 514 .name = "port", 515 .type = QEMU_OPT_NUMBER, 516 .help = "Port to connect to", 517 }, 518 { 519 .name = "host_key_check", 520 .type = QEMU_OPT_STRING, 521 .help = "Defines how and what to check the host key against", 522 }, 523 { /* end of list */ } 524 }, 525 }; 526 527 static bool ssh_process_legacy_options(QDict *output_opts, 528 QemuOpts *legacy_opts, 529 Error **errp) 530 { 531 const char *host = qemu_opt_get(legacy_opts, "host"); 532 const char *port = qemu_opt_get(legacy_opts, "port"); 533 const char *host_key_check = qemu_opt_get(legacy_opts, "host_key_check"); 534 535 if (!host && port) { 536 error_setg(errp, "port may not be used without host"); 537 return false; 538 } 539 540 if (host) { 541 qdict_put_str(output_opts, "server.host", host); 542 qdict_put_str(output_opts, "server.port", port ?: stringify(22)); 543 } 544 545 if (host_key_check) { 546 if (strcmp(host_key_check, "no") == 0) { 547 qdict_put_str(output_opts, "host-key-check.mode", "none"); 548 } else if (strncmp(host_key_check, "md5:", 4) == 0) { 549 qdict_put_str(output_opts, "host-key-check.mode", "hash"); 550 qdict_put_str(output_opts, "host-key-check.type", "md5"); 551 qdict_put_str(output_opts, "host-key-check.hash", 552 &host_key_check[4]); 553 } else if (strncmp(host_key_check, "sha1:", 5) == 0) { 554 qdict_put_str(output_opts, "host-key-check.mode", "hash"); 555 qdict_put_str(output_opts, "host-key-check.type", "sha1"); 556 qdict_put_str(output_opts, "host-key-check.hash", 557 &host_key_check[5]); 558 } else if (strcmp(host_key_check, "yes") == 0) { 559 qdict_put_str(output_opts, "host-key-check.mode", "known_hosts"); 560 } else { 561 error_setg(errp, "unknown host_key_check setting (%s)", 562 host_key_check); 563 return false; 564 } 565 } 566 567 return true; 568 } 569 570 static BlockdevOptionsSsh *ssh_parse_options(QDict *options, Error **errp) 571 { 572 BlockdevOptionsSsh *result = NULL; 573 QemuOpts *opts = NULL; 574 const QDictEntry *e; 575 Visitor *v; 576 577 /* Translate legacy options */ 578 opts = qemu_opts_create(&ssh_runtime_opts, NULL, 0, &error_abort); 579 if (!qemu_opts_absorb_qdict(opts, options, errp)) { 580 goto fail; 581 } 582 583 if (!ssh_process_legacy_options(options, opts, errp)) { 584 goto fail; 585 } 586 587 /* Create the QAPI object */ 588 v = qobject_input_visitor_new_flat_confused(options, errp); 589 if (!v) { 590 goto fail; 591 } 592 593 visit_type_BlockdevOptionsSsh(v, NULL, &result, errp); 594 visit_free(v); 595 if (!result) { 596 goto fail; 597 } 598 599 /* Remove the processed options from the QDict (the visitor processes 600 * _all_ options in the QDict) */ 601 while ((e = qdict_first(options))) { 602 qdict_del(options, e->key); 603 } 604 605 fail: 606 qemu_opts_del(opts); 607 return result; 608 } 609 610 static int connect_to_ssh(BDRVSSHState *s, BlockdevOptionsSsh *opts, 611 int ssh_flags, int creat_mode, Error **errp) 612 { 613 int r, ret; 614 unsigned int port = 0; 615 int new_sock = -1; 616 617 if (opts->has_user) { 618 s->user = g_strdup(opts->user); 619 } else { 620 s->user = g_strdup(g_get_user_name()); 621 if (!s->user) { 622 error_setg_errno(errp, errno, "Can't get user name"); 623 ret = -errno; 624 goto err; 625 } 626 } 627 628 /* Pop the config into our state object, Exit if invalid */ 629 s->inet = opts->server; 630 opts->server = NULL; 631 632 if (qemu_strtoui(s->inet->port, NULL, 10, &port) < 0) { 633 error_setg(errp, "Use only numeric port value"); 634 ret = -EINVAL; 635 goto err; 636 } 637 638 /* Open the socket and connect. */ 639 new_sock = inet_connect_saddr(s->inet, errp); 640 if (new_sock < 0) { 641 ret = -EIO; 642 goto err; 643 } 644 645 /* 646 * Try to disable the Nagle algorithm on TCP sockets to reduce latency, 647 * but do not fail if it cannot be disabled. 648 */ 649 r = socket_set_nodelay(new_sock); 650 if (r < 0) { 651 warn_report("can't set TCP_NODELAY for the ssh server %s: %s", 652 s->inet->host, strerror(errno)); 653 } 654 655 /* Create SSH session. */ 656 s->session = ssh_new(); 657 if (!s->session) { 658 ret = -EINVAL; 659 session_error_setg(errp, s, "failed to initialize libssh session"); 660 goto err; 661 } 662 663 /* 664 * Make sure we are in blocking mode during the connection and 665 * authentication phases. 666 */ 667 ssh_set_blocking(s->session, 1); 668 669 r = ssh_options_set(s->session, SSH_OPTIONS_USER, s->user); 670 if (r < 0) { 671 ret = -EINVAL; 672 session_error_setg(errp, s, 673 "failed to set the user in the libssh session"); 674 goto err; 675 } 676 677 r = ssh_options_set(s->session, SSH_OPTIONS_HOST, s->inet->host); 678 if (r < 0) { 679 ret = -EINVAL; 680 session_error_setg(errp, s, 681 "failed to set the host in the libssh session"); 682 goto err; 683 } 684 685 if (port > 0) { 686 r = ssh_options_set(s->session, SSH_OPTIONS_PORT, &port); 687 if (r < 0) { 688 ret = -EINVAL; 689 session_error_setg(errp, s, 690 "failed to set the port in the libssh session"); 691 goto err; 692 } 693 } 694 695 r = ssh_options_set(s->session, SSH_OPTIONS_COMPRESSION, "none"); 696 if (r < 0) { 697 ret = -EINVAL; 698 session_error_setg(errp, s, 699 "failed to disable the compression in the libssh " 700 "session"); 701 goto err; 702 } 703 704 /* Read ~/.ssh/config. */ 705 r = ssh_options_parse_config(s->session, NULL); 706 if (r < 0) { 707 ret = -EINVAL; 708 session_error_setg(errp, s, "failed to parse ~/.ssh/config"); 709 goto err; 710 } 711 712 r = ssh_options_set(s->session, SSH_OPTIONS_FD, &new_sock); 713 if (r < 0) { 714 ret = -EINVAL; 715 session_error_setg(errp, s, 716 "failed to set the socket in the libssh session"); 717 goto err; 718 } 719 /* libssh took ownership of the socket. */ 720 s->sock = new_sock; 721 new_sock = -1; 722 723 /* Connect. */ 724 r = ssh_connect(s->session); 725 if (r != SSH_OK) { 726 ret = -EINVAL; 727 session_error_setg(errp, s, "failed to establish SSH session"); 728 goto err; 729 } 730 731 /* Check the remote host's key against known_hosts. */ 732 ret = check_host_key(s, opts->host_key_check, errp); 733 if (ret < 0) { 734 goto err; 735 } 736 737 /* Authenticate. */ 738 ret = authenticate(s, errp); 739 if (ret < 0) { 740 goto err; 741 } 742 743 /* Start SFTP. */ 744 s->sftp = sftp_new(s->session); 745 if (!s->sftp) { 746 session_error_setg(errp, s, "failed to create sftp handle"); 747 ret = -EINVAL; 748 goto err; 749 } 750 751 r = sftp_init(s->sftp); 752 if (r < 0) { 753 sftp_error_setg(errp, s, "failed to initialize sftp handle"); 754 ret = -EINVAL; 755 goto err; 756 } 757 758 /* Open the remote file. */ 759 trace_ssh_connect_to_ssh(opts->path, ssh_flags, creat_mode); 760 s->sftp_handle = sftp_open(s->sftp, opts->path, ssh_flags, creat_mode); 761 if (!s->sftp_handle) { 762 sftp_error_setg(errp, s, "failed to open remote file '%s'", 763 opts->path); 764 ret = -EINVAL; 765 goto err; 766 } 767 768 /* Make sure the SFTP file is handled in blocking mode. */ 769 sftp_file_set_blocking(s->sftp_handle); 770 771 s->attrs = sftp_fstat(s->sftp_handle); 772 if (!s->attrs) { 773 sftp_error_setg(errp, s, "failed to read file attributes"); 774 return -EINVAL; 775 } 776 777 return 0; 778 779 err: 780 if (s->attrs) { 781 sftp_attributes_free(s->attrs); 782 } 783 s->attrs = NULL; 784 if (s->sftp_handle) { 785 sftp_close(s->sftp_handle); 786 } 787 s->sftp_handle = NULL; 788 if (s->sftp) { 789 sftp_free(s->sftp); 790 } 791 s->sftp = NULL; 792 if (s->session) { 793 ssh_disconnect(s->session); 794 ssh_free(s->session); 795 } 796 s->session = NULL; 797 s->sock = -1; 798 if (new_sock >= 0) { 799 close(new_sock); 800 } 801 802 return ret; 803 } 804 805 static int ssh_file_open(BlockDriverState *bs, QDict *options, int bdrv_flags, 806 Error **errp) 807 { 808 BDRVSSHState *s = bs->opaque; 809 BlockdevOptionsSsh *opts; 810 int ret; 811 int ssh_flags; 812 813 ssh_state_init(s); 814 815 ssh_flags = 0; 816 if (bdrv_flags & BDRV_O_RDWR) { 817 ssh_flags |= O_RDWR; 818 } else { 819 ssh_flags |= O_RDONLY; 820 } 821 822 opts = ssh_parse_options(options, errp); 823 if (opts == NULL) { 824 return -EINVAL; 825 } 826 827 /* Start up SSH. */ 828 ret = connect_to_ssh(s, opts, ssh_flags, 0, errp); 829 if (ret < 0) { 830 goto err; 831 } 832 833 /* Go non-blocking. */ 834 ssh_set_blocking(s->session, 0); 835 836 if (s->attrs->type == SSH_FILEXFER_TYPE_REGULAR) { 837 bs->supported_truncate_flags = BDRV_REQ_ZERO_WRITE; 838 } 839 840 qapi_free_BlockdevOptionsSsh(opts); 841 842 return 0; 843 844 err: 845 qapi_free_BlockdevOptionsSsh(opts); 846 847 return ret; 848 } 849 850 /* Note: This is a blocking operation */ 851 static int ssh_grow_file(BDRVSSHState *s, int64_t offset, Error **errp) 852 { 853 ssize_t ret; 854 char c[1] = { '\0' }; 855 int was_blocking = ssh_is_blocking(s->session); 856 857 /* offset must be strictly greater than the current size so we do 858 * not overwrite anything */ 859 assert(offset > 0 && offset > s->attrs->size); 860 861 ssh_set_blocking(s->session, 1); 862 863 sftp_seek64(s->sftp_handle, offset - 1); 864 ret = sftp_write(s->sftp_handle, c, 1); 865 866 ssh_set_blocking(s->session, was_blocking); 867 868 if (ret < 0) { 869 sftp_error_setg(errp, s, "Failed to grow file"); 870 return -EIO; 871 } 872 873 s->attrs->size = offset; 874 return 0; 875 } 876 877 static QemuOptsList ssh_create_opts = { 878 .name = "ssh-create-opts", 879 .head = QTAILQ_HEAD_INITIALIZER(ssh_create_opts.head), 880 .desc = { 881 { 882 .name = BLOCK_OPT_SIZE, 883 .type = QEMU_OPT_SIZE, 884 .help = "Virtual disk size" 885 }, 886 { /* end of list */ } 887 } 888 }; 889 890 static int ssh_co_create(BlockdevCreateOptions *options, Error **errp) 891 { 892 BlockdevCreateOptionsSsh *opts = &options->u.ssh; 893 BDRVSSHState s; 894 int ret; 895 896 assert(options->driver == BLOCKDEV_DRIVER_SSH); 897 898 ssh_state_init(&s); 899 900 ret = connect_to_ssh(&s, opts->location, 901 O_RDWR | O_CREAT | O_TRUNC, 902 0644, errp); 903 if (ret < 0) { 904 goto fail; 905 } 906 907 if (opts->size > 0) { 908 ret = ssh_grow_file(&s, opts->size, errp); 909 if (ret < 0) { 910 goto fail; 911 } 912 } 913 914 ret = 0; 915 fail: 916 ssh_state_free(&s); 917 return ret; 918 } 919 920 static int coroutine_fn ssh_co_create_opts(BlockDriver *drv, 921 const char *filename, 922 QemuOpts *opts, 923 Error **errp) 924 { 925 BlockdevCreateOptions *create_options; 926 BlockdevCreateOptionsSsh *ssh_opts; 927 int ret; 928 QDict *uri_options = NULL; 929 930 create_options = g_new0(BlockdevCreateOptions, 1); 931 create_options->driver = BLOCKDEV_DRIVER_SSH; 932 ssh_opts = &create_options->u.ssh; 933 934 /* Get desired file size. */ 935 ssh_opts->size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0), 936 BDRV_SECTOR_SIZE); 937 trace_ssh_co_create_opts(ssh_opts->size); 938 939 uri_options = qdict_new(); 940 ret = parse_uri(filename, uri_options, errp); 941 if (ret < 0) { 942 goto out; 943 } 944 945 ssh_opts->location = ssh_parse_options(uri_options, errp); 946 if (ssh_opts->location == NULL) { 947 ret = -EINVAL; 948 goto out; 949 } 950 951 ret = ssh_co_create(create_options, errp); 952 953 out: 954 qobject_unref(uri_options); 955 qapi_free_BlockdevCreateOptions(create_options); 956 return ret; 957 } 958 959 static void ssh_close(BlockDriverState *bs) 960 { 961 BDRVSSHState *s = bs->opaque; 962 963 ssh_state_free(s); 964 } 965 966 static int ssh_has_zero_init(BlockDriverState *bs) 967 { 968 BDRVSSHState *s = bs->opaque; 969 /* Assume false, unless we can positively prove it's true. */ 970 int has_zero_init = 0; 971 972 if (s->attrs->type == SSH_FILEXFER_TYPE_REGULAR) { 973 has_zero_init = 1; 974 } 975 976 return has_zero_init; 977 } 978 979 typedef struct BDRVSSHRestart { 980 BlockDriverState *bs; 981 Coroutine *co; 982 } BDRVSSHRestart; 983 984 static void restart_coroutine(void *opaque) 985 { 986 BDRVSSHRestart *restart = opaque; 987 BlockDriverState *bs = restart->bs; 988 BDRVSSHState *s = bs->opaque; 989 AioContext *ctx = bdrv_get_aio_context(bs); 990 991 trace_ssh_restart_coroutine(restart->co); 992 aio_set_fd_handler(ctx, s->sock, false, NULL, NULL, NULL, NULL); 993 994 aio_co_wake(restart->co); 995 } 996 997 /* A non-blocking call returned EAGAIN, so yield, ensuring the 998 * handlers are set up so that we'll be rescheduled when there is an 999 * interesting event on the socket. 1000 */ 1001 static coroutine_fn void co_yield(BDRVSSHState *s, BlockDriverState *bs) 1002 { 1003 int r; 1004 IOHandler *rd_handler = NULL, *wr_handler = NULL; 1005 BDRVSSHRestart restart = { 1006 .bs = bs, 1007 .co = qemu_coroutine_self() 1008 }; 1009 1010 r = ssh_get_poll_flags(s->session); 1011 1012 if (r & SSH_READ_PENDING) { 1013 rd_handler = restart_coroutine; 1014 } 1015 if (r & SSH_WRITE_PENDING) { 1016 wr_handler = restart_coroutine; 1017 } 1018 1019 trace_ssh_co_yield(s->sock, rd_handler, wr_handler); 1020 1021 aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock, 1022 false, rd_handler, wr_handler, NULL, &restart); 1023 qemu_coroutine_yield(); 1024 trace_ssh_co_yield_back(s->sock); 1025 } 1026 1027 static coroutine_fn int ssh_read(BDRVSSHState *s, BlockDriverState *bs, 1028 int64_t offset, size_t size, 1029 QEMUIOVector *qiov) 1030 { 1031 ssize_t r; 1032 size_t got; 1033 char *buf, *end_of_vec; 1034 struct iovec *i; 1035 1036 trace_ssh_read(offset, size); 1037 1038 trace_ssh_seek(offset); 1039 sftp_seek64(s->sftp_handle, offset); 1040 1041 /* This keeps track of the current iovec element ('i'), where we 1042 * will write to next ('buf'), and the end of the current iovec 1043 * ('end_of_vec'). 1044 */ 1045 i = &qiov->iov[0]; 1046 buf = i->iov_base; 1047 end_of_vec = i->iov_base + i->iov_len; 1048 1049 for (got = 0; got < size; ) { 1050 size_t request_read_size; 1051 again: 1052 /* 1053 * The size of SFTP packets is limited to 32K bytes, so limit 1054 * the amount of data requested to 16K, as libssh currently 1055 * does not handle multiple requests on its own. 1056 */ 1057 request_read_size = MIN(end_of_vec - buf, 16384); 1058 trace_ssh_read_buf(buf, end_of_vec - buf, request_read_size); 1059 r = sftp_read(s->sftp_handle, buf, request_read_size); 1060 trace_ssh_read_return(r, sftp_get_error(s->sftp)); 1061 1062 if (r == SSH_AGAIN) { 1063 co_yield(s, bs); 1064 goto again; 1065 } 1066 if (r == SSH_EOF || (r == 0 && sftp_get_error(s->sftp) == SSH_FX_EOF)) { 1067 /* EOF: Short read so pad the buffer with zeroes and return it. */ 1068 qemu_iovec_memset(qiov, got, 0, size - got); 1069 return 0; 1070 } 1071 if (r <= 0) { 1072 sftp_error_trace(s, "read"); 1073 return -EIO; 1074 } 1075 1076 got += r; 1077 buf += r; 1078 if (buf >= end_of_vec && got < size) { 1079 i++; 1080 buf = i->iov_base; 1081 end_of_vec = i->iov_base + i->iov_len; 1082 } 1083 } 1084 1085 return 0; 1086 } 1087 1088 static coroutine_fn int ssh_co_readv(BlockDriverState *bs, 1089 int64_t sector_num, 1090 int nb_sectors, QEMUIOVector *qiov) 1091 { 1092 BDRVSSHState *s = bs->opaque; 1093 int ret; 1094 1095 qemu_co_mutex_lock(&s->lock); 1096 ret = ssh_read(s, bs, sector_num * BDRV_SECTOR_SIZE, 1097 nb_sectors * BDRV_SECTOR_SIZE, qiov); 1098 qemu_co_mutex_unlock(&s->lock); 1099 1100 return ret; 1101 } 1102 1103 static int ssh_write(BDRVSSHState *s, BlockDriverState *bs, 1104 int64_t offset, size_t size, 1105 QEMUIOVector *qiov) 1106 { 1107 ssize_t r; 1108 size_t written; 1109 char *buf, *end_of_vec; 1110 struct iovec *i; 1111 1112 trace_ssh_write(offset, size); 1113 1114 trace_ssh_seek(offset); 1115 sftp_seek64(s->sftp_handle, offset); 1116 1117 /* This keeps track of the current iovec element ('i'), where we 1118 * will read from next ('buf'), and the end of the current iovec 1119 * ('end_of_vec'). 1120 */ 1121 i = &qiov->iov[0]; 1122 buf = i->iov_base; 1123 end_of_vec = i->iov_base + i->iov_len; 1124 1125 for (written = 0; written < size; ) { 1126 size_t request_write_size; 1127 again: 1128 /* 1129 * Avoid too large data packets, as libssh currently does not 1130 * handle multiple requests on its own. 1131 */ 1132 request_write_size = MIN(end_of_vec - buf, 131072); 1133 trace_ssh_write_buf(buf, end_of_vec - buf, request_write_size); 1134 r = sftp_write(s->sftp_handle, buf, request_write_size); 1135 trace_ssh_write_return(r, sftp_get_error(s->sftp)); 1136 1137 if (r == SSH_AGAIN) { 1138 co_yield(s, bs); 1139 goto again; 1140 } 1141 if (r < 0) { 1142 sftp_error_trace(s, "write"); 1143 return -EIO; 1144 } 1145 1146 written += r; 1147 buf += r; 1148 if (buf >= end_of_vec && written < size) { 1149 i++; 1150 buf = i->iov_base; 1151 end_of_vec = i->iov_base + i->iov_len; 1152 } 1153 1154 if (offset + written > s->attrs->size) { 1155 s->attrs->size = offset + written; 1156 } 1157 } 1158 1159 return 0; 1160 } 1161 1162 static coroutine_fn int ssh_co_writev(BlockDriverState *bs, 1163 int64_t sector_num, 1164 int nb_sectors, QEMUIOVector *qiov, 1165 int flags) 1166 { 1167 BDRVSSHState *s = bs->opaque; 1168 int ret; 1169 1170 assert(!flags); 1171 qemu_co_mutex_lock(&s->lock); 1172 ret = ssh_write(s, bs, sector_num * BDRV_SECTOR_SIZE, 1173 nb_sectors * BDRV_SECTOR_SIZE, qiov); 1174 qemu_co_mutex_unlock(&s->lock); 1175 1176 return ret; 1177 } 1178 1179 static void unsafe_flush_warning(BDRVSSHState *s, const char *what) 1180 { 1181 if (!s->unsafe_flush_warning) { 1182 warn_report("ssh server %s does not support fsync", 1183 s->inet->host); 1184 if (what) { 1185 error_report("to support fsync, you need %s", what); 1186 } 1187 s->unsafe_flush_warning = true; 1188 } 1189 } 1190 1191 static coroutine_fn int ssh_flush(BDRVSSHState *s, BlockDriverState *bs) 1192 { 1193 int r; 1194 1195 trace_ssh_flush(); 1196 1197 if (!sftp_extension_supported(s->sftp, "fsync@openssh.com", "1")) { 1198 unsafe_flush_warning(s, "OpenSSH >= 6.3"); 1199 return 0; 1200 } 1201 again: 1202 r = sftp_fsync(s->sftp_handle); 1203 if (r == SSH_AGAIN) { 1204 co_yield(s, bs); 1205 goto again; 1206 } 1207 if (r < 0) { 1208 sftp_error_trace(s, "fsync"); 1209 return -EIO; 1210 } 1211 1212 return 0; 1213 } 1214 1215 static coroutine_fn int ssh_co_flush(BlockDriverState *bs) 1216 { 1217 BDRVSSHState *s = bs->opaque; 1218 int ret; 1219 1220 qemu_co_mutex_lock(&s->lock); 1221 ret = ssh_flush(s, bs); 1222 qemu_co_mutex_unlock(&s->lock); 1223 1224 return ret; 1225 } 1226 1227 static int64_t ssh_getlength(BlockDriverState *bs) 1228 { 1229 BDRVSSHState *s = bs->opaque; 1230 int64_t length; 1231 1232 /* Note we cannot make a libssh call here. */ 1233 length = (int64_t) s->attrs->size; 1234 trace_ssh_getlength(length); 1235 1236 return length; 1237 } 1238 1239 static int coroutine_fn ssh_co_truncate(BlockDriverState *bs, int64_t offset, 1240 bool exact, PreallocMode prealloc, 1241 BdrvRequestFlags flags, Error **errp) 1242 { 1243 BDRVSSHState *s = bs->opaque; 1244 1245 if (prealloc != PREALLOC_MODE_OFF) { 1246 error_setg(errp, "Unsupported preallocation mode '%s'", 1247 PreallocMode_str(prealloc)); 1248 return -ENOTSUP; 1249 } 1250 1251 if (offset < s->attrs->size) { 1252 error_setg(errp, "ssh driver does not support shrinking files"); 1253 return -ENOTSUP; 1254 } 1255 1256 if (offset == s->attrs->size) { 1257 return 0; 1258 } 1259 1260 return ssh_grow_file(s, offset, errp); 1261 } 1262 1263 static void ssh_refresh_filename(BlockDriverState *bs) 1264 { 1265 BDRVSSHState *s = bs->opaque; 1266 const char *path, *host_key_check; 1267 int ret; 1268 1269 /* 1270 * None of these options can be represented in a plain "host:port" 1271 * format, so if any was given, we have to abort. 1272 */ 1273 if (s->inet->has_ipv4 || s->inet->has_ipv6 || s->inet->has_to || 1274 s->inet->has_numeric) 1275 { 1276 return; 1277 } 1278 1279 path = qdict_get_try_str(bs->full_open_options, "path"); 1280 assert(path); /* mandatory option */ 1281 1282 host_key_check = qdict_get_try_str(bs->full_open_options, "host_key_check"); 1283 1284 ret = snprintf(bs->exact_filename, sizeof(bs->exact_filename), 1285 "ssh://%s@%s:%s%s%s%s", 1286 s->user, s->inet->host, s->inet->port, path, 1287 host_key_check ? "?host_key_check=" : "", 1288 host_key_check ?: ""); 1289 if (ret >= sizeof(bs->exact_filename)) { 1290 /* An overflow makes the filename unusable, so do not report any */ 1291 bs->exact_filename[0] = '\0'; 1292 } 1293 } 1294 1295 static char *ssh_bdrv_dirname(BlockDriverState *bs, Error **errp) 1296 { 1297 if (qdict_haskey(bs->full_open_options, "host_key_check")) { 1298 /* 1299 * We cannot generate a simple prefix if we would have to 1300 * append a query string. 1301 */ 1302 error_setg(errp, 1303 "Cannot generate a base directory with host_key_check set"); 1304 return NULL; 1305 } 1306 1307 if (bs->exact_filename[0] == '\0') { 1308 error_setg(errp, "Cannot generate a base directory for this ssh node"); 1309 return NULL; 1310 } 1311 1312 return path_combine(bs->exact_filename, ""); 1313 } 1314 1315 static const char *const ssh_strong_runtime_opts[] = { 1316 "host", 1317 "port", 1318 "path", 1319 "user", 1320 "host_key_check", 1321 "server.", 1322 1323 NULL 1324 }; 1325 1326 static BlockDriver bdrv_ssh = { 1327 .format_name = "ssh", 1328 .protocol_name = "ssh", 1329 .instance_size = sizeof(BDRVSSHState), 1330 .bdrv_parse_filename = ssh_parse_filename, 1331 .bdrv_file_open = ssh_file_open, 1332 .bdrv_co_create = ssh_co_create, 1333 .bdrv_co_create_opts = ssh_co_create_opts, 1334 .bdrv_close = ssh_close, 1335 .bdrv_has_zero_init = ssh_has_zero_init, 1336 .bdrv_co_readv = ssh_co_readv, 1337 .bdrv_co_writev = ssh_co_writev, 1338 .bdrv_getlength = ssh_getlength, 1339 .bdrv_co_truncate = ssh_co_truncate, 1340 .bdrv_co_flush_to_disk = ssh_co_flush, 1341 .bdrv_refresh_filename = ssh_refresh_filename, 1342 .bdrv_dirname = ssh_bdrv_dirname, 1343 .create_opts = &ssh_create_opts, 1344 .strong_runtime_opts = ssh_strong_runtime_opts, 1345 }; 1346 1347 static void bdrv_ssh_init(void) 1348 { 1349 int r; 1350 1351 r = ssh_init(); 1352 if (r != 0) { 1353 fprintf(stderr, "libssh initialization failed, %d\n", r); 1354 exit(EXIT_FAILURE); 1355 } 1356 1357 #if TRACE_LIBSSH != 0 1358 ssh_set_log_level(TRACE_LIBSSH); 1359 #endif 1360 1361 bdrv_register(&bdrv_ssh); 1362 } 1363 1364 block_init(bdrv_ssh_init); 1365