xref: /openbmc/qemu/io/channel-tls.c (revision 2e1cacfb) 
1 /*
2  * QEMU I/O channels TLS driver
3  *
4  * Copyright (c) 2015 Red Hat, Inc.
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18  *
19  */
20 
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "qemu/module.h"
24 #include "io/channel-tls.h"
25 #include "trace.h"
26 #include "qemu/atomic.h"
27 
28 
29 static ssize_t qio_channel_tls_write_handler(const char *buf,
30                                              size_t len,
31                                              void *opaque,
32                                              Error **errp)
33 {
34     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
35     ssize_t ret;
36 
37     ret = qio_channel_write(tioc->master, buf, len, errp);
38     if (ret == QIO_CHANNEL_ERR_BLOCK) {
39         return QCRYPTO_TLS_SESSION_ERR_BLOCK;
40     } else if (ret < 0) {
41         return -1;
42     }
43     return ret;
44 }
45 
46 static ssize_t qio_channel_tls_read_handler(char *buf,
47                                             size_t len,
48                                             void *opaque,
49                                             Error **errp)
50 {
51     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
52     ssize_t ret;
53 
54     ret = qio_channel_read(tioc->master, buf, len, errp);
55     if (ret == QIO_CHANNEL_ERR_BLOCK) {
56         return QCRYPTO_TLS_SESSION_ERR_BLOCK;
57     } else if (ret < 0) {
58         return -1;
59     }
60     return ret;
61 }
62 
63 
64 QIOChannelTLS *
65 qio_channel_tls_new_server(QIOChannel *master,
66                            QCryptoTLSCreds *creds,
67                            const char *aclname,
68                            Error **errp)
69 {
70     QIOChannelTLS *tioc;
71     QIOChannel *ioc;
72 
73     tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
74     ioc = QIO_CHANNEL(tioc);
75 
76     tioc->master = master;
77     ioc->follow_coroutine_ctx = master->follow_coroutine_ctx;
78     if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
79         qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
80     }
81     object_ref(OBJECT(master));
82 
83     tioc->session = qcrypto_tls_session_new(
84         creds,
85         NULL,
86         aclname,
87         QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
88         errp);
89     if (!tioc->session) {
90         goto error;
91     }
92 
93     qcrypto_tls_session_set_callbacks(
94         tioc->session,
95         qio_channel_tls_write_handler,
96         qio_channel_tls_read_handler,
97         tioc);
98 
99     trace_qio_channel_tls_new_server(tioc, master, creds, aclname);
100     return tioc;
101 
102  error:
103     object_unref(OBJECT(tioc));
104     return NULL;
105 }
106 
107 QIOChannelTLS *
108 qio_channel_tls_new_client(QIOChannel *master,
109                            QCryptoTLSCreds *creds,
110                            const char *hostname,
111                            Error **errp)
112 {
113     QIOChannelTLS *tioc;
114     QIOChannel *ioc;
115 
116     tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
117     ioc = QIO_CHANNEL(tioc);
118 
119     tioc->master = master;
120     ioc->follow_coroutine_ctx = master->follow_coroutine_ctx;
121     if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
122         qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
123     }
124     object_ref(OBJECT(master));
125 
126     tioc->session = qcrypto_tls_session_new(
127         creds,
128         hostname,
129         NULL,
130         QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT,
131         errp);
132     if (!tioc->session) {
133         goto error;
134     }
135 
136     qcrypto_tls_session_set_callbacks(
137         tioc->session,
138         qio_channel_tls_write_handler,
139         qio_channel_tls_read_handler,
140         tioc);
141 
142     trace_qio_channel_tls_new_client(tioc, master, creds, hostname);
143     return tioc;
144 
145  error:
146     object_unref(OBJECT(tioc));
147     return NULL;
148 }
149 
150 struct QIOChannelTLSData {
151     QIOTask *task;
152     GMainContext *context;
153 };
154 typedef struct QIOChannelTLSData QIOChannelTLSData;
155 
156 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
157                                              GIOCondition condition,
158                                              gpointer user_data);
159 
160 static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
161                                            QIOTask *task,
162                                            GMainContext *context)
163 {
164     Error *err = NULL;
165     QCryptoTLSSessionHandshakeStatus status;
166 
167     if (qcrypto_tls_session_handshake(ioc->session, &err) < 0) {
168         trace_qio_channel_tls_handshake_fail(ioc);
169         qio_task_set_error(task, err);
170         qio_task_complete(task);
171         return;
172     }
173 
174     status = qcrypto_tls_session_get_handshake_status(ioc->session);
175     if (status == QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
176         trace_qio_channel_tls_handshake_complete(ioc);
177         if (qcrypto_tls_session_check_credentials(ioc->session,
178                                                   &err) < 0) {
179             trace_qio_channel_tls_credentials_deny(ioc);
180             qio_task_set_error(task, err);
181         } else {
182             trace_qio_channel_tls_credentials_allow(ioc);
183         }
184         qio_task_complete(task);
185     } else {
186         GIOCondition condition;
187         QIOChannelTLSData *data = g_new0(typeof(*data), 1);
188 
189         data->task = task;
190         data->context = context;
191 
192         if (context) {
193             g_main_context_ref(context);
194         }
195 
196         if (status == QCRYPTO_TLS_HANDSHAKE_SENDING) {
197             condition = G_IO_OUT;
198         } else {
199             condition = G_IO_IN;
200         }
201 
202         trace_qio_channel_tls_handshake_pending(ioc, status);
203         ioc->hs_ioc_tag =
204             qio_channel_add_watch_full(ioc->master,
205                                        condition,
206                                        qio_channel_tls_handshake_io,
207                                        data,
208                                        NULL,
209                                        context);
210     }
211 }
212 
213 
214 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
215                                              GIOCondition condition,
216                                              gpointer user_data)
217 {
218     QIOChannelTLSData *data = user_data;
219     QIOTask *task = data->task;
220     GMainContext *context = data->context;
221     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(
222         qio_task_get_source(task));
223 
224     tioc->hs_ioc_tag = 0;
225     g_free(data);
226     qio_channel_tls_handshake_task(tioc, task, context);
227 
228     if (context) {
229         g_main_context_unref(context);
230     }
231 
232     return FALSE;
233 }
234 
235 void qio_channel_tls_handshake(QIOChannelTLS *ioc,
236                                QIOTaskFunc func,
237                                gpointer opaque,
238                                GDestroyNotify destroy,
239                                GMainContext *context)
240 {
241     QIOTask *task;
242 
243     task = qio_task_new(OBJECT(ioc),
244                         func, opaque, destroy);
245 
246     trace_qio_channel_tls_handshake_start(ioc);
247     qio_channel_tls_handshake_task(ioc, task, context);
248 }
249 
250 
251 static void qio_channel_tls_init(Object *obj G_GNUC_UNUSED)
252 {
253 }
254 
255 
256 static void qio_channel_tls_finalize(Object *obj)
257 {
258     QIOChannelTLS *ioc = QIO_CHANNEL_TLS(obj);
259 
260     object_unref(OBJECT(ioc->master));
261     qcrypto_tls_session_free(ioc->session);
262 }
263 
264 
265 static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
266                                      const struct iovec *iov,
267                                      size_t niov,
268                                      int **fds,
269                                      size_t *nfds,
270                                      int flags,
271                                      Error **errp)
272 {
273     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
274     size_t i;
275     ssize_t got = 0;
276 
277     for (i = 0 ; i < niov ; i++) {
278         ssize_t ret = qcrypto_tls_session_read(
279             tioc->session,
280             iov[i].iov_base,
281             iov[i].iov_len,
282             qatomic_load_acquire(&tioc->shutdown) & QIO_CHANNEL_SHUTDOWN_READ,
283             errp);
284         if (ret == QCRYPTO_TLS_SESSION_ERR_BLOCK) {
285             if (got) {
286                 return got;
287             } else {
288                 return QIO_CHANNEL_ERR_BLOCK;
289             }
290         } else if (ret < 0) {
291             return -1;
292         }
293         got += ret;
294         if (ret < iov[i].iov_len) {
295             break;
296         }
297     }
298     return got;
299 }
300 
301 
302 static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
303                                       const struct iovec *iov,
304                                       size_t niov,
305                                       int *fds,
306                                       size_t nfds,
307                                       int flags,
308                                       Error **errp)
309 {
310     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
311     size_t i;
312     ssize_t done = 0;
313 
314     for (i = 0 ; i < niov ; i++) {
315         ssize_t ret = qcrypto_tls_session_write(tioc->session,
316                                                 iov[i].iov_base,
317                                                 iov[i].iov_len,
318                                                 errp);
319         if (ret == QCRYPTO_TLS_SESSION_ERR_BLOCK) {
320             if (done) {
321                 return done;
322             } else {
323                 return QIO_CHANNEL_ERR_BLOCK;
324             }
325         } else if (ret < 0) {
326             return -1;
327         }
328         done += ret;
329         if (ret < iov[i].iov_len) {
330             break;
331         }
332     }
333     return done;
334 }
335 
336 static int qio_channel_tls_set_blocking(QIOChannel *ioc,
337                                         bool enabled,
338                                         Error **errp)
339 {
340     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
341 
342     return qio_channel_set_blocking(tioc->master, enabled, errp);
343 }
344 
345 static void qio_channel_tls_set_delay(QIOChannel *ioc,
346                                       bool enabled)
347 {
348     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
349 
350     qio_channel_set_delay(tioc->master, enabled);
351 }
352 
353 static void qio_channel_tls_set_cork(QIOChannel *ioc,
354                                      bool enabled)
355 {
356     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
357 
358     qio_channel_set_cork(tioc->master, enabled);
359 }
360 
361 static int qio_channel_tls_shutdown(QIOChannel *ioc,
362                                     QIOChannelShutdown how,
363                                     Error **errp)
364 {
365     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
366 
367     qatomic_or(&tioc->shutdown, how);
368 
369     return qio_channel_shutdown(tioc->master, how, errp);
370 }
371 
372 static int qio_channel_tls_close(QIOChannel *ioc,
373                                  Error **errp)
374 {
375     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
376 
377     if (tioc->hs_ioc_tag) {
378         trace_qio_channel_tls_handshake_cancel(ioc);
379         g_clear_handle_id(&tioc->hs_ioc_tag, g_source_remove);
380     }
381 
382     return qio_channel_close(tioc->master, errp);
383 }
384 
385 static void qio_channel_tls_set_aio_fd_handler(QIOChannel *ioc,
386                                                AioContext *read_ctx,
387                                                IOHandler *io_read,
388                                                AioContext *write_ctx,
389                                                IOHandler *io_write,
390                                                void *opaque)
391 {
392     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
393 
394     qio_channel_set_aio_fd_handler(tioc->master, read_ctx, io_read,
395             write_ctx, io_write, opaque);
396 }
397 
398 typedef struct QIOChannelTLSSource QIOChannelTLSSource;
399 struct QIOChannelTLSSource {
400     GSource parent;
401     QIOChannelTLS *tioc;
402 };
403 
404 static gboolean
405 qio_channel_tls_source_check(GSource *source)
406 {
407     QIOChannelTLSSource *tsource = (QIOChannelTLSSource *)source;
408 
409     return qcrypto_tls_session_check_pending(tsource->tioc->session) > 0;
410 }
411 
412 static gboolean
413 qio_channel_tls_source_prepare(GSource *source, gint *timeout)
414 {
415     *timeout = -1;
416     return qio_channel_tls_source_check(source);
417 }
418 
419 static gboolean
420 qio_channel_tls_source_dispatch(GSource *source, GSourceFunc callback,
421                                 gpointer user_data)
422 {
423     return G_SOURCE_CONTINUE;
424 }
425 
426 static void
427 qio_channel_tls_source_finalize(GSource *source)
428 {
429     QIOChannelTLSSource *tsource = (QIOChannelTLSSource *)source;
430 
431     object_unref(OBJECT(tsource->tioc));
432 }
433 
434 static GSourceFuncs qio_channel_tls_source_funcs = {
435     qio_channel_tls_source_prepare,
436     qio_channel_tls_source_check,
437     qio_channel_tls_source_dispatch,
438     qio_channel_tls_source_finalize
439 };
440 
441 static void
442 qio_channel_tls_read_watch(QIOChannelTLS *tioc, GSource *source)
443 {
444     GSource *child;
445     QIOChannelTLSSource *tlssource;
446 
447     child = g_source_new(&qio_channel_tls_source_funcs,
448                           sizeof(QIOChannelTLSSource));
449     tlssource = (QIOChannelTLSSource *)child;
450 
451     tlssource->tioc = tioc;
452     object_ref(OBJECT(tioc));
453 
454     g_source_add_child_source(source, child);
455     g_source_unref(child);
456 }
457 
458 static GSource *qio_channel_tls_create_watch(QIOChannel *ioc,
459                                              GIOCondition condition)
460 {
461     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
462     GSource *source = qio_channel_create_watch(tioc->master, condition);
463 
464     if (condition & G_IO_IN) {
465         qio_channel_tls_read_watch(tioc, source);
466     }
467 
468     return source;
469 }
470 
471 QCryptoTLSSession *
472 qio_channel_tls_get_session(QIOChannelTLS *ioc)
473 {
474     return ioc->session;
475 }
476 
477 static void qio_channel_tls_class_init(ObjectClass *klass,
478                                        void *class_data G_GNUC_UNUSED)
479 {
480     QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
481 
482     ioc_klass->io_writev = qio_channel_tls_writev;
483     ioc_klass->io_readv = qio_channel_tls_readv;
484     ioc_klass->io_set_blocking = qio_channel_tls_set_blocking;
485     ioc_klass->io_set_delay = qio_channel_tls_set_delay;
486     ioc_klass->io_set_cork = qio_channel_tls_set_cork;
487     ioc_klass->io_close = qio_channel_tls_close;
488     ioc_klass->io_shutdown = qio_channel_tls_shutdown;
489     ioc_klass->io_create_watch = qio_channel_tls_create_watch;
490     ioc_klass->io_set_aio_fd_handler = qio_channel_tls_set_aio_fd_handler;
491 }
492 
493 static const TypeInfo qio_channel_tls_info = {
494     .parent = TYPE_QIO_CHANNEL,
495     .name = TYPE_QIO_CHANNEL_TLS,
496     .instance_size = sizeof(QIOChannelTLS),
497     .instance_init = qio_channel_tls_init,
498     .instance_finalize = qio_channel_tls_finalize,
499     .class_init = qio_channel_tls_class_init,
500 };
501 
502 static void qio_channel_tls_register_types(void)
503 {
504     type_register_static(&qio_channel_tls_info);
505 }
506 
507 type_init(qio_channel_tls_register_types);
508