1 /* 2 * QEMU I/O channels TLS driver 3 * 4 * Copyright (c) 2015 Red Hat, Inc. 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 * 19 */ 20 21 #include "qemu/osdep.h" 22 #include "qapi/error.h" 23 #include "io/channel-tls.h" 24 #include "trace.h" 25 26 27 static ssize_t qio_channel_tls_write_handler(const char *buf, 28 size_t len, 29 void *opaque) 30 { 31 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque); 32 ssize_t ret; 33 34 ret = qio_channel_write(tioc->master, buf, len, NULL); 35 if (ret == QIO_CHANNEL_ERR_BLOCK) { 36 errno = EAGAIN; 37 return -1; 38 } else if (ret < 0) { 39 errno = EIO; 40 return -1; 41 } 42 return ret; 43 } 44 45 static ssize_t qio_channel_tls_read_handler(char *buf, 46 size_t len, 47 void *opaque) 48 { 49 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque); 50 ssize_t ret; 51 52 ret = qio_channel_read(tioc->master, buf, len, NULL); 53 if (ret == QIO_CHANNEL_ERR_BLOCK) { 54 errno = EAGAIN; 55 return -1; 56 } else if (ret < 0) { 57 errno = EIO; 58 return -1; 59 } 60 return ret; 61 } 62 63 64 QIOChannelTLS * 65 qio_channel_tls_new_server(QIOChannel *master, 66 QCryptoTLSCreds *creds, 67 const char *aclname, 68 Error **errp) 69 { 70 QIOChannelTLS *ioc; 71 72 ioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS)); 73 74 ioc->master = master; 75 object_ref(OBJECT(master)); 76 77 ioc->session = qcrypto_tls_session_new( 78 creds, 79 NULL, 80 aclname, 81 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER, 82 errp); 83 if (!ioc->session) { 84 goto error; 85 } 86 87 qcrypto_tls_session_set_callbacks( 88 ioc->session, 89 qio_channel_tls_write_handler, 90 qio_channel_tls_read_handler, 91 ioc); 92 93 trace_qio_channel_tls_new_server(ioc, master, creds, aclname); 94 return ioc; 95 96 error: 97 object_unref(OBJECT(ioc)); 98 return NULL; 99 } 100 101 QIOChannelTLS * 102 qio_channel_tls_new_client(QIOChannel *master, 103 QCryptoTLSCreds *creds, 104 const char *hostname, 105 Error **errp) 106 { 107 QIOChannelTLS *tioc; 108 QIOChannel *ioc; 109 110 tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS)); 111 ioc = QIO_CHANNEL(tioc); 112 113 tioc->master = master; 114 if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) { 115 qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN); 116 } 117 object_ref(OBJECT(master)); 118 119 tioc->session = qcrypto_tls_session_new( 120 creds, 121 hostname, 122 NULL, 123 QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT, 124 errp); 125 if (!tioc->session) { 126 goto error; 127 } 128 129 qcrypto_tls_session_set_callbacks( 130 tioc->session, 131 qio_channel_tls_write_handler, 132 qio_channel_tls_read_handler, 133 tioc); 134 135 trace_qio_channel_tls_new_client(tioc, master, creds, hostname); 136 return tioc; 137 138 error: 139 object_unref(OBJECT(tioc)); 140 return NULL; 141 } 142 143 144 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc, 145 GIOCondition condition, 146 gpointer user_data); 147 148 static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc, 149 QIOTask *task) 150 { 151 Error *err = NULL; 152 QCryptoTLSSessionHandshakeStatus status; 153 154 if (qcrypto_tls_session_handshake(ioc->session, &err) < 0) { 155 trace_qio_channel_tls_handshake_fail(ioc); 156 qio_task_set_error(task, err); 157 qio_task_complete(task); 158 return; 159 } 160 161 status = qcrypto_tls_session_get_handshake_status(ioc->session); 162 if (status == QCRYPTO_TLS_HANDSHAKE_COMPLETE) { 163 trace_qio_channel_tls_handshake_complete(ioc); 164 if (qcrypto_tls_session_check_credentials(ioc->session, 165 &err) < 0) { 166 trace_qio_channel_tls_credentials_deny(ioc); 167 qio_task_set_error(task, err); 168 } else { 169 trace_qio_channel_tls_credentials_allow(ioc); 170 } 171 qio_task_complete(task); 172 } else { 173 GIOCondition condition; 174 if (status == QCRYPTO_TLS_HANDSHAKE_SENDING) { 175 condition = G_IO_OUT; 176 } else { 177 condition = G_IO_IN; 178 } 179 180 trace_qio_channel_tls_handshake_pending(ioc, status); 181 qio_channel_add_watch(ioc->master, 182 condition, 183 qio_channel_tls_handshake_io, 184 task, 185 NULL); 186 } 187 } 188 189 190 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc, 191 GIOCondition condition, 192 gpointer user_data) 193 { 194 QIOTask *task = user_data; 195 QIOChannelTLS *tioc = QIO_CHANNEL_TLS( 196 qio_task_get_source(task)); 197 198 qio_channel_tls_handshake_task( 199 tioc, task); 200 201 return FALSE; 202 } 203 204 void qio_channel_tls_handshake(QIOChannelTLS *ioc, 205 QIOTaskFunc func, 206 gpointer opaque, 207 GDestroyNotify destroy) 208 { 209 QIOTask *task; 210 211 task = qio_task_new(OBJECT(ioc), 212 func, opaque, destroy); 213 214 trace_qio_channel_tls_handshake_start(ioc); 215 qio_channel_tls_handshake_task(ioc, task); 216 } 217 218 219 static void qio_channel_tls_init(Object *obj G_GNUC_UNUSED) 220 { 221 } 222 223 224 static void qio_channel_tls_finalize(Object *obj) 225 { 226 QIOChannelTLS *ioc = QIO_CHANNEL_TLS(obj); 227 228 object_unref(OBJECT(ioc->master)); 229 qcrypto_tls_session_free(ioc->session); 230 } 231 232 233 static ssize_t qio_channel_tls_readv(QIOChannel *ioc, 234 const struct iovec *iov, 235 size_t niov, 236 int **fds, 237 size_t *nfds, 238 Error **errp) 239 { 240 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 241 size_t i; 242 ssize_t got = 0; 243 244 for (i = 0 ; i < niov ; i++) { 245 ssize_t ret = qcrypto_tls_session_read(tioc->session, 246 iov[i].iov_base, 247 iov[i].iov_len); 248 if (ret < 0) { 249 if (errno == EAGAIN) { 250 if (got) { 251 return got; 252 } else { 253 return QIO_CHANNEL_ERR_BLOCK; 254 } 255 } 256 257 error_setg_errno(errp, errno, 258 "Cannot read from TLS channel"); 259 return -1; 260 } 261 got += ret; 262 if (ret < iov[i].iov_len) { 263 break; 264 } 265 } 266 return got; 267 } 268 269 270 static ssize_t qio_channel_tls_writev(QIOChannel *ioc, 271 const struct iovec *iov, 272 size_t niov, 273 int *fds, 274 size_t nfds, 275 Error **errp) 276 { 277 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 278 size_t i; 279 ssize_t done = 0; 280 281 for (i = 0 ; i < niov ; i++) { 282 ssize_t ret = qcrypto_tls_session_write(tioc->session, 283 iov[i].iov_base, 284 iov[i].iov_len); 285 if (ret <= 0) { 286 if (errno == EAGAIN) { 287 if (done) { 288 return done; 289 } else { 290 return QIO_CHANNEL_ERR_BLOCK; 291 } 292 } 293 294 error_setg_errno(errp, errno, 295 "Cannot write to TLS channel"); 296 return -1; 297 } 298 done += ret; 299 if (ret < iov[i].iov_len) { 300 break; 301 } 302 } 303 return done; 304 } 305 306 static int qio_channel_tls_set_blocking(QIOChannel *ioc, 307 bool enabled, 308 Error **errp) 309 { 310 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 311 312 return qio_channel_set_blocking(tioc->master, enabled, errp); 313 } 314 315 static void qio_channel_tls_set_delay(QIOChannel *ioc, 316 bool enabled) 317 { 318 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 319 320 qio_channel_set_delay(tioc->master, enabled); 321 } 322 323 static void qio_channel_tls_set_cork(QIOChannel *ioc, 324 bool enabled) 325 { 326 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 327 328 qio_channel_set_cork(tioc->master, enabled); 329 } 330 331 static int qio_channel_tls_shutdown(QIOChannel *ioc, 332 QIOChannelShutdown how, 333 Error **errp) 334 { 335 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 336 337 return qio_channel_shutdown(tioc->master, how, errp); 338 } 339 340 static int qio_channel_tls_close(QIOChannel *ioc, 341 Error **errp) 342 { 343 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 344 345 return qio_channel_close(tioc->master, errp); 346 } 347 348 static void qio_channel_tls_set_aio_fd_handler(QIOChannel *ioc, 349 AioContext *ctx, 350 IOHandler *io_read, 351 IOHandler *io_write, 352 void *opaque) 353 { 354 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 355 356 qio_channel_set_aio_fd_handler(tioc->master, ctx, io_read, io_write, opaque); 357 } 358 359 static GSource *qio_channel_tls_create_watch(QIOChannel *ioc, 360 GIOCondition condition) 361 { 362 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 363 364 return qio_channel_create_watch(tioc->master, condition); 365 } 366 367 QCryptoTLSSession * 368 qio_channel_tls_get_session(QIOChannelTLS *ioc) 369 { 370 return ioc->session; 371 } 372 373 static void qio_channel_tls_class_init(ObjectClass *klass, 374 void *class_data G_GNUC_UNUSED) 375 { 376 QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass); 377 378 ioc_klass->io_writev = qio_channel_tls_writev; 379 ioc_klass->io_readv = qio_channel_tls_readv; 380 ioc_klass->io_set_blocking = qio_channel_tls_set_blocking; 381 ioc_klass->io_set_delay = qio_channel_tls_set_delay; 382 ioc_klass->io_set_cork = qio_channel_tls_set_cork; 383 ioc_klass->io_close = qio_channel_tls_close; 384 ioc_klass->io_shutdown = qio_channel_tls_shutdown; 385 ioc_klass->io_create_watch = qio_channel_tls_create_watch; 386 ioc_klass->io_set_aio_fd_handler = qio_channel_tls_set_aio_fd_handler; 387 } 388 389 static const TypeInfo qio_channel_tls_info = { 390 .parent = TYPE_QIO_CHANNEL, 391 .name = TYPE_QIO_CHANNEL_TLS, 392 .instance_size = sizeof(QIOChannelTLS), 393 .instance_init = qio_channel_tls_init, 394 .instance_finalize = qio_channel_tls_finalize, 395 .class_init = qio_channel_tls_class_init, 396 }; 397 398 static void qio_channel_tls_register_types(void) 399 { 400 type_register_static(&qio_channel_tls_info); 401 } 402 403 type_init(qio_channel_tls_register_types); 404