1 /* 2 * QEMU I/O channels TLS driver 3 * 4 * Copyright (c) 2015 Red Hat, Inc. 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 * 19 */ 20 21 #include "qemu/osdep.h" 22 #include "io/channel-tls.h" 23 #include "trace.h" 24 25 26 static ssize_t qio_channel_tls_write_handler(const char *buf, 27 size_t len, 28 void *opaque) 29 { 30 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque); 31 ssize_t ret; 32 33 ret = qio_channel_write(tioc->master, buf, len, NULL); 34 if (ret == QIO_CHANNEL_ERR_BLOCK) { 35 errno = EAGAIN; 36 return -1; 37 } else if (ret < 0) { 38 errno = EIO; 39 return -1; 40 } 41 return ret; 42 } 43 44 static ssize_t qio_channel_tls_read_handler(char *buf, 45 size_t len, 46 void *opaque) 47 { 48 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque); 49 ssize_t ret; 50 51 ret = qio_channel_read(tioc->master, buf, len, NULL); 52 if (ret == QIO_CHANNEL_ERR_BLOCK) { 53 errno = EAGAIN; 54 return -1; 55 } else if (ret < 0) { 56 errno = EIO; 57 return -1; 58 } 59 return ret; 60 } 61 62 63 QIOChannelTLS * 64 qio_channel_tls_new_server(QIOChannel *master, 65 QCryptoTLSCreds *creds, 66 const char *aclname, 67 Error **errp) 68 { 69 QIOChannelTLS *ioc; 70 71 ioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS)); 72 73 ioc->master = master; 74 object_ref(OBJECT(master)); 75 76 ioc->session = qcrypto_tls_session_new( 77 creds, 78 NULL, 79 aclname, 80 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER, 81 errp); 82 if (!ioc->session) { 83 goto error; 84 } 85 86 qcrypto_tls_session_set_callbacks( 87 ioc->session, 88 qio_channel_tls_write_handler, 89 qio_channel_tls_read_handler, 90 ioc); 91 92 trace_qio_channel_tls_new_server(ioc, master, creds, aclname); 93 return ioc; 94 95 error: 96 object_unref(OBJECT(ioc)); 97 return NULL; 98 } 99 100 QIOChannelTLS * 101 qio_channel_tls_new_client(QIOChannel *master, 102 QCryptoTLSCreds *creds, 103 const char *hostname, 104 Error **errp) 105 { 106 QIOChannelTLS *tioc; 107 QIOChannel *ioc; 108 109 tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS)); 110 ioc = QIO_CHANNEL(tioc); 111 112 tioc->master = master; 113 if (master->features & (1 << QIO_CHANNEL_FEATURE_SHUTDOWN)) { 114 ioc->features |= (1 << QIO_CHANNEL_FEATURE_SHUTDOWN); 115 } 116 object_ref(OBJECT(master)); 117 118 tioc->session = qcrypto_tls_session_new( 119 creds, 120 hostname, 121 NULL, 122 QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT, 123 errp); 124 if (!tioc->session) { 125 goto error; 126 } 127 128 qcrypto_tls_session_set_callbacks( 129 tioc->session, 130 qio_channel_tls_write_handler, 131 qio_channel_tls_read_handler, 132 tioc); 133 134 trace_qio_channel_tls_new_client(tioc, master, creds, hostname); 135 return tioc; 136 137 error: 138 object_unref(OBJECT(tioc)); 139 return NULL; 140 } 141 142 143 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc, 144 GIOCondition condition, 145 gpointer user_data); 146 147 static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc, 148 QIOTask *task) 149 { 150 Error *err = NULL; 151 QCryptoTLSSessionHandshakeStatus status; 152 153 if (qcrypto_tls_session_handshake(ioc->session, &err) < 0) { 154 trace_qio_channel_tls_handshake_fail(ioc); 155 qio_task_abort(task, err); 156 goto cleanup; 157 } 158 159 status = qcrypto_tls_session_get_handshake_status(ioc->session); 160 if (status == QCRYPTO_TLS_HANDSHAKE_COMPLETE) { 161 trace_qio_channel_tls_handshake_complete(ioc); 162 if (qcrypto_tls_session_check_credentials(ioc->session, 163 &err) < 0) { 164 trace_qio_channel_tls_credentials_deny(ioc); 165 qio_task_abort(task, err); 166 goto cleanup; 167 } 168 trace_qio_channel_tls_credentials_allow(ioc); 169 qio_task_complete(task); 170 } else { 171 GIOCondition condition; 172 if (status == QCRYPTO_TLS_HANDSHAKE_SENDING) { 173 condition = G_IO_OUT; 174 } else { 175 condition = G_IO_IN; 176 } 177 178 trace_qio_channel_tls_handshake_pending(ioc, status); 179 qio_channel_add_watch(ioc->master, 180 condition, 181 qio_channel_tls_handshake_io, 182 task, 183 NULL); 184 } 185 186 cleanup: 187 error_free(err); 188 } 189 190 191 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc, 192 GIOCondition condition, 193 gpointer user_data) 194 { 195 QIOTask *task = user_data; 196 QIOChannelTLS *tioc = QIO_CHANNEL_TLS( 197 qio_task_get_source(task)); 198 199 qio_channel_tls_handshake_task( 200 tioc, task); 201 202 object_unref(OBJECT(tioc)); 203 204 return FALSE; 205 } 206 207 void qio_channel_tls_handshake(QIOChannelTLS *ioc, 208 QIOTaskFunc func, 209 gpointer opaque, 210 GDestroyNotify destroy) 211 { 212 QIOTask *task; 213 214 task = qio_task_new(OBJECT(ioc), 215 func, opaque, destroy); 216 217 trace_qio_channel_tls_handshake_start(ioc); 218 qio_channel_tls_handshake_task(ioc, task); 219 } 220 221 222 static void qio_channel_tls_init(Object *obj G_GNUC_UNUSED) 223 { 224 } 225 226 227 static void qio_channel_tls_finalize(Object *obj) 228 { 229 QIOChannelTLS *ioc = QIO_CHANNEL_TLS(obj); 230 231 object_unref(OBJECT(ioc->master)); 232 qcrypto_tls_session_free(ioc->session); 233 } 234 235 236 static ssize_t qio_channel_tls_readv(QIOChannel *ioc, 237 const struct iovec *iov, 238 size_t niov, 239 int **fds, 240 size_t *nfds, 241 Error **errp) 242 { 243 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 244 size_t i; 245 ssize_t got = 0; 246 247 for (i = 0 ; i < niov ; i++) { 248 ssize_t ret = qcrypto_tls_session_read(tioc->session, 249 iov[i].iov_base, 250 iov[i].iov_len); 251 if (ret < 0) { 252 if (errno == EAGAIN) { 253 if (got) { 254 return got; 255 } else { 256 return QIO_CHANNEL_ERR_BLOCK; 257 } 258 } 259 260 error_setg_errno(errp, errno, 261 "Cannot read from TLS channel"); 262 return -1; 263 } 264 got += ret; 265 if (ret < iov[i].iov_len) { 266 break; 267 } 268 } 269 return got; 270 } 271 272 273 static ssize_t qio_channel_tls_writev(QIOChannel *ioc, 274 const struct iovec *iov, 275 size_t niov, 276 int *fds, 277 size_t nfds, 278 Error **errp) 279 { 280 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 281 size_t i; 282 ssize_t done = 0; 283 284 for (i = 0 ; i < niov ; i++) { 285 ssize_t ret = qcrypto_tls_session_write(tioc->session, 286 iov[i].iov_base, 287 iov[i].iov_len); 288 if (ret <= 0) { 289 if (errno == EAGAIN) { 290 if (done) { 291 return done; 292 } else { 293 return QIO_CHANNEL_ERR_BLOCK; 294 } 295 } 296 297 error_setg_errno(errp, errno, 298 "Cannot write to TLS channel"); 299 return -1; 300 } 301 done += ret; 302 if (ret < iov[i].iov_len) { 303 break; 304 } 305 } 306 return done; 307 } 308 309 static int qio_channel_tls_set_blocking(QIOChannel *ioc, 310 bool enabled, 311 Error **errp) 312 { 313 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 314 315 return qio_channel_set_blocking(tioc->master, enabled, errp); 316 } 317 318 static void qio_channel_tls_set_delay(QIOChannel *ioc, 319 bool enabled) 320 { 321 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 322 323 qio_channel_set_delay(tioc->master, enabled); 324 } 325 326 static void qio_channel_tls_set_cork(QIOChannel *ioc, 327 bool enabled) 328 { 329 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 330 331 qio_channel_set_cork(tioc->master, enabled); 332 } 333 334 static int qio_channel_tls_shutdown(QIOChannel *ioc, 335 QIOChannelShutdown how, 336 Error **errp) 337 { 338 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 339 340 return qio_channel_shutdown(tioc->master, how, errp); 341 } 342 343 static int qio_channel_tls_close(QIOChannel *ioc, 344 Error **errp) 345 { 346 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 347 348 return qio_channel_close(tioc->master, errp); 349 } 350 351 static GSource *qio_channel_tls_create_watch(QIOChannel *ioc, 352 GIOCondition condition) 353 { 354 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 355 356 return qio_channel_create_watch(tioc->master, condition); 357 } 358 359 QCryptoTLSSession * 360 qio_channel_tls_get_session(QIOChannelTLS *ioc) 361 { 362 return ioc->session; 363 } 364 365 static void qio_channel_tls_class_init(ObjectClass *klass, 366 void *class_data G_GNUC_UNUSED) 367 { 368 QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass); 369 370 ioc_klass->io_writev = qio_channel_tls_writev; 371 ioc_klass->io_readv = qio_channel_tls_readv; 372 ioc_klass->io_set_blocking = qio_channel_tls_set_blocking; 373 ioc_klass->io_set_delay = qio_channel_tls_set_delay; 374 ioc_klass->io_set_cork = qio_channel_tls_set_cork; 375 ioc_klass->io_close = qio_channel_tls_close; 376 ioc_klass->io_shutdown = qio_channel_tls_shutdown; 377 ioc_klass->io_create_watch = qio_channel_tls_create_watch; 378 } 379 380 static const TypeInfo qio_channel_tls_info = { 381 .parent = TYPE_QIO_CHANNEL, 382 .name = TYPE_QIO_CHANNEL_TLS, 383 .instance_size = sizeof(QIOChannelTLS), 384 .instance_init = qio_channel_tls_init, 385 .instance_finalize = qio_channel_tls_finalize, 386 .class_init = qio_channel_tls_class_init, 387 }; 388 389 static void qio_channel_tls_register_types(void) 390 { 391 type_register_static(&qio_channel_tls_info); 392 } 393 394 type_init(qio_channel_tls_register_types); 395