1 /* 2 * QEMU I/O channels TLS driver 3 * 4 * Copyright (c) 2015 Red Hat, Inc. 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 * 19 */ 20 21 #include "io/channel-tls.h" 22 #include "trace.h" 23 24 25 static ssize_t qio_channel_tls_write_handler(const char *buf, 26 size_t len, 27 void *opaque) 28 { 29 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque); 30 ssize_t ret; 31 32 ret = qio_channel_write(tioc->master, buf, len, NULL); 33 if (ret == QIO_CHANNEL_ERR_BLOCK) { 34 errno = EAGAIN; 35 return -1; 36 } else if (ret < 0) { 37 errno = EIO; 38 return -1; 39 } 40 return ret; 41 } 42 43 static ssize_t qio_channel_tls_read_handler(char *buf, 44 size_t len, 45 void *opaque) 46 { 47 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque); 48 ssize_t ret; 49 50 ret = qio_channel_read(tioc->master, buf, len, NULL); 51 if (ret == QIO_CHANNEL_ERR_BLOCK) { 52 errno = EAGAIN; 53 return -1; 54 } else if (ret < 0) { 55 errno = EIO; 56 return -1; 57 } 58 return ret; 59 } 60 61 62 QIOChannelTLS * 63 qio_channel_tls_new_server(QIOChannel *master, 64 QCryptoTLSCreds *creds, 65 const char *aclname, 66 Error **errp) 67 { 68 QIOChannelTLS *ioc; 69 70 ioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS)); 71 72 ioc->master = master; 73 object_ref(OBJECT(master)); 74 75 ioc->session = qcrypto_tls_session_new( 76 creds, 77 NULL, 78 aclname, 79 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER, 80 errp); 81 if (!ioc->session) { 82 goto error; 83 } 84 85 qcrypto_tls_session_set_callbacks( 86 ioc->session, 87 qio_channel_tls_write_handler, 88 qio_channel_tls_read_handler, 89 ioc); 90 91 trace_qio_channel_tls_new_server(ioc, master, creds, aclname); 92 return ioc; 93 94 error: 95 object_unref(OBJECT(ioc)); 96 return NULL; 97 } 98 99 QIOChannelTLS * 100 qio_channel_tls_new_client(QIOChannel *master, 101 QCryptoTLSCreds *creds, 102 const char *hostname, 103 Error **errp) 104 { 105 QIOChannelTLS *tioc; 106 QIOChannel *ioc; 107 108 tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS)); 109 ioc = QIO_CHANNEL(tioc); 110 111 tioc->master = master; 112 if (master->features & (1 << QIO_CHANNEL_FEATURE_SHUTDOWN)) { 113 ioc->features |= (1 << QIO_CHANNEL_FEATURE_SHUTDOWN); 114 } 115 object_ref(OBJECT(master)); 116 117 tioc->session = qcrypto_tls_session_new( 118 creds, 119 hostname, 120 NULL, 121 QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT, 122 errp); 123 if (!tioc->session) { 124 goto error; 125 } 126 127 qcrypto_tls_session_set_callbacks( 128 tioc->session, 129 qio_channel_tls_write_handler, 130 qio_channel_tls_read_handler, 131 tioc); 132 133 trace_qio_channel_tls_new_client(tioc, master, creds, hostname); 134 return tioc; 135 136 error: 137 object_unref(OBJECT(tioc)); 138 return NULL; 139 } 140 141 142 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc, 143 GIOCondition condition, 144 gpointer user_data); 145 146 static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc, 147 QIOTask *task) 148 { 149 Error *err = NULL; 150 QCryptoTLSSessionHandshakeStatus status; 151 152 if (qcrypto_tls_session_handshake(ioc->session, &err) < 0) { 153 trace_qio_channel_tls_handshake_fail(ioc); 154 qio_task_abort(task, err); 155 goto cleanup; 156 } 157 158 status = qcrypto_tls_session_get_handshake_status(ioc->session); 159 if (status == QCRYPTO_TLS_HANDSHAKE_COMPLETE) { 160 trace_qio_channel_tls_handshake_complete(ioc); 161 if (qcrypto_tls_session_check_credentials(ioc->session, 162 &err) < 0) { 163 trace_qio_channel_tls_credentials_deny(ioc); 164 qio_task_abort(task, err); 165 goto cleanup; 166 } 167 trace_qio_channel_tls_credentials_allow(ioc); 168 qio_task_complete(task); 169 } else { 170 GIOCondition condition; 171 if (status == QCRYPTO_TLS_HANDSHAKE_SENDING) { 172 condition = G_IO_OUT; 173 } else { 174 condition = G_IO_IN; 175 } 176 177 trace_qio_channel_tls_handshake_pending(ioc, status); 178 qio_channel_add_watch(ioc->master, 179 condition, 180 qio_channel_tls_handshake_io, 181 task, 182 NULL); 183 } 184 185 cleanup: 186 error_free(err); 187 } 188 189 190 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc, 191 GIOCondition condition, 192 gpointer user_data) 193 { 194 QIOTask *task = user_data; 195 QIOChannelTLS *tioc = QIO_CHANNEL_TLS( 196 qio_task_get_source(task)); 197 198 qio_channel_tls_handshake_task( 199 tioc, task); 200 201 object_unref(OBJECT(tioc)); 202 203 return FALSE; 204 } 205 206 void qio_channel_tls_handshake(QIOChannelTLS *ioc, 207 QIOTaskFunc func, 208 gpointer opaque, 209 GDestroyNotify destroy) 210 { 211 QIOTask *task; 212 213 task = qio_task_new(OBJECT(ioc), 214 func, opaque, destroy); 215 216 trace_qio_channel_tls_handshake_start(ioc); 217 qio_channel_tls_handshake_task(ioc, task); 218 } 219 220 221 static void qio_channel_tls_init(Object *obj G_GNUC_UNUSED) 222 { 223 } 224 225 226 static void qio_channel_tls_finalize(Object *obj) 227 { 228 QIOChannelTLS *ioc = QIO_CHANNEL_TLS(obj); 229 230 object_unref(OBJECT(ioc->master)); 231 qcrypto_tls_session_free(ioc->session); 232 } 233 234 235 static ssize_t qio_channel_tls_readv(QIOChannel *ioc, 236 const struct iovec *iov, 237 size_t niov, 238 int **fds, 239 size_t *nfds, 240 Error **errp) 241 { 242 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 243 size_t i; 244 ssize_t got = 0; 245 246 for (i = 0 ; i < niov ; i++) { 247 ssize_t ret = qcrypto_tls_session_read(tioc->session, 248 iov[i].iov_base, 249 iov[i].iov_len); 250 if (ret < 0) { 251 if (errno == EAGAIN) { 252 if (got) { 253 return got; 254 } else { 255 return QIO_CHANNEL_ERR_BLOCK; 256 } 257 } 258 259 error_setg_errno(errp, errno, 260 "Cannot read from TLS channel"); 261 return -1; 262 } 263 got += ret; 264 if (ret < iov[i].iov_len) { 265 break; 266 } 267 } 268 return got; 269 } 270 271 272 static ssize_t qio_channel_tls_writev(QIOChannel *ioc, 273 const struct iovec *iov, 274 size_t niov, 275 int *fds, 276 size_t nfds, 277 Error **errp) 278 { 279 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 280 size_t i; 281 ssize_t done = 0; 282 283 for (i = 0 ; i < niov ; i++) { 284 ssize_t ret = qcrypto_tls_session_write(tioc->session, 285 iov[i].iov_base, 286 iov[i].iov_len); 287 if (ret <= 0) { 288 if (errno == EAGAIN) { 289 if (done) { 290 return done; 291 } else { 292 return QIO_CHANNEL_ERR_BLOCK; 293 } 294 } 295 296 error_setg_errno(errp, errno, 297 "Cannot write to TLS channel"); 298 return -1; 299 } 300 done += ret; 301 if (ret < iov[i].iov_len) { 302 break; 303 } 304 } 305 return done; 306 } 307 308 static int qio_channel_tls_set_blocking(QIOChannel *ioc, 309 bool enabled, 310 Error **errp) 311 { 312 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 313 314 return qio_channel_set_blocking(tioc->master, enabled, errp); 315 } 316 317 static void qio_channel_tls_set_delay(QIOChannel *ioc, 318 bool enabled) 319 { 320 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 321 322 qio_channel_set_delay(tioc->master, enabled); 323 } 324 325 static void qio_channel_tls_set_cork(QIOChannel *ioc, 326 bool enabled) 327 { 328 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 329 330 qio_channel_set_cork(tioc->master, enabled); 331 } 332 333 static int qio_channel_tls_shutdown(QIOChannel *ioc, 334 QIOChannelShutdown how, 335 Error **errp) 336 { 337 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 338 339 return qio_channel_shutdown(tioc->master, how, errp); 340 } 341 342 static int qio_channel_tls_close(QIOChannel *ioc, 343 Error **errp) 344 { 345 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 346 347 return qio_channel_close(tioc->master, errp); 348 } 349 350 static GSource *qio_channel_tls_create_watch(QIOChannel *ioc, 351 GIOCondition condition) 352 { 353 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); 354 355 return qio_channel_create_watch(tioc->master, condition); 356 } 357 358 QCryptoTLSSession * 359 qio_channel_tls_get_session(QIOChannelTLS *ioc) 360 { 361 return ioc->session; 362 } 363 364 static void qio_channel_tls_class_init(ObjectClass *klass, 365 void *class_data G_GNUC_UNUSED) 366 { 367 QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass); 368 369 ioc_klass->io_writev = qio_channel_tls_writev; 370 ioc_klass->io_readv = qio_channel_tls_readv; 371 ioc_klass->io_set_blocking = qio_channel_tls_set_blocking; 372 ioc_klass->io_set_delay = qio_channel_tls_set_delay; 373 ioc_klass->io_set_cork = qio_channel_tls_set_cork; 374 ioc_klass->io_close = qio_channel_tls_close; 375 ioc_klass->io_shutdown = qio_channel_tls_shutdown; 376 ioc_klass->io_create_watch = qio_channel_tls_create_watch; 377 } 378 379 static const TypeInfo qio_channel_tls_info = { 380 .parent = TYPE_QIO_CHANNEL, 381 .name = TYPE_QIO_CHANNEL_TLS, 382 .instance_size = sizeof(QIOChannelTLS), 383 .instance_init = qio_channel_tls_init, 384 .instance_finalize = qio_channel_tls_finalize, 385 .class_init = qio_channel_tls_class_init, 386 }; 387 388 static void qio_channel_tls_register_types(void) 389 { 390 type_register_static(&qio_channel_tls_info); 391 } 392 393 type_init(qio_channel_tls_register_types); 394