xref: /qemu/io/channel-tls.c (revision 03e18810) 
1 /*
2  * QEMU I/O channels TLS driver
3  *
4  * Copyright (c) 2015 Red Hat, Inc.
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18  *
19  */
20 
21 #include "qemu/osdep.h"
22 #include "io/channel-tls.h"
23 #include "trace.h"
24 
25 
26 static ssize_t qio_channel_tls_write_handler(const char *buf,
27                                              size_t len,
28                                              void *opaque)
29 {
30     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
31     ssize_t ret;
32 
33     ret = qio_channel_write(tioc->master, buf, len, NULL);
34     if (ret == QIO_CHANNEL_ERR_BLOCK) {
35         errno = EAGAIN;
36         return -1;
37     } else if (ret < 0) {
38         errno = EIO;
39         return -1;
40     }
41     return ret;
42 }
43 
44 static ssize_t qio_channel_tls_read_handler(char *buf,
45                                             size_t len,
46                                             void *opaque)
47 {
48     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
49     ssize_t ret;
50 
51     ret = qio_channel_read(tioc->master, buf, len, NULL);
52     if (ret == QIO_CHANNEL_ERR_BLOCK) {
53         errno = EAGAIN;
54         return -1;
55     } else if (ret < 0) {
56         errno = EIO;
57         return -1;
58     }
59     return ret;
60 }
61 
62 
63 QIOChannelTLS *
64 qio_channel_tls_new_server(QIOChannel *master,
65                            QCryptoTLSCreds *creds,
66                            const char *aclname,
67                            Error **errp)
68 {
69     QIOChannelTLS *ioc;
70 
71     ioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
72 
73     ioc->master = master;
74     object_ref(OBJECT(master));
75 
76     ioc->session = qcrypto_tls_session_new(
77         creds,
78         NULL,
79         aclname,
80         QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
81         errp);
82     if (!ioc->session) {
83         goto error;
84     }
85 
86     qcrypto_tls_session_set_callbacks(
87         ioc->session,
88         qio_channel_tls_write_handler,
89         qio_channel_tls_read_handler,
90         ioc);
91 
92     trace_qio_channel_tls_new_server(ioc, master, creds, aclname);
93     return ioc;
94 
95  error:
96     object_unref(OBJECT(ioc));
97     return NULL;
98 }
99 
100 QIOChannelTLS *
101 qio_channel_tls_new_client(QIOChannel *master,
102                            QCryptoTLSCreds *creds,
103                            const char *hostname,
104                            Error **errp)
105 {
106     QIOChannelTLS *tioc;
107     QIOChannel *ioc;
108 
109     tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
110     ioc = QIO_CHANNEL(tioc);
111 
112     tioc->master = master;
113     if (master->features & (1 << QIO_CHANNEL_FEATURE_SHUTDOWN)) {
114         ioc->features |= (1 << QIO_CHANNEL_FEATURE_SHUTDOWN);
115     }
116     object_ref(OBJECT(master));
117 
118     tioc->session = qcrypto_tls_session_new(
119         creds,
120         hostname,
121         NULL,
122         QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT,
123         errp);
124     if (!tioc->session) {
125         goto error;
126     }
127 
128     qcrypto_tls_session_set_callbacks(
129         tioc->session,
130         qio_channel_tls_write_handler,
131         qio_channel_tls_read_handler,
132         tioc);
133 
134     trace_qio_channel_tls_new_client(tioc, master, creds, hostname);
135     return tioc;
136 
137  error:
138     object_unref(OBJECT(tioc));
139     return NULL;
140 }
141 
142 
143 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
144                                              GIOCondition condition,
145                                              gpointer user_data);
146 
147 static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
148                                            QIOTask *task)
149 {
150     Error *err = NULL;
151     QCryptoTLSSessionHandshakeStatus status;
152 
153     if (qcrypto_tls_session_handshake(ioc->session, &err) < 0) {
154         trace_qio_channel_tls_handshake_fail(ioc);
155         qio_task_abort(task, err);
156         goto cleanup;
157     }
158 
159     status = qcrypto_tls_session_get_handshake_status(ioc->session);
160     if (status == QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
161         trace_qio_channel_tls_handshake_complete(ioc);
162         if (qcrypto_tls_session_check_credentials(ioc->session,
163                                                   &err) < 0) {
164             trace_qio_channel_tls_credentials_deny(ioc);
165             qio_task_abort(task, err);
166             goto cleanup;
167         }
168         trace_qio_channel_tls_credentials_allow(ioc);
169         qio_task_complete(task);
170     } else {
171         GIOCondition condition;
172         if (status == QCRYPTO_TLS_HANDSHAKE_SENDING) {
173             condition = G_IO_OUT;
174         } else {
175             condition = G_IO_IN;
176         }
177 
178         trace_qio_channel_tls_handshake_pending(ioc, status);
179         qio_channel_add_watch(ioc->master,
180                               condition,
181                               qio_channel_tls_handshake_io,
182                               task,
183                               NULL);
184     }
185 
186  cleanup:
187     error_free(err);
188 }
189 
190 
191 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
192                                              GIOCondition condition,
193                                              gpointer user_data)
194 {
195     QIOTask *task = user_data;
196     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(
197         qio_task_get_source(task));
198 
199     qio_channel_tls_handshake_task(
200        tioc, task);
201 
202     object_unref(OBJECT(tioc));
203 
204     return FALSE;
205 }
206 
207 void qio_channel_tls_handshake(QIOChannelTLS *ioc,
208                                QIOTaskFunc func,
209                                gpointer opaque,
210                                GDestroyNotify destroy)
211 {
212     QIOTask *task;
213 
214     task = qio_task_new(OBJECT(ioc),
215                         func, opaque, destroy);
216 
217     trace_qio_channel_tls_handshake_start(ioc);
218     qio_channel_tls_handshake_task(ioc, task);
219 }
220 
221 
222 static void qio_channel_tls_init(Object *obj G_GNUC_UNUSED)
223 {
224 }
225 
226 
227 static void qio_channel_tls_finalize(Object *obj)
228 {
229     QIOChannelTLS *ioc = QIO_CHANNEL_TLS(obj);
230 
231     object_unref(OBJECT(ioc->master));
232     qcrypto_tls_session_free(ioc->session);
233 }
234 
235 
236 static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
237                                      const struct iovec *iov,
238                                      size_t niov,
239                                      int **fds,
240                                      size_t *nfds,
241                                      Error **errp)
242 {
243     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
244     size_t i;
245     ssize_t got = 0;
246 
247     for (i = 0 ; i < niov ; i++) {
248         ssize_t ret = qcrypto_tls_session_read(tioc->session,
249                                                iov[i].iov_base,
250                                                iov[i].iov_len);
251         if (ret < 0) {
252             if (errno == EAGAIN) {
253                 if (got) {
254                     return got;
255                 } else {
256                     return QIO_CHANNEL_ERR_BLOCK;
257                 }
258             }
259 
260             error_setg_errno(errp, errno,
261                              "Cannot read from TLS channel");
262             return -1;
263         }
264         got += ret;
265         if (ret < iov[i].iov_len) {
266             break;
267         }
268     }
269     return got;
270 }
271 
272 
273 static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
274                                       const struct iovec *iov,
275                                       size_t niov,
276                                       int *fds,
277                                       size_t nfds,
278                                       Error **errp)
279 {
280     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
281     size_t i;
282     ssize_t done = 0;
283 
284     for (i = 0 ; i < niov ; i++) {
285         ssize_t ret = qcrypto_tls_session_write(tioc->session,
286                                                 iov[i].iov_base,
287                                                 iov[i].iov_len);
288         if (ret <= 0) {
289             if (errno == EAGAIN) {
290                 if (done) {
291                     return done;
292                 } else {
293                     return QIO_CHANNEL_ERR_BLOCK;
294                 }
295             }
296 
297             error_setg_errno(errp, errno,
298                              "Cannot write to TLS channel");
299             return -1;
300         }
301         done += ret;
302         if (ret < iov[i].iov_len) {
303             break;
304         }
305     }
306     return done;
307 }
308 
309 static int qio_channel_tls_set_blocking(QIOChannel *ioc,
310                                         bool enabled,
311                                         Error **errp)
312 {
313     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
314 
315     return qio_channel_set_blocking(tioc->master, enabled, errp);
316 }
317 
318 static void qio_channel_tls_set_delay(QIOChannel *ioc,
319                                       bool enabled)
320 {
321     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
322 
323     qio_channel_set_delay(tioc->master, enabled);
324 }
325 
326 static void qio_channel_tls_set_cork(QIOChannel *ioc,
327                                      bool enabled)
328 {
329     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
330 
331     qio_channel_set_cork(tioc->master, enabled);
332 }
333 
334 static int qio_channel_tls_shutdown(QIOChannel *ioc,
335                                     QIOChannelShutdown how,
336                                     Error **errp)
337 {
338     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
339 
340     return qio_channel_shutdown(tioc->master, how, errp);
341 }
342 
343 static int qio_channel_tls_close(QIOChannel *ioc,
344                                  Error **errp)
345 {
346     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
347 
348     return qio_channel_close(tioc->master, errp);
349 }
350 
351 static GSource *qio_channel_tls_create_watch(QIOChannel *ioc,
352                                              GIOCondition condition)
353 {
354     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
355 
356     return qio_channel_create_watch(tioc->master, condition);
357 }
358 
359 QCryptoTLSSession *
360 qio_channel_tls_get_session(QIOChannelTLS *ioc)
361 {
362     return ioc->session;
363 }
364 
365 static void qio_channel_tls_class_init(ObjectClass *klass,
366                                        void *class_data G_GNUC_UNUSED)
367 {
368     QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
369 
370     ioc_klass->io_writev = qio_channel_tls_writev;
371     ioc_klass->io_readv = qio_channel_tls_readv;
372     ioc_klass->io_set_blocking = qio_channel_tls_set_blocking;
373     ioc_klass->io_set_delay = qio_channel_tls_set_delay;
374     ioc_klass->io_set_cork = qio_channel_tls_set_cork;
375     ioc_klass->io_close = qio_channel_tls_close;
376     ioc_klass->io_shutdown = qio_channel_tls_shutdown;
377     ioc_klass->io_create_watch = qio_channel_tls_create_watch;
378 }
379 
380 static const TypeInfo qio_channel_tls_info = {
381     .parent = TYPE_QIO_CHANNEL,
382     .name = TYPE_QIO_CHANNEL_TLS,
383     .instance_size = sizeof(QIOChannelTLS),
384     .instance_init = qio_channel_tls_init,
385     .instance_finalize = qio_channel_tls_finalize,
386     .class_init = qio_channel_tls_class_init,
387 };
388 
389 static void qio_channel_tls_register_types(void)
390 {
391     type_register_static(&qio_channel_tls_info);
392 }
393 
394 type_init(qio_channel_tls_register_types);
395