xref: /qemu/io/channel-tls.c (revision 370ed600) 
1 /*
2  * QEMU I/O channels TLS driver
3  *
4  * Copyright (c) 2015 Red Hat, Inc.
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18  *
19  */
20 
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "qemu/module.h"
24 #include "io/channel-tls.h"
25 #include "trace.h"
26 #include "qemu/atomic.h"
27 
28 
29 static ssize_t qio_channel_tls_write_handler(const char *buf,
30                                              size_t len,
31                                              void *opaque)
32 {
33     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
34     ssize_t ret;
35 
36     ret = qio_channel_write(tioc->master, buf, len, NULL);
37     if (ret == QIO_CHANNEL_ERR_BLOCK) {
38         errno = EAGAIN;
39         return -1;
40     } else if (ret < 0) {
41         errno = EIO;
42         return -1;
43     }
44     return ret;
45 }
46 
47 static ssize_t qio_channel_tls_read_handler(char *buf,
48                                             size_t len,
49                                             void *opaque)
50 {
51     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
52     ssize_t ret;
53 
54     ret = qio_channel_read(tioc->master, buf, len, NULL);
55     if (ret == QIO_CHANNEL_ERR_BLOCK) {
56         errno = EAGAIN;
57         return -1;
58     } else if (ret < 0) {
59         errno = EIO;
60         return -1;
61     }
62     return ret;
63 }
64 
65 
66 QIOChannelTLS *
67 qio_channel_tls_new_server(QIOChannel *master,
68                            QCryptoTLSCreds *creds,
69                            const char *aclname,
70                            Error **errp)
71 {
72     QIOChannelTLS *ioc;
73 
74     ioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
75 
76     ioc->master = master;
77     if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
78         qio_channel_set_feature(QIO_CHANNEL(ioc), QIO_CHANNEL_FEATURE_SHUTDOWN);
79     }
80     object_ref(OBJECT(master));
81 
82     ioc->session = qcrypto_tls_session_new(
83         creds,
84         NULL,
85         aclname,
86         QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
87         errp);
88     if (!ioc->session) {
89         goto error;
90     }
91 
92     qcrypto_tls_session_set_callbacks(
93         ioc->session,
94         qio_channel_tls_write_handler,
95         qio_channel_tls_read_handler,
96         ioc);
97 
98     trace_qio_channel_tls_new_server(ioc, master, creds, aclname);
99     return ioc;
100 
101  error:
102     object_unref(OBJECT(ioc));
103     return NULL;
104 }
105 
106 QIOChannelTLS *
107 qio_channel_tls_new_client(QIOChannel *master,
108                            QCryptoTLSCreds *creds,
109                            const char *hostname,
110                            Error **errp)
111 {
112     QIOChannelTLS *tioc;
113     QIOChannel *ioc;
114 
115     tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
116     ioc = QIO_CHANNEL(tioc);
117 
118     tioc->master = master;
119     if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
120         qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
121     }
122     object_ref(OBJECT(master));
123 
124     tioc->session = qcrypto_tls_session_new(
125         creds,
126         hostname,
127         NULL,
128         QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT,
129         errp);
130     if (!tioc->session) {
131         goto error;
132     }
133 
134     qcrypto_tls_session_set_callbacks(
135         tioc->session,
136         qio_channel_tls_write_handler,
137         qio_channel_tls_read_handler,
138         tioc);
139 
140     trace_qio_channel_tls_new_client(tioc, master, creds, hostname);
141     return tioc;
142 
143  error:
144     object_unref(OBJECT(tioc));
145     return NULL;
146 }
147 
148 struct QIOChannelTLSData {
149     QIOTask *task;
150     GMainContext *context;
151 };
152 typedef struct QIOChannelTLSData QIOChannelTLSData;
153 
154 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
155                                              GIOCondition condition,
156                                              gpointer user_data);
157 
158 static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
159                                            QIOTask *task,
160                                            GMainContext *context)
161 {
162     Error *err = NULL;
163     QCryptoTLSSessionHandshakeStatus status;
164 
165     if (qcrypto_tls_session_handshake(ioc->session, &err) < 0) {
166         trace_qio_channel_tls_handshake_fail(ioc);
167         qio_task_set_error(task, err);
168         qio_task_complete(task);
169         return;
170     }
171 
172     status = qcrypto_tls_session_get_handshake_status(ioc->session);
173     if (status == QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
174         trace_qio_channel_tls_handshake_complete(ioc);
175         if (qcrypto_tls_session_check_credentials(ioc->session,
176                                                   &err) < 0) {
177             trace_qio_channel_tls_credentials_deny(ioc);
178             qio_task_set_error(task, err);
179         } else {
180             trace_qio_channel_tls_credentials_allow(ioc);
181         }
182         qio_task_complete(task);
183     } else {
184         GIOCondition condition;
185         QIOChannelTLSData *data = g_new0(typeof(*data), 1);
186 
187         data->task = task;
188         data->context = context;
189 
190         if (context) {
191             g_main_context_ref(context);
192         }
193 
194         if (status == QCRYPTO_TLS_HANDSHAKE_SENDING) {
195             condition = G_IO_OUT;
196         } else {
197             condition = G_IO_IN;
198         }
199 
200         trace_qio_channel_tls_handshake_pending(ioc, status);
201         qio_channel_add_watch_full(ioc->master,
202                                    condition,
203                                    qio_channel_tls_handshake_io,
204                                    data,
205                                    NULL,
206                                    context);
207     }
208 }
209 
210 
211 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
212                                              GIOCondition condition,
213                                              gpointer user_data)
214 {
215     QIOChannelTLSData *data = user_data;
216     QIOTask *task = data->task;
217     GMainContext *context = data->context;
218     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(
219         qio_task_get_source(task));
220 
221     g_free(data);
222     qio_channel_tls_handshake_task(tioc, task, context);
223 
224     if (context) {
225         g_main_context_unref(context);
226     }
227 
228     return FALSE;
229 }
230 
231 void qio_channel_tls_handshake(QIOChannelTLS *ioc,
232                                QIOTaskFunc func,
233                                gpointer opaque,
234                                GDestroyNotify destroy,
235                                GMainContext *context)
236 {
237     QIOTask *task;
238 
239     task = qio_task_new(OBJECT(ioc),
240                         func, opaque, destroy);
241 
242     trace_qio_channel_tls_handshake_start(ioc);
243     qio_channel_tls_handshake_task(ioc, task, context);
244 }
245 
246 
247 static void qio_channel_tls_init(Object *obj G_GNUC_UNUSED)
248 {
249 }
250 
251 
252 static void qio_channel_tls_finalize(Object *obj)
253 {
254     QIOChannelTLS *ioc = QIO_CHANNEL_TLS(obj);
255 
256     object_unref(OBJECT(ioc->master));
257     qcrypto_tls_session_free(ioc->session);
258 }
259 
260 
261 static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
262                                      const struct iovec *iov,
263                                      size_t niov,
264                                      int **fds,
265                                      size_t *nfds,
266                                      int flags,
267                                      Error **errp)
268 {
269     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
270     size_t i;
271     ssize_t got = 0;
272 
273     for (i = 0 ; i < niov ; i++) {
274         ssize_t ret = qcrypto_tls_session_read(tioc->session,
275                                                iov[i].iov_base,
276                                                iov[i].iov_len);
277         if (ret < 0) {
278             if (errno == EAGAIN) {
279                 if (got) {
280                     return got;
281                 } else {
282                     return QIO_CHANNEL_ERR_BLOCK;
283                 }
284             } else if (errno == ECONNABORTED &&
285                        (qatomic_load_acquire(&tioc->shutdown) &
286                         QIO_CHANNEL_SHUTDOWN_READ)) {
287                 return 0;
288             }
289 
290             error_setg_errno(errp, errno,
291                              "Cannot read from TLS channel");
292             return -1;
293         }
294         got += ret;
295         if (ret < iov[i].iov_len) {
296             break;
297         }
298     }
299     return got;
300 }
301 
302 
303 static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
304                                       const struct iovec *iov,
305                                       size_t niov,
306                                       int *fds,
307                                       size_t nfds,
308                                       int flags,
309                                       Error **errp)
310 {
311     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
312     size_t i;
313     ssize_t done = 0;
314 
315     for (i = 0 ; i < niov ; i++) {
316         ssize_t ret = qcrypto_tls_session_write(tioc->session,
317                                                 iov[i].iov_base,
318                                                 iov[i].iov_len);
319         if (ret <= 0) {
320             if (errno == EAGAIN) {
321                 if (done) {
322                     return done;
323                 } else {
324                     return QIO_CHANNEL_ERR_BLOCK;
325                 }
326             }
327 
328             error_setg_errno(errp, errno,
329                              "Cannot write to TLS channel");
330             return -1;
331         }
332         done += ret;
333         if (ret < iov[i].iov_len) {
334             break;
335         }
336     }
337     return done;
338 }
339 
340 static int qio_channel_tls_set_blocking(QIOChannel *ioc,
341                                         bool enabled,
342                                         Error **errp)
343 {
344     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
345 
346     return qio_channel_set_blocking(tioc->master, enabled, errp);
347 }
348 
349 static void qio_channel_tls_set_delay(QIOChannel *ioc,
350                                       bool enabled)
351 {
352     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
353 
354     qio_channel_set_delay(tioc->master, enabled);
355 }
356 
357 static void qio_channel_tls_set_cork(QIOChannel *ioc,
358                                      bool enabled)
359 {
360     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
361 
362     qio_channel_set_cork(tioc->master, enabled);
363 }
364 
365 static int qio_channel_tls_shutdown(QIOChannel *ioc,
366                                     QIOChannelShutdown how,
367                                     Error **errp)
368 {
369     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
370 
371     qatomic_or(&tioc->shutdown, how);
372 
373     return qio_channel_shutdown(tioc->master, how, errp);
374 }
375 
376 static int qio_channel_tls_close(QIOChannel *ioc,
377                                  Error **errp)
378 {
379     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
380 
381     return qio_channel_close(tioc->master, errp);
382 }
383 
384 static void qio_channel_tls_set_aio_fd_handler(QIOChannel *ioc,
385                                                AioContext *ctx,
386                                                IOHandler *io_read,
387                                                IOHandler *io_write,
388                                                void *opaque)
389 {
390     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
391 
392     qio_channel_set_aio_fd_handler(tioc->master, ctx, io_read, io_write, opaque);
393 }
394 
395 typedef struct QIOChannelTLSSource QIOChannelTLSSource;
396 struct QIOChannelTLSSource {
397     GSource parent;
398     QIOChannelTLS *tioc;
399 };
400 
401 static gboolean
402 qio_channel_tls_source_check(GSource *source)
403 {
404     QIOChannelTLSSource *tsource = (QIOChannelTLSSource *)source;
405 
406     return qcrypto_tls_session_check_pending(tsource->tioc->session) > 0;
407 }
408 
409 static gboolean
410 qio_channel_tls_source_prepare(GSource *source, gint *timeout)
411 {
412     *timeout = -1;
413     return qio_channel_tls_source_check(source);
414 }
415 
416 static gboolean
417 qio_channel_tls_source_dispatch(GSource *source, GSourceFunc callback,
418                                 gpointer user_data)
419 {
420     return G_SOURCE_CONTINUE;
421 }
422 
423 static void
424 qio_channel_tls_source_finalize(GSource *source)
425 {
426     QIOChannelTLSSource *tsource = (QIOChannelTLSSource *)source;
427 
428     object_unref(OBJECT(tsource->tioc));
429 }
430 
431 static GSourceFuncs qio_channel_tls_source_funcs = {
432     qio_channel_tls_source_prepare,
433     qio_channel_tls_source_check,
434     qio_channel_tls_source_dispatch,
435     qio_channel_tls_source_finalize
436 };
437 
438 static void
439 qio_channel_tls_read_watch(QIOChannelTLS *tioc, GSource *source)
440 {
441     GSource *child;
442     QIOChannelTLSSource *tlssource;
443 
444     child = g_source_new(&qio_channel_tls_source_funcs,
445                           sizeof(QIOChannelTLSSource));
446     tlssource = (QIOChannelTLSSource *)child;
447 
448     tlssource->tioc = tioc;
449     object_ref(OBJECT(tioc));
450 
451     g_source_add_child_source(source, child);
452     g_source_unref(child);
453 }
454 
455 static GSource *qio_channel_tls_create_watch(QIOChannel *ioc,
456                                              GIOCondition condition)
457 {
458     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
459     GSource *source = qio_channel_create_watch(tioc->master, condition);
460 
461     if (condition & G_IO_IN) {
462         qio_channel_tls_read_watch(tioc, source);
463     }
464 
465     return source;
466 }
467 
468 QCryptoTLSSession *
469 qio_channel_tls_get_session(QIOChannelTLS *ioc)
470 {
471     return ioc->session;
472 }
473 
474 static void qio_channel_tls_class_init(ObjectClass *klass,
475                                        void *class_data G_GNUC_UNUSED)
476 {
477     QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
478 
479     ioc_klass->io_writev = qio_channel_tls_writev;
480     ioc_klass->io_readv = qio_channel_tls_readv;
481     ioc_klass->io_set_blocking = qio_channel_tls_set_blocking;
482     ioc_klass->io_set_delay = qio_channel_tls_set_delay;
483     ioc_klass->io_set_cork = qio_channel_tls_set_cork;
484     ioc_klass->io_close = qio_channel_tls_close;
485     ioc_klass->io_shutdown = qio_channel_tls_shutdown;
486     ioc_klass->io_create_watch = qio_channel_tls_create_watch;
487     ioc_klass->io_set_aio_fd_handler = qio_channel_tls_set_aio_fd_handler;
488 }
489 
490 static const TypeInfo qio_channel_tls_info = {
491     .parent = TYPE_QIO_CHANNEL,
492     .name = TYPE_QIO_CHANNEL_TLS,
493     .instance_size = sizeof(QIOChannelTLS),
494     .instance_init = qio_channel_tls_init,
495     .instance_finalize = qio_channel_tls_finalize,
496     .class_init = qio_channel_tls_class_init,
497 };
498 
499 static void qio_channel_tls_register_types(void)
500 {
501     type_register_static(&qio_channel_tls_info);
502 }
503 
504 type_init(qio_channel_tls_register_types);
505