xref: /qemu/migration/tls.c (revision 6402cbbb) 
1 /*
2  * QEMU migration TLS support
3  *
4  * Copyright (c) 2015 Red Hat, Inc.
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18  *
19  */
20 
21 #include "qemu/osdep.h"
22 #include "channel.h"
23 #include "migration.h"
24 #include "tls.h"
25 #include "io/channel-tls.h"
26 #include "crypto/tlscreds.h"
27 #include "qemu/error-report.h"
28 #include "qapi/error.h"
29 #include "trace.h"
30 
31 static QCryptoTLSCreds *
32 migration_tls_get_creds(MigrationState *s,
33                         QCryptoTLSCredsEndpoint endpoint,
34                         Error **errp)
35 {
36     Object *creds;
37     QCryptoTLSCreds *ret;
38 
39     creds = object_resolve_path_component(
40         object_get_objects_root(), s->parameters.tls_creds);
41     if (!creds) {
42         error_setg(errp, "No TLS credentials with id '%s'",
43                    s->parameters.tls_creds);
44         return NULL;
45     }
46     ret = (QCryptoTLSCreds *)object_dynamic_cast(
47         creds, TYPE_QCRYPTO_TLS_CREDS);
48     if (!ret) {
49         error_setg(errp, "Object with id '%s' is not TLS credentials",
50                    s->parameters.tls_creds);
51         return NULL;
52     }
53     if (ret->endpoint != endpoint) {
54         error_setg(errp,
55                    "Expected TLS credentials for a %s endpoint",
56                    endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT ?
57                    "client" : "server");
58         return NULL;
59     }
60 
61     object_ref(OBJECT(ret));
62     return ret;
63 }
64 
65 
66 static void migration_tls_incoming_handshake(QIOTask *task,
67                                              gpointer opaque)
68 {
69     QIOChannel *ioc = QIO_CHANNEL(qio_task_get_source(task));
70     Error *err = NULL;
71 
72     if (qio_task_propagate_error(task, &err)) {
73         trace_migration_tls_incoming_handshake_error(error_get_pretty(err));
74         error_report_err(err);
75     } else {
76         trace_migration_tls_incoming_handshake_complete();
77         migration_channel_process_incoming(ioc);
78     }
79     object_unref(OBJECT(ioc));
80 }
81 
82 void migration_tls_channel_process_incoming(MigrationState *s,
83                                             QIOChannel *ioc,
84                                             Error **errp)
85 {
86     QCryptoTLSCreds *creds;
87     QIOChannelTLS *tioc;
88 
89     creds = migration_tls_get_creds(
90         s, QCRYPTO_TLS_CREDS_ENDPOINT_SERVER, errp);
91     if (!creds) {
92         return;
93     }
94 
95     tioc = qio_channel_tls_new_server(
96         ioc, creds,
97         NULL, /* XXX pass ACL name */
98         errp);
99     if (!tioc) {
100         return;
101     }
102 
103     trace_migration_tls_incoming_handshake_start();
104     qio_channel_set_name(QIO_CHANNEL(tioc), "migration-tls-incoming");
105     qio_channel_tls_handshake(tioc,
106                               migration_tls_incoming_handshake,
107                               NULL,
108                               NULL);
109 }
110 
111 
112 static void migration_tls_outgoing_handshake(QIOTask *task,
113                                              gpointer opaque)
114 {
115     MigrationState *s = opaque;
116     QIOChannel *ioc = QIO_CHANNEL(qio_task_get_source(task));
117     Error *err = NULL;
118 
119     if (qio_task_propagate_error(task, &err)) {
120         trace_migration_tls_outgoing_handshake_error(error_get_pretty(err));
121         migrate_fd_error(s, err);
122         error_free(err);
123     } else {
124         trace_migration_tls_outgoing_handshake_complete();
125         migration_channel_connect(s, ioc, NULL);
126     }
127     object_unref(OBJECT(ioc));
128 }
129 
130 
131 void migration_tls_channel_connect(MigrationState *s,
132                                    QIOChannel *ioc,
133                                    const char *hostname,
134                                    Error **errp)
135 {
136     QCryptoTLSCreds *creds;
137     QIOChannelTLS *tioc;
138 
139     creds = migration_tls_get_creds(
140         s, QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT, errp);
141     if (!creds) {
142         return;
143     }
144 
145     if (s->parameters.tls_hostname && *s->parameters.tls_hostname) {
146         hostname = s->parameters.tls_hostname;
147     }
148     if (!hostname) {
149         error_setg(errp, "No hostname available for TLS");
150         return;
151     }
152 
153     tioc = qio_channel_tls_new_client(
154         ioc, creds, hostname, errp);
155     if (!tioc) {
156         return;
157     }
158 
159     trace_migration_tls_outgoing_handshake_start(hostname);
160     qio_channel_set_name(QIO_CHANNEL(tioc), "migration-tls-outgoing");
161     qio_channel_tls_handshake(tioc,
162                               migration_tls_outgoing_handshake,
163                               s,
164                               NULL);
165 }
166