xref: /qemu/migration/tls.c (revision 8afc43ea) 
1 /*
2  * QEMU migration TLS support
3  *
4  * Copyright (c) 2015 Red Hat, Inc.
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18  *
19  */
20 
21 #include "qemu/osdep.h"
22 #include "channel.h"
23 #include "migration.h"
24 #include "tls.h"
25 #include "options.h"
26 #include "crypto/tlscreds.h"
27 #include "qemu/error-report.h"
28 #include "qapi/error.h"
29 #include "trace.h"
30 
31 static QCryptoTLSCreds *
32 migration_tls_get_creds(MigrationState *s,
33                         QCryptoTLSCredsEndpoint endpoint,
34                         Error **errp)
35 {
36     Object *creds;
37     QCryptoTLSCreds *ret;
38 
39     creds = object_resolve_path_component(
40         object_get_objects_root(), s->parameters.tls_creds);
41     if (!creds) {
42         error_setg(errp, "No TLS credentials with id '%s'",
43                    s->parameters.tls_creds);
44         return NULL;
45     }
46     ret = (QCryptoTLSCreds *)object_dynamic_cast(
47         creds, TYPE_QCRYPTO_TLS_CREDS);
48     if (!ret) {
49         error_setg(errp, "Object with id '%s' is not TLS credentials",
50                    s->parameters.tls_creds);
51         return NULL;
52     }
53     if (!qcrypto_tls_creds_check_endpoint(ret, endpoint, errp)) {
54         return NULL;
55     }
56 
57     return ret;
58 }
59 
60 
61 static void migration_tls_incoming_handshake(QIOTask *task,
62                                              gpointer opaque)
63 {
64     QIOChannel *ioc = QIO_CHANNEL(qio_task_get_source(task));
65     Error *err = NULL;
66 
67     if (qio_task_propagate_error(task, &err)) {
68         trace_migration_tls_incoming_handshake_error(error_get_pretty(err));
69         error_report_err(err);
70     } else {
71         trace_migration_tls_incoming_handshake_complete();
72         migration_channel_process_incoming(ioc);
73     }
74     object_unref(OBJECT(ioc));
75 }
76 
77 void migration_tls_channel_process_incoming(MigrationState *s,
78                                             QIOChannel *ioc,
79                                             Error **errp)
80 {
81     QCryptoTLSCreds *creds;
82     QIOChannelTLS *tioc;
83 
84     creds = migration_tls_get_creds(
85         s, QCRYPTO_TLS_CREDS_ENDPOINT_SERVER, errp);
86     if (!creds) {
87         return;
88     }
89 
90     tioc = qio_channel_tls_new_server(
91         ioc, creds,
92         s->parameters.tls_authz,
93         errp);
94     if (!tioc) {
95         return;
96     }
97 
98     trace_migration_tls_incoming_handshake_start();
99     qio_channel_set_name(QIO_CHANNEL(tioc), "migration-tls-incoming");
100     qio_channel_tls_handshake(tioc,
101                               migration_tls_incoming_handshake,
102                               NULL,
103                               NULL,
104                               NULL);
105 }
106 
107 
108 static void migration_tls_outgoing_handshake(QIOTask *task,
109                                              gpointer opaque)
110 {
111     MigrationState *s = opaque;
112     QIOChannel *ioc = QIO_CHANNEL(qio_task_get_source(task));
113     Error *err = NULL;
114 
115     if (qio_task_propagate_error(task, &err)) {
116         trace_migration_tls_outgoing_handshake_error(error_get_pretty(err));
117     } else {
118         trace_migration_tls_outgoing_handshake_complete();
119     }
120     migration_channel_connect(s, ioc, NULL, err);
121     object_unref(OBJECT(ioc));
122 }
123 
124 QIOChannelTLS *migration_tls_client_create(MigrationState *s,
125                                            QIOChannel *ioc,
126                                            const char *hostname,
127                                            Error **errp)
128 {
129     QCryptoTLSCreds *creds;
130 
131     creds = migration_tls_get_creds(
132         s, QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT, errp);
133     if (!creds) {
134         return NULL;
135     }
136 
137     if (s->parameters.tls_hostname && *s->parameters.tls_hostname) {
138         hostname = s->parameters.tls_hostname;
139     }
140 
141     return qio_channel_tls_new_client(ioc, creds, hostname, errp);
142 }
143 
144 void migration_tls_channel_connect(MigrationState *s,
145                                    QIOChannel *ioc,
146                                    const char *hostname,
147                                    Error **errp)
148 {
149     QIOChannelTLS *tioc;
150 
151     tioc = migration_tls_client_create(s, ioc, hostname, errp);
152     if (!tioc) {
153         return;
154     }
155 
156     /* Save hostname into MigrationState for handshake */
157     s->hostname = g_strdup(hostname);
158     trace_migration_tls_outgoing_handshake_start(hostname);
159     qio_channel_set_name(QIO_CHANNEL(tioc), "migration-tls-outgoing");
160     qio_channel_tls_handshake(tioc,
161                               migration_tls_outgoing_handshake,
162                               s,
163                               NULL,
164                               NULL);
165 }
166 
167 bool migrate_channel_requires_tls_upgrade(QIOChannel *ioc)
168 {
169     if (!migrate_tls()) {
170         return false;
171     }
172 
173     return !object_dynamic_cast(OBJECT(ioc), TYPE_QIO_CHANNEL_TLS);
174 }
175