io/channel-tls.c

   1 /*
   2  * QEMU I/O channels TLS driver
   3  *
   4  * Copyright (c) 2015 Red Hat, Inc.
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "io/channel-tls.h"
  23 #include "trace.h"
  24
  25
  26 static ssize_t qio_channel_tls_write_handler(const char *buf,
  27                                              size_t len,
  28                                              void *opaque)
  29 {
  30     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
  31     ssize_t ret;
  32
  33     ret = qio_channel_write(tioc->master, buf, len, NULL);
  34     if (ret == QIO_CHANNEL_ERR_BLOCK) {
  35         errno = EAGAIN;
  36         return -1;
  37     } else if (ret < 0) {
  38         errno = EIO;
  39         return -1;
  40     }
  41     return ret;
  42 }
  43
  44 static ssize_t qio_channel_tls_read_handler(char *buf,
  45                                             size_t len,
  46                                             void *opaque)
  47 {
  48     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
  49     ssize_t ret;
  50
  51     ret = qio_channel_read(tioc->master, buf, len, NULL);
  52     if (ret == QIO_CHANNEL_ERR_BLOCK) {
  53         errno = EAGAIN;
  54         return -1;
  55     } else if (ret < 0) {
  56         errno = EIO;
  57         return -1;
  58     }
  59     return ret;
  60 }
  61
  62
  63 QIOChannelTLS *
  64 qio_channel_tls_new_server(QIOChannel *master,
  65                            QCryptoTLSCreds *creds,
  66                            const char *aclname,
  67                            Error **errp)
  68 {
  69     QIOChannelTLS *ioc;
  70
  71     ioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
  72
  73     ioc->master = master;
  74     object_ref(OBJECT(master));
  75
  76     ioc->session = qcrypto_tls_session_new(
  77         creds,
  78         NULL,
  79         aclname,
  80         QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
  81         errp);
  82     if (!ioc->session) {
  83         goto error;
  84     }
  85
  86     qcrypto_tls_session_set_callbacks(
  87         ioc->session,
  88         qio_channel_tls_write_handler,
  89         qio_channel_tls_read_handler,
  90         ioc);
  91
  92     trace_qio_channel_tls_new_server(ioc, master, creds, aclname);
  93     return ioc;
  94
  95  error:
  96     object_unref(OBJECT(ioc));
  97     return NULL;
  98 }
  99
 100 QIOChannelTLS *
 101 qio_channel_tls_new_client(QIOChannel *master,
 102                            QCryptoTLSCreds *creds,
 103                            const char *hostname,
 104                            Error **errp)
 105 {
 106     QIOChannelTLS *tioc;
 107     QIOChannel *ioc;
 108
 109     tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
 110     ioc = QIO_CHANNEL(tioc);
 111
 112     tioc->master = master;
 113     if (master->features & (1 << QIO_CHANNEL_FEATURE_SHUTDOWN)) {
 114         ioc->features |= (1 << QIO_CHANNEL_FEATURE_SHUTDOWN);
 115     }
 116     object_ref(OBJECT(master));
 117
 118     tioc->session = qcrypto_tls_session_new(
 119         creds,
 120         hostname,
 121         NULL,
 122         QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT,
 123         errp);
 124     if (!tioc->session) {
 125         goto error;
 126     }
 127
 128     qcrypto_tls_session_set_callbacks(
 129         tioc->session,
 130         qio_channel_tls_write_handler,
 131         qio_channel_tls_read_handler,
 132         tioc);
 133
 134     trace_qio_channel_tls_new_client(tioc, master, creds, hostname);
 135     return tioc;
 136
 137  error:
 138     object_unref(OBJECT(tioc));
 139     return NULL;
 140 }
 141
 142
 143 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
 144                                              GIOCondition condition,
 145                                              gpointer user_data);
 146
 147 static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
 148                                            QIOTask *task)
 149 {
 150     Error *err = NULL;
 151     QCryptoTLSSessionHandshakeStatus status;
 152
 153     if (qcrypto_tls_session_handshake(ioc->session, &err) < 0) {
 154         trace_qio_channel_tls_handshake_fail(ioc);
 155         qio_task_abort(task, err);
 156         goto cleanup;
 157     }
 158
 159     status = qcrypto_tls_session_get_handshake_status(ioc->session);
 160     if (status == QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
 161         trace_qio_channel_tls_handshake_complete(ioc);
 162         if (qcrypto_tls_session_check_credentials(ioc->session,
 163                                                   &err) < 0) {
 164             trace_qio_channel_tls_credentials_deny(ioc);
 165             qio_task_abort(task, err);
 166             goto cleanup;
 167         }
 168         trace_qio_channel_tls_credentials_allow(ioc);
 169         qio_task_complete(task);
 170     } else {
 171         GIOCondition condition;
 172         if (status == QCRYPTO_TLS_HANDSHAKE_SENDING) {
 173             condition = G_IO_OUT;
 174         } else {
 175             condition = G_IO_IN;
 176         }
 177
 178         trace_qio_channel_tls_handshake_pending(ioc, status);
 179         qio_channel_add_watch(ioc->master,
 180                               condition,
 181                               qio_channel_tls_handshake_io,
 182                               task,
 183                               NULL);
 184     }
 185
 186  cleanup:
 187     error_free(err);
 188 }
 189
 190
 191 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
 192                                              GIOCondition condition,
 193                                              gpointer user_data)
 194 {
 195     QIOTask *task = user_data;
 196     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(
 197         qio_task_get_source(task));
 198
 199     qio_channel_tls_handshake_task(
 200        tioc, task);
 201
 202     object_unref(OBJECT(tioc));
 203
 204     return FALSE;
 205 }
 206
 207 void qio_channel_tls_handshake(QIOChannelTLS *ioc,
 208                                QIOTaskFunc func,
 209                                gpointer opaque,
 210                                GDestroyNotify destroy)
 211 {
 212     QIOTask *task;
 213
 214     task = qio_task_new(OBJECT(ioc),
 215                         func, opaque, destroy);
 216
 217     trace_qio_channel_tls_handshake_start(ioc);
 218     qio_channel_tls_handshake_task(ioc, task);
 219 }
 220
 221
 222 static void qio_channel_tls_init(Object *obj G_GNUC_UNUSED)
 223 {
 224 }
 225
 226
 227 static void qio_channel_tls_finalize(Object *obj)
 228 {
 229     QIOChannelTLS *ioc = QIO_CHANNEL_TLS(obj);
 230
 231     object_unref(OBJECT(ioc->master));
 232     qcrypto_tls_session_free(ioc->session);
 233 }
 234
 235
 236 static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
 237                                      const struct iovec *iov,
 238                                      size_t niov,
 239                                      int **fds,
 240                                      size_t *nfds,
 241                                      Error **errp)
 242 {
 243     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 244     size_t i;
 245     ssize_t got = 0;
 246
 247     for (i = 0 ; i < niov ; i++) {
 248         ssize_t ret = qcrypto_tls_session_read(tioc->session,
 249                                                iov[i].iov_base,
 250                                                iov[i].iov_len);
 251         if (ret < 0) {
 252             if (errno == EAGAIN) {
 253                 if (got) {
 254                     return got;
 255                 } else {
 256                     return QIO_CHANNEL_ERR_BLOCK;
 257                 }
 258             }
 259
 260             error_setg_errno(errp, errno,
 261                              "Cannot read from TLS channel");
 262             return -1;
 263         }
 264         got += ret;
 265         if (ret < iov[i].iov_len) {
 266             break;
 267         }
 268     }
 269     return got;
 270 }
 271
 272
 273 static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
 274                                       const struct iovec *iov,
 275                                       size_t niov,
 276                                       int *fds,
 277                                       size_t nfds,
 278                                       Error **errp)
 279 {
 280     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 281     size_t i;
 282     ssize_t done = 0;
 283
 284     for (i = 0 ; i < niov ; i++) {
 285         ssize_t ret = qcrypto_tls_session_write(tioc->session,
 286                                                 iov[i].iov_base,
 287                                                 iov[i].iov_len);
 288         if (ret <= 0) {
 289             if (errno == EAGAIN) {
 290                 if (done) {
 291                     return done;
 292                 } else {
 293                     return QIO_CHANNEL_ERR_BLOCK;
 294                 }
 295             }
 296
 297             error_setg_errno(errp, errno,
 298                              "Cannot write to TLS channel");
 299             return -1;
 300         }
 301         done += ret;
 302         if (ret < iov[i].iov_len) {
 303             break;
 304         }
 305     }
 306     return done;
 307 }
 308
 309 static int qio_channel_tls_set_blocking(QIOChannel *ioc,
 310                                         bool enabled,
 311                                         Error **errp)
 312 {
 313     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 314
 315     return qio_channel_set_blocking(tioc->master, enabled, errp);
 316 }
 317
 318 static void qio_channel_tls_set_delay(QIOChannel *ioc,
 319                                       bool enabled)
 320 {
 321     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 322
 323     qio_channel_set_delay(tioc->master, enabled);
 324 }
 325
 326 static void qio_channel_tls_set_cork(QIOChannel *ioc,
 327                                      bool enabled)
 328 {
 329     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 330
 331     qio_channel_set_cork(tioc->master, enabled);
 332 }
 333
 334 static int qio_channel_tls_shutdown(QIOChannel *ioc,
 335                                     QIOChannelShutdown how,
 336                                     Error **errp)
 337 {
 338     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 339
 340     return qio_channel_shutdown(tioc->master, how, errp);
 341 }
 342
 343 static int qio_channel_tls_close(QIOChannel *ioc,
 344                                  Error **errp)
 345 {
 346     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 347
 348     return qio_channel_close(tioc->master, errp);
 349 }
 350
 351 static GSource *qio_channel_tls_create_watch(QIOChannel *ioc,
 352                                              GIOCondition condition)
 353 {
 354     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 355
 356     return qio_channel_create_watch(tioc->master, condition);
 357 }
 358
 359 QCryptoTLSSession *
 360 qio_channel_tls_get_session(QIOChannelTLS *ioc)
 361 {
 362     return ioc->session;
 363 }
 364
 365 static void qio_channel_tls_class_init(ObjectClass *klass,
 366                                        void *class_data G_GNUC_UNUSED)
 367 {
 368     QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
 369
 370     ioc_klass->io_writev = qio_channel_tls_writev;
 371     ioc_klass->io_readv = qio_channel_tls_readv;
 372     ioc_klass->io_set_blocking = qio_channel_tls_set_blocking;
 373     ioc_klass->io_set_delay = qio_channel_tls_set_delay;
 374     ioc_klass->io_set_cork = qio_channel_tls_set_cork;
 375     ioc_klass->io_close = qio_channel_tls_close;
 376     ioc_klass->io_shutdown = qio_channel_tls_shutdown;
 377     ioc_klass->io_create_watch = qio_channel_tls_create_watch;
 378 }
 379
 380 static const TypeInfo qio_channel_tls_info = {
 381     .parent = TYPE_QIO_CHANNEL,
 382     .name = TYPE_QIO_CHANNEL_TLS,
 383     .instance_size = sizeof(QIOChannelTLS),
 384     .instance_init = qio_channel_tls_init,
 385     .instance_finalize = qio_channel_tls_finalize,
 386     .class_init = qio_channel_tls_class_init,
 387 };
 388
 389 static void qio_channel_tls_register_types(void)
 390 {
 391     type_register_static(&qio_channel_tls_info);
 392 }
 393
 394 type_init(qio_channel_tls_register_types);