io/channel-tls.c

   1 /*
   2  * QEMU I/O channels TLS driver
   3  *
   4  * Copyright (c) 2015 Red Hat, Inc.
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "io/channel-tls.h"
  22 #include "trace.h"
  23
  24
  25 static ssize_t qio_channel_tls_write_handler(const char *buf,
  26                                              size_t len,
  27                                              void *opaque)
  28 {
  29     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
  30     ssize_t ret;
  31
  32     ret = qio_channel_write(tioc->master, buf, len, NULL);
  33     if (ret == QIO_CHANNEL_ERR_BLOCK) {
  34         errno = EAGAIN;
  35         return -1;
  36     } else if (ret < 0) {
  37         errno = EIO;
  38         return -1;
  39     }
  40     return ret;
  41 }
  42
  43 static ssize_t qio_channel_tls_read_handler(char *buf,
  44                                             size_t len,
  45                                             void *opaque)
  46 {
  47     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
  48     ssize_t ret;
  49
  50     ret = qio_channel_read(tioc->master, buf, len, NULL);
  51     if (ret == QIO_CHANNEL_ERR_BLOCK) {
  52         errno = EAGAIN;
  53         return -1;
  54     } else if (ret < 0) {
  55         errno = EIO;
  56         return -1;
  57     }
  58     return ret;
  59 }
  60
  61
  62 QIOChannelTLS *
  63 qio_channel_tls_new_server(QIOChannel *master,
  64                            QCryptoTLSCreds *creds,
  65                            const char *aclname,
  66                            Error **errp)
  67 {
  68     QIOChannelTLS *ioc;
  69
  70     ioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
  71
  72     ioc->master = master;
  73     object_ref(OBJECT(master));
  74
  75     ioc->session = qcrypto_tls_session_new(
  76         creds,
  77         NULL,
  78         aclname,
  79         QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
  80         errp);
  81     if (!ioc->session) {
  82         goto error;
  83     }
  84
  85     qcrypto_tls_session_set_callbacks(
  86         ioc->session,
  87         qio_channel_tls_write_handler,
  88         qio_channel_tls_read_handler,
  89         ioc);
  90
  91     trace_qio_channel_tls_new_server(ioc, master, creds, aclname);
  92     return ioc;
  93
  94  error:
  95     object_unref(OBJECT(ioc));
  96     return NULL;
  97 }
  98
  99 QIOChannelTLS *
 100 qio_channel_tls_new_client(QIOChannel *master,
 101                            QCryptoTLSCreds *creds,
 102                            const char *hostname,
 103                            Error **errp)
 104 {
 105     QIOChannelTLS *tioc;
 106     QIOChannel *ioc;
 107
 108     tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
 109     ioc = QIO_CHANNEL(tioc);
 110
 111     tioc->master = master;
 112     if (master->features & (1 << QIO_CHANNEL_FEATURE_SHUTDOWN)) {
 113         ioc->features |= (1 << QIO_CHANNEL_FEATURE_SHUTDOWN);
 114     }
 115     object_ref(OBJECT(master));
 116
 117     tioc->session = qcrypto_tls_session_new(
 118         creds,
 119         hostname,
 120         NULL,
 121         QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT,
 122         errp);
 123     if (!tioc->session) {
 124         goto error;
 125     }
 126
 127     qcrypto_tls_session_set_callbacks(
 128         tioc->session,
 129         qio_channel_tls_write_handler,
 130         qio_channel_tls_read_handler,
 131         tioc);
 132
 133     trace_qio_channel_tls_new_client(tioc, master, creds, hostname);
 134     return tioc;
 135
 136  error:
 137     object_unref(OBJECT(tioc));
 138     return NULL;
 139 }
 140
 141
 142 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
 143                                              GIOCondition condition,
 144                                              gpointer user_data);
 145
 146 static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
 147                                            QIOTask *task)
 148 {
 149     Error *err = NULL;
 150     QCryptoTLSSessionHandshakeStatus status;
 151
 152     if (qcrypto_tls_session_handshake(ioc->session, &err) < 0) {
 153         trace_qio_channel_tls_handshake_fail(ioc);
 154         qio_task_abort(task, err);
 155         goto cleanup;
 156     }
 157
 158     status = qcrypto_tls_session_get_handshake_status(ioc->session);
 159     if (status == QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
 160         trace_qio_channel_tls_handshake_complete(ioc);
 161         if (qcrypto_tls_session_check_credentials(ioc->session,
 162                                                   &err) < 0) {
 163             trace_qio_channel_tls_credentials_deny(ioc);
 164             qio_task_abort(task, err);
 165             goto cleanup;
 166         }
 167         trace_qio_channel_tls_credentials_allow(ioc);
 168         qio_task_complete(task);
 169     } else {
 170         GIOCondition condition;
 171         if (status == QCRYPTO_TLS_HANDSHAKE_SENDING) {
 172             condition = G_IO_OUT;
 173         } else {
 174             condition = G_IO_IN;
 175         }
 176
 177         trace_qio_channel_tls_handshake_pending(ioc, status);
 178         qio_channel_add_watch(ioc->master,
 179                               condition,
 180                               qio_channel_tls_handshake_io,
 181                               task,
 182                               NULL);
 183     }
 184
 185  cleanup:
 186     error_free(err);
 187 }
 188
 189
 190 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
 191                                              GIOCondition condition,
 192                                              gpointer user_data)
 193 {
 194     QIOTask *task = user_data;
 195     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(
 196         qio_task_get_source(task));
 197
 198     qio_channel_tls_handshake_task(
 199        tioc, task);
 200
 201     object_unref(OBJECT(tioc));
 202
 203     return FALSE;
 204 }
 205
 206 void qio_channel_tls_handshake(QIOChannelTLS *ioc,
 207                                QIOTaskFunc func,
 208                                gpointer opaque,
 209                                GDestroyNotify destroy)
 210 {
 211     QIOTask *task;
 212
 213     task = qio_task_new(OBJECT(ioc),
 214                         func, opaque, destroy);
 215
 216     trace_qio_channel_tls_handshake_start(ioc);
 217     qio_channel_tls_handshake_task(ioc, task);
 218 }
 219
 220
 221 static void qio_channel_tls_init(Object *obj G_GNUC_UNUSED)
 222 {
 223 }
 224
 225
 226 static void qio_channel_tls_finalize(Object *obj)
 227 {
 228     QIOChannelTLS *ioc = QIO_CHANNEL_TLS(obj);
 229
 230     object_unref(OBJECT(ioc->master));
 231     qcrypto_tls_session_free(ioc->session);
 232 }
 233
 234
 235 static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
 236                                      const struct iovec *iov,
 237                                      size_t niov,
 238                                      int **fds,
 239                                      size_t *nfds,
 240                                      Error **errp)
 241 {
 242     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 243     size_t i;
 244     ssize_t got = 0;
 245
 246     for (i = 0 ; i < niov ; i++) {
 247         ssize_t ret = qcrypto_tls_session_read(tioc->session,
 248                                                iov[i].iov_base,
 249                                                iov[i].iov_len);
 250         if (ret < 0) {
 251             if (errno == EAGAIN) {
 252                 if (got) {
 253                     return got;
 254                 } else {
 255                     return QIO_CHANNEL_ERR_BLOCK;
 256                 }
 257             }
 258
 259             error_setg_errno(errp, errno,
 260                              "Cannot read from TLS channel");
 261             return -1;
 262         }
 263         got += ret;
 264         if (ret < iov[i].iov_len) {
 265             break;
 266         }
 267     }
 268     return got;
 269 }
 270
 271
 272 static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
 273                                       const struct iovec *iov,
 274                                       size_t niov,
 275                                       int *fds,
 276                                       size_t nfds,
 277                                       Error **errp)
 278 {
 279     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 280     size_t i;
 281     ssize_t done = 0;
 282
 283     for (i = 0 ; i < niov ; i++) {
 284         ssize_t ret = qcrypto_tls_session_write(tioc->session,
 285                                                 iov[i].iov_base,
 286                                                 iov[i].iov_len);
 287         if (ret <= 0) {
 288             if (errno == EAGAIN) {
 289                 if (done) {
 290                     return done;
 291                 } else {
 292                     return QIO_CHANNEL_ERR_BLOCK;
 293                 }
 294             }
 295
 296             error_setg_errno(errp, errno,
 297                              "Cannot write to TLS channel");
 298             return -1;
 299         }
 300         done += ret;
 301         if (ret < iov[i].iov_len) {
 302             break;
 303         }
 304     }
 305     return done;
 306 }
 307
 308 static int qio_channel_tls_set_blocking(QIOChannel *ioc,
 309                                         bool enabled,
 310                                         Error **errp)
 311 {
 312     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 313
 314     return qio_channel_set_blocking(tioc->master, enabled, errp);
 315 }
 316
 317 static void qio_channel_tls_set_delay(QIOChannel *ioc,
 318                                       bool enabled)
 319 {
 320     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 321
 322     qio_channel_set_delay(tioc->master, enabled);
 323 }
 324
 325 static void qio_channel_tls_set_cork(QIOChannel *ioc,
 326                                      bool enabled)
 327 {
 328     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 329
 330     qio_channel_set_cork(tioc->master, enabled);
 331 }
 332
 333 static int qio_channel_tls_shutdown(QIOChannel *ioc,
 334                                     QIOChannelShutdown how,
 335                                     Error **errp)
 336 {
 337     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 338
 339     return qio_channel_shutdown(tioc->master, how, errp);
 340 }
 341
 342 static int qio_channel_tls_close(QIOChannel *ioc,
 343                                  Error **errp)
 344 {
 345     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 346
 347     return qio_channel_close(tioc->master, errp);
 348 }
 349
 350 static GSource *qio_channel_tls_create_watch(QIOChannel *ioc,
 351                                              GIOCondition condition)
 352 {
 353     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 354
 355     return qio_channel_create_watch(tioc->master, condition);
 356 }
 357
 358 QCryptoTLSSession *
 359 qio_channel_tls_get_session(QIOChannelTLS *ioc)
 360 {
 361     return ioc->session;
 362 }
 363
 364 static void qio_channel_tls_class_init(ObjectClass *klass,
 365                                        void *class_data G_GNUC_UNUSED)
 366 {
 367     QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
 368
 369     ioc_klass->io_writev = qio_channel_tls_writev;
 370     ioc_klass->io_readv = qio_channel_tls_readv;
 371     ioc_klass->io_set_blocking = qio_channel_tls_set_blocking;
 372     ioc_klass->io_set_delay = qio_channel_tls_set_delay;
 373     ioc_klass->io_set_cork = qio_channel_tls_set_cork;
 374     ioc_klass->io_close = qio_channel_tls_close;
 375     ioc_klass->io_shutdown = qio_channel_tls_shutdown;
 376     ioc_klass->io_create_watch = qio_channel_tls_create_watch;
 377 }
 378
 379 static const TypeInfo qio_channel_tls_info = {
 380     .parent = TYPE_QIO_CHANNEL,
 381     .name = TYPE_QIO_CHANNEL_TLS,
 382     .instance_size = sizeof(QIOChannelTLS),
 383     .instance_init = qio_channel_tls_init,
 384     .instance_finalize = qio_channel_tls_finalize,
 385     .class_init = qio_channel_tls_class_init,
 386 };
 387
 388 static void qio_channel_tls_register_types(void)
 389 {
 390     type_register_static(&qio_channel_tls_info);
 391 }
 392
 393 type_init(qio_channel_tls_register_types);