Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2019-02-28' into...
[qemu/ar7.git] / io / channel-tls.c
blobc98ead21b01ea23cbfa0a99a3cff4c01141158e6
1 /*
2 * QEMU I/O channels TLS driver
4 * Copyright (c) 2015 Red Hat, Inc.
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "io/channel-tls.h"
24 #include "trace.h"
27 static ssize_t qio_channel_tls_write_handler(const char *buf,
28 size_t len,
29 void *opaque)
31 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
32 ssize_t ret;
34 ret = qio_channel_write(tioc->master, buf, len, NULL);
35 if (ret == QIO_CHANNEL_ERR_BLOCK) {
36 errno = EAGAIN;
37 return -1;
38 } else if (ret < 0) {
39 errno = EIO;
40 return -1;
42 return ret;
45 static ssize_t qio_channel_tls_read_handler(char *buf,
46 size_t len,
47 void *opaque)
49 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
50 ssize_t ret;
52 ret = qio_channel_read(tioc->master, buf, len, NULL);
53 if (ret == QIO_CHANNEL_ERR_BLOCK) {
54 errno = EAGAIN;
55 return -1;
56 } else if (ret < 0) {
57 errno = EIO;
58 return -1;
60 return ret;
64 QIOChannelTLS *
65 qio_channel_tls_new_server(QIOChannel *master,
66 QCryptoTLSCreds *creds,
67 const char *aclname,
68 Error **errp)
70 QIOChannelTLS *ioc;
72 ioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
74 ioc->master = master;
75 object_ref(OBJECT(master));
77 ioc->session = qcrypto_tls_session_new(
78 creds,
79 NULL,
80 aclname,
81 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
82 errp);
83 if (!ioc->session) {
84 goto error;
87 qcrypto_tls_session_set_callbacks(
88 ioc->session,
89 qio_channel_tls_write_handler,
90 qio_channel_tls_read_handler,
91 ioc);
93 trace_qio_channel_tls_new_server(ioc, master, creds, aclname);
94 return ioc;
96 error:
97 object_unref(OBJECT(ioc));
98 return NULL;
101 QIOChannelTLS *
102 qio_channel_tls_new_client(QIOChannel *master,
103 QCryptoTLSCreds *creds,
104 const char *hostname,
105 Error **errp)
107 QIOChannelTLS *tioc;
108 QIOChannel *ioc;
110 tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
111 ioc = QIO_CHANNEL(tioc);
113 tioc->master = master;
114 if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
115 qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
117 object_ref(OBJECT(master));
119 tioc->session = qcrypto_tls_session_new(
120 creds,
121 hostname,
122 NULL,
123 QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT,
124 errp);
125 if (!tioc->session) {
126 goto error;
129 qcrypto_tls_session_set_callbacks(
130 tioc->session,
131 qio_channel_tls_write_handler,
132 qio_channel_tls_read_handler,
133 tioc);
135 trace_qio_channel_tls_new_client(tioc, master, creds, hostname);
136 return tioc;
138 error:
139 object_unref(OBJECT(tioc));
140 return NULL;
143 struct QIOChannelTLSData {
144 QIOTask *task;
145 GMainContext *context;
147 typedef struct QIOChannelTLSData QIOChannelTLSData;
149 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
150 GIOCondition condition,
151 gpointer user_data);
153 static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
154 QIOTask *task,
155 GMainContext *context)
157 Error *err = NULL;
158 QCryptoTLSSessionHandshakeStatus status;
160 if (qcrypto_tls_session_handshake(ioc->session, &err) < 0) {
161 trace_qio_channel_tls_handshake_fail(ioc);
162 qio_task_set_error(task, err);
163 qio_task_complete(task);
164 return;
167 status = qcrypto_tls_session_get_handshake_status(ioc->session);
168 if (status == QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
169 trace_qio_channel_tls_handshake_complete(ioc);
170 if (qcrypto_tls_session_check_credentials(ioc->session,
171 &err) < 0) {
172 trace_qio_channel_tls_credentials_deny(ioc);
173 qio_task_set_error(task, err);
174 } else {
175 trace_qio_channel_tls_credentials_allow(ioc);
177 qio_task_complete(task);
178 } else {
179 GIOCondition condition;
180 QIOChannelTLSData *data = g_new0(typeof(*data), 1);
182 data->task = task;
183 data->context = context;
185 if (context) {
186 g_main_context_ref(context);
189 if (status == QCRYPTO_TLS_HANDSHAKE_SENDING) {
190 condition = G_IO_OUT;
191 } else {
192 condition = G_IO_IN;
195 trace_qio_channel_tls_handshake_pending(ioc, status);
196 qio_channel_add_watch_full(ioc->master,
197 condition,
198 qio_channel_tls_handshake_io,
199 data,
200 NULL,
201 context);
206 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
207 GIOCondition condition,
208 gpointer user_data)
210 QIOChannelTLSData *data = user_data;
211 QIOTask *task = data->task;
212 GMainContext *context = data->context;
213 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(
214 qio_task_get_source(task));
216 g_free(data);
217 qio_channel_tls_handshake_task(tioc, task, context);
219 if (context) {
220 g_main_context_unref(context);
223 return FALSE;
226 void qio_channel_tls_handshake(QIOChannelTLS *ioc,
227 QIOTaskFunc func,
228 gpointer opaque,
229 GDestroyNotify destroy,
230 GMainContext *context)
232 QIOTask *task;
234 task = qio_task_new(OBJECT(ioc),
235 func, opaque, destroy);
237 trace_qio_channel_tls_handshake_start(ioc);
238 qio_channel_tls_handshake_task(ioc, task, context);
242 static void qio_channel_tls_init(Object *obj G_GNUC_UNUSED)
247 static void qio_channel_tls_finalize(Object *obj)
249 QIOChannelTLS *ioc = QIO_CHANNEL_TLS(obj);
251 object_unref(OBJECT(ioc->master));
252 qcrypto_tls_session_free(ioc->session);
256 static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
257 const struct iovec *iov,
258 size_t niov,
259 int **fds,
260 size_t *nfds,
261 Error **errp)
263 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
264 size_t i;
265 ssize_t got = 0;
267 for (i = 0 ; i < niov ; i++) {
268 ssize_t ret = qcrypto_tls_session_read(tioc->session,
269 iov[i].iov_base,
270 iov[i].iov_len);
271 if (ret < 0) {
272 if (errno == EAGAIN) {
273 if (got) {
274 return got;
275 } else {
276 return QIO_CHANNEL_ERR_BLOCK;
278 } else if (errno == ECONNABORTED &&
279 (tioc->shutdown & QIO_CHANNEL_SHUTDOWN_READ)) {
280 return 0;
283 error_setg_errno(errp, errno,
284 "Cannot read from TLS channel");
285 return -1;
287 got += ret;
288 if (ret < iov[i].iov_len) {
289 break;
292 return got;
296 static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
297 const struct iovec *iov,
298 size_t niov,
299 int *fds,
300 size_t nfds,
301 Error **errp)
303 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
304 size_t i;
305 ssize_t done = 0;
307 for (i = 0 ; i < niov ; i++) {
308 ssize_t ret = qcrypto_tls_session_write(tioc->session,
309 iov[i].iov_base,
310 iov[i].iov_len);
311 if (ret <= 0) {
312 if (errno == EAGAIN) {
313 if (done) {
314 return done;
315 } else {
316 return QIO_CHANNEL_ERR_BLOCK;
320 error_setg_errno(errp, errno,
321 "Cannot write to TLS channel");
322 return -1;
324 done += ret;
325 if (ret < iov[i].iov_len) {
326 break;
329 return done;
332 static int qio_channel_tls_set_blocking(QIOChannel *ioc,
333 bool enabled,
334 Error **errp)
336 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
338 return qio_channel_set_blocking(tioc->master, enabled, errp);
341 static void qio_channel_tls_set_delay(QIOChannel *ioc,
342 bool enabled)
344 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
346 qio_channel_set_delay(tioc->master, enabled);
349 static void qio_channel_tls_set_cork(QIOChannel *ioc,
350 bool enabled)
352 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
354 qio_channel_set_cork(tioc->master, enabled);
357 static int qio_channel_tls_shutdown(QIOChannel *ioc,
358 QIOChannelShutdown how,
359 Error **errp)
361 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
363 tioc->shutdown |= how;
365 return qio_channel_shutdown(tioc->master, how, errp);
368 static int qio_channel_tls_close(QIOChannel *ioc,
369 Error **errp)
371 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
373 return qio_channel_close(tioc->master, errp);
376 static void qio_channel_tls_set_aio_fd_handler(QIOChannel *ioc,
377 AioContext *ctx,
378 IOHandler *io_read,
379 IOHandler *io_write,
380 void *opaque)
382 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
384 qio_channel_set_aio_fd_handler(tioc->master, ctx, io_read, io_write, opaque);
387 static GSource *qio_channel_tls_create_watch(QIOChannel *ioc,
388 GIOCondition condition)
390 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
392 return qio_channel_create_watch(tioc->master, condition);
395 QCryptoTLSSession *
396 qio_channel_tls_get_session(QIOChannelTLS *ioc)
398 return ioc->session;
401 static void qio_channel_tls_class_init(ObjectClass *klass,
402 void *class_data G_GNUC_UNUSED)
404 QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
406 ioc_klass->io_writev = qio_channel_tls_writev;
407 ioc_klass->io_readv = qio_channel_tls_readv;
408 ioc_klass->io_set_blocking = qio_channel_tls_set_blocking;
409 ioc_klass->io_set_delay = qio_channel_tls_set_delay;
410 ioc_klass->io_set_cork = qio_channel_tls_set_cork;
411 ioc_klass->io_close = qio_channel_tls_close;
412 ioc_klass->io_shutdown = qio_channel_tls_shutdown;
413 ioc_klass->io_create_watch = qio_channel_tls_create_watch;
414 ioc_klass->io_set_aio_fd_handler = qio_channel_tls_set_aio_fd_handler;
417 static const TypeInfo qio_channel_tls_info = {
418 .parent = TYPE_QIO_CHANNEL,
419 .name = TYPE_QIO_CHANNEL_TLS,
420 .instance_size = sizeof(QIOChannelTLS),
421 .instance_init = qio_channel_tls_init,
422 .instance_finalize = qio_channel_tls_finalize,
423 .class_init = qio_channel_tls_class_init,
426 static void qio_channel_tls_register_types(void)
428 type_register_static(&qio_channel_tls_info);
431 type_init(qio_channel_tls_register_types);