2 * QEMU migration TLS support
4 * Copyright (c) 2015 Red Hat, Inc.
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu/osdep.h"
23 #include "migration.h"
26 #include "crypto/tlscreds.h"
27 #include "qemu/error-report.h"
28 #include "qapi/error.h"
31 static QCryptoTLSCreds
*
32 migration_tls_get_creds(MigrationState
*s
,
33 QCryptoTLSCredsEndpoint endpoint
,
39 creds
= object_resolve_path_component(
40 object_get_objects_root(), s
->parameters
.tls_creds
);
42 error_setg(errp
, "No TLS credentials with id '%s'",
43 s
->parameters
.tls_creds
);
46 ret
= (QCryptoTLSCreds
*)object_dynamic_cast(
47 creds
, TYPE_QCRYPTO_TLS_CREDS
);
49 error_setg(errp
, "Object with id '%s' is not TLS credentials",
50 s
->parameters
.tls_creds
);
53 if (!qcrypto_tls_creds_check_endpoint(ret
, endpoint
, errp
)) {
61 static void migration_tls_incoming_handshake(QIOTask
*task
,
64 QIOChannel
*ioc
= QIO_CHANNEL(qio_task_get_source(task
));
67 if (qio_task_propagate_error(task
, &err
)) {
68 trace_migration_tls_incoming_handshake_error(error_get_pretty(err
));
69 error_report_err(err
);
71 trace_migration_tls_incoming_handshake_complete();
72 migration_channel_process_incoming(ioc
);
74 object_unref(OBJECT(ioc
));
77 void migration_tls_channel_process_incoming(MigrationState
*s
,
81 QCryptoTLSCreds
*creds
;
84 creds
= migration_tls_get_creds(
85 s
, QCRYPTO_TLS_CREDS_ENDPOINT_SERVER
, errp
);
90 tioc
= qio_channel_tls_new_server(
92 s
->parameters
.tls_authz
,
98 trace_migration_tls_incoming_handshake_start();
99 qio_channel_set_name(QIO_CHANNEL(tioc
), "migration-tls-incoming");
100 qio_channel_tls_handshake(tioc
,
101 migration_tls_incoming_handshake
,
108 static void migration_tls_outgoing_handshake(QIOTask
*task
,
111 MigrationState
*s
= opaque
;
112 QIOChannel
*ioc
= QIO_CHANNEL(qio_task_get_source(task
));
115 if (qio_task_propagate_error(task
, &err
)) {
116 trace_migration_tls_outgoing_handshake_error(error_get_pretty(err
));
118 trace_migration_tls_outgoing_handshake_complete();
120 migration_channel_connect(s
, ioc
, NULL
, err
);
121 object_unref(OBJECT(ioc
));
124 QIOChannelTLS
*migration_tls_client_create(MigrationState
*s
,
126 const char *hostname
,
129 QCryptoTLSCreds
*creds
;
131 creds
= migration_tls_get_creds(
132 s
, QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT
, errp
);
137 if (s
->parameters
.tls_hostname
&& *s
->parameters
.tls_hostname
) {
138 hostname
= s
->parameters
.tls_hostname
;
141 return qio_channel_tls_new_client(ioc
, creds
, hostname
, errp
);
144 void migration_tls_channel_connect(MigrationState
*s
,
146 const char *hostname
,
151 tioc
= migration_tls_client_create(s
, ioc
, hostname
, errp
);
156 /* Save hostname into MigrationState for handshake */
157 s
->hostname
= g_strdup(hostname
);
158 trace_migration_tls_outgoing_handshake_start(hostname
);
159 qio_channel_set_name(QIO_CHANNEL(tioc
), "migration-tls-outgoing");
160 qio_channel_tls_handshake(tioc
,
161 migration_tls_outgoing_handshake
,
167 bool migrate_channel_requires_tls_upgrade(QIOChannel
*ioc
)
169 if (!migrate_tls()) {
173 return !object_dynamic_cast(OBJECT(ioc
), TYPE_QIO_CHANNEL_TLS
);