block/ssh.c

   1 /*
   2  * Secure Shell (ssh) backend for QEMU.
   3  *
   4  * Copyright (C) 2013 Red Hat Inc., Richard W.M. Jones <rjones@redhat.com>
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24
  25 #include "qemu/osdep.h"
  26
  27 #include <libssh2.h>
  28 #include <libssh2_sftp.h>
  29
  30 #include "block/block_int.h"
  31 #include "qemu/error-report.h"
  32 #include "qemu/sockets.h"
  33 #include "qemu/uri.h"
  34 #include "qapi/qmp/qint.h"
  35 #include "qapi/qmp/qstring.h"
  36
  37 /* DEBUG_SSH=1 enables the DPRINTF (debugging printf) statements in
  38  * this block driver code.
  39  *
  40  * TRACE_LIBSSH2=<bitmask> enables tracing in libssh2 itself.  Note
  41  * that this requires that libssh2 was specially compiled with the
  42  * `./configure --enable-debug' option, so most likely you will have
  43  * to compile it yourself.  The meaning of <bitmask> is described
  44  * here: http://www.libssh2.org/libssh2_trace.html
  45  */
  46 #define DEBUG_SSH     0
  47 #define TRACE_LIBSSH2 0 /* or try: LIBSSH2_TRACE_SFTP */
  48
  49 #define DPRINTF(fmt, ...)                           \
  50     do {                                            \
  51         if (DEBUG_SSH) {                            \
  52             fprintf(stderr, "ssh: %-15s " fmt "\n", \
  53                     __func__, ##__VA_ARGS__);       \
  54         }                                           \
  55     } while (0)
  56
  57 typedef struct BDRVSSHState {
  58     /* Coroutine. */
  59     CoMutex lock;
  60
  61     /* SSH connection. */
  62     int sock;                         /* socket */
  63     LIBSSH2_SESSION *session;         /* ssh session */
  64     LIBSSH2_SFTP *sftp;               /* sftp session */
  65     LIBSSH2_SFTP_HANDLE *sftp_handle; /* sftp remote file handle */
  66
  67     /* See ssh_seek() function below. */
  68     int64_t offset;
  69     bool offset_op_read;
  70
  71     /* File attributes at open.  We try to keep the .filesize field
  72      * updated if it changes (eg by writing at the end of the file).
  73      */
  74     LIBSSH2_SFTP_ATTRIBUTES attrs;
  75
  76     /* Used to warn if 'flush' is not supported. */
  77     char *hostport;
  78     bool unsafe_flush_warning;
  79 } BDRVSSHState;
  80
  81 static void ssh_state_init(BDRVSSHState *s)
  82 {
  83     memset(s, 0, sizeof *s);
  84     s->sock = -1;
  85     s->offset = -1;
  86     qemu_co_mutex_init(&s->lock);
  87 }
  88
  89 static void ssh_state_free(BDRVSSHState *s)
  90 {
  91     g_free(s->hostport);
  92     if (s->sftp_handle) {
  93         libssh2_sftp_close(s->sftp_handle);
  94     }
  95     if (s->sftp) {
  96         libssh2_sftp_shutdown(s->sftp);
  97     }
  98     if (s->session) {
  99         libssh2_session_disconnect(s->session,
 100                                    "from qemu ssh client: "
 101                                    "user closed the connection");
 102         libssh2_session_free(s->session);
 103     }
 104     if (s->sock >= 0) {
 105         close(s->sock);
 106     }
 107 }
 108
 109 static void GCC_FMT_ATTR(3, 4)
 110 session_error_setg(Error **errp, BDRVSSHState *s, const char *fs, ...)
 111 {
 112     va_list args;
 113     char *msg;
 114
 115     va_start(args, fs);
 116     msg = g_strdup_vprintf(fs, args);
 117     va_end(args);
 118
 119     if (s->session) {
 120         char *ssh_err;
 121         int ssh_err_code;
 122
 123         /* This is not an errno.  See <libssh2.h>. */
 124         ssh_err_code = libssh2_session_last_error(s->session,
 125                                                   &ssh_err, NULL, 0);
 126         error_setg(errp, "%s: %s (libssh2 error code: %d)",
 127                    msg, ssh_err, ssh_err_code);
 128     } else {
 129         error_setg(errp, "%s", msg);
 130     }
 131     g_free(msg);
 132 }
 133
 134 static void GCC_FMT_ATTR(3, 4)
 135 sftp_error_setg(Error **errp, BDRVSSHState *s, const char *fs, ...)
 136 {
 137     va_list args;
 138     char *msg;
 139
 140     va_start(args, fs);
 141     msg = g_strdup_vprintf(fs, args);
 142     va_end(args);
 143
 144     if (s->sftp) {
 145         char *ssh_err;
 146         int ssh_err_code;
 147         unsigned long sftp_err_code;
 148
 149         /* This is not an errno.  See <libssh2.h>. */
 150         ssh_err_code = libssh2_session_last_error(s->session,
 151                                                   &ssh_err, NULL, 0);
 152         /* See <libssh2_sftp.h>. */
 153         sftp_err_code = libssh2_sftp_last_error((s)->sftp);
 154
 155         error_setg(errp,
 156                    "%s: %s (libssh2 error code: %d, sftp error code: %lu)",
 157                    msg, ssh_err, ssh_err_code, sftp_err_code);
 158     } else {
 159         error_setg(errp, "%s", msg);
 160     }
 161     g_free(msg);
 162 }
 163
 164 static void GCC_FMT_ATTR(2, 3)
 165 sftp_error_report(BDRVSSHState *s, const char *fs, ...)
 166 {
 167     va_list args;
 168
 169     va_start(args, fs);
 170     error_vprintf(fs, args);
 171
 172     if ((s)->sftp) {
 173         char *ssh_err;
 174         int ssh_err_code;
 175         unsigned long sftp_err_code;
 176
 177         /* This is not an errno.  See <libssh2.h>. */
 178         ssh_err_code = libssh2_session_last_error(s->session,
 179                                                   &ssh_err, NULL, 0);
 180         /* See <libssh2_sftp.h>. */
 181         sftp_err_code = libssh2_sftp_last_error((s)->sftp);
 182
 183         error_printf(": %s (libssh2 error code: %d, sftp error code: %lu)",
 184                      ssh_err, ssh_err_code, sftp_err_code);
 185     }
 186
 187     va_end(args);
 188     error_printf("\n");
 189 }
 190
 191 static int parse_uri(const char *filename, QDict *options, Error **errp)
 192 {
 193     URI *uri = NULL;
 194     QueryParams *qp;
 195     int i;
 196
 197     uri = uri_parse(filename);
 198     if (!uri) {
 199         return -EINVAL;
 200     }
 201
 202     if (strcmp(uri->scheme, "ssh") != 0) {
 203         error_setg(errp, "URI scheme must be 'ssh'");
 204         goto err;
 205     }
 206
 207     if (!uri->server || strcmp(uri->server, "") == 0) {
 208         error_setg(errp, "missing hostname in URI");
 209         goto err;
 210     }
 211
 212     if (!uri->path || strcmp(uri->path, "") == 0) {
 213         error_setg(errp, "missing remote path in URI");
 214         goto err;
 215     }
 216
 217     qp = query_params_parse(uri->query);
 218     if (!qp) {
 219         error_setg(errp, "could not parse query parameters");
 220         goto err;
 221     }
 222
 223     if(uri->user && strcmp(uri->user, "") != 0) {
 224         qdict_put(options, "user", qstring_from_str(uri->user));
 225     }
 226
 227     qdict_put(options, "host", qstring_from_str(uri->server));
 228
 229     if (uri->port) {
 230         qdict_put(options, "port", qint_from_int(uri->port));
 231     }
 232
 233     qdict_put(options, "path", qstring_from_str(uri->path));
 234
 235     /* Pick out any query parameters that we understand, and ignore
 236      * the rest.
 237      */
 238     for (i = 0; i < qp->n; ++i) {
 239         if (strcmp(qp->p[i].name, "host_key_check") == 0) {
 240             qdict_put(options, "host_key_check",
 241                       qstring_from_str(qp->p[i].value));
 242         }
 243     }
 244
 245     query_params_free(qp);
 246     uri_free(uri);
 247     return 0;
 248
 249  err:
 250     if (uri) {
 251       uri_free(uri);
 252     }
 253     return -EINVAL;
 254 }
 255
 256 static void ssh_parse_filename(const char *filename, QDict *options,
 257                                Error **errp)
 258 {
 259     if (qdict_haskey(options, "user") ||
 260         qdict_haskey(options, "host") ||
 261         qdict_haskey(options, "port") ||
 262         qdict_haskey(options, "path") ||
 263         qdict_haskey(options, "host_key_check")) {
 264         error_setg(errp, "user, host, port, path, host_key_check cannot be used at the same time as a file option");
 265         return;
 266     }
 267
 268     parse_uri(filename, options, errp);
 269 }
 270
 271 static int check_host_key_knownhosts(BDRVSSHState *s,
 272                                      const char *host, int port, Error **errp)
 273 {
 274     const char *home;
 275     char *knh_file = NULL;
 276     LIBSSH2_KNOWNHOSTS *knh = NULL;
 277     struct libssh2_knownhost *found;
 278     int ret, r;
 279     const char *hostkey;
 280     size_t len;
 281     int type;
 282
 283     hostkey = libssh2_session_hostkey(s->session, &len, &type);
 284     if (!hostkey) {
 285         ret = -EINVAL;
 286         session_error_setg(errp, s, "failed to read remote host key");
 287         goto out;
 288     }
 289
 290     knh = libssh2_knownhost_init(s->session);
 291     if (!knh) {
 292         ret = -EINVAL;
 293         session_error_setg(errp, s,
 294                            "failed to initialize known hosts support");
 295         goto out;
 296     }
 297
 298     home = getenv("HOME");
 299     if (home) {
 300         knh_file = g_strdup_printf("%s/.ssh/known_hosts", home);
 301     } else {
 302         knh_file = g_strdup_printf("/root/.ssh/known_hosts");
 303     }
 304
 305     /* Read all known hosts from OpenSSH-style known_hosts file. */
 306     libssh2_knownhost_readfile(knh, knh_file, LIBSSH2_KNOWNHOST_FILE_OPENSSH);
 307
 308     r = libssh2_knownhost_checkp(knh, host, port, hostkey, len,
 309                                  LIBSSH2_KNOWNHOST_TYPE_PLAIN|
 310                                  LIBSSH2_KNOWNHOST_KEYENC_RAW,
 311                                  &found);
 312     switch (r) {
 313     case LIBSSH2_KNOWNHOST_CHECK_MATCH:
 314         /* OK */
 315         DPRINTF("host key OK: %s", found->key);
 316         break;
 317     case LIBSSH2_KNOWNHOST_CHECK_MISMATCH:
 318         ret = -EINVAL;
 319         session_error_setg(errp, s,
 320                       "host key does not match the one in known_hosts"
 321                       " (found key %s)", found->key);
 322         goto out;
 323     case LIBSSH2_KNOWNHOST_CHECK_NOTFOUND:
 324         ret = -EINVAL;
 325         session_error_setg(errp, s, "no host key was found in known_hosts");
 326         goto out;
 327     case LIBSSH2_KNOWNHOST_CHECK_FAILURE:
 328         ret = -EINVAL;
 329         session_error_setg(errp, s,
 330                       "failure matching the host key with known_hosts");
 331         goto out;
 332     default:
 333         ret = -EINVAL;
 334         session_error_setg(errp, s, "unknown error matching the host key"
 335                       " with known_hosts (%d)", r);
 336         goto out;
 337     }
 338
 339     /* known_hosts checking successful. */
 340     ret = 0;
 341
 342  out:
 343     if (knh != NULL) {
 344         libssh2_knownhost_free(knh);
 345     }
 346     g_free(knh_file);
 347     return ret;
 348 }
 349
 350 static unsigned hex2decimal(char ch)
 351 {
 352     if (ch >= '0' && ch <= '9') {
 353         return (ch - '0');
 354     } else if (ch >= 'a' && ch <= 'f') {
 355         return 10 + (ch - 'a');
 356     } else if (ch >= 'A' && ch <= 'F') {
 357         return 10 + (ch - 'A');
 358     }
 359
 360     return -1;
 361 }
 362
 363 /* Compare the binary fingerprint (hash of host key) with the
 364  * host_key_check parameter.
 365  */
 366 static int compare_fingerprint(const unsigned char *fingerprint, size_t len,
 367                                const char *host_key_check)
 368 {
 369     unsigned c;
 370
 371     while (len > 0) {
 372         while (*host_key_check == ':')
 373             host_key_check++;
 374         if (!qemu_isxdigit(host_key_check[0]) ||
 375             !qemu_isxdigit(host_key_check[1]))
 376             return 1;
 377         c = hex2decimal(host_key_check[0]) * 16 +
 378             hex2decimal(host_key_check[1]);
 379         if (c - *fingerprint != 0)
 380             return c - *fingerprint;
 381         fingerprint++;
 382         len--;
 383         host_key_check += 2;
 384     }
 385     return *host_key_check - '\0';
 386 }
 387
 388 static int
 389 check_host_key_hash(BDRVSSHState *s, const char *hash,
 390                     int hash_type, size_t fingerprint_len, Error **errp)
 391 {
 392     const char *fingerprint;
 393
 394     fingerprint = libssh2_hostkey_hash(s->session, hash_type);
 395     if (!fingerprint) {
 396         session_error_setg(errp, s, "failed to read remote host key");
 397         return -EINVAL;
 398     }
 399
 400     if(compare_fingerprint((unsigned char *) fingerprint, fingerprint_len,
 401                            hash) != 0) {
 402         error_setg(errp, "remote host key does not match host_key_check '%s'",
 403                    hash);
 404         return -EPERM;
 405     }
 406
 407     return 0;
 408 }
 409
 410 static int check_host_key(BDRVSSHState *s, const char *host, int port,
 411                           const char *host_key_check, Error **errp)
 412 {
 413     /* host_key_check=no */
 414     if (strcmp(host_key_check, "no") == 0) {
 415         return 0;
 416     }
 417
 418     /* host_key_check=md5:xx:yy:zz:... */
 419     if (strncmp(host_key_check, "md5:", 4) == 0) {
 420         return check_host_key_hash(s, &host_key_check[4],
 421                                    LIBSSH2_HOSTKEY_HASH_MD5, 16, errp);
 422     }
 423
 424     /* host_key_check=sha1:xx:yy:zz:... */
 425     if (strncmp(host_key_check, "sha1:", 5) == 0) {
 426         return check_host_key_hash(s, &host_key_check[5],
 427                                    LIBSSH2_HOSTKEY_HASH_SHA1, 20, errp);
 428     }
 429
 430     /* host_key_check=yes */
 431     if (strcmp(host_key_check, "yes") == 0) {
 432         return check_host_key_knownhosts(s, host, port, errp);
 433     }
 434
 435     error_setg(errp, "unknown host_key_check setting (%s)", host_key_check);
 436     return -EINVAL;
 437 }
 438
 439 static int authenticate(BDRVSSHState *s, const char *user, Error **errp)
 440 {
 441     int r, ret;
 442     const char *userauthlist;
 443     LIBSSH2_AGENT *agent = NULL;
 444     struct libssh2_agent_publickey *identity;
 445     struct libssh2_agent_publickey *prev_identity = NULL;
 446
 447     userauthlist = libssh2_userauth_list(s->session, user, strlen(user));
 448     if (strstr(userauthlist, "publickey") == NULL) {
 449         ret = -EPERM;
 450         error_setg(errp,
 451                 "remote server does not support \"publickey\" authentication");
 452         goto out;
 453     }
 454
 455     /* Connect to ssh-agent and try each identity in turn. */
 456     agent = libssh2_agent_init(s->session);
 457     if (!agent) {
 458         ret = -EINVAL;
 459         session_error_setg(errp, s, "failed to initialize ssh-agent support");
 460         goto out;
 461     }
 462     if (libssh2_agent_connect(agent)) {
 463         ret = -ECONNREFUSED;
 464         session_error_setg(errp, s, "failed to connect to ssh-agent");
 465         goto out;
 466     }
 467     if (libssh2_agent_list_identities(agent)) {
 468         ret = -EINVAL;
 469         session_error_setg(errp, s,
 470                            "failed requesting identities from ssh-agent");
 471         goto out;
 472     }
 473
 474     for(;;) {
 475         r = libssh2_agent_get_identity(agent, &identity, prev_identity);
 476         if (r == 1) {           /* end of list */
 477             break;
 478         }
 479         if (r < 0) {
 480             ret = -EINVAL;
 481             session_error_setg(errp, s,
 482                                "failed to obtain identity from ssh-agent");
 483             goto out;
 484         }
 485         r = libssh2_agent_userauth(agent, user, identity);
 486         if (r == 0) {
 487             /* Authenticated! */
 488             ret = 0;
 489             goto out;
 490         }
 491         /* Failed to authenticate with this identity, try the next one. */
 492         prev_identity = identity;
 493     }
 494
 495     ret = -EPERM;
 496     error_setg(errp, "failed to authenticate using publickey authentication "
 497                "and the identities held by your ssh-agent");
 498
 499  out:
 500     if (agent != NULL) {
 501         /* Note: libssh2 implementation implicitly calls
 502          * libssh2_agent_disconnect if necessary.
 503          */
 504         libssh2_agent_free(agent);
 505     }
 506
 507     return ret;
 508 }
 509
 510 static int connect_to_ssh(BDRVSSHState *s, QDict *options,
 511                           int ssh_flags, int creat_mode, Error **errp)
 512 {
 513     int r, ret;
 514     const char *host, *user, *path, *host_key_check;
 515     int port;
 516
 517     if (!qdict_haskey(options, "host")) {
 518         ret = -EINVAL;
 519         error_setg(errp, "No hostname was specified");
 520         goto err;
 521     }
 522     host = qdict_get_str(options, "host");
 523
 524     if (qdict_haskey(options, "port")) {
 525         port = qdict_get_int(options, "port");
 526     } else {
 527         port = 22;
 528     }
 529
 530     if (!qdict_haskey(options, "path")) {
 531         ret = -EINVAL;
 532         error_setg(errp, "No path was specified");
 533         goto err;
 534     }
 535     path = qdict_get_str(options, "path");
 536
 537     if (qdict_haskey(options, "user")) {
 538         user = qdict_get_str(options, "user");
 539     } else {
 540         user = g_get_user_name();
 541         if (!user) {
 542             error_setg_errno(errp, errno, "Can't get user name");
 543             ret = -errno;
 544             goto err;
 545         }
 546     }
 547
 548     if (qdict_haskey(options, "host_key_check")) {
 549         host_key_check = qdict_get_str(options, "host_key_check");
 550     } else {
 551         host_key_check = "yes";
 552     }
 553
 554     /* Construct the host:port name for inet_connect. */
 555     g_free(s->hostport);
 556     s->hostport = g_strdup_printf("%s:%d", host, port);
 557
 558     /* Open the socket and connect. */
 559     s->sock = inet_connect(s->hostport, errp);
 560     if (s->sock < 0) {
 561         ret = -EIO;
 562         goto err;
 563     }
 564
 565     /* Create SSH session. */
 566     s->session = libssh2_session_init();
 567     if (!s->session) {
 568         ret = -EINVAL;
 569         session_error_setg(errp, s, "failed to initialize libssh2 session");
 570         goto err;
 571     }
 572
 573 #if TRACE_LIBSSH2 != 0
 574     libssh2_trace(s->session, TRACE_LIBSSH2);
 575 #endif
 576
 577     r = libssh2_session_handshake(s->session, s->sock);
 578     if (r != 0) {
 579         ret = -EINVAL;
 580         session_error_setg(errp, s, "failed to establish SSH session");
 581         goto err;
 582     }
 583
 584     /* Check the remote host's key against known_hosts. */
 585     ret = check_host_key(s, host, port, host_key_check, errp);
 586     if (ret < 0) {
 587         goto err;
 588     }
 589
 590     /* Authenticate. */
 591     ret = authenticate(s, user, errp);
 592     if (ret < 0) {
 593         goto err;
 594     }
 595
 596     /* Start SFTP. */
 597     s->sftp = libssh2_sftp_init(s->session);
 598     if (!s->sftp) {
 599         session_error_setg(errp, s, "failed to initialize sftp handle");
 600         ret = -EINVAL;
 601         goto err;
 602     }
 603
 604     /* Open the remote file. */
 605     DPRINTF("opening file %s flags=0x%x creat_mode=0%o",
 606             path, ssh_flags, creat_mode);
 607     s->sftp_handle = libssh2_sftp_open(s->sftp, path, ssh_flags, creat_mode);
 608     if (!s->sftp_handle) {
 609         session_error_setg(errp, s, "failed to open remote file '%s'", path);
 610         ret = -EINVAL;
 611         goto err;
 612     }
 613
 614     r = libssh2_sftp_fstat(s->sftp_handle, &s->attrs);
 615     if (r < 0) {
 616         sftp_error_setg(errp, s, "failed to read file attributes");
 617         return -EINVAL;
 618     }
 619
 620     /* Delete the options we've used; any not deleted will cause the
 621      * block layer to give an error about unused options.
 622      */
 623     qdict_del(options, "host");
 624     qdict_del(options, "port");
 625     qdict_del(options, "user");
 626     qdict_del(options, "path");
 627     qdict_del(options, "host_key_check");
 628
 629     return 0;
 630
 631  err:
 632     if (s->sftp_handle) {
 633         libssh2_sftp_close(s->sftp_handle);
 634     }
 635     s->sftp_handle = NULL;
 636     if (s->sftp) {
 637         libssh2_sftp_shutdown(s->sftp);
 638     }
 639     s->sftp = NULL;
 640     if (s->session) {
 641         libssh2_session_disconnect(s->session,
 642                                    "from qemu ssh client: "
 643                                    "error opening connection");
 644         libssh2_session_free(s->session);
 645     }
 646     s->session = NULL;
 647
 648     return ret;
 649 }
 650
 651 static int ssh_file_open(BlockDriverState *bs, QDict *options, int bdrv_flags,
 652                          Error **errp)
 653 {
 654     BDRVSSHState *s = bs->opaque;
 655     int ret;
 656     int ssh_flags;
 657
 658     ssh_state_init(s);
 659
 660     ssh_flags = LIBSSH2_FXF_READ;
 661     if (bdrv_flags & BDRV_O_RDWR) {
 662         ssh_flags |= LIBSSH2_FXF_WRITE;
 663     }
 664
 665     /* Start up SSH. */
 666     ret = connect_to_ssh(s, options, ssh_flags, 0, errp);
 667     if (ret < 0) {
 668         goto err;
 669     }
 670
 671     /* Go non-blocking. */
 672     libssh2_session_set_blocking(s->session, 0);
 673
 674     return 0;
 675
 676  err:
 677     if (s->sock >= 0) {
 678         close(s->sock);
 679     }
 680     s->sock = -1;
 681
 682     return ret;
 683 }
 684
 685 static QemuOptsList ssh_create_opts = {
 686     .name = "ssh-create-opts",
 687     .head = QTAILQ_HEAD_INITIALIZER(ssh_create_opts.head),
 688     .desc = {
 689         {
 690             .name = BLOCK_OPT_SIZE,
 691             .type = QEMU_OPT_SIZE,
 692             .help = "Virtual disk size"
 693         },
 694         { /* end of list */ }
 695     }
 696 };
 697
 698 static int ssh_create(const char *filename, QemuOpts *opts, Error **errp)
 699 {
 700     int r, ret;
 701     int64_t total_size = 0;
 702     QDict *uri_options = NULL;
 703     BDRVSSHState s;
 704     ssize_t r2;
 705     char c[1] = { '\0' };
 706
 707     ssh_state_init(&s);
 708
 709     /* Get desired file size. */
 710     total_size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),
 711                           BDRV_SECTOR_SIZE);
 712     DPRINTF("total_size=%" PRIi64, total_size);
 713
 714     uri_options = qdict_new();
 715     r = parse_uri(filename, uri_options, errp);
 716     if (r < 0) {
 717         ret = r;
 718         goto out;
 719     }
 720
 721     r = connect_to_ssh(&s, uri_options,
 722                        LIBSSH2_FXF_READ|LIBSSH2_FXF_WRITE|
 723                        LIBSSH2_FXF_CREAT|LIBSSH2_FXF_TRUNC,
 724                        0644, errp);
 725     if (r < 0) {
 726         ret = r;
 727         goto out;
 728     }
 729
 730     if (total_size > 0) {
 731         libssh2_sftp_seek64(s.sftp_handle, total_size-1);
 732         r2 = libssh2_sftp_write(s.sftp_handle, c, 1);
 733         if (r2 < 0) {
 734             sftp_error_setg(errp, &s, "truncate failed");
 735             ret = -EINVAL;
 736             goto out;
 737         }
 738         s.attrs.filesize = total_size;
 739     }
 740
 741     ret = 0;
 742
 743  out:
 744     ssh_state_free(&s);
 745     if (uri_options != NULL) {
 746         QDECREF(uri_options);
 747     }
 748     return ret;
 749 }
 750
 751 static void ssh_close(BlockDriverState *bs)
 752 {
 753     BDRVSSHState *s = bs->opaque;
 754
 755     ssh_state_free(s);
 756 }
 757
 758 static int ssh_has_zero_init(BlockDriverState *bs)
 759 {
 760     BDRVSSHState *s = bs->opaque;
 761     /* Assume false, unless we can positively prove it's true. */
 762     int has_zero_init = 0;
 763
 764     if (s->attrs.flags & LIBSSH2_SFTP_ATTR_PERMISSIONS) {
 765         if (s->attrs.permissions & LIBSSH2_SFTP_S_IFREG) {
 766             has_zero_init = 1;
 767         }
 768     }
 769
 770     return has_zero_init;
 771 }
 772
 773 static void restart_coroutine(void *opaque)
 774 {
 775     Coroutine *co = opaque;
 776
 777     DPRINTF("co=%p", co);
 778
 779     qemu_coroutine_enter(co, NULL);
 780 }
 781
 782 static coroutine_fn void set_fd_handler(BDRVSSHState *s, BlockDriverState *bs)
 783 {
 784     int r;
 785     IOHandler *rd_handler = NULL, *wr_handler = NULL;
 786     Coroutine *co = qemu_coroutine_self();
 787
 788     r = libssh2_session_block_directions(s->session);
 789
 790     if (r & LIBSSH2_SESSION_BLOCK_INBOUND) {
 791         rd_handler = restart_coroutine;
 792     }
 793     if (r & LIBSSH2_SESSION_BLOCK_OUTBOUND) {
 794         wr_handler = restart_coroutine;
 795     }
 796
 797     DPRINTF("s->sock=%d rd_handler=%p wr_handler=%p", s->sock,
 798             rd_handler, wr_handler);
 799
 800     aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock,
 801                        false, rd_handler, wr_handler, co);
 802 }
 803
 804 static coroutine_fn void clear_fd_handler(BDRVSSHState *s,
 805                                           BlockDriverState *bs)
 806 {
 807     DPRINTF("s->sock=%d", s->sock);
 808     aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock,
 809                        false, NULL, NULL, NULL);
 810 }
 811
 812 /* A non-blocking call returned EAGAIN, so yield, ensuring the
 813  * handlers are set up so that we'll be rescheduled when there is an
 814  * interesting event on the socket.
 815  */
 816 static coroutine_fn void co_yield(BDRVSSHState *s, BlockDriverState *bs)
 817 {
 818     set_fd_handler(s, bs);
 819     qemu_coroutine_yield();
 820     clear_fd_handler(s, bs);
 821 }
 822
 823 /* SFTP has a function `libssh2_sftp_seek64' which seeks to a position
 824  * in the remote file.  Notice that it just updates a field in the
 825  * sftp_handle structure, so there is no network traffic and it cannot
 826  * fail.
 827  *
 828  * However, `libssh2_sftp_seek64' does have a catastrophic effect on
 829  * performance since it causes the handle to throw away all in-flight
 830  * reads and buffered readahead data.  Therefore this function tries
 831  * to be intelligent about when to call the underlying libssh2 function.
 832  */
 833 #define SSH_SEEK_WRITE 0
 834 #define SSH_SEEK_READ  1
 835 #define SSH_SEEK_FORCE 2
 836
 837 static void ssh_seek(BDRVSSHState *s, int64_t offset, int flags)
 838 {
 839     bool op_read = (flags & SSH_SEEK_READ) != 0;
 840     bool force = (flags & SSH_SEEK_FORCE) != 0;
 841
 842     if (force || op_read != s->offset_op_read || offset != s->offset) {
 843         DPRINTF("seeking to offset=%" PRIi64, offset);
 844         libssh2_sftp_seek64(s->sftp_handle, offset);
 845         s->offset = offset;
 846         s->offset_op_read = op_read;
 847     }
 848 }
 849
 850 static coroutine_fn int ssh_read(BDRVSSHState *s, BlockDriverState *bs,
 851                                  int64_t offset, size_t size,
 852                                  QEMUIOVector *qiov)
 853 {
 854     ssize_t r;
 855     size_t got;
 856     char *buf, *end_of_vec;
 857     struct iovec *i;
 858
 859     DPRINTF("offset=%" PRIi64 " size=%zu", offset, size);
 860
 861     ssh_seek(s, offset, SSH_SEEK_READ);
 862
 863     /* This keeps track of the current iovec element ('i'), where we
 864      * will write to next ('buf'), and the end of the current iovec
 865      * ('end_of_vec').
 866      */
 867     i = &qiov->iov[0];
 868     buf = i->iov_base;
 869     end_of_vec = i->iov_base + i->iov_len;
 870
 871     /* libssh2 has a hard-coded limit of 2000 bytes per request,
 872      * although it will also do readahead behind our backs.  Therefore
 873      * we may have to do repeated reads here until we have read 'size'
 874      * bytes.
 875      */
 876     for (got = 0; got < size; ) {
 877     again:
 878         DPRINTF("sftp_read buf=%p size=%zu", buf, end_of_vec - buf);
 879         r = libssh2_sftp_read(s->sftp_handle, buf, end_of_vec - buf);
 880         DPRINTF("sftp_read returned %zd", r);
 881
 882         if (r == LIBSSH2_ERROR_EAGAIN || r == LIBSSH2_ERROR_TIMEOUT) {
 883             co_yield(s, bs);
 884             goto again;
 885         }
 886         if (r < 0) {
 887             sftp_error_report(s, "read failed");
 888             s->offset = -1;
 889             return -EIO;
 890         }
 891         if (r == 0) {
 892             /* EOF: Short read so pad the buffer with zeroes and return it. */
 893             qemu_iovec_memset(qiov, got, 0, size - got);
 894             return 0;
 895         }
 896
 897         got += r;
 898         buf += r;
 899         s->offset += r;
 900         if (buf >= end_of_vec && got < size) {
 901             i++;
 902             buf = i->iov_base;
 903             end_of_vec = i->iov_base + i->iov_len;
 904         }
 905     }
 906
 907     return 0;
 908 }
 909
 910 static coroutine_fn int ssh_co_readv(BlockDriverState *bs,
 911                                      int64_t sector_num,
 912                                      int nb_sectors, QEMUIOVector *qiov)
 913 {
 914     BDRVSSHState *s = bs->opaque;
 915     int ret;
 916
 917     qemu_co_mutex_lock(&s->lock);
 918     ret = ssh_read(s, bs, sector_num * BDRV_SECTOR_SIZE,
 919                    nb_sectors * BDRV_SECTOR_SIZE, qiov);
 920     qemu_co_mutex_unlock(&s->lock);
 921
 922     return ret;
 923 }
 924
 925 static int ssh_write(BDRVSSHState *s, BlockDriverState *bs,
 926                      int64_t offset, size_t size,
 927                      QEMUIOVector *qiov)
 928 {
 929     ssize_t r;
 930     size_t written;
 931     char *buf, *end_of_vec;
 932     struct iovec *i;
 933
 934     DPRINTF("offset=%" PRIi64 " size=%zu", offset, size);
 935
 936     ssh_seek(s, offset, SSH_SEEK_WRITE);
 937
 938     /* This keeps track of the current iovec element ('i'), where we
 939      * will read from next ('buf'), and the end of the current iovec
 940      * ('end_of_vec').
 941      */
 942     i = &qiov->iov[0];
 943     buf = i->iov_base;
 944     end_of_vec = i->iov_base + i->iov_len;
 945
 946     for (written = 0; written < size; ) {
 947     again:
 948         DPRINTF("sftp_write buf=%p size=%zu", buf, end_of_vec - buf);
 949         r = libssh2_sftp_write(s->sftp_handle, buf, end_of_vec - buf);
 950         DPRINTF("sftp_write returned %zd", r);
 951
 952         if (r == LIBSSH2_ERROR_EAGAIN || r == LIBSSH2_ERROR_TIMEOUT) {
 953             co_yield(s, bs);
 954             goto again;
 955         }
 956         if (r < 0) {
 957             sftp_error_report(s, "write failed");
 958             s->offset = -1;
 959             return -EIO;
 960         }
 961         /* The libssh2 API is very unclear about this.  A comment in
 962          * the code says "nothing was acked, and no EAGAIN was
 963          * received!" which apparently means that no data got sent
 964          * out, and the underlying channel didn't return any EAGAIN
 965          * indication.  I think this is a bug in either libssh2 or
 966          * OpenSSH (server-side).  In any case, forcing a seek (to
 967          * discard libssh2 internal buffers), and then trying again
 968          * works for me.
 969          */
 970         if (r == 0) {
 971             ssh_seek(s, offset + written, SSH_SEEK_WRITE|SSH_SEEK_FORCE);
 972             co_yield(s, bs);
 973             goto again;
 974         }
 975
 976         written += r;
 977         buf += r;
 978         s->offset += r;
 979         if (buf >= end_of_vec && written < size) {
 980             i++;
 981             buf = i->iov_base;
 982             end_of_vec = i->iov_base + i->iov_len;
 983         }
 984
 985         if (offset + written > s->attrs.filesize)
 986             s->attrs.filesize = offset + written;
 987     }
 988
 989     return 0;
 990 }
 991
 992 static coroutine_fn int ssh_co_writev(BlockDriverState *bs,
 993                                       int64_t sector_num,
 994                                       int nb_sectors, QEMUIOVector *qiov)
 995 {
 996     BDRVSSHState *s = bs->opaque;
 997     int ret;
 998
 999     qemu_co_mutex_lock(&s->lock);
1000     ret = ssh_write(s, bs, sector_num * BDRV_SECTOR_SIZE,
1001                     nb_sectors * BDRV_SECTOR_SIZE, qiov);
1002     qemu_co_mutex_unlock(&s->lock);
1003
1004     return ret;
1005 }
1006
1007 static void unsafe_flush_warning(BDRVSSHState *s, const char *what)
1008 {
1009     if (!s->unsafe_flush_warning) {
1010         error_report("warning: ssh server %s does not support fsync",
1011                      s->hostport);
1012         if (what) {
1013             error_report("to support fsync, you need %s", what);
1014         }
1015         s->unsafe_flush_warning = true;
1016     }
1017 }
1018
1019 #ifdef HAS_LIBSSH2_SFTP_FSYNC
1020
1021 static coroutine_fn int ssh_flush(BDRVSSHState *s, BlockDriverState *bs)
1022 {
1023     int r;
1024
1025     DPRINTF("fsync");
1026  again:
1027     r = libssh2_sftp_fsync(s->sftp_handle);
1028     if (r == LIBSSH2_ERROR_EAGAIN || r == LIBSSH2_ERROR_TIMEOUT) {
1029         co_yield(s, bs);
1030         goto again;
1031     }
1032     if (r == LIBSSH2_ERROR_SFTP_PROTOCOL &&
1033         libssh2_sftp_last_error(s->sftp) == LIBSSH2_FX_OP_UNSUPPORTED) {
1034         unsafe_flush_warning(s, "OpenSSH >= 6.3");
1035         return 0;
1036     }
1037     if (r < 0) {
1038         sftp_error_report(s, "fsync failed");
1039         return -EIO;
1040     }
1041
1042     return 0;
1043 }
1044
1045 static coroutine_fn int ssh_co_flush(BlockDriverState *bs)
1046 {
1047     BDRVSSHState *s = bs->opaque;
1048     int ret;
1049
1050     qemu_co_mutex_lock(&s->lock);
1051     ret = ssh_flush(s, bs);
1052     qemu_co_mutex_unlock(&s->lock);
1053
1054     return ret;
1055 }
1056
1057 #else /* !HAS_LIBSSH2_SFTP_FSYNC */
1058
1059 static coroutine_fn int ssh_co_flush(BlockDriverState *bs)
1060 {
1061     BDRVSSHState *s = bs->opaque;
1062
1063     unsafe_flush_warning(s, "libssh2 >= 1.4.4");
1064     return 0;
1065 }
1066
1067 #endif /* !HAS_LIBSSH2_SFTP_FSYNC */
1068
1069 static int64_t ssh_getlength(BlockDriverState *bs)
1070 {
1071     BDRVSSHState *s = bs->opaque;
1072     int64_t length;
1073
1074     /* Note we cannot make a libssh2 call here. */
1075     length = (int64_t) s->attrs.filesize;
1076     DPRINTF("length=%" PRIi64, length);
1077
1078     return length;
1079 }
1080
1081 static BlockDriver bdrv_ssh = {
1082     .format_name                  = "ssh",
1083     .protocol_name                = "ssh",
1084     .instance_size                = sizeof(BDRVSSHState),
1085     .bdrv_parse_filename          = ssh_parse_filename,
1086     .bdrv_file_open               = ssh_file_open,
1087     .bdrv_create                  = ssh_create,
1088     .bdrv_close                   = ssh_close,
1089     .bdrv_has_zero_init           = ssh_has_zero_init,
1090     .bdrv_co_readv                = ssh_co_readv,
1091     .bdrv_co_writev               = ssh_co_writev,
1092     .bdrv_getlength               = ssh_getlength,
1093     .bdrv_co_flush_to_disk        = ssh_co_flush,
1094     .create_opts                  = &ssh_create_opts,
1095 };
1096
1097 static void bdrv_ssh_init(void)
1098 {
1099     int r;
1100
1101     r = libssh2_init(0);
1102     if (r != 0) {
1103         fprintf(stderr, "libssh2 initialization failed, %d\n", r);
1104         exit(EXIT_FAILURE);
1105     }
1106
1107     bdrv_register(&bdrv_ssh);
1108 }
1109
1110 block_init(bdrv_ssh_init);