io/channel-tls.c

   1 /*
   2  * QEMU I/O channels TLS driver
   3  *
   4  * Copyright (c) 2015 Red Hat, Inc.
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "qapi/error.h"
  23 #include "qemu/module.h"
  24 #include "io/channel-tls.h"
  25 #include "trace.h"
  26 #include "qemu/atomic.h"
  27
  28
  29 static ssize_t qio_channel_tls_write_handler(const char *buf,
  30                                              size_t len,
  31                                              void *opaque)
  32 {
  33     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
  34     ssize_t ret;
  35
  36     ret = qio_channel_write(tioc->master, buf, len, NULL);
  37     if (ret == QIO_CHANNEL_ERR_BLOCK) {
  38         errno = EAGAIN;
  39         return -1;
  40     } else if (ret < 0) {
  41         errno = EIO;
  42         return -1;
  43     }
  44     return ret;
  45 }
  46
  47 static ssize_t qio_channel_tls_read_handler(char *buf,
  48                                             size_t len,
  49                                             void *opaque)
  50 {
  51     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
  52     ssize_t ret;
  53
  54     ret = qio_channel_read(tioc->master, buf, len, NULL);
  55     if (ret == QIO_CHANNEL_ERR_BLOCK) {
  56         errno = EAGAIN;
  57         return -1;
  58     } else if (ret < 0) {
  59         errno = EIO;
  60         return -1;
  61     }
  62     return ret;
  63 }
  64
  65
  66 QIOChannelTLS *
  67 qio_channel_tls_new_server(QIOChannel *master,
  68                            QCryptoTLSCreds *creds,
  69                            const char *aclname,
  70                            Error **errp)
  71 {
  72     QIOChannelTLS *ioc;
  73
  74     ioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
  75
  76     ioc->master = master;
  77     if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
  78         qio_channel_set_feature(QIO_CHANNEL(ioc), QIO_CHANNEL_FEATURE_SHUTDOWN);
  79     }
  80     object_ref(OBJECT(master));
  81
  82     ioc->session = qcrypto_tls_session_new(
  83         creds,
  84         NULL,
  85         aclname,
  86         QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
  87         errp);
  88     if (!ioc->session) {
  89         goto error;
  90     }
  91
  92     qcrypto_tls_session_set_callbacks(
  93         ioc->session,
  94         qio_channel_tls_write_handler,
  95         qio_channel_tls_read_handler,
  96         ioc);
  97
  98     trace_qio_channel_tls_new_server(ioc, master, creds, aclname);
  99     return ioc;
 100
 101  error:
 102     object_unref(OBJECT(ioc));
 103     return NULL;
 104 }
 105
 106 QIOChannelTLS *
 107 qio_channel_tls_new_client(QIOChannel *master,
 108                            QCryptoTLSCreds *creds,
 109                            const char *hostname,
 110                            Error **errp)
 111 {
 112     QIOChannelTLS *tioc;
 113     QIOChannel *ioc;
 114
 115     tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
 116     ioc = QIO_CHANNEL(tioc);
 117
 118     tioc->master = master;
 119     if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
 120         qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
 121     }
 122     object_ref(OBJECT(master));
 123
 124     tioc->session = qcrypto_tls_session_new(
 125         creds,
 126         hostname,
 127         NULL,
 128         QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT,
 129         errp);
 130     if (!tioc->session) {
 131         goto error;
 132     }
 133
 134     qcrypto_tls_session_set_callbacks(
 135         tioc->session,
 136         qio_channel_tls_write_handler,
 137         qio_channel_tls_read_handler,
 138         tioc);
 139
 140     trace_qio_channel_tls_new_client(tioc, master, creds, hostname);
 141     return tioc;
 142
 143  error:
 144     object_unref(OBJECT(tioc));
 145     return NULL;
 146 }
 147
 148 struct QIOChannelTLSData {
 149     QIOTask *task;
 150     GMainContext *context;
 151 };
 152 typedef struct QIOChannelTLSData QIOChannelTLSData;
 153
 154 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
 155                                              GIOCondition condition,
 156                                              gpointer user_data);
 157
 158 static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
 159                                            QIOTask *task,
 160                                            GMainContext *context)
 161 {
 162     Error *err = NULL;
 163     QCryptoTLSSessionHandshakeStatus status;
 164
 165     if (qcrypto_tls_session_handshake(ioc->session, &err) < 0) {
 166         trace_qio_channel_tls_handshake_fail(ioc);
 167         qio_task_set_error(task, err);
 168         qio_task_complete(task);
 169         return;
 170     }
 171
 172     status = qcrypto_tls_session_get_handshake_status(ioc->session);
 173     if (status == QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
 174         trace_qio_channel_tls_handshake_complete(ioc);
 175         if (qcrypto_tls_session_check_credentials(ioc->session,
 176                                                   &err) < 0) {
 177             trace_qio_channel_tls_credentials_deny(ioc);
 178             qio_task_set_error(task, err);
 179         } else {
 180             trace_qio_channel_tls_credentials_allow(ioc);
 181         }
 182         qio_task_complete(task);
 183     } else {
 184         GIOCondition condition;
 185         QIOChannelTLSData *data = g_new0(typeof(*data), 1);
 186
 187         data->task = task;
 188         data->context = context;
 189
 190         if (context) {
 191             g_main_context_ref(context);
 192         }
 193
 194         if (status == QCRYPTO_TLS_HANDSHAKE_SENDING) {
 195             condition = G_IO_OUT;
 196         } else {
 197             condition = G_IO_IN;
 198         }
 199
 200         trace_qio_channel_tls_handshake_pending(ioc, status);
 201         qio_channel_add_watch_full(ioc->master,
 202                                    condition,
 203                                    qio_channel_tls_handshake_io,
 204                                    data,
 205                                    NULL,
 206                                    context);
 207     }
 208 }
 209
 210
 211 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
 212                                              GIOCondition condition,
 213                                              gpointer user_data)
 214 {
 215     QIOChannelTLSData *data = user_data;
 216     QIOTask *task = data->task;
 217     GMainContext *context = data->context;
 218     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(
 219         qio_task_get_source(task));
 220
 221     g_free(data);
 222     qio_channel_tls_handshake_task(tioc, task, context);
 223
 224     if (context) {
 225         g_main_context_unref(context);
 226     }
 227
 228     return FALSE;
 229 }
 230
 231 void qio_channel_tls_handshake(QIOChannelTLS *ioc,
 232                                QIOTaskFunc func,
 233                                gpointer opaque,
 234                                GDestroyNotify destroy,
 235                                GMainContext *context)
 236 {
 237     QIOTask *task;
 238
 239     task = qio_task_new(OBJECT(ioc),
 240                         func, opaque, destroy);
 241
 242     trace_qio_channel_tls_handshake_start(ioc);
 243     qio_channel_tls_handshake_task(ioc, task, context);
 244 }
 245
 246
 247 static void qio_channel_tls_init(Object *obj G_GNUC_UNUSED)
 248 {
 249 }
 250
 251
 252 static void qio_channel_tls_finalize(Object *obj)
 253 {
 254     QIOChannelTLS *ioc = QIO_CHANNEL_TLS(obj);
 255
 256     object_unref(OBJECT(ioc->master));
 257     qcrypto_tls_session_free(ioc->session);
 258 }
 259
 260
 261 static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
 262                                      const struct iovec *iov,
 263                                      size_t niov,
 264                                      int **fds,
 265                                      size_t *nfds,
 266                                      int flags,
 267                                      Error **errp)
 268 {
 269     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 270     size_t i;
 271     ssize_t got = 0;
 272
 273     for (i = 0 ; i < niov ; i++) {
 274         ssize_t ret = qcrypto_tls_session_read(tioc->session,
 275                                                iov[i].iov_base,
 276                                                iov[i].iov_len);
 277         if (ret < 0) {
 278             if (errno == EAGAIN) {
 279                 if (got) {
 280                     return got;
 281                 } else {
 282                     return QIO_CHANNEL_ERR_BLOCK;
 283                 }
 284             } else if (errno == ECONNABORTED &&
 285                        (qatomic_load_acquire(&tioc->shutdown) &
 286                         QIO_CHANNEL_SHUTDOWN_READ)) {
 287                 return 0;
 288             }
 289
 290             error_setg_errno(errp, errno,
 291                              "Cannot read from TLS channel");
 292             return -1;
 293         }
 294         got += ret;
 295         if (ret < iov[i].iov_len) {
 296             break;
 297         }
 298     }
 299     return got;
 300 }
 301
 302
 303 static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
 304                                       const struct iovec *iov,
 305                                       size_t niov,
 306                                       int *fds,
 307                                       size_t nfds,
 308                                       int flags,
 309                                       Error **errp)
 310 {
 311     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 312     size_t i;
 313     ssize_t done = 0;
 314
 315     for (i = 0 ; i < niov ; i++) {
 316         ssize_t ret = qcrypto_tls_session_write(tioc->session,
 317                                                 iov[i].iov_base,
 318                                                 iov[i].iov_len);
 319         if (ret <= 0) {
 320             if (errno == EAGAIN) {
 321                 if (done) {
 322                     return done;
 323                 } else {
 324                     return QIO_CHANNEL_ERR_BLOCK;
 325                 }
 326             }
 327
 328             error_setg_errno(errp, errno,
 329                              "Cannot write to TLS channel");
 330             return -1;
 331         }
 332         done += ret;
 333         if (ret < iov[i].iov_len) {
 334             break;
 335         }
 336     }
 337     return done;
 338 }
 339
 340 static int qio_channel_tls_set_blocking(QIOChannel *ioc,
 341                                         bool enabled,
 342                                         Error **errp)
 343 {
 344     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 345
 346     return qio_channel_set_blocking(tioc->master, enabled, errp);
 347 }
 348
 349 static void qio_channel_tls_set_delay(QIOChannel *ioc,
 350                                       bool enabled)
 351 {
 352     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 353
 354     qio_channel_set_delay(tioc->master, enabled);
 355 }
 356
 357 static void qio_channel_tls_set_cork(QIOChannel *ioc,
 358                                      bool enabled)
 359 {
 360     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 361
 362     qio_channel_set_cork(tioc->master, enabled);
 363 }
 364
 365 static int qio_channel_tls_shutdown(QIOChannel *ioc,
 366                                     QIOChannelShutdown how,
 367                                     Error **errp)
 368 {
 369     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 370
 371     qatomic_or(&tioc->shutdown, how);
 372
 373     return qio_channel_shutdown(tioc->master, how, errp);
 374 }
 375
 376 static int qio_channel_tls_close(QIOChannel *ioc,
 377                                  Error **errp)
 378 {
 379     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 380
 381     return qio_channel_close(tioc->master, errp);
 382 }
 383
 384 static void qio_channel_tls_set_aio_fd_handler(QIOChannel *ioc,
 385                                                AioContext *ctx,
 386                                                IOHandler *io_read,
 387                                                IOHandler *io_write,
 388                                                void *opaque)
 389 {
 390     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 391
 392     qio_channel_set_aio_fd_handler(tioc->master, ctx, io_read, io_write, opaque);
 393 }
 394
 395 typedef struct QIOChannelTLSSource QIOChannelTLSSource;
 396 struct QIOChannelTLSSource {
 397     GSource parent;
 398     QIOChannelTLS *tioc;
 399 };
 400
 401 static gboolean
 402 qio_channel_tls_source_check(GSource *source)
 403 {
 404     QIOChannelTLSSource *tsource = (QIOChannelTLSSource *)source;
 405
 406     return qcrypto_tls_session_check_pending(tsource->tioc->session) > 0;
 407 }
 408
 409 static gboolean
 410 qio_channel_tls_source_prepare(GSource *source, gint *timeout)
 411 {
 412     *timeout = -1;
 413     return qio_channel_tls_source_check(source);
 414 }
 415
 416 static gboolean
 417 qio_channel_tls_source_dispatch(GSource *source, GSourceFunc callback,
 418                                 gpointer user_data)
 419 {
 420     return G_SOURCE_CONTINUE;
 421 }
 422
 423 static void
 424 qio_channel_tls_source_finalize(GSource *source)
 425 {
 426     QIOChannelTLSSource *tsource = (QIOChannelTLSSource *)source;
 427
 428     object_unref(OBJECT(tsource->tioc));
 429 }
 430
 431 static GSourceFuncs qio_channel_tls_source_funcs = {
 432     qio_channel_tls_source_prepare,
 433     qio_channel_tls_source_check,
 434     qio_channel_tls_source_dispatch,
 435     qio_channel_tls_source_finalize
 436 };
 437
 438 static void
 439 qio_channel_tls_read_watch(QIOChannelTLS *tioc, GSource *source)
 440 {
 441     GSource *child;
 442     QIOChannelTLSSource *tlssource;
 443
 444     child = g_source_new(&qio_channel_tls_source_funcs,
 445                           sizeof(QIOChannelTLSSource));
 446     tlssource = (QIOChannelTLSSource *)child;
 447
 448     tlssource->tioc = tioc;
 449     object_ref(OBJECT(tioc));
 450
 451     g_source_add_child_source(source, child);
 452     g_source_unref(child);
 453 }
 454
 455 static GSource *qio_channel_tls_create_watch(QIOChannel *ioc,
 456                                              GIOCondition condition)
 457 {
 458     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 459     GSource *source = qio_channel_create_watch(tioc->master, condition);
 460
 461     if (condition & G_IO_IN) {
 462         qio_channel_tls_read_watch(tioc, source);
 463     }
 464
 465     return source;
 466 }
 467
 468 QCryptoTLSSession *
 469 qio_channel_tls_get_session(QIOChannelTLS *ioc)
 470 {
 471     return ioc->session;
 472 }
 473
 474 static void qio_channel_tls_class_init(ObjectClass *klass,
 475                                        void *class_data G_GNUC_UNUSED)
 476 {
 477     QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
 478
 479     ioc_klass->io_writev = qio_channel_tls_writev;
 480     ioc_klass->io_readv = qio_channel_tls_readv;
 481     ioc_klass->io_set_blocking = qio_channel_tls_set_blocking;
 482     ioc_klass->io_set_delay = qio_channel_tls_set_delay;
 483     ioc_klass->io_set_cork = qio_channel_tls_set_cork;
 484     ioc_klass->io_close = qio_channel_tls_close;
 485     ioc_klass->io_shutdown = qio_channel_tls_shutdown;
 486     ioc_klass->io_create_watch = qio_channel_tls_create_watch;
 487     ioc_klass->io_set_aio_fd_handler = qio_channel_tls_set_aio_fd_handler;
 488 }
 489
 490 static const TypeInfo qio_channel_tls_info = {
 491     .parent = TYPE_QIO_CHANNEL,
 492     .name = TYPE_QIO_CHANNEL_TLS,
 493     .instance_size = sizeof(QIOChannelTLS),
 494     .instance_init = qio_channel_tls_init,
 495     .instance_finalize = qio_channel_tls_finalize,
 496     .class_init = qio_channel_tls_class_init,
 497 };
 498
 499 static void qio_channel_tls_register_types(void)
 500 {
 501     type_register_static(&qio_channel_tls_info);
 502 }
 503
 504 type_init(qio_channel_tls_register_types);