io/channel-tls.c

   1 /*
   2  * QEMU I/O channels TLS driver
   3  *
   4  * Copyright (c) 2015 Red Hat, Inc.
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "qapi/error.h"
  23 #include "qemu/module.h"
  24 #include "io/channel-tls.h"
  25 #include "trace.h"
  26 #include "qemu/atomic.h"
  27
  28
  29 static ssize_t qio_channel_tls_write_handler(const char *buf,
  30                                              size_t len,
  31                                              void *opaque)
  32 {
  33     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
  34     ssize_t ret;
  35
  36     ret = qio_channel_write(tioc->master, buf, len, NULL);
  37     if (ret == QIO_CHANNEL_ERR_BLOCK) {
  38         errno = EAGAIN;
  39         return -1;
  40     } else if (ret < 0) {
  41         errno = EIO;
  42         return -1;
  43     }
  44     return ret;
  45 }
  46
  47 static ssize_t qio_channel_tls_read_handler(char *buf,
  48                                             size_t len,
  49                                             void *opaque)
  50 {
  51     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
  52     ssize_t ret;
  53
  54     ret = qio_channel_read(tioc->master, buf, len, NULL);
  55     if (ret == QIO_CHANNEL_ERR_BLOCK) {
  56         errno = EAGAIN;
  57         return -1;
  58     } else if (ret < 0) {
  59         errno = EIO;
  60         return -1;
  61     }
  62     return ret;
  63 }
  64
  65
  66 QIOChannelTLS *
  67 qio_channel_tls_new_server(QIOChannel *master,
  68                            QCryptoTLSCreds *creds,
  69                            const char *aclname,
  70                            Error **errp)
  71 {
  72     QIOChannelTLS *tioc;
  73     QIOChannel *ioc;
  74
  75     tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
  76     ioc = QIO_CHANNEL(tioc);
  77
  78     tioc->master = master;
  79     ioc->follow_coroutine_ctx = master->follow_coroutine_ctx;
  80     if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
  81         qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
  82     }
  83     object_ref(OBJECT(master));
  84
  85     tioc->session = qcrypto_tls_session_new(
  86         creds,
  87         NULL,
  88         aclname,
  89         QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
  90         errp);
  91     if (!tioc->session) {
  92         goto error;
  93     }
  94
  95     qcrypto_tls_session_set_callbacks(
  96         tioc->session,
  97         qio_channel_tls_write_handler,
  98         qio_channel_tls_read_handler,
  99         tioc);
 100
 101     trace_qio_channel_tls_new_server(tioc, master, creds, aclname);
 102     return tioc;
 103
 104  error:
 105     object_unref(OBJECT(tioc));
 106     return NULL;
 107 }
 108
 109 QIOChannelTLS *
 110 qio_channel_tls_new_client(QIOChannel *master,
 111                            QCryptoTLSCreds *creds,
 112                            const char *hostname,
 113                            Error **errp)
 114 {
 115     QIOChannelTLS *tioc;
 116     QIOChannel *ioc;
 117
 118     tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
 119     ioc = QIO_CHANNEL(tioc);
 120
 121     tioc->master = master;
 122     ioc->follow_coroutine_ctx = master->follow_coroutine_ctx;
 123     if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
 124         qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
 125     }
 126     object_ref(OBJECT(master));
 127
 128     tioc->session = qcrypto_tls_session_new(
 129         creds,
 130         hostname,
 131         NULL,
 132         QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT,
 133         errp);
 134     if (!tioc->session) {
 135         goto error;
 136     }
 137
 138     qcrypto_tls_session_set_callbacks(
 139         tioc->session,
 140         qio_channel_tls_write_handler,
 141         qio_channel_tls_read_handler,
 142         tioc);
 143
 144     trace_qio_channel_tls_new_client(tioc, master, creds, hostname);
 145     return tioc;
 146
 147  error:
 148     object_unref(OBJECT(tioc));
 149     return NULL;
 150 }
 151
 152 struct QIOChannelTLSData {
 153     QIOTask *task;
 154     GMainContext *context;
 155 };
 156 typedef struct QIOChannelTLSData QIOChannelTLSData;
 157
 158 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
 159                                              GIOCondition condition,
 160                                              gpointer user_data);
 161
 162 static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
 163                                            QIOTask *task,
 164                                            GMainContext *context)
 165 {
 166     Error *err = NULL;
 167     QCryptoTLSSessionHandshakeStatus status;
 168
 169     if (qcrypto_tls_session_handshake(ioc->session, &err) < 0) {
 170         trace_qio_channel_tls_handshake_fail(ioc);
 171         qio_task_set_error(task, err);
 172         qio_task_complete(task);
 173         return;
 174     }
 175
 176     status = qcrypto_tls_session_get_handshake_status(ioc->session);
 177     if (status == QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
 178         trace_qio_channel_tls_handshake_complete(ioc);
 179         if (qcrypto_tls_session_check_credentials(ioc->session,
 180                                                   &err) < 0) {
 181             trace_qio_channel_tls_credentials_deny(ioc);
 182             qio_task_set_error(task, err);
 183         } else {
 184             trace_qio_channel_tls_credentials_allow(ioc);
 185         }
 186         qio_task_complete(task);
 187     } else {
 188         GIOCondition condition;
 189         QIOChannelTLSData *data = g_new0(typeof(*data), 1);
 190
 191         data->task = task;
 192         data->context = context;
 193
 194         if (context) {
 195             g_main_context_ref(context);
 196         }
 197
 198         if (status == QCRYPTO_TLS_HANDSHAKE_SENDING) {
 199             condition = G_IO_OUT;
 200         } else {
 201             condition = G_IO_IN;
 202         }
 203
 204         trace_qio_channel_tls_handshake_pending(ioc, status);
 205         ioc->hs_ioc_tag =
 206             qio_channel_add_watch_full(ioc->master,
 207                                        condition,
 208                                        qio_channel_tls_handshake_io,
 209                                        data,
 210                                        NULL,
 211                                        context);
 212     }
 213 }
 214
 215
 216 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
 217                                              GIOCondition condition,
 218                                              gpointer user_data)
 219 {
 220     QIOChannelTLSData *data = user_data;
 221     QIOTask *task = data->task;
 222     GMainContext *context = data->context;
 223     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(
 224         qio_task_get_source(task));
 225
 226     tioc->hs_ioc_tag = 0;
 227     g_free(data);
 228     qio_channel_tls_handshake_task(tioc, task, context);
 229
 230     if (context) {
 231         g_main_context_unref(context);
 232     }
 233
 234     return FALSE;
 235 }
 236
 237 void qio_channel_tls_handshake(QIOChannelTLS *ioc,
 238                                QIOTaskFunc func,
 239                                gpointer opaque,
 240                                GDestroyNotify destroy,
 241                                GMainContext *context)
 242 {
 243     QIOTask *task;
 244
 245     task = qio_task_new(OBJECT(ioc),
 246                         func, opaque, destroy);
 247
 248     trace_qio_channel_tls_handshake_start(ioc);
 249     qio_channel_tls_handshake_task(ioc, task, context);
 250 }
 251
 252
 253 static void qio_channel_tls_init(Object *obj G_GNUC_UNUSED)
 254 {
 255 }
 256
 257
 258 static void qio_channel_tls_finalize(Object *obj)
 259 {
 260     QIOChannelTLS *ioc = QIO_CHANNEL_TLS(obj);
 261
 262     object_unref(OBJECT(ioc->master));
 263     qcrypto_tls_session_free(ioc->session);
 264 }
 265
 266
 267 static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
 268                                      const struct iovec *iov,
 269                                      size_t niov,
 270                                      int **fds,
 271                                      size_t *nfds,
 272                                      int flags,
 273                                      Error **errp)
 274 {
 275     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 276     size_t i;
 277     ssize_t got = 0;
 278
 279     for (i = 0 ; i < niov ; i++) {
 280         ssize_t ret = qcrypto_tls_session_read(tioc->session,
 281                                                iov[i].iov_base,
 282                                                iov[i].iov_len);
 283         if (ret < 0) {
 284             if (errno == EAGAIN) {
 285                 if (got) {
 286                     return got;
 287                 } else {
 288                     return QIO_CHANNEL_ERR_BLOCK;
 289                 }
 290             } else if (errno == ECONNABORTED &&
 291                        (qatomic_load_acquire(&tioc->shutdown) &
 292                         QIO_CHANNEL_SHUTDOWN_READ)) {
 293                 return 0;
 294             }
 295
 296             error_setg_errno(errp, errno,
 297                              "Cannot read from TLS channel");
 298             return -1;
 299         }
 300         got += ret;
 301         if (ret < iov[i].iov_len) {
 302             break;
 303         }
 304     }
 305     return got;
 306 }
 307
 308
 309 static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
 310                                       const struct iovec *iov,
 311                                       size_t niov,
 312                                       int *fds,
 313                                       size_t nfds,
 314                                       int flags,
 315                                       Error **errp)
 316 {
 317     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 318     size_t i;
 319     ssize_t done = 0;
 320
 321     for (i = 0 ; i < niov ; i++) {
 322         ssize_t ret = qcrypto_tls_session_write(tioc->session,
 323                                                 iov[i].iov_base,
 324                                                 iov[i].iov_len);
 325         if (ret <= 0) {
 326             if (errno == EAGAIN) {
 327                 if (done) {
 328                     return done;
 329                 } else {
 330                     return QIO_CHANNEL_ERR_BLOCK;
 331                 }
 332             }
 333
 334             error_setg_errno(errp, errno,
 335                              "Cannot write to TLS channel");
 336             return -1;
 337         }
 338         done += ret;
 339         if (ret < iov[i].iov_len) {
 340             break;
 341         }
 342     }
 343     return done;
 344 }
 345
 346 static int qio_channel_tls_set_blocking(QIOChannel *ioc,
 347                                         bool enabled,
 348                                         Error **errp)
 349 {
 350     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 351
 352     return qio_channel_set_blocking(tioc->master, enabled, errp);
 353 }
 354
 355 static void qio_channel_tls_set_delay(QIOChannel *ioc,
 356                                       bool enabled)
 357 {
 358     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 359
 360     qio_channel_set_delay(tioc->master, enabled);
 361 }
 362
 363 static void qio_channel_tls_set_cork(QIOChannel *ioc,
 364                                      bool enabled)
 365 {
 366     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 367
 368     qio_channel_set_cork(tioc->master, enabled);
 369 }
 370
 371 static int qio_channel_tls_shutdown(QIOChannel *ioc,
 372                                     QIOChannelShutdown how,
 373                                     Error **errp)
 374 {
 375     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 376
 377     qatomic_or(&tioc->shutdown, how);
 378
 379     return qio_channel_shutdown(tioc->master, how, errp);
 380 }
 381
 382 static int qio_channel_tls_close(QIOChannel *ioc,
 383                                  Error **errp)
 384 {
 385     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 386
 387     if (tioc->hs_ioc_tag) {
 388         trace_qio_channel_tls_handshake_cancel(ioc);
 389         g_clear_handle_id(&tioc->hs_ioc_tag, g_source_remove);
 390     }
 391
 392     return qio_channel_close(tioc->master, errp);
 393 }
 394
 395 static void qio_channel_tls_set_aio_fd_handler(QIOChannel *ioc,
 396                                                AioContext *read_ctx,
 397                                                IOHandler *io_read,
 398                                                AioContext *write_ctx,
 399                                                IOHandler *io_write,
 400                                                void *opaque)
 401 {
 402     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 403
 404     qio_channel_set_aio_fd_handler(tioc->master, read_ctx, io_read,
 405             write_ctx, io_write, opaque);
 406 }
 407
 408 typedef struct QIOChannelTLSSource QIOChannelTLSSource;
 409 struct QIOChannelTLSSource {
 410     GSource parent;
 411     QIOChannelTLS *tioc;
 412 };
 413
 414 static gboolean
 415 qio_channel_tls_source_check(GSource *source)
 416 {
 417     QIOChannelTLSSource *tsource = (QIOChannelTLSSource *)source;
 418
 419     return qcrypto_tls_session_check_pending(tsource->tioc->session) > 0;
 420 }
 421
 422 static gboolean
 423 qio_channel_tls_source_prepare(GSource *source, gint *timeout)
 424 {
 425     *timeout = -1;
 426     return qio_channel_tls_source_check(source);
 427 }
 428
 429 static gboolean
 430 qio_channel_tls_source_dispatch(GSource *source, GSourceFunc callback,
 431                                 gpointer user_data)
 432 {
 433     return G_SOURCE_CONTINUE;
 434 }
 435
 436 static void
 437 qio_channel_tls_source_finalize(GSource *source)
 438 {
 439     QIOChannelTLSSource *tsource = (QIOChannelTLSSource *)source;
 440
 441     object_unref(OBJECT(tsource->tioc));
 442 }
 443
 444 static GSourceFuncs qio_channel_tls_source_funcs = {
 445     qio_channel_tls_source_prepare,
 446     qio_channel_tls_source_check,
 447     qio_channel_tls_source_dispatch,
 448     qio_channel_tls_source_finalize
 449 };
 450
 451 static void
 452 qio_channel_tls_read_watch(QIOChannelTLS *tioc, GSource *source)
 453 {
 454     GSource *child;
 455     QIOChannelTLSSource *tlssource;
 456
 457     child = g_source_new(&qio_channel_tls_source_funcs,
 458                           sizeof(QIOChannelTLSSource));
 459     tlssource = (QIOChannelTLSSource *)child;
 460
 461     tlssource->tioc = tioc;
 462     object_ref(OBJECT(tioc));
 463
 464     g_source_add_child_source(source, child);
 465     g_source_unref(child);
 466 }
 467
 468 static GSource *qio_channel_tls_create_watch(QIOChannel *ioc,
 469                                              GIOCondition condition)
 470 {
 471     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 472     GSource *source = qio_channel_create_watch(tioc->master, condition);
 473
 474     if (condition & G_IO_IN) {
 475         qio_channel_tls_read_watch(tioc, source);
 476     }
 477
 478     return source;
 479 }
 480
 481 QCryptoTLSSession *
 482 qio_channel_tls_get_session(QIOChannelTLS *ioc)
 483 {
 484     return ioc->session;
 485 }
 486
 487 static void qio_channel_tls_class_init(ObjectClass *klass,
 488                                        void *class_data G_GNUC_UNUSED)
 489 {
 490     QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
 491
 492     ioc_klass->io_writev = qio_channel_tls_writev;
 493     ioc_klass->io_readv = qio_channel_tls_readv;
 494     ioc_klass->io_set_blocking = qio_channel_tls_set_blocking;
 495     ioc_klass->io_set_delay = qio_channel_tls_set_delay;
 496     ioc_klass->io_set_cork = qio_channel_tls_set_cork;
 497     ioc_klass->io_close = qio_channel_tls_close;
 498     ioc_klass->io_shutdown = qio_channel_tls_shutdown;
 499     ioc_klass->io_create_watch = qio_channel_tls_create_watch;
 500     ioc_klass->io_set_aio_fd_handler = qio_channel_tls_set_aio_fd_handler;
 501 }
 502
 503 static const TypeInfo qio_channel_tls_info = {
 504     .parent = TYPE_QIO_CHANNEL,
 505     .name = TYPE_QIO_CHANNEL_TLS,
 506     .instance_size = sizeof(QIOChannelTLS),
 507     .instance_init = qio_channel_tls_init,
 508     .instance_finalize = qio_channel_tls_finalize,
 509     .class_init = qio_channel_tls_class_init,
 510 };
 511
 512 static void qio_channel_tls_register_types(void)
 513 {
 514     type_register_static(&qio_channel_tls_info);
 515 }
 516
 517 type_init(qio_channel_tls_register_types);