2 * QEMU I/O channels TLS driver
4 * Copyright (c) 2015 Red Hat, Inc.
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "qemu/module.h"
24 #include "io/channel-tls.h"
26 #include "qemu/atomic.h"
29 static ssize_t
qio_channel_tls_write_handler(const char *buf
,
33 QIOChannelTLS
*tioc
= QIO_CHANNEL_TLS(opaque
);
36 ret
= qio_channel_write(tioc
->master
, buf
, len
, NULL
);
37 if (ret
== QIO_CHANNEL_ERR_BLOCK
) {
47 static ssize_t
qio_channel_tls_read_handler(char *buf
,
51 QIOChannelTLS
*tioc
= QIO_CHANNEL_TLS(opaque
);
54 ret
= qio_channel_read(tioc
->master
, buf
, len
, NULL
);
55 if (ret
== QIO_CHANNEL_ERR_BLOCK
) {
67 qio_channel_tls_new_server(QIOChannel
*master
,
68 QCryptoTLSCreds
*creds
,
74 ioc
= QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS
));
77 object_ref(OBJECT(master
));
79 ioc
->session
= qcrypto_tls_session_new(
83 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER
,
89 qcrypto_tls_session_set_callbacks(
91 qio_channel_tls_write_handler
,
92 qio_channel_tls_read_handler
,
95 trace_qio_channel_tls_new_server(ioc
, master
, creds
, aclname
);
99 object_unref(OBJECT(ioc
));
104 qio_channel_tls_new_client(QIOChannel
*master
,
105 QCryptoTLSCreds
*creds
,
106 const char *hostname
,
112 tioc
= QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS
));
113 ioc
= QIO_CHANNEL(tioc
);
115 tioc
->master
= master
;
116 if (qio_channel_has_feature(master
, QIO_CHANNEL_FEATURE_SHUTDOWN
)) {
117 qio_channel_set_feature(ioc
, QIO_CHANNEL_FEATURE_SHUTDOWN
);
119 object_ref(OBJECT(master
));
121 tioc
->session
= qcrypto_tls_session_new(
125 QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT
,
127 if (!tioc
->session
) {
131 qcrypto_tls_session_set_callbacks(
133 qio_channel_tls_write_handler
,
134 qio_channel_tls_read_handler
,
137 trace_qio_channel_tls_new_client(tioc
, master
, creds
, hostname
);
141 object_unref(OBJECT(tioc
));
145 struct QIOChannelTLSData
{
147 GMainContext
*context
;
149 typedef struct QIOChannelTLSData QIOChannelTLSData
;
151 static gboolean
qio_channel_tls_handshake_io(QIOChannel
*ioc
,
152 GIOCondition condition
,
155 static void qio_channel_tls_handshake_task(QIOChannelTLS
*ioc
,
157 GMainContext
*context
)
160 QCryptoTLSSessionHandshakeStatus status
;
162 if (qcrypto_tls_session_handshake(ioc
->session
, &err
) < 0) {
163 trace_qio_channel_tls_handshake_fail(ioc
);
164 qio_task_set_error(task
, err
);
165 qio_task_complete(task
);
169 status
= qcrypto_tls_session_get_handshake_status(ioc
->session
);
170 if (status
== QCRYPTO_TLS_HANDSHAKE_COMPLETE
) {
171 trace_qio_channel_tls_handshake_complete(ioc
);
172 if (qcrypto_tls_session_check_credentials(ioc
->session
,
174 trace_qio_channel_tls_credentials_deny(ioc
);
175 qio_task_set_error(task
, err
);
177 trace_qio_channel_tls_credentials_allow(ioc
);
179 qio_task_complete(task
);
181 GIOCondition condition
;
182 QIOChannelTLSData
*data
= g_new0(typeof(*data
), 1);
185 data
->context
= context
;
188 g_main_context_ref(context
);
191 if (status
== QCRYPTO_TLS_HANDSHAKE_SENDING
) {
192 condition
= G_IO_OUT
;
197 trace_qio_channel_tls_handshake_pending(ioc
, status
);
198 qio_channel_add_watch_full(ioc
->master
,
200 qio_channel_tls_handshake_io
,
208 static gboolean
qio_channel_tls_handshake_io(QIOChannel
*ioc
,
209 GIOCondition condition
,
212 QIOChannelTLSData
*data
= user_data
;
213 QIOTask
*task
= data
->task
;
214 GMainContext
*context
= data
->context
;
215 QIOChannelTLS
*tioc
= QIO_CHANNEL_TLS(
216 qio_task_get_source(task
));
219 qio_channel_tls_handshake_task(tioc
, task
, context
);
222 g_main_context_unref(context
);
228 void qio_channel_tls_handshake(QIOChannelTLS
*ioc
,
231 GDestroyNotify destroy
,
232 GMainContext
*context
)
236 task
= qio_task_new(OBJECT(ioc
),
237 func
, opaque
, destroy
);
239 trace_qio_channel_tls_handshake_start(ioc
);
240 qio_channel_tls_handshake_task(ioc
, task
, context
);
244 static void qio_channel_tls_init(Object
*obj G_GNUC_UNUSED
)
249 static void qio_channel_tls_finalize(Object
*obj
)
251 QIOChannelTLS
*ioc
= QIO_CHANNEL_TLS(obj
);
253 object_unref(OBJECT(ioc
->master
));
254 qcrypto_tls_session_free(ioc
->session
);
258 static ssize_t
qio_channel_tls_readv(QIOChannel
*ioc
,
259 const struct iovec
*iov
,
266 QIOChannelTLS
*tioc
= QIO_CHANNEL_TLS(ioc
);
270 for (i
= 0 ; i
< niov
; i
++) {
271 ssize_t ret
= qcrypto_tls_session_read(tioc
->session
,
275 if (errno
== EAGAIN
) {
279 return QIO_CHANNEL_ERR_BLOCK
;
281 } else if (errno
== ECONNABORTED
&&
282 (qatomic_load_acquire(&tioc
->shutdown
) &
283 QIO_CHANNEL_SHUTDOWN_READ
)) {
287 error_setg_errno(errp
, errno
,
288 "Cannot read from TLS channel");
292 if (ret
< iov
[i
].iov_len
) {
300 static ssize_t
qio_channel_tls_writev(QIOChannel
*ioc
,
301 const struct iovec
*iov
,
308 QIOChannelTLS
*tioc
= QIO_CHANNEL_TLS(ioc
);
312 for (i
= 0 ; i
< niov
; i
++) {
313 ssize_t ret
= qcrypto_tls_session_write(tioc
->session
,
317 if (errno
== EAGAIN
) {
321 return QIO_CHANNEL_ERR_BLOCK
;
325 error_setg_errno(errp
, errno
,
326 "Cannot write to TLS channel");
330 if (ret
< iov
[i
].iov_len
) {
337 static int qio_channel_tls_set_blocking(QIOChannel
*ioc
,
341 QIOChannelTLS
*tioc
= QIO_CHANNEL_TLS(ioc
);
343 return qio_channel_set_blocking(tioc
->master
, enabled
, errp
);
346 static void qio_channel_tls_set_delay(QIOChannel
*ioc
,
349 QIOChannelTLS
*tioc
= QIO_CHANNEL_TLS(ioc
);
351 qio_channel_set_delay(tioc
->master
, enabled
);
354 static void qio_channel_tls_set_cork(QIOChannel
*ioc
,
357 QIOChannelTLS
*tioc
= QIO_CHANNEL_TLS(ioc
);
359 qio_channel_set_cork(tioc
->master
, enabled
);
362 static int qio_channel_tls_shutdown(QIOChannel
*ioc
,
363 QIOChannelShutdown how
,
366 QIOChannelTLS
*tioc
= QIO_CHANNEL_TLS(ioc
);
368 qatomic_or(&tioc
->shutdown
, how
);
370 return qio_channel_shutdown(tioc
->master
, how
, errp
);
373 static int qio_channel_tls_close(QIOChannel
*ioc
,
376 QIOChannelTLS
*tioc
= QIO_CHANNEL_TLS(ioc
);
378 return qio_channel_close(tioc
->master
, errp
);
381 static void qio_channel_tls_set_aio_fd_handler(QIOChannel
*ioc
,
387 QIOChannelTLS
*tioc
= QIO_CHANNEL_TLS(ioc
);
389 qio_channel_set_aio_fd_handler(tioc
->master
, ctx
, io_read
, io_write
, opaque
);
392 typedef struct QIOChannelTLSSource QIOChannelTLSSource
;
393 struct QIOChannelTLSSource
{
399 qio_channel_tls_source_check(GSource
*source
)
401 QIOChannelTLSSource
*tsource
= (QIOChannelTLSSource
*)source
;
403 return qcrypto_tls_session_check_pending(tsource
->tioc
->session
) > 0;
407 qio_channel_tls_source_prepare(GSource
*source
, gint
*timeout
)
410 return qio_channel_tls_source_check(source
);
414 qio_channel_tls_source_dispatch(GSource
*source
, GSourceFunc callback
,
417 return G_SOURCE_CONTINUE
;
421 qio_channel_tls_source_finalize(GSource
*source
)
423 QIOChannelTLSSource
*tsource
= (QIOChannelTLSSource
*)source
;
425 object_unref(OBJECT(tsource
->tioc
));
428 static GSourceFuncs qio_channel_tls_source_funcs
= {
429 qio_channel_tls_source_prepare
,
430 qio_channel_tls_source_check
,
431 qio_channel_tls_source_dispatch
,
432 qio_channel_tls_source_finalize
436 qio_channel_tls_read_watch(QIOChannelTLS
*tioc
, GSource
*source
)
439 QIOChannelTLSSource
*tlssource
;
441 child
= g_source_new(&qio_channel_tls_source_funcs
,
442 sizeof(QIOChannelTLSSource
));
443 tlssource
= (QIOChannelTLSSource
*)child
;
445 tlssource
->tioc
= tioc
;
446 object_ref(OBJECT(tioc
));
448 g_source_add_child_source(source
, child
);
451 static GSource
*qio_channel_tls_create_watch(QIOChannel
*ioc
,
452 GIOCondition condition
)
454 QIOChannelTLS
*tioc
= QIO_CHANNEL_TLS(ioc
);
455 GSource
*source
= qio_channel_create_watch(tioc
->master
, condition
);
457 if (condition
& G_IO_IN
) {
458 qio_channel_tls_read_watch(tioc
, source
);
465 qio_channel_tls_get_session(QIOChannelTLS
*ioc
)
470 static void qio_channel_tls_class_init(ObjectClass
*klass
,
471 void *class_data G_GNUC_UNUSED
)
473 QIOChannelClass
*ioc_klass
= QIO_CHANNEL_CLASS(klass
);
475 ioc_klass
->io_writev
= qio_channel_tls_writev
;
476 ioc_klass
->io_readv
= qio_channel_tls_readv
;
477 ioc_klass
->io_set_blocking
= qio_channel_tls_set_blocking
;
478 ioc_klass
->io_set_delay
= qio_channel_tls_set_delay
;
479 ioc_klass
->io_set_cork
= qio_channel_tls_set_cork
;
480 ioc_klass
->io_close
= qio_channel_tls_close
;
481 ioc_klass
->io_shutdown
= qio_channel_tls_shutdown
;
482 ioc_klass
->io_create_watch
= qio_channel_tls_create_watch
;
483 ioc_klass
->io_set_aio_fd_handler
= qio_channel_tls_set_aio_fd_handler
;
486 static const TypeInfo qio_channel_tls_info
= {
487 .parent
= TYPE_QIO_CHANNEL
,
488 .name
= TYPE_QIO_CHANNEL_TLS
,
489 .instance_size
= sizeof(QIOChannelTLS
),
490 .instance_init
= qio_channel_tls_init
,
491 .instance_finalize
= qio_channel_tls_finalize
,
492 .class_init
= qio_channel_tls_class_init
,
495 static void qio_channel_tls_register_types(void)
497 type_register_static(&qio_channel_tls_info
);
500 type_init(qio_channel_tls_register_types
);