xref: /qemu/io/channel-tls.c (revision 513823e7521a09ed7ad1e32e6454bac3b2cbf52d) 
1 /*
2  * QEMU I/O channels TLS driver
3  *
4  * Copyright (c) 2015 Red Hat, Inc.
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18  *
19  */
20 
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "qemu/module.h"
24 #include "io/channel-tls.h"
25 #include "trace.h"
26 #include "qemu/atomic.h"
27 
28 
29 static ssize_t qio_channel_tls_write_handler(const char *buf,
30                                              size_t len,
31                                              void *opaque,
32                                              Error **errp)
33 {
34     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
35     ssize_t ret;
36 
37     ret = qio_channel_write(tioc->master, buf, len, errp);
38     if (ret == QIO_CHANNEL_ERR_BLOCK) {
39         return QCRYPTO_TLS_SESSION_ERR_BLOCK;
40     } else if (ret < 0) {
41         return -1;
42     }
43     return ret;
44 }
45 
46 static ssize_t qio_channel_tls_read_handler(char *buf,
47                                             size_t len,
48                                             void *opaque,
49                                             Error **errp)
50 {
51     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
52     ssize_t ret;
53 
54     ret = qio_channel_read(tioc->master, buf, len, errp);
55     if (ret == QIO_CHANNEL_ERR_BLOCK) {
56         return QCRYPTO_TLS_SESSION_ERR_BLOCK;
57     } else if (ret < 0) {
58         return -1;
59     }
60     return ret;
61 }
62 
63 
64 QIOChannelTLS *
65 qio_channel_tls_new_server(QIOChannel *master,
66                            QCryptoTLSCreds *creds,
67                            const char *aclname,
68                            Error **errp)
69 {
70     QIOChannelTLS *tioc;
71     QIOChannel *ioc;
72 
73     tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
74     ioc = QIO_CHANNEL(tioc);
75 
76     tioc->master = master;
77     ioc->follow_coroutine_ctx = master->follow_coroutine_ctx;
78     if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
79         qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
80     }
81     object_ref(OBJECT(master));
82 
83     tioc->session = qcrypto_tls_session_new(
84         creds,
85         NULL,
86         aclname,
87         QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
88         errp);
89     if (!tioc->session) {
90         goto error;
91     }
92 
93     qcrypto_tls_session_set_callbacks(
94         tioc->session,
95         qio_channel_tls_write_handler,
96         qio_channel_tls_read_handler,
97         tioc);
98 
99     trace_qio_channel_tls_new_server(tioc, master, creds, aclname);
100     return tioc;
101 
102  error:
103     object_unref(OBJECT(tioc));
104     return NULL;
105 }
106 
107 QIOChannelTLS *
108 qio_channel_tls_new_client(QIOChannel *master,
109                            QCryptoTLSCreds *creds,
110                            const char *hostname,
111                            Error **errp)
112 {
113     QIOChannelTLS *tioc;
114     QIOChannel *ioc;
115 
116     tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
117     ioc = QIO_CHANNEL(tioc);
118 
119     tioc->master = master;
120     ioc->follow_coroutine_ctx = master->follow_coroutine_ctx;
121     if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
122         qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
123     }
124     object_ref(OBJECT(master));
125 
126     tioc->session = qcrypto_tls_session_new(
127         creds,
128         hostname,
129         NULL,
130         QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT,
131         errp);
132     if (!tioc->session) {
133         goto error;
134     }
135 
136     qcrypto_tls_session_set_callbacks(
137         tioc->session,
138         qio_channel_tls_write_handler,
139         qio_channel_tls_read_handler,
140         tioc);
141 
142     trace_qio_channel_tls_new_client(tioc, master, creds, hostname);
143     return tioc;
144 
145  error:
146     object_unref(OBJECT(tioc));
147     return NULL;
148 }
149 
150 struct QIOChannelTLSData {
151     QIOTask *task;
152     GMainContext *context;
153 };
154 typedef struct QIOChannelTLSData QIOChannelTLSData;
155 
156 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
157                                              GIOCondition condition,
158                                              gpointer user_data);
159 
160 static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
161                                            QIOTask *task,
162                                            GMainContext *context)
163 {
164     Error *err = NULL;
165     int status;
166 
167     status = qcrypto_tls_session_handshake(ioc->session, &err);
168 
169     if (status < 0) {
170         trace_qio_channel_tls_handshake_fail(ioc);
171         qio_task_set_error(task, err);
172         qio_task_complete(task);
173         return;
174     }
175 
176     if (status == QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
177         trace_qio_channel_tls_handshake_complete(ioc);
178         if (qcrypto_tls_session_check_credentials(ioc->session,
179                                                   &err) < 0) {
180             trace_qio_channel_tls_credentials_deny(ioc);
181             qio_task_set_error(task, err);
182         } else {
183             trace_qio_channel_tls_credentials_allow(ioc);
184         }
185         qio_task_complete(task);
186     } else {
187         GIOCondition condition;
188         QIOChannelTLSData *data = g_new0(typeof(*data), 1);
189 
190         data->task = task;
191         data->context = context;
192 
193         if (context) {
194             g_main_context_ref(context);
195         }
196 
197         if (status == QCRYPTO_TLS_HANDSHAKE_SENDING) {
198             condition = G_IO_OUT;
199         } else {
200             condition = G_IO_IN;
201         }
202 
203         trace_qio_channel_tls_handshake_pending(ioc, status);
204         ioc->hs_ioc_tag =
205             qio_channel_add_watch_full(ioc->master,
206                                        condition,
207                                        qio_channel_tls_handshake_io,
208                                        data,
209                                        NULL,
210                                        context);
211     }
212 }
213 
214 
215 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
216                                              GIOCondition condition,
217                                              gpointer user_data)
218 {
219     QIOChannelTLSData *data = user_data;
220     QIOTask *task = data->task;
221     GMainContext *context = data->context;
222     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(
223         qio_task_get_source(task));
224 
225     tioc->hs_ioc_tag = 0;
226     g_free(data);
227     qio_channel_tls_handshake_task(tioc, task, context);
228 
229     if (context) {
230         g_main_context_unref(context);
231     }
232 
233     return FALSE;
234 }
235 
236 void qio_channel_tls_handshake(QIOChannelTLS *ioc,
237                                QIOTaskFunc func,
238                                gpointer opaque,
239                                GDestroyNotify destroy,
240                                GMainContext *context)
241 {
242     QIOTask *task;
243 
244     task = qio_task_new(OBJECT(ioc),
245                         func, opaque, destroy);
246 
247     trace_qio_channel_tls_handshake_start(ioc);
248     qio_channel_tls_handshake_task(ioc, task, context);
249 }
250 
251 static gboolean qio_channel_tls_bye_io(QIOChannel *ioc, GIOCondition condition,
252                                        gpointer user_data);
253 
254 static void qio_channel_tls_bye_task(QIOChannelTLS *ioc, QIOTask *task,
255                                      GMainContext *context)
256 {
257     GIOCondition condition;
258     QIOChannelTLSData *data;
259     int status;
260     Error *err = NULL;
261 
262     status = qcrypto_tls_session_bye(ioc->session, &err);
263 
264     if (status < 0) {
265         trace_qio_channel_tls_bye_fail(ioc);
266         qio_task_set_error(task, err);
267         qio_task_complete(task);
268         return;
269     }
270 
271     if (status == QCRYPTO_TLS_BYE_COMPLETE) {
272         qio_task_complete(task);
273         return;
274     }
275 
276     data = g_new0(typeof(*data), 1);
277     data->task = task;
278     data->context = context;
279 
280     if (context) {
281         g_main_context_ref(context);
282     }
283 
284     if (status == QCRYPTO_TLS_BYE_SENDING) {
285         condition = G_IO_OUT;
286     } else {
287         condition = G_IO_IN;
288     }
289 
290     trace_qio_channel_tls_bye_pending(ioc, status);
291     ioc->bye_ioc_tag = qio_channel_add_watch_full(ioc->master, condition,
292                                                   qio_channel_tls_bye_io,
293                                                   data, NULL, context);
294 }
295 
296 
297 static gboolean qio_channel_tls_bye_io(QIOChannel *ioc, GIOCondition condition,
298                                        gpointer user_data)
299 {
300     QIOChannelTLSData *data = user_data;
301     QIOTask *task = data->task;
302     GMainContext *context = data->context;
303     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(qio_task_get_source(task));
304 
305     tioc->bye_ioc_tag = 0;
306     g_free(data);
307     qio_channel_tls_bye_task(tioc, task, context);
308 
309     if (context) {
310         g_main_context_unref(context);
311     }
312 
313     return FALSE;
314 }
315 
316 static void propagate_error(QIOTask *task, gpointer opaque)
317 {
318     qio_task_propagate_error(task, opaque);
319 }
320 
321 void qio_channel_tls_bye(QIOChannelTLS *ioc, Error **errp)
322 {
323     QIOTask *task;
324 
325     task = qio_task_new(OBJECT(ioc), propagate_error, errp, NULL);
326 
327     trace_qio_channel_tls_bye_start(ioc);
328     qio_channel_tls_bye_task(ioc, task, NULL);
329 }
330 
331 static void qio_channel_tls_init(Object *obj G_GNUC_UNUSED)
332 {
333 }
334 
335 
336 static void qio_channel_tls_finalize(Object *obj)
337 {
338     QIOChannelTLS *ioc = QIO_CHANNEL_TLS(obj);
339 
340     object_unref(OBJECT(ioc->master));
341     qcrypto_tls_session_free(ioc->session);
342 }
343 
344 
345 static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
346                                      const struct iovec *iov,
347                                      size_t niov,
348                                      int **fds,
349                                      size_t *nfds,
350                                      int flags,
351                                      Error **errp)
352 {
353     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
354     size_t i;
355     ssize_t got = 0;
356 
357     for (i = 0 ; i < niov ; i++) {
358         ssize_t ret = qcrypto_tls_session_read(
359             tioc->session,
360             iov[i].iov_base,
361             iov[i].iov_len,
362             flags & QIO_CHANNEL_READ_FLAG_RELAXED_EOF ||
363             qatomic_load_acquire(&tioc->shutdown) & QIO_CHANNEL_SHUTDOWN_READ,
364             errp);
365         if (ret == QCRYPTO_TLS_SESSION_ERR_BLOCK) {
366             if (got) {
367                 return got;
368             } else {
369                 return QIO_CHANNEL_ERR_BLOCK;
370             }
371         } else if (ret < 0) {
372             return -1;
373         }
374         got += ret;
375         if (ret < iov[i].iov_len) {
376             break;
377         }
378     }
379     return got;
380 }
381 
382 
383 static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
384                                       const struct iovec *iov,
385                                       size_t niov,
386                                       int *fds,
387                                       size_t nfds,
388                                       int flags,
389                                       Error **errp)
390 {
391     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
392     size_t i;
393     ssize_t done = 0;
394 
395     for (i = 0 ; i < niov ; i++) {
396         ssize_t ret = qcrypto_tls_session_write(tioc->session,
397                                                 iov[i].iov_base,
398                                                 iov[i].iov_len,
399                                                 errp);
400         if (ret == QCRYPTO_TLS_SESSION_ERR_BLOCK) {
401             if (done) {
402                 return done;
403             } else {
404                 return QIO_CHANNEL_ERR_BLOCK;
405             }
406         } else if (ret < 0) {
407             return -1;
408         }
409         done += ret;
410         if (ret < iov[i].iov_len) {
411             break;
412         }
413     }
414     return done;
415 }
416 
417 static int qio_channel_tls_set_blocking(QIOChannel *ioc,
418                                         bool enabled,
419                                         Error **errp)
420 {
421     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
422 
423     return qio_channel_set_blocking(tioc->master, enabled, errp);
424 }
425 
426 static void qio_channel_tls_set_delay(QIOChannel *ioc,
427                                       bool enabled)
428 {
429     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
430 
431     qio_channel_set_delay(tioc->master, enabled);
432 }
433 
434 static void qio_channel_tls_set_cork(QIOChannel *ioc,
435                                      bool enabled)
436 {
437     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
438 
439     qio_channel_set_cork(tioc->master, enabled);
440 }
441 
442 static int qio_channel_tls_shutdown(QIOChannel *ioc,
443                                     QIOChannelShutdown how,
444                                     Error **errp)
445 {
446     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
447 
448     qatomic_or(&tioc->shutdown, how);
449 
450     return qio_channel_shutdown(tioc->master, how, errp);
451 }
452 
453 static int qio_channel_tls_close(QIOChannel *ioc,
454                                  Error **errp)
455 {
456     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
457 
458     if (tioc->hs_ioc_tag) {
459         trace_qio_channel_tls_handshake_cancel(ioc);
460         g_clear_handle_id(&tioc->hs_ioc_tag, g_source_remove);
461     }
462 
463     if (tioc->bye_ioc_tag) {
464         trace_qio_channel_tls_bye_cancel(ioc);
465         g_clear_handle_id(&tioc->bye_ioc_tag, g_source_remove);
466     }
467 
468     return qio_channel_close(tioc->master, errp);
469 }
470 
471 static void qio_channel_tls_set_aio_fd_handler(QIOChannel *ioc,
472                                                AioContext *read_ctx,
473                                                IOHandler *io_read,
474                                                AioContext *write_ctx,
475                                                IOHandler *io_write,
476                                                void *opaque)
477 {
478     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
479 
480     qio_channel_set_aio_fd_handler(tioc->master, read_ctx, io_read,
481             write_ctx, io_write, opaque);
482 }
483 
484 typedef struct QIOChannelTLSSource QIOChannelTLSSource;
485 struct QIOChannelTLSSource {
486     GSource parent;
487     QIOChannelTLS *tioc;
488 };
489 
490 static gboolean
491 qio_channel_tls_source_check(GSource *source)
492 {
493     QIOChannelTLSSource *tsource = (QIOChannelTLSSource *)source;
494 
495     return qcrypto_tls_session_check_pending(tsource->tioc->session) > 0;
496 }
497 
498 static gboolean
499 qio_channel_tls_source_prepare(GSource *source, gint *timeout)
500 {
501     *timeout = -1;
502     return qio_channel_tls_source_check(source);
503 }
504 
505 static gboolean
506 qio_channel_tls_source_dispatch(GSource *source, GSourceFunc callback,
507                                 gpointer user_data)
508 {
509     return G_SOURCE_CONTINUE;
510 }
511 
512 static void
513 qio_channel_tls_source_finalize(GSource *source)
514 {
515     QIOChannelTLSSource *tsource = (QIOChannelTLSSource *)source;
516 
517     object_unref(OBJECT(tsource->tioc));
518 }
519 
520 static GSourceFuncs qio_channel_tls_source_funcs = {
521     qio_channel_tls_source_prepare,
522     qio_channel_tls_source_check,
523     qio_channel_tls_source_dispatch,
524     qio_channel_tls_source_finalize
525 };
526 
527 static void
528 qio_channel_tls_read_watch(QIOChannelTLS *tioc, GSource *source)
529 {
530     GSource *child;
531     QIOChannelTLSSource *tlssource;
532 
533     child = g_source_new(&qio_channel_tls_source_funcs,
534                           sizeof(QIOChannelTLSSource));
535     tlssource = (QIOChannelTLSSource *)child;
536 
537     tlssource->tioc = tioc;
538     object_ref(OBJECT(tioc));
539 
540     g_source_add_child_source(source, child);
541     g_source_unref(child);
542 }
543 
544 static GSource *qio_channel_tls_create_watch(QIOChannel *ioc,
545                                              GIOCondition condition)
546 {
547     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
548     GSource *source = qio_channel_create_watch(tioc->master, condition);
549 
550     if (condition & G_IO_IN) {
551         qio_channel_tls_read_watch(tioc, source);
552     }
553 
554     return source;
555 }
556 
557 QCryptoTLSSession *
558 qio_channel_tls_get_session(QIOChannelTLS *ioc)
559 {
560     return ioc->session;
561 }
562 
563 static void qio_channel_tls_class_init(ObjectClass *klass,
564                                        void *class_data G_GNUC_UNUSED)
565 {
566     QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
567 
568     ioc_klass->io_writev = qio_channel_tls_writev;
569     ioc_klass->io_readv = qio_channel_tls_readv;
570     ioc_klass->io_set_blocking = qio_channel_tls_set_blocking;
571     ioc_klass->io_set_delay = qio_channel_tls_set_delay;
572     ioc_klass->io_set_cork = qio_channel_tls_set_cork;
573     ioc_klass->io_close = qio_channel_tls_close;
574     ioc_klass->io_shutdown = qio_channel_tls_shutdown;
575     ioc_klass->io_create_watch = qio_channel_tls_create_watch;
576     ioc_klass->io_set_aio_fd_handler = qio_channel_tls_set_aio_fd_handler;
577 }
578 
579 static const TypeInfo qio_channel_tls_info = {
580     .parent = TYPE_QIO_CHANNEL,
581     .name = TYPE_QIO_CHANNEL_TLS,
582     .instance_size = sizeof(QIOChannelTLS),
583     .instance_init = qio_channel_tls_init,
584     .instance_finalize = qio_channel_tls_finalize,
585     .class_init = qio_channel_tls_class_init,
586 };
587 
588 static void qio_channel_tls_register_types(void)
589 {
590     type_register_static(&qio_channel_tls_info);
591 }
592 
593 type_init(qio_channel_tls_register_types);
594