1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21#include "qemu/osdep.h"
22#include "qapi/error.h"
23#include "io/channel-tls.h"
24#include "trace.h"
25
26
27static ssize_t qio_channel_tls_write_handler(const char *buf,
28 size_t len,
29 void *opaque)
30{
31 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
32 ssize_t ret;
33
34 ret = qio_channel_write(tioc->master, buf, len, NULL);
35 if (ret == QIO_CHANNEL_ERR_BLOCK) {
36 errno = EAGAIN;
37 return -1;
38 } else if (ret < 0) {
39 errno = EIO;
40 return -1;
41 }
42 return ret;
43}
44
45static ssize_t qio_channel_tls_read_handler(char *buf,
46 size_t len,
47 void *opaque)
48{
49 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
50 ssize_t ret;
51
52 ret = qio_channel_read(tioc->master, buf, len, NULL);
53 if (ret == QIO_CHANNEL_ERR_BLOCK) {
54 errno = EAGAIN;
55 return -1;
56 } else if (ret < 0) {
57 errno = EIO;
58 return -1;
59 }
60 return ret;
61}
62
63
64QIOChannelTLS *
65qio_channel_tls_new_server(QIOChannel *master,
66 QCryptoTLSCreds *creds,
67 const char *aclname,
68 Error **errp)
69{
70 QIOChannelTLS *ioc;
71
72 ioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
73
74 ioc->master = master;
75 object_ref(OBJECT(master));
76
77 ioc->session = qcrypto_tls_session_new(
78 creds,
79 NULL,
80 aclname,
81 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
82 errp);
83 if (!ioc->session) {
84 goto error;
85 }
86
87 qcrypto_tls_session_set_callbacks(
88 ioc->session,
89 qio_channel_tls_write_handler,
90 qio_channel_tls_read_handler,
91 ioc);
92
93 trace_qio_channel_tls_new_server(ioc, master, creds, aclname);
94 return ioc;
95
96 error:
97 object_unref(OBJECT(ioc));
98 return NULL;
99}
100
101QIOChannelTLS *
102qio_channel_tls_new_client(QIOChannel *master,
103 QCryptoTLSCreds *creds,
104 const char *hostname,
105 Error **errp)
106{
107 QIOChannelTLS *tioc;
108 QIOChannel *ioc;
109
110 tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
111 ioc = QIO_CHANNEL(tioc);
112
113 tioc->master = master;
114 if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
115 qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
116 }
117 object_ref(OBJECT(master));
118
119 tioc->session = qcrypto_tls_session_new(
120 creds,
121 hostname,
122 NULL,
123 QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT,
124 errp);
125 if (!tioc->session) {
126 goto error;
127 }
128
129 qcrypto_tls_session_set_callbacks(
130 tioc->session,
131 qio_channel_tls_write_handler,
132 qio_channel_tls_read_handler,
133 tioc);
134
135 trace_qio_channel_tls_new_client(tioc, master, creds, hostname);
136 return tioc;
137
138 error:
139 object_unref(OBJECT(tioc));
140 return NULL;
141}
142
143
144static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
145 GIOCondition condition,
146 gpointer user_data);
147
148static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
149 QIOTask *task)
150{
151 Error *err = NULL;
152 QCryptoTLSSessionHandshakeStatus status;
153
154 if (qcrypto_tls_session_handshake(ioc->session, &err) < 0) {
155 trace_qio_channel_tls_handshake_fail(ioc);
156 qio_task_set_error(task, err);
157 qio_task_complete(task);
158 return;
159 }
160
161 status = qcrypto_tls_session_get_handshake_status(ioc->session);
162 if (status == QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
163 trace_qio_channel_tls_handshake_complete(ioc);
164 if (qcrypto_tls_session_check_credentials(ioc->session,
165 &err) < 0) {
166 trace_qio_channel_tls_credentials_deny(ioc);
167 qio_task_set_error(task, err);
168 } else {
169 trace_qio_channel_tls_credentials_allow(ioc);
170 }
171 qio_task_complete(task);
172 } else {
173 GIOCondition condition;
174 if (status == QCRYPTO_TLS_HANDSHAKE_SENDING) {
175 condition = G_IO_OUT;
176 } else {
177 condition = G_IO_IN;
178 }
179
180 trace_qio_channel_tls_handshake_pending(ioc, status);
181 qio_channel_add_watch(ioc->master,
182 condition,
183 qio_channel_tls_handshake_io,
184 task,
185 NULL);
186 }
187}
188
189
190static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
191 GIOCondition condition,
192 gpointer user_data)
193{
194 QIOTask *task = user_data;
195 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(
196 qio_task_get_source(task));
197
198 qio_channel_tls_handshake_task(
199 tioc, task);
200
201 return FALSE;
202}
203
204void qio_channel_tls_handshake(QIOChannelTLS *ioc,
205 QIOTaskFunc func,
206 gpointer opaque,
207 GDestroyNotify destroy)
208{
209 QIOTask *task;
210
211 task = qio_task_new(OBJECT(ioc),
212 func, opaque, destroy);
213
214 trace_qio_channel_tls_handshake_start(ioc);
215 qio_channel_tls_handshake_task(ioc, task);
216}
217
218
219static void qio_channel_tls_init(Object *obj G_GNUC_UNUSED)
220{
221}
222
223
224static void qio_channel_tls_finalize(Object *obj)
225{
226 QIOChannelTLS *ioc = QIO_CHANNEL_TLS(obj);
227
228 object_unref(OBJECT(ioc->master));
229 qcrypto_tls_session_free(ioc->session);
230}
231
232
233static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
234 const struct iovec *iov,
235 size_t niov,
236 int **fds,
237 size_t *nfds,
238 Error **errp)
239{
240 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
241 size_t i;
242 ssize_t got = 0;
243
244 for (i = 0 ; i < niov ; i++) {
245 ssize_t ret = qcrypto_tls_session_read(tioc->session,
246 iov[i].iov_base,
247 iov[i].iov_len);
248 if (ret < 0) {
249 if (errno == EAGAIN) {
250 if (got) {
251 return got;
252 } else {
253 return QIO_CHANNEL_ERR_BLOCK;
254 }
255 }
256
257 error_setg_errno(errp, errno,
258 "Cannot read from TLS channel");
259 return -1;
260 }
261 got += ret;
262 if (ret < iov[i].iov_len) {
263 break;
264 }
265 }
266 return got;
267}
268
269
270static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
271 const struct iovec *iov,
272 size_t niov,
273 int *fds,
274 size_t nfds,
275 Error **errp)
276{
277 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
278 size_t i;
279 ssize_t done = 0;
280
281 for (i = 0 ; i < niov ; i++) {
282 ssize_t ret = qcrypto_tls_session_write(tioc->session,
283 iov[i].iov_base,
284 iov[i].iov_len);
285 if (ret <= 0) {
286 if (errno == EAGAIN) {
287 if (done) {
288 return done;
289 } else {
290 return QIO_CHANNEL_ERR_BLOCK;
291 }
292 }
293
294 error_setg_errno(errp, errno,
295 "Cannot write to TLS channel");
296 return -1;
297 }
298 done += ret;
299 if (ret < iov[i].iov_len) {
300 break;
301 }
302 }
303 return done;
304}
305
306static int qio_channel_tls_set_blocking(QIOChannel *ioc,
307 bool enabled,
308 Error **errp)
309{
310 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
311
312 return qio_channel_set_blocking(tioc->master, enabled, errp);
313}
314
315static void qio_channel_tls_set_delay(QIOChannel *ioc,
316 bool enabled)
317{
318 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
319
320 qio_channel_set_delay(tioc->master, enabled);
321}
322
323static void qio_channel_tls_set_cork(QIOChannel *ioc,
324 bool enabled)
325{
326 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
327
328 qio_channel_set_cork(tioc->master, enabled);
329}
330
331static int qio_channel_tls_shutdown(QIOChannel *ioc,
332 QIOChannelShutdown how,
333 Error **errp)
334{
335 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
336
337 return qio_channel_shutdown(tioc->master, how, errp);
338}
339
340static int qio_channel_tls_close(QIOChannel *ioc,
341 Error **errp)
342{
343 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
344
345 return qio_channel_close(tioc->master, errp);
346}
347
348static void qio_channel_tls_set_aio_fd_handler(QIOChannel *ioc,
349 AioContext *ctx,
350 IOHandler *io_read,
351 IOHandler *io_write,
352 void *opaque)
353{
354 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
355
356 qio_channel_set_aio_fd_handler(tioc->master, ctx, io_read, io_write, opaque);
357}
358
359static GSource *qio_channel_tls_create_watch(QIOChannel *ioc,
360 GIOCondition condition)
361{
362 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
363
364 return qio_channel_create_watch(tioc->master, condition);
365}
366
367QCryptoTLSSession *
368qio_channel_tls_get_session(QIOChannelTLS *ioc)
369{
370 return ioc->session;
371}
372
373static void qio_channel_tls_class_init(ObjectClass *klass,
374 void *class_data G_GNUC_UNUSED)
375{
376 QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
377
378 ioc_klass->io_writev = qio_channel_tls_writev;
379 ioc_klass->io_readv = qio_channel_tls_readv;
380 ioc_klass->io_set_blocking = qio_channel_tls_set_blocking;
381 ioc_klass->io_set_delay = qio_channel_tls_set_delay;
382 ioc_klass->io_set_cork = qio_channel_tls_set_cork;
383 ioc_klass->io_close = qio_channel_tls_close;
384 ioc_klass->io_shutdown = qio_channel_tls_shutdown;
385 ioc_klass->io_create_watch = qio_channel_tls_create_watch;
386 ioc_klass->io_set_aio_fd_handler = qio_channel_tls_set_aio_fd_handler;
387}
388
389static const TypeInfo qio_channel_tls_info = {
390 .parent = TYPE_QIO_CHANNEL,
391 .name = TYPE_QIO_CHANNEL_TLS,
392 .instance_size = sizeof(QIOChannelTLS),
393 .instance_init = qio_channel_tls_init,
394 .instance_finalize = qio_channel_tls_finalize,
395 .class_init = qio_channel_tls_class_init,
396};
397
398static void qio_channel_tls_register_types(void)
399{
400 type_register_static(&qio_channel_tls_info);
401}
402
403type_init(qio_channel_tls_register_types);
404
