1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21#include "qemu/osdep.h"
22#include "qapi/error.h"
23#include "io/channel-tls.h"
24#include "trace.h"
25
26
27static ssize_t qio_channel_tls_write_handler(const char *buf,
28 size_t len,
29 void *opaque)
30{
31 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
32 ssize_t ret;
33
34 ret = qio_channel_write(tioc->master, buf, len, NULL);
35 if (ret == QIO_CHANNEL_ERR_BLOCK) {
36 errno = EAGAIN;
37 return -1;
38 } else if (ret < 0) {
39 errno = EIO;
40 return -1;
41 }
42 return ret;
43}
44
45static ssize_t qio_channel_tls_read_handler(char *buf,
46 size_t len,
47 void *opaque)
48{
49 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
50 ssize_t ret;
51
52 ret = qio_channel_read(tioc->master, buf, len, NULL);
53 if (ret == QIO_CHANNEL_ERR_BLOCK) {
54 errno = EAGAIN;
55 return -1;
56 } else if (ret < 0) {
57 errno = EIO;
58 return -1;
59 }
60 return ret;
61}
62
63
64QIOChannelTLS *
65qio_channel_tls_new_server(QIOChannel *master,
66 QCryptoTLSCreds *creds,
67 const char *aclname,
68 Error **errp)
69{
70 QIOChannelTLS *ioc;
71
72 ioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
73
74 ioc->master = master;
75 object_ref(OBJECT(master));
76
77 ioc->session = qcrypto_tls_session_new(
78 creds,
79 NULL,
80 aclname,
81 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
82 errp);
83 if (!ioc->session) {
84 goto error;
85 }
86
87 qcrypto_tls_session_set_callbacks(
88 ioc->session,
89 qio_channel_tls_write_handler,
90 qio_channel_tls_read_handler,
91 ioc);
92
93 trace_qio_channel_tls_new_server(ioc, master, creds, aclname);
94 return ioc;
95
96 error:
97 object_unref(OBJECT(ioc));
98 return NULL;
99}
100
101QIOChannelTLS *
102qio_channel_tls_new_client(QIOChannel *master,
103 QCryptoTLSCreds *creds,
104 const char *hostname,
105 Error **errp)
106{
107 QIOChannelTLS *tioc;
108 QIOChannel *ioc;
109
110 tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
111 ioc = QIO_CHANNEL(tioc);
112
113 tioc->master = master;
114 if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
115 qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
116 }
117 object_ref(OBJECT(master));
118
119 tioc->session = qcrypto_tls_session_new(
120 creds,
121 hostname,
122 NULL,
123 QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT,
124 errp);
125 if (!tioc->session) {
126 goto error;
127 }
128
129 qcrypto_tls_session_set_callbacks(
130 tioc->session,
131 qio_channel_tls_write_handler,
132 qio_channel_tls_read_handler,
133 tioc);
134
135 trace_qio_channel_tls_new_client(tioc, master, creds, hostname);
136 return tioc;
137
138 error:
139 object_unref(OBJECT(tioc));
140 return NULL;
141}
142
143struct QIOChannelTLSData {
144 QIOTask *task;
145 GMainContext *context;
146};
147typedef struct QIOChannelTLSData QIOChannelTLSData;
148
149static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
150 GIOCondition condition,
151 gpointer user_data);
152
153static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
154 QIOTask *task,
155 GMainContext *context)
156{
157 Error *err = NULL;
158 QCryptoTLSSessionHandshakeStatus status;
159
160 if (qcrypto_tls_session_handshake(ioc->session, &err) < 0) {
161 trace_qio_channel_tls_handshake_fail(ioc);
162 qio_task_set_error(task, err);
163 qio_task_complete(task);
164 return;
165 }
166
167 status = qcrypto_tls_session_get_handshake_status(ioc->session);
168 if (status == QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
169 trace_qio_channel_tls_handshake_complete(ioc);
170 if (qcrypto_tls_session_check_credentials(ioc->session,
171 &err) < 0) {
172 trace_qio_channel_tls_credentials_deny(ioc);
173 qio_task_set_error(task, err);
174 } else {
175 trace_qio_channel_tls_credentials_allow(ioc);
176 }
177 qio_task_complete(task);
178 } else {
179 GIOCondition condition;
180 QIOChannelTLSData *data = g_new0(typeof(*data), 1);
181
182 data->task = task;
183 data->context = context;
184
185 if (context) {
186 g_main_context_ref(context);
187 }
188
189 if (status == QCRYPTO_TLS_HANDSHAKE_SENDING) {
190 condition = G_IO_OUT;
191 } else {
192 condition = G_IO_IN;
193 }
194
195 trace_qio_channel_tls_handshake_pending(ioc, status);
196 qio_channel_add_watch_full(ioc->master,
197 condition,
198 qio_channel_tls_handshake_io,
199 data,
200 NULL,
201 context);
202 }
203}
204
205
206static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
207 GIOCondition condition,
208 gpointer user_data)
209{
210 QIOChannelTLSData *data = user_data;
211 QIOTask *task = data->task;
212 GMainContext *context = data->context;
213 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(
214 qio_task_get_source(task));
215
216 g_free(data);
217 qio_channel_tls_handshake_task(tioc, task, context);
218
219 if (context) {
220 g_main_context_unref(context);
221 }
222
223 return FALSE;
224}
225
226void qio_channel_tls_handshake(QIOChannelTLS *ioc,
227 QIOTaskFunc func,
228 gpointer opaque,
229 GDestroyNotify destroy,
230 GMainContext *context)
231{
232 QIOTask *task;
233
234 task = qio_task_new(OBJECT(ioc),
235 func, opaque, destroy);
236
237 trace_qio_channel_tls_handshake_start(ioc);
238 qio_channel_tls_handshake_task(ioc, task, context);
239}
240
241
242static void qio_channel_tls_init(Object *obj G_GNUC_UNUSED)
243{
244}
245
246
247static void qio_channel_tls_finalize(Object *obj)
248{
249 QIOChannelTLS *ioc = QIO_CHANNEL_TLS(obj);
250
251 object_unref(OBJECT(ioc->master));
252 qcrypto_tls_session_free(ioc->session);
253}
254
255
256static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
257 const struct iovec *iov,
258 size_t niov,
259 int **fds,
260 size_t *nfds,
261 Error **errp)
262{
263 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
264 size_t i;
265 ssize_t got = 0;
266
267 for (i = 0 ; i < niov ; i++) {
268 ssize_t ret = qcrypto_tls_session_read(tioc->session,
269 iov[i].iov_base,
270 iov[i].iov_len);
271 if (ret < 0) {
272 if (errno == EAGAIN) {
273 if (got) {
274 return got;
275 } else {
276 return QIO_CHANNEL_ERR_BLOCK;
277 }
278 } else if (errno == ECONNABORTED &&
279 (tioc->shutdown & QIO_CHANNEL_SHUTDOWN_READ)) {
280 return 0;
281 }
282
283 error_setg_errno(errp, errno,
284 "Cannot read from TLS channel");
285 return -1;
286 }
287 got += ret;
288 if (ret < iov[i].iov_len) {
289 break;
290 }
291 }
292 return got;
293}
294
295
296static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
297 const struct iovec *iov,
298 size_t niov,
299 int *fds,
300 size_t nfds,
301 Error **errp)
302{
303 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
304 size_t i;
305 ssize_t done = 0;
306
307 for (i = 0 ; i < niov ; i++) {
308 ssize_t ret = qcrypto_tls_session_write(tioc->session,
309 iov[i].iov_base,
310 iov[i].iov_len);
311 if (ret <= 0) {
312 if (errno == EAGAIN) {
313 if (done) {
314 return done;
315 } else {
316 return QIO_CHANNEL_ERR_BLOCK;
317 }
318 }
319
320 error_setg_errno(errp, errno,
321 "Cannot write to TLS channel");
322 return -1;
323 }
324 done += ret;
325 if (ret < iov[i].iov_len) {
326 break;
327 }
328 }
329 return done;
330}
331
332static int qio_channel_tls_set_blocking(QIOChannel *ioc,
333 bool enabled,
334 Error **errp)
335{
336 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
337
338 return qio_channel_set_blocking(tioc->master, enabled, errp);
339}
340
341static void qio_channel_tls_set_delay(QIOChannel *ioc,
342 bool enabled)
343{
344 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
345
346 qio_channel_set_delay(tioc->master, enabled);
347}
348
349static void qio_channel_tls_set_cork(QIOChannel *ioc,
350 bool enabled)
351{
352 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
353
354 qio_channel_set_cork(tioc->master, enabled);
355}
356
357static int qio_channel_tls_shutdown(QIOChannel *ioc,
358 QIOChannelShutdown how,
359 Error **errp)
360{
361 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
362
363 tioc->shutdown |= how;
364
365 return qio_channel_shutdown(tioc->master, how, errp);
366}
367
368static int qio_channel_tls_close(QIOChannel *ioc,
369 Error **errp)
370{
371 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
372
373 return qio_channel_close(tioc->master, errp);
374}
375
376static void qio_channel_tls_set_aio_fd_handler(QIOChannel *ioc,
377 AioContext *ctx,
378 IOHandler *io_read,
379 IOHandler *io_write,
380 void *opaque)
381{
382 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
383
384 qio_channel_set_aio_fd_handler(tioc->master, ctx, io_read, io_write, opaque);
385}
386
387static GSource *qio_channel_tls_create_watch(QIOChannel *ioc,
388 GIOCondition condition)
389{
390 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
391
392 return qio_channel_create_watch(tioc->master, condition);
393}
394
395QCryptoTLSSession *
396qio_channel_tls_get_session(QIOChannelTLS *ioc)
397{
398 return ioc->session;
399}
400
401static void qio_channel_tls_class_init(ObjectClass *klass,
402 void *class_data G_GNUC_UNUSED)
403{
404 QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
405
406 ioc_klass->io_writev = qio_channel_tls_writev;
407 ioc_klass->io_readv = qio_channel_tls_readv;
408 ioc_klass->io_set_blocking = qio_channel_tls_set_blocking;
409 ioc_klass->io_set_delay = qio_channel_tls_set_delay;
410 ioc_klass->io_set_cork = qio_channel_tls_set_cork;
411 ioc_klass->io_close = qio_channel_tls_close;
412 ioc_klass->io_shutdown = qio_channel_tls_shutdown;
413 ioc_klass->io_create_watch = qio_channel_tls_create_watch;
414 ioc_klass->io_set_aio_fd_handler = qio_channel_tls_set_aio_fd_handler;
415}
416
417static const TypeInfo qio_channel_tls_info = {
418 .parent = TYPE_QIO_CHANNEL,
419 .name = TYPE_QIO_CHANNEL_TLS,
420 .instance_size = sizeof(QIOChannelTLS),
421 .instance_init = qio_channel_tls_init,
422 .instance_finalize = qio_channel_tls_finalize,
423 .class_init = qio_channel_tls_class_init,
424};
425
426static void qio_channel_tls_register_types(void)
427{
428 type_register_static(&qio_channel_tls_info);
429}
430
431type_init(qio_channel_tls_register_types);
432
