qemu/block/ssh.c
<<
>>
Prefs
   1/*
   2 * Secure Shell (ssh) backend for QEMU.
   3 *
   4 * Copyright (C) 2013 Red Hat Inc., Richard W.M. Jones <rjones@redhat.com>
   5 *
   6 * Permission is hereby granted, free of charge, to any person obtaining a copy
   7 * of this software and associated documentation files (the "Software"), to deal
   8 * in the Software without restriction, including without limitation the rights
   9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10 * copies of the Software, and to permit persons to whom the Software is
  11 * furnished to do so, subject to the following conditions:
  12 *
  13 * The above copyright notice and this permission notice shall be included in
  14 * all copies or substantial portions of the Software.
  15 *
  16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22 * THE SOFTWARE.
  23 */
  24
  25#include "qemu/osdep.h"
  26
  27#include <libssh/libssh.h>
  28#include <libssh/sftp.h>
  29
  30#include "block/block_int.h"
  31#include "block/qdict.h"
  32#include "qapi/error.h"
  33#include "qemu/error-report.h"
  34#include "qemu/module.h"
  35#include "qemu/option.h"
  36#include "qemu/ctype.h"
  37#include "qemu/cutils.h"
  38#include "qemu/sockets.h"
  39#include "qemu/uri.h"
  40#include "qapi/qapi-visit-sockets.h"
  41#include "qapi/qapi-visit-block-core.h"
  42#include "qapi/qmp/qdict.h"
  43#include "qapi/qmp/qstring.h"
  44#include "qapi/qobject-input-visitor.h"
  45#include "qapi/qobject-output-visitor.h"
  46#include "trace.h"
  47
  48/*
  49 * TRACE_LIBSSH=<level> enables tracing in libssh itself.
  50 * The meaning of <level> is described here:
  51 * http://api.libssh.org/master/group__libssh__log.html
  52 */
  53#define TRACE_LIBSSH  0 /* see: SSH_LOG_* */
  54
  55typedef struct BDRVSSHState {
  56    /* Coroutine. */
  57    CoMutex lock;
  58
  59    /* SSH connection. */
  60    int sock;                         /* socket */
  61    ssh_session session;              /* ssh session */
  62    sftp_session sftp;                /* sftp session */
  63    sftp_file sftp_handle;            /* sftp remote file handle */
  64
  65    /*
  66     * File attributes at open.  We try to keep the .size field
  67     * updated if it changes (eg by writing at the end of the file).
  68     */
  69    sftp_attributes attrs;
  70
  71    InetSocketAddress *inet;
  72
  73    /* Used to warn if 'flush' is not supported. */
  74    bool unsafe_flush_warning;
  75
  76    /*
  77     * Store the user name for ssh_refresh_filename() because the
  78     * default depends on the system you are on -- therefore, when we
  79     * generate a filename, it should always contain the user name we
  80     * are actually using.
  81     */
  82    char *user;
  83} BDRVSSHState;
  84
  85static void ssh_state_init(BDRVSSHState *s)
  86{
  87    memset(s, 0, sizeof *s);
  88    s->sock = -1;
  89    qemu_co_mutex_init(&s->lock);
  90}
  91
  92static void ssh_state_free(BDRVSSHState *s)
  93{
  94    g_free(s->user);
  95
  96    if (s->attrs) {
  97        sftp_attributes_free(s->attrs);
  98    }
  99    if (s->sftp_handle) {
 100        sftp_close(s->sftp_handle);
 101    }
 102    if (s->sftp) {
 103        sftp_free(s->sftp);
 104    }
 105    if (s->session) {
 106        ssh_disconnect(s->session);
 107        ssh_free(s->session); /* This frees s->sock */
 108    }
 109}
 110
 111static void GCC_FMT_ATTR(3, 4)
 112session_error_setg(Error **errp, BDRVSSHState *s, const char *fs, ...)
 113{
 114    va_list args;
 115    char *msg;
 116
 117    va_start(args, fs);
 118    msg = g_strdup_vprintf(fs, args);
 119    va_end(args);
 120
 121    if (s->session) {
 122        const char *ssh_err;
 123        int ssh_err_code;
 124
 125        /* This is not an errno.  See <libssh/libssh.h>. */
 126        ssh_err = ssh_get_error(s->session);
 127        ssh_err_code = ssh_get_error_code(s->session);
 128        error_setg(errp, "%s: %s (libssh error code: %d)",
 129                   msg, ssh_err, ssh_err_code);
 130    } else {
 131        error_setg(errp, "%s", msg);
 132    }
 133    g_free(msg);
 134}
 135
 136static void GCC_FMT_ATTR(3, 4)
 137sftp_error_setg(Error **errp, BDRVSSHState *s, const char *fs, ...)
 138{
 139    va_list args;
 140    char *msg;
 141
 142    va_start(args, fs);
 143    msg = g_strdup_vprintf(fs, args);
 144    va_end(args);
 145
 146    if (s->sftp) {
 147        const char *ssh_err;
 148        int ssh_err_code;
 149        int sftp_err_code;
 150
 151        /* This is not an errno.  See <libssh/libssh.h>. */
 152        ssh_err = ssh_get_error(s->session);
 153        ssh_err_code = ssh_get_error_code(s->session);
 154        /* See <libssh/sftp.h>. */
 155        sftp_err_code = sftp_get_error(s->sftp);
 156
 157        error_setg(errp,
 158                   "%s: %s (libssh error code: %d, sftp error code: %d)",
 159                   msg, ssh_err, ssh_err_code, sftp_err_code);
 160    } else {
 161        error_setg(errp, "%s", msg);
 162    }
 163    g_free(msg);
 164}
 165
 166static void sftp_error_trace(BDRVSSHState *s, const char *op)
 167{
 168    const char *ssh_err;
 169    int ssh_err_code;
 170    int sftp_err_code;
 171
 172    /* This is not an errno.  See <libssh/libssh.h>. */
 173    ssh_err = ssh_get_error(s->session);
 174    ssh_err_code = ssh_get_error_code(s->session);
 175    /* See <libssh/sftp.h>. */
 176    sftp_err_code = sftp_get_error(s->sftp);
 177
 178    trace_sftp_error(op, ssh_err, ssh_err_code, sftp_err_code);
 179}
 180
 181static int parse_uri(const char *filename, QDict *options, Error **errp)
 182{
 183    URI *uri = NULL;
 184    QueryParams *qp;
 185    char *port_str;
 186    int i;
 187
 188    uri = uri_parse(filename);
 189    if (!uri) {
 190        return -EINVAL;
 191    }
 192
 193    if (g_strcmp0(uri->scheme, "ssh") != 0) {
 194        error_setg(errp, "URI scheme must be 'ssh'");
 195        goto err;
 196    }
 197
 198    if (!uri->server || strcmp(uri->server, "") == 0) {
 199        error_setg(errp, "missing hostname in URI");
 200        goto err;
 201    }
 202
 203    if (!uri->path || strcmp(uri->path, "") == 0) {
 204        error_setg(errp, "missing remote path in URI");
 205        goto err;
 206    }
 207
 208    qp = query_params_parse(uri->query);
 209    if (!qp) {
 210        error_setg(errp, "could not parse query parameters");
 211        goto err;
 212    }
 213
 214    if(uri->user && strcmp(uri->user, "") != 0) {
 215        qdict_put_str(options, "user", uri->user);
 216    }
 217
 218    qdict_put_str(options, "server.host", uri->server);
 219
 220    port_str = g_strdup_printf("%d", uri->port ?: 22);
 221    qdict_put_str(options, "server.port", port_str);
 222    g_free(port_str);
 223
 224    qdict_put_str(options, "path", uri->path);
 225
 226    /* Pick out any query parameters that we understand, and ignore
 227     * the rest.
 228     */
 229    for (i = 0; i < qp->n; ++i) {
 230        if (strcmp(qp->p[i].name, "host_key_check") == 0) {
 231            qdict_put_str(options, "host_key_check", qp->p[i].value);
 232        }
 233    }
 234
 235    query_params_free(qp);
 236    uri_free(uri);
 237    return 0;
 238
 239 err:
 240    if (uri) {
 241      uri_free(uri);
 242    }
 243    return -EINVAL;
 244}
 245
 246static bool ssh_has_filename_options_conflict(QDict *options, Error **errp)
 247{
 248    const QDictEntry *qe;
 249
 250    for (qe = qdict_first(options); qe; qe = qdict_next(options, qe)) {
 251        if (!strcmp(qe->key, "host") ||
 252            !strcmp(qe->key, "port") ||
 253            !strcmp(qe->key, "path") ||
 254            !strcmp(qe->key, "user") ||
 255            !strcmp(qe->key, "host_key_check") ||
 256            strstart(qe->key, "server.", NULL))
 257        {
 258            error_setg(errp, "Option '%s' cannot be used with a file name",
 259                       qe->key);
 260            return true;
 261        }
 262    }
 263
 264    return false;
 265}
 266
 267static void ssh_parse_filename(const char *filename, QDict *options,
 268                               Error **errp)
 269{
 270    if (ssh_has_filename_options_conflict(options, errp)) {
 271        return;
 272    }
 273
 274    parse_uri(filename, options, errp);
 275}
 276
 277static int check_host_key_knownhosts(BDRVSSHState *s, Error **errp)
 278{
 279    int ret;
 280#ifdef HAVE_LIBSSH_0_8
 281    enum ssh_known_hosts_e state;
 282    int r;
 283    ssh_key pubkey;
 284    enum ssh_keytypes_e pubkey_type;
 285    unsigned char *server_hash = NULL;
 286    size_t server_hash_len;
 287    char *fingerprint = NULL;
 288
 289    state = ssh_session_is_known_server(s->session);
 290    trace_ssh_server_status(state);
 291
 292    switch (state) {
 293    case SSH_KNOWN_HOSTS_OK:
 294        /* OK */
 295        trace_ssh_check_host_key_knownhosts();
 296        break;
 297    case SSH_KNOWN_HOSTS_CHANGED:
 298        ret = -EINVAL;
 299        r = ssh_get_server_publickey(s->session, &pubkey);
 300        if (r == 0) {
 301            r = ssh_get_publickey_hash(pubkey, SSH_PUBLICKEY_HASH_SHA256,
 302                                       &server_hash, &server_hash_len);
 303            pubkey_type = ssh_key_type(pubkey);
 304            ssh_key_free(pubkey);
 305        }
 306        if (r == 0) {
 307            fingerprint = ssh_get_fingerprint_hash(SSH_PUBLICKEY_HASH_SHA256,
 308                                                   server_hash,
 309                                                   server_hash_len);
 310            ssh_clean_pubkey_hash(&server_hash);
 311        }
 312        if (fingerprint) {
 313            error_setg(errp,
 314                       "host key (%s key with fingerprint %s) does not match "
 315                       "the one in known_hosts; this may be a possible attack",
 316                       ssh_key_type_to_char(pubkey_type), fingerprint);
 317            ssh_string_free_char(fingerprint);
 318        } else  {
 319            error_setg(errp,
 320                       "host key does not match the one in known_hosts; this "
 321                       "may be a possible attack");
 322        }
 323        goto out;
 324    case SSH_KNOWN_HOSTS_OTHER:
 325        ret = -EINVAL;
 326        error_setg(errp,
 327                   "host key for this server not found, another type exists");
 328        goto out;
 329    case SSH_KNOWN_HOSTS_UNKNOWN:
 330        ret = -EINVAL;
 331        error_setg(errp, "no host key was found in known_hosts");
 332        goto out;
 333    case SSH_KNOWN_HOSTS_NOT_FOUND:
 334        ret = -ENOENT;
 335        error_setg(errp, "known_hosts file not found");
 336        goto out;
 337    case SSH_KNOWN_HOSTS_ERROR:
 338        ret = -EINVAL;
 339        error_setg(errp, "error while checking the host");
 340        goto out;
 341    default:
 342        ret = -EINVAL;
 343        error_setg(errp, "error while checking for known server (%d)", state);
 344        goto out;
 345    }
 346#else /* !HAVE_LIBSSH_0_8 */
 347    int state;
 348
 349    state = ssh_is_server_known(s->session);
 350    trace_ssh_server_status(state);
 351
 352    switch (state) {
 353    case SSH_SERVER_KNOWN_OK:
 354        /* OK */
 355        trace_ssh_check_host_key_knownhosts();
 356        break;
 357    case SSH_SERVER_KNOWN_CHANGED:
 358        ret = -EINVAL;
 359        error_setg(errp,
 360                   "host key does not match the one in known_hosts; this "
 361                   "may be a possible attack");
 362        goto out;
 363    case SSH_SERVER_FOUND_OTHER:
 364        ret = -EINVAL;
 365        error_setg(errp,
 366                   "host key for this server not found, another type exists");
 367        goto out;
 368    case SSH_SERVER_FILE_NOT_FOUND:
 369        ret = -ENOENT;
 370        error_setg(errp, "known_hosts file not found");
 371        goto out;
 372    case SSH_SERVER_NOT_KNOWN:
 373        ret = -EINVAL;
 374        error_setg(errp, "no host key was found in known_hosts");
 375        goto out;
 376    case SSH_SERVER_ERROR:
 377        ret = -EINVAL;
 378        error_setg(errp, "server error");
 379        goto out;
 380    default:
 381        ret = -EINVAL;
 382        error_setg(errp, "error while checking for known server (%d)", state);
 383        goto out;
 384    }
 385#endif /* !HAVE_LIBSSH_0_8 */
 386
 387    /* known_hosts checking successful. */
 388    ret = 0;
 389
 390 out:
 391    return ret;
 392}
 393
 394static unsigned hex2decimal(char ch)
 395{
 396    if (ch >= '0' && ch <= '9') {
 397        return (ch - '0');
 398    } else if (ch >= 'a' && ch <= 'f') {
 399        return 10 + (ch - 'a');
 400    } else if (ch >= 'A' && ch <= 'F') {
 401        return 10 + (ch - 'A');
 402    }
 403
 404    return -1;
 405}
 406
 407/* Compare the binary fingerprint (hash of host key) with the
 408 * host_key_check parameter.
 409 */
 410static int compare_fingerprint(const unsigned char *fingerprint, size_t len,
 411                               const char *host_key_check)
 412{
 413    unsigned c;
 414
 415    while (len > 0) {
 416        while (*host_key_check == ':')
 417            host_key_check++;
 418        if (!qemu_isxdigit(host_key_check[0]) ||
 419            !qemu_isxdigit(host_key_check[1]))
 420            return 1;
 421        c = hex2decimal(host_key_check[0]) * 16 +
 422            hex2decimal(host_key_check[1]);
 423        if (c - *fingerprint != 0)
 424            return c - *fingerprint;
 425        fingerprint++;
 426        len--;
 427        host_key_check += 2;
 428    }
 429    return *host_key_check - '\0';
 430}
 431
 432static int
 433check_host_key_hash(BDRVSSHState *s, const char *hash,
 434                    enum ssh_publickey_hash_type type, Error **errp)
 435{
 436    int r;
 437    ssh_key pubkey;
 438    unsigned char *server_hash;
 439    size_t server_hash_len;
 440
 441#ifdef HAVE_LIBSSH_0_8
 442    r = ssh_get_server_publickey(s->session, &pubkey);
 443#else
 444    r = ssh_get_publickey(s->session, &pubkey);
 445#endif
 446    if (r != SSH_OK) {
 447        session_error_setg(errp, s, "failed to read remote host key");
 448        return -EINVAL;
 449    }
 450
 451    r = ssh_get_publickey_hash(pubkey, type, &server_hash, &server_hash_len);
 452    ssh_key_free(pubkey);
 453    if (r != 0) {
 454        session_error_setg(errp, s,
 455                           "failed reading the hash of the server SSH key");
 456        return -EINVAL;
 457    }
 458
 459    r = compare_fingerprint(server_hash, server_hash_len, hash);
 460    ssh_clean_pubkey_hash(&server_hash);
 461    if (r != 0) {
 462        error_setg(errp, "remote host key does not match host_key_check '%s'",
 463                   hash);
 464        return -EPERM;
 465    }
 466
 467    return 0;
 468}
 469
 470static int check_host_key(BDRVSSHState *s, SshHostKeyCheck *hkc, Error **errp)
 471{
 472    SshHostKeyCheckMode mode;
 473
 474    if (hkc) {
 475        mode = hkc->mode;
 476    } else {
 477        mode = SSH_HOST_KEY_CHECK_MODE_KNOWN_HOSTS;
 478    }
 479
 480    switch (mode) {
 481    case SSH_HOST_KEY_CHECK_MODE_NONE:
 482        return 0;
 483    case SSH_HOST_KEY_CHECK_MODE_HASH:
 484        if (hkc->u.hash.type == SSH_HOST_KEY_CHECK_HASH_TYPE_MD5) {
 485            return check_host_key_hash(s, hkc->u.hash.hash,
 486                                       SSH_PUBLICKEY_HASH_MD5, errp);
 487        } else if (hkc->u.hash.type == SSH_HOST_KEY_CHECK_HASH_TYPE_SHA1) {
 488            return check_host_key_hash(s, hkc->u.hash.hash,
 489                                       SSH_PUBLICKEY_HASH_SHA1, errp);
 490        }
 491        g_assert_not_reached();
 492        break;
 493    case SSH_HOST_KEY_CHECK_MODE_KNOWN_HOSTS:
 494        return check_host_key_knownhosts(s, errp);
 495    default:
 496        g_assert_not_reached();
 497    }
 498
 499    return -EINVAL;
 500}
 501
 502static int authenticate(BDRVSSHState *s, Error **errp)
 503{
 504    int r, ret;
 505    int method;
 506
 507    /* Try to authenticate with the "none" method. */
 508    r = ssh_userauth_none(s->session, NULL);
 509    if (r == SSH_AUTH_ERROR) {
 510        ret = -EPERM;
 511        session_error_setg(errp, s, "failed to authenticate using none "
 512                                    "authentication");
 513        goto out;
 514    } else if (r == SSH_AUTH_SUCCESS) {
 515        /* Authenticated! */
 516        ret = 0;
 517        goto out;
 518    }
 519
 520    method = ssh_userauth_list(s->session, NULL);
 521    trace_ssh_auth_methods(method);
 522
 523    /*
 524     * Try to authenticate with publickey, using the ssh-agent
 525     * if available.
 526     */
 527    if (method & SSH_AUTH_METHOD_PUBLICKEY) {
 528        r = ssh_userauth_publickey_auto(s->session, NULL, NULL);
 529        if (r == SSH_AUTH_ERROR) {
 530            ret = -EINVAL;
 531            session_error_setg(errp, s, "failed to authenticate using "
 532                                        "publickey authentication");
 533            goto out;
 534        } else if (r == SSH_AUTH_SUCCESS) {
 535            /* Authenticated! */
 536            ret = 0;
 537            goto out;
 538        }
 539    }
 540
 541    ret = -EPERM;
 542    error_setg(errp, "failed to authenticate using publickey authentication "
 543               "and the identities held by your ssh-agent");
 544
 545 out:
 546    return ret;
 547}
 548
 549static QemuOptsList ssh_runtime_opts = {
 550    .name = "ssh",
 551    .head = QTAILQ_HEAD_INITIALIZER(ssh_runtime_opts.head),
 552    .desc = {
 553        {
 554            .name = "host",
 555            .type = QEMU_OPT_STRING,
 556            .help = "Host to connect to",
 557        },
 558        {
 559            .name = "port",
 560            .type = QEMU_OPT_NUMBER,
 561            .help = "Port to connect to",
 562        },
 563        {
 564            .name = "host_key_check",
 565            .type = QEMU_OPT_STRING,
 566            .help = "Defines how and what to check the host key against",
 567        },
 568        { /* end of list */ }
 569    },
 570};
 571
 572static bool ssh_process_legacy_options(QDict *output_opts,
 573                                       QemuOpts *legacy_opts,
 574                                       Error **errp)
 575{
 576    const char *host = qemu_opt_get(legacy_opts, "host");
 577    const char *port = qemu_opt_get(legacy_opts, "port");
 578    const char *host_key_check = qemu_opt_get(legacy_opts, "host_key_check");
 579
 580    if (!host && port) {
 581        error_setg(errp, "port may not be used without host");
 582        return false;
 583    }
 584
 585    if (host) {
 586        qdict_put_str(output_opts, "server.host", host);
 587        qdict_put_str(output_opts, "server.port", port ?: stringify(22));
 588    }
 589
 590    if (host_key_check) {
 591        if (strcmp(host_key_check, "no") == 0) {
 592            qdict_put_str(output_opts, "host-key-check.mode", "none");
 593        } else if (strncmp(host_key_check, "md5:", 4) == 0) {
 594            qdict_put_str(output_opts, "host-key-check.mode", "hash");
 595            qdict_put_str(output_opts, "host-key-check.type", "md5");
 596            qdict_put_str(output_opts, "host-key-check.hash",
 597                          &host_key_check[4]);
 598        } else if (strncmp(host_key_check, "sha1:", 5) == 0) {
 599            qdict_put_str(output_opts, "host-key-check.mode", "hash");
 600            qdict_put_str(output_opts, "host-key-check.type", "sha1");
 601            qdict_put_str(output_opts, "host-key-check.hash",
 602                          &host_key_check[5]);
 603        } else if (strcmp(host_key_check, "yes") == 0) {
 604            qdict_put_str(output_opts, "host-key-check.mode", "known_hosts");
 605        } else {
 606            error_setg(errp, "unknown host_key_check setting (%s)",
 607                       host_key_check);
 608            return false;
 609        }
 610    }
 611
 612    return true;
 613}
 614
 615static BlockdevOptionsSsh *ssh_parse_options(QDict *options, Error **errp)
 616{
 617    BlockdevOptionsSsh *result = NULL;
 618    QemuOpts *opts = NULL;
 619    const QDictEntry *e;
 620    Visitor *v;
 621
 622    /* Translate legacy options */
 623    opts = qemu_opts_create(&ssh_runtime_opts, NULL, 0, &error_abort);
 624    if (!qemu_opts_absorb_qdict(opts, options, errp)) {
 625        goto fail;
 626    }
 627
 628    if (!ssh_process_legacy_options(options, opts, errp)) {
 629        goto fail;
 630    }
 631
 632    /* Create the QAPI object */
 633    v = qobject_input_visitor_new_flat_confused(options, errp);
 634    if (!v) {
 635        goto fail;
 636    }
 637
 638    visit_type_BlockdevOptionsSsh(v, NULL, &result, errp);
 639    visit_free(v);
 640    if (!result) {
 641        goto fail;
 642    }
 643
 644    /* Remove the processed options from the QDict (the visitor processes
 645     * _all_ options in the QDict) */
 646    while ((e = qdict_first(options))) {
 647        qdict_del(options, e->key);
 648    }
 649
 650fail:
 651    qemu_opts_del(opts);
 652    return result;
 653}
 654
 655static int connect_to_ssh(BDRVSSHState *s, BlockdevOptionsSsh *opts,
 656                          int ssh_flags, int creat_mode, Error **errp)
 657{
 658    int r, ret;
 659    unsigned int port = 0;
 660    int new_sock = -1;
 661
 662    if (opts->has_user) {
 663        s->user = g_strdup(opts->user);
 664    } else {
 665        s->user = g_strdup(g_get_user_name());
 666        if (!s->user) {
 667            error_setg_errno(errp, errno, "Can't get user name");
 668            ret = -errno;
 669            goto err;
 670        }
 671    }
 672
 673    /* Pop the config into our state object, Exit if invalid */
 674    s->inet = opts->server;
 675    opts->server = NULL;
 676
 677    if (qemu_strtoui(s->inet->port, NULL, 10, &port) < 0) {
 678        error_setg(errp, "Use only numeric port value");
 679        ret = -EINVAL;
 680        goto err;
 681    }
 682
 683    /* Open the socket and connect. */
 684    new_sock = inet_connect_saddr(s->inet, errp);
 685    if (new_sock < 0) {
 686        ret = -EIO;
 687        goto err;
 688    }
 689
 690    /*
 691     * Try to disable the Nagle algorithm on TCP sockets to reduce latency,
 692     * but do not fail if it cannot be disabled.
 693     */
 694    r = socket_set_nodelay(new_sock);
 695    if (r < 0) {
 696        warn_report("can't set TCP_NODELAY for the ssh server %s: %s",
 697                    s->inet->host, strerror(errno));
 698    }
 699
 700    /* Create SSH session. */
 701    s->session = ssh_new();
 702    if (!s->session) {
 703        ret = -EINVAL;
 704        session_error_setg(errp, s, "failed to initialize libssh session");
 705        goto err;
 706    }
 707
 708    /*
 709     * Make sure we are in blocking mode during the connection and
 710     * authentication phases.
 711     */
 712    ssh_set_blocking(s->session, 1);
 713
 714    r = ssh_options_set(s->session, SSH_OPTIONS_USER, s->user);
 715    if (r < 0) {
 716        ret = -EINVAL;
 717        session_error_setg(errp, s,
 718                           "failed to set the user in the libssh session");
 719        goto err;
 720    }
 721
 722    r = ssh_options_set(s->session, SSH_OPTIONS_HOST, s->inet->host);
 723    if (r < 0) {
 724        ret = -EINVAL;
 725        session_error_setg(errp, s,
 726                           "failed to set the host in the libssh session");
 727        goto err;
 728    }
 729
 730    if (port > 0) {
 731        r = ssh_options_set(s->session, SSH_OPTIONS_PORT, &port);
 732        if (r < 0) {
 733            ret = -EINVAL;
 734            session_error_setg(errp, s,
 735                               "failed to set the port in the libssh session");
 736            goto err;
 737        }
 738    }
 739
 740    r = ssh_options_set(s->session, SSH_OPTIONS_COMPRESSION, "none");
 741    if (r < 0) {
 742        ret = -EINVAL;
 743        session_error_setg(errp, s,
 744                           "failed to disable the compression in the libssh "
 745                           "session");
 746        goto err;
 747    }
 748
 749    /* Read ~/.ssh/config. */
 750    r = ssh_options_parse_config(s->session, NULL);
 751    if (r < 0) {
 752        ret = -EINVAL;
 753        session_error_setg(errp, s, "failed to parse ~/.ssh/config");
 754        goto err;
 755    }
 756
 757    r = ssh_options_set(s->session, SSH_OPTIONS_FD, &new_sock);
 758    if (r < 0) {
 759        ret = -EINVAL;
 760        session_error_setg(errp, s,
 761                           "failed to set the socket in the libssh session");
 762        goto err;
 763    }
 764    /* libssh took ownership of the socket. */
 765    s->sock = new_sock;
 766    new_sock = -1;
 767
 768    /* Connect. */
 769    r = ssh_connect(s->session);
 770    if (r != SSH_OK) {
 771        ret = -EINVAL;
 772        session_error_setg(errp, s, "failed to establish SSH session");
 773        goto err;
 774    }
 775
 776    /* Check the remote host's key against known_hosts. */
 777    ret = check_host_key(s, opts->host_key_check, errp);
 778    if (ret < 0) {
 779        goto err;
 780    }
 781
 782    /* Authenticate. */
 783    ret = authenticate(s, errp);
 784    if (ret < 0) {
 785        goto err;
 786    }
 787
 788    /* Start SFTP. */
 789    s->sftp = sftp_new(s->session);
 790    if (!s->sftp) {
 791        session_error_setg(errp, s, "failed to create sftp handle");
 792        ret = -EINVAL;
 793        goto err;
 794    }
 795
 796    r = sftp_init(s->sftp);
 797    if (r < 0) {
 798        sftp_error_setg(errp, s, "failed to initialize sftp handle");
 799        ret = -EINVAL;
 800        goto err;
 801    }
 802
 803    /* Open the remote file. */
 804    trace_ssh_connect_to_ssh(opts->path, ssh_flags, creat_mode);
 805    s->sftp_handle = sftp_open(s->sftp, opts->path, ssh_flags, creat_mode);
 806    if (!s->sftp_handle) {
 807        sftp_error_setg(errp, s, "failed to open remote file '%s'",
 808                        opts->path);
 809        ret = -EINVAL;
 810        goto err;
 811    }
 812
 813    /* Make sure the SFTP file is handled in blocking mode. */
 814    sftp_file_set_blocking(s->sftp_handle);
 815
 816    s->attrs = sftp_fstat(s->sftp_handle);
 817    if (!s->attrs) {
 818        sftp_error_setg(errp, s, "failed to read file attributes");
 819        return -EINVAL;
 820    }
 821
 822    return 0;
 823
 824 err:
 825    if (s->attrs) {
 826        sftp_attributes_free(s->attrs);
 827    }
 828    s->attrs = NULL;
 829    if (s->sftp_handle) {
 830        sftp_close(s->sftp_handle);
 831    }
 832    s->sftp_handle = NULL;
 833    if (s->sftp) {
 834        sftp_free(s->sftp);
 835    }
 836    s->sftp = NULL;
 837    if (s->session) {
 838        ssh_disconnect(s->session);
 839        ssh_free(s->session);
 840    }
 841    s->session = NULL;
 842    s->sock = -1;
 843    if (new_sock >= 0) {
 844        close(new_sock);
 845    }
 846
 847    return ret;
 848}
 849
 850static int ssh_file_open(BlockDriverState *bs, QDict *options, int bdrv_flags,
 851                         Error **errp)
 852{
 853    BDRVSSHState *s = bs->opaque;
 854    BlockdevOptionsSsh *opts;
 855    int ret;
 856    int ssh_flags;
 857
 858    ssh_state_init(s);
 859
 860    ssh_flags = 0;
 861    if (bdrv_flags & BDRV_O_RDWR) {
 862        ssh_flags |= O_RDWR;
 863    } else {
 864        ssh_flags |= O_RDONLY;
 865    }
 866
 867    opts = ssh_parse_options(options, errp);
 868    if (opts == NULL) {
 869        return -EINVAL;
 870    }
 871
 872    /* Start up SSH. */
 873    ret = connect_to_ssh(s, opts, ssh_flags, 0, errp);
 874    if (ret < 0) {
 875        goto err;
 876    }
 877
 878    /* Go non-blocking. */
 879    ssh_set_blocking(s->session, 0);
 880
 881    if (s->attrs->type == SSH_FILEXFER_TYPE_REGULAR) {
 882        bs->supported_truncate_flags = BDRV_REQ_ZERO_WRITE;
 883    }
 884
 885    qapi_free_BlockdevOptionsSsh(opts);
 886
 887    return 0;
 888
 889 err:
 890    qapi_free_BlockdevOptionsSsh(opts);
 891
 892    return ret;
 893}
 894
 895/* Note: This is a blocking operation */
 896static int ssh_grow_file(BDRVSSHState *s, int64_t offset, Error **errp)
 897{
 898    ssize_t ret;
 899    char c[1] = { '\0' };
 900    int was_blocking = ssh_is_blocking(s->session);
 901
 902    /* offset must be strictly greater than the current size so we do
 903     * not overwrite anything */
 904    assert(offset > 0 && offset > s->attrs->size);
 905
 906    ssh_set_blocking(s->session, 1);
 907
 908    sftp_seek64(s->sftp_handle, offset - 1);
 909    ret = sftp_write(s->sftp_handle, c, 1);
 910
 911    ssh_set_blocking(s->session, was_blocking);
 912
 913    if (ret < 0) {
 914        sftp_error_setg(errp, s, "Failed to grow file");
 915        return -EIO;
 916    }
 917
 918    s->attrs->size = offset;
 919    return 0;
 920}
 921
 922static QemuOptsList ssh_create_opts = {
 923    .name = "ssh-create-opts",
 924    .head = QTAILQ_HEAD_INITIALIZER(ssh_create_opts.head),
 925    .desc = {
 926        {
 927            .name = BLOCK_OPT_SIZE,
 928            .type = QEMU_OPT_SIZE,
 929            .help = "Virtual disk size"
 930        },
 931        { /* end of list */ }
 932    }
 933};
 934
 935static int ssh_co_create(BlockdevCreateOptions *options, Error **errp)
 936{
 937    BlockdevCreateOptionsSsh *opts = &options->u.ssh;
 938    BDRVSSHState s;
 939    int ret;
 940
 941    assert(options->driver == BLOCKDEV_DRIVER_SSH);
 942
 943    ssh_state_init(&s);
 944
 945    ret = connect_to_ssh(&s, opts->location,
 946                         O_RDWR | O_CREAT | O_TRUNC,
 947                         0644, errp);
 948    if (ret < 0) {
 949        goto fail;
 950    }
 951
 952    if (opts->size > 0) {
 953        ret = ssh_grow_file(&s, opts->size, errp);
 954        if (ret < 0) {
 955            goto fail;
 956        }
 957    }
 958
 959    ret = 0;
 960fail:
 961    ssh_state_free(&s);
 962    return ret;
 963}
 964
 965static int coroutine_fn ssh_co_create_opts(BlockDriver *drv,
 966                                           const char *filename,
 967                                           QemuOpts *opts,
 968                                           Error **errp)
 969{
 970    BlockdevCreateOptions *create_options;
 971    BlockdevCreateOptionsSsh *ssh_opts;
 972    int ret;
 973    QDict *uri_options = NULL;
 974
 975    create_options = g_new0(BlockdevCreateOptions, 1);
 976    create_options->driver = BLOCKDEV_DRIVER_SSH;
 977    ssh_opts = &create_options->u.ssh;
 978
 979    /* Get desired file size. */
 980    ssh_opts->size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),
 981                              BDRV_SECTOR_SIZE);
 982    trace_ssh_co_create_opts(ssh_opts->size);
 983
 984    uri_options = qdict_new();
 985    ret = parse_uri(filename, uri_options, errp);
 986    if (ret < 0) {
 987        goto out;
 988    }
 989
 990    ssh_opts->location = ssh_parse_options(uri_options, errp);
 991    if (ssh_opts->location == NULL) {
 992        ret = -EINVAL;
 993        goto out;
 994    }
 995
 996    ret = ssh_co_create(create_options, errp);
 997
 998 out:
 999    qobject_unref(uri_options);
1000    qapi_free_BlockdevCreateOptions(create_options);
1001    return ret;
1002}
1003
1004static void ssh_close(BlockDriverState *bs)
1005{
1006    BDRVSSHState *s = bs->opaque;
1007
1008    ssh_state_free(s);
1009}
1010
1011static int ssh_has_zero_init(BlockDriverState *bs)
1012{
1013    BDRVSSHState *s = bs->opaque;
1014    /* Assume false, unless we can positively prove it's true. */
1015    int has_zero_init = 0;
1016
1017    if (s->attrs->type == SSH_FILEXFER_TYPE_REGULAR) {
1018        has_zero_init = 1;
1019    }
1020
1021    return has_zero_init;
1022}
1023
1024typedef struct BDRVSSHRestart {
1025    BlockDriverState *bs;
1026    Coroutine *co;
1027} BDRVSSHRestart;
1028
1029static void restart_coroutine(void *opaque)
1030{
1031    BDRVSSHRestart *restart = opaque;
1032    BlockDriverState *bs = restart->bs;
1033    BDRVSSHState *s = bs->opaque;
1034    AioContext *ctx = bdrv_get_aio_context(bs);
1035
1036    trace_ssh_restart_coroutine(restart->co);
1037    aio_set_fd_handler(ctx, s->sock, false, NULL, NULL, NULL, NULL);
1038
1039    aio_co_wake(restart->co);
1040}
1041
1042/* A non-blocking call returned EAGAIN, so yield, ensuring the
1043 * handlers are set up so that we'll be rescheduled when there is an
1044 * interesting event on the socket.
1045 */
1046static coroutine_fn void co_yield(BDRVSSHState *s, BlockDriverState *bs)
1047{
1048    int r;
1049    IOHandler *rd_handler = NULL, *wr_handler = NULL;
1050    BDRVSSHRestart restart = {
1051        .bs = bs,
1052        .co = qemu_coroutine_self()
1053    };
1054
1055    r = ssh_get_poll_flags(s->session);
1056
1057    if (r & SSH_READ_PENDING) {
1058        rd_handler = restart_coroutine;
1059    }
1060    if (r & SSH_WRITE_PENDING) {
1061        wr_handler = restart_coroutine;
1062    }
1063
1064    trace_ssh_co_yield(s->sock, rd_handler, wr_handler);
1065
1066    aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock,
1067                       false, rd_handler, wr_handler, NULL, &restart);
1068    qemu_coroutine_yield();
1069    trace_ssh_co_yield_back(s->sock);
1070}
1071
1072static coroutine_fn int ssh_read(BDRVSSHState *s, BlockDriverState *bs,
1073                                 int64_t offset, size_t size,
1074                                 QEMUIOVector *qiov)
1075{
1076    ssize_t r;
1077    size_t got;
1078    char *buf, *end_of_vec;
1079    struct iovec *i;
1080
1081    trace_ssh_read(offset, size);
1082
1083    trace_ssh_seek(offset);
1084    sftp_seek64(s->sftp_handle, offset);
1085
1086    /* This keeps track of the current iovec element ('i'), where we
1087     * will write to next ('buf'), and the end of the current iovec
1088     * ('end_of_vec').
1089     */
1090    i = &qiov->iov[0];
1091    buf = i->iov_base;
1092    end_of_vec = i->iov_base + i->iov_len;
1093
1094    for (got = 0; got < size; ) {
1095        size_t request_read_size;
1096    again:
1097        /*
1098         * The size of SFTP packets is limited to 32K bytes, so limit
1099         * the amount of data requested to 16K, as libssh currently
1100         * does not handle multiple requests on its own.
1101         */
1102        request_read_size = MIN(end_of_vec - buf, 16384);
1103        trace_ssh_read_buf(buf, end_of_vec - buf, request_read_size);
1104        r = sftp_read(s->sftp_handle, buf, request_read_size);
1105        trace_ssh_read_return(r, sftp_get_error(s->sftp));
1106
1107        if (r == SSH_AGAIN) {
1108            co_yield(s, bs);
1109            goto again;
1110        }
1111        if (r == SSH_EOF || (r == 0 && sftp_get_error(s->sftp) == SSH_FX_EOF)) {
1112            /* EOF: Short read so pad the buffer with zeroes and return it. */
1113            qemu_iovec_memset(qiov, got, 0, size - got);
1114            return 0;
1115        }
1116        if (r <= 0) {
1117            sftp_error_trace(s, "read");
1118            return -EIO;
1119        }
1120
1121        got += r;
1122        buf += r;
1123        if (buf >= end_of_vec && got < size) {
1124            i++;
1125            buf = i->iov_base;
1126            end_of_vec = i->iov_base + i->iov_len;
1127        }
1128    }
1129
1130    return 0;
1131}
1132
1133static coroutine_fn int ssh_co_readv(BlockDriverState *bs,
1134                                     int64_t sector_num,
1135                                     int nb_sectors, QEMUIOVector *qiov)
1136{
1137    BDRVSSHState *s = bs->opaque;
1138    int ret;
1139
1140    qemu_co_mutex_lock(&s->lock);
1141    ret = ssh_read(s, bs, sector_num * BDRV_SECTOR_SIZE,
1142                   nb_sectors * BDRV_SECTOR_SIZE, qiov);
1143    qemu_co_mutex_unlock(&s->lock);
1144
1145    return ret;
1146}
1147
1148static int ssh_write(BDRVSSHState *s, BlockDriverState *bs,
1149                     int64_t offset, size_t size,
1150                     QEMUIOVector *qiov)
1151{
1152    ssize_t r;
1153    size_t written;
1154    char *buf, *end_of_vec;
1155    struct iovec *i;
1156
1157    trace_ssh_write(offset, size);
1158
1159    trace_ssh_seek(offset);
1160    sftp_seek64(s->sftp_handle, offset);
1161
1162    /* This keeps track of the current iovec element ('i'), where we
1163     * will read from next ('buf'), and the end of the current iovec
1164     * ('end_of_vec').
1165     */
1166    i = &qiov->iov[0];
1167    buf = i->iov_base;
1168    end_of_vec = i->iov_base + i->iov_len;
1169
1170    for (written = 0; written < size; ) {
1171        size_t request_write_size;
1172    again:
1173        /*
1174         * Avoid too large data packets, as libssh currently does not
1175         * handle multiple requests on its own.
1176         */
1177        request_write_size = MIN(end_of_vec - buf, 131072);
1178        trace_ssh_write_buf(buf, end_of_vec - buf, request_write_size);
1179        r = sftp_write(s->sftp_handle, buf, request_write_size);
1180        trace_ssh_write_return(r, sftp_get_error(s->sftp));
1181
1182        if (r == SSH_AGAIN) {
1183            co_yield(s, bs);
1184            goto again;
1185        }
1186        if (r < 0) {
1187            sftp_error_trace(s, "write");
1188            return -EIO;
1189        }
1190
1191        written += r;
1192        buf += r;
1193        if (buf >= end_of_vec && written < size) {
1194            i++;
1195            buf = i->iov_base;
1196            end_of_vec = i->iov_base + i->iov_len;
1197        }
1198
1199        if (offset + written > s->attrs->size) {
1200            s->attrs->size = offset + written;
1201        }
1202    }
1203
1204    return 0;
1205}
1206
1207static coroutine_fn int ssh_co_writev(BlockDriverState *bs,
1208                                      int64_t sector_num,
1209                                      int nb_sectors, QEMUIOVector *qiov,
1210                                      int flags)
1211{
1212    BDRVSSHState *s = bs->opaque;
1213    int ret;
1214
1215    assert(!flags);
1216    qemu_co_mutex_lock(&s->lock);
1217    ret = ssh_write(s, bs, sector_num * BDRV_SECTOR_SIZE,
1218                    nb_sectors * BDRV_SECTOR_SIZE, qiov);
1219    qemu_co_mutex_unlock(&s->lock);
1220
1221    return ret;
1222}
1223
1224static void unsafe_flush_warning(BDRVSSHState *s, const char *what)
1225{
1226    if (!s->unsafe_flush_warning) {
1227        warn_report("ssh server %s does not support fsync",
1228                    s->inet->host);
1229        if (what) {
1230            error_report("to support fsync, you need %s", what);
1231        }
1232        s->unsafe_flush_warning = true;
1233    }
1234}
1235
1236#ifdef HAVE_LIBSSH_0_8
1237
1238static coroutine_fn int ssh_flush(BDRVSSHState *s, BlockDriverState *bs)
1239{
1240    int r;
1241
1242    trace_ssh_flush();
1243
1244    if (!sftp_extension_supported(s->sftp, "fsync@openssh.com", "1")) {
1245        unsafe_flush_warning(s, "OpenSSH >= 6.3");
1246        return 0;
1247    }
1248 again:
1249    r = sftp_fsync(s->sftp_handle);
1250    if (r == SSH_AGAIN) {
1251        co_yield(s, bs);
1252        goto again;
1253    }
1254    if (r < 0) {
1255        sftp_error_trace(s, "fsync");
1256        return -EIO;
1257    }
1258
1259    return 0;
1260}
1261
1262static coroutine_fn int ssh_co_flush(BlockDriverState *bs)
1263{
1264    BDRVSSHState *s = bs->opaque;
1265    int ret;
1266
1267    qemu_co_mutex_lock(&s->lock);
1268    ret = ssh_flush(s, bs);
1269    qemu_co_mutex_unlock(&s->lock);
1270
1271    return ret;
1272}
1273
1274#else /* !HAVE_LIBSSH_0_8 */
1275
1276static coroutine_fn int ssh_co_flush(BlockDriverState *bs)
1277{
1278    BDRVSSHState *s = bs->opaque;
1279
1280    unsafe_flush_warning(s, "libssh >= 0.8.0");
1281    return 0;
1282}
1283
1284#endif /* !HAVE_LIBSSH_0_8 */
1285
1286static int64_t ssh_getlength(BlockDriverState *bs)
1287{
1288    BDRVSSHState *s = bs->opaque;
1289    int64_t length;
1290
1291    /* Note we cannot make a libssh call here. */
1292    length = (int64_t) s->attrs->size;
1293    trace_ssh_getlength(length);
1294
1295    return length;
1296}
1297
1298static int coroutine_fn ssh_co_truncate(BlockDriverState *bs, int64_t offset,
1299                                        bool exact, PreallocMode prealloc,
1300                                        BdrvRequestFlags flags, Error **errp)
1301{
1302    BDRVSSHState *s = bs->opaque;
1303
1304    if (prealloc != PREALLOC_MODE_OFF) {
1305        error_setg(errp, "Unsupported preallocation mode '%s'",
1306                   PreallocMode_str(prealloc));
1307        return -ENOTSUP;
1308    }
1309
1310    if (offset < s->attrs->size) {
1311        error_setg(errp, "ssh driver does not support shrinking files");
1312        return -ENOTSUP;
1313    }
1314
1315    if (offset == s->attrs->size) {
1316        return 0;
1317    }
1318
1319    return ssh_grow_file(s, offset, errp);
1320}
1321
1322static void ssh_refresh_filename(BlockDriverState *bs)
1323{
1324    BDRVSSHState *s = bs->opaque;
1325    const char *path, *host_key_check;
1326    int ret;
1327
1328    /*
1329     * None of these options can be represented in a plain "host:port"
1330     * format, so if any was given, we have to abort.
1331     */
1332    if (s->inet->has_ipv4 || s->inet->has_ipv6 || s->inet->has_to ||
1333        s->inet->has_numeric)
1334    {
1335        return;
1336    }
1337
1338    path = qdict_get_try_str(bs->full_open_options, "path");
1339    assert(path); /* mandatory option */
1340
1341    host_key_check = qdict_get_try_str(bs->full_open_options, "host_key_check");
1342
1343    ret = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
1344                   "ssh://%s@%s:%s%s%s%s",
1345                   s->user, s->inet->host, s->inet->port, path,
1346                   host_key_check ? "?host_key_check=" : "",
1347                   host_key_check ?: "");
1348    if (ret >= sizeof(bs->exact_filename)) {
1349        /* An overflow makes the filename unusable, so do not report any */
1350        bs->exact_filename[0] = '\0';
1351    }
1352}
1353
1354static char *ssh_bdrv_dirname(BlockDriverState *bs, Error **errp)
1355{
1356    if (qdict_haskey(bs->full_open_options, "host_key_check")) {
1357        /*
1358         * We cannot generate a simple prefix if we would have to
1359         * append a query string.
1360         */
1361        error_setg(errp,
1362                   "Cannot generate a base directory with host_key_check set");
1363        return NULL;
1364    }
1365
1366    if (bs->exact_filename[0] == '\0') {
1367        error_setg(errp, "Cannot generate a base directory for this ssh node");
1368        return NULL;
1369    }
1370
1371    return path_combine(bs->exact_filename, "");
1372}
1373
1374static const char *const ssh_strong_runtime_opts[] = {
1375    "host",
1376    "port",
1377    "path",
1378    "user",
1379    "host_key_check",
1380    "server.",
1381
1382    NULL
1383};
1384
1385static BlockDriver bdrv_ssh = {
1386    .format_name                  = "ssh",
1387    .protocol_name                = "ssh",
1388    .instance_size                = sizeof(BDRVSSHState),
1389    .bdrv_parse_filename          = ssh_parse_filename,
1390    .bdrv_file_open               = ssh_file_open,
1391    .bdrv_co_create               = ssh_co_create,
1392    .bdrv_co_create_opts          = ssh_co_create_opts,
1393    .bdrv_close                   = ssh_close,
1394    .bdrv_has_zero_init           = ssh_has_zero_init,
1395    .bdrv_co_readv                = ssh_co_readv,
1396    .bdrv_co_writev               = ssh_co_writev,
1397    .bdrv_getlength               = ssh_getlength,
1398    .bdrv_co_truncate             = ssh_co_truncate,
1399    .bdrv_co_flush_to_disk        = ssh_co_flush,
1400    .bdrv_refresh_filename        = ssh_refresh_filename,
1401    .bdrv_dirname                 = ssh_bdrv_dirname,
1402    .create_opts                  = &ssh_create_opts,
1403    .strong_runtime_opts          = ssh_strong_runtime_opts,
1404};
1405
1406static void bdrv_ssh_init(void)
1407{
1408    int r;
1409
1410    r = ssh_init();
1411    if (r != 0) {
1412        fprintf(stderr, "libssh initialization failed, %d\n", r);
1413        exit(EXIT_FAILURE);
1414    }
1415
1416#if TRACE_LIBSSH != 0
1417    ssh_set_log_level(TRACE_LIBSSH);
1418#endif
1419
1420    bdrv_register(&bdrv_ssh);
1421}
1422
1423block_init(bdrv_ssh_init);
1424