2 * QEMU I/O channels TLS driver
4 * Copyright (c) 2015 Red Hat, Inc.
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "qemu/module.h"
24 #include "io/channel-tls.h"
26 #include "qemu/atomic.h"
29 static ssize_t qio_channel_tls_write_handler(const char *buf,
33 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
36 ret = qio_channel_write(tioc->master, buf, len, NULL);
37 if (ret == QIO_CHANNEL_ERR_BLOCK) {
47 static ssize_t qio_channel_tls_read_handler(char *buf,
51 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
54 ret = qio_channel_read(tioc->master, buf, len, NULL);
55 if (ret == QIO_CHANNEL_ERR_BLOCK) {
67 qio_channel_tls_new_server(QIOChannel *master,
68 QCryptoTLSCreds *creds,
74 ioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
77 if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
78 qio_channel_set_feature(QIO_CHANNEL(ioc), QIO_CHANNEL_FEATURE_SHUTDOWN);
80 object_ref(OBJECT(master));
82 ioc->session = qcrypto_tls_session_new(
86 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
92 qcrypto_tls_session_set_callbacks(
94 qio_channel_tls_write_handler,
95 qio_channel_tls_read_handler,
98 trace_qio_channel_tls_new_server(ioc, master, creds, aclname);
102 object_unref(OBJECT(ioc));
107 qio_channel_tls_new_client(QIOChannel *master,
108 QCryptoTLSCreds *creds,
109 const char *hostname,
115 tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
116 ioc = QIO_CHANNEL(tioc);
118 tioc->master = master;
119 if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
120 qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
122 object_ref(OBJECT(master));
124 tioc->session = qcrypto_tls_session_new(
128 QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT,
130 if (!tioc->session) {
134 qcrypto_tls_session_set_callbacks(
136 qio_channel_tls_write_handler,
137 qio_channel_tls_read_handler,
140 trace_qio_channel_tls_new_client(tioc, master, creds, hostname);
144 object_unref(OBJECT(tioc));
148 struct QIOChannelTLSData {
150 GMainContext *context;
152 typedef struct QIOChannelTLSData QIOChannelTLSData;
154 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
155 GIOCondition condition,
158 static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
160 GMainContext *context)
163 QCryptoTLSSessionHandshakeStatus status;
165 if (qcrypto_tls_session_handshake(ioc->session, &err) < 0) {
166 trace_qio_channel_tls_handshake_fail(ioc);
167 qio_task_set_error(task, err);
168 qio_task_complete(task);
172 status = qcrypto_tls_session_get_handshake_status(ioc->session);
173 if (status == QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
174 trace_qio_channel_tls_handshake_complete(ioc);
175 if (qcrypto_tls_session_check_credentials(ioc->session,
177 trace_qio_channel_tls_credentials_deny(ioc);
178 qio_task_set_error(task, err);
180 trace_qio_channel_tls_credentials_allow(ioc);
182 qio_task_complete(task);
184 GIOCondition condition;
185 QIOChannelTLSData *data = g_new0(typeof(*data), 1);
188 data->context = context;
191 g_main_context_ref(context);
194 if (status == QCRYPTO_TLS_HANDSHAKE_SENDING) {
195 condition = G_IO_OUT;
200 trace_qio_channel_tls_handshake_pending(ioc, status);
202 qio_channel_add_watch_full(ioc->master,
204 qio_channel_tls_handshake_io,
212 static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
213 GIOCondition condition,
216 QIOChannelTLSData *data = user_data;
217 QIOTask *task = data->task;
218 GMainContext *context = data->context;
219 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(
220 qio_task_get_source(task));
222 tioc->hs_ioc_tag = 0;
224 qio_channel_tls_handshake_task(tioc, task, context);
227 g_main_context_unref(context);
233 void qio_channel_tls_handshake(QIOChannelTLS *ioc,
236 GDestroyNotify destroy,
237 GMainContext *context)
241 task = qio_task_new(OBJECT(ioc),
242 func, opaque, destroy);
244 trace_qio_channel_tls_handshake_start(ioc);
245 qio_channel_tls_handshake_task(ioc, task, context);
249 static void qio_channel_tls_init(Object *obj G_GNUC_UNUSED)
254 static void qio_channel_tls_finalize(Object *obj)
256 QIOChannelTLS *ioc = QIO_CHANNEL_TLS(obj);
258 object_unref(OBJECT(ioc->master));
259 qcrypto_tls_session_free(ioc->session);
263 static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
264 const struct iovec *iov,
271 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
275 for (i = 0 ; i < niov ; i++) {
276 ssize_t ret = qcrypto_tls_session_read(tioc->session,
280 if (errno == EAGAIN) {
284 return QIO_CHANNEL_ERR_BLOCK;
286 } else if (errno == ECONNABORTED &&
287 (qatomic_load_acquire(&tioc->shutdown) &
288 QIO_CHANNEL_SHUTDOWN_READ)) {
292 error_setg_errno(errp, errno,
293 "Cannot read from TLS channel");
297 if (ret < iov[i].iov_len) {
305 static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
306 const struct iovec *iov,
313 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
317 for (i = 0 ; i < niov ; i++) {
318 ssize_t ret = qcrypto_tls_session_write(tioc->session,
322 if (errno == EAGAIN) {
326 return QIO_CHANNEL_ERR_BLOCK;
330 error_setg_errno(errp, errno,
331 "Cannot write to TLS channel");
335 if (ret < iov[i].iov_len) {
342 static int qio_channel_tls_set_blocking(QIOChannel *ioc,
346 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
348 return qio_channel_set_blocking(tioc->master, enabled, errp);
351 static void qio_channel_tls_set_delay(QIOChannel *ioc,
354 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
356 qio_channel_set_delay(tioc->master, enabled);
359 static void qio_channel_tls_set_cork(QIOChannel *ioc,
362 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
364 qio_channel_set_cork(tioc->master, enabled);
367 static int qio_channel_tls_shutdown(QIOChannel *ioc,
368 QIOChannelShutdown how,
371 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
373 qatomic_or(&tioc->shutdown, how);
375 return qio_channel_shutdown(tioc->master, how, errp);
378 static int qio_channel_tls_close(QIOChannel *ioc,
381 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
383 if (tioc->hs_ioc_tag) {
384 g_clear_handle_id(&tioc->hs_ioc_tag, g_source_remove);
387 return qio_channel_close(tioc->master, errp);
390 static void qio_channel_tls_set_aio_fd_handler(QIOChannel *ioc,
391 AioContext *read_ctx,
393 AioContext *write_ctx,
397 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
399 qio_channel_set_aio_fd_handler(tioc->master, read_ctx, io_read,
400 write_ctx, io_write, opaque);
403 typedef struct QIOChannelTLSSource QIOChannelTLSSource;
404 struct QIOChannelTLSSource {
410 qio_channel_tls_source_check(GSource *source)
412 QIOChannelTLSSource *tsource = (QIOChannelTLSSource *)source;
414 return qcrypto_tls_session_check_pending(tsource->tioc->session) > 0;
418 qio_channel_tls_source_prepare(GSource *source, gint *timeout)
421 return qio_channel_tls_source_check(source);
425 qio_channel_tls_source_dispatch(GSource *source, GSourceFunc callback,
428 return G_SOURCE_CONTINUE;
432 qio_channel_tls_source_finalize(GSource *source)
434 QIOChannelTLSSource *tsource = (QIOChannelTLSSource *)source;
436 object_unref(OBJECT(tsource->tioc));
439 static GSourceFuncs qio_channel_tls_source_funcs = {
440 qio_channel_tls_source_prepare,
441 qio_channel_tls_source_check,
442 qio_channel_tls_source_dispatch,
443 qio_channel_tls_source_finalize
447 qio_channel_tls_read_watch(QIOChannelTLS *tioc, GSource *source)
450 QIOChannelTLSSource *tlssource;
452 child = g_source_new(&qio_channel_tls_source_funcs,
453 sizeof(QIOChannelTLSSource));
454 tlssource = (QIOChannelTLSSource *)child;
456 tlssource->tioc = tioc;
457 object_ref(OBJECT(tioc));
459 g_source_add_child_source(source, child);
460 g_source_unref(child);
463 static GSource *qio_channel_tls_create_watch(QIOChannel *ioc,
464 GIOCondition condition)
466 QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
467 GSource *source = qio_channel_create_watch(tioc->master, condition);
469 if (condition & G_IO_IN) {
470 qio_channel_tls_read_watch(tioc, source);
477 qio_channel_tls_get_session(QIOChannelTLS *ioc)
482 static void qio_channel_tls_class_init(ObjectClass *klass,
483 void *class_data G_GNUC_UNUSED)
485 QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
487 ioc_klass->io_writev = qio_channel_tls_writev;
488 ioc_klass->io_readv = qio_channel_tls_readv;
489 ioc_klass->io_set_blocking = qio_channel_tls_set_blocking;
490 ioc_klass->io_set_delay = qio_channel_tls_set_delay;
491 ioc_klass->io_set_cork = qio_channel_tls_set_cork;
492 ioc_klass->io_close = qio_channel_tls_close;
493 ioc_klass->io_shutdown = qio_channel_tls_shutdown;
494 ioc_klass->io_create_watch = qio_channel_tls_create_watch;
495 ioc_klass->io_set_aio_fd_handler = qio_channel_tls_set_aio_fd_handler;
498 static const TypeInfo qio_channel_tls_info = {
499 .parent = TYPE_QIO_CHANNEL,
500 .name = TYPE_QIO_CHANNEL_TLS,
501 .instance_size = sizeof(QIOChannelTLS),
502 .instance_init = qio_channel_tls_init,
503 .instance_finalize = qio_channel_tls_finalize,
504 .class_init = qio_channel_tls_class_init,
507 static void qio_channel_tls_register_types(void)
509 type_register_static(&qio_channel_tls_info);
512 type_init(qio_channel_tls_register_types);