| 1 | /* |
| 2 | * QEMU migration TLS support |
| 3 | * |
| 4 | * Copyright (c) 2015 Red Hat, Inc. |
| 5 | * |
| 6 | * This library is free software; you can redistribute it and/or |
| 7 | * modify it under the terms of the GNU Lesser General Public |
| 8 | * License as published by the Free Software Foundation; either |
| 9 | * version 2.1 of the License, or (at your option) any later version. |
| 10 | * |
| 11 | * This library is distributed in the hope that it will be useful, |
| 12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| 14 | * Lesser General Public License for more details. |
| 15 | * |
| 16 | * You should have received a copy of the GNU Lesser General Public |
| 17 | * License along with this library; if not, see <http://www.gnu.org/licenses/>. |
| 18 | * |
| 19 | */ |
| 20 | |
| 21 | #include "qemu/osdep.h" |
| 22 | #include "channel.h" |
| 23 | #include "migration.h" |
| 24 | #include "tls.h" |
| 25 | #include "options.h" |
| 26 | #include "crypto/tlscreds.h" |
| 27 | #include "qemu/error-report.h" |
| 28 | #include "qapi/error.h" |
| 29 | #include "trace.h" |
| 30 | |
| 31 | static QCryptoTLSCreds * |
| 32 | migration_tls_get_creds(QCryptoTLSCredsEndpoint endpoint, Error **errp) |
| 33 | { |
| 34 | Object *creds; |
| 35 | const char *tls_creds = migrate_tls_creds(); |
| 36 | QCryptoTLSCreds *ret; |
| 37 | |
| 38 | creds = object_resolve_path_component(object_get_objects_root(), tls_creds); |
| 39 | if (!creds) { |
| 40 | error_setg(errp, "No TLS credentials with id '%s'", tls_creds); |
| 41 | return NULL; |
| 42 | } |
| 43 | ret = (QCryptoTLSCreds *)object_dynamic_cast( |
| 44 | creds, TYPE_QCRYPTO_TLS_CREDS); |
| 45 | if (!ret) { |
| 46 | error_setg(errp, "Object with id '%s' is not TLS credentials", |
| 47 | tls_creds); |
| 48 | return NULL; |
| 49 | } |
| 50 | if (!qcrypto_tls_creds_check_endpoint(ret, endpoint, errp)) { |
| 51 | return NULL; |
| 52 | } |
| 53 | |
| 54 | return ret; |
| 55 | } |
| 56 | |
| 57 | |
| 58 | static void migration_tls_incoming_handshake(QIOTask *task, |
| 59 | gpointer opaque) |
| 60 | { |
| 61 | QIOChannel *ioc = QIO_CHANNEL(qio_task_get_source(task)); |
| 62 | Error *err = NULL; |
| 63 | |
| 64 | if (qio_task_propagate_error(task, &err)) { |
| 65 | trace_migration_tls_incoming_handshake_error(error_get_pretty(err)); |
| 66 | error_report_err(err); |
| 67 | } else { |
| 68 | trace_migration_tls_incoming_handshake_complete(); |
| 69 | migration_channel_process_incoming(ioc); |
| 70 | } |
| 71 | object_unref(OBJECT(ioc)); |
| 72 | } |
| 73 | |
| 74 | void migration_tls_channel_process_incoming(QIOChannel *ioc, Error **errp) |
| 75 | { |
| 76 | QCryptoTLSCreds *creds; |
| 77 | QIOChannelTLS *tioc; |
| 78 | |
| 79 | creds = migration_tls_get_creds(QCRYPTO_TLS_CREDS_ENDPOINT_SERVER, errp); |
| 80 | if (!creds) { |
| 81 | return; |
| 82 | } |
| 83 | |
| 84 | tioc = qio_channel_tls_new_server(ioc, creds, migrate_tls_authz(), errp); |
| 85 | if (!tioc) { |
| 86 | return; |
| 87 | } |
| 88 | |
| 89 | trace_migration_tls_incoming_handshake_start(); |
| 90 | qio_channel_set_name(QIO_CHANNEL(tioc), "migration-tls-incoming"); |
| 91 | if (migrate_postcopy_ram() || migrate_return_path()) { |
| 92 | qio_channel_set_feature(QIO_CHANNEL(tioc), |
| 93 | QIO_CHANNEL_FEATURE_CONCURRENT_IO); |
| 94 | } |
| 95 | qio_channel_tls_handshake(tioc, |
| 96 | migration_tls_incoming_handshake, |
| 97 | NULL, |
| 98 | NULL, |
| 99 | NULL); |
| 100 | } |
| 101 | |
| 102 | |
| 103 | static void migration_tls_outgoing_handshake(QIOTask *task, |
| 104 | gpointer opaque) |
| 105 | { |
| 106 | MigrationState *s = opaque; |
| 107 | g_autoptr(QIOChannel) ioc = QIO_CHANNEL(qio_task_get_source(task)); |
| 108 | Error *err = NULL; |
| 109 | |
| 110 | if (qio_task_propagate_error(task, &err)) { |
| 111 | trace_migration_tls_outgoing_handshake_error(error_get_pretty(err)); |
| 112 | migration_connect_error_propagate(s, err); |
| 113 | return; |
| 114 | } |
| 115 | |
| 116 | trace_migration_tls_outgoing_handshake_complete(); |
| 117 | migration_channel_connect_outgoing(s, ioc); |
| 118 | } |
| 119 | |
| 120 | QIOChannelTLS *migration_tls_client_create(QIOChannel *ioc, |
| 121 | Error **errp) |
| 122 | { |
| 123 | QCryptoTLSCreds *creds; |
| 124 | |
| 125 | creds = migration_tls_get_creds(QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT, errp); |
| 126 | if (!creds) { |
| 127 | return NULL; |
| 128 | } |
| 129 | |
| 130 | return qio_channel_tls_new_client(ioc, creds, migrate_tls_hostname(), errp); |
| 131 | } |
| 132 | |
| 133 | void migration_tls_channel_connect(MigrationState *s, QIOChannel *ioc, |
| 134 | Error **errp) |
| 135 | { |
| 136 | QIOChannelTLS *tioc; |
| 137 | |
| 138 | tioc = migration_tls_client_create(ioc, errp); |
| 139 | if (!tioc) { |
| 140 | return; |
| 141 | } |
| 142 | |
| 143 | trace_migration_tls_outgoing_handshake_start(); |
| 144 | qio_channel_set_name(QIO_CHANNEL(tioc), "migration-tls-outgoing"); |
| 145 | |
| 146 | if (migrate_postcopy_ram() || migrate_return_path()) { |
| 147 | qio_channel_set_feature(QIO_CHANNEL(tioc), |
| 148 | QIO_CHANNEL_FEATURE_CONCURRENT_IO); |
| 149 | } |
| 150 | qio_channel_tls_handshake(tioc, |
| 151 | migration_tls_outgoing_handshake, |
| 152 | s, |
| 153 | NULL, |
| 154 | NULL); |
| 155 | } |
| 156 | |
| 157 | void migration_tls_channel_end(QIOChannel *ioc, Error **errp) |
| 158 | { |
| 159 | qio_channel_tls_bye(QIO_CHANNEL_TLS(ioc), errp); |
| 160 | } |
| 161 | |
| 162 | bool migrate_channel_requires_tls_upgrade(QIOChannel *ioc) |
| 163 | { |
| 164 | if (!migrate_tls()) { |
| 165 | return false; |
| 166 | } |
| 167 | |
| 168 | return !object_dynamic_cast(OBJECT(ioc), TYPE_QIO_CHANNEL_TLS); |
| 169 | } |