]>
Commit | Line | Data |
---|---|---|
e1226365 DB |
1 | /* |
2 | * QEMU migration TLS support | |
3 | * | |
4 | * Copyright (c) 2015 Red Hat, Inc. | |
5 | * | |
6 | * This library is free software; you can redistribute it and/or | |
7 | * modify it under the terms of the GNU Lesser General Public | |
8 | * License as published by the Free Software Foundation; either | |
ef19b50d | 9 | * version 2.1 of the License, or (at your option) any later version. |
e1226365 DB |
10 | * |
11 | * This library is distributed in the hope that it will be useful, | |
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
14 | * Lesser General Public License for more details. | |
15 | * | |
16 | * You should have received a copy of the GNU Lesser General Public | |
17 | * License along with this library; if not, see <http://www.gnu.org/licenses/>. | |
18 | * | |
19 | */ | |
20 | ||
21 | #include "qemu/osdep.h" | |
dd4339c5 | 22 | #include "channel.h" |
6666c96a | 23 | #include "migration.h" |
41d64227 | 24 | #include "tls.h" |
10d4703b | 25 | #include "options.h" |
e1226365 DB |
26 | #include "crypto/tlscreds.h" |
27 | #include "qemu/error-report.h" | |
28 | #include "qapi/error.h" | |
29 | #include "trace.h" | |
30 | ||
31 | static QCryptoTLSCreds * | |
3f461a0c | 32 | migration_tls_get_creds(QCryptoTLSCredsEndpoint endpoint, Error **errp) |
e1226365 DB |
33 | { |
34 | Object *creds; | |
d5c3e195 | 35 | const char *tls_creds = migrate_tls_creds(); |
e1226365 DB |
36 | QCryptoTLSCreds *ret; |
37 | ||
d5c3e195 | 38 | creds = object_resolve_path_component(object_get_objects_root(), tls_creds); |
e1226365 | 39 | if (!creds) { |
d5c3e195 | 40 | error_setg(errp, "No TLS credentials with id '%s'", tls_creds); |
e1226365 DB |
41 | return NULL; |
42 | } | |
43 | ret = (QCryptoTLSCreds *)object_dynamic_cast( | |
44 | creds, TYPE_QCRYPTO_TLS_CREDS); | |
45 | if (!ret) { | |
46 | error_setg(errp, "Object with id '%s' is not TLS credentials", | |
d5c3e195 | 47 | tls_creds); |
e1226365 DB |
48 | return NULL; |
49 | } | |
5590f65f | 50 | if (!qcrypto_tls_creds_check_endpoint(ret, endpoint, errp)) { |
e1226365 DB |
51 | return NULL; |
52 | } | |
53 | ||
e1226365 DB |
54 | return ret; |
55 | } | |
56 | ||
57 | ||
60e705c5 | 58 | static void migration_tls_incoming_handshake(QIOTask *task, |
e1226365 DB |
59 | gpointer opaque) |
60 | { | |
60e705c5 DB |
61 | QIOChannel *ioc = QIO_CHANNEL(qio_task_get_source(task)); |
62 | Error *err = NULL; | |
e1226365 | 63 | |
60e705c5 | 64 | if (qio_task_propagate_error(task, &err)) { |
e1226365 | 65 | trace_migration_tls_incoming_handshake_error(error_get_pretty(err)); |
60e705c5 | 66 | error_report_err(err); |
e1226365 DB |
67 | } else { |
68 | trace_migration_tls_incoming_handshake_complete(); | |
54314711 | 69 | migration_channel_process_incoming(ioc); |
e1226365 DB |
70 | } |
71 | object_unref(OBJECT(ioc)); | |
72 | } | |
73 | ||
22724f49 DB |
74 | void migration_tls_channel_process_incoming(MigrationState *s, |
75 | QIOChannel *ioc, | |
76 | Error **errp) | |
e1226365 DB |
77 | { |
78 | QCryptoTLSCreds *creds; | |
79 | QIOChannelTLS *tioc; | |
80 | ||
3f461a0c | 81 | creds = migration_tls_get_creds(QCRYPTO_TLS_CREDS_ENDPOINT_SERVER, errp); |
e1226365 DB |
82 | if (!creds) { |
83 | return; | |
84 | } | |
85 | ||
2eb0308b | 86 | tioc = qio_channel_tls_new_server(ioc, creds, migrate_tls_authz(), errp); |
e1226365 DB |
87 | if (!tioc) { |
88 | return; | |
89 | } | |
90 | ||
91 | trace_migration_tls_incoming_handshake_start(); | |
6f01f136 | 92 | qio_channel_set_name(QIO_CHANNEL(tioc), "migration-tls-incoming"); |
e1226365 DB |
93 | qio_channel_tls_handshake(tioc, |
94 | migration_tls_incoming_handshake, | |
95 | NULL, | |
1939ccda | 96 | NULL, |
e1226365 DB |
97 | NULL); |
98 | } | |
99 | ||
100 | ||
60e705c5 | 101 | static void migration_tls_outgoing_handshake(QIOTask *task, |
e1226365 DB |
102 | gpointer opaque) |
103 | { | |
104 | MigrationState *s = opaque; | |
60e705c5 DB |
105 | QIOChannel *ioc = QIO_CHANNEL(qio_task_get_source(task)); |
106 | Error *err = NULL; | |
e1226365 | 107 | |
60e705c5 | 108 | if (qio_task_propagate_error(task, &err)) { |
e1226365 | 109 | trace_migration_tls_outgoing_handshake_error(error_get_pretty(err)); |
e1226365 DB |
110 | } else { |
111 | trace_migration_tls_outgoing_handshake_complete(); | |
e1226365 | 112 | } |
688a3dcb | 113 | migration_channel_connect(s, ioc, NULL, err); |
e1226365 DB |
114 | object_unref(OBJECT(ioc)); |
115 | } | |
116 | ||
0deb7e9b | 117 | QIOChannelTLS *migration_tls_client_create(QIOChannel *ioc, |
bfb790e7 CZ |
118 | const char *hostname, |
119 | Error **errp) | |
e1226365 DB |
120 | { |
121 | QCryptoTLSCreds *creds; | |
e1226365 | 122 | |
3f461a0c | 123 | creds = migration_tls_get_creds(QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT, errp); |
e1226365 | 124 | if (!creds) { |
bfb790e7 | 125 | return NULL; |
e1226365 DB |
126 | } |
127 | ||
1f2f366c JQ |
128 | const char *tls_hostname = migrate_tls_hostname(); |
129 | if (tls_hostname && *tls_hostname) { | |
130 | hostname = tls_hostname; | |
e1226365 | 131 | } |
e1226365 | 132 | |
66997c42 | 133 | return qio_channel_tls_new_client(ioc, creds, hostname, errp); |
bfb790e7 CZ |
134 | } |
135 | ||
136 | void migration_tls_channel_connect(MigrationState *s, | |
137 | QIOChannel *ioc, | |
138 | const char *hostname, | |
139 | Error **errp) | |
140 | { | |
141 | QIOChannelTLS *tioc; | |
142 | ||
0deb7e9b | 143 | tioc = migration_tls_client_create(ioc, hostname, errp); |
e1226365 DB |
144 | if (!tioc) { |
145 | return; | |
146 | } | |
147 | ||
d8053e73 CZ |
148 | /* Save hostname into MigrationState for handshake */ |
149 | s->hostname = g_strdup(hostname); | |
e1226365 | 150 | trace_migration_tls_outgoing_handshake_start(hostname); |
6f01f136 | 151 | qio_channel_set_name(QIO_CHANNEL(tioc), "migration-tls-outgoing"); |
e1226365 DB |
152 | qio_channel_tls_handshake(tioc, |
153 | migration_tls_outgoing_handshake, | |
154 | s, | |
1939ccda | 155 | NULL, |
e1226365 DB |
156 | NULL); |
157 | } | |
85a8578e PX |
158 | |
159 | bool migrate_channel_requires_tls_upgrade(QIOChannel *ioc) | |
160 | { | |
10d4703b | 161 | if (!migrate_tls()) { |
85a8578e PX |
162 | return false; |
163 | } | |
164 | ||
165 | return !object_dynamic_cast(OBJECT(ioc), TYPE_QIO_CHANNEL_TLS); | |
166 | } |