Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 1 | /* |
| 2 | * QEMU migration TLS support |
| 3 | * |
| 4 | * Copyright (c) 2015 Red Hat, Inc. |
| 5 | * |
| 6 | * This library is free software; you can redistribute it and/or |
| 7 | * modify it under the terms of the GNU Lesser General Public |
| 8 | * License as published by the Free Software Foundation; either |
Chetan Pant | ef19b50 | 2020-10-23 12:31:30 +0000 | [diff] [blame] | 9 | * version 2.1 of the License, or (at your option) any later version. |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 10 | * |
| 11 | * This library is distributed in the hope that it will be useful, |
| 12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| 14 | * Lesser General Public License for more details. |
| 15 | * |
| 16 | * You should have received a copy of the GNU Lesser General Public |
| 17 | * License along with this library; if not, see <http://www.gnu.org/licenses/>. |
| 18 | * |
| 19 | */ |
| 20 | |
| 21 | #include "qemu/osdep.h" |
Juan Quintela | dd4339c | 2017-04-17 17:07:04 +0200 | [diff] [blame] | 22 | #include "channel.h" |
Juan Quintela | 6666c96 | 2017-04-24 20:07:27 +0200 | [diff] [blame] | 23 | #include "migration.h" |
Juan Quintela | 41d6422 | 2017-04-05 17:45:16 +0200 | [diff] [blame] | 24 | #include "tls.h" |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 25 | #include "crypto/tlscreds.h" |
| 26 | #include "qemu/error-report.h" |
| 27 | #include "qapi/error.h" |
| 28 | #include "trace.h" |
| 29 | |
| 30 | static QCryptoTLSCreds * |
| 31 | migration_tls_get_creds(MigrationState *s, |
| 32 | QCryptoTLSCredsEndpoint endpoint, |
| 33 | Error **errp) |
| 34 | { |
| 35 | Object *creds; |
| 36 | QCryptoTLSCreds *ret; |
| 37 | |
| 38 | creds = object_resolve_path_component( |
| 39 | object_get_objects_root(), s->parameters.tls_creds); |
| 40 | if (!creds) { |
| 41 | error_setg(errp, "No TLS credentials with id '%s'", |
| 42 | s->parameters.tls_creds); |
| 43 | return NULL; |
| 44 | } |
| 45 | ret = (QCryptoTLSCreds *)object_dynamic_cast( |
| 46 | creds, TYPE_QCRYPTO_TLS_CREDS); |
| 47 | if (!ret) { |
| 48 | error_setg(errp, "Object with id '%s' is not TLS credentials", |
| 49 | s->parameters.tls_creds); |
| 50 | return NULL; |
| 51 | } |
Philippe Mathieu-Daudé | 5590f65 | 2021-06-28 18:09:12 +0200 | [diff] [blame] | 52 | if (!qcrypto_tls_creds_check_endpoint(ret, endpoint, errp)) { |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 53 | return NULL; |
| 54 | } |
| 55 | |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 56 | return ret; |
| 57 | } |
| 58 | |
| 59 | |
Daniel P. Berrange | 60e705c | 2016-08-11 15:20:58 +0100 | [diff] [blame] | 60 | static void migration_tls_incoming_handshake(QIOTask *task, |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 61 | gpointer opaque) |
| 62 | { |
Daniel P. Berrange | 60e705c | 2016-08-11 15:20:58 +0100 | [diff] [blame] | 63 | QIOChannel *ioc = QIO_CHANNEL(qio_task_get_source(task)); |
| 64 | Error *err = NULL; |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 65 | |
Daniel P. Berrange | 60e705c | 2016-08-11 15:20:58 +0100 | [diff] [blame] | 66 | if (qio_task_propagate_error(task, &err)) { |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 67 | trace_migration_tls_incoming_handshake_error(error_get_pretty(err)); |
Daniel P. Berrange | 60e705c | 2016-08-11 15:20:58 +0100 | [diff] [blame] | 68 | error_report_err(err); |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 69 | } else { |
| 70 | trace_migration_tls_incoming_handshake_complete(); |
Juan Quintela | 5431471 | 2017-04-17 17:15:02 +0200 | [diff] [blame] | 71 | migration_channel_process_incoming(ioc); |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 72 | } |
| 73 | object_unref(OBJECT(ioc)); |
| 74 | } |
| 75 | |
Daniel P. Berrange | 22724f4 | 2016-06-01 11:17:14 +0100 | [diff] [blame] | 76 | void migration_tls_channel_process_incoming(MigrationState *s, |
| 77 | QIOChannel *ioc, |
| 78 | Error **errp) |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 79 | { |
| 80 | QCryptoTLSCreds *creds; |
| 81 | QIOChannelTLS *tioc; |
| 82 | |
| 83 | creds = migration_tls_get_creds( |
| 84 | s, QCRYPTO_TLS_CREDS_ENDPOINT_SERVER, errp); |
| 85 | if (!creds) { |
| 86 | return; |
| 87 | } |
| 88 | |
| 89 | tioc = qio_channel_tls_new_server( |
| 90 | ioc, creds, |
Daniel P. Berrange | d2f1d29 | 2019-02-27 14:53:24 +0000 | [diff] [blame] | 91 | s->parameters.tls_authz, |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 92 | errp); |
| 93 | if (!tioc) { |
| 94 | return; |
| 95 | } |
| 96 | |
| 97 | trace_migration_tls_incoming_handshake_start(); |
Daniel P. Berrange | 6f01f13 | 2016-09-30 11:57:14 +0100 | [diff] [blame] | 98 | qio_channel_set_name(QIO_CHANNEL(tioc), "migration-tls-incoming"); |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 99 | qio_channel_tls_handshake(tioc, |
| 100 | migration_tls_incoming_handshake, |
| 101 | NULL, |
Peter Xu | 1939ccd | 2018-03-05 14:43:24 +0800 | [diff] [blame] | 102 | NULL, |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 103 | NULL); |
| 104 | } |
| 105 | |
| 106 | |
Daniel P. Berrange | 60e705c | 2016-08-11 15:20:58 +0100 | [diff] [blame] | 107 | static void migration_tls_outgoing_handshake(QIOTask *task, |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 108 | gpointer opaque) |
| 109 | { |
| 110 | MigrationState *s = opaque; |
Daniel P. Berrange | 60e705c | 2016-08-11 15:20:58 +0100 | [diff] [blame] | 111 | QIOChannel *ioc = QIO_CHANNEL(qio_task_get_source(task)); |
| 112 | Error *err = NULL; |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 113 | |
Daniel P. Berrange | 60e705c | 2016-08-11 15:20:58 +0100 | [diff] [blame] | 114 | if (qio_task_propagate_error(task, &err)) { |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 115 | trace_migration_tls_outgoing_handshake_error(error_get_pretty(err)); |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 116 | } else { |
| 117 | trace_migration_tls_outgoing_handshake_complete(); |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 118 | } |
Dr. David Alan Gilbert | 688a3dc | 2017-12-15 17:16:55 +0000 | [diff] [blame] | 119 | migration_channel_connect(s, ioc, NULL, err); |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 120 | object_unref(OBJECT(ioc)); |
| 121 | } |
| 122 | |
Chuan Zheng | bfb790e | 2020-09-15 11:03:58 +0800 | [diff] [blame] | 123 | QIOChannelTLS *migration_tls_client_create(MigrationState *s, |
| 124 | QIOChannel *ioc, |
| 125 | const char *hostname, |
| 126 | Error **errp) |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 127 | { |
| 128 | QCryptoTLSCreds *creds; |
| 129 | QIOChannelTLS *tioc; |
| 130 | |
| 131 | creds = migration_tls_get_creds( |
| 132 | s, QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT, errp); |
| 133 | if (!creds) { |
Chuan Zheng | bfb790e | 2020-09-15 11:03:58 +0800 | [diff] [blame] | 134 | return NULL; |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 135 | } |
| 136 | |
Daniel P. Berrange | 4af245d | 2017-03-15 16:16:03 +0000 | [diff] [blame] | 137 | if (s->parameters.tls_hostname && *s->parameters.tls_hostname) { |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 138 | hostname = s->parameters.tls_hostname; |
| 139 | } |
| 140 | if (!hostname) { |
| 141 | error_setg(errp, "No hostname available for TLS"); |
Chuan Zheng | bfb790e | 2020-09-15 11:03:58 +0800 | [diff] [blame] | 142 | return NULL; |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 143 | } |
| 144 | |
| 145 | tioc = qio_channel_tls_new_client( |
| 146 | ioc, creds, hostname, errp); |
Chuan Zheng | bfb790e | 2020-09-15 11:03:58 +0800 | [diff] [blame] | 147 | |
| 148 | return tioc; |
| 149 | } |
| 150 | |
| 151 | void migration_tls_channel_connect(MigrationState *s, |
| 152 | QIOChannel *ioc, |
| 153 | const char *hostname, |
| 154 | Error **errp) |
| 155 | { |
| 156 | QIOChannelTLS *tioc; |
| 157 | |
| 158 | tioc = migration_tls_client_create(s, ioc, hostname, errp); |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 159 | if (!tioc) { |
| 160 | return; |
| 161 | } |
| 162 | |
Chuan Zheng | d8053e7 | 2020-09-15 11:03:57 +0800 | [diff] [blame] | 163 | /* Save hostname into MigrationState for handshake */ |
| 164 | s->hostname = g_strdup(hostname); |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 165 | trace_migration_tls_outgoing_handshake_start(hostname); |
Daniel P. Berrange | 6f01f13 | 2016-09-30 11:57:14 +0100 | [diff] [blame] | 166 | qio_channel_set_name(QIO_CHANNEL(tioc), "migration-tls-outgoing"); |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 167 | qio_channel_tls_handshake(tioc, |
| 168 | migration_tls_outgoing_handshake, |
| 169 | s, |
Peter Xu | 1939ccd | 2018-03-05 14:43:24 +0800 | [diff] [blame] | 170 | NULL, |
Daniel P. Berrange | e122636 | 2016-04-27 11:05:16 +0100 | [diff] [blame] | 171 | NULL); |
| 172 | } |