mirror of
https://gitlab.com/qemu-project/qemu
synced 2024-11-05 20:35:44 +00:00
199e84de1c
Since qemu 8.2, the combination of NBD + TLS + iothread crashes on an
assertion failure:
qemu-kvm: ../io/channel.c:534: void qio_channel_restart_read(void *): Assertion `qemu_get_current_aio_context() == qemu_coroutine_get_aio_context(co)' failed.
It turns out that when we removed AioContext locking, we did so by
having NBD tell its qio channels that it wanted to opt in to
qio_channel_set_follow_coroutine_ctx(); but while we opted in on the
main channel, we did not opt in on the TLS wrapper channel.
qemu-iotests has coverage of NBD+iothread and NBD+TLS, but apparently
no coverage of NBD+TLS+iothread, or we would have noticed this
regression sooner. (I'll add that in the next patch)
But while we could manually opt in to the TLS channel in nbd/server.c
(a one-line change), it is more generic if all qio channels that wrap
other channels inherit the follow status, in the same way that they
inherit feature bits.
CC: Stefan Hajnoczi <stefanha@redhat.com>
CC: Daniel P. Berrangé <berrange@redhat.com>
CC: qemu-stable@nongnu.org
Fixes: https://issues.redhat.com/browse/RHEL-34786
Fixes: 06e0f098 ("io: follow coroutine AioContext in qio_channel_yield()", v8.2.0)
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20240518025246.791593-5-eblake@redhat.com>
517 lines
15 KiB
C
517 lines
15 KiB
C
/*
|
|
* QEMU I/O channels TLS driver
|
|
*
|
|
* Copyright (c) 2015 Red Hat, Inc.
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library; if not, see <http://www.gnu.org/licenses/>.
|
|
*
|
|
*/
|
|
|
|
#include "qemu/osdep.h"
|
|
#include "qapi/error.h"
|
|
#include "qemu/module.h"
|
|
#include "io/channel-tls.h"
|
|
#include "trace.h"
|
|
#include "qemu/atomic.h"
|
|
|
|
|
|
static ssize_t qio_channel_tls_write_handler(const char *buf,
|
|
size_t len,
|
|
void *opaque)
|
|
{
|
|
QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
|
|
ssize_t ret;
|
|
|
|
ret = qio_channel_write(tioc->master, buf, len, NULL);
|
|
if (ret == QIO_CHANNEL_ERR_BLOCK) {
|
|
errno = EAGAIN;
|
|
return -1;
|
|
} else if (ret < 0) {
|
|
errno = EIO;
|
|
return -1;
|
|
}
|
|
return ret;
|
|
}
|
|
|
|
static ssize_t qio_channel_tls_read_handler(char *buf,
|
|
size_t len,
|
|
void *opaque)
|
|
{
|
|
QIOChannelTLS *tioc = QIO_CHANNEL_TLS(opaque);
|
|
ssize_t ret;
|
|
|
|
ret = qio_channel_read(tioc->master, buf, len, NULL);
|
|
if (ret == QIO_CHANNEL_ERR_BLOCK) {
|
|
errno = EAGAIN;
|
|
return -1;
|
|
} else if (ret < 0) {
|
|
errno = EIO;
|
|
return -1;
|
|
}
|
|
return ret;
|
|
}
|
|
|
|
|
|
QIOChannelTLS *
|
|
qio_channel_tls_new_server(QIOChannel *master,
|
|
QCryptoTLSCreds *creds,
|
|
const char *aclname,
|
|
Error **errp)
|
|
{
|
|
QIOChannelTLS *tioc;
|
|
QIOChannel *ioc;
|
|
|
|
tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
|
|
ioc = QIO_CHANNEL(tioc);
|
|
|
|
tioc->master = master;
|
|
ioc->follow_coroutine_ctx = master->follow_coroutine_ctx;
|
|
if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
|
|
qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
|
|
}
|
|
object_ref(OBJECT(master));
|
|
|
|
tioc->session = qcrypto_tls_session_new(
|
|
creds,
|
|
NULL,
|
|
aclname,
|
|
QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
|
|
errp);
|
|
if (!tioc->session) {
|
|
goto error;
|
|
}
|
|
|
|
qcrypto_tls_session_set_callbacks(
|
|
tioc->session,
|
|
qio_channel_tls_write_handler,
|
|
qio_channel_tls_read_handler,
|
|
tioc);
|
|
|
|
trace_qio_channel_tls_new_server(tioc, master, creds, aclname);
|
|
return tioc;
|
|
|
|
error:
|
|
object_unref(OBJECT(tioc));
|
|
return NULL;
|
|
}
|
|
|
|
QIOChannelTLS *
|
|
qio_channel_tls_new_client(QIOChannel *master,
|
|
QCryptoTLSCreds *creds,
|
|
const char *hostname,
|
|
Error **errp)
|
|
{
|
|
QIOChannelTLS *tioc;
|
|
QIOChannel *ioc;
|
|
|
|
tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
|
|
ioc = QIO_CHANNEL(tioc);
|
|
|
|
tioc->master = master;
|
|
ioc->follow_coroutine_ctx = master->follow_coroutine_ctx;
|
|
if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
|
|
qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
|
|
}
|
|
object_ref(OBJECT(master));
|
|
|
|
tioc->session = qcrypto_tls_session_new(
|
|
creds,
|
|
hostname,
|
|
NULL,
|
|
QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT,
|
|
errp);
|
|
if (!tioc->session) {
|
|
goto error;
|
|
}
|
|
|
|
qcrypto_tls_session_set_callbacks(
|
|
tioc->session,
|
|
qio_channel_tls_write_handler,
|
|
qio_channel_tls_read_handler,
|
|
tioc);
|
|
|
|
trace_qio_channel_tls_new_client(tioc, master, creds, hostname);
|
|
return tioc;
|
|
|
|
error:
|
|
object_unref(OBJECT(tioc));
|
|
return NULL;
|
|
}
|
|
|
|
struct QIOChannelTLSData {
|
|
QIOTask *task;
|
|
GMainContext *context;
|
|
};
|
|
typedef struct QIOChannelTLSData QIOChannelTLSData;
|
|
|
|
static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
|
|
GIOCondition condition,
|
|
gpointer user_data);
|
|
|
|
static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
|
|
QIOTask *task,
|
|
GMainContext *context)
|
|
{
|
|
Error *err = NULL;
|
|
QCryptoTLSSessionHandshakeStatus status;
|
|
|
|
if (qcrypto_tls_session_handshake(ioc->session, &err) < 0) {
|
|
trace_qio_channel_tls_handshake_fail(ioc);
|
|
qio_task_set_error(task, err);
|
|
qio_task_complete(task);
|
|
return;
|
|
}
|
|
|
|
status = qcrypto_tls_session_get_handshake_status(ioc->session);
|
|
if (status == QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
|
|
trace_qio_channel_tls_handshake_complete(ioc);
|
|
if (qcrypto_tls_session_check_credentials(ioc->session,
|
|
&err) < 0) {
|
|
trace_qio_channel_tls_credentials_deny(ioc);
|
|
qio_task_set_error(task, err);
|
|
} else {
|
|
trace_qio_channel_tls_credentials_allow(ioc);
|
|
}
|
|
qio_task_complete(task);
|
|
} else {
|
|
GIOCondition condition;
|
|
QIOChannelTLSData *data = g_new0(typeof(*data), 1);
|
|
|
|
data->task = task;
|
|
data->context = context;
|
|
|
|
if (context) {
|
|
g_main_context_ref(context);
|
|
}
|
|
|
|
if (status == QCRYPTO_TLS_HANDSHAKE_SENDING) {
|
|
condition = G_IO_OUT;
|
|
} else {
|
|
condition = G_IO_IN;
|
|
}
|
|
|
|
trace_qio_channel_tls_handshake_pending(ioc, status);
|
|
ioc->hs_ioc_tag =
|
|
qio_channel_add_watch_full(ioc->master,
|
|
condition,
|
|
qio_channel_tls_handshake_io,
|
|
data,
|
|
NULL,
|
|
context);
|
|
}
|
|
}
|
|
|
|
|
|
static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
|
|
GIOCondition condition,
|
|
gpointer user_data)
|
|
{
|
|
QIOChannelTLSData *data = user_data;
|
|
QIOTask *task = data->task;
|
|
GMainContext *context = data->context;
|
|
QIOChannelTLS *tioc = QIO_CHANNEL_TLS(
|
|
qio_task_get_source(task));
|
|
|
|
tioc->hs_ioc_tag = 0;
|
|
g_free(data);
|
|
qio_channel_tls_handshake_task(tioc, task, context);
|
|
|
|
if (context) {
|
|
g_main_context_unref(context);
|
|
}
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
void qio_channel_tls_handshake(QIOChannelTLS *ioc,
|
|
QIOTaskFunc func,
|
|
gpointer opaque,
|
|
GDestroyNotify destroy,
|
|
GMainContext *context)
|
|
{
|
|
QIOTask *task;
|
|
|
|
task = qio_task_new(OBJECT(ioc),
|
|
func, opaque, destroy);
|
|
|
|
trace_qio_channel_tls_handshake_start(ioc);
|
|
qio_channel_tls_handshake_task(ioc, task, context);
|
|
}
|
|
|
|
|
|
static void qio_channel_tls_init(Object *obj G_GNUC_UNUSED)
|
|
{
|
|
}
|
|
|
|
|
|
static void qio_channel_tls_finalize(Object *obj)
|
|
{
|
|
QIOChannelTLS *ioc = QIO_CHANNEL_TLS(obj);
|
|
|
|
object_unref(OBJECT(ioc->master));
|
|
qcrypto_tls_session_free(ioc->session);
|
|
}
|
|
|
|
|
|
static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
|
|
const struct iovec *iov,
|
|
size_t niov,
|
|
int **fds,
|
|
size_t *nfds,
|
|
int flags,
|
|
Error **errp)
|
|
{
|
|
QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
|
|
size_t i;
|
|
ssize_t got = 0;
|
|
|
|
for (i = 0 ; i < niov ; i++) {
|
|
ssize_t ret = qcrypto_tls_session_read(tioc->session,
|
|
iov[i].iov_base,
|
|
iov[i].iov_len);
|
|
if (ret < 0) {
|
|
if (errno == EAGAIN) {
|
|
if (got) {
|
|
return got;
|
|
} else {
|
|
return QIO_CHANNEL_ERR_BLOCK;
|
|
}
|
|
} else if (errno == ECONNABORTED &&
|
|
(qatomic_load_acquire(&tioc->shutdown) &
|
|
QIO_CHANNEL_SHUTDOWN_READ)) {
|
|
return 0;
|
|
}
|
|
|
|
error_setg_errno(errp, errno,
|
|
"Cannot read from TLS channel");
|
|
return -1;
|
|
}
|
|
got += ret;
|
|
if (ret < iov[i].iov_len) {
|
|
break;
|
|
}
|
|
}
|
|
return got;
|
|
}
|
|
|
|
|
|
static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
|
|
const struct iovec *iov,
|
|
size_t niov,
|
|
int *fds,
|
|
size_t nfds,
|
|
int flags,
|
|
Error **errp)
|
|
{
|
|
QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
|
|
size_t i;
|
|
ssize_t done = 0;
|
|
|
|
for (i = 0 ; i < niov ; i++) {
|
|
ssize_t ret = qcrypto_tls_session_write(tioc->session,
|
|
iov[i].iov_base,
|
|
iov[i].iov_len);
|
|
if (ret <= 0) {
|
|
if (errno == EAGAIN) {
|
|
if (done) {
|
|
return done;
|
|
} else {
|
|
return QIO_CHANNEL_ERR_BLOCK;
|
|
}
|
|
}
|
|
|
|
error_setg_errno(errp, errno,
|
|
"Cannot write to TLS channel");
|
|
return -1;
|
|
}
|
|
done += ret;
|
|
if (ret < iov[i].iov_len) {
|
|
break;
|
|
}
|
|
}
|
|
return done;
|
|
}
|
|
|
|
static int qio_channel_tls_set_blocking(QIOChannel *ioc,
|
|
bool enabled,
|
|
Error **errp)
|
|
{
|
|
QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
|
|
|
|
return qio_channel_set_blocking(tioc->master, enabled, errp);
|
|
}
|
|
|
|
static void qio_channel_tls_set_delay(QIOChannel *ioc,
|
|
bool enabled)
|
|
{
|
|
QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
|
|
|
|
qio_channel_set_delay(tioc->master, enabled);
|
|
}
|
|
|
|
static void qio_channel_tls_set_cork(QIOChannel *ioc,
|
|
bool enabled)
|
|
{
|
|
QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
|
|
|
|
qio_channel_set_cork(tioc->master, enabled);
|
|
}
|
|
|
|
static int qio_channel_tls_shutdown(QIOChannel *ioc,
|
|
QIOChannelShutdown how,
|
|
Error **errp)
|
|
{
|
|
QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
|
|
|
|
qatomic_or(&tioc->shutdown, how);
|
|
|
|
return qio_channel_shutdown(tioc->master, how, errp);
|
|
}
|
|
|
|
static int qio_channel_tls_close(QIOChannel *ioc,
|
|
Error **errp)
|
|
{
|
|
QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
|
|
|
|
if (tioc->hs_ioc_tag) {
|
|
trace_qio_channel_tls_handshake_cancel(ioc);
|
|
g_clear_handle_id(&tioc->hs_ioc_tag, g_source_remove);
|
|
}
|
|
|
|
return qio_channel_close(tioc->master, errp);
|
|
}
|
|
|
|
static void qio_channel_tls_set_aio_fd_handler(QIOChannel *ioc,
|
|
AioContext *read_ctx,
|
|
IOHandler *io_read,
|
|
AioContext *write_ctx,
|
|
IOHandler *io_write,
|
|
void *opaque)
|
|
{
|
|
QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
|
|
|
|
qio_channel_set_aio_fd_handler(tioc->master, read_ctx, io_read,
|
|
write_ctx, io_write, opaque);
|
|
}
|
|
|
|
typedef struct QIOChannelTLSSource QIOChannelTLSSource;
|
|
struct QIOChannelTLSSource {
|
|
GSource parent;
|
|
QIOChannelTLS *tioc;
|
|
};
|
|
|
|
static gboolean
|
|
qio_channel_tls_source_check(GSource *source)
|
|
{
|
|
QIOChannelTLSSource *tsource = (QIOChannelTLSSource *)source;
|
|
|
|
return qcrypto_tls_session_check_pending(tsource->tioc->session) > 0;
|
|
}
|
|
|
|
static gboolean
|
|
qio_channel_tls_source_prepare(GSource *source, gint *timeout)
|
|
{
|
|
*timeout = -1;
|
|
return qio_channel_tls_source_check(source);
|
|
}
|
|
|
|
static gboolean
|
|
qio_channel_tls_source_dispatch(GSource *source, GSourceFunc callback,
|
|
gpointer user_data)
|
|
{
|
|
return G_SOURCE_CONTINUE;
|
|
}
|
|
|
|
static void
|
|
qio_channel_tls_source_finalize(GSource *source)
|
|
{
|
|
QIOChannelTLSSource *tsource = (QIOChannelTLSSource *)source;
|
|
|
|
object_unref(OBJECT(tsource->tioc));
|
|
}
|
|
|
|
static GSourceFuncs qio_channel_tls_source_funcs = {
|
|
qio_channel_tls_source_prepare,
|
|
qio_channel_tls_source_check,
|
|
qio_channel_tls_source_dispatch,
|
|
qio_channel_tls_source_finalize
|
|
};
|
|
|
|
static void
|
|
qio_channel_tls_read_watch(QIOChannelTLS *tioc, GSource *source)
|
|
{
|
|
GSource *child;
|
|
QIOChannelTLSSource *tlssource;
|
|
|
|
child = g_source_new(&qio_channel_tls_source_funcs,
|
|
sizeof(QIOChannelTLSSource));
|
|
tlssource = (QIOChannelTLSSource *)child;
|
|
|
|
tlssource->tioc = tioc;
|
|
object_ref(OBJECT(tioc));
|
|
|
|
g_source_add_child_source(source, child);
|
|
g_source_unref(child);
|
|
}
|
|
|
|
static GSource *qio_channel_tls_create_watch(QIOChannel *ioc,
|
|
GIOCondition condition)
|
|
{
|
|
QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
|
|
GSource *source = qio_channel_create_watch(tioc->master, condition);
|
|
|
|
if (condition & G_IO_IN) {
|
|
qio_channel_tls_read_watch(tioc, source);
|
|
}
|
|
|
|
return source;
|
|
}
|
|
|
|
QCryptoTLSSession *
|
|
qio_channel_tls_get_session(QIOChannelTLS *ioc)
|
|
{
|
|
return ioc->session;
|
|
}
|
|
|
|
static void qio_channel_tls_class_init(ObjectClass *klass,
|
|
void *class_data G_GNUC_UNUSED)
|
|
{
|
|
QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
|
|
|
|
ioc_klass->io_writev = qio_channel_tls_writev;
|
|
ioc_klass->io_readv = qio_channel_tls_readv;
|
|
ioc_klass->io_set_blocking = qio_channel_tls_set_blocking;
|
|
ioc_klass->io_set_delay = qio_channel_tls_set_delay;
|
|
ioc_klass->io_set_cork = qio_channel_tls_set_cork;
|
|
ioc_klass->io_close = qio_channel_tls_close;
|
|
ioc_klass->io_shutdown = qio_channel_tls_shutdown;
|
|
ioc_klass->io_create_watch = qio_channel_tls_create_watch;
|
|
ioc_klass->io_set_aio_fd_handler = qio_channel_tls_set_aio_fd_handler;
|
|
}
|
|
|
|
static const TypeInfo qio_channel_tls_info = {
|
|
.parent = TYPE_QIO_CHANNEL,
|
|
.name = TYPE_QIO_CHANNEL_TLS,
|
|
.instance_size = sizeof(QIOChannelTLS),
|
|
.instance_init = qio_channel_tls_init,
|
|
.instance_finalize = qio_channel_tls_finalize,
|
|
.class_init = qio_channel_tls_class_init,
|
|
};
|
|
|
|
static void qio_channel_tls_register_types(void)
|
|
{
|
|
type_register_static(&qio_channel_tls_info);
|
|
}
|
|
|
|
type_init(qio_channel_tls_register_types);
|