SYS-OSS/FRET-qemu
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

crypto: Allow gracefully ending the TLS session

Browse Source 
QEMU's TLS session code provides no way to call gnutls_bye() to
terminate a TLS session. Callers of qcrypto_tls_session_read() can
choose to ignore a GNUTLS_E_PREMATURE_TERMINATION error by setting the
gracefulTermination argument.

The QIOChannelTLS ignores the premature termination error whenever
shutdown() has already been issued. This was found to be not enough for
the migration code because shutdown() might not have been issued before
the connection is terminated.

Add support for calling gnutls_bye() in the tlssession layer so users
of QIOChannelTLS can clearly identify the end of a TLS session.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
This commit is contained in:
Fabiano Rosas 2025-02-05 13:13:53 -03:00
parent 495de0fd82
commit ab1cb3683b
2 changed files with 63 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
crypto/tlssession.c
View File

@ -585,6 +585,40 @@ qcrypto_tls_session_get_handshake_status(QCryptoTLSSession *session)
}
}
int
qcrypto_tls_session_bye(QCryptoTLSSession *session, Error **errp)
{
int ret;
if (!session->handshakeComplete) {
return 0;
}
ret = gnutls_bye(session->handle, GNUTLS_SHUT_WR);
if (!ret) {
return QCRYPTO_TLS_BYE_COMPLETE;
}
if (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN) {
int direction = gnutls_record_get_direction(session->handle);
return direction ? QCRYPTO_TLS_BYE_SENDING : QCRYPTO_TLS_BYE_RECVING;
}
if (session->rerr || session->werr) {
error_setg(errp, "TLS termination failed: %s: %s", gnutls_strerror(ret),
error_get_pretty(session->rerr ?
session->rerr : session->werr));
} else {
error_setg(errp, "TLS termination failed: %s", gnutls_strerror(ret));
}
error_free(session->rerr);
error_free(session->werr);
session->rerr = session->werr = NULL;
return -1;
}
int
qcrypto_tls_session_get_key_size(QCryptoTLSSession *session,
@ -699,6 +733,13 @@ qcrypto_tls_session_get_handshake_status(QCryptoTLSSession *sess)
}
int
qcrypto_tls_session_bye(QCryptoTLSSession *session, Error **errp)
{
return QCRYPTO_TLS_BYE_COMPLETE;
}
int
qcrypto_tls_session_get_key_size(QCryptoTLSSession *sess,
Error **errp)

22
include/crypto/tlssession.h
View File

@ -323,6 +323,28 @@ typedef enum {
QCryptoTLSSessionHandshakeStatus
qcrypto_tls_session_get_handshake_status(QCryptoTLSSession *sess);
typedef enum {
QCRYPTO_TLS_BYE_COMPLETE,
QCRYPTO_TLS_BYE_SENDING,
QCRYPTO_TLS_BYE_RECVING,
} QCryptoTLSSessionByeStatus;
/**
* qcrypto_tls_session_bye:
* @session: the TLS session object
* @errp: pointer to a NULL-initialized error object
*
* Start, or continue, a TLS termination sequence. If the underlying
* data channel is non-blocking, then this method may return control
* before the termination is complete. The return value will indicate
* whether the termination has completed, or is waiting to send or
* receive data. In the latter cases, the caller should setup an event
* loop watch and call this method again once the underlying data
* channel is ready to read or write again.
*/
int
qcrypto_tls_session_bye(QCryptoTLSSession *session, Error **errp);
/**
* qcrypto_tls_session_get_key_size:
* @sess: the TLS session object