session: first approximation implementation of tls
It consists of two main parts. First, add an application transport type
whereby applications can offer transport to other applications. For
instance, a tls app can offer transport services to other applications.
And second, a tls transport app that leverages the mbedtls library for
tls protocol implementation.
Change-Id: I616996c6e6539a9e2368fab8a1ac874d7c5d9838
Signed-off-by: Florin Coras <fcoras@cisco.com>
diff --git a/src/vnet/session/application.c b/src/vnet/session/application.c
index b80aa33..12f816b 100644
--- a/src/vnet/session/application.c
+++ b/src/vnet/session/application.c
@@ -209,6 +209,9 @@
*/
application_local_sessions_del (app);
+ vec_free (app->tls_cert);
+ vec_free (app->tls_key);
+
application_table_del (app);
pool_put (app_pool, app);
}
@@ -473,10 +476,22 @@
application_open_session (application_t * app, session_endpoint_t * sep,
u32 api_context)
{
- segment_manager_t *sm;
int rv;
/* Make sure we have a segment manager for connects */
+ application_alloc_connects_segment_manager (app);
+
+ if ((rv = session_open (app->index, sep, api_context)))
+ return rv;
+
+ return 0;
+}
+
+int
+application_alloc_connects_segment_manager (application_t * app)
+{
+ segment_manager_t *sm;
+
if (app->connects_seg_manager == APP_INVALID_SEGMENT_MANAGER_INDEX)
{
sm = application_alloc_segment_manager (app);
@@ -484,10 +499,6 @@
return -1;
app->connects_seg_manager = segment_manager_index (sm);
}
-
- if ((rv = session_open (app->index, sep, api_context)))
- return rv;
-
return 0;
}
@@ -1156,6 +1167,30 @@
segment_manager_del (sm);
}
+clib_error_t *
+vnet_app_add_tls_cert (vnet_app_add_tls_cert_args_t * a)
+{
+ application_t *app;
+ app = application_get (a->app_index);
+ if (!app)
+ return clib_error_return_code (0, VNET_API_ERROR_APPLICATION_NOT_ATTACHED,
+ 0, "app %u doesn't exist", a->app_index);
+ app->tls_cert = vec_dup (a->cert);
+ return 0;
+}
+
+clib_error_t *
+vnet_app_add_tls_key (vnet_app_add_tls_key_args_t * a)
+{
+ application_t *app;
+ app = application_get (a->app_index);
+ if (!app)
+ return clib_error_return_code (0, VNET_API_ERROR_APPLICATION_NOT_ATTACHED,
+ 0, "app %u doesn't exist", a->app_index);
+ app->tls_key = vec_dup (a->key);
+ return 0;
+}
+
u8 *
format_application_listener (u8 * s, va_list * args)
{
diff --git a/src/vnet/session/application.h b/src/vnet/session/application.h
index 6fb0f06..8e5c2de 100644
--- a/src/vnet/session/application.h
+++ b/src/vnet/session/application.h
@@ -20,12 +20,6 @@
#include <vnet/session/session.h>
#include <vnet/session/segment_manager.h>
#include <vnet/session/application_namespace.h>
-typedef enum
-{
- APP_SERVER,
- APP_CLIENT,
- APP_N_TYPES
-} application_type_t;
typedef struct _stream_session_cb_vft
{
@@ -49,8 +43,11 @@
/** Notify app that session was reset */
void (*session_reset_callback) (stream_session_t * s);
- /** Direct RX callback, for built-in servers */
- int (*builtin_server_rx_callback) (stream_session_t * session);
+ /** Direct RX callback for built-in application */
+ int (*builtin_app_rx_callback) (stream_session_t * session);
+
+ /** Direct TX callback for built-in application */
+ int (*builtin_app_tx_callback) (stream_session_t * session);
} session_cb_vft_t;
@@ -118,6 +115,16 @@
/** Hash table of the app's local connects */
uword *local_connects;
+
+ /*
+ * TLS Specific
+ */
+
+ /** Certificate to be used for listen sessions */
+ u8 *tls_cert;
+
+ /** PEM encoded key */
+ u8 *tls_key;
} application_t;
#define APP_INVALID_INDEX ((u32)~0)
@@ -152,6 +159,8 @@
ls);
segment_manager_t *application_get_connect_segment_manager (application_t *
app);
+int application_alloc_connects_segment_manager (application_t * app);
+
int application_is_proxy (application_t * app);
int application_is_builtin (application_t * app);
int application_is_builtin_proxy (application_t * app);
@@ -245,6 +254,13 @@
return (tp != TRANSPORT_PROTO_NONE);
}
+void send_local_session_disconnect_callback (u32 app_index,
+ local_session_t * ls);
+
+int application_connect (u32 client_index, u32 api_context,
+ session_endpoint_t * sep);
+
+uword unformat_application_proto (unformat_input_t * input, va_list * args);
#endif /* SRC_VNET_SESSION_APPLICATION_H_ */
diff --git a/src/vnet/session/application_interface.c b/src/vnet/session/application_interface.c
index fd079b5..12a5701 100644
--- a/src/vnet/session/application_interface.c
+++ b/src/vnet/session/application_interface.c
@@ -22,6 +22,61 @@
VPP's application/session API bind/unbind/connect/disconnect calls
*/
+/*
+ * TLS server cert and keys to be used for testing only
+ */
+const char test_srv_crt_rsa[] =
+ "-----BEGIN CERTIFICATE-----\r\n"
+ "MIIDNzCCAh+gAwIBAgIBAjANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER\r\n"
+ "MA8GA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3QgQ0EwHhcN\r\n"
+ "MTEwMjEyMTQ0NDA2WhcNMjEwMjEyMTQ0NDA2WjA0MQswCQYDVQQGEwJOTDERMA8G\r\n"
+ "A1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcN\r\n"
+ "AQEBBQADggEPADCCAQoCggEBAMFNo93nzR3RBNdJcriZrA545Do8Ss86ExbQWuTN\r\n"
+ "owCIp+4ea5anUrSQ7y1yej4kmvy2NKwk9XfgJmSMnLAofaHa6ozmyRyWvP7BBFKz\r\n"
+ "NtSj+uGxdtiQwWG0ZlI2oiZTqqt0Xgd9GYLbKtgfoNkNHC1JZvdbJXNG6AuKT2kM\r\n"
+ "tQCQ4dqCEGZ9rlQri2V5kaHiYcPNQEkI7mgM8YuG0ka/0LiqEQMef1aoGh5EGA8P\r\n"
+ "hYvai0Re4hjGYi/HZo36Xdh98yeJKQHFkA4/J/EwyEoO79bex8cna8cFPXrEAjya\r\n"
+ "HT4P6DSYW8tzS1KW2BGiLICIaTla0w+w3lkvEcf36hIBMJcCAwEAAaNNMEswCQYD\r\n"
+ "VR0TBAIwADAdBgNVHQ4EFgQUpQXoZLjc32APUBJNYKhkr02LQ5MwHwYDVR0jBBgw\r\n"
+ "FoAUtFrkpbPe0lL2udWmlQ/rPrzH/f8wDQYJKoZIhvcNAQEFBQADggEBAJxnXClY\r\n"
+ "oHkbp70cqBrsGXLybA74czbO5RdLEgFs7rHVS9r+c293luS/KdliLScZqAzYVylw\r\n"
+ "UfRWvKMoWhHYKp3dEIS4xTXk6/5zXxhv9Rw8SGc8qn6vITHk1S1mPevtekgasY5Y\r\n"
+ "iWQuM3h4YVlRH3HHEMAD1TnAexfXHHDFQGe+Bd1iAbz1/sH9H8l4StwX6egvTK3M\r\n"
+ "wXRwkKkvjKaEDA9ATbZx0mI8LGsxSuCqe9r9dyjmttd47J1p1Rulz3CLzaRcVIuS\r\n"
+ "RRQfaD8neM9c1S/iJ/amTVqJxA1KOdOS5780WhPfSArA+g4qAmSjelc3p4wWpha8\r\n"
+ "zhuYwjVuX6JHG0c=\r\n" "-----END CERTIFICATE-----\r\n";
+const u32 test_srv_crt_rsa_len = sizeof (test_srv_crt_rsa);
+
+const char test_srv_key_rsa[] =
+ "-----BEGIN RSA PRIVATE KEY-----\r\n"
+ "MIIEpAIBAAKCAQEAwU2j3efNHdEE10lyuJmsDnjkOjxKzzoTFtBa5M2jAIin7h5r\r\n"
+ "lqdStJDvLXJ6PiSa/LY0rCT1d+AmZIycsCh9odrqjObJHJa8/sEEUrM21KP64bF2\r\n"
+ "2JDBYbRmUjaiJlOqq3ReB30Zgtsq2B+g2Q0cLUlm91slc0boC4pPaQy1AJDh2oIQ\r\n"
+ "Zn2uVCuLZXmRoeJhw81ASQjuaAzxi4bSRr/QuKoRAx5/VqgaHkQYDw+Fi9qLRF7i\r\n"
+ "GMZiL8dmjfpd2H3zJ4kpAcWQDj8n8TDISg7v1t7HxydrxwU9esQCPJodPg/oNJhb\r\n"
+ "y3NLUpbYEaIsgIhpOVrTD7DeWS8Rx/fqEgEwlwIDAQABAoIBAQCXR0S8EIHFGORZ\r\n"
+ "++AtOg6eENxD+xVs0f1IeGz57Tjo3QnXX7VBZNdj+p1ECvhCE/G7XnkgU5hLZX+G\r\n"
+ "Z0jkz/tqJOI0vRSdLBbipHnWouyBQ4e/A1yIJdlBtqXxJ1KE/ituHRbNc4j4kL8Z\r\n"
+ "/r6pvwnTI0PSx2Eqs048YdS92LT6qAv4flbNDxMn2uY7s4ycS4Q8w1JXnCeaAnYm\r\n"
+ "WYI5wxO+bvRELR2Mcz5DmVnL8jRyml6l6582bSv5oufReFIbyPZbQWlXgYnpu6He\r\n"
+ "GTc7E1zKYQGG/9+DQUl/1vQuCPqQwny0tQoX2w5tdYpdMdVm+zkLtbajzdTviJJa\r\n"
+ "TWzL6lt5AoGBAN86+SVeJDcmQJcv4Eq6UhtRr4QGMiQMz0Sod6ettYxYzMgxtw28\r\n"
+ "CIrgpozCc+UaZJLo7UxvC6an85r1b2nKPCLQFaggJ0H4Q0J/sZOhBIXaoBzWxveK\r\n"
+ "nupceKdVxGsFi8CDy86DBfiyFivfBj+47BbaQzPBj7C4rK7UlLjab2rDAoGBAN2u\r\n"
+ "AM2gchoFiu4v1HFL8D7lweEpi6ZnMJjnEu/dEgGQJFjwdpLnPbsj4c75odQ4Gz8g\r\n"
+ "sw9lao9VVzbusoRE/JGI4aTdO0pATXyG7eG1Qu+5Yc1YGXcCrliA2xM9xx+d7f+s\r\n"
+ "mPzN+WIEg5GJDYZDjAzHG5BNvi/FfM1C9dOtjv2dAoGAF0t5KmwbjWHBhcVqO4Ic\r\n"
+ "BVvN3BIlc1ue2YRXEDlxY5b0r8N4XceMgKmW18OHApZxfl8uPDauWZLXOgl4uepv\r\n"
+ "whZC3EuWrSyyICNhLY21Ah7hbIEBPF3L3ZsOwC+UErL+dXWLdB56Jgy3gZaBeW7b\r\n"
+ "vDrEnocJbqCm7IukhXHOBK8CgYEAwqdHB0hqyNSzIOGY7v9abzB6pUdA3BZiQvEs\r\n"
+ "3LjHVd4HPJ2x0N8CgrBIWOE0q8+0hSMmeE96WW/7jD3fPWwCR5zlXknxBQsfv0gP\r\n"
+ "3BC5PR0Qdypz+d+9zfMf625kyit4T/hzwhDveZUzHnk1Cf+IG7Q+TOEnLnWAWBED\r\n"
+ "ISOWmrUCgYAFEmRxgwAc/u+D6t0syCwAYh6POtscq9Y0i9GyWk89NzgC4NdwwbBH\r\n"
+ "4AgahOxIxXx2gxJnq3yfkJfIjwf0s2DyP0kY2y6Ua1OeomPeY9mrIS4tCuDQ6LrE\r\n"
+ "TB6l9VGoxJL4fyHnZb8L5gGvnB1bbD8cL6YPaDiOhcRseC9vBiEuVg==\r\n"
+ "-----END RSA PRIVATE KEY-----\r\n";
+const u32 test_srv_key_rsa_len = sizeof (test_srv_key_rsa);
+
static u8
session_endpoint_is_local (session_endpoint_t * sep)
{
@@ -179,8 +234,8 @@
}
int
-vnet_connect_i (u32 client_index, u32 api_context, session_endpoint_t * sep,
- void *mp)
+application_connect (u32 client_index, u32 api_context,
+ session_endpoint_t * sep)
{
application_t *server, *client;
u32 table_index, server_index, li;
@@ -277,22 +332,23 @@
unformat_vnet_uri (unformat_input_t * input, va_list * args)
{
session_endpoint_t *sep = va_arg (*args, session_endpoint_t *);
- u32 transport_proto = 0;
- if (unformat (input, "%U://%U/%d", unformat_transport_proto,
- &transport_proto, unformat_ip4_address, &sep->ip.ip4,
- &sep->port))
+ u32 transport_proto = 0, port;
+
+ if (unformat
+ (input, "%U://%U/%d", unformat_transport_proto, &transport_proto,
+ unformat_ip4_address, &sep->ip.ip4, &port))
{
sep->transport_proto = transport_proto;
- sep->port = clib_host_to_net_u16 (sep->port);
+ sep->port = clib_host_to_net_u16 (port);
sep->is_ip4 = 1;
return 1;
}
- if (unformat (input, "%U://%U/%d", unformat_transport_proto,
- &transport_proto, unformat_ip6_address, &sep->ip.ip6,
- &sep->port))
+ else if (unformat (input, "%U://%U/%d", unformat_transport_proto,
+ &transport_proto, unformat_ip6_address, &sep->ip.ip6,
+ &port))
{
sep->transport_proto = transport_proto;
- sep->port = clib_host_to_net_u16 (sep->port);
+ sep->port = clib_host_to_net_u16 (port);
sep->is_ip4 = 0;
return 1;
}
@@ -440,8 +496,8 @@
int
vnet_unbind_uri (vnet_unbind_args_t * a)
{
- stream_session_t *listener;
session_endpoint_t sep = SESSION_ENDPOINT_NULL;
+ stream_session_t *listener;
int rv;
rv = parse_uri (a->uri, &sep);
@@ -459,15 +515,15 @@
clib_error_t *
vnet_connect_uri (vnet_connect_args_t * a)
{
- session_endpoint_t sep_null = SESSION_ENDPOINT_NULL;
+ session_endpoint_t sep = SESSION_ENDPOINT_NULL;
int rv;
/* Parse uri */
- a->sep = sep_null;
- rv = parse_uri (a->uri, &a->sep);
+ rv = parse_uri (a->uri, &sep);
if (rv)
return clib_error_return_code (0, rv, 0, "app init: %d", rv);
- if ((rv = vnet_connect_i (a->app_index, a->api_context, &a->sep, a->mp)))
+
+ if ((rv = application_connect (a->app_index, a->api_context, &sep)))
return clib_error_return_code (0, rv, 0, "connect failed");
return 0;
}
@@ -523,8 +579,10 @@
clib_error_t *
vnet_connect (vnet_connect_args_t * a)
{
+ session_endpoint_t *sep = &a->sep;
int rv;
- if ((rv = vnet_connect_i (a->app_index, a->api_context, &a->sep, a->mp)))
+
+ if ((rv = application_connect (a->app_index, a->api_context, sep)))
return clib_error_return_code (0, rv, 0, "connect failed");
return 0;
}
diff --git a/src/vnet/session/application_interface.h b/src/vnet/session/application_interface.h
index 4b7a2df..2ab09d6 100644
--- a/src/vnet/session/application_interface.h
+++ b/src/vnet/session/application_interface.h
@@ -30,7 +30,7 @@
/** Application and segment manager options */
u64 *options;
- /* Namespace id */
+ /** ID of the namespace the app has access to */
u8 *namespace_id;
/** Session to application callback functions */
@@ -80,8 +80,11 @@
typedef struct _vnet_connect_args
{
- char *uri;
- session_endpoint_t sep;
+ union
+ {
+ char *uri;
+ session_endpoint_t sep;
+ };
u32 app_index;
u32 api_context;
@@ -96,6 +99,18 @@
u32 app_index;
} vnet_disconnect_args_t;
+typedef struct _vnet_application_add_tls_cert_args_t
+{
+ u32 app_index;
+ u8 *cert;
+} vnet_app_add_tls_cert_args_t;
+
+typedef struct _vnet_application_add_tls_key_args_t
+{
+ u32 app_index;
+ u8 *key;
+} vnet_app_add_tls_key_args_t;
+
/* Application attach options */
typedef enum
{
@@ -136,24 +151,24 @@
#undef _
} app_options_flags_t;
-clib_error_t *vnet_application_attach (vnet_app_attach_args_t * a);
-int vnet_application_detach (vnet_app_detach_args_t * a);
-
int vnet_bind_uri (vnet_bind_args_t *);
int vnet_unbind_uri (vnet_unbind_args_t * a);
clib_error_t *vnet_connect_uri (vnet_connect_args_t * a);
-int vnet_disconnect_session (vnet_disconnect_args_t * a);
+clib_error_t *vnet_application_attach (vnet_app_attach_args_t * a);
clib_error_t *vnet_bind (vnet_bind_args_t * a);
clib_error_t *vnet_connect (vnet_connect_args_t * a);
clib_error_t *vnet_unbind (vnet_unbind_args_t * a);
+int vnet_application_detach (vnet_app_detach_args_t * a);
+int vnet_disconnect_session (vnet_disconnect_args_t * a);
-int
-api_parse_session_handle (u64 handle, u32 * session_index,
- u32 * thread_index);
+clib_error_t *vnet_app_add_tls_cert (vnet_app_add_tls_cert_args_t * a);
+clib_error_t *vnet_app_add_tls_key (vnet_app_add_tls_key_args_t * a);
-void send_local_session_disconnect_callback (u32 app_index,
- local_session_t * ls);
+extern const char test_srv_crt_rsa[];
+extern const u32 test_srv_crt_rsa_len;
+extern const char test_srv_key_rsa[];
+extern const u32 test_srv_key_rsa_len;
#endif /* __included_uri_h__ */
diff --git a/src/vnet/session/session.api b/src/vnet/session/session.api
index a6739fc..336b51c 100644
--- a/src/vnet/session/session.api
+++ b/src/vnet/session/session.api
@@ -51,6 +51,34 @@
u8 segment_name[128];
};
+/** \brief Application add TLS certificate
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param cert_len - certificate length
+ @param cert - certificate as a string
+*/
+autoreply define application_tls_cert_add {
+ u32 client_index;
+ u32 context;
+ u32 app_index;
+ u16 cert_len;
+ u8 cert[cert_len];
+};
+
+/** \brief Application add TLS key
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param key_len - certificate length
+ @param key - PEM encoded key as a string
+*/
+autoreply define application_tls_key_add {
+ u32 client_index;
+ u32 context;
+ u32 app_index;
+ u16 key_len;
+ u8 key[key_len];
+};
+
/** \brief client->vpp, attach application to session layer
@param client_index - opaque cookie to identify the sender
@param context - sender context, to match reply w/ request
diff --git a/src/vnet/session/session.c b/src/vnet/session/session.c
index de3cbc5..09e3ded 100644
--- a/src/vnet/session/session.c
+++ b/src/vnet/session/session.c
@@ -103,7 +103,7 @@
return s;
}
-static void
+void
session_free (stream_session_t * s)
{
pool_put (session_manager_main.sessions[s->thread_index], s);
@@ -111,7 +111,7 @@
memset (s, 0xFA, sizeof (*s));
}
-static int
+int
session_alloc_fifos (segment_manager_t * sm, stream_session_t * s)
{
svm_fifo_t *server_rx_fifo = 0, *server_tx_fifo = 0;
@@ -463,9 +463,9 @@
return 0;
}
- /* Built-in server? Hand event to the callback... */
- if (app->cb_fns.builtin_server_rx_callback)
- return app->cb_fns.builtin_server_rx_callback (s);
+ /* Built-in app? Hand event to the callback... */
+ if (app->cb_fns.builtin_app_rx_callback)
+ return app->cb_fns.builtin_app_rx_callback (s);
/* If no event, send one */
if (svm_fifo_set_event (s->server_rx_fifo))
@@ -548,13 +548,13 @@
int
session_stream_connect_notify (transport_connection_t * tc, u8 is_fail)
{
- application_t *app;
+ u32 opaque = 0, new_ti, new_si;
stream_session_t *new_s = 0;
- u64 handle;
- u32 opaque = 0;
- int error = 0;
segment_manager_t *sm;
+ application_t *app;
u8 alloc_fifos;
+ int error = 0;
+ u64 handle;
/*
* Find connection handle and cleanup half-open table
@@ -588,7 +588,11 @@
error = -1;
}
else
- new_s->app_index = app->index;
+ {
+ new_s->app_index = app->index;
+ new_si = new_s->session_index;
+ new_ti = new_s->thread_index;
+ }
}
/*
@@ -599,12 +603,18 @@
{
SESSION_DBG ("failed to notify app");
if (!is_fail)
- stream_session_disconnect_transport (new_s);
+ {
+ new_s = session_get (new_si, new_ti);
+ stream_session_disconnect_transport (new_s);
+ }
}
else
{
if (!is_fail)
- new_s->session_state = SESSION_STATE_READY;
+ {
+ new_s = session_get (new_si, new_ti);
+ new_s->session_state = SESSION_STATE_READY;
+ }
}
return error;
@@ -790,6 +800,102 @@
return 0;
}
+int
+session_open_cl (u32 app_index, session_endpoint_t * rmt, u32 opaque)
+{
+ transport_connection_t *tc;
+ transport_endpoint_t *tep;
+ segment_manager_t *sm;
+ stream_session_t *s;
+ application_t *app;
+ int rv;
+
+ tep = session_endpoint_to_transport (rmt);
+ rv = tp_vfts[rmt->transport_proto].open (tep);
+ if (rv < 0)
+ {
+ SESSION_DBG ("Transport failed to open connection.");
+ return VNET_API_ERROR_SESSION_CONNECT;
+ }
+
+ tc = tp_vfts[rmt->transport_proto].get_half_open ((u32) rv);
+
+ /* For dgram type of service, allocate session and fifos now.
+ */
+ app = application_get (app_index);
+ sm = application_get_connect_segment_manager (app);
+
+ if (session_alloc_and_init (sm, tc, 1, &s))
+ return -1;
+ s->app_index = app->index;
+ s->session_state = SESSION_STATE_CONNECTING_READY;
+
+ /* Tell the app about the new event fifo for this session */
+ app->cb_fns.session_connected_callback (app->index, opaque, s, 0);
+
+ return 0;
+}
+
+int
+session_open_vc (u32 app_index, session_endpoint_t * rmt, u32 opaque)
+{
+ transport_connection_t *tc;
+ transport_endpoint_t *tep;
+ u64 handle;
+ int rv;
+
+ /* TODO until udp is fixed */
+ if (rmt->transport_proto == TRANSPORT_PROTO_UDP)
+ return session_open_cl (app_index, rmt, opaque);
+
+ tep = session_endpoint_to_transport (rmt);
+ rv = tp_vfts[rmt->transport_proto].open (tep);
+ if (rv < 0)
+ {
+ SESSION_DBG ("Transport failed to open connection.");
+ return VNET_API_ERROR_SESSION_CONNECT;
+ }
+
+ tc = tp_vfts[rmt->transport_proto].get_half_open ((u32) rv);
+
+ /* If transport offers a stream service, only allocate session once the
+ * connection has been established.
+ * Add connection to half-open table and save app and tc index. The
+ * latter is needed to help establish the connection while the former
+ * is needed when the connect notify comes and we have to notify the
+ * external app
+ */
+ handle = (((u64) app_index) << 32) | (u64) tc->c_index;
+ session_lookup_add_half_open (tc, handle);
+
+ /* Store api_context (opaque) for when the reply comes. Not the nicest
+ * thing but better than allocating a separate half-open pool.
+ */
+ tc->s_index = opaque;
+ return 0;
+}
+
+int
+session_open_app (u32 app_index, session_endpoint_t * rmt, u32 opaque)
+{
+ session_endpoint_extended_t sep;
+ clib_memcpy (&sep, rmt, sizeof (*rmt));
+ sep.app_index = app_index;
+ sep.opaque = opaque;
+
+ return tp_vfts[rmt->transport_proto].open ((transport_endpoint_t *) & sep);
+}
+
+typedef int (*session_open_service_fn) (u32, session_endpoint_t *, u32);
+
+/* *INDENT-OFF* */
+static session_open_service_fn session_open_srv_fns[TRANSPORT_N_SERVICES] = {
+ session_open_vc,
+ session_open_cl,
+ session_open_app,
+};
+/* *INDENT-ON* */
+
/**
* Ask transport to open connection to remote transport endpoint.
*
@@ -806,58 +912,8 @@
int
session_open (u32 app_index, session_endpoint_t * rmt, u32 opaque)
{
- transport_connection_t *tc;
- transport_endpoint_t *tep;
- segment_manager_t *sm;
- stream_session_t *s;
- application_t *app;
- int rv;
- u64 handle;
-
- tep = session_endpoint_to_transport (rmt);
- rv = tp_vfts[rmt->transport_proto].open (tep);
- if (rv < 0)
- {
- SESSION_DBG ("Transport failed to open connection.");
- return VNET_API_ERROR_SESSION_CONNECT;
- }
-
- tc = tp_vfts[rmt->transport_proto].get_half_open ((u32) rv);
-
- /* If transport offers a stream service, only allocate session once the
- * connection has been established.
- */
- if (transport_is_stream (rmt->transport_proto))
- {
- /* Add connection to half-open table and save app and tc index. The
- * latter is needed to help establish the connection while the former
- * is needed when the connect notify comes and we have to notify the
- * external app
- */
- handle = (((u64) app_index) << 32) | (u64) tc->c_index;
- session_lookup_add_half_open (tc, handle);
-
- /* Store api_context (opaque) for when the reply comes. Not the nicest
- * thing but better than allocating a separate half-open pool.
- */
- tc->s_index = opaque;
- }
- /* For dgram type of service, allocate session and fifos now.
- */
- else
- {
- app = application_get (app_index);
- sm = application_get_connect_segment_manager (app);
-
- if (session_alloc_and_init (sm, tc, 1, &s))
- return -1;
- s->app_index = app->index;
- s->session_state = SESSION_STATE_CONNECTING_READY;
-
- /* Tell the app about the new event fifo for this session */
- app->cb_fns.session_connected_callback (app->index, opaque, s, 0);
- }
- return 0;
+ transport_service_type_t tst = tp_vfts[rmt->transport_proto].service_type;
+ return session_open_srv_fns[tst] (app_index, rmt, opaque);
}
/**
@@ -869,7 +925,7 @@
* @param tep Local endpoint to be listened on.
*/
int
-stream_session_listen (stream_session_t * s, session_endpoint_t * sep)
+session_listen_vc (stream_session_t * s, session_endpoint_t * sep)
{
transport_connection_t *tc;
u32 tci;
@@ -895,6 +951,36 @@
return 0;
}
+int
+session_listen_app (stream_session_t * s, session_endpoint_t * sep)
+{
+ session_endpoint_extended_t esep;
+ clib_memcpy (&esep, sep, sizeof (*sep));
+ esep.app_index = s->app_index;
+
+ return tp_vfts[sep->transport_proto].bind (s->session_index,
+ (transport_endpoint_t *) & esep);
+}
+
+typedef int (*session_listen_service_fn) (stream_session_t *,
+ session_endpoint_t *);
+
+/* *INDENT-OFF* */
+static session_listen_service_fn
+session_listen_srv_fns[TRANSPORT_N_SERVICES] = {
+ session_listen_vc,
+ session_listen_vc,
+ session_listen_app,
+};
+/* *INDENT-ON* */
+
+int
+stream_session_listen (stream_session_t * s, session_endpoint_t * sep)
+{
+ transport_service_type_t tst = tp_vfts[sep->transport_proto].service_type;
+ return session_listen_srv_fns[tst] (s, sep);
+}
+
/**
* Ask transport to stop listening on local transport endpoint.
*
@@ -1039,6 +1125,14 @@
return 0;
}
+/* *INDENT-OFF* */
+static session_fifo_rx_fn *session_tx_fns[TRANSPORT_TX_N_FNS] = {
+ session_tx_fifo_peek_and_snd,
+ session_tx_fifo_dequeue_and_snd,
+ session_tx_fifo_dequeue_internal
+};
+/* *INDENT-ON* */
+
/**
* Initialize session layer for given transport proto and ip version
*
@@ -1061,15 +1155,18 @@
vec_validate (smm->session_tx_fns, session_type);
/* *INDENT-OFF* */
- foreach_vlib_main (({
- next_index = vlib_node_add_next (this_vlib_main, session_queue_node.index,
- output_node);
- }));
+ if (output_node != ~0)
+ {
+ foreach_vlib_main (({
+ next_index = vlib_node_add_next (this_vlib_main,
+ session_queue_node.index,
+ output_node);
+ }));
+ }
/* *INDENT-ON* */
smm->session_type_to_next[session_type] = next_index;
- session_manager_set_transport_rx_fn (session_type,
- vft->tx_fifo_offset != 0);
+ smm->session_tx_fns[session_type] = session_tx_fns[vft->tx_type];
}
transport_connection_t *
@@ -1118,8 +1215,7 @@
segment_manager_main_init_args_t _sm_args = { 0 }, *sm_args = &_sm_args;
session_manager_main_t *smm = &session_manager_main;
vlib_thread_main_t *vtm = vlib_get_thread_main ();
- u32 num_threads;
- u32 preallocated_sessions_per_worker;
+ u32 num_threads, preallocated_sessions_per_worker;
int i, j;
num_threads = 1 /* main thread */ + vtm->n_threads;
diff --git a/src/vnet/session/session.h b/src/vnet/session/session.h
index 364c646..a6118d1 100644
--- a/src/vnet/session/session.h
+++ b/src/vnet/session/session.h
@@ -114,6 +114,7 @@
extern session_fifo_rx_fn session_tx_fifo_peek_and_snd;
extern session_fifo_rx_fn session_tx_fifo_dequeue_and_snd;
+extern session_fifo_rx_fn session_tx_fifo_dequeue_internal;
u8 session_node_lookup_fifo_event (svm_fifo_t * f, session_fifo_event_t * e);
@@ -233,6 +234,8 @@
}
stream_session_t *session_alloc (u32 thread_index);
+int session_alloc_fifos (segment_manager_t * sm, stream_session_t * s);
+void session_free (stream_session_t * s);
always_inline stream_session_t *
session_get (u32 si, u32 thread_index)
@@ -453,7 +456,6 @@
u32 stream_session_tx_fifo_max_dequeue (transport_connection_t * tc);
-stream_session_t *session_alloc (u32 thread_index);
int
session_enqueue_stream_connection (transport_connection_t * tc,
vlib_buffer_t * b, u32 offset,
@@ -531,6 +533,13 @@
return s;
}
+always_inline void
+listen_session_parse_handle (session_handle_t handle, u32 * type, u32 * index)
+{
+ *type = handle >> 32;
+ *index = handle & 0xFFFFFFFF;
+}
+
always_inline stream_session_t *
listen_session_new (session_type_t type)
{
@@ -573,18 +582,6 @@
index);
}
-/**
- * Set peek or dequeue function for given session type
- *
- * Reliable transport protocols will probably want to use a peek function
- */
-always_inline void
-session_manager_set_transport_rx_fn (session_type_t type, u8 is_peek)
-{
- session_manager_main.session_tx_fns[type] = (is_peek) ?
- session_tx_fifo_peek_and_snd : session_tx_fifo_dequeue_and_snd;
-}
-
always_inline u8
session_manager_is_enabled ()
{
diff --git a/src/vnet/session/session_api.c b/src/vnet/session/session_api.c
index f21701c..6c2643c 100755
--- a/src/vnet/session/session_api.c
+++ b/src/vnet/session/session_api.c
@@ -56,6 +56,8 @@
_(APP_NAMESPACE_ADD_DEL, app_namespace_add_del) \
_(SESSION_RULE_ADD_DEL, session_rule_add_del) \
_(SESSION_RULES_DUMP, session_rules_dump) \
+_(APPLICATION_TLS_CERT_ADD, application_tls_cert_add) \
+_(APPLICATION_TLS_KEY_ADD, application_tls_key_add) \
static int
session_send_memfd_fd (vl_api_registration_t * reg, const ssvm_private_t * sp)
@@ -1102,6 +1104,64 @@
/* *INDENT-ON* */
}
+static void
+vl_api_application_tls_cert_add_t_handler (vl_api_application_tls_cert_add_t *
+ mp)
+{
+ vl_api_app_namespace_add_del_reply_t *rmp;
+ vnet_app_add_tls_cert_args_t _a, *a = &_a;
+ clib_error_t *error;
+ u32 cert_len;
+ int rv = 0;
+ if (!session_manager_is_enabled ())
+ {
+ rv = VNET_API_ERROR_FEATURE_DISABLED;
+ goto done;
+ }
+ memset (a, 0, sizeof (*a));
+ a->app_index = clib_net_to_host_u32 (mp->app_index);
+ cert_len = clib_net_to_host_u16 (mp->cert_len);
+ vec_validate (a->cert, cert_len);
+ clib_memcpy (a->cert, mp->cert, cert_len);
+ if ((error = vnet_app_add_tls_cert (a)))
+ {
+ rv = clib_error_get_code (error);
+ clib_error_report (error);
+ }
+ vec_free (a->cert);
+done:
+ REPLY_MACRO (VL_API_APPLICATION_TLS_CERT_ADD_REPLY);
+}
+
+static void
+vl_api_application_tls_key_add_t_handler (vl_api_application_tls_key_add_t *
+ mp)
+{
+ vl_api_app_namespace_add_del_reply_t *rmp;
+ vnet_app_add_tls_key_args_t _a, *a = &_a;
+ clib_error_t *error;
+ u32 key_len;
+ int rv = 0;
+ if (!session_manager_is_enabled ())
+ {
+ rv = VNET_API_ERROR_FEATURE_DISABLED;
+ goto done;
+ }
+ memset (a, 0, sizeof (*a));
+ a->app_index = clib_net_to_host_u32 (mp->app_index);
+ key_len = clib_net_to_host_u16 (mp->key_len);
+ vec_validate (a->key, key_len);
+ clib_memcpy (a->key, mp->key, key_len);
+ if ((error = vnet_app_add_tls_key (a)))
+ {
+ rv = clib_error_get_code (error);
+ clib_error_report (error);
+ }
+ vec_free (a->key);
+done:
+ REPLY_MACRO (VL_API_APPLICATION_TLS_KEY_ADD_REPLY);
+}
+
static clib_error_t *
application_reaper_cb (u32 client_index)
{
diff --git a/src/vnet/session/session_debug.h b/src/vnet/session/session_debug.h
index 702fe96..12c667c 100644
--- a/src/vnet/session/session_debug.h
+++ b/src/vnet/session/session_debug.h
@@ -33,7 +33,7 @@
#define SESSION_DEBUG (0 && TRANSPORT_DEBUG)
#define SESSION_DEQ_NODE_EVTS (0)
-#define SESSION_EVT_POLL_DBG (1)
+#define SESSION_EVT_POLL_DBG (0)
#if SESSION_DEBUG
diff --git a/src/vnet/session/session_node.c b/src/vnet/session/session_node.c
index 796056e..9cd0ef1 100644
--- a/src/vnet/session/session_node.c
+++ b/src/vnet/session/session_node.c
@@ -389,6 +389,20 @@
n_tx_pkts, 0);
}
+int
+session_tx_fifo_dequeue_internal (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ session_manager_main_t * smm,
+ session_fifo_event_t * e0,
+ stream_session_t * s0, u32 thread_index,
+ int *n_tx_pkts)
+{
+ application_t *app;
+ app = application_get (s0->opaque);
+ svm_fifo_unset_event (s0->server_tx_fifo);
+ return app->cb_fns.builtin_app_tx_callback (s0);
+}
+
always_inline stream_session_t *
session_event_get_session (session_fifo_event_t * e, u8 thread_index)
{
@@ -505,7 +519,7 @@
clib_memcpy (e, headp, q->elsize);
found = session_node_cmp_event (e, f);
if (found)
- break;
+ return 1;
if (++index == q->maxsize)
index = 0;
}
@@ -657,7 +671,7 @@
continue;
svm_fifo_unset_event (s0->server_rx_fifo);
app = application_get (s0->app_index);
- app->cb_fns.builtin_server_rx_callback (s0);
+ app->cb_fns.builtin_app_rx_callback (s0);
break;
case FIFO_EVENT_RPC:
fp = e0->rpc_args.fp;
diff --git a/src/vnet/session/session_test.c b/src/vnet/session/session_test.c
index 85e8732..91ac351 100644
--- a/src/vnet/session/session_test.c
+++ b/src/vnet/session/session_test.c
@@ -69,12 +69,6 @@
return 0;
}
-int
-dummy_redirect_connect_callback (u32 client_index, void *mp)
-{
- return VNET_API_ERROR_SESSION_REDIRECT;
-}
-
void
dummy_session_disconnect_callback (stream_session_t * s)
{
@@ -104,7 +98,7 @@
.session_connected_callback = dummy_session_connected_callback,
.session_accept_callback = dummy_session_accept_callback,
.session_disconnect_callback = dummy_session_disconnect_callback,
- .builtin_server_rx_callback = dummy_server_rx_callback,
+ .builtin_app_rx_callback = dummy_server_rx_callback,
.add_segment_callback = dummy_add_segment_callback,
.del_segment_callback = dummy_del_segment_callback,
};
@@ -1316,8 +1310,10 @@
SESSION_TEST ((handle == SESSION_DROP_HANDLE), "lookup for 1.2.3.4/32 1234 "
"5.6.7.8/16 432*2* in local table should return deny");
+
connect_args.app_index = server_index;
connect_args.sep = sep;
+
error = vnet_connect (&connect_args);
SESSION_TEST ((error != 0), "connect should fail");
rv = clib_error_get_code (error);
diff --git a/src/vnet/session/stream_session.h b/src/vnet/session/stream_session.h
index 5c4601d..6f6dce6 100644
--- a/src/vnet/session/stream_session.h
+++ b/src/vnet/session/stream_session.h
@@ -85,8 +85,13 @@
/** Transport specific */
u32 connection_index;
- /** Parent listener session if the result of an accept */
- u32 listener_index;
+ union
+ {
+ /** Parent listener session if the result of an accept */
+ u32 listener_index;
+ /** Opaque, for general use */
+ u32 opaque;
+ };
CLIB_CACHE_LINE_ALIGN_MARK (pad);
} stream_session_t;
@@ -133,20 +138,27 @@
CLIB_CACHE_LINE_ALIGN_MARK (pad);
} local_session_t;
+#define foreach_session_endpoint_fields \
+ foreach_transport_connection_fields \
+ _(u8, transport_proto) \
+ _(u8, app_proto) \
+
typedef struct _session_endpoint
{
- /*
- * Network specific
- */
#define _(type, name) type name;
- foreach_transport_connection_fields
+ foreach_session_endpoint_fields
#undef _
- /*
- * Session specific
- */
- u8 transport_proto; /**< transport protocol for session */
} session_endpoint_t;
+typedef struct _session_endpoint_extended
+{
+#define _(type, name) type name;
+ foreach_session_endpoint_fields
+#undef _
+ u32 app_index;
+ u32 opaque;
+} session_endpoint_extended_t;
+
#define SESSION_IP46_ZERO \
{ \
.ip6 = { \
@@ -161,6 +173,7 @@
.is_ip4 = 0, \
.port = 0, \
.transport_proto = 0, \
+ .app_proto = 0, \
}
#define session_endpoint_to_transport(_sep) ((transport_endpoint_t *)_sep)
diff --git a/src/vnet/session/transport.c b/src/vnet/session/transport.c
index acbb4f6..797bdad 100644
--- a/src/vnet/session/transport.c
+++ b/src/vnet/session/transport.c
@@ -96,6 +96,10 @@
*proto = TRANSPORT_PROTO_SCTP;
else if (unformat (input, "SCTP"))
*proto = TRANSPORT_PROTO_SCTP;
+ else if (unformat (input, "tls"))
+ *proto = TRANSPORT_PROTO_TLS;
+ else if (unformat (input, "TLS"))
+ *proto = TRANSPORT_PROTO_TLS;
else
return 0;
return 1;
diff --git a/src/vnet/session/transport.h b/src/vnet/session/transport.h
index 76ee226..ed9eb02 100644
--- a/src/vnet/session/transport.h
+++ b/src/vnet/session/transport.h
@@ -25,20 +25,34 @@
*/
typedef struct _transport_connection
{
- ip46_address_t rmt_ip; /**< Remote IP */
- ip46_address_t lcl_ip; /**< Local IP */
- u16 lcl_port; /**< Local port */
- u16 rmt_port; /**< Remote port */
- u8 proto; /**< Protocol id */
- u8 is_ip4; /**< Flag if IP4 connection */
- u32 fib_index; /**< Network namespace */
+ /** Connection ID */
+ union
+ {
+ /*
+ * Network connection ID tuple
+ */
+ struct
+ {
+ ip46_address_t rmt_ip; /**< Remote IP */
+ ip46_address_t lcl_ip; /**< Local IP */
+ u16 lcl_port; /**< Local port */
+ u16 rmt_port; /**< Remote port */
+ u8 proto; /**< Protocol id */
+ u8 is_ip4; /**< Flag if IP4 connection */
+ u32 fib_index; /**< Network namespace */
+ };
+ /*
+ * Opaque connection ID
+ */
+ u8 opaque_conn_id[42];
+ };
u32 s_index; /**< Parent session index */
u32 c_index; /**< Connection index in transport pool */
u32 thread_index; /**< Worker-thread index */
- fib_node_index_t rmt_fei; /**< FIB entry index for rmt */
- dpo_id_t rmt_dpo; /**< Forwarding DPO for rmt */
+ /*fib_node_index_t rmt_fei;
+ dpo_id_t rmt_dpo; */
#if TRANSPORT_DEBUG
elog_track_t elog_track; /**< Event logging */
@@ -64,6 +78,7 @@
#define c_cc_stat_tstamp connection.cc_stat_tstamp
#define c_rmt_fei connection.rmt_fei
#define c_rmt_dpo connection.rmt_dpo
+#define c_opaque_id connection.opaque_conn_id
} transport_connection_t;
typedef enum _transport_proto
@@ -72,6 +87,7 @@
TRANSPORT_PROTO_UDP,
TRANSPORT_PROTO_SCTP,
TRANSPORT_PROTO_NONE,
+ TRANSPORT_PROTO_TLS,
TRANSPORT_N_PROTO
} transport_proto_t;
diff --git a/src/vnet/session/transport_interface.h b/src/vnet/session/transport_interface.h
index 09542e6..04a5ff2 100644
--- a/src/vnet/session/transport_interface.h
+++ b/src/vnet/session/transport_interface.h
@@ -19,9 +19,26 @@
#include <vnet/vnet.h>
#include <vnet/session/transport.h>
+typedef enum transport_dequeue_type_
+{
+ TRANSPORT_TX_PEEK, /**< reliable transport protos */
+ TRANSPORT_TX_DEQUEUE, /**< unreliable transport protos */
+ TRANSPORT_TX_INTERNAL, /**< apps acting as transports */
+ TRANSPORT_TX_N_FNS
+} transport_tx_fn_type_t;
+
+typedef enum transport_service_type_
+{
+ TRANSPORT_SERVICE_VC, /**< virtual circuit service */
+ TRANSPORT_SERVICE_CL, /**< connectionless service */
+ TRANSPORT_SERVICE_APP, /**< app transport service */
+ TRANSPORT_N_SERVICES
+} transport_service_type_t;
+
/*
* Transport protocol virtual function table
*/
+/* *INDENT-OFF* */
typedef struct _transport_proto_vft
{
/*
@@ -37,10 +54,11 @@
/*
* Transmission
*/
- u32 (*push_header) (transport_connection_t * tconn, vlib_buffer_t * b);
- u16 (*send_mss) (transport_connection_t * tc);
- u32 (*send_space) (transport_connection_t * tc);
- u32 (*tx_fifo_offset) (transport_connection_t * tc);
+
+ u32 (*push_header) (transport_connection_t * tconn, vlib_buffer_t * b);
+ u16 (*send_mss) (transport_connection_t * tc);
+ u32 (*send_space) (transport_connection_t * tc);
+ u32 (*tx_fifo_offset) (transport_connection_t * tc);
void (*update_time) (f64 time_now, u8 thread_index);
/*
@@ -56,11 +74,18 @@
u8 *(*format_connection) (u8 * s, va_list * args);
u8 *(*format_listener) (u8 * s, va_list * args);
u8 *(*format_half_open) (u8 * s, va_list * args);
+
+ /*
+ * Properties
+ */
+ transport_tx_fn_type_t tx_type;
+ transport_service_type_t service_type;
} transport_proto_vft_t;
+/* *INDENT-ON* */
extern transport_proto_vft_t *tp_vfts;
-#define transport_proto_foreach(VAR, BODY) \
+#define transport_proto_foreach(VAR, BODY) \
do { \
for (VAR = 0; VAR < vec_len (tp_vfts); VAR++) \
if (tp_vfts[VAR].push_header != 0) \